waterplane 0.0.1 → 0.1.6

package/node_modules/@waterplane/shared/dist/pad.js

@@ -0,0 +1,373 @@
+/**
+ * The pad, as a value two devices can both write to without deleting each
+ * other's words.
+ *
+ * The pad is a synced setting, and a synced setting is an OPAQUE STRING with
+ * one `ts` — the host never parses it (`shared/settings.ts` argues why at
+ * length). So the merge the host can perform is last-write-wins on the whole
+ * value: a device that pushes its pad while holding an older copy replaces
+ * every note the other one had, with no diff, no warning, and nothing on the
+ * wire that distinguishes it from a deliberate delete. For a preference that is
+ * the right rule; for the store whose entire job is to be the last copy of
+ * words that never ran, it is a silent delete.
+ *
+ * Everything that used to compensate for that — a diff that guessed which
+ * drops were losses, a device-local rescue store, an amber "N notes were kept
+ * for you" block — is gone, because the merge is fixed instead. The CLIENT
+ * merges per note on adopt (`web/settings.ts`'s `onAdopt`), the host still
+ * stores a string and still compares a `ts`, and nothing on the wire changed.
+ *
+ * ── The shape, and why it is still one array ──────────────────────────────
+ *
+ * The synced value stays ONE JSON array under `waterplane.pad`, with two element
+ * shapes discriminated by their fields: a note has a string `text`, a
+ * tombstone has a finite `gone` and no text. It is not `{v:2,notes,tombs}`,
+ * which would have been tidier, because an older bundle's `loadPad` and its
+ * `onAdopt` guard both filter to elements with a string `text` — against an
+ * array they drop the tombstones silently and keep a working pad, where
+ * against an object they would show the user an EMPTY pad. The host's
+ * `padNotesFor` already skips text-less elements for the same reason.
+ *
+ * ── The failure mode this chooses ─────────────────────────────────────────
+ *
+ * A legacy array parses as a `PadDoc` with `tombs: []`. So a delete made on a
+ * device still running an old bundle — or one that fell more than
+ * `PAD_TOMB_TTL_MS` behind the newest words either copy carries — is forgotten,
+ * and the note comes back once, everywhere, wearing its original date. That
+ * costs one tap. The failure it replaces cost words.
+ *
+ * Pinned by `packages/shared/test/pad.test.mjs`.
+ */
+/**
+ * Hard bounds on the pad — a COUNT that rarely binds and a BYTE budget that does.
+ *
+ * The pad is not a scratch list. It holds words that have no target yet, which
+ * is the one kind this app cannot reconstruct from anywhere else. Both bind on
+ * a LOCAL ADD only, and an add past them is REFUSED rather than silently
+ * shedding the oldest note — a refusal leaves the words in the editor, where
+ * their author can see them; shedding deleted a note precisely because it was
+ * old, and a note is old exactly when nobody has dealt with it yet.
+ */
+export const PAD_CAP = 400;
+export const PAD_BYTES = 512 * 1024;
+/**
+ * How long a tombstone suppresses the note it names: 30 days.
+ *
+ * The argument is "how long may a device be offline before its stale copy is
+ * allowed to resurrect a delete", not the retired rescue store's 7 days, which
+ * measured something else entirely. A month is the longest a phone left in a
+ * drawer plausibly stays paired; past that the delete is forgotten and the
+ * stale copy comes back once, wearing its old date.
+ *
+ * Measured against the PAD's own newest stamp, never against a device clock —
+ * `mergePad` argues why at length. So "30 days" means 30 days of the pad being
+ * written to without this delete travelling, which is the thing the number was
+ * ever a guess about.
+ */
+export const PAD_TOMB_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+/** Tombstones are capped like notes, newest `gone` kept. Same number, because
+ *  the worst case is one tombstone per note and there is no reason for the two
+ *  halves of one value to have different ceilings. */
+export const PAD_TOMB_CAP = PAD_CAP;
+// ── Parse and serialize ──────────────────────────────────────────────
+function finite(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : null;
+}
+/**
+ * Read the stored value, tolerating everything.
