uxnan-bridge 0.0.1-alpha.20260621

package/dist/src/index.js

@@ -0,0 +1,65 @@
+/**
+ * uxnan-bridge — public API.
+ *
+ * `startBridge()` boots the daemon core (state, identity, JSON-RPC router).
+ * The live transport and agent runtimes are added in later increments.
+ */
+export { startBridge } from './bridge.js';
+export { BRIDGE_VERSION } from './version.js';
+export { HandlerRouter } from './handler-router.js';
+export { DaemonState, DAEMON_FILES } from './daemon-state.js';
+export { DEFAULT_DAEMON_CONFIG, resolveDaemonConfig, } from './daemon-config.js';
+export { ProjectRegistry, projectIdFor } from './projects/project-registry.js';
+export { PushService, } from './push/push-service.js';
+export { createBridgePushSender, defaultServiceAccountPath, } from './push/push-sender.js';
+export { SessionHistoryReader, } from './conversation/session-history.js';
+export { PairingCodeService, } from './pairing/pairing-code-service.js';
+export { MdnsAdvertiser, parseQuestions, buildMessage, encodeName, } from './transport/mdns-advertiser.js';
+export { SecureDeviceState } from './secure-device-state.js';
+export { InMemorySecretStore } from './secret-store.js';
+export { KeyringSecretStore, createDefaultSecretStore, loadNativeKeyringBackend, } from './keyring-secret-store.js';
+export { SessionState } from './session-state.js';
+export { LockFile, isProcessAlive } from './lock-file.js';
+export { buildServicePlan, buildWindowsStartupPlan, installService, uninstallService, currentServiceEnv, isServicePlatformSupported, } from './service-installer.js';
+export { buildBridgeStatus } from './bridge-status.js';
+export { getAuthStatus } from './account-status.js';
+export { generatePairingPayload, renderPairingQr } from './qr.js';
+export { createLogger, createFileLogger, redactSecrets, logFileFor, } from './logger.js';
+export { BaseAgentAdapter } from './adapters/base-adapter.js';
+export { CodexAdapter, codexUsageTokens, parseCodexConfigModels, parseCodexModelList, parseCodexModelWindows, parseCodexReasoning, } from './adapters/codex-adapter.js';
+export { resolveCodexBinary } from './adapters/resolve-codex.js';
+export { PiAdapter, parsePiLine, parsePiModelList, parsePiUsageTokens, parsePiContextWindow, } from './adapters/pi-adapter.js';
+export { resolvePiBinary } from './adapters/resolve-pi.js';
+export { GeminiAdapter, parseGeminiLine, } from './adapters/gemini-adapter.js';
+export { resolveGeminiBinary } from './adapters/resolve-gemini.js';
+export { OpenCodeAdapter, parseOpenCodeLine, parseModelList, parseOpenCodeModelWindows, openCodeUsageTokens, } from './adapters/opencode-adapter.js';
+export { resolveOpenCodeBinary } from './adapters/resolve-opencode.js';
+export { defaultSpawn } from './adapters/spawn.js';
+export { ClaudeCodeAdapter, claudeContextWindow, claudeUsageTokens, parseClaudeLine, } from './adapters/claude-adapter.js';
+export { resolveClaudeBinary } from './adapters/resolve-claude.js';
+export { EchoAgentAdapter } from './adapters/echo-agent-adapter.js';
+export { ProcessAgentAdapter, } from './adapters/process-agent-adapter.js';
+// Conversation engine
+export { ThreadStore, } from './conversation/thread-store.js';
+export { AgentManager, } from './agents/agent-manager.js';
+// Transport (live E2EE)
+export { MessageQueue, queueFor, createInMemoryIoPair, } from './transport/message-io.js';
+export { generateEphemeralKeyPair, deriveSessionKey, randomHex, verifyEd25519, aesGcmEncrypt, aesGcmDecrypt, } from './transport/crypto.js';
+export { BridgeSecureChannel, ReplayError } from './transport/secure-channel.js';
+export { performServerHandshake, HandshakeError, } from './transport/server-handshake.js';
+export { handleSecureConnection, } from './transport/session-handler.js';
+export { FileTrustStore } from './transport/trust-store.js';
+export { connectRelayAsMac, } from './transport/relay-client.js';
+export { startLanServer, } from './transport/lan-server.js';
+export { wsToMessageIO, rawDataToBuffer } from './transport/ws-adapter.js';
+export { localHostPorts } from './transport/local-hosts.js';
+export { OutboundLog } from './transport/outbound-log.js';
+export { SessionRegistry } from './transport/session-registry.js';
+// Git + workspace services
+export { GitService } from './git/git-service.js';
+export { runGit, GitCommandError, sanitizePaths } from './git/git-runner.js';
+export { WorkspaceService } from './workspace/workspace-service.js';
+export { BrowseService, browseRootIdFor } from './workspace/browse-service.js';
+export { CheckpointService } from './workspace/checkpoint-service.js';
+export { resolveWithinRoot, isSensitiveName } from './workspace/path-guard.js';
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAwC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,EAAE,aAAa,EAAmB,MAAM,qBAAqB,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAIpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EACL,WAAW,GAIZ,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GAGrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,kBAAkB,GAEnB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,UAAU,GAGX,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAuB,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAoB,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,GAEzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,GAK3B,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAA0B,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAA0B,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAA+B,MAAM,SAAS,CAAC;AAC/F,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,UAAU,GAIX,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GAKpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAsB,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACL,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,GAIrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAmB,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EACL,aAAa,EACb,eAAe,GAIhB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAuB,MAAM,8BAA8B,CAAC;AACxF,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,yBAAyB,EACzB,mBAAmB,GAGpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAyB,MAAM,gCAAgC,CAAC;AAC9F,OAAO,EAAE,YAAY,EAAqC,MAAM,qBAAqB,CAAC;AACtF,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,GAKhB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAuB,MAAM,8BAA8B,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EACL,mBAAmB,GAEpB,MAAM,qCAAqC,CAAC;AAE7C,sBAAsB;AACtB,OAAO,EACL,WAAW,GAIZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,GAIb,MAAM,2BAA2B,CAAC;AAEnC,wBAAwB;AACxB,OAAO,EAEL,YAAY,EACZ,QAAQ,EACR,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,aAAa,EACb,aAAa,GAGd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,cAAc,GAGf,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,cAAc,EAAmB,MAAM,4BAA4B,CAAC;AAC7E,OAAO,EACL,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,cAAc,GAGf,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAqB,MAAM,4BAA4B,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAyB,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,eAAe,EAAoB,MAAM,iCAAiC,CAAC;AAEpF,2BAA2B;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,aAAa,EAAqB,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,iBAAiB,EAAuB,MAAM,mCAAmC,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/keyring-secret-store.d.ts

