restructure Android sync around public/private/off relay modes and delete the LAN stack: the ServerSocket listener, the phone-as-relay hub and frames, the code pairing server, mDNS and discovery all go, keeping the relay responder as the only transport (v2.5.0)

@@ -1,390 +0,0 @@1-package com.peachpasswords.sync2-3-import kotlinx.coroutines.CompletableDeferred4-import kotlinx.coroutines.CoroutineScope5-import kotlinx.coroutines.Dispatchers6-import kotlinx.coroutines.channels.awaitClose7-import kotlinx.coroutines.delay8-import kotlinx.coroutines.flow.Flow9-import kotlinx.coroutines.flow.callbackFlow10-import kotlinx.coroutines.isActive11-import kotlinx.coroutines.launch12-import kotlinx.coroutines.withContext13-import org.json.JSONObject14-import java.net.Inet4Address15-import java.net.NetworkInterface16-import java.net.ServerSocket17-import java.net.Socket18-import javax.inject.Inject19-import javax.inject.Singleton20-21-/**22- * Code-based pairing, phone side. The phone listens and displays a code; the23- * browser dials out and presents the token from it.24- *25- * Wire contract (peach-browser is the authority — `.agent/CONTINUITY.md`26- * 2026-07-24T17:36Z, implemented there in `shared/pairing-dial.ts`):27- *28- *   1. browser dials `ws://<ip>:<port>` taken from the code29- *   2. browser → phone, plaintext BINARY frame: {type:"PEACH_HELLO", token:"<lowercase hex>"}30- *   3. phone verifies the token; on mismatch it closes the socket with NO error31- *      frame — that silence is the invalid-code signal32- *   4. phone → browser, plaintext BINARY: {type:"PEACH_HELLO_ACK", ephemeralPublicKeyHex:"<64 hex>"}33- *      (that key is the phone's Noise NK static `s`)34- *35- * Every frame in this exchange is binary, including the two JSON ones. This36- * document said "text" until 2026-07-24 and the code followed it; the browser's37- * socket is binary end to end, so pairing failed for every correct code. Verify38- * claims like this against `pairing-dial.ts`, not against this comment.39- *   5. Noise NK, phone as RESPONDER, over binary frames40- *   6. one encrypted PAIR_IDENTITY frame each way, BROWSER FIRST41- *   7. both derive the same 8-digit SAS from the handshake hash, and BOTH gate42- *      persistence on the user confirming it43- *44- * Step 7 is why [PairingSession] hands the SAS out and waits: the older45- * [MdnsPairingServer] wrote the peer into [PairedDeviceStore] as soon as the46- * handshake completed, before any human had compared anything, which makes the47- * SAS decorative. Nothing is persisted here until [PairingSession.confirm] is48- * called with true.49- */50-sealed interface PairingEvent {51-    /** The listener is up; show [code] to the user. */52-    data class Listening(val code: String, val ip: String, val port: Int) : PairingEvent53-54-    /** A peer completed the handshake. Show [sas]; nothing is stored yet. */55-    data class AwaitingConfirmation(val sas: String, val deviceName: String, val session: PairingSession) : PairingEvent56-57-    data class Paired(val deviceName: String) : PairingEvent58-59-    /** The code's window elapsed without a pairing; the user must start again. */60-    data object Expired : PairingEvent61-62-    /** Includes the silent-close case: a peer presented a bad token. */63-    data class Rejected(val reason: String) : PairingEvent64-}65-66-class PairingSession internal constructor() {67-    private val decision = CompletableDeferred<Boolean>()68-    fun confirm(matches: Boolean) { decision.complete(matches) }69-    internal suspend fun await(): Boolean = decision.await()70-}71-72-@Singleton73-class CodePairingServer @Inject constructor(74-    // The interface, not the concrete store: the store needs Android's75-    // EncryptedSharedPreferences, which would make this whole class untestable76-    // off device — and the token/window logic is exactly what wants testing.77-    private val deviceStore: PairedDeviceRegistry,78-) {79-    private var serverSocket: ServerSocket? = null80-81-    companion object {82-        /** Doc says 5–10 minutes; the low end is plenty to walk to a laptop. */83-        const val PAIRING_WINDOW_MS = 5L * 60 * 100084-85-        /** Interfaces whose address a LAN peer cannot route back to. */86-        private val TUNNEL_PREFIXES = listOf("tun", "ppp", "ipsec", "rmnet", "rndis", "ap")87-    }88-89-    /**90-     * Bind, publish a code, and accept pairing attempts until the flow is91-     * cancelled. One token per call: after a successful pairing the caller92-     * should stop this flow, which closes the pairing window while leaving any93-     * long-lived sync listener alone.94-     */95-    fun start(96-        scope: CoroutineScope,97-        ourStaticPrivateKey: ByteArray,98-        ourStaticPublicKey: ByteArray,99-        localIdentity: LocalChirpIdentity,100-        windowMs: Long = PAIRING_WINDOW_MS,101-        adoptionSourceDeps: AdoptionSourceDeps? = null,102-    ): Flow<PairingEvent> = callbackFlow {103-        val ip = localIpv4()104-        if (ip == null) {105-            trySend(PairingEvent.Rejected("no_local_network"))106-            close()107-            return@callbackFlow108-        }109-110-        val socket = withContext(Dispatchers.IO) { ServerSocket(0) }111-        serverSocket = socket112-        val token = PairingCode.newToken()113-        val tokenHex = token.joinToString("") { "%02x".format(it) }114-115-        trySend(PairingEvent.Listening(PairingCode.encode(ip, socket.localPort, token), ip, socket.localPort))116-117-        // The window is not a race against an attacker — there isn't a118-        // realistic one on your own LAN for a single-use code. It just stops an119-        // abandoned code from staying live indefinitely on a phone in a pocket.120-        val expiryJob = scope.launch {121-            delay(windowMs)122-            trySend(PairingEvent.Expired)123-            stop()124-            this@callbackFlow.close()125-        }126-127-        val acceptJob = scope.launch(Dispatchers.IO) {128-            while (isActive && !socket.isClosed) {129-                val client = runCatching { socket.accept() }.getOrNull() ?: break130-                launch {131-                    val event = handleClient(132-                        client,133-                        tokenHex,134-                        ourStaticPrivateKey,135-                        ourStaticPublicKey,136-                        localIdentity,137-                        adoptionSourceDeps,138-                    )139-                    trySend(event)140-                    // One code, one device. A rejected or failed attempt leaves141-                    // the window open so the user can retry without generating142-                    // a new code; only a real pairing closes it.143-                    if (event is PairingEvent.Paired) {144-                        