@ciphore/radiocli 0.1.2 → 0.1.4

package/CHANGELOG.md

@@ -5,6 +5,60 @@ All notable changes to RadioCLI are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.1.4] - 2026-05-31
+
+### Added
+
+- Added a dedicated AirPlay receiver picker and AirPlay Code screen for
+  passcode-protected receivers.
+
+### Changed
+
+- Replaced silent AirPlay target cycling with a dedicated receiver picker in
+  Settings, clearer Audio output labels, immediate output switching while a
+  station is playing, and explicit AirPlay receiver selection before tuning.
+- AirPlay is now an explicit current-session output instead of a persisted
+  default. Restarting RadioCLI returns to automatic local playback while keeping
+  the last receiver available for the next manual AirPlay switch.
+- Bundled the AirPlay sender bridge and updated the Homebrew formula template to
+  install FFmpeg, so macOS users do not need manual AirPlay package setup.
+
+### Fixed
+
+- Fixed same-session AirPlay station switching so the worker retunes the active
+  receiver, resets its sender buffer, and keeps the UI in buffering until the
+  new stream is actually ready.
+- Fixed AirPlay output failures so `skip broken streams` no longer walks
+  through the library when the receiver is missing, off, local, or unavailable.
+- Fixed library selection after playing a station that moves to the top of
+  recents.
+- Patched the bundled AirPlay sender for modern macOS AirPlay 2 receivers that
+  return digest-protected setup responses or empty first setup bodies.
+
+## [0.1.3] - 2026-05-30
+
+### Added
+
+- Experimental macOS AirPlay playback backend with Bonjour receiver discovery,
+  Settings target selection, `:airplay-code` passcode entry, worker-based stream
+  forwarding, and active receiver labels in the playback footer.
+
+### Changed
+
+- `ffplay` is now treated as a playback-only fallback: the UI labels it as
+  `ffplay fallback`, `radiocli doctor` reports limited controls, and unsupported
+  pause, mute, volume, and media-key actions explain that `mpv` is required.
+
+### Security
+
+- AirPlay sender support is worker-isolated and blocks high-risk sender
+  dependency advisories before the backend is advertised.
+- Hardened AirPlay discovery and worker messaging with bounded payloads,
+  sanitized receiver data, passcode validation, and worker shutdown on startup
+  timeout.
+
 ## [0.1.2] - 2026-05-30
 
 ### Fixed
@@ -26,9 +80,10 @@ Initial public release.
   countries, world map, nearby, stats, and settings screens.
 - Radio Browser provider with mirror fallback, durable cache, and tune
   resolution, plus an experimental, opt-in Radio Garden provider.
-- `mpv` playback with `ffplay` fallback, readiness checks, ICY metadata polling,
-  volume, pause, mute, sleep timer, tune timeouts, and skip-broken-stream
-  behavior, using Unix sockets on macOS/Linux and named pipes on native Windows.
+- `mpv` playback controls for readiness checks, ICY metadata polling, volume,
+  pause, and mute, with `ffplay` playback fallback, sleep timer, tune timeouts,
+  and skip-broken-stream behavior, using Unix sockets on macOS/Linux and named
+  pipes on native Windows.
 - Receiver-style Now Playing screen with 50 selectable visualizers and
   zero-signal frames whenever playback is idle, paused, stopped, or not
   backend-ready.
@@ -56,5 +111,7 @@ Initial public release.
   backend/volume that already appear in the header and footer. The reclaimed
   rows go to the visualizer.
 
