@jsprismarine/nethernet 0.0.0 → 0.20.0

package/CHANGELOG.md

@@ -0,0 +1,16 @@
+# @jsprismarine/nethernet
+
+## 0.20.0
+
+### Patch Changes
+
+- [#2944](https://github.com/JSPrismarine/JSPrismarine/pull/2944) [`e498e81`](https://github.com/JSPrismarine/JSPrismarine/commit/e498e81b74d4ca6ee2ea27dedc773c6b2fd37ab0) Thanks [@filiphsps](https://github.com/filiphsps)! - New package `@jsprismarine/nethernet` holds the NetherNet pieces a server and a client share: HTTP signaling, the signed `a=identity` on SDP answers, the LAN advertisement codec and the ES384 JSON Web Signatures Bedrock uses. `@jsprismarine/prismarine` uses it for its NetherNet transport and its encryption handshake.
+
+- [#2944](https://github.com/JSPrismarine/JSPrismarine/pull/2944) [`2f505cd`](https://github.com/JSPrismarine/JSPrismarine/commit/2f505cdb9140773af493c3f73890473556bed003) Thanks [@filiphsps](https://github.com/filiphsps)! - `@jsprismarine/auth` covers both ends of a Bedrock login. `XboxAuthProvider` signs in to Xbox Live through prismarine-auth, an optional peer dependency loaded only when a provider signs in, and presents the chain and multiplayer token Minecraft services issue for its key. `createAuthProvider` builds a provider by name, and `KeyedAuthProvider` is the base both providers share. A provider's `getMultiplayerToken()` returns its token, and `@jsprismarine/client` signs its NetherNet offer with it, as a signed-in game client does. The server's login verification moved into the package as `verifyLogin`, exported from `@jsprismarine/auth/server`, beside the values both ends agree on in `@jsprismarine/auth/protocol`.
+  
+  Every JWT and JWS is now signed, verified and decoded by `jose` rather than by hand or through fast-jwt, which no package depends on any more. `verifyLogin` fetches the issuer's keys through `jose`'s remote key set, and allows a minute of clock drift on a token's expiry as well as its start.
+  
+  Breaking: `@jsprismarine/prismarine/network/LoginVerifier` is removed; import `verifyLogin`, `LoginRefused`, `MojangKeys` and `useLoginKeys` from `@jsprismarine/auth/server`, and `TOKEN_ISSUER` from `@jsprismarine/auth/protocol`. `MojangKeys` takes a `fetch` implementation instead of a key set loader and a clock. `SessionEncryption.begin` returns a promise.
+- Updated dependencies [[`f030c63`](https://github.com/JSPrismarine/JSPrismarine/commit/f030c63e5c6269288d8dc576bddde160eda3cc74)]:
+  - @jsprismarine/binaryutils@0.20.0
+  - @jsprismarine/logger@0.20.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JSPrismarine Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,4 +1,19 @@
 # @jsprismarine/nethernet
 
-Placeholder release (`0.0.0`, dist-tag `placeholder`) used to reserve the package name
-and configure npm trusted publishing. Real releases will be published by CI.
+[![Join the Discord Server](https://img.shields.io/discord/704967868885762108?color=%237289DA&label=Discord)](https://discord.gg/kZZCDyCBbW)
+[![npm](https://img.shields.io/npm/dt/@jsprismarine/nethernet)](https://www.npmjs.com/package/@jsprismarine/nethernet)
+
+NetherNet is the WebRTC transport Minecraft: Bedrock Edition uses beside RakNet. This package holds
+what a server and a client both need on top of [`nethernet`](https://www.npmjs.com/package/nethernet),
+which carries the WebRTC connection itself:
+
+- `HttpSignaling`, the HTTP signaling a client joining by address uses: `GET /v1/join` for the
+  server's status and `POST /v1/join/{networkId}` to trade an SDP offer for an answer.
+- `NetherNetIdentity`, which signs the `a=identity` a client requires on every answer, and the SDP
+  helpers it is built on.
+- `encodeLanAdvertisement` and `decodeLanAdvertisement`, the advertisement a server answers LAN
+  discovery with, on the fixed UDP port `NETHERNET_LAN_PORT`.
+- `compactEs384`, `detachedEs384` and `verifiesDetachedEs384`, the ES384 JSON Web Signatures Bedrock signs its tokens with, made and checked by [`jose`](https://github.com/panva/jose).
+
+It knows nothing about Minecraft packets. The `0xFE` batch id NetherNet leaves out of each message
+is the business of whichever transport carries batches over it.

