@ciphore/radiocli 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to RadioCLI are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.3] - 2026-05-30
+
+### Added
+
+- Experimental macOS AirPlay playback backend with Bonjour receiver discovery,
+  Settings target selection, `:airplay-code` passcode entry, worker-based stream
+  forwarding, and active receiver labels in the playback footer.
+
+### Changed
+
+- `ffplay` is now treated as a playback-only fallback: the UI labels it as
+  `ffplay fallback`, `radiocli doctor` reports limited controls, and unsupported
+  pause, mute, volume, and media-key actions explain that `mpv` is required.
+
+### Security
+
+- AirPlay sender support is disabled unless a compatible sender package passes
+  RadioCLI's dependency safety gate; the current public `node-airtunes2` package
+  line remains blocked because of vulnerable transitive dependencies.
+- Hardened AirPlay discovery and worker messaging with bounded payloads,
+  sanitized receiver data, passcode validation, and worker shutdown on startup
+  timeout.
+
+## [0.1.2] - 2026-05-30
+
+### Fixed
+
+- Ignored Kitty keyboard release events so Ghostty users do not skip multiple
+  tabs from one left/right arrow key press.
+- Ignored Kitty release events for raw media-key transport sequences so learned
+  or native media keys do not double-fire on key release.
+
 ## [0.1.1] - 2026-05-30
 
 Initial public release.
@@ -17,9 +49,10 @@ Initial public release.
   countries, world map, nearby, stats, and settings screens.
 - Radio Browser provider with mirror fallback, durable cache, and tune
   resolution, plus an experimental, opt-in Radio Garden provider.
-- `mpv` playback with `ffplay` fallback, readiness checks, ICY metadata polling,
-  volume, pause, mute, sleep timer, tune timeouts, and skip-broken-stream
-  behavior, using Unix sockets on macOS/Linux and named pipes on native Windows.
+- `mpv` playback controls for readiness checks, ICY metadata polling, volume,
+  pause, and mute, with `ffplay` playback fallback, sleep timer, tune timeouts,
+  and skip-broken-stream behavior, using Unix sockets on macOS/Linux and named
+  pipes on native Windows.
 - Receiver-style Now Playing screen with 50 selectable visualizers and
   zero-signal frames whenever playback is idle, paused, stopped, or not
   backend-ready.
@@ -47,4 +80,6 @@ Initial public release.
   backend/volume that already appear in the header and footer. The reclaimed
   rows go to the visualizer.
 
+[0.1.3]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.3
+[0.1.2]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.2
 [0.1.1]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.1

package/CONTRIBUTING.md

@@ -12,7 +12,8 @@ npm run build
 npm run test
 ```
 
-Install `mpv` for the best playback experience:
+Install `mpv` for playback controls, metadata polling, and the best playback
+experience:
 
 ```bash
 brew install mpv
@@ -57,4 +58,6 @@ checks.
 ## Issue Triage
 
 Playback issues should include station name, country, backend, and
-`radiocli check` output when possible.
+`radiocli check` or `radiocli doctor` output when possible. If the backend is
+`ffplay`, pause, mute, volume, and play/pause media-key behavior are expected to
+be limited until `mpv` is installed.

package/README.md

@@ -13,8 +13,8 @@ It is built with [Ink](https://github.com/vadimdemedes/ink), [React](https://rea
 ## Features
 