expiryJob.cancel()145-                        stop()146-                        this@callbackFlow.close()147-                    }148-                }149-            }150-        }151-152-        awaitClose {153-            expiryJob.cancel()154-            acceptJob.cancel()155-            stop()156-        }157-    }158-159-    fun stop() {160-        runCatching { serverSocket?.close() }161-        serverSocket = null162-    }163-164-    private suspend fun handleClient(165-        client: Socket,166-        expectedTokenHex: String,167-        ourStaticPrivateKey: ByteArray,168-        ourStaticPublicKey: ByteArray,169-        localIdentity: LocalChirpIdentity,170-        adoptionSourceDeps: AdoptionSourceDeps?,171-    ): PairingEvent = withContext(Dispatchers.IO) {172-        val ws = WebSocketConnection(client, client.getInputStream(), client.getOutputStream())173-        var noiseSession: NoiseNKSession? = null174-        try {175-            if (!ws.accept()) {176-                ws.closeSilently()177-                return@withContext PairingEvent.Rejected("not_a_websocket")178-            }179-180-            // The browser sends this as a BINARY frame — `openPairingSocket` in181-            // peach-browser's pairing-dial.ts is a binary seam end to end182-            // (`ws.binaryType = "arraybuffer"`, `send(bytes: Uint8Array)`).183-            // Requiring text here rejected every real dial and closed the socket184-            // without a word, which the browser reports as "invalid code" — so a185-            // perfectly good code always failed. Text is still accepted so any186-            // other caller keeps working.187-            val helloText = when (val frame = ws.receive()) {188-                is WsMessage.Binary -> String(frame.bytes, Charsets.UTF_8)189-                is WsMessage.Text -> frame.text190-                else -> return@withContext rejectSilently(ws, "no_hello")191-            }192-            val helloJson = runCatching { JSONObject(helloText) }.getOrNull()193-                ?: return@withContext rejectSilently(ws, "bad_hello")194-            if (helloJson.optString("type") != "PEACH_HELLO") {195-                return@withContext rejectSilently(ws, "bad_hello")196-            }197-            if (!constantTimeEquals(helloJson.optString("token"), expectedTokenHex)) {198-                return@withContext rejectSilently(ws, "bad_token")199-            }200-            val flow = helloJson.optString("flow").ifBlank { null }201-            if (flow != null && flow != "adoption") {202-                return@withContext rejectSilently(ws, "unsupported_flow")203-            }204-205-            // Binary, for the same reason: the browser reads every frame as206-            // `new Uint8Array(ev.data as ArrayBuffer)`. A text frame hands it a207-            // string, which converts to a ZERO-LENGTH array rather than208-            // throwing — and a zero-length ACK is also read as an invalid code.209-            ws.send(210-                JSONObject()211-                    .put("type", "PEACH_HELLO_ACK")212-                    .put("ephemeralPublicKeyHex", ourStaticPublicKey.joinToString("") { "%02x".format(it) })213-                    .toString()214-                    .toByteArray(Charsets.UTF_8),215-            )216-217-            val session = noiseNKResponder(218-                ourStaticPrivateKey,219-                ourStaticPublicKey,220-                { frame -> ws.send(frame) },221-                { (ws.receive() as? WsMessage.Binary)?.bytes ?: throw IllegalStateException("peer closed") },222-            )223-            noiseSession = session224-225-            if (flow == "adoption") {226-                val deps = adoptionSourceDeps227-                    ?: return@withContext rejectSilently(ws, "adoption_unavailable")228-                return@withContext handleAdoption(229-                    ws,230-                    session,231-                    localIdentity,232-                    deps,233-                )234-            }235-236-            // E1: the initiator proves it holds the private half of the key it237-            // will advertise. Bind that proof to this NK transcript before any238-            // identity frame is accepted or SAS consent is requested.239-            val authenticatedInitiatorKey = performResponderPairingAuth(240-                session = session,241-                ourPrivateKey = ourStaticPrivateKey,242-                ourPublicKey = ourStaticPublicKey,243-                sendEncryptedJson = { plaintext -> ws.send(session.encrypt(plaintext)) },244-                receiveEncryptedJson = {245-                    session.decrypt(246-                        (ws.receive() as? WsMessage.Binary)?.bytes247-                            ?: throw IllegalStateException("peer closed"),248-                    )249-                },250-            )251-252-            // Browser first, then us — matching the contract's ordering.253-            val theirIdentity = parsePairIdentityFrame(254-                session.decrypt((ws.receive() as? WsMessage.Binary)?.bytes ?: throw IllegalStateException("peer closed")),255-            )256-            require(257-                java.security.MessageDigest.isEqual(258-                    authenticatedInitiatorKey,259-                    hexToPubkey(theirIdentity.longTermPublicKeyHex),260-                ),261-            ) { "PAIR_IDENTITY key does not match proven initiator key" }262-            ws.send(session.encrypt(encodePairIdentityFrame(localIdentity)))263-264-            val sas = SASDerivation.derive(session.handshakeHash)265-            val device = Rendezvous.bindPairState(266-                device = pairIdentityToPairedDevice(theirIdentity),267-                handshakeHash = session.handshakeHash,268-                // The device displaying the code chooses the mesh relay.269-                relayUrl = localIdentity.relayUrl,270-            )271-            val pending = PairingSession()272-            val name = device.deviceName?.takeIf { it.isNotBlank() } ?: "Unknown device"273-274-            // Hand the SAS to the UI and block here. Persisting before the user275-            // has compared the digits would make the comparison meaningless.276-            val confirmation = PairingEvent.AwaitingConfirmation(sas, name, pending)277-            confirmationSink?.invoke(confirmation)278-            if (!pending.await()) {279-                ws.closeSilently()280-                return@withContext PairingEvent.Rejected("sas_mismatch")281-            }282-283-            // A direct code pairing means a physically present user confirmed284-            // the SAS on both screens — the only thing allowed to lift a285-            // terminal revocation (see PairedDeviceStore.revoke).286-            