Module store 

Device registry (SQLite) — paired Ryu hardware and their tokens.

Persists the device records backing the REST surface in PROTOCOL.md §6 and the Bearer-token auth on the WS upgrade (§2). This is the system of record for “which devices are paired to this node”, extending the connections/presence model with durable, per-device, revocable tokens.

Placement (Core vs Gateway): the device registry + token lifecycle decide which device is allowed to drive this node and what it runs, so this is Core. It mirrors [crate::meetings::store]: one rusqlite connection behind an Arc<Mutex<…>>, opened under crate::paths::ryu_dir().

The raw token is shown to the app exactly once (at pairing); only its SHA-256 hash is persisted here. A device authenticates the WS upgrade by presenting the raw token, which is re-hashed and compared against the row.

Structs

DeviceRecord

A paired device row. The token_hash is stored, never the raw token.

DeviceStore

Handle to the device registry table. Cheaply cloneable (wraps an Arc).

Functions

hash_token

Hash a raw Bearer token to the form stored in the registry. The token is a 256-bit random secret (see super::pairing::generate_device_token); a plain SHA-256 is sufficient for a high-entropy secret (no need for a slow KDF, which only matters for low-entropy passwords).