+ *
+ * Nothing here throws and nothing here is authoritative: a value written by a
+ * newer bundle, an older one, or half a bundle must still produce a pad
+ * somebody can use. Not an array (or unparseable) is an EMPTY doc, never an
+ * error — the alternative is a sheet that cannot render.
+ */
+export function parsePad(raw) {
+    let list;
+    try {
+        list = raw ? JSON.parse(raw) : null;
+    }
+    catch {
+        return { notes: [], tombs: [] };
+    }
+    if (!Array.isArray(list))
+        return { notes: [], tombs: [] };
+    const notes = new Map();
+    const tombs = new Map();
+    for (const el of list) {
+        if (!el || typeof el !== "object")
+            continue;
+        const d = el;
+        if (typeof d.id !== "string" || !d.id)
+            continue;
+        if (typeof d.text === "string") {
+            const steps = Array.isArray(d.steps) ? d.steps.filter((s) => typeof s === "string") : [];
+            const note = { id: d.id, text: d.text, ts: finite(d.ts) ?? 0 };
+            if (steps.length)
+                note.steps = steps;
+            if (typeof d.cwd === "string" && d.cwd)
+                note.cwd = d.cwd;
+            // Duplicate ids keep the greater `ts`: two copies of one note in one
+            // value is malformed, and the newer one is the one somebody typed last.
+            const have = notes.get(note.id);
+            if (!have || note.ts > have.ts)
+                notes.set(note.id, note);
+            continue;
+        }
+        const gone = finite(d.gone);
+        if (gone !== null) {
+            const have = tombs.get(d.id);
+            if (!have || gone > have.gone)
+                tombs.set(d.id, { id: d.id, gone });
+        }
+        // Anything else is dropped: an element that is neither a note nor a delete
+        // says nothing, and guessing which it meant is how a pad loses a note.
+    }
+    return { notes: [...notes.values()], tombs: [...tombs.values()] };
+}
+function canonNote(n) {
+    // Insertion order IS key order in `JSON.stringify`, so this is the fixed
+    // order the canonical form promises.
+    const o = { id: n.id, text: n.text, ts: n.ts };
+    if (n.steps && n.steps.length)
+        o.steps = n.steps;
+    if (n.cwd)
+        o.cwd = n.cwd;
+    return o;
+}
+/** One note's canonical JSON — the merge's tie-break reads this, so it must be
+ *  the same bytes the serializer would emit. */
+function noteKey(n) { return JSON.stringify(canonNote(n)); }
+/**
+ * The value this device writes — CANONICAL, and that is load-bearing.
+ *
+ * Notes newest first (`ts` desc, then `id` asc), tombstones after them
+ * (`gone` desc, then `id` asc), keys in a fixed order. The convergence in
+ * `web/settings.ts` terminates only because two devices holding the same set of
+ * notes produce byte-identical strings: the loser of a concurrent push
+ * re-merges the winner's value, gets exactly that string back, and
+ * `applyRemoteSetting`'s equality branch stops the exchange. A serializer that
+ * ordered by insertion would hand the two devices two different strings for one
+ * pad, and they would push at each other until one of them was closed.
+ */
+export function serializePad(doc) {
+    const notes = [...doc.notes].sort((a, b) => b.ts - a.ts || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    const tombs = [...doc.tombs].sort((a, b) => b.gone - a.gone || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    return JSON.stringify([...notes.map(canonNote), ...tombs.map((t) => ({ id: t.id, gone: t.gone }))]);
+}
+// ── The merge ────────────────────────────────────────────────────────
+/**
+ * Two copies of the pad, one pad.
+ *
+ * Commutative and idempotent by construction, which is what lets both devices
+ * run it on whatever they happen to hold and land on the same value:
+ *
+ *  1. **Tombstones union** by id, greater `gone` wins; anything older than
+ *     `PAD_TOMB_TTL_MS` **before the newest stamp in the union** is forgotten.
+ *  2. **Per note id**, the copy with the greater `ts` is the candidate. On an
+ *     exact tie the one whose canonical JSON sorts lexically LATER wins —
+ *     "prefer mine" would make the function non-commutative, i.e. the two
+ *     devices would converge on two different values and push for ever.