+[0.1.4]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.4
+[0.1.3]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.3
 [0.1.2]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.2
 [0.1.1]: https://github.com/Ciphore/RadioCLI/releases/tag/v0.1.1

package/CONTRIBUTING.md

@@ -12,7 +12,8 @@ npm run build
 npm run test
 ```
 
-Install `mpv` for the best playback experience:
+Install `mpv` for playback controls, metadata polling, and the best playback
+experience:
 
 ```bash
 brew install mpv
@@ -57,4 +58,6 @@ checks.
 ## Issue Triage
 
 Playback issues should include station name, country, backend, and
-`radiocli check` output when possible.
+`radiocli check` or `radiocli doctor` output when possible. If the backend is
+`ffplay`, pause, mute, volume, and play/pause media-key behavior are expected to
+be limited until `mpv` is installed.

package/README.md

@@ -13,8 +13,8 @@ It is built with [Ink](https://github.com/vadimdemedes/ink), [React](https://rea
 ## Features
 
 - Explore public radio from around the world through a cosmo-style braille world map beside the station list, with click-to-place mouse support and WASD keyboard movement backed by a cached geotagged station atlas. Country lists, global station search, a country-density map, and opt-in nearby discovery round out the discovery surface.
-- Tune stations with `mpv` first and `ffplay` fallback when available.
-- Use a receiver-style Now Playing screen with 50 selectable receiver visualizers, backend status, cleaned ICY track metadata, stream diagnostics, sleep timer, favorite state, volume, pause, mute, station skipping, and zero-signal graphics whenever playback is idle, paused, stopped, or not backend-ready.
+- Tune stations with `mpv` first for full playback controls, with `ffplay` as a playback-only fallback when available.
+- Use a receiver-style Now Playing screen with 50 selectable receiver visualizers, backend status, cleaned ICY track metadata, stream diagnostics, sleep timer, favorite state, `mpv`-backed volume, pause, mute, station skipping, and zero-signal graphics whenever playback is idle, paused, stopped, or not backend-ready.
 - Keep shortcuts in a fixed adaptive footer: a compact live station and track row appears above page-specific and global controls while playback is active.
 - Move previous/next through the exact station list you tuned from, even after navigating to another screen.
 - Browse dense station lists with inline location/codec metadata and yellow favorite stars next to station names.
@@ -70,7 +70,7 @@ Live public radio from around the world
   5 Countries · Browse by country list with a world-map toggle
   6 Nearby · Opt-in approximate location for local stations
   7 Stats · Listening graph, sessions, streaks, hours
-  8 Settings · Playback backend, colors, providers
+  8 Settings · Audio output, colors, providers
 
 3 recent · 2 favorites · 1 imported
 
@@ -137,10 +137,11 @@ Set `NEXT_PUBLIC_SITE_URL` for the canonical public docs URL. Preview builds als
 
 Requirements:
 
-- Homebrew on macOS: installs RadioCLI, Node.js, and `mpv`
+- Homebrew on macOS: installs RadioCLI, Node.js, `mpv`, and FFmpeg
 - npm on macOS, Linux, and Windows: Node.js 22 or newer
-- `mpv` for best playback; RadioCLI expects one local playback backend at runtime
-- `ffplay` from FFmpeg as an optional fallback
+- `mpv` for playback, pause, mute, volume, media keys, metadata, and readiness checks
+- FFmpeg on macOS for experimental AirPlay and optional `ffplay` fallback
+- `ffplay` from FFmpeg as an optional playback-only fallback
 
 Recommended macOS install:
 
@@ -149,8 +150,12 @@ brew install ciphore/tap/radiocli
 radiocli
 ```
 
-The Homebrew formula depends on `node` and `mpv`, so the native playback backend
-comes from the native package manager.
+The Homebrew formula depends on `node`, `mpv`, and FFmpeg, so the native playback
+and AirPlay prerequisites come from the native package manager.
+
+AirPlay playback on macOS is experimental, but the sender bridge is bundled with
+RadioCLI. The app discovers AirPlay/RAOP receivers with Bonjour and decodes
+streams with FFmpeg; passcode-protected receivers prompt in the TUI.
 
 Universal npm install:
 
@@ -203,6 +208,11 @@ Windows:
 winget install --id Gyan.FFmpeg -e
 ```
 
+`ffplay` can keep streams playable when `mpv` is not installed, but it does not
+provide reliable pause, mute, volume, media-key, or metadata control. In that
+mode RadioCLI labels the backend as `ffplay fallback`, shows limited-control
+footer text, and `radiocli doctor` reports `controls=limited`.
+
 CI covers command-mode typecheck, tests, builds, package checks, and fresh
 install smoke checks on Ubuntu, macOS, and Windows.
 
