restructure browser sync around public/private/off relay modes and delete the LAN transport: pairing codes, subnet probing, the address cache and the local-network module all go, leaving one relay path (v4.2.0)

@@ -1,142 +0,0 @@1-// Background wiring for code pairing.2-//3-// Keeps `code-pairing.ts` a PURE, dependency-injected client (so its unit tests4-// run without chrome / vault / WebSocket). This module supplies the production5-// `CodePairingDeps` and the single-flight SAS/confirm round-trip that bridges6-// the blocking `confirm(sas)` callback to the popup via runtime messages:7-//8-//   PAIR_WITH_CODE    → startCodePairing()            (popup → bg, messages.ts)9-//   CODE_PAIR_SAS     ← push when onSasReady fires    (bg → popup)10-//   CODE_PAIR_CONFIRM → resolveCodePairingConfirm()   (popup → bg, messages.ts)11-//   CODE_PAIR_RESULT  ← push on complete/error        (bg → popup)12-13-import {14-  pairWithCode,15-  type CodePairingDeps,16-  type CodePairingCallbacks,17-} from "./code-pairing";18-import { openPairingSocket } from "../shared/pairing-dial";19-import {20-  clearDeviceRevocation,21-  upsertPairedDevice,22-  setLastKnownIp,23-} from "./paired-devices";24-import { buildLocalIdentity } from "./device-identity";25-import { computeVaultId, deriveSyncIdentityKeypair } from "../shared/sync-identity";26-import { isUnlocked, getRootKeyHex } from "./vault";27-import type { LocalIdentity } from "../shared/pairing-handshake";28-import { getRelaySettings } from "./relay-settings";29-30-function hexToBytesLocal(hex: string): Uint8Array {31-  const out = new Uint8Array(hex.length / 2);32-  for (let i = 0; i < out.length; i++) out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);33-  return out;34-}35-36-/** Best-effort push to the popup. The popup may be closed — pushes are advisory. */37-function push(type: string, payload: unknown): void {38-  try {39-    const maybe = chrome.runtime.sendMessage({ type, payload }) as unknown;40-    if (maybe && typeof (maybe as Promise<unknown>).catch === "function") {41-      (maybe as Promise<unknown>).catch(() => undefined);42-    }43-  } catch {44-    // Popup closed / no receiver — fine.45-  }46-}47-48-/** Production dependency set — real WebSocket, identity, and storage. */49-export function productionCodePairingDeps(): CodePairingDeps {50-  return {51-    openSocket: (ip, port) => openPairingSocket(ip, port),52-    async getRelayUrl() {53-      return (await getRelaySettings()).relayUrl;54-    },55-    async getLocalIdentity(): Promise<{56-      identity: LocalIdentity;57-      privateKey: Uint8Array;58-      publicKey: Uint8Array;59-    }> {60-      if (!isUnlocked()) throw new Error("vault_locked");61-      const masterKeyHex = getRootKeyHex();62-      if (!masterKeyHex) throw new Error("vault_locked");63-      // SEV-2-B: derive from the stable ROOT key so pairing survives a64-      // master-password change. Zero the copy when done.65-      const masterKey = hexToBytesLocal(masterKeyHex);66-      try {67-        const base = await buildLocalIdentity(masterKey);68-        const vaultId = await computeVaultId(masterKey);69-        const keys = deriveSyncIdentityKeypair(masterKey, base.deviceId);70-        return {71-          identity: { ...base, vaultId },72-          privateKey: keys.secretKey,73-          publicKey: keys.publicKey,74-        };75-      } finally {76-        masterKey.fill(0);77-      }78-    },79-    // A direct code pairing means a physically present user confirmed the SAS80-    // on both screens — the strongest consent signal in the system, and the81-    // only thing allowed to lift a terminal revocation (see revokeDeviceById).82-    persistDevice: async (d) => {83-      await clearDeviceRevocation(d.deviceId);84-      await