deviceStore.clearRevocation(device.deviceId)287-            deviceStore.upsert(device)288-            PairingEvent.Paired(name)289-        } catch (e: Exception) {290-            ws.closeSilently()291-            PairingEvent.Rejected(e.message ?: "pairing_failed")292-        } finally {293-            noiseSession?.close()294-            runCatching { client.close() }295-        }296-    }297-298-    private suspend fun handleAdoption(299-        ws: WebSocketConnection,300-        session: NoiseNKSession,301-        localIdentity: LocalChirpIdentity,302-        sourceDeps: AdoptionSourceDeps,303-    ): PairingEvent {304-        val channel = object : PairingTransport {305-            override suspend fun send(msg: ByteArray) = ws.send(session.encrypt(msg))306-            override suspend fun receive(): ByteArray = session.decrypt(307-                (ws.receive() as? WsMessage.Binary)?.bytes308-                    ?: throw IllegalStateException("peer closed"),309-            )310-            override suspend fun close() = ws.closeSilently()311-        }312-        val request = receiveFrame(channel)313-        require(isAdoptRequest(request)) { "expected ADOPT_REQUEST" }314-        request as AdoptionFrame.Request315-316-        val pending = PairingSession()317-        val name = request.deviceName.ifBlank { "New device" }318-        confirmationSink?.invoke(319-            PairingEvent.AwaitingConfirmation(320-                SASDerivation.derive(session.handshakeHash),321-                name,322-                pending,323-            ),324-        )325-        if (!pending.await()) return PairingEvent.Rejected("sas_mismatch")326-327-        val pairState = AdoptionPairState(328-            rendezvousSecretHex = Rendezvous.bytesToHex(329-                Rendezvous.deriveSecret(session.handshakeHash),330-            ),331-            relayUrl = localIdentity.relayUrl,332-        )333-        val boundDeps = object : AdoptionSourceDeps {334-            override val sourceIdentity = localIdentity335-            override val pairState = pairState336-            override suspend fun rootKeyHex() = sourceDeps.rootKeyHex()337-            override suspend fun vaultId() = sourceDeps.vaultId()338-            override suspend fun license() = sourceDeps.license()339-            override suspend fun onConsent(request: AdoptionFrame.Request) = true340-            override suspend fun upsertPairedDevice(device: PairedDevice) {341-                sourceDeps.upsertPairedDevice(device)342-            }343-        }344-        return if (grantAdoption(channel, request, boundDeps) != null) {345-            PairingEvent.Paired(name)346-        } else {347-            PairingEvent.Rejected("adoption_rejected")348-        }349-    }350-351-    /**352-     * Set by the ViewModel so the SAS reaches the UI while [handleClient] is353-     * still blocked inside the connection.354-     */355-    var confirmationSink: ((PairingEvent.AwaitingConfirmation) -> Unit)? = null356-357-    private fun rejectSilently(ws: WebSocketConnection, reason: String): PairingEvent {358-        ws.closeSilently()359-        return PairingEvent.Rejected(reason)360-    }361-362-    /** The token is low-value, but comparing it in constant time costs nothing. */363-    private fun constantTimeEquals(a: String, b: String): Boolean {364-        return CryptoCompare.utf8(a, b)365-    }366-367-    /**368-     * The address to put in the code — it has to be the one the browser can369-     * actually dial, which is the Wi-Fi address.370-     *371-     * Interface order is not meaningful, so taking the first site-local IPv4372-     * can hand back a VPN (tun/ppp) or tethering (ap/rndis) address. Both are373-     * site-local and both produce a code that looks fine and then times out374-     * with nothing to debug, so Wi-Fi-ish names are preferred explicitly and375-     * tunnels are excluded rather than merely deprioritised.376-     */377-    internal fun localIpv4(): String? = runCatching {378-        val candidates = NetworkInterface.getNetworkInterfaces().toList()379-            .filter { it.isUp && !it.isLoopback && !it.isVirtual }380-            .filterNot { iface -> TUNNEL_PREFIXES.any { iface.name.startsWith(it) } }381-382-        fun addressOf(iface: NetworkInterface): String? = iface.inetAddresses.toList()383-            .filterIsInstance<Inet4Address>()384-            .firstOrNull { it.isSiteLocalAddress }385-            ?.hostAddress386-387-        candidates.firstOrNull { it.name.startsWith("wlan") }?.let(::addressOf)388-            ?: candidates.firstNotNullOfOrNull(::addressOf)389-    }.getOrNull()390-}

@@ -1,343 +0,0 @@1-package com.peachpasswords.sync2-3-import android.content.Context4-import android.net.nsd.NsdManager5-import android.net.nsd.NsdServiceInfo6-import android.os.Build7-import dagger.hilt.android.qualifiers.ApplicationContext8-import kotlinx.coroutines.CoroutineScope9-import kotlinx.coroutines.Dispatchers10-import kotlinx.coroutines.channels.awaitClose11-import kotlinx.coroutines.flow.Flow12-import kotlinx.coroutines.flow.callbackFlow13-import kotlinx.coroutines.isActive14-import kotlinx.coroutines.launch15-import kotlinx.coroutines.withContext16-import org.json.JSONObject17-import java.net.ServerSocket18-import java.net.Socket19-import java.nio.charset.StandardCharsets20-import javax.inject.Inject21-import javax.inject.Singleton22-23-/**24- * C7 TCP + mDNS reconnect SERVER (responder side).25- *26- * Listens on an OS-assigned TCP port, advertises itself over mDNS as27- * `_peach._tcp`, and for each inbound connection runs the REAL responder28- * pipeline:29- *   1. Resolve PEACH_RECONNECT against paired local state, then run Noise KK30- *      over length-prefixed frames ([SocketFrameIO]).31- *   2. PAIR_IDENTITY frame exchange — encoded/decoded with the SAME private32- *      helpers ChirpPairing uses; since those are file-private there, this draft33- *      re-derives the identity frame via [LocalChirpIdentity] and a minimal34- *      JSON, and parses the peer's via [parsePairIdentityFrame]. See35- *      C7-INTEGRATION.md: the cleanest integration promotes ChirpPairing's36- *      encode/decodePairingFrame to internal and deletes these shims.37- *   3. Encrypted vault sync via the REAL [runChirpSyncResponder] over a38- *      [ChirpSyncSession] backed by the Noise session.39- *40- * Reconnect is strictly KK. The opaque selector capability is resolved against41- * local paired state before the handshake, both static keys are authenticated42- * by the named pattern, and failure never falls back to first-pair NK.43- *  - The brief calls `syncAdapter.buildResponse/applyRequest`. NO SUCH METHODS.44- *    The real per-round protocol is [runChirpSyncResponder]; the adapter is a45- *    [ChirpSyncVaultAdapter] ([VaultSyncAdapter]) with getEncryptedEntries/46- *    