@@ -257,6 +267,11 @@ RadioCLI keeps shortcuts at the bottom of the terminal. When playback is active,
 - `+` / `-`: volume.
 - `q` or `Ctrl+C`: quit cleanly.
 
+Pause, mute, volume, and play/pause media-key control require `mpv`. When only
+`ffplay` is active, RadioCLI keeps playback and station skipping available but
+labels interactive playback controls as limited and shows an `Install mpv`
+warning instead of pretending the control worked.
+
 Page-specific footer controls:
 
 | Screen | Controls |
@@ -269,7 +284,9 @@ Page-specific footer controls:
 | World map | `/` filter, `↑` / `↓` move, `Enter` open country, `w` list, `b` home |
 | Station lists | `↑` / `↓` or `n` / `p` move, `Enter` tune, `f` favorite, `[` / `]` page, `b` home |
 | Now Playing | `space` / `F8` pause, `f` favorite, `m` mute, `s` sleep, `d` diagnostics, `b` home |
-| Settings | `Enter` change selected, `g` Radio Garden, `l` location, `x` skip broken streams, `o` backend, `r` health, `b` home |
+| Settings | `Enter` change selected, `g` Radio Garden, `l` location, `x` skip broken streams, `o` audio output, `a` AirPlay, `r` health, `b` home |
+| AirPlay | `↑` / `↓` choose, `Enter` select receiver, `c` code entry, `r` refresh, `b` settings |
+| AirPlay Code | type receiver code, `Backspace` edit, `Enter` submit, `Esc` AirPlay |
 | Stats | `b` home |
 
 Other active shortcuts:
@@ -279,7 +296,7 @@ Other active shortcuts:
 - `/`: edit search or country filter on screens that support it.
 - `[` / `]`: page through long station and country lists.
 - `m`: mute.
-- `o`: cycle playback backend.
+- `o`: cycle audio output. If a station is playing, RadioCLI retunes it on the new output immediately.
 - `g`: toggle the experimental Radio Garden adapter.
 - `l`: toggle nearby location lookup.
 - `x`: toggle skip-broken-stream behavior.
@@ -292,7 +309,7 @@ Other active shortcuts:
 
 When you tune a station from Library, Explore, Search, Countries, or Nearby, that list becomes the playback queue. Previous/next keeps moving through that source list from any screen until you tune from another list.
 
-Hardware media keys depend on the OS and terminal. RadioCLI maximizes compatibility by enabling enhanced keyboard reporting where supported, recognizing common F7/F8/F9 sequences, Kitty consumer/media-key codes, modified-arrow sequences, comma/dot transport fallback, and learned custom bindings. Learn keys from Settings or with `:learn previous`, `:learn play`, and `:learn next`; clear them with `:keys reset`.
+Hardware media keys depend on the OS and terminal. RadioCLI maximizes compatibility by enabling enhanced keyboard reporting where supported, recognizing common F7/F8/F9 sequences, Kitty consumer/media-key codes, modified-arrow sequences, comma/dot transport fallback, and learned custom bindings. Previous/next media actions stay app-level; play/pause needs the `mpv` backend. Learn keys from Settings or with `:learn previous`, `:learn play`, and `:learn next`; clear them with `:keys reset`.
 
 Explore mouse clicks use terminal mouse reporting while the Explore tab is active. If your terminal or tmux setup does not pass those events through, the WASD cursor controls stay fully available.
 
@@ -317,6 +334,8 @@ Useful command palette entries:
 :learn play
 :learn next
 :keys reset
+:airplay
+:airplay-code 1234
 :map
 :library
 :stats
@@ -326,6 +345,16 @@ Useful command palette entries:
 
 Settings persist display colors and receiver styles without editing config files. The fourteen display colors are green, amber, blue, ruby, ice, teal, violet, copper, cyan, lime, coral, rose, slate, and mono, cycled with `t`. The 50 receiver styles span classic receiver displays, high-resolution braille visuals, and generative motion scenes; cycle them with `v` (see the [Demo](#demo) for the full family breakdown). The stats graph and legend follow the selected display color, and the selected Now Playing style is restored on the next launch.
 