upsertPairedDevice(d);85-    },86-    cacheLastKnownIp: (pubkeyHex, ip) => setLastKnownIp(pubkeyHex, ip),87-  };88-}89-90-// ── Single in-flight pairing per worker ──────────────────────────────────────91-// One pairing at a time. The blocking confirm() resolver is parked here while92-// the popup shows the SAS; CODE_PAIR_CONFIRM resolves it.93-let pendingConfirm: ((confirmed: boolean) => void) | null = null;94-let inFlight = false;95-96-function clearPairingState(): void {97-  pendingConfirm = null;98-  inFlight = false;99-}100-101-export function isCodePairingInFlight(): boolean {102-  return inFlight;103-}104-105-/**106- * Kick off a code pairing. Returns immediately; the SAS and the terminal107- * result are delivered to the popup as CODE_PAIR_SAS / CODE_PAIR_RESULT108- * pushes. `deps` is injectable for tests.109- */110-export function startCodePairing(111-  code: string,112-  deps: CodePairingDeps = productionCodePairingDeps(),113-): void {114-  inFlight = true;115-  const cb: CodePairingCallbacks = {116-    onSasReady: (sas) => push("CODE_PAIR_SAS", { sas }),117-    onComplete: (device) => {118-      push("CODE_PAIR_RESULT", { status: "complete", device });119-      clearPairingState();120-    },121-    onError: (error) => {122-      push("CODE_PAIR_RESULT", { status: "error", error });123-      clearPairingState();124-    },125-  };126-  // The confirm callback blocks on the popup's CODE_PAIR_CONFIRM reply.127-  const confirm = (_sas: string): Promise<boolean> =>128-    new Promise<boolean>((resolve) => { pendingConfirm = resolve; });129-130-  void pairWithCode(code, cb, deps, confirm).finally(() => {131-    // onComplete/onError already cleared state; this is the backstop for an132-    // unexpected throw that skipped the callbacks.133-    if (inFlight) clearPairingState();134-  });135-}136-137-/** Resolve the parked confirm() with the user's decision from the popup. */138-export function resolveCodePairingConfirm(confirmed: boolean): void {139-  const resolve = pendingConfirm;140-  pendingConfirm = null;141-  if (resolve) resolve(confirmed);142-}

@@ -1,425 +0,0 @@1-// Code pairing — the PAIR_IDENTITY half over an address-bearing pairing code.2-//3-// Driven entirely through the dependency-injection seam (CodePairingDeps and a4-// fake PairingSocket), so no real WebSocket or Noise crypto runs — except the5-// SAS KAT, which calls the REAL `derivePairingSAS` to pin cross-implementation6-// agreement with the peer.7-8-import { beforeEach, describe, expect, it, vi } from "vitest";9-10-import {11-  pairWithCode,12-  type CodePairingDeps,13-  type CodePairingCallbacks,14-} from "./code-pairing";15-import type { PairingSocket } from "../shared/pairing-dial";16-17-// REAL SAS implementation — reused, not re-derived (ground truth §5).18-import { derivePairingSAS } from "../shared/pairing-handshake";19-import { encodePairingCode } from "../shared/pairing-code";20-import type { LocalIdentity } from "../shared/pairing-handshake";21-import type { PairedDevice } from "../shared/sync-types";22-23-// ── helpers ────────────────────────────────────────────────────────────────24-25-const enc = (o: unknown) => new TextEncoder().encode(JSON.stringify(o));26-const dec = (b: Uint8Array) => JSON.parse(new TextDecoder().decode(b));27-28-const PEER_EPHEMERAL_HEX = "a".repeat(64);29-// The ACK key is the Noise NK responder static, so the encrypted identity must30-// repeat exactly this key after the handshake.31-const PHONE_LONGTERM_HEX = PEER_EPHEMERAL_HEX;32-const PHONE_TOKEN = Uint8Array.of(0xde, 0xad, 0xbe, 0xef);33-const PHONE_CODE = encodePairingCode("192.168.4.77", 51555, PHONE_TOKEN);34-35-const OUR_IDENTITY: LocalIdentity = {36-  deviceId: "ext-local-001",37-  deviceName: "Firefox on MacBook",38-  deviceType: "extension",39-  