package/dist/HttpSignaling.d.ts

@@ -0,0 +1,60 @@
+import { SignalStructure } from 'nethernet';
+/** The part of `nethernet`'s `Server` that turns an offer into an answer. */
+export interface NetherNetOfferAnswerer {
+    /** Every peer by connection ID, which a new offer's ID must not collide with. */
+    readonly connections: ReadonlyMap<bigint, {
+        close(reason?: string): void;
+        readonly rtcConnection?: unknown;
+    }>;
+    /** Negotiates a peer for the offer, answering through `respond`. */
+    handleOffer(signal: SignalStructure, respond: (signal: SignalStructure) => void): Promise<void>;
+}
+/** Where the signaling server reports what went wrong. `@jsprismarine/logger`'s `Logger` fits. */
+export interface SignalingLogger {
+    debug(message: string): void;
+    info(message: string): void;
+    warn(message: string): void;
+    error(error: unknown): void;
+}
+/** What the signaling server needs besides the answerer. */
+export interface HttpSignalingOptions {
+    /** Turns an offer into an answer and keeps the peer it negotiates. */
+    readonly answerer: NetherNetOfferAnswerer;
+    /** The `GET /v1/join` body, read per request. */
+    readonly status: () => string;
+    /** Adds the server's `a=identity` to an answer; the client refuses one without it. */
+    readonly sign: (answer: string) => string | Promise<string>;
+    readonly logger: SignalingLogger;
+    /** How long an offer may wait for its answer. */
+    readonly answerTimeoutMs?: number;
+}
+/**
+ * NetherNet's HTTP signaling, which a client joining by address uses: it probes `GET /v1/join`
+ * on the game port's TCP side, then posts its complete SDP offer to `POST /v1/join/{networkId}`
+ * and reads the complete answer from the response. One request per attempt; trickle ICE is
+ * off, so each side's candidates travel inside its description.
+ *
+ * The offer goes to the same `nethernet` `Server` LAN signaling feeds, so a peer negotiated
+ * here reaches the server through `NetherNetTransport` like any other. HTTP carries no
+ * connection ID, so this picks one for each offer, unused by any live peer.
+ */
+export declare class HttpSignaling {
+    private readonly options;
+    private readonly server;
+    private readonly answerTimeoutMs;
+    constructor(options: HttpSignalingOptions);
+    /**
+     * Listens on TCP.
+     * @param port - The game port; NetherNet signals on its TCP side.
+     * @param host - The address to bind.
+     * @returns The bound port, which differs from `port` when that was 0.
+     */
+    listen(port: number, host: string): Promise<number>;
+    /** Stops listening and drops open requests. */
+    close(): void;
+    private route;
+    private join;
+    /** Hands the offer to the answerer under a fresh connection ID and waits for its answer. */
+    private negotiate;
+}
+//# sourceMappingURL=HttpSignaling.d.ts.map

package/dist/HttpSignaling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpSignaling.d.ts","sources":["../src/HttpSignaling.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,eAAe,EAAc,MAAM,WAAW,CAAC;AAaxD,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACnC,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9G,oEAAoE;IACpE,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAED,kGAAkG;AAClG,MAAM,WAAW,eAAe;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACjC,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC;IAC9B,sFAAsF;IACtF,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,iDAAiD;IACjD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACrC;AAqBD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IAIH,OAAO,CAAC,QAAQ,CAAC,OAAO;IAH3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAoC,OAAO,EAAE,oBAAoB,EAOhE;IAED;;;;;OAKG;IACI,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASzD;IAED,+CAA+C;IACxC,KAAK,IAAI,IAAI,CAGnB;YAEa,KAAK;YAyBL,IAAI;IA0BlB,4FAA4F;IAC5F,OAAO,CAAC,SAAS;CAqCpB"}