+On macOS, Settings opens a dedicated AirPlay receiver picker for Bonjour
+receivers. Change Audio output to AirPlay with `o`, open AirPlay with `a` or
+`:airplay`, and choose a visible receiver. If a station is already playing,
+RadioCLI moves it to the selected receiver immediately; switch Audio output back
+to `This device (mpv)` to leave AirPlay. RadioCLI does not auto-pick a receiver.
+AirPlay is a current-session output: restarting RadioCLI returns to automatic
+local playback while remembering the last receiver for the next manual switch.
+If the receiver asks for a code, RadioCLI opens the AirPlay Code screen; you can
+also press `c` from AirPlay settings or use `:airplay-code 1234`.
+
 ## Architecture
 
 RadioCLI is split around four seams:
@@ -342,9 +371,9 @@ a station, `ProviderManager.resolve()` follows the provider-specific path, then
 `PlayerController` starts `mpv` with `--no-video`, `--force-window=no`, a local
 JSON IPC endpoint, and the configured volume. The endpoint is a Unix socket on
 macOS/Linux and a named pipe on native Windows. `ffplay` is available as a
-simpler fallback, but `mpv` is the intended backend because it handles
-redirects, HLS, codecs, metadata, pause, mute, volume, and readiness checks more
-reliably than a JavaScript stream client.
+playback-only fallback, but `mpv` is the intended backend because it handles
+redirects, HLS, codecs, metadata, pause, mute, volume, media keys, and readiness
+checks more reliably than a JavaScript stream client.
 
 RadioCLI waits for the backend to become ready before marking playback as
 `playing`. With `mpv`, it polls playback state every 500ms and ICY metadata every
@@ -385,7 +414,7 @@ animation cost.
 
 Radio Browser is the primary provider. Its own docs recommend using a speaking user agent, resolving station clicks through `/json/url`, and retrying with other servers when one fails; RadioCLI follows that shape with mirror fallback and durable cache. Explore and Nearby use a cached geotagged Radio Browser atlas, then compute local distance in the app so map movement is not biased toward the most-clicked stations worldwide. Radio Garden support is experimental because the useful endpoints are publicly discoverable but unofficial, and they can be blocked or changed independently of this project.
 
-Playback prefers `mpv` because it handles real-world streams, redirects, HLS, codecs, and metadata better than a hand-rolled stream client. RadioCLI controls `mpv` through JSON IPC for readiness, pause, mute, volume, and metadata polling, using Unix sockets on macOS/Linux and named pipes on Windows.
+Playback prefers `mpv` because it handles real-world streams, redirects, HLS, codecs, and metadata better than a hand-rolled stream client. RadioCLI controls `mpv` through JSON IPC for readiness, pause, mute, volume, and metadata polling, using Unix sockets on macOS/Linux and named pipes on Windows. `ffplay` remains a playback-only fallback and is intentionally labeled with limited controls in the UI and doctor output. Experimental AirPlay output is available on macOS when Bonjour discovery and FFmpeg are available.
 
 The npm package is `@ciphore/radiocli`, and the installed executable is `radiocli`. Current installs store data under RadioCLI paths such as `radiocli.json` and `radiocli-cache.json`. Existing Radio Atlas data is still discovered when a new RadioCLI store does not exist, and legacy `RADIO_ATLAS_HOME` / animation environment variables remain supported as migration fallbacks. New automation should use `RADIOCLI_HOME` and `RADIOCLI_DISABLE_ANIMATION`.
 