longTermPublicKeyHex: "c".repeat(64),40-  signingPublicKeyHex: "d".repeat(64),41-  vaultId: "e".repeat(64),42-};43-const OUR_PRIVATE_KEY = new Uint8Array(32).fill(0x0c);44-const OUR_PUBLIC_KEY = new Uint8Array(32).fill(0xcc);45-46-/**47- * Scripted fake socket. Captures everything sent, and replays a queued list48- * of inbound frames. A frame of `null` means "the socket closes here with no49- * data" — the wrong-code behaviour (no error frame).50- */51-function makeFakeSocket(inbound: Array<Uint8Array | null>) {52-  const sent: Uint8Array[] = [];53-  let closed = false;54-  let lastWasClose = false;55-  const queue = [...inbound];56-  const sock: PairingSocket = {57-    send(bytes) { sent.push(bytes); },58-    async receive() {59-      const next = queue.shift();60-      if (next === undefined || next === null) {61-        closed = true;62-        lastWasClose = true;63-        throw new Error("socket closed");64-      }65-      lastWasClose = false;66-      return next;67-    },68-    close() { closed = true; },69-    closedBeforeFrame() { return lastWasClose; },70-  };71-  return { sock, sent, isClosed: () => closed };72-}73-74-/**75- * A fake Noise session that no-ops encrypt/decrypt (identity transform) so we76- * can drive the PAIR_IDENTITY exchange without real crypto. We stub77- * `noiseNKInitiator` via vi.mock below; this is the shape it returns.78- */79-const FAKE_HANDSHAKE_HASH = Uint8Array.from([80-  0x0f, 0xba, 0xb8, 0xcd, ...new Array(28).fill(0),81-]);82-83-// Mock the NK initiator: skip the two handshake messages, hand back a session84-// whose encrypt/decrypt are identity transforms and whose handshakeHash is the85-// cross-platform KAT prefix (so the SAS test below is end-to-end through the flow).86-vi.mock("../shared/noise-js", async (orig) => {87-  const actual = await orig<typeof import("../shared/noise-js")>();88-  return {89-    ...actual,90-    noiseNKInitiator: vi.fn(async (_responderStatic, _send, _receive) => ({91-      encrypt: (pt: Uint8Array) => pt,92-      decrypt: (ct: Uint8Array) => ct,93-      handshakeHash: FAKE_HANDSHAKE_HASH,94-      close: vi.fn(),95-    })),96-    performInitiatorAuth: vi.fn(async () => undefined),97-  };98-});99-100-function makeDeps(overrides: Partial<CodePairingDeps> = {}): {101-  deps: CodePairingDeps;102-  persisted: PairedDevice[];103-  sockets: ReturnType<typeof makeFakeSocket>[];104-} {105-  const persisted: PairedDevice[] = [];106-  const sockets: ReturnType<typeof makeFakeSocket>[] = [];107-  const deps: CodePairingDeps = {108-    openSocket: vi.fn(async () => {109-      // default: ACK then a PAIR_IDENTITY response110-      const s = makeFakeSocket([111-        enc({ type: "PEACH_HELLO_ACK", ephemeralPublicKeyHex: PEER_EPHEMERAL_HEX }),112-        enc({113-          type: "PAIR_IDENTITY",114-          device_id: "android-001",115-          device_name: "Pixel 8",116-          device_type: "android",117-          long_term_public_key_hex: PHONE_LONGTERM_HEX,118-          ws_port: 49142,119-          relay_url: "wss://relay.peachpasswords.com",120-        }),121-      ]);122-      sockets.push(s);123-      return s.sock;124-    }),125-    getLocalIdentity: vi.fn(async () => ({126-      identity: OUR_IDENTITY,127-      privateKey: OUR_PRIVATE_KEY,128-      publicKey: OUR_PUBLIC_KEY,129-    })),130-    getRelayUrl: vi.fn(async () => "wss://relay.peachpasswords.com"),131-    persistDevice: vi.fn(async (d: PairedDevice) => { persisted.push(d); }),132-    ...overrides,133-  };134-  return { deps, persisted, sockets };135-}136-137-function makeCallbacks(): {138-  cb: CodePairingCallbacks;139-  sas: { value?: string };140-  errors: string[];141-  completed: PairedDevice[];142-} {143-  const sas: { value?: string } = {};144-  const errors: string[] = [];145-  const completed: PairedDevice[] = [];146-  const cb: CodePairingCallbacks = {147-    onSasReady: (s) => { sas.value = s; },148-    onError: (e) => { errors.push(e); },149-    onComplete: (d) => { completed.push(d); },150-  };151-  return { cb, sas, errors, completed };152-}153-154-beforeEach(() => {155-  vi.clearAllMocks();156-});157-158-// ── specs ────────────────────────────────────────────────────────────────159-160-describe("pairWithCode", () => {161-  it("dials the coded endpoint and sends its token in PEACH_HELLO", async () => {162-    const { deps, sockets } = makeDeps();163-    const { cb } = makeCallbacks();164-165-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);166-167-    expect(deps.openSocket).toHaveBeenCalledWith("192.168.4.77", 51555);168-    const firstFrame = dec(sockets[0].sent[0]);169-    expect(firstFrame).toEqual({ type: "PEACH_HELLO", token: "deadbeef" });170-  });171-172-  it("treats a socket close without PEACH_HELLO_ACK as invalid_code", async () => {173-    // The listener sends NO error frame on a wrong/expired code — it SILENTLY174-    // CLOSES the socket and rotates the code. So the175-    // absence of a PEACH_HELLO_ACK *is* the wrong-code signal. (This replaces176-    // the original brief's bogus PEACH_HELLO_ERROR test — no such frame exists.)177-    const closeImmediately = makeFakeSocket([null]); // close, no data178-    const { deps } = makeDeps({179-      openSocket: vi.fn(async () => closeImmediately.sock),180-    });181-    const { cb, errors, completed } = makeCallbacks();182-183-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);184-185-    expect(errors).toEqual(["invalid_code"]);186-    expect(completed).toHaveLength(0);187-    expect(deps.persistDevice).not.toHaveBeenCalled();188-  });189-190-  it("derives the SAS via the real derivePairingSAS — KAT 0fbab8cd… → 44907520", () => {191-    // Cross-impl KAT, matched byte-for-byte by peach-android's SASDerivation:192-    // the first eight bytes 0f ba b8 cd 00 00 00 00 read as an unsigned193-    // big-endian integer are 1133421446844907520; mod 1e8 = 44907520.194-    const hash = Uint8Array.from([195-      0x0f, 0xba, 0xb8, 0xcd, ...new Array(28).fill(0),196-    ]);197-    expect(derivePairingSAS(hash)).toBe("44907520");198-  });199-200-  it("surfaces that same SAS through the pairing flow", async () => {201-    // FAKE_HANDSHAKE_HASH starts 0fbab8cd, so onSasReady must report 44907520.202-    const { deps } = makeDeps();203-    const { cb, sas } = makeCallbacks();204-205-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);206-207-    expect(sas.value).toBe("44907520");208-  });209-210-  it("persists the phone identity on SAS confirm", async () => {211-    const { deps, persisted } = makeDeps();212-    const { cb, completed, errors } = makeCallbacks();213-214-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);215-216-    expect(errors).toHaveLength(0);217-    expect(persisted).toHaveLength(1);218-    expect(persisted[0].deviceType).toBe("android");219-    expect(persisted[0].deviceId).toBe("android-001");220-    expect(persisted[0].longTermPublicKeyHex).toBe(PHONE_LONGTERM_HEX);221-    expect(persisted[0].trustSource).toBe("direct");222-    expect(persisted[0].wsPort).toBe(49142);223-    expect(persisted[0].relayUrl).toBe("wss://relay.peachpasswords.com");224-    expect(persisted[0].rendezvousSecretHex).toMatch(/^[0-9a-f]{64}$/);225-    expect(completed).toHaveLength(1);226-  });227-228-  it("proves possession before accepting the peer identity", async () => {229-    const { performInitiatorAuth } = await import("../shared/noise-js");230-    const { deps } = makeDeps();231-    const { cb, errors } = makeCallbacks();232-233-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);234-235-    expect(errors).toHaveLength(0);236-    