+ *  3. A tombstone with `gone >= candidate.ts` drops the note. A candidate whose
+ *     `ts` is GREATER than the tombstone's `gone` keeps the note **and drops
+ *     the tombstone**: those are words somebody typed after the delete, and the
+ *     delete was made on a device that had not seen them.
+ *  4. **Then** the newest `PAD_TOMB_CAP` tombstones are kept.
+ *  5. **No note is ever dropped for size here.** The caps bind on a local add,
+ *     where a person is present to be told. A merge that shed notes would
+ *     delete words on the device that was merely receiving them.
+ *
+ * ── Why the TTL is cut on the DATA and not on a clock ─────────────────────
+ *
+ * "Same union ⇒ same bytes" is the whole contract, and a `Date.now()` anywhere
+ * inside it breaks that between two devices whose clocks disagree — which is
+ * every pair of devices. Trace the version that read the clock: A is two hours
+ * behind B, and a tombstone `T` has `gone` between the two cutoffs. A merges
+ * the host's value, keeps `T`, sees `changed`, pushes. B adopts it, drops `T`,
+ * sees `changed`, pushes. A adopts THAT, re-adds `T`, pushes — one round per
+ * `PUSH_DEBOUNCE_MS` for the whole skew window, each one re-stamping the
+ * setting and firing `announce`, and neither device is wrong.
+ *
+ * So the cutoff is `max(every ts and every gone across both copies) −
+ * PAD_TOMB_TTL_MS`. It is a fact about the two documents, so both devices
+ * compute it identically and the function is a pure fold over the union again.
+ * The cost is that the newest tombstone in a pad nobody touches is never aged
+ * out — which is correct: "30 days" was always meant as *30 days of the pad
+ * moving on without this delete*, and a pad that has not moved has no newer
+ * words for a stale copy to overwrite.
+ *
+ * `now` is therefore UNREAD, and kept in the signature deliberately: the call
+ * sites pass it, and `pad.test.mjs` hands the two sides wildly different values
+ * and asserts the bytes are identical, which is a pin a removed parameter
+ * could not carry.
+ *
+ * ── Why the cap is applied AFTER rule 3 ───────────────────────────────────
+ *
+ * Cutting to `PAD_TOMB_CAP` first meant the resurrection rule then deleted
+ * tombstones out of an already-cut list, so the output could hold fewer than
+ * the cap while the union still held tombstones that belonged in it — and the
+ * next exchange with the same peer put them back. The merged value was not a
+ * fixed point of merging with its own input, which is the same
+ * push-at-each-other loop by another route. Resurrect first, cut last: the cut
+ * is then a function of what actually survived.
+ */
+export function mergePad(mine, theirs, _now) {
+    const allTombs = [...mine.tombs, ...theirs.tombs].filter((t) => t && t.id && Number.isFinite(t.gone));
+    const allNotes = [...mine.notes, ...theirs.notes].filter((n) => n && n.id);
+    let latest = 0;
+    for (const n of allNotes)
+        if (Number.isFinite(n.ts) && n.ts > latest)
+            latest = n.ts;
+    for (const t of allTombs)
+        if (t.gone > latest)
+            latest = t.gone;
+    const cutoff = latest - PAD_TOMB_TTL_MS;
+    const live = new Map();
+    for (const t of allTombs) {
+        if (t.gone < cutoff)
+            continue;
+        const have = live.get(t.id);
+        if (!have || t.gone > have.gone)
+            live.set(t.id, { id: t.id, gone: t.gone });
+    }
+    const cand = new Map();
+    for (const n of allNotes) {
+        const have = cand.get(n.id);
+        if (!have) {
+            cand.set(n.id, n);
+            continue;
+        }
+        if (n.ts > have.ts) {
+            cand.set(n.id, n);
+            continue;
+        }
+        if (n.ts === have.ts && noteKey(n) > noteKey(have))
+            cand.set(n.id, n);
+    }
+    const notes = [];
+    for (const n of cand.values()) {
+        const tomb = live.get(n.id);
+        if (!tomb) {
+            notes.push(n);
+            continue;
+        }
+        if (tomb.gone >= n.ts)
+            continue; // deleted at or after these words: stay deleted
+        live.delete(n.id); // typed after the delete: the words win and the delete goes
+        notes.push(n);
+    }
+    let kept = [...live.values()].sort((a, b) => b.gone - a.gone || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+    if (kept.length > PAD_TOMB_CAP)
+        kept = kept.slice(0, PAD_TOMB_CAP);
+    return { notes, tombs: kept };
+}
+/**
+ * Delete notes — and say so in a way that travels.
