nexo_pairing/lib.rs
1//! Phase 26 — pairing protocol.
2//!
3//! Two coexisting protocols:
4//!
5//! - **DM challenge** — opt-in inbound allowlist. A plugin (whatsapp,
6//! telegram, …) calls [`PairingGate::should_admit`] before publishing
7//! to the broker. Unknown senders get a one-time human-friendly code
8//! and the operator approves them via CLI / admin-ui.
9//! - **Setup-code** — operator-initiated. `agent pair start` issues a
10//! short-lived HMAC-signed bearer token + a gateway URL, packs them
11//! into a base64url payload, and renders a QR. A companion app
12//! scans, opens the WS, presents the token, and gets a session
13//! token in return.
14//!
15//! This crate is a *leaf*: it does not depend on `nexo-core` or any
16//! plugin crate. The bin (`src/main.rs`) wires the store + the gate
17//! into the plugins, and registers the CLI subcommand.
18
19pub mod adapter;
20pub mod code;
21pub mod gate;
22pub mod qr;
23pub mod registry;
24pub mod setup_code;
25pub mod store;
26pub mod types;
27pub mod url_resolver;
28
29pub use adapter::PairingChannelAdapter;
30pub use gate::PairingGate;
31pub use registry::PairingAdapterRegistry;
32pub use setup_code::SetupCodeIssuer;
33pub use store::PairingStore;
34pub use types::{
35 ApprovedRequest, Decision, PairingError, PairingPolicy, PendingRequest, SetupCode, TokenClaims,
36 UpsertOutcome,
37};