 - Explore public radio from around the world through a cosmo-style braille world map beside the station list, with click-to-place mouse support and WASD keyboard movement backed by a cached geotagged station atlas. Country lists, global station search, a country-density map, and opt-in nearby discovery round out the discovery surface.
-- Tune stations with `mpv` first and `ffplay` fallback when available.
-- Use a receiver-style Now Playing screen with 50 selectable receiver visualizers, backend status, cleaned ICY track metadata, stream diagnostics, sleep timer, favorite state, volume, pause, mute, station skipping, and zero-signal graphics whenever playback is idle, paused, stopped, or not backend-ready.
+- Tune stations with `mpv` first for full playback controls, with `ffplay` as a playback-only fallback when available.
+- Use a receiver-style Now Playing screen with 50 selectable receiver visualizers, backend status, cleaned ICY track metadata, stream diagnostics, sleep timer, favorite state, `mpv`-backed volume, pause, mute, station skipping, and zero-signal graphics whenever playback is idle, paused, stopped, or not backend-ready.
 - Keep shortcuts in a fixed adaptive footer: a compact live station and track row appears above page-specific and global controls while playback is active.
 - Move previous/next through the exact station list you tuned from, even after navigating to another screen.
 - Browse dense station lists with inline location/codec metadata and yellow favorite stars next to station names.
@@ -139,8 +139,9 @@ Requirements:
 
 - Homebrew on macOS: installs RadioCLI, Node.js, and `mpv`
 - npm on macOS, Linux, and Windows: Node.js 22 or newer
-- `mpv` for best playback; RadioCLI expects one local playback backend at runtime
-- `ffplay` from FFmpeg as an optional fallback
+- `mpv` for playback, pause, mute, volume, media keys, metadata, and readiness checks
+- `ffmpeg` plus an audited, compatible sender package on macOS for experimental AirPlay
+- `ffplay` from FFmpeg as an optional playback-only fallback
 
 Recommended macOS install:
 
@@ -152,6 +153,22 @@ radiocli
 The Homebrew formula depends on `node` and `mpv`, so the native playback backend
 comes from the native package manager.
 
+AirPlay playback on macOS is experimental. RadioCLI discovers AirPlay/RAOP
+receivers with Bonjour and decodes streams with `ffmpeg`, but it only advertises
+the `airplay` backend when a compatible sender package passes its dependency
+safety gate.
+
+```bash
+brew install ffmpeg
+npm audit --audit-level=low
+```
+
+Do not install `node-airtunes2` blindly just to enable this feature: the current
+public package line is blocked by RadioCLI because its transitive dependency tree
+contains known vulnerable versions. If you supply a patched compatible sender,
+passcode-protected receivers prompt in the TUI; enter the code with
+`:airplay-code 1234`.
+
 Universal npm install:
 
 ```bash
@@ -203,6 +220,11 @@ Windows:
 winget install --id Gyan.FFmpeg -e
 ```
 
+`ffplay` can keep streams playable when `mpv` is not installed, but it does not
+provide reliable pause, mute, volume, media-key, or metadata control. In that
+mode RadioCLI labels the backend as `ffplay fallback`, shows limited-control
+footer text, and `radiocli doctor` reports `controls=limited`.
+
 CI covers command-mode typecheck, tests, builds, package checks, and fresh
 install smoke checks on Ubuntu, macOS, and Windows.
 
@@ -257,6 +279,11 @@ RadioCLI keeps shortcuts at the bottom of the terminal. When playback is active,
 - `+` / `-`: volume.
 - `q` or `Ctrl+C`: quit cleanly.
 
+Pause, mute, volume, and play/pause media-key control require `mpv`. When only
+`ffplay` is active, RadioCLI keeps playback and station skipping available but
+labels interactive playback controls as limited and shows an `Install mpv`
+warning instead of pretending the control worked.
+
 Page-specific footer controls:
 
 | Screen | Controls |
@@ -269,7 +296,7 @@ Page-specific footer controls:
 | World map | `/` filter, `↑` / `↓` move, `Enter` open country, `w` list, `b` home |
 | Station lists | `↑` / `↓` or `n` / `p` move, `Enter` tune, `f` favorite, `[` / `]` page, `b` home |
 | Now Playing | `space` / `F8` pause, `f` favorite, `m` mute, `s` sleep, `d` diagnostics, `b` home |
-| Settings | `Enter` change selected, `g` Radio Garden, `l` location, `x` skip broken streams, `o` backend, `r` health, `b` home |
+| Settings | `Enter` change selected, `g` Radio Garden, `l` location, `x` skip broken streams, `o` backend, `a` AirPlay, `r` health, `b` home |
 | Stats | `b` home |
 
 Other active shortcuts:
@@ -292,7 +319,7 @@ Other active shortcuts:
 
 When you tune a station from Library, Explore, Search, Countries, or Nearby, that list becomes the playback queue. Previous/next keeps moving through that source list from any screen until you tune from another list.
 