package/dist/player/airplay-discovery.js

@@ -0,0 +1,174 @@
+import { spawn } from 'node:child_process';
+import { lookup } from 'node:dns/promises';
+import { networkInterfaces } from 'node:os';
+import { commandExists } from './command.js';
+const defaultTimeoutMs = 2500;
+const defaultMaxDevices = 12;
+const defaultLookupConcurrency = 4;
+const defaultMaxOutputBytes = 64 * 1024;
+export async function discoverAirPlayDevices({ platform = process.platform, timeoutMs = defaultTimeoutMs, maxDevices = defaultMaxDevices, lookupConcurrency = defaultLookupConcurrency, maxOutputBytes = defaultMaxOutputBytes } = {}) {
+    if (platform !== 'darwin' || !commandExists('dns-sd')) {
+        return [];
+    }
+    const browseOutput = await runDnsSd(['-B', '_raop._tcp', 'local'], timeoutMs, maxOutputBytes).catch(() => '');
+    const instances = parseRaopBrowseOutput(browseOutput).slice(0, Math.max(0, maxDevices));
+    const devices = await mapWithConcurrency(instances, Math.max(1, lookupConcurrency), async (instance) => {
+        const lookupOutput = await runDnsSd(['-L', instance, '_raop._tcp', 'local'], timeoutMs, maxOutputBytes).catch(() => '');
+        const device = parseRaopLookupOutput(instance, lookupOutput);
+        return device ? enrichAirPlayDeviceHost(device) : null;
+    });
+    return devices.filter((device) => Boolean(device));
+}
+async function enrichAirPlayDeviceHost(device) {
+    const addresses = await lookup(device.host, { all: true, family: 4 }).catch(() => []);
+    if (addresses.length === 0) {
+        return device;
+    }
+    const localAddresses = localIpv4Addresses();
+    const preferred = addresses.find(address => !isLoopbackAddress(address.address)) ?? addresses[0];
+    if (!preferred) {
+        return device;
+    }
+    return {
+        ...device,
+        host: preferred.address,
+        local: addresses.some(address => localAddresses.has(address.address))
+    };
+}
+function localIpv4Addresses() {
+    const addresses = new Set(['127.0.0.1']);
+    for (const entries of Object.values(networkInterfaces())) {
+        for (const entry of entries ?? []) {
+            if (entry.family === 'IPv4') {
+                addresses.add(entry.address);
+            }
+        }
+    }
+    return addresses;
+}
+function isLoopbackAddress(address) {
+    return address === '127.0.0.1' || address.startsWith('127.');
+}
+export function parseRaopBrowseOutput(output) {
+    const instances = new Set();
+    for (const line of output.split('\n')) {
+        const match = /\s_raop\._tcp\.\s+(.+)$/.exec(line);
+        const instance = sanitizeDnsSdText(unescapeDnsSdName(match?.[1]?.trim() ?? ''), 256);
+        if (instance) {
+            instances.add(instance);
+        }
+    }
+    return [...instances];
+}
+export function parseRaopLookupOutput(instance, output) {
+    const reachable = output.match(/ can be reached at (.+?)\.?:(\d+) \(interface \d+\)/);
+    if (!reachable?.[1] || !reachable[2]) {
+        return null;
+    }
+    const id = sanitizeDnsSdText(instance, 256);
+    const host = normalizeHost(reachable[1]);
+    const port = Number(reachable[2]);
+    if (!id || !host || !Number.isInteger(port) || port <= 0 || port > 65535) {
+        return null;
+    }
+    const txtLine = output
+        .split('\n')
+        .map(line => line.trim())
+        .find(line => /\bcn=/.test(line) || /\bsf=/.test(line) || /\bpk=/.test(line));
+    const txt = txtLine
