Cross-device debug pairing (QR + HMAC cookie)

Generated from mcp/patterns.registry.json — do not edit by hand; change the registry and run bun run patterns:build.

Index card — the docs below are the canonical explanation; deep-tier pattern pages additionally carry invariants and emulation notes.

Category: Admin & Privacy · Tier: light · Risk: medium — HMAC cookie and code claiming must resist forgery/replay

A short-lived, single-use pairing code and QR flow that attributes a phone's anonymous pageviews to an admin's identity via an HMAC-signed cookie, without logging the phone in.

When to use: Use when an admin needs to test the live site on a second device and see its activity attributed on the dashboard.

Docs

• docs/blueprint/admin/pairing.md (GitHub · GitLab)

Code

• src/lib/server/pairing/ (GitHub · GitLab)

Proof

• /pair/[code] (app route, no showcase)

Machine-readable record: admin-privacy-pairing in mcp/patterns.registry.json.