@@ -0,0 +1,36 @@
+/**
+ * OS-keychain-backed {@link SecretStore} (Windows Credential Manager, macOS
+ * Keychain, Linux Secret Service) via the optional `@napi-rs/keyring` native
+ * module. The bridge's Ed25519 identity is a secret and (per AGENTS.md) must
+ * never be persisted in plaintext — this is how it survives restarts.
+ *
+ * The native module is optional and loaded lazily; if it is unavailable (e.g. a
+ * headless Linux box with no Secret Service), the caller falls back to an
+ * in-memory store via {@link createDefaultSecretStore} — the bridge still runs,
+ * but the identity is ephemeral (real pairing then requires the keychain).
+ */
+import type { SecretStore } from './secret-store.js';
+import type { Logger } from './logger.js';
+/** Minimal synchronous keychain backend (one entry per service+account). */
+export interface KeyringBackend {
+    getPassword(service: string, account: string): string | null;
+    setPassword(service: string, account: string, password: string): void;
+    deletePassword(service: string, account: string): boolean;
+}
+export declare class KeyringSecretStore implements SecretStore {
+    #private;
+    constructor(backend: KeyringBackend, service?: string);
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/**
+ * Lazily load `@napi-rs/keyring` and adapt it to {@link KeyringBackend}.
+ * Returns `null` if the module (or its native binary) is unavailable.
+ */
+export declare function loadNativeKeyringBackend(): Promise<KeyringBackend | null>;
+/**
+ * Build the default secret store: the OS keychain when available, otherwise a
+ * warned in-memory fallback.
+ */
+export declare function createDefaultSecretStore(logger?: Logger): Promise<SecretStore>;