expect(performInitiatorAuth).toHaveBeenCalledTimes(1);237-    expect(performInitiatorAuth).toHaveBeenCalledWith(238-      expect.anything(),239-      OUR_PRIVATE_KEY,240-      OUR_PUBLIC_KEY,241-      expect.any(Uint8Array),242-      expect.any(Function),243-      expect.any(Function),244-    );245-  });246-247-  it("rejects a PAIR_IDENTITY that is not bound to the Noise responder key", async () => {248-    const { deps, persisted } = makeDeps({249-      openSocket: vi.fn(async () => makeFakeSocket([250-        enc({ type: "PEACH_HELLO_ACK", ephemeralPublicKeyHex: PEER_EPHEMERAL_HEX }),251-        enc({252-          type: "PAIR_IDENTITY",253-          device_id: "attacker",254-          device_name: "Wrong key",255-          device_type: "android",256-          long_term_public_key_hex: "f".repeat(64),257-          ws_port: 49142,258-        }),259-      ]).sock),260-    });261-    const { cb, errors } = makeCallbacks();262-263-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);264-265-    expect(errors).toEqual(["handshake_failed"]);266-    expect(persisted).toHaveLength(0);267-  });268-269-  it("aborts with sas_mismatch and persists nothing when the user rejects", async () => {270-    const { deps, persisted } = makeDeps();271-    const { cb, errors } = makeCallbacks();272-273-    await pairWithCode(PHONE_CODE, cb, deps, async () => false);274-275-    expect(errors).toEqual(["sas_mismatch"]);276-    expect(persisted).toHaveLength(0);277-    expect(deps.persistDevice).not.toHaveBeenCalled();278-  });279-280-  it("includes vault_id in the outbound PAIR_IDENTITY (Change 1)", async () => {281-    const { deps, sockets } = makeDeps();282-    const { cb } = makeCallbacks();283-284-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);285-286-    // sent[0] = PEACH_HELLO (plaintext); sent[1] = our PAIR_IDENTITY287-    // (encrypt is identity in the mock, so it decodes directly).288-    const ourPairIdentity = dec(sockets[0].sent[1]);289-    expect(ourPairIdentity.type).toBe("PAIR_IDENTITY");290-    expect(ourPairIdentity.vault_id).toBe(OUR_IDENTITY.vaultId);291-  });292-293-  it("reports vault_locked when local identity is unavailable", async () => {294-    const { deps } = makeDeps({295-      getLocalIdentity: vi.fn(async () => { throw new Error("vault_locked"); }),296-    });297-    const { cb, errors } = makeCallbacks();298-299-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);300-301-    expect(errors).toEqual(["vault_locked"]);302-    expect(deps.openSocket).not.toHaveBeenCalled();303-  });304-});305-306-// ── pairing-code path (the phone is the listener) ──────────────────────────307-308-/** Deps whose socket replays an Android peer's ACK + PAIR_IDENTITY. */309-function makePhoneDeps(deviceType: string | undefined = "android") {310-  const identity: Record<string, unknown> = {311-    type: "PAIR_IDENTITY",312-    device_id: "android-001",313-    device_name: "Pixel 8",314-    long_term_public_key_hex: PHONE_LONGTERM_HEX,315-    ws_port: 49142,316-    relay_url: "wss://relay.peachpasswords.com",317-  };318-  identity.device_type = deviceType;319-  return makeDeps({320-    openSocket: vi.fn(async () => makeFakeSocket([321-      enc({ type: "PEACH_HELLO_ACK", ephemeralPublicKeyHex: PEER_EPHEMERAL_HEX }),322-      enc(identity),323-    ]).sock),324-  });325-}326-327-describe("pairWithCode — pairing code", () => {328-  it("dials the address in the code", async () => {329-    const { deps } = makePhoneDeps();330-    const { cb, errors } = makeCallbacks();331-332-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);333-334-    expect(errors).toHaveLength(0);335-    expect(deps.openSocket).toHaveBeenCalledWith("192.168.4.77", 51555);336-  });337-338-  it("presents the token as hex in the plaintext hello, not