+ *
+ * A tombstone is written for every id, INCLUDING ids this device has never
+ * seen: a delete made against a note that only exists on the other device still
+ * has to reach it, and "I do not have it" is not a delete.
+ */
+export function removeNotes(doc, ids, now) {
+    const gone = new Set(ids.filter((id) => typeof id === "string" && id));
+    if (!gone.size)
+        return doc;
+    const tombs = new Map(doc.tombs.map((t) => [t.id, t]));
+    for (const id of gone) {
+        const have = tombs.get(id);
+        if (!have || now > have.gone)
+            tombs.set(id, { id, gone: now });
+    }
+    return { notes: doc.notes.filter((n) => !gone.has(n.id)), tombs: [...tombs.values()] };
+}
+/** Write a note, by id — and forget any delete for it, since this is somebody
+ *  typing after that delete, which is rule 3 stated locally. */
+export function upsertNote(doc, note) {
+    const notes = doc.notes.some((n) => n.id === note.id)
+        ? doc.notes.map((n) => (n.id === note.id ? note : n))
+        : [note, ...doc.notes];
+    return { notes, tombs: doc.tombs.filter((t) => t.id !== note.id) };
+}
+/**
+ * A remote value is about to replace this device's copy: merge instead.
+ *
+ * `changed` says the merged value differs from what arrived — i.e. this device
+ * holds something the host does not, and has to push it back. An incoming `""`
+ * is an EMPTY doc rather than "no opinion", so a removal on the wire cannot
+ * take this device's notes with it: they survive the merge and go back up.
+ */
+export function adoptPad(incomingRaw, currentRaw, now) {
+    const value = serializePad(mergePad(parsePad(currentRaw), parsePad(incomingRaw), now));
+    return { value, changed: value !== incomingRaw };
+}
+// ── Words ────────────────────────────────────────────────────────────
+// Here rather than in a web module for `shared/assess.ts`'s reason: a sheet's
+// sentences are part of what the app MEANS, they are pinned by a node test, and
+// this file already owns everything else about the pad that is not pixels.
+/** What the pad IS, at the top of the sheet. */
+export const PAD_HINT = "Notes with no target yet — write them anywhere, offline included, and aim them later. " +
+    "A note that names a repo can be filed straight onto that repo's backlog. " +
+    "Sending or filing one uses the normal queue, so it survives a dead tunnel like anything else you type.";
+/** The refusal: the add did not happen, and the words are still where you can
+ *  see them. Never a shed note — that deleted somebody's words to make room for
+ *  somebody's words. */
+export function padFullText(n, kb) {
+    return `the pad is full (${n} notes, ${kb} KB) — your text is still in the editor; send, file or clear a note first`;
+}
+/** The other refusal: this browser refused the write outright (private mode, an
+ *  origin at quota). Same promise — the words did not move. */
+export const PAD_WRITE_REFUSED = "this phone's storage refused the note — your text is still in the editor; free some space, or send or clear a note first";
+/** The retired device-local rescue store, handed back to the pad it was
+ *  guarding. Said once, on the boot that moves them. */
+export function padMigratedToast(n) {
+    return n === 1
+        ? "one note that was kept on this phone is back on the pad"
+        : `${n} notes that were kept on this phone are back on the pad`;
+}
+/** A half-written prompt about to be replaced by words nobody typed, parked
+ *  where there is a listing to find it again. */
+export const DRAFT_KEPT_TOAST = "kept your unfinished prompt — it is a note on the pad";
+/** …and when the pad could not take it. The draft is NOT overwritten: a rescue
+ *  that failed must not also be a delete. */
+export const DRAFT_REFUSED_TOAST = "the pad could not take your unfinished prompt, so it was left in the box — nothing was replaced";
+/** *file it* — the verb for a note that already knows which repo it is for. */
+export const FILE_WORDS = {
+    label: "file it",
+    title: (repo) => `put it on ${repo}'s backlog as it is — it waits there, nothing runs now`,
+};
+/** What filing did. Offline is its own sentence: the row is durable either way,
+ *  and a promise about "when the link is back" is the honest half. */
+export function padFiledToast(repo, offline) {
+    return offline
+        ? `filed offline — it reaches ${repo}'s backlog when the link is back`
+        : `filed — on ${repo}'s backlog`;
+}
+/**
+ * A draft about to be replaced by words nobody typed — what, if anything, to
+ * keep.