package/dist/src/keyring-secret-store.js

@@ -0,0 +1,70 @@
+import { InMemorySecretStore } from './secret-store.js';
+const SERVICE_NAME = 'uxnan-bridge';
+export class KeyringSecretStore {
+    #backend;
+    #service;
+    constructor(backend, service = SERVICE_NAME) {
+        this.#backend = backend;
+        this.#service = service;
+    }
+    get(key) {
+        return Promise.resolve(this.#backend.getPassword(this.#service, key));
+    }
+    set(key, value) {
+        this.#backend.setPassword(this.#service, key, value);
+        return Promise.resolve();
+    }
+    delete(key) {
+        this.#backend.deletePassword(this.#service, key);
+        return Promise.resolve();
+    }
+}
+/**
+ * Lazily load `@napi-rs/keyring` and adapt it to {@link KeyringBackend}.
+ * Returns `null` if the module (or its native binary) is unavailable.
+ */
+export async function loadNativeKeyringBackend() {
+    try {
+        const mod = (await import('@napi-rs/keyring'));
+        const { Entry } = mod;
+        return {
+            getPassword: (service, account) => {
+                try {
+                    return new Entry(service, account).getPassword();
+                }
+                catch {
+                    return null; // no entry / locked keychain
+                }
+            },
+            setPassword: (service, account, password) => {
+                new Entry(service, account).setPassword(password);
+            },
+            deletePassword: (service, account) => {
+                try {
+                    return new Entry(service, account).deletePassword();
+                }
+                catch {
+                    return false;
+                }
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Build the default secret store: the OS keychain when available, otherwise a
+ * warned in-memory fallback.
+ */
+export async function createDefaultSecretStore(logger) {
+    const backend = await loadNativeKeyringBackend();
+    if (backend) {
+        return new KeyringSecretStore(backend);
+    }
+    logger?.warn('OS keychain unavailable (@napi-rs/keyring not loaded); using an in-memory ' +
+        'identity store. The bridge identity will NOT survive restarts — install a ' +
+        'working keychain before real pairing. See bridge/FOR-DEV.md.');
+    return new InMemorySecretStore();
+}
+//# sourceMappingURL=keyring-secret-store.js.map

package/dist/src/keyring-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring-secret-store.js","sourceRoot":"","sources":["../../src/keyring-secret-store.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAGxD,MAAM,YAAY,GAAG,cAAc,CAAC;AASpC,MAAM,OAAO,kBAAkB;IACpB,QAAQ,CAAiB;IACzB,QAAQ,CAAS;IAE1B,YAAY,OAAuB,EAAE,UAAkB,YAAY;QACjE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED,GAAG,CAAC,GAAW;QACb,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAS5C,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,OAAO;YACL,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBAChC,IAAI,CAAC;oBACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,IAAI,CAAC,CAAC,6BAA6B;gBAC5C,CAAC;YACH,CAAC;YACD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;gBAC1C,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;YACpD,CAAC;YACD,cAAc,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACnC,IAAI,CAAC;oBACH,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAe;IAC5D,MAAM,OAAO,GAAG,MAAM,wBAAwB,EAAE,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,EAAE,IAAI,CACV,4EAA4E;QAC1E,4EAA4E;QAC5E,8DAA8D,CACjE,CAAC;IACF,OAAO,IAAI,mBAAmB,EAAE,CAAC;AACnC,CAAC"}

package/dist/src/lock-file.d.ts

@@ -0,0 +1,18 @@
+export interface LockInfo {
+    pid: number;
+    startedAt: number;
+}
+/** Whether a process with the given pid is currently alive. */
+export declare function isProcessAlive(pid: number): boolean;
+export declare class LockFile {
+    #private;
+    constructor(path: string);
+    read(): Promise<LockInfo | null>;
+    /**
+     * Try to acquire the lock. Returns `true` on success, or `false` if another
+     * live process already holds it. Stale locks are overwritten.
+     */
+    acquire(pid?: number, now?: number): Promise<boolean>;
+    /** Release the lock if it is owned by `pid` (no-op otherwise). */
+    release(pid?: number): Promise<void>;
+}