applyEntries/etc. We drive the whole round, not single request/response.47- */48-@Singleton49-class MdnsPairingServer @Inject constructor(50-    private val deviceStore: PairedDeviceStore,51-    @ApplicationContext private val ctx: Context,52-) {53-    private var serverSocket: ServerSocket? = null54-    private var nsdManager: NsdManager? = null55-    private var registrationListener: NsdManager.RegistrationListener? = null56-57-    /**58-     * Start listening + advertise + accept. Caller supplies:59-     *  - [ourStaticPrivateKey]/[ourStaticPublicKey]: the device's long-term sync60-     *    identity (from [deriveSyncIdentityKeypair]) — the KK responder static61-     *    key, also published in mDNS TXT "pk".62-     *  - [vaultFactory]: builds a fresh [ChirpSyncVaultAdapter] per connection63-     *    (the vault may lock/unlock between connections).64-     *  - [localIdentity]: our PAIR_IDENTITY payload.65-     */66-    fun start(67-        scope: CoroutineScope,68-        ourStaticPrivateKey: ByteArray,69-        ourStaticPublicKey: ByteArray,70-        localIdentity: LocalChirpIdentity,71-        vaultFactory: () -> ChirpSyncVaultAdapter?,72-    ): Flow<PairingServerEvent> = callbackFlow {73-        val socket = withContext(Dispatchers.IO) { ServerSocket(0) }74-        serverSocket = socket75-        val port = socket.localPort76-77-        registerMdns(port, ourStaticPublicKey, localIdentity.deviceId)78-        trySend(PairingServerEvent.Started(port))79-80-        val acceptJob = scope.launch(Dispatchers.IO) {81-            while (isActive && !socket.isClosed) {82-                val client = try {83-                    socket.accept()84-                } catch (_: Throwable) {85-                    break86-                }87-                launch {88-                    val event = handleClient(client, ourStaticPrivateKey, ourStaticPublicKey, localIdentity, vaultFactory)89-                    trySend(event)90-                }91-            }92-        }93-94-        awaitClose {95-            acceptJob.cancel()96-            stop()97-        }98-    }99-100-    fun stop() {101-        registrationListener?.let { l -> runCatching { nsdManager?.unregisterService(l) } }102-        registrationListener = null103-        runCatching { serverSocket?.close() }104-        serverSocket = null105-    }106-107-    private suspend fun handleClient(108-        socket: Socket,109-        ourStaticPrivateKey: ByteArray,110-        ourStaticPublicKey: ByteArray,111-        localIdentity: LocalChirpIdentity,112-        vaultFactory: () -> ChirpSyncVaultAdapter?,113-    ): PairingServerEvent {114-        val transport = SocketFrameIO(115-            input = socket.getInputStream(),116-            output = socket.getOutputStream(),117-            onClose = { withContext(Dispatchers.IO) { runCatching { socket.close() } } },118-        )119-        var noiseSession: NoiseNKSession? = null120-        return try {121-            val selector = JSONObject(String(transport.receive(), Charsets.UTF_8))122-            require(selector.optString("type") == "PEACH_RECONNECT") { "expected PEACH_RECONNECT" }123-            val rendezvousId = selector.optString("rendezvous_id")124-            val known = Rendezvous.resolvePeer(deviceStore.getAll(), rendezvousId)125-                ?: throw IllegalArgumentException("unknown reconnect peer")126-            val initiatorKeyHex = known.longTermPublicKeyHex127-                ?: throw IllegalArgumentException("known peer missing static key")128-            val initiatorKey = hexToPubkey(initiatorKeyHex)129-130-            val session = noiseKKResponder(131-                ourStaticPrivateKey,132-                ourStaticPublicKey,133-                initiatorKey,134-                transport::send,135-                transport::receive,136-            )137-            noiseSession = session138-139-            // 2. PAIR_IDENTITY exchange (responder reads first, then answers) —140-            //    mirrors ChirpPairing.runPairingResponder ordering.141-            val theirIdentity = parsePairIdentityFrame(142-                SyncPadding.unpad(session.decrypt(transport.receive())),143-            )144-            require(theirIdentity.deviceId == known.deviceId) { "peer device id changed after KK" }145-            require(146-                CryptoCompare.hex(theirIdentity.longTermPublicKeyHex, initiatorKeyHex),147-            ) { "peer identity does not match authenticated KK key" }148-            transport.send(session.encrypt(SyncPadding.pad(encodePairIdentityFrame(localIdentity))))149-150-            val sas = SASDerivation.derive(session.handshakeHash)151-            // 3. Encrypted vault sync — real responder round over a ChirpSyncSession.152-            val vault = vaultFactory()153-            if (vault != null) {154-                vault.bindAuthenticatedPeer(known)155-                val syncSession = chirpSessionOver(session, transport, initiatorKey)156-                val outcome = runChirpSyncResponder(syncSession, vault)157-                if (outcome.status == SyncOutcomeStatus.COMPLETED) {158-                    deviceStore.updateLastSync(known.deviceId)159-                }160-            }161-            transport.close()162-            PairingServerEvent.SyncComplete(known.deviceId, sas)163-        } catch (e: Throwable) {164-            transport.close()165-            PairingServerEvent.Error(e.message ?: "pairing_server_error")166-        } finally {167-            noiseSession?.close()168-        }169-    }170-171-    private fun registerMdns(port: Int, staticPub: ByteArray, deviceId: String) {172-        val manager = ctx.getSystemService(NsdManager::class.java) ?: return173-        nsdManager = manager174-        val info = NsdServiceInfo().apply {175-            serviceName = buildServiceName(deviceId)176-            serviceType = PEACH_SERVICE_TYPE177-            this.port = port178-            // NsdServiceInfo.setAttribute is API 21+; minSdk is 26.179-            setAttribute("v", PROTOCOL_VERSION)180-            setAttribute("pk", pubkeyToHex(staticPub))181-            setAttribute("id", deviceId)182-        }183-        val listener = object : NsdManager.RegistrationListener {184-            override fun onServiceRegistered(info: NsdServiceInfo) {}185-            override fun onRegistrationFailed(info: NsdServiceInfo, errorCode: Int) {}186-            override fun onServiceUnregistered(info: NsdServiceInfo) {}187-            override fun onUnregistrationFailed(info: NsdServiceInfo, errorCode: Int) {}188-        }189-        registrationListener = listener190-        manager.registerService(info, NsdManager.PROTOCOL_DNS_SD, listener)191-    }192-193-    private fun buildServiceName(deviceId: String): String {194-        val shortId = deviceId.take(8)195-        val model = Build.MODEL.replace(Regex("[^A-Za-z0-9-]"), "")196-        // mDNS service-instance names are capped at 63 bytes; reserve room for197-        // the "Peach-" prefix and the "-${shortId}" suffix.198-        val maxModel = 63 - "Peach-".length - 1 - shortId.length199-        val trimmedModel = if (model.length > maxModel && maxModel > 0) model.take(maxModel) else model200-        return "Peach-$trimmedModel-$shortId".take(63)201-    }202-203-    private companion object {204-        const val PEACH_SERVICE_TYPE = "_peach._tcp"205-        const val PROTOCOL_VERSION = "1"206-    }207-}208-209-sealed class PairingServerEvent {210-    data class Started(val port: Int) : PairingServerEvent()211-    data class SyncComplete(val deviceId: String, val sas: String) : PairingServerEvent()212-    data class Error(val message: String) : PairingServerEvent()213-    data object Stopped : PairingServerEvent()214-}215-216-/* ── PAIR_IDENTITY shims (see C7-INTEGRATION.md item: promote ChirpPairing's217-   private encode/decodePairingFrame to internal and drop these) ───────────── */218-219-internal data class PairIdentity(220-    val deviceId: String,221-    val deviceName: String,222-    val deviceType: DeviceType,223-    val longTermPublicKeyHex: String,224-    val signingPublicKeyHex: String?,225-    val wsPort: Int?,226-    val relayUrl: String?,227-)228-229-internal fun encodePairIdentityFrame(id: LocalChirpIdentity): ByteArray {230-    val sb = StringBuilder()231-    sb.append('{')232-    sb.append("\"type\":\"PAIR_IDENTITY\"")233-    sb.append(",\"device_id\":\"").append(jsonEscape(id.deviceId)).append('"')234-    sb.append(",\"device_name\":\"").append(jsonEscape(id.deviceName)).append('"')235-    sb.append(",\"device_type\":\"").append(id.deviceType.wireValue).append('"')236-    sb.append(",\"long_term_public_key_hex\":\"").append(id.longTermPublicKeyHex).append('"')237-    sb.append(",\"signing_public_key_hex\":\"").append(id.signingPublicKeyHex).append('"')238-    id.wsPort?.let { sb.append(",\"ws_port\":").append(it) }239-    sb.append(",\"relay_url\":\"").append(jsonEscape(id.relayUrl)).append('"')240-    sb.append('}')241-    return sb.toString().toByteArray(StandardCharsets.UTF_8)242-}243-244-internal fun parsePairIdentityFrame(bytes: ByteArray): PairIdentity {245-    val map = miniJsonObject(String(bytes, StandardCharsets.UTF_8))246-    require(map["type"] == "PAIR_IDENTITY") { "expected PAIR_IDENTITY frame" }247-    val deviceType = when (map["device_type"]) {248-        "extension" -> DeviceType.EXTENSION249-        "android" -> DeviceType.ANDROID250-        "ios" -> DeviceType.IOS251-        else -> error("device_type missing")252-    }253-    val ltpk = map["long_term_public_key_hex"] ?: error("long_term_public_key_hex missing")254-    require(ltpk.matches(Regex("^[0-9a-f]{64}$"))) { "long_term_public_key_hex not 32-byte hex" }255-    return PairIdentity(256-        deviceId = map["device_id"] ?: error("device_id missing"),257-        deviceName = map["device_name"] ?: error("device_name missing"),258-        deviceType = deviceType,259-        longTermPublicKeyHex = ltpk,260-        signingPublicKeyHex = map["signing_public_key_hex"]?.takeIf { it.isNotBlank() },261-        wsPort = map["ws_port"]?.toIntOrNull(),262-        relayUrl = map["relay_url"]?.let(Rendezvous::normalizeRelayUrl),263-    )264-}265-266-internal fun pairIdentityToPairedDevice(id: PairIdentity): PairedDevice = PairedDevice(267-    deviceId = id.deviceId,268-    deviceName = id.deviceName,269-    deviceType = id.deviceType.wireValue,270-    longTermPublicKeyHex = id.longTermPublicKeyHex,271-    signingPublicKeyHex = id.signingPublicKeyHex,272-    trustSource = "direct",273-    wsPort = id.wsPort,274-    relayUrl = id.relayUrl,275-    pairedAt = System.currentTimeMillis(),276-    lastSyncedAt = System.currentTimeMillis(),277-)278-279-/**280- * Build a [ChirpSyncSession] over an established Noise session + frame281- * transport, so the REAL [runChirpSyncInitiator]/[runChirpSyncResponder] can run282- * the encrypted vault exchange. Send/receive splice the Noise cipher onto the283- * length-prefixed frame layer; `remoteStaticPublicKey` is informational here.284- */285-internal fun chirpSessionOver(286-    session: NoiseNKSession,287-    transport: SocketFrameIO,288-    remoteStaticPublicKey: ByteArray = ByteArray(0),289-): ChirpSyncSession =290-    ChirpSyncSession(291-        remoteStaticPublicKey = remoteStaticPublicKey.copyOf(),292-        // ChirpSyncSession.send is non-suspending;293-        // SocketFrameIO.sendBlocking writes a frame synchronously.294-        send = { plaintext -> transport.sendBlocking(session.encrypt(SyncPadding.pad(plaintext))) },295-        receive = { SyncPadding.unpad(session.decrypt(transport.receive())) },296-        close = {297-            try {298-                session.close()299-            } finally {300-                transport.close()301-            }302-        },303-    )304-305-private fun jsonEscape(value: String): String = buildString(value.length) {306-    for (ch in value) when (ch) {307-        '\\' -> append("\\\\"); '"' -> append("\\\"")308-        '\n' -> append("\\n"); '\r' -> append("\\r"); '\t' -> append("\\t")309-        else -> append(ch)310-    }311-}312-313-private fun miniJsonObject(text: String): Map<String, String> {314-    val trimmed = text.trim()315-    require(trimmed.startsWith("{") && trimmed.endsWith("}")) { "expected JSON object" }316-    val body = trimmed.substring(1, trimmed.length - 1)317-    val out = linkedMapOf<String, String>()318-    var i = 0319-    while (i < body.length) {320-        while (i < body.length && body[i].isWhitespace()) i++321-        if (i >= body.length || body[i] != '"') break322-        i++323-        val keyStart = i324-        while (i < body.length && body[i] != '"') i++325-        val key = body.substring(keyStart, i); i++326-        while (i < body.length && (body[i].isWhitespace() || body[i] == ':')) i++327-        val value: String328-        if (i < body.length && body[i] == '"') {329-            i++330-            val vStart = i331-            while (i < body.length && body[i] != '"') i++332-            value = body.substring(vStart, i); i++333-        } else {334-            val vStart = i335-            while (i < body.length && body[i] != ',') i++336-            value = body.substring(vStart, i).trim()337-        }338-        out[key] = value339-        while (i < body.length && body[i].isWhitespace()) i++340-        if (i < body.length && body[i] == ',') i++341-    }342-    return out343-}