-Hardware media keys depend on the OS and terminal. RadioCLI maximizes compatibility by enabling enhanced keyboard reporting where supported, recognizing common F7/F8/F9 sequences, Kitty consumer/media-key codes, modified-arrow sequences, comma/dot transport fallback, and learned custom bindings. Learn keys from Settings or with `:learn previous`, `:learn play`, and `:learn next`; clear them with `:keys reset`.
+Hardware media keys depend on the OS and terminal. RadioCLI maximizes compatibility by enabling enhanced keyboard reporting where supported, recognizing common F7/F8/F9 sequences, Kitty consumer/media-key codes, modified-arrow sequences, comma/dot transport fallback, and learned custom bindings. Previous/next media actions stay app-level; play/pause needs the `mpv` backend. Learn keys from Settings or with `:learn previous`, `:learn play`, and `:learn next`; clear them with `:keys reset`.
 
 Explore mouse clicks use terminal mouse reporting while the Explore tab is active. If your terminal or tmux setup does not pass those events through, the WASD cursor controls stay fully available.
 
@@ -317,6 +344,7 @@ Useful command palette entries:
 :learn play
 :learn next
 :keys reset
+:airplay-code 1234
 :map
 :library
 :stats
@@ -326,6 +354,11 @@ Useful command palette entries:
 
 Settings persist display colors and receiver styles without editing config files. The fourteen display colors are green, amber, blue, ruby, ice, teal, violet, copper, cyan, lime, coral, rose, slate, and mono, cycled with `t`. The 50 receiver styles span classic receiver displays, high-resolution braille visuals, and generative motion scenes; cycle them with `v` (see the [Demo](#demo) for the full family breakdown). The stats graph and legend follow the selected display color, and the selected Now Playing style is restored on the next launch.
 
+On macOS, Settings can cycle AirPlay targets discovered through Bonjour when
+`ffmpeg` and a compatible sender package pass RadioCLI's dependency safety gate.
+Select the `airplay` backend with `o`, choose a receiver with `a`, then tune a
+station. If the receiver asks for a code, enter it with `:airplay-code 1234`.
+
 ## Architecture
 
 RadioCLI is split around four seams:
@@ -342,9 +375,9 @@ a station, `ProviderManager.resolve()` follows the provider-specific path, then
 `PlayerController` starts `mpv` with `--no-video`, `--force-window=no`, a local
 JSON IPC endpoint, and the configured volume. The endpoint is a Unix socket on
 macOS/Linux and a named pipe on native Windows. `ffplay` is available as a
-simpler fallback, but `mpv` is the intended backend because it handles
-redirects, HLS, codecs, metadata, pause, mute, volume, and readiness checks more
-reliably than a JavaScript stream client.
+playback-only fallback, but `mpv` is the intended backend because it handles
+redirects, HLS, codecs, metadata, pause, mute, volume, media keys, and readiness
+checks more reliably than a JavaScript stream client.
 
 RadioCLI waits for the backend to become ready before marking playback as
 `playing`. With `mpv`, it polls playback state every 500ms and ICY metadata every
@@ -385,7 +418,7 @@ animation cost.
 
 Radio Browser is the primary provider. Its own docs recommend using a speaking user agent, resolving station clicks through `/json/url`, and retrying with other servers when one fails; RadioCLI follows that shape with mirror fallback and durable cache. Explore and Nearby use a cached geotagged Radio Browser atlas, then compute local distance in the app so map movement is not biased toward the most-clicked stations worldwide. Radio Garden support is experimental because the useful endpoints are publicly discoverable but unofficial, and they can be blocked or changed independently of this project.
 