package/dist/src/lock-file.js

@@ -0,0 +1,60 @@
+/**
+ * Single-instance lock for the daemon (`~/.uxnan/bridge.lock`).
+ *
+ * Prevents a standalone bridge and an embedded one (or two standalone daemons)
+ * from running at once and fighting over the relay identity and LAN port
+ * (architecture/02e-bridge-integration.md §7.3). A lock owned by a process that
+ * is no longer alive is considered stale and may be taken over.
+ */
+import { readFile, unlink, writeFile } from 'node:fs/promises';
+/** Whether a process with the given pid is currently alive. */
+export function isProcessAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // ESRCH → no such process; EPERM → exists but not signalable (alive).
+        return err.code === 'EPERM';
+    }
+}
+export class LockFile {
+    #path;
+    constructor(path) {
+        this.#path = path;
+    }
+    async read() {
+        try {
+            const raw = await readFile(this.#path, 'utf-8');
+            return JSON.parse(raw);
+        }
+        catch {
+            return null; // missing or corrupt → treat as no lock
+        }
+    }
+    /**
+     * Try to acquire the lock. Returns `true` on success, or `false` if another
+     * live process already holds it. Stale locks are overwritten.
+     */
+    async acquire(pid = process.pid, now = Date.now()) {
+        const existing = await this.read();
+        if (existing && existing.pid !== pid && isProcessAlive(existing.pid)) {
+            return false;
+        }
+        await writeFile(this.#path, JSON.stringify({ pid, startedAt: now }), 'utf-8');
+        return true;
+    }
+    /** Release the lock if it is owned by `pid` (no-op otherwise). */
+    async release(pid = process.pid) {
+        const existing = await this.read();
+        if (existing && existing.pid !== pid)
+            return;
+        try {
+            await unlink(this.#path);
+        }
+        catch {
+            // already gone
+        }
+    }
+}
+//# sourceMappingURL=lock-file.js.map

package/dist/src/lock-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-file.js","sourceRoot":"","sources":["../../src/lock-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAO/D,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,sEAAsE;QACtE,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,OAAO,QAAQ;IACV,KAAK,CAAS;IAEvB,YAAY,IAAY;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,wCAAwC;QACvD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,OAAO,CAAC,MAAc,OAAO,CAAC,GAAG;QACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;CACF"}

package/dist/src/logger.d.ts

@@ -0,0 +1,28 @@
+export type LogLevel = 'debug' | 'info' | 'warn' | 'error';
+export interface Logger {
+    debug(message: string, ...rest: unknown[]): void;
+    info(message: string, ...rest: unknown[]): void;
+    warn(message: string, ...rest: unknown[]): void;
+    error(message: string, ...rest: unknown[]): void;
+}
+/** Mask obvious secrets in a log line. Best-effort defense-in-depth. */
+export declare function redactSecrets(text: string): string;
+/** Console-only logger (stderr). */
+export declare function createLogger(scope: string, minLevel?: LogLevel): Logger;
+export interface FileLoggerOptions {
+    scope: string;
+    minLevel?: LogLevel;
+    /** Directory for daily log files (`bridge-YYYY-MM-DD.log`). */
+    logDir: string;
+    /** Also write to stderr (default true). */
+    toConsole?: boolean;
+    /** Injected clock for the timestamp + rotation filename (default `new Date()`). */
+    now?: () => Date;
+}
+/**
+ * Logger that writes to stderr and appends to a daily-rotated file. Logging never
+ * throws: file errors are swallowed so a logging failure can't crash the daemon.
+ */
+export declare function createFileLogger(options: FileLoggerOptions): Logger;
+/** `<dir>/bridge-YYYY-MM-DD.log` for the given date. */
+export declare function logFileFor(dir: string, date: Date): string;