@@ -1,152 +0,0 @@1-package com.peachpasswords.sync2-3-import java.security.SecureRandom4-5-/**6- * The compact join code this phone displays and the user types into the7- * browser. Exact port of the browser's `shared/pairing-code.ts`, which is the8- * authoritative definition of the wire format — the browser only ever decodes,9- * the phone is the only side that generates.10- *11- * Payload: IPv4 (4 bytes) | port (2 bytes, big-endian) | token (>= 4 bytes),12- * in Crockford's Base32, displayed in groups of four:13- *14- *     A74H-48J3-KI32-OEP415- *16- * Token length is deliberately open — everything after the port is token — so17- * this side can pick anywhere in the 4–10 byte range with no coordinated change18- * on the browser.19- *20- * SECURITY: the token travels in the clear in the hello frame and is NOT the21- * security boundary; the user-compared SAS after the Noise NK handshake is. The22- * token only stops an unrelated host on the same LAN from consuming the pairing23- * window.24- */25-object PairingCode {26-    private const val ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"27-    private const val IP_BYTES = 428-    private const val PORT_BYTES = 229-    // Decoding stays lenient about token length so a peer on an older build30-    // (8-byte tokens, 23 characters) still pairs instead of hard-failing.31-    // Encoding is strict — see TOKEN_BYTES.32-    private const val MIN_TOKEN_BYTES = 433-    private const val MAX_TOKEN_BYTES = 1634-35-    /**36-     * 4 bytes, which is what a four-group code actually costs.37-     *38-     * Base32 packs 5 bits per character, so the code length is fixed by the39-     * payload: IP(4) + port(2) + token(n) bytes → ceil((6+n)*8/5) characters.40-     * A 4-byte token is 10 bytes → exactly 16 characters → four clean groups,41-     * and is the only size that lands on a group boundary. 8 bytes was 2342-     * characters and six groups, which is the code June was looking at.43-     *44-     * The brief asks for both "8–10 byte token" and "~4 groups"; those are not45-     * the same code. Its own worked example — A74H-48J3-KI32-OEP4, 1646-     * characters — is a 4-byte token, so the example is what this follows.47-     *48-     * 32 bits is sound here because the token is not the security boundary:49-     * it is single-use, lives for one short pairing window, is only reachable50-     * from the same LAN, and a peer that guesses it still cannot pair without51-     * the user confirming a matching SAS. Its whole job is to stop an52-     * unrelated host from consuming the window. The browser independently sets53-     * its floor at 4 bytes ([MIN_TOKEN_BYTES] there), so this is the shortest54-     * code both sides accept rather than a number picked to be short.55-     */56-    const val TOKEN_BYTES = 457-58-    private val rng = SecureRandom()59-60-    data class Parsed(val ip: String, val port: Int, val tokenHex: String)61-62-    fun newToken(): ByteArray = ByteArray(TOKEN_BYTES).also(rng::nextBytes)63-64-    fun encode(ip: String, port: Int, token: ByteArray): String {65-        val octets = ip.split(".")66-        require(octets.size == IP_BYTES) { "ip must be dotted-quad IPv4" }67-        require(port in 1..65535) { "invalid port: $port" }68-        // Strict, mirroring the browser: a longer token silently produces a69-        // longer code, which is exactly the bug this guard exists to prevent.70-        require(token.size == TOKEN_BYTES) {71-            "token must be exactly $TOKEN_BYTES bytes (got ${token.size}); " +72-                "every extra byte adds 1.6 characters to the code"73-        }74-75-        val bytes = ByteArray(IP_BYTES + PORT_BYTES + token.size)76-        for (i in 0 until IP_BYTES) {77-            val n = octets[i].toIntOrNull()78-            require(n != null && n in 0..255) { "invalid IPv4 octet: ${octets[i]}" }79-            bytes[i] = n.toByte()80-        }81-        bytes[4] = ((port shr 8) and 0xff).toByte()82-        bytes[5] = (port and 0xff).toByte()83-        token.copyInto(bytes, IP_BYTES + PORT_BYTES)84-        return group(encodeCrockford(bytes))85-    }86-87-    /** Null for anything that is not a well-formed code, never an exception. */88-    fun parse(input: String): Parsed? {89-        val bytes = decodeCrockford(input) ?: return null90-        val tokenBytes = bytes.size - IP_BYTES - PORT_BYTES91-        if (tokenBytes < MIN_TOKEN_BYTES || tokenBytes > MAX_TOKEN_BYTES) return null92-        val port = ((bytes[4].toInt() and 0xff) shl 8) or (bytes[5].toInt() and 0xff)93-        if (port == 0) return null94-        return Parsed(95-            ip = (0 until IP_BYTES).joinToString(".") { (bytes[it].toInt() and 0xff).toString() },96-            port = port,97-            tokenHex = bytes.copyOfRange(IP_BYTES + PORT_BYTES, bytes.size).toHex(),98-        )99-    }100-101-    fun ByteArray.toHex(): String = joinToString("") { "%02x".format(it) }102-103-    private fun group(chars: String): String =104-        chars.chunked(4).joinToString("-")105-106-    private fun encodeCrockford(bytes: ByteArray): String {107-        val s = StringBuilder()108-        var acc = 0109-        var bits = 0110-        for (b in bytes) {111-            acc = (acc shl 8) or (b.toInt() and 0xff)112-            bits += 8113-            while (bits >= 5) {114-                bits -= 5115-                s.append(ALPHABET[(acc shr bits) and 0x1f])116-            }117-        }118-        if (bits > 0) s.append(ALPHABET[(acc shl (5 - bits)) and 0x1f])119-        return s.toString()120-    }121-122-    private fun decodeCrockford(input: String): ByteArray? {123-        // Crockford's alphabet omits I, L, O and U; decoding folds I/L -> 1 and124-        // O -> 0 so a code misread off a phone screen still resolves.125-        val clean = buildString {126-            for (c in input.uppercase()) when (c) {127-                ' ', '-', '\t', '\n' -> Unit128-                'I', 'L' -> append('1')129-                'O' -> append('0')130-                else -> append(c)131-            }132-        }133-        if (clean.isEmpty()) return null134-135-        // Trailing bits that don't complete a byte are padding and are dropped.136-        val out = ByteArray(clean.length * 5 / 8)137-        var acc = 0138-        var bits = 0139-        var o = 0140-        for (ch in clean) {141-            val v = ALPHABET.indexOf(ch)142-            if (v < 0) return null143-            acc = (acc shl 5) or v144-            bits += 5145-            if (bits >= 8) {146-                bits -= 8147-                out[o++] = ((acc shr bits) and 0xff).toByte()148-            }149-        }150-        return out151-    }152-}