-Playback prefers `mpv` because it handles real-world streams, redirects, HLS, codecs, and metadata better than a hand-rolled stream client. RadioCLI controls `mpv` through JSON IPC for readiness, pause, mute, volume, and metadata polling, using Unix sockets on macOS/Linux and named pipes on Windows.
+Playback prefers `mpv` because it handles real-world streams, redirects, HLS, codecs, and metadata better than a hand-rolled stream client. RadioCLI controls `mpv` through JSON IPC for readiness, pause, mute, volume, and metadata polling, using Unix sockets on macOS/Linux and named pipes on Windows. `ffplay` remains a playback-only fallback and is intentionally labeled with limited controls in the UI and doctor output. Experimental AirPlay output is available on macOS only when Bonjour discovery, `ffmpeg`, and a compatible sender package pass RadioCLI's safety gate.
 
 The npm package is `@ciphore/radiocli`, and the installed executable is `radiocli`. Current installs store data under RadioCLI paths such as `radiocli.json` and `radiocli-cache.json`. Existing Radio Atlas data is still discovered when a new RadioCLI store does not exist, and legacy `RADIO_ATLAS_HOME` / animation environment variables remain supported as migration fallbacks. New automation should use `RADIOCLI_HOME` and `RADIOCLI_DISABLE_ANIMATION`.
 