+ *
+ * The merge above guards the pad against a synced overwrite. This guards the
+ * *sheet drafts* against the local equivalent, and the local one is worse: the
+ * sheet-draft store has no listing of its own, so the only route back to a
+ * draft is re-opening the exact sheet that wrote it. When anything breaks that
+ * single route — a routing bug, a reload, an OTA bundle swap, a killed tab —
+ * the words still exist and nothing on the phone can reach them, and the next
+ * open of that sheet seeds the slot and deletes them. A prompt typed on a
+ * train, with a schedule set and a screenshot marked up, went that way.
+ *
+ * Two things are NOT rescued, and both are the ordinary case: an empty slot
+ * (nothing to keep), and a slot that already holds exactly the incoming seed
+ * (re-opening the same message is not an overwrite). Whitespace-only counts as
+ * empty — a stray newline is not a draft, and a rescue row for one teaches the
+ * user to ignore the section.
+ *
+ * Returns the chain SPLIT: `text` is the first step and `steps` the rest, which
+ * is the shape a pad note wants (`PadNote.steps`) rather than a string with
+ * control characters in it.
+ */
+export function draftToRescue(current, seed) {
+    if (!current.trim() || current === seed)
+        return null;
+    const [text = "", ...steps] = current.split("\f");
+    return steps.length ? { text, steps } : { text };
+}
+//# sourceMappingURL=pad.js.map

package/node_modules/@waterplane/shared/dist/pad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pad.js","sourceRoot":"","sources":["../src/pad.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAqCH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACxD;;sDAEsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AAEpC,wEAAwE;AAExE,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,GAA8B;IACrD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAAC,CAAC;IACvF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmB,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC9C,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,EAAoG,CAAC;QAC/G,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,SAAS;QAChD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,GAAY,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,IAAI,KAAK,CAAC,MAAM;gBAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;YACrC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;YACzD,qEAAqE;YACrE,wEAAwE;YACxE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;IACzE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,yEAAyE;IACzE,qCAAqC;IACrC,MAAM,CAAC,GAA4B,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IACxE,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM;QAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,GAAG;QAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;gDACgD;AAChD,SAAS,OAAO,CAAC,CAAU,IAAY,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAE,IAAa;IAClE,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;IAE3E,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IACpF,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,GAAG,eAAe,CAAC;IAExC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,GAAG,MAAM;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAmB,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACpD,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACvC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE;YAAE,SAAS,CAAC,gDAAgD;QACjF,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,4DAA4D;QAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,IAAI,IAAI,CAAC,MAAM,GAAG,YAAY;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAsB,EAAE,GAAW;IAC1E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAa;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,UAAyB,EAAE,GAAW;IAClF,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACvF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAE3E,gDAAgD;AAChD,MAAM,CAAC,MAAM,QAAQ,GACnB,wFAAwF;IACxF,2EAA2E;IAC3E,wGAAwG,CAAC;AAE3G;;wBAEwB;AACxB,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,EAAU;IAC/C,OAAO,oBAAoB,CAAC,WAAW,EAAE,2EAA2E,CAAC;AACvH,CAAC;AAED;+DAC+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAC5B,0HAA0H,CAAC;AAE7H;wDACwD;AACxD,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,OAAO,CAAC,KAAK,CAAC;QACZ,CAAC,CAAC,yDAAyD;QAC3D,CAAC,CAAC,GAAG,CAAC,yDAAyD,CAAC;AACpE,CAAC;AAED;iDACiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,uDAAuD,CAAC;AACxF;6CAC6C;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAC9B,iGAAiG,CAAC;AAEpG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,aAAa,IAAI,wDAAwD;CACnG,CAAC;AAEF;sEACsE;AACtE,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAgB;IAC1D,OAAO,OAAO;QACZ,CAAC,CAAC,8BAA8B,IAAI,kCAAkC;QACtE,CAAC,CAAC,cAAc,IAAI,YAAY,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC"}

package/node_modules/@waterplane/shared/dist/pairing.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Pairing a new phone to a desktop: a short code shown as a QR on a phone that
+ * is already trusted, redeemed once by the new one.