+        ? txtLine.split(/\s+/).map(entry => sanitizeDnsSdText(entry, 512)).filter(Boolean).slice(0, 64)
+        : [];
+    const txtMap = txtRecordMap(txt);
+    const sf = txtMap.get('sf');
+    const sfValue = sf ? Number.parseInt(sf.replace(/^0x/i, ''), 16) : 0;
+    return {
+        id,
+        name: displayNameForRaopInstance(id),
+        host,
+        port,
+        txt,
+        requiresPassword: sfValue !== 0 && sfValue !== 0x4,
+        airplay2: Boolean(txtMap.get('pk') || txtMap.get('vv') === '2' || txtMap.get('et')?.split(',').some(value => ['3', '4', '5'].includes(value)))
+    };
+}
+function displayNameForRaopInstance(instance) {
+    const atIndex = instance.indexOf('@');
+    return sanitizeDnsSdText(atIndex === -1 ? instance : instance.slice(atIndex + 1), 256) || 'AirPlay receiver';
+}
+function txtRecordMap(txt) {
+    const map = new Map();
+    for (const entry of txt) {
+        const equals = entry.indexOf('=');
+        if (equals === -1) {
+            continue;
+        }
+        map.set(entry.slice(0, equals), entry.slice(equals + 1));
+    }
+    return map;
+}
+function unescapeDnsSdName(value) {
+    return value.replace(/\\(\d{3})/g, (_match, code) => String.fromCharCode(Number(code)));
+}
+function normalizeHost(value) {
+    const host = sanitizeDnsSdText(unescapeDnsSdName(value), 253).replace(/\.$/, '');
+    if (!host || /[\s/\\]/.test(host) || !/^[A-Za-z0-9._:%-]+$/.test(host)) {
+        return null;
+    }
+    return host;
+}
+function sanitizeDnsSdText(value, maxBytes) {
+    const withoutControls = value.replace(/\u001B\[[0-9;?]*[ -/]*[@-~]/g, '').replace(/[\u0000-\u001F\u007F-\u009F]/g, ' ');
+    let cleaned = withoutControls.replace(/\s+/g, ' ').trim();
+    while (Buffer.byteLength(cleaned, 'utf8') > maxBytes) {
+        cleaned = cleaned.slice(0, -1);
+    }
+    return cleaned.trim();
+}
+function runDnsSd(args, timeoutMs, maxOutputBytes) {
+    return new Promise(resolve => {
+        const child = spawn('dns-sd', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        let output = '';
+        let killedForLimit = false;
+        const timer = setTimeout(() => {
+            child.kill('SIGTERM');
+        }, timeoutMs);
+        const appendOutput = (chunk) => {
+            if (Buffer.byteLength(output, 'utf8') >= maxOutputBytes) {
+                if (!killedForLimit) {
+                    killedForLimit = true;
+                    child.kill('SIGTERM');
+                }
+                return;
+            }
+            const remaining = maxOutputBytes - Buffer.byteLength(output, 'utf8');
+            output += chunk.toString('utf8').slice(0, remaining);
+        };
+        child.stdout.on('data', chunk => {
+            appendOutput(chunk);
+        });
+        child.stderr.on('data', chunk => {
+            appendOutput(chunk);
+        });
+        child.once('error', () => {
+            clearTimeout(timer);
+            resolve(output);
+        });
+        child.once('exit', () => {
+            clearTimeout(timer);
+            resolve(output);
+        });
+    });
+}
+async function mapWithConcurrency(items, concurrency, map) {
+    const results = [];
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+        while (nextIndex < items.length) {
+            const index = nextIndex;
+            nextIndex += 1;
+            results[index] = await map(items[index]);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}