a 6-digit code", async () => {339-    const sockets: ReturnType<typeof makeFakeSocket>[] = [];340-    const { deps } = makeDeps({341-      openSocket: vi.fn(async () => {342-        const s = makeFakeSocket([343-          enc({ type: "PEACH_HELLO_ACK", ephemeralPublicKeyHex: PEER_EPHEMERAL_HEX }),344-          enc({345-            type: "PAIR_IDENTITY",346-            device_id: "android-001",347-            device_name: "Pixel 8",348-            device_type: "android",349-            long_term_public_key_hex: PHONE_LONGTERM_HEX,350-            ws_port: 49142,351-            relay_url: "wss://relay.peachpasswords.com",352-          }),353-        ]);354-        sockets.push(s);355-        return s.sock;356-      }),357-    });358-    const { cb } = makeCallbacks();359-360-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);361-362-    const hello = dec(sockets[0].sent[0]);363-    expect(hello.type).toBe("PEACH_HELLO");364-    expect(hello.token).toBe("deadbeef");365-    expect(hello.code).toBeUndefined();366-  });367-368-  it("persists the phone with the device type it announced", async () => {369-    const { deps, persisted } = makePhoneDeps();370-    const { cb, completed } = makeCallbacks();371-372-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);373-374-    expect(persisted).toHaveLength(1);375-    expect(persisted[0].deviceType).toBe("android");376-    expect(persisted[0].deviceId).toBe("android-001");377-    expect(persisted[0].longTermPublicKeyHex).toBe(PHONE_LONGTERM_HEX);378-    expect(persisted[0].trustSource).toBe("direct");379-    expect(persisted[0].wsPort).toBe(49142);380-    expect(completed).toHaveLength(1);381-  });382-383-  it("rejects a peer that omits its device type", async () => {384-    const { deps, persisted } = makePhoneDeps("");385-    const { cb, errors } = makeCallbacks();386-387-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);388-389-    expect(errors).toEqual(["handshake_failed"]);390-    expect(persisted).toHaveLength(0);391-  });392-393-  it("caches the coded IP for the next sync round", async () => {394-    const cacheLastKnownIp = vi.fn(async () => undefined);395-    const { deps } = makePhoneDeps();396-    deps.cacheLastKnownIp = cacheLastKnownIp;397-    const { cb } = makeCallbacks();398-399-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);400-401-    expect(cacheLastKnownIp).toHaveBeenCalledWith(PHONE_LONGTERM_HEX, "192.168.4.77");402-  });403-404-  it("reports no_host_found when the coded endpoint refuses the connection", async () => {405-    const { deps } = makeDeps({406-      openSocket: vi.fn(async () => { throw new Error("ECONNREFUSED"); }),407-    });408-    const { cb, errors } = makeCallbacks();409-410-    await pairWithCode(PHONE_CODE, cb, deps, async () => true);411-412-    expect(errors).toEqual(["no_host_found"]);413-    expect(deps.persistDevice).not.toHaveBeenCalled();414-  });415-416-  it("still aborts on SAS rejection — the token is not the security boundary", async () => {417-    const { deps, persisted } = makePhoneDeps();418-    const { cb, errors } = makeCallbacks();419-420-    await pairWithCode(PHONE_CODE, cb, deps, async () => false);421-422-    expect(errors).toEqual(["sas_mismatch"]);423-    expect(persisted).toHaveLength(0);424-  });425-});