package/dist/src/logger.js

@@ -0,0 +1,99 @@
+/**
+ * Leveled logger for the bridge daemon, with optional file output (daily
+ * rotation under `~/.uxnan/logs/`) and a secret-redaction pass.
+ *
+ * Security (AGENTS.md): callers should not pass secrets to the logger, and
+ * {@link redactSecrets} is a defense-in-depth net that masks obvious secrets
+ * (JWTs, `key=…`/`token=…`/`secret=…` values, PEM key blocks) before they are
+ * written anywhere. All log output goes to stderr; stdout is reserved for IPC.
+ *
+ * Source: architecture/02a-system-architecture.md §5.8.3.
+ */
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+const LEVEL_ORDER = { debug: 10, info: 20, warn: 30, error: 40 };
+/** Mask obvious secrets in a log line. Best-effort defense-in-depth. */
+export function redactSecrets(text) {
+    return (text
+        // JWT-like a.b.c
+        .replace(/\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g, '[REDACTED-JWT]')
+        // key=value / "token": "value" for secret-ish keys
+        .replace(/\b(token|secret|password|passwd|api[_-]?key|authorization|bearer|notificationSecret|privateKey|private_key)\b(["']?\s*[:=]\s*["']?)([^\s"',}]+)/gi, (_m, key, sep) => `${key}${sep}[REDACTED]`)
+        // PEM blocks
+        .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, '[REDACTED-KEY]'));
+}
+function stringify(value) {
+    if (typeof value === 'string')
+        return value;
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+function formatLine(input) {
+    const prefix = input.timestamp ? `[${input.timestamp}] ` : '';
+    const extra = input.rest.length > 0 ? ` ${input.rest.map(stringify).join(' ')}` : '';
+    return redactSecrets(`${prefix}[${input.level.toUpperCase()}] (${input.scope}) ${input.message}${extra}`);
+}
+/** Console-only logger (stderr). */
+export function createLogger(scope, minLevel = 'info') {
+    const threshold = LEVEL_ORDER[minLevel];
+    const emit = (level, message, rest) => {
+        if (LEVEL_ORDER[level] < threshold)
+            return;
+        console.error(formatLine({ level, scope, message, rest }));
+    };
+    return {
+        debug: (m, ...r) => emit('debug', m, r),
+        info: (m, ...r) => emit('info', m, r),
+        warn: (m, ...r) => emit('warn', m, r),
+        error: (m, ...r) => emit('error', m, r),
+    };
+}
+/**
+ * Logger that writes to stderr and appends to a daily-rotated file. Logging never
+ * throws: file errors are swallowed so a logging failure can't crash the daemon.
+ */
+export function createFileLogger(options) {
+    const threshold = LEVEL_ORDER[options.minLevel ?? 'info'];
+    const now = options.now ?? (() => new Date());
+    const toConsole = options.toConsole !== false;
+    let ensured = false;
+    const emit = (level, message, rest) => {
+        if (LEVEL_ORDER[level] < threshold)
+            return;
+        const date = now();
+        const line = formatLine({
+            level,
+            scope: options.scope,
+            message,
+            rest,
+            timestamp: date.toISOString(),
+        });
+        if (toConsole)
+            console.error(line);
+        try {
+            if (!ensured) {
+                mkdirSync(options.logDir, { recursive: true });
+                ensured = true;
+            }
+            appendFileSync(logFileFor(options.logDir, date), `${line}\n`);
+        }
+        catch {
+            // logging must never throw
+        }
+    };
+    return {
+        debug: (m, ...r) => emit('debug', m, r),
+        info: (m, ...r) => emit('info', m, r),
+        warn: (m, ...r) => emit('warn', m, r),
+        error: (m, ...r) => emit('error', m, r),
+    };
+}
+/** `<dir>/bridge-YYYY-MM-DD.log` for the given date. */
+export function logFileFor(dir, date) {
+    return join(dir, `bridge-${date.toISOString().slice(0, 10)}.log`);
+}
+//# sourceMappingURL=logger.js.map