package/dist/player/airplay-discovery.js

@@ -0,0 +1,141 @@
+import { spawn } from 'node:child_process';
+import { commandExists } from './command.js';
+const defaultTimeoutMs = 2500;
+const defaultMaxDevices = 12;
+const defaultLookupConcurrency = 4;
+const defaultMaxOutputBytes = 64 * 1024;
+export async function discoverAirPlayDevices({ platform = process.platform, timeoutMs = defaultTimeoutMs, maxDevices = defaultMaxDevices, lookupConcurrency = defaultLookupConcurrency, maxOutputBytes = defaultMaxOutputBytes } = {}) {
+    if (platform !== 'darwin' || !commandExists('dns-sd')) {
+        return [];
+    }
+    const browseOutput = await runDnsSd(['-B', '_raop._tcp', 'local'], timeoutMs, maxOutputBytes).catch(() => '');
+    const instances = parseRaopBrowseOutput(browseOutput).slice(0, Math.max(0, maxDevices));
+    const devices = await mapWithConcurrency(instances, Math.max(1, lookupConcurrency), async (instance) => {
+        const lookupOutput = await runDnsSd(['-L', instance, '_raop._tcp', 'local'], timeoutMs, maxOutputBytes).catch(() => '');
+        return parseRaopLookupOutput(instance, lookupOutput);
+    });
+    return devices.filter((device) => Boolean(device));
+}
+export function parseRaopBrowseOutput(output) {
+    const instances = new Set();
+    for (const line of output.split('\n')) {
+        const match = /\s_raop\._tcp\.\s+(.+)$/.exec(line);
+        const instance = sanitizeDnsSdText(unescapeDnsSdName(match?.[1]?.trim() ?? ''), 256);
+        if (instance) {
+            instances.add(instance);
+        }
+    }
+    return [...instances];
+}
+export function parseRaopLookupOutput(instance, output) {
+    const reachable = output.match(/ can be reached at (.+?)\.?:(\d+) \(interface \d+\)/);
+    if (!reachable?.[1] || !reachable[2]) {
+        return null;
+    }
+    const id = sanitizeDnsSdText(instance, 256);
+    const host = normalizeHost(reachable[1]);
+    const port = Number(reachable[2]);
+    if (!id || !host || !Number.isInteger(port) || port <= 0 || port > 65535) {
+        return null;
+    }
+    const txtLine = output
+        .split('\n')
+        .map(line => line.trim())
+        .find(line => /\bcn=/.test(line) || /\bsf=/.test(line) || /\bpk=/.test(line));
+    const txt = txtLine
+        ? txtLine.split(/\s+/).map(entry => sanitizeDnsSdText(entry, 512)).filter(Boolean).slice(0, 64)
+        : [];
+    const txtMap = txtRecordMap(txt);
+    const sf = txtMap.get('sf');
+    const sfValue = sf ? Number.parseInt(sf.replace(/^0x/i, ''), 16) : 0;
+    return {
+        id,
+        name: displayNameForRaopInstance(id),
+        host,
+        port,
+        txt,
+        requiresPassword: sfValue !== 0 && sfValue !== 0x4,
+        airplay2: Boolean(txtMap.get('pk') || txtMap.get('vv') === '2' || txtMap.get('et')?.split(',').some(value => ['3', '4', '5'].includes(value)))
+    };
+}
+function displayNameForRaopInstance(instance) {
+    const atIndex = instance.indexOf('@');
+    return sanitizeDnsSdText(atIndex === -1 ? instance : instance.slice(atIndex + 1), 256) || 'AirPlay receiver';
+}
+function txtRecordMap(txt) {
+    const map = new Map();
+    for (const entry of txt) {
+        const equals = entry.indexOf('=');
+        if (equals === -1) {
+            continue;
+        }
+        map.set(entry.slice(0, equals), entry.slice(equals + 1));
+    }
+    return map;
+}
+function unescapeDnsSdName(value) {
+    return value.replace(/\\(\d{3})/g, (_match, code) => String.fromCharCode(Number(code)));
+}
+function normalizeHost(value) {
+    const host = sanitizeDnsSdText(unescapeDnsSdName(value), 253).replace(/\.$/, '');
+    if (!host || /[\s/\\]/.test(host) || !/^[A-Za-z0-9._:%-]+$/.test(host)) {
+        return null;
+    }
+    return host;
+}
+function sanitizeDnsSdText(value, maxBytes) {
+    const withoutControls = value.replace(/\u001B\[[0-9;?]*[ -/]*[@-~]/g, '').replace(/[\u0000-\u001F\u007F-\u009F]/g, ' ');
+    let cleaned = withoutControls.replace(/\s+/g, ' ').trim();
+    while (Buffer.byteLength(cleaned, 'utf8') > maxBytes) {
+        cleaned = cleaned.slice(0, -1);
+    }
+    return cleaned.trim();
+}
+function runDnsSd(args, timeoutMs, maxOutputBytes) {
+    return new Promise(resolve => {
+        const child = spawn('dns-sd', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let output = '';
+        let killedForLimit = false;
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+        }, timeoutMs);
+        const appendOutput = (chunk) => {
+            if (Buffer.byteLength(output, 'utf8') >= maxOutputBytes) {
+                if (!killedForLimit) {
+                    killedForLimit = true;
+                    child.kill('SIGTERM');
+                }
+                return;
+            }
+            const remaining = maxOutputBytes - Buffer.byteLength(output, 'utf8');
+            output += chunk.toString('utf8').slice(0, remaining);
+        };
+        child.stdout.on('data', chunk => {
+            appendOutput(chunk);
+        });
+        child.stderr.on('data', chunk => {
+            appendOutput(chunk);
+        });
+        child.once('error', () => {
+            clearTimeout(timer);
+            resolve(output);
+        });
+        child.once('exit', () => {
+            clearTimeout(timer);
+            resolve(output);
+        });
+    });
+}
+async function mapWithConcurrency(items, concurrency, map) {
+    const results = [];
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+        while (nextIndex < items.length) {
+            const index = nextIndex;
+            nextIndex += 1;
+            results[index] = await map(items[index]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}