@@ -1,202 +0,0 @@1-// Device pairing over a code — the PAIR_IDENTITY half.2-//3-// The dialling half (decode the code, connect, plaintext hello, Noise NK) lives4-// in `shared/pairing-dial.ts` and is shared with vault adoption, which speaks5-// ADOPT_* frames over the same channel instead. This module is only what6-// happens once that channel is open:7-//8-//   1. exchange PAIR_IDENTITY (send ours incl. vault_id, then read theirs)9-//   2. derive the SAS, surface it for user confirmation10-//   3. on confirm -> persist the PairedDevice; on reject -> abort without11-//      persisting12-//13-// A pairing code (`A74H-48J3-KI32-OEP4`) carries the listener's endpoint and14-// one-time token.15-16-import { dialPairingChannel, PAIRING_PORT, type PairingDialDeps } from "../shared/pairing-dial";17-import type { LocalIdentity } from "../shared/pairing-handshake";18-import type { DeviceType, PairedDevice } from "../shared/sync-types";19-import { bytesToHex, normalizeRelayUrl } from "../shared/rendezvous";20-import { constantTimeEqualHex } from "../shared/constant-time";21-22-/** Default sync port a peer announces; used when ws_port is absent. Same23- *  fixed port pairing dials — SyncReconnectListener.SYNC_PORT on Android. */24-const DEFAULT_SYNC_PORT = PAIRING_PORT;25-26-export type CodePairingError =27-  | "invalid_code"      // socket closed before PEACH_HELLO_ACK (wrong/expired)28-  | "no_host_found"     // nothing answered at the endpoint29-  | "handshake_failed"  // Noise NK / PAIR_IDENTITY decode failed30-  | "sas_mismatch"      // user rejected the SAS31-  | "vault_locked";     // no master key available32-33-export interface CodePairingDeps extends PairingDialDeps {34-  /**35-   * Public identity plus the private key used for structural36-   * proof-of-possession. The private half never enters a wire frame.37-   */38-  getLocalIdentity(): Promise<{39-    identity: LocalIdentity;40-    privateKey: Uint8Array;41-    publicKey: Uint8Array;42-  }>;43-  /** Current mesh relay URL; sent in the encrypted pairing identity. */44-  getRelayUrl(): Promise<string>;45-  /** Persist on user confirm. */46-  persistDevice(device: PairedDevice): Promise<void>;47-  /** Optional fast-path cache for the next sync round. */48-  cacheLastKnownIp?(pubkeyHex: string, ip: string): Promise<void>;49-}50-51-export interface CodePairingCallbacks {52-  /** Show the 8-digit SAS; the popup must compare it against the peer's. */53-  onSasReady(sas: string): void;54-  /** Pairing succeeded and the device was persisted. */55-  onComplete(device: PairedDevice): void;56-  /** Pairing failed at some stage. */57-  onError(error: CodePairingError): void;58-}59-60-interface PairingFrame {61-  type: "PAIR_IDENTITY";62-  device_id: string;63-  device_name: string;64-  device_type: DeviceType;65-  long_term_public_key_hex: string;66-  signing_public_key_hex?: string;67-  ws_port?: number;68-  vault_id?: string; // Change 1 — additive, optional69-  relay_url?: string;70-}71-72-function encodeJson(obj: unknown): Uint8Array {73-  return new TextEncoder().encode(JSON.stringify(obj));74-}75-76-function decodePairIdentity(bytes: Uint8Array): PairingFrame {77-  const p = JSON.parse(new TextDecoder().decode(bytes)) as Record<string, unknown>;78-  if (p?.type !== "PAIR_IDENTITY") throw new Error("expected PAIR_IDENTITY");79-  if (typeof p.device_id !== "string" || !p.device_id) throw new Error("device_id missing");80-  if (typeof p.device_name !== "string") throw new Error("device_name missing");81-  if (82-    p.device_type !== "extension" &&83-    p.device_type !== "android" &&84-    p.device_type !== "ios"85-  ) {86-    throw new Error("device_type invalid");87-  }88-  if (typeof p.long_term_public_key_hex !== "string" ||89-      !/^[0-9a-f]{64}$/.test(p.long_term_public_key_hex)) {90-    throw new Error("long_term_public_key_hex is not 32-byte hex");91-  }92-  if (p.relay_url !== undefined) {93-    if (typeof p.relay_url !