+ *
+ * The code is 8 characters from an alphabet with no look-alikes (no 0/O, 1/I),
+ * so it can be typed off a screen as a fallback; it lives `PAIR_TTL_MS` and is
+ * spent by its first successful redeem. The QR carries the LANDING URL
+ * (`<base>/pair/<code>`, a host-rendered page that offers the web version and
+ * the APK); the installed app is reached through the DEEP LINK
+ * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
+ *
+ * The base goes through `normalizeHostBase`, so a scanned or pasted link can
+ * never aim the app at a `javascript:` or `data:` base.
+ */
+import { type RandomBytes } from "./hosts.js";
+/** 32 characters (a power of two: uniform from a byte), no 0, O, 1 or I. */
+export declare const PAIR_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+export declare const PAIR_CODE_LEN = 8;
+export declare const PAIR_TTL_MS: number;
+export declare const PAIR_SCHEME: string;
+/** Past identities' schemes, newest first: still PARSED (a QR printed by an older
+ *  host), never emitted. */
+export declare const LEGACY_PAIR_SCHEMES: readonly string[];
+export declare function newPairCode(rand?: RandomBytes): string;
+/** A code as typed: case, spaces and dashes forgiven, anything else refused.
+ *  No look-alike is "corrected" — 0/O/1/I are not in the alphabet, so a code
+ *  containing one was misread and guessing which letter was meant would spend
+ *  a rate-limited attempt on a wrong code. */
+export declare function normalizePairCode(raw: unknown): string | null;
+/** `ABCD-EFGH`, for reading aloud or off a screen. */
+export declare function formatPairCode(code: string): string;
+export interface PairTarget {
+    base: string;
+    code: string;
+}
+export declare function pairDeepLink(base: string, code: string): string;
+export declare function pairLandingUrl(base: string, code: string): string;
+/** Parse `<scheme>://pair?u=<base>&c=<code>` (current or a legacy scheme), or `null`. */
+export declare function parsePairDeepLink(raw: unknown): PairTarget | null;
+/** The code in a landing path: `/pair/<code>` (page) or `/pair/<code>/apk`. */
+export declare function pairPathCode(pathname: string): {
+    code: string;
+    apk: boolean;
+} | null;
+/** Parse `<base>/pair/<code>`, or `null`. */
+export declare function parsePairLandingUrl(raw: unknown): PairTarget | null;
+/** Whatever was scanned or pasted: a deep link or a landing URL. */
+export declare function parsePairInput(raw: unknown): PairTarget | null;
+export declare function pairExpired(expiresAt: number, now: number): boolean;
+/** One waterplane daemon found on the tailnet (`GET /api/tailnet/peers`). */
+export interface TailnetPeer {
+    /** The tailscale hostname. */
+    name: string;
+    /** `100.x.y.z:port` — what the phone saves as the host's address. */
+    addr: string;
+    os: string;
+    /** The daemon answered 401: it has a password, so a pairing code is needed. */
+    gated: boolean;
+}
+/** `GET /api/tailnet/peers` (trusted path only). `peers` is empty with a
+ *  sentence in `note` when tailscale is missing or nobody answered. */
+export interface TailnetPeersResponse {
+    ok: true;
+    peers: TailnetPeer[];
+    note?: string;
+}
+/** `POST /api/pair/mint` (trusted, authenticated caller) → */
+/** `POST /api/pair/mint` body. `passive`: the device this code pairs gets a