package/dist/src/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,MAAM,WAAW,GAA6B,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AAS3F,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CACL,IAAI;QACF,iBAAiB;SAChB,OAAO,CAAC,8DAA8D,EAAE,gBAAgB,CAAC;QAC1F,mDAAmD;SAClD,OAAO,CACN,mJAAmJ,EACnJ,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,YAAY,CAC3D;QACD,aAAa;SACZ,OAAO,CACN,6EAA6E,EAC7E,gBAAgB,CACjB,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAUD,SAAS,UAAU,CAAC,KAAkB;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,OAAO,aAAa,CAClB,GAAG,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,GAAG,KAAK,EAAE,CACpF,CAAC;AACJ,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,WAAqB,MAAM;IACrE,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAAe,EAAQ,EAAE;QACvE,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS;YAAE,OAAO;QAC3C,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAaD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA0B;IACzD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,OAAe,EAAE,IAAe,EAAQ,EAAE;QACvE,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,SAAS;YAAE,OAAO;QAC3C,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,UAAU,CAAC;YACtB,KAAK;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO;YACP,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE;SAC9B,CAAC,CAAC;QACH,IAAI,SAAS;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,2BAA2B;QAC7B,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACrC,KAAK,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAU;IAChD,OAAO,IAAI,CAAC,GAAG,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;AACpE,CAAC"}

package/dist/src/pairing/pairing-code-service.d.ts

@@ -0,0 +1,45 @@
+import type { PairingPayload } from '@uxnan/shared';
+export interface PairingCodeServiceOptions {
+    /** Builds the payload handed out on a valid code (the bridge's pairing data). */
+    buildPayload: () => PairingPayload;
+    /** Injected clock (epoch ms) for testability. */
+    now?: () => number;
+    /** Code lifetime before it rotates (default 10 min). */
+    ttlMs?: number;
+    /** Injected code generator (tests); defaults to an 8-char base32 code. */
+    generateCode?: () => string;
+    /** Per-IP resolve-attempt window + cap (anti-brute-force). */
+    rateWindowMs?: number;
+    rateMax?: number;
+    /**
+     * Absolute path to persist the current code+expiry (e.g.
+     * `~/.uxnan/pairing-code.json`). When set, the code is shared ACROSS processes
+     * so the running daemon that serves `/pair/resolve` and a separate `qr`/`code`
+     * command (or an autostarted, console-less daemon) hand out the SAME code.
+     * Omit for an in-memory-only instance (tests).
+     */
+    statePath?: string;
+}
+export declare class PairingCodeService {
+    #private;
+    constructor(options: PairingCodeServiceOptions);
+    /**
+     * The current pairing code, (re)issued if none exists or the previous one
+     * expired. Display this on the PC for the user to type on the phone. Returned
+     * grouped (`ABCD-EFGH`) for readability; {@link resolve} accepts either form.
+     */
+    currentCode(): string;
+    /** Force a fresh code now (e.g. the user asked to regenerate). */
+    rotate(): string;
+    /**
+     * Validate a code presented by a phone and, if it matches the active
+     * (unexpired) code, return the pairing payload. Comparison is constant-time and
+     * input is normalized (case, grouping, Crockford look-alikes).
+     */
+    resolve(code: string): PairingPayload | undefined;
+    /**
+     * Record a resolve attempt from `ip` and report whether it is now over the
+     * limit (the caller should answer 429 and NOT call {@link resolve}).
+     */
+    rateLimited(ip: string): boolean;
+}