package/dist/player/airplay-sender-health.js

@@ -0,0 +1,87 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname } from 'node:path';
+const require = createRequire(import.meta.url);
+const airPlaySenderPackageName = 'node-airtunes2';
+export function airPlaySenderHealth(lookupPackage = lookupInstalledPackage) {
+    const sender = lookupPackage(airPlaySenderPackageName);
+    if (!sender) {
+        return {
+            available: false,
+            safe: false,
+            packageName: airPlaySenderPackageName,
+            message: 'AirPlay sender package not installed. Install an audited node-airtunes2-compatible sender next to RadioCLI.',
+            vulnerablePackages: []
+        };
+    }
+    const vulnerablePackages = vulnerableAirPlaySenderPackages(sender, lookupPackage);
+    if (vulnerablePackages.length > 0) {
+        return {
+            available: true,
+            safe: false,
+            packageName: sender.name,
+            version: sender.version,
+            message: `Installed AirPlay sender ${sender.name}@${sender.version} is blocked because vulnerable transitive dependencies were found: ${vulnerablePackages.join(', ')}.`,
+            vulnerablePackages
+        };
+    }
+    return {
+        available: true,
+        safe: true,
+        packageName: sender.name,
+        version: sender.version,
+        message: `AirPlay sender ${sender.name}@${sender.version} passed the dependency safety gate.`,
+        vulnerablePackages: []
+    };
+}
+function vulnerableAirPlaySenderPackages(sender, lookupPackage) {
+    const packagePaths = [sender.root];
+    const vulnerable = [];
+    const protobuf = lookupPackage('protobufjs', packagePaths);
+    const elliptic = lookupPackage('elliptic', packagePaths);
+    if (protobuf && compareSemver(protobuf.version, '7.5.8') < 0) {
+        vulnerable.push(`protobufjs@${protobuf.version}`);
+    }
+    if (elliptic && compareSemver(elliptic.version, '6.6.2') < 0) {
+        vulnerable.push(`elliptic@${elliptic.version}`);
+    }
+    return vulnerable;
+}
+function lookupInstalledPackage(packageName, paths) {
+    try {
+        const packageJsonPath = paths
+            ? require.resolve(`${packageName}/package.json`, { paths })
+            : require.resolve(`${packageName}/package.json`);
+        const parsed = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+        if (!parsed.version) {
+            return null;
+        }
+        return {
+            name: parsed.name ?? packageName,
+            version: parsed.version,
+            root: dirname(packageJsonPath)
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function compareSemver(left, right) {
+    const leftParts = semverParts(left);
+    const rightParts = semverParts(right);
+    for (let index = 0; index < 3; index += 1) {
+        const delta = leftParts[index] - rightParts[index];
+        if (delta !== 0) {
+            return delta;
+        }
+    }
+    return 0;
+}
+function semverParts(version) {
+    const [major = '0', minor = '0', patch = '0'] = version.split(/[.-]/);
+    return [
+        Number.parseInt(major, 10) || 0,
+        Number.parseInt(minor, 10) || 0,
+        Number.parseInt(patch, 10) || 0
+    ];
+}