+ *  passive token (`passive.ts`), and redeeming it switches "gate Tailscale" on. */
+export interface PairMintRequest {
+    passive?: boolean;
+}
+export interface PairMintResponse {
+    code: string;
+    /** The code pairs a passive device. */
+    passive?: boolean;
+    expiresAt: number;
+    /** What the QR encodes. */
+    landingUrl: string;
+    deepLink: string;
+    base: string;
+    /** Plain-HTTP LAN base, when the host has a LAN interface bound. */
+    lanBase?: string;
+}
+/** `POST /api/pair/redeem` */
+export interface PairRedeemRequest {
+    code: string;
+    deviceName: string;
+}
+export interface PairRedeemHost {
+    name: string;
+    base: string;
+    httpsUrl: string | null;
+    lanBase?: string;
+    lanSsids?: string[];
+}
+/** `no-password`: the host has no password and the redeem came over the LAN —
+ *  its `message` is the host's own sentence and is shown verbatim. */
+export type PairRedeemError = "bad-request" | "unknown" | "expired" | "used" | "rate-limited" | "no-password";
+export type PairRedeemResponse = {
+    ok: true;
+    host: PairRedeemHost;
+    /** Device token (a new ledger row) — absent when no password is set. */
+    token?: string;
+    deviceId?: string;
+    /** Only to a loopback/tailscale peer. */
+    lanIdentity?: {
+        hostId: string;
+        secret: string;
+    };
+    /** A sentence for the phone when it got no token (no password set). */
+    note?: string;
+    /** The token is a passive one (`passive.ts`). */
+    scope?: "passive";
+} | {
+    ok: false;
+    error: PairRedeemError;
+    message: string;
+};
+export declare function pairRedeemErrorText(error: PairRedeemError): string;

package/node_modules/@waterplane/shared/dist/pairing.js

@@ -0,0 +1,130 @@
+/**
+ * Pairing a new phone to a desktop: a short code shown as a QR on a phone that
+ * is already trusted, redeemed once by the new one.
+ *
+ * The code is 8 characters from an alphabet with no look-alikes (no 0/O, 1/I),
+ * so it can be typed off a screen as a fallback; it lives `PAIR_TTL_MS` and is
+ * spent by its first successful redeem. The QR carries the LANDING URL
+ * (`<base>/pair/<code>`, a host-rendered page that offers the web version and
+ * the APK); the installed app is reached through the DEEP LINK
+ * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
+ *
+ * The base goes through `normalizeHostBase`, so a scanned or pasted link can
+ * never aim the app at a `javascript:` or `data:` base.
+ */
+import { normalizeHostBase } from "./hosturl.js";
+import { BRAND, LEGACY } from "./brand.js";
+import { randomFromAlphabet, defaultRandomBytes } from "./hosts.js";
+/** 32 characters (a power of two: uniform from a byte), no 0, O, 1 or I. */
+export const PAIR_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+export const PAIR_CODE_LEN = 8;
+export const PAIR_TTL_MS = 10 * 60 * 1000;
+export const PAIR_SCHEME = BRAND.pairScheme;
+/** Past identities' schemes, newest first: still PARSED (a QR printed by an older
+ *  host), never emitted. */
+export const LEGACY_PAIR_SCHEMES = LEGACY.map((l) => l.pairScheme);
+export function newPairCode(rand = defaultRandomBytes) {
+    return randomFromAlphabet(PAIR_ALPHABET, PAIR_CODE_LEN, rand);
+}
+/** A code as typed: case, spaces and dashes forgiven, anything else refused.