@@ -1,310 +0,0 @@1-package com.peachpasswords.sync2-3-import android.content.Context4-import android.net.nsd.NsdManager5-import android.net.nsd.NsdServiceInfo6-import android.net.wifi.WifiManager7-import dagger.hilt.android.qualifiers.ApplicationContext8-import kotlinx.coroutines.Dispatchers9-import kotlinx.coroutines.channels.awaitClose10-import kotlinx.coroutines.flow.Flow11-import kotlinx.coroutines.flow.callbackFlow12-import kotlinx.coroutines.flow.first13-import kotlinx.coroutines.withContext14-import kotlinx.coroutines.withTimeoutOrNull15-import org.json.JSONObject16-import java.net.InetSocketAddress17-import java.net.Socket18-import java.net.SocketTimeoutException19-import javax.inject.Inject20-import javax.inject.Singleton21-22-/**23- * C7 TCP + mDNS reconnect CLIENT (initiator side). Discovers `_peach._tcp`24- * peers, dials one, and runs the REAL initiator pipeline:25- *   1. An opaque, rotating PEACH_RECONNECT capability lets the responder choose26- *      an already-paired local record, then Noise KK authenticates both stored27- *      static keys.28- *   2. PAIR_IDENTITY exchange (initiator writes first, then reads), matching29- *      ChirpPairing.runPairingInitiator ordering.30- *   3. SAS via the REAL [SASDerivation.derive] over the Noise handshake hash.31- *   4. Encrypted vault sync via the REAL [runChirpSyncInitiator] over a32- *      [ChirpSyncSession].33- *34- * ── Reconciliation with the brief ──────────────────────────────────────────35- *  - Reconnect is strictly KK: both local static keys are inputs and a failure36- *    never negotiates or retries NK. The returned [NoiseNKSession] interface is37- *    transport-neutral legacy naming, not the active handshake pattern.38- *  - `syncAdapter.buildRequest/applyResponse` do NOT exist. Real round driver is39- *    [runChirpSyncInitiator] against a [ChirpSyncVaultAdapter].40- *  - `peer.serviceInfo.host/.port`: on API < 34, [NsdServiceInfo.getHost] is41- *    deprecated; on the supported floor it still returns the resolved42- *    InetAddress, which we use for the dial. The resolved port is authoritative.43- */44-@Singleton45-class PairingDiscoveryClient @Inject constructor(46-    @ApplicationContext private val ctx: Context,47-    private val deviceStore: PairedDeviceStore,48-) {49-    /**50-     * Discover nearby Peach instances via mDNS. Each found service is resolved,51-     * its TXT records parsed into a [DiscoveredPeer], and emitted. The flow runs52-     * until the collector cancels (e.g. via kotlinx `.timeout(...)` or `first`).53-     */54-    fun discoverPeers(): Flow<DiscoveredPeer> = callbackFlow {55-        val manager = ctx.getSystemService(NsdManager::class.java)56-            ?: run { close(); return@callbackFlow }57-58-        // mDNS/NSD relies on Wi-Fi multicast, which Android drops by default to save59-        // power. Hold a MulticastLock for the lifetime of discovery so service60-        // announcements actually reach us (requires CHANGE_WIFI_MULTICAST_STATE).61-        val multicastLock = (ctx.getSystemService(Context.WIFI_SERVICE) as? WifiManager)62-            ?.createMulticastLock("peach-mdns")63-            ?.apply { setReferenceCounted(false); runCatching { acquire() } }64-65-        val resolveListener = object : NsdManager.ResolveListener {66-            override fun onServiceResolved(resolved: NsdServiceInfo) {67-                parsePeer(resolved)?.let { trySend(it) }68-            }69-            override fun onResolveFailed(info: NsdServiceInfo, errorCode: Int) {}70-        }71-72-        val discoveryListener = object : NsdManager.DiscoveryListener {73-            override fun onServiceFound(info: NsdServiceInfo) {74-                if (info.serviceType.trimEnd('.') == PEACH_SERVICE_TYPE) {75-                    runCatching { manager.resolveService(info, resolveListener) }76-                }77-            }78-            override fun onServiceLost(info: NsdServiceInfo) {}79-            override fun onDiscoveryStarted(serviceType: String) {}80-            override fun onDiscoveryStopped(serviceType: String) {}81-            override fun onStartDiscoveryFailed(serviceType: String, errorCode: Int) { close() }82-            override fun onStopDiscoveryFailed(serviceType: String, errorCode: Int) {}83-        }84-85-        manager.discoverServices(PEACH_SERVICE_TYPE, NsdManager.PROTOCOL_DNS_SD, discoveryListener)86-        awaitClose {87-            runCatching { manager.stopServiceDiscovery(discoveryListener) }88-            multicastLock?.let { if (it.isHeld) runCatching { it.release() } }89-        }90-    }91-92-    /**93-     * Dial [peer], run the Noise KK initiator handshake, exchange identities and94-     * derive the SAS, then run one initiator sync round.95-     *96-     * Caller supplies the local static identity and private key required by KK,97-     * plus a vault adapter factory. The pre-handshake selector is an opaque98-     * rendezvous capability; it never discloses either stored public key.99-     */100-    private suspend fun connectAndSync(101-        peer: DiscoveredPeer,102-        localIdentity: LocalChirpIdentity,103-        localStaticPrivateKey: ByteArray,104-        rendezvousId: String,105-        vaultFactory: () -> ChirpSyncVaultAdapter?,106-        connectTimeoutMs: Int = 15_000,107-    ): PairingResult = withContext(Dispatchers.IO) {108-        val socket = Socket()109-        var noiseSession: NoiseNKSession? = null110-        try {111-            socket.connect(InetSocketAddress(peer.host, peer.port), connectTimeoutMs)112-            socket.soTimeout = connectTimeoutMs113-114-            val transport = SocketFrameIO(115-                input = socket.getInputStream(),116-                output = socket.getOutputStream(),117-                onClose = { withContext(Dispatchers.IO) { runCatching { socket.close() } } },118-            )119-120-            val localPublicKey = hexToPubkey(localIdentity.longTermPublicKeyHex)121-            transport.send(122-                JSONObject()123-                    .put("type", "PEACH_RECONNECT")124-                    .put("rendezvous_id", rendezvousId)125-                    .toString()126-                    .toByteArray(Charsets.UTF_8),127-            )128-            val session = try {129-                noiseKKInitiator(130-                    localStaticPrivateKey,131-                    localPublicKey,132-                    peer.remoteStaticPublicKey,133-                    transport::send,134-                    transport::receive,135-                )136-            } catch (e: Throwable) {137-                transport.close()138-                return@withContext PairingResult.Error(PairingError.HANDSHAKE_FAILED)139-            }140-            noiseSession = session141-142-            // PAIR_IDENTITY: initiator writes first, then reads (mirrors143-            // ChirpPairing.runPairingInitiator).144-            transport.send(session.encrypt(SyncPadding.pad(encodePairIdentityFrame(localIdentity))))145-            val theirIdentity = parsePairIdentityFrame(146-                SyncPadding.unpad(session.decrypt(transport.receive())),147-            )148-            require(theirIdentity.deviceId == peer.deviceId) { "peer device id changed after KK" }149-            require(150-                