package/dist/player/airplay-worker-protocol.js

@@ -0,0 +1,129 @@
+const maxWorkerStartBytes = 16_384;
+export const maxWorkerMessageBytes = 8192;
+const maxWorkerTextBytes = 512;
+const maxPasscodeBytes = 64;
+export function encodeWorkerStart(start) {
+    return Buffer.from(JSON.stringify(start), 'utf8').toString('base64url');
+}
+export function decodeWorkerStart(encoded) {
+    const decoded = Buffer.from(encoded, 'base64url').toString('utf8');
+    if (Buffer.byteLength(decoded, 'utf8') > maxWorkerStartBytes) {
+        throw new Error('AirPlay worker start payload is too large.');
+    }
+    return validateWorkerStart(JSON.parse(decoded));
+}
+export function serializeWorkerMessage(message) {
+    return `${JSON.stringify(message)}\n`;
+}
+export function parseWorkerMessage(line) {
+    if (!line.trim()) {
+        return null;
+    }
+    if (Buffer.byteLength(line, 'utf8') > maxWorkerMessageBytes) {
+        return null;
+    }
+    try {
+        return validateWorkerMessage(JSON.parse(line));
+    }
+    catch {
+        return null;
+    }
+}
+function validateWorkerStart(value) {
+    if (!isRecord(value) || !isRecord(value.device)) {
+        throw new Error('Invalid AirPlay worker start payload.');
+    }
+    const streamUrl = boundedString(value.streamUrl, 'streamUrl', 4096);
+    const parsedUrl = new URL(streamUrl);
+    if (!['http:', 'https:'].includes(parsedUrl.protocol)) {
+        throw new Error('AirPlay streams must use http or https URLs.');
+    }
+    const device = value.device;
+    const port = Number(device.port);
+    const txt = Array.isArray(device.txt)
+        ? device.txt.slice(0, 64).map(item => boundedString(item, 'txt', 512)).filter(Boolean)
+        : [];
+    return {
+        streamUrl,
+        stationName: boundedText(value.stationName, 'stationName', maxWorkerTextBytes),
+        volume: clampVolume(Number(value.volume)),
+        muted: typeof value.muted === 'boolean' ? value.muted : false,
+        device: {
+            id: boundedText(device.id, 'device.id', 256),
+            name: boundedText(device.name, 'device.name', 256),
+            host: safeHost(device.host),
+            port: Number.isInteger(port) && port > 0 && port <= 65535 ? port : invalid('device.port'),
+            txt,
+            requiresPassword: Boolean(device.requiresPassword),
+            airplay2: Boolean(device.airplay2)
+        }
+    };
+}
+function validateWorkerMessage(value) {
+    if (!isRecord(value) || typeof value.type !== 'string') {
+        return null;
+    }
+    if (value.type === 'stop') {
+        return { type: 'stop' };
+    }
+    if (value.type === 'setVolume') {
+        return Number.isFinite(Number(value.volume)) ? { type: 'setVolume', volume: clampVolume(Number(value.volume)) } : null;
+    }
+    if (value.type === 'setMuted') {
+        return typeof value.muted === 'boolean' ? { type: 'setMuted', muted: value.muted } : null;
+    }
+    if (value.type === 'passcode') {
+        if (typeof value.code !== 'string' || Buffer.byteLength(value.code, 'utf8') > maxPasscodeBytes) {
+            return null;
+        }
+        const code = cleanText(value.code, maxPasscodeBytes);
+        return code ? { type: 'passcode', code } : null;
+    }
+    if (value.type === 'ready' || value.type === 'playing' || value.type === 'password-required' || value.type === 'stopped') {
+        return { type: value.type };
+    }
+    if (value.type === 'buffer') {
+        return { type: 'buffer', status: cleanText(value.status, 120) || 'unknown' };
+    }
+    if (value.type === 'error') {
+        return { type: 'error', message: cleanText(value.message, maxWorkerTextBytes) || 'AirPlay worker error.' };
+    }
+    return null;
+}
+function boundedString(value, field, maxBytes) {
+    if (typeof value !== 'string' || !value.trim()) {
+        return invalid(field);
+    }
+    const cleaned = cleanText(value, maxBytes);
+    return cleaned || invalid(field);
+}
+function boundedText(value, field, maxBytes) {
+    return boundedString(value, field, maxBytes);
+}
+function cleanText(value, maxBytes) {
+    if (typeof value !== 'string') {
+        return '';
+    }
+    const withoutControls = value.replace(/[\u0000-\u001F\u007F-\u009F]/g, ' ').replace(/\s+/g, ' ').trim();
+    let cleaned = withoutControls;
+    while (Buffer.byteLength(cleaned, 'utf8') > maxBytes) {
+        cleaned = cleaned.slice(0, -1);
+    }
+    return cleaned.trim();
+}
+function safeHost(value) {
+    const host = boundedString(value, 'device.host', 253).replace(/\.$/, '');
+    if (/[\s/\\]/.test(host) || !/^[A-Za-z0-9._:%-]+$/.test(host)) {
+        return invalid('device.host');
+    }
+    return host;
+}
+function clampVolume(volume) {
+    return Math.min(100, Math.max(0, Math.round(Number.isFinite(volume) ? volume : 70)));
+}
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function invalid(field) {
+    throw new Error(`Invalid AirPlay worker ${field}.`);
+}