+ *  No look-alike is "corrected" — 0/O/1/I are not in the alphabet, so a code
+ *  containing one was misread and guessing which letter was meant would spend
+ *  a rate-limited attempt on a wrong code. */
+export function normalizePairCode(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const s = raw.replace(/[\s-]/g, "").toUpperCase();
+    if (s.length !== PAIR_CODE_LEN)
+        return null;
+    for (const ch of s)
+        if (!PAIR_ALPHABET.includes(ch))
+            return null;
+    return s;
+}
+/** `ABCD-EFGH`, for reading aloud or off a screen. */
+export function formatPairCode(code) {
+    return code.length === PAIR_CODE_LEN ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
+}
+export function pairDeepLink(base, code) {
+    return `${PAIR_SCHEME}://pair?u=${encodeURIComponent(base)}&c=${encodeURIComponent(code)}`;
+}
+export function pairLandingUrl(base, code) {
+    return `${base.replace(/\/+$/, "")}/pair/${code}`;
+}
+/** Parse `<scheme>://pair?u=<base>&c=<code>` (current or a legacy scheme), or `null`. */
+export function parsePairDeepLink(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const schemes = [PAIR_SCHEME, ...LEGACY_PAIR_SCHEMES].map((x) => x.replace(/[^a-z0-9+.-]/gi, "")).join("|");
+    const m = new RegExp(`^(?:${schemes})://pair/?\\?(.*)$`, "i").exec(raw.trim());
+    if (!m)
+        return null;
+    let params;
+    try {
+        params = new URLSearchParams(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const base = normalizeHostBase(params.get("u") ?? "");
+    const code = normalizePairCode(params.get("c"));
+    return base && code ? { base, code } : null;
+}
+/** The code in a landing path: `/pair/<code>` (page) or `/pair/<code>/apk`. */
+export function pairPathCode(pathname) {
+    const m = /^\/pair\/([^/]+)(\/apk)?\/?$/.exec(pathname);
+    if (!m)
+        return null;
+    let seg;
+    try {
+        seg = decodeURIComponent(m[1]);
+    }
+    catch {
+        return null;
+    }
+    const code = normalizePairCode(seg);
+    return code ? { code, apk: !!m[2] } : null;
+}
+/** Parse `<base>/pair/<code>`, or `null`. */
+export function parsePairLandingUrl(raw) {
+    if (typeof raw !== "string")
+        return null;
+    let u;
+    try {
+        u = new URL(raw.trim());
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "http:" && u.protocol !== "https:")
+        return null;
+    const p = pairPathCode(u.pathname);
+    if (!p || p.apk)
+        return null;
+    const base = normalizeHostBase(`${u.protocol}//${u.host}`);
+    return base ? { base, code: p.code } : null;
+}
+/** Whatever was scanned or pasted: a deep link or a landing URL. */
+export function parsePairInput(raw) {
+    return parsePairDeepLink(raw) ?? parsePairLandingUrl(raw);
+}
+export function pairExpired(expiresAt, now) {
+    return now >= expiresAt;
+}
+export function pairRedeemErrorText(error) {
+    switch (error) {
+        case "bad-request":
+            return "That is not a pairing code — it is 8 letters and digits.";
+        case "unknown":
+            return "The desktop does not know that code. Check it, or show a new QR.";
+        case "expired":
+            return "That code has expired (they last 10 minutes). Show a new QR on the paired phone.";
+        case "used":
+            return "That code was already used. Show a new QR on the paired phone.";
+        case "rate-limited":
+            return "Too many attempts. Wait a minute and try again.";
+        case "no-password":
+            return "This desktop has no password set, so it refuses pairing over the Wi-Fi. Pair over Tailscale instead.";
+    }
+}
+//# sourceMappingURL=pairing.js.map

package/node_modules/@waterplane/shared/dist/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AAEtF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;AAC5C;4BAC4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CAAC,OAAoB,kBAAkB;IAChE,OAAO,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,GAAG,WAAW,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,OAAO,oBAAoB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAW;IACxD,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AA6ED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,0DAA0D,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,kEAAkE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,gEAAgE,CAAC;QAC1E,KAAK,cAAc;YACjB,OAAO,iDAAiD,CAAC;QAC3D,KAAK,aAAa;YAChB,OAAO,sGAAsG,CAAC;IAClH,CAAC;AACH,CAAC"}