package/dist/player/airplay-sender-health.js

@@ -0,0 +1,98 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { dirname } from 'node:path';
+const require = createRequire(import.meta.url);
+const airPlaySenderPackageName = 'node-airtunes2';
+export function airPlaySenderHealth(lookupPackage = lookupInstalledPackage) {
+    const sender = lookupPackage(airPlaySenderPackageName);
+    if (!sender) {
+        return {
+            available: false,
+            safe: false,
+            packageName: airPlaySenderPackageName,
+            message: 'AirPlay sender package is not installed.',
+            vulnerablePackages: [],
+            warningPackages: []
+        };
+    }
+    const vulnerablePackages = blockingAirPlaySenderPackages(sender, lookupPackage);
+    const warningPackages = warningAirPlaySenderPackages(sender, lookupPackage);
+    if (vulnerablePackages.length > 0) {
+        return {
+            available: true,
+            safe: false,
+            packageName: sender.name,
+            version: sender.version,
+            message: `Installed AirPlay sender ${sender.name}@${sender.version} is blocked because vulnerable transitive dependencies were found: ${vulnerablePackages.join(', ')}.`,
+            vulnerablePackages,
+            warningPackages
+        };
+    }
+    return {
+        available: true,
+        safe: true,
+        packageName: sender.name,
+        version: sender.version,
+        message: warningPackages.length > 0
+            ? `Bundled AirPlay sender ${sender.name}@${sender.version} is available with warnings: ${warningPackages.join(', ')}.`
+            : `AirPlay sender ${sender.name}@${sender.version} passed the dependency safety gate.`,
+        vulnerablePackages: [],
+        warningPackages
+    };
+}
+function blockingAirPlaySenderPackages(sender, lookupPackage) {
+    const packagePaths = [sender.root];
+    const vulnerable = [];
+    const protobuf = lookupPackage('protobufjs', packagePaths);
+    if (protobuf && compareSemver(protobuf.version, '7.5.8') < 0) {
+        vulnerable.push(`protobufjs@${protobuf.version}`);
+    }
+    return vulnerable;
+}
+function warningAirPlaySenderPackages(sender, lookupPackage) {
+    const packagePaths = [sender.root];
+    const vulnerable = [];
+    const elliptic = lookupPackage('elliptic', packagePaths);
+    if (elliptic && compareSemver(elliptic.version, '6.6.2') < 0) {
+        vulnerable.push(`elliptic@${elliptic.version}`);
+    }
+    return vulnerable;
+}
+function lookupInstalledPackage(packageName, paths) {
+    try {
+        const packageJsonPath = paths
+            ? require.resolve(`${packageName}/package.json`, { paths })
+            : require.resolve(`${packageName}/package.json`);
+        const parsed = JSON.parse(readFileSync(packageJsonPath, 'utf8'));
+        if (!parsed.version) {
+            return null;
+        }
+        return {
+            name: parsed.name ?? packageName,
+            version: parsed.version,
+            root: dirname(packageJsonPath)
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function compareSemver(left, right) {
+    const leftParts = semverParts(left);
+    const rightParts = semverParts(right);
+    for (let index = 0; index < 3; index += 1) {
+        const delta = leftParts[index] - rightParts[index];
+        if (delta !== 0) {
+            return delta;
+        }
+    }
+    return 0;
+}
+function semverParts(version) {
+    const [major = '0', minor = '0', patch = '0'] = version.split(/[.-]/);
+    return [
+        Number.parseInt(major, 10) || 0,
+        Number.parseInt(minor, 10) || 0,
+        Number.parseInt(patch, 10) || 0
+    ];
+}