== "string") throw new Error("relay_url invalid");94-    p.relay_url = normalizeRelayUrl(p.relay_url);95-  }96-  return p as unknown as PairingFrame;97-}98-99-/**100- * Drive a complete code pairing.101- *102- * `confirm` is a function the caller resolves AFTER the user has compared the103- * SAS shown here against the SAS the peer displays. Resolving false (or104- * rejecting) aborts before any device is persisted — this is the out-of-band105- * MITM defence (see the SECURITY note in pairing-handshake.ts), and it, not the106- * pairing token, is what actually authenticates the peer.107- */108-export async function pairWithCode(109-  code: string,110-  cb: CodePairingCallbacks,111-  deps: CodePairingDeps,112-  confirm: (sas: string) => Promise<boolean>,113-): Promise<void> {114-  let local: Awaited<ReturnType<CodePairingDeps["getLocalIdentity"]>>;115-  try {116-    local = await deps.getLocalIdentity();117-  } catch {118-    cb.onError("vault_locked");119-    return;120-  }121-122-  const dial = await dialPairingChannel(code, deps);123-  if (!dial.ok) {124-    cb.onError(dial.error);125-    return;126-  }127-  const {128-    channel,129-    sas,130-    host,131-    rendezvousSecretHex,132-    remoteStaticPublicKey,133-    authenticateInitiator,134-    socket,135-  } = dial.dialled;136-137-  try {138-    const { identity, privateKey, publicKey } = local;139-    if (!constantTimeEqualHex(bytesToHex(publicKey), identity.longTermPublicKeyHex)) {140-      throw new Error("local pairing key does not match advertised identity");141-    }142-    // E1: prove the private half of the advertised initiator identity before143-    // either side trusts a PAIR_IDENTITY frame or asks the user for SAS consent.144-    await authenticateInitiator(privateKey, publicKey);145-146-    const relayUrl = await deps.getRelayUrl();147-    // Initiator (browser) sends its identity FIRST, then reads the peer's.148-    const ourFrame: PairingFrame = {149-      type: "PAIR_IDENTITY",150-      device_id: identity.deviceId,151-      device_name: identity.deviceName,152-      device_type: identity.deviceType,153-      long_term_public_key_hex: identity.longTermPublicKeyHex,154-      signing_public_key_hex: identity.signingPublicKeyHex,155-      ws_port: identity.wsPort,156-      vault_id: identity.vaultId, // Change 1157-      relay_url: relayUrl,158-    };159-    await channel.send(encodeJson(ourFrame));160-161-    const theirFrame = decodePairIdentity(await channel.receive());162-    if (!constantTimeEqualHex(163-      theirFrame.long_term_public_key_hex,164-      bytesToHex(remoteStaticPublicKey),165-    )) {166-      throw new Error("peer identity does not match Noise responder key");167-    }168-169-    cb.onSasReady(sas);170-    const confirmed = await confirm(sas);171-    if (!confirmed) {172-      cb.onError("sas_mismatch");173-      return;174-    }175-176-    // ws_port comes from the authenticated peer frame and falls back to the177-    // native listener's fixed pairing/sync port for older peers.178-    const device: PairedDevice = {179-      deviceId: theirFrame.device_id,180-      deviceName: theirFrame.device_name,181-      deviceType: theirFrame.device_type,182-      longTermPublicKeyHex: theirFrame.long_term_public_key_hex,183-      signingPublicKeyHex: theirFrame.signing_public_key_hex,184-      trustSource: "direct",185-      wsPort: typeof theirFrame.ws_port === "number" ? theirFrame.ws_port : DEFAULT_SYNC_PORT,186-      rendezvousSecretHex,187-      // The listening phone is the authority for the relay this pair will use.188-      relayUrl: theirFrame.relay_url ?? relayUrl,189-      pairedAt: Date.now(),190-    };191-    await deps.persistDevice(device);192-    if (deps.cacheLastKnownIp && device.longTermPublicKeyHex) {193-      await deps.cacheLastKnownIp(device.longTermPublicKeyHex, host).catch(() => undefined);194-    }195-    cb.onComplete(device);196-  } catch (err) {197-    if (typeof console !== "undefined") console.error("[code-pairing] handshake failed:", err);198-    cb.onError("handshake_failed");199-  } finally {200-    socket.close();201-  }202-}