package/dist/src/pairing/pairing-code-service.js

@@ -0,0 +1,183 @@
+/**
+ * Manual-code pairing (bridge-side; architecture §5.10.1 reframed for the
+ * bridge-first model — the relay's `/trusted-session/resolve` was the off-LAN
+ * equivalent).
+ *
+ * The bridge shows a short, rotating **pairing code** on the PC (CLI / desktop).
+ * A phone that has located the bridge on the LAN (via mDNS discovery — a later
+ * slice — or by typing the host) calls `GET /pair/resolve?code=<code>` on the LAN
+ * server; this service validates the code and hands back the full
+ * {@link PairingPayload} (the same data the QR carries), which the phone then runs
+ * through the normal E2EE handshake.
+ *
+ * The code is the **consent gate**: only someone who can read the PC screen learns
+ * it, so a random LAN device cannot pull the payload and pair. This is the same
+ * trust posture as the QR (whoever sees the screen can pair) — the code adds no
+ * new secret beyond what the QR already exposes. Brute force is bounded by the
+ * code entropy (40 bits), a short TTL, and per-IP rate limiting.
+ *
+ * Security note: the payload is not a secret that grants access on its own — the
+ * phone must still complete the identity-keyed E2EE handshake. See bridge/FOR-DEV.md.
+ */
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+/** Crockford base32 alphabet (no I, L, O, U — unambiguous when read aloud/typed). */
+const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
+const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 minutes
+const DEFAULT_RATE_WINDOW_MS = 60 * 1000; // 1 minute
+const DEFAULT_RATE_MAX = 10; // attempts per window per IP
+export class PairingCodeService {
+    #buildPayload;
+    #now;
+    #ttlMs;
+    #generateCode;
+    #rateWindowMs;
+    #rateMax;
+    #rate = new Map();
+    #statePath;
+    #code;
+    #expiresAt = 0;
+    constructor(options) {
+        this.#buildPayload = options.buildPayload;
+        this.#now = options.now ?? (() => Date.now());
+        this.#ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+        this.#generateCode = options.generateCode ?? defaultGenerateCode;
+        this.#rateWindowMs = options.rateWindowMs ?? DEFAULT_RATE_WINDOW_MS;
+        this.#rateMax = options.rateMax ?? DEFAULT_RATE_MAX;
+        this.#statePath = options.statePath;
+    }
+    /**
+     * The current pairing code, (re)issued if none exists or the previous one
+     * expired. Display this on the PC for the user to type on the phone. Returned
+     * grouped (`ABCD-EFGH`) for readability; {@link resolve} accepts either form.
+     */
+    currentCode() {
+        const now = this.#now();
+        this.#syncFromDisk(now);
+        if (!this.#code || now >= this.#expiresAt) {
+            this.#code = this.#generateCode();
+            this.#expiresAt = now + this.#ttlMs;
+            this.#persist();
+        }
+        return group(this.#code);
+    }
+    /** Force a fresh code now (e.g. the user asked to regenerate). */
+    rotate() {
+        this.#code = this.#generateCode();
+        this.#expiresAt = this.#now() + this.#ttlMs;
+        this.#persist();
+        return group(this.#code);
+    }
+    /**
+     * Validate a code presented by a phone and, if it matches the active
+     * (unexpired) code, return the pairing payload. Comparison is constant-time and
+     * input is normalized (case, grouping, Crockford look-alikes).
+     */
+    resolve(code) {
+        const now = this.#now();
+        // Re-read the shared code so a daemon serving `/pair/resolve` validates
+        // against the code another process (the `qr`/`code` command) may have issued.
+        this.#syncFromDisk(now);
+        if (!this.#code || now >= this.#expiresAt)
+            return undefined;
+        if (!constantTimeEqual(normalize(code), this.#code))
+            return undefined;
+        return this.#buildPayload();
+    }
+    /** Adopt the persisted (shared) code when present and still valid. */
+    #syncFromDisk(now) {
+        const persisted = this.#load();
+        if (persisted && now < persisted.expiresAt) {
+            this.#code = persisted.code;
+            this.#expiresAt = persisted.expiresAt;
+        }
+    }
+    /** Read the shared code from disk, or `undefined` (no path / missing / corrupt). */
+    #load() {
+        if (!this.#statePath)
+            return undefined;
+        try {
+            const parsed = JSON.parse(readFileSync(this.#statePath, 'utf-8'));
+            if (parsed &&
+                typeof parsed === 'object' &&
+                typeof parsed.code === 'string' &&
+                typeof parsed.expiresAt === 'number') {
+                return {
+                    code: parsed.code,
+                    expiresAt: parsed.expiresAt,
+                };
+            }
+        }
+        catch {
+            /* missing or corrupt → in-memory only */
+        }
+        return undefined;
+    }
+    /** Persist the current code so other processes hand out the same one. Best-effort. */
+    #persist() {
+        if (!this.#statePath || !this.#code)
+            return;
+        try {
+            mkdirSync(dirname(this.#statePath), { recursive: true });
+            writeFileSync(this.#statePath, JSON.stringify({ code: this.#code, expiresAt: this.#expiresAt }));
+        }
+        catch {
+            /* best-effort: persistence failure falls back to in-memory */
+        }
+    }
+    /**
+     * Record a resolve attempt from `ip` and report whether it is now over the
+     * limit (the caller should answer 429 and NOT call {@link resolve}).
+     */
+    rateLimited(ip) {
+        const now = this.#now();
+        const entry = this.#rate.get(ip);
+        if (!entry || now >= entry.resetAt) {
+            this.#rate.set(ip, { count: 1, resetAt: now + this.#rateWindowMs });
+            return false;
+        }
+        entry.count += 1;
+        return entry.count > this.#rateMax;
+    }
+}
+/** Generate an 8-char Crockford-base32 code from 40 bits of entropy. */
+function defaultGenerateCode() {
+    const bytes = randomBytes(5); // 40 bits → 8 base32 chars
+    let bits = 0;
+    let value = 0;
+    let out = '';
+    for (const byte of bytes) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            out += ALPHABET[(value >>> bits) & 31];
+        }
+    }
+    return out.slice(0, 8);
+}
+/** Group an 8-char code as `ABCD-EFGH` for display. */
+function group(code) {
+    return code.length === 8 ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+}
+/**
+ * Normalize a user-typed code: uppercase, strip non-alphanumerics (dashes/spaces),
+ * and fold Crockford look-alikes (O→0, I/L→1) so a misread is still accepted.
+ */
+function normalize(input) {
+    return input
+        .toUpperCase()
+        .replace(/[^0-9A-Z]/g, '')
+        .replace(/O/g, '0')
+        .replace(/[IL]/g, '1');
+}
+/** Constant-time string compare that never throws on length mismatch. */
+function constantTimeEqual(a, b) {
+    const ba = Buffer.from(a, 'utf-8');
+    const bb = Buffer.from(b, 'utf-8');
+    if (ba.length !== bb.length)
+        return false;
+    return timingSafeEqual(ba, bb);
+}
+//# sourceMappingURL=pairing-code-service.js.map