CryptoCompare.hex(151-                    theirIdentity.longTermPublicKeyHex,152-                    pubkeyToHex(peer.remoteStaticPublicKey),153-                ),154-            ) { "peer identity does not match authenticated KK key" }155-156-            val sas = SASDerivation.derive(session.handshakeHash)157-            val incoming = pairIdentityToPairedDevice(theirIdentity)158-            val existing = deviceStore.getByPubkey(incoming.longTermPublicKeyHex.orEmpty())159-                ?: deviceStore.get(incoming.deviceId)160-            val device = incoming.copy(161-                rendezvousSecretHex = existing?.rendezvousSecretHex,162-                relayUrl = existing?.relayUrl ?: incoming.relayUrl,163-            )164-            deviceStore.upsert(device)165-166-            // Encrypted vault sync — real initiator round.167-            val vault = vaultFactory()168-            if (vault != null) {169-                vault.bindAuthenticatedPeer(device)170-                val syncSession = chirpSessionOver(session, transport, peer.remoteStaticPublicKey)171-                val outcome = runChirpSyncInitiator(syncSession, vault)172-                if (outcome.status == SyncOutcomeStatus.COMPLETED) {173-                    deviceStore.updateLastSync(device.deviceId)174-                }175-            }176-177-            transport.close()178-            PairingResult.Success(device, sas)179-        } catch (e: SocketTimeoutException) {180-            runCatching { socket.close() }181-            PairingResult.Error(PairingError.TIMEOUT)182-        } catch (e: Throwable) {183-            runCatching { socket.close() }184-            PairingResult.Error(PairingError.IO_ERROR)185-        } finally {186-            noiseSession?.close()187-        }188-    }189-190-    /**191-     * Dial a known peer: the cached address first, discovery only as a fallback.192-     *193-     * [cached] is the peer's last-known endpoint, refreshed by the listener on194-     * every inbound reconnect. Trying it first is the "silent reconnect" the195-     * sync design asks for (§6) — this used to go straight to mDNS and report196-     * NOT_FOUND after a 5s timeout, so a peer that was perfectly reachable at197-     * its cached address failed to sync whenever discovery was unavailable,198-     * which on a home network is often.199-     *200-     * The cached attempt gets a short timeout: a stale address is the normal201-     * case after a network change, and it must not delay the fallback.202-     */203-    suspend fun syncWithKnownDevice(204-        deviceId: String,205-        localIdentity: LocalChirpIdentity,206-        localStaticPrivateKey: ByteArray,207-        vaultFactory: () -> ChirpSyncVaultAdapter?,208-        discoveryTimeoutMs: Long = 5_000L,209-        cached: DiscoveredPeer? = null,210-        cachedTimeoutMs: Int = 2_000,211-    ): PairingResult {212-        val paired = deviceStore.get(deviceId)213-            ?: return PairingResult.Error(PairingError.NOT_FOUND)214-        val secret = paired.rendezvousSecretHex215-            ?.let { runCatching { Rendezvous.secretFromHex(it) }.getOrNull() }216-            ?: return PairingResult.Error(PairingError.HANDSHAKE_FAILED)217-        val rendezvousIds = Rendezvous.dialingIds(218-            secret,219-            System.currentTimeMillis() / 1000L,220-        )221-        if (cached != null) {222-            val pinnedCached = pinDiscoveredPeerToPairedState(paired, cached)223-            for (rendezvousId in rendezvousIds) {224-                val viaCache = connectAndSync(225-                    pinnedCached,226-                    localIdentity,227-                    localStaticPrivateKey,228-                    rendezvousId,229-                    vaultFactory,230-                    connectTimeoutMs = cachedTimeoutMs,231-                )232-                if (viaCache is PairingResult.Success) return viaCache233-            }234-        }235-        val discovered = withTimeoutOrNull(discoveryTimeoutMs) {236-            discoverPeers().first { it.deviceId == deviceId }237-        } ?: return PairingResult.Error(PairingError.NOT_FOUND)238-        val peer = pinDiscoveredPeerToPairedState(paired, discovered)239-        var last: PairingResult = PairingResult.Error(PairingError.HANDSHAKE_FAILED)240-        for (rendezvousId in rendezvousIds) {241-            last = connectAndSync(242-                peer,243-                localIdentity,244-                localStaticPrivateKey,245-                rendezvousId,246-                vaultFactory,247-            )248-            if (last is PairingResult.Success) return last249-        }250-        return last251-    }252-253-    private fun parsePeer(info: NsdServiceInfo): DiscoveredPeer? {254-        val attrs = info.attributes ?: return null255-        val pkHex = attrs["pk"]?.let { String(it, Charsets.UTF_8) } ?: return null256-        if (!pkHex.matches(Regex("^[0-9a-f]{64}$"))) return null257-        val deviceId = attrs["id"]?.let { String(it, Charsets.UTF_8) } ?: return null258-        @Suppress("DEPRECATION")259-        val host = info.host?.hostAddress ?: return null260-        return DiscoveredPeer(261-            deviceId = deviceId,262-            deviceName = info.serviceName,263-            host = host,264-            port = info.port,265-            remoteStaticPublicKey = hexToPubkey(pkHex),266-        )267-    }268-269-    private companion object {270-        const val PEACH_SERVICE_TYPE = "_peach._tcp"271-    }272-}273-274-data class DiscoveredPeer(275-    val deviceId: String,276-    val deviceName: String,277-    val host: String,278-    val port: Int,279-    /** Paired responder static public key, parsed from TXT "pk" and pinned in KK. */280-    val remoteStaticPublicKey: ByteArray,281-)282-283-/**284- * Discovery supplies reachability only. KK's responder key always comes from285- * paired local state; a spoofed mDNS TXT record can redirect or deny service,286- * but cannot choose the key the initiator authenticates.287- */288-internal fun pinDiscoveredPeerToPairedState(289-    paired: PairedDevice,290-    discovered: DiscoveredPeer,291-): DiscoveredPeer {292-    require(discovered.deviceId == paired.deviceId) { "discovered peer id does not match paired state" }293-    val expectedKey = paired.longTermPublicKeyHex294-        ?: throw IllegalArgumentException("paired peer missing static key")295-    return discovered.copy(remoteStaticPublicKey = hexToPubkey(expectedKey))296-}297-298-sealed class PairingResult {299-    data class Success(val device: PairedDevice, val sasCode: String) : PairingResult()300-    data class Error(val reason: PairingError) : PairingResult()301-}302-303-enum class PairingError {304-    NOT_FOUND,305-    HANDSHAKE_FAILED,306-    VERSION_MISMATCH,307-    ALREADY_PAIRED,308-    TIMEOUT,309-    IO_ERROR,310-}