package/dist/player/airplay-sender-patch.js

@@ -0,0 +1,138 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const setupAp2DigestGuard = 'this.status === SETUP_AP2_1 && response.code === 401';
+const responseHeadersMarker = '    headers = response.headers';
+const processDataResponseMarker = '  if (this.status != OPTIONS && this.status != OPTIONS2 && this.mode == 0) {';
+const setupAp2TimingPortMarker = `      let sa1_bplist = bplistParser.parseBuffer(buf7)
+      this.eventPort = sa1_bplist[0]['eventPort']
+      if (sa1_bplist[0]['timingPort'])
+        this.timingDestPort = sa1_bplist[0]['timingPort']
+      console.log('timing port ok', sa1_bplist[0]['timingPort'])`;
+const setupAp2TimingPortFallback = `      let sa1_bplist
+      try {
+        sa1_bplist = buf7.length > 0 ? bplistParser.parseBuffer(buf7) : [{}]
+      }
+      catch (_) {
+        sa1_bplist = [{}]
+      }
+      this.eventPort = sa1_bplist[0]['eventPort'] || this.eventPort || this.socket.remotePort || 7000
+      if (sa1_bplist[0]['timingPort'])
+        this.timingDestPort = sa1_bplist[0]['timingPort']
+      console.log('timing port ok', sa1_bplist[0]['timingPort'])`;
+const socketDataHandlerMarker = `  var blob = ''
+  this.socket.on('data', function (data) {
+    if (self.encryptedChannel && self.credentials) {
+      // if (self.debug != false) console.log("incoming", data)
+      data = self.credentials.decrypt(data)
+    }
+    self.clearTimeout()
+
+    /*
+     * I wish I could use node's HTTP parser for this...
+     * I assume that all responses have empty bodies.
+     */
+    var rawData = data
+    data = data.toString()
+
+    blob += data
+    var endIndex = blob.indexOf('\\r\\n\\r\\n')
+
+    if (endIndex < 0) {
+      return
+    }
+
+    endIndex += 4
+
+    blob = blob.substring(0, endIndex)
+    self.processData(blob, rawData)
+
+    blob = data.substring(endIndex)
+  })`;
+const bufferedSocketDataHandler = `  var blob = Buffer.alloc(0)
+  this.socket.on('data', function (data) {
+    if (self.encryptedChannel && self.credentials) {
+      // if (self.debug != false) console.log("incoming", data)
+      data = self.credentials.decrypt(data)
+    }
+    self.clearTimeout()
+
+    blob = Buffer.concat([blob, Buffer.from(data)])
+    while (blob.length > 0) {
+      var endIndex = blob.indexOf('\\r\\n\\r\\n')
+
+      if (endIndex < 0) {
+        return
+      }
+
+      endIndex += 4
+      var headers = blob.slice(0, endIndex).toString()
+      var lengthMatch = /(?:^|\\r\\n)Content-Length:\\s*(\\d+)/i.exec(headers)
+      var contentLength = lengthMatch ? parseInt(lengthMatch[1], 10) : 0
+      var messageLength = endIndex + contentLength
+
+      if (blob.length < messageLength) {
+        return
+      }
+
+      var rawData = blob.slice(0, messageLength)
+      self.processData(headers, rawData)
+
+      blob = blob.slice(messageLength)
+    }
+  })`;
+let installed = false;
+export function installAirPlaySenderPatch(packageName = 'node-airtunes2') {
+    if (installed) {
+        return true;
+    }
+    let rtspPath;
+    try {
+        rtspPath = require.resolve(`${packageName}/lib/rtsp.js`);
+    }
+    catch {
+        return false;
+    }
+    const moduleLoader = require('node:module');
+    const originalLoader = moduleLoader._extensions['.js'];
+    if (!originalLoader) {
+        return false;
+    }
+    moduleLoader._extensions['.js'] = (module, filename) => {
+        if (filename !== rtspPath) {
+            originalLoader(module, filename);
+            return;
+        }
+        module._compile(patchAirTunesRtspSource(readFileSync(filename, 'utf8')), filename);
+    };
+    installed = true;
+    return true;
+}
+export function patchAirTunesRtspSource(source) {
+    let patched = source;
+    if (patched.includes(socketDataHandlerMarker) && !patched.includes('Buffer.concat([blob, Buffer.from(data)])')) {
+        patched = patched.replace(socketDataHandlerMarker, bufferedSocketDataHandler);
+    }
+    if (patched.includes(setupAp2TimingPortMarker) && !patched.includes("this.socket.remotePort || 7000")) {
+        patched = patched.replace(setupAp2TimingPortMarker, setupAp2TimingPortFallback);
+    }
+    if (patched.includes(responseHeadersMarker) && !patched.includes('headers = response.headers || {}')) {
+        patched = patched.replace(responseHeadersMarker, '    headers = response.headers || {}');
+    }
+    if (patched.includes(setupAp2DigestGuard) || !patched.includes(processDataResponseMarker)) {
+        return patched;
+    }
+    const setupAp2DigestRetry = `  if (${setupAp2DigestGuard} && headers['WWW-Authenticate'] && this.password) {
+    const auth = headers['WWW-Authenticate']
+    const di = {
+      realm: parseAuthenticate(auth, 'realm'),
+      nonce: parseAuthenticate(auth, 'nonce'),
+      username: 'iTunes',
+      password: this.password,
+    }
+    this.sendNextRequest(di)
+    return
+  }
+`;
+    return patched.replace(processDataResponseMarker, `${setupAp2DigestRetry}${processDataResponseMarker}`);
+}