package/dist/src/pairing/pairing-code-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-code-service.js","sourceRoot":"","sources":["../../../src/pairing/pairing-code-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,qFAAqF;AACrF,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AAEpD,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AACpD,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW;AACrD,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,6BAA6B;AAmC1D,MAAM,OAAO,kBAAkB;IACpB,aAAa,CAAuB;IACpC,IAAI,CAAe;IACnB,MAAM,CAAS;IACf,aAAa,CAAe;IAC5B,aAAa,CAAS;IACtB,QAAQ,CAAS;IACjB,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IACrC,UAAU,CAAqB;IAExC,KAAK,CAAqB;IAC1B,UAAU,GAAG,CAAC,CAAC;IAEf,YAAY,OAAkC;QAC5C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAC;QACjE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACpE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,WAAW;QACT,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAClE,MAAM;QACJ,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,wEAAwE;QACxE,8EAA8E;QAC9E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QAC5D,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED,sEAAsE;IACtE,aAAa,CAAC,GAAW;QACvB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,SAAS,IAAI,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC;YAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC;QACxC,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,SAAS,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3E,IACE,MAAM;gBACN,OAAO,MAAM,KAAK,QAAQ;gBAC1B,OAAQ,MAAwB,CAAC,IAAI,KAAK,QAAQ;gBAClD,OAAQ,MAAwB,CAAC,SAAS,KAAK,QAAQ,EACvD,CAAC;gBACD,OAAO;oBACL,IAAI,EAAG,MAAwB,CAAC,IAAI;oBACpC,SAAS,EAAG,MAAwB,CAAC,SAAS;iBAC/C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,sFAAsF;IACtF,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QAC5C,IAAI,CAAC;YACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,aAAa,CACX,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CACjE,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,EAAU;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC;IACrC,CAAC;CACF;AAED,wEAAwE;AACxE,SAAS,mBAAmB;IAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;IACzD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,IAAI,QAAQ,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,WAAW,EAAE;SACb,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACnC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}