package/dist/HttpSignaling.js

@@ -0,0 +1,177 @@
+import { withoutIdentity } from "./sdp.js";
+import { describeCandidates, tracePeerConnection } from "./tracePeerConnection.js";
+import { randomBytes } from "node:crypto";
+import http from "node:http";
+import { SignalStructure, SignalType } from "nethernet";
+// src/HttpSignaling.ts
+/** The largest SDP offer accepted. A real offer with every candidate is a few kilobytes. */
+var MAX_OFFER_BYTES = 65536;
+/** How long an offer may wait for its answer; go-nethernet's handler allows the same. */
+var DEFAULT_ANSWER_TIMEOUT_MS = 15e3;
+/** The largest NetherNet network ID, an unsigned 64-bit integer. */
+var MAX_NETWORK_ID = (1n << 64n) - 1n;
+/** Thrown while reading an offer, carrying the status the request is refused with. */
+var RefusedRequest = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+/** A random unsigned 64-bit integer. */
+var randomUint64 = () => randomBytes(8).readBigUInt64BE();
+/**
+* NetherNet's HTTP signaling, which a client joining by address uses: it probes `GET /v1/join`
+* on the game port's TCP side, then posts its complete SDP offer to `POST /v1/join/{networkId}`
+* and reads the complete answer from the response. One request per attempt; trickle ICE is
+* off, so each side's candidates travel inside its description.
+*
+* The offer goes to the same `nethernet` `Server` LAN signaling feeds, so a peer negotiated
+* here reaches the server through `NetherNetTransport` like any other. HTTP carries no
+* connection ID, so this picks one for each offer, unused by any live peer.
+*/
+var HttpSignaling = class {
+	options;
+	server;
+	answerTimeoutMs;
+	constructor(options) {
+		this.options = options;
+		this.answerTimeoutMs = options.answerTimeoutMs ?? DEFAULT_ANSWER_TIMEOUT_MS;
+		this.server = http.createServer({
+			requestTimeout: 1e4,
+			headersTimeout: 5e3,
+			keepAliveTimeout: 0
+		}, (request, response) => void this.route(request, response));
+	}
+	/**
+	* Listens on TCP.
+	* @param port - The game port; NetherNet signals on its TCP side.
+	* @param host - The address to bind.
+	* @returns The bound port, which differs from `port` when that was 0.
+	*/
+	listen(port, host) {
+		return new Promise((resolve, reject) => {
+			this.server.once("error", reject);
+			this.server.listen(port, host, () => {
+				this.server.off("error", reject);
+				const address = this.server.address();
+				resolve(typeof address === "object" && address !== null ? address.port : port);
+			});
+		});
+	}
+	/** Stops listening and drops open requests. */
+	close() {
+		this.server.close();
+		this.server.closeAllConnections();
+	}
+	async route(request, response) {
+		response.setHeader("Connection", "close");
+		const path = (request.url ?? "").split("?")[0];
+		try {
+			if (request.method === "GET" && path === "/v1/join") {
+				this.options.logger.debug(`NetherNet status asked for by ${remoteOf(request)}`);
+				response.writeHead(200, { "Content-Type": "application/json" }).end(this.options.status());
+				return;
+			}
+			const networkId = /^\/v1\/join\/([^/]*)$/.exec(path ?? "")?.[1];
+			if (request.method === "POST" && networkId !== void 0) {
+				await this.join(networkId, request, response);
+				return;
+			}
+			text(response, 404, "Not Found");
+		} catch (error) {
+			if (error instanceof RefusedRequest) {
+				text(response, error.status, error.message);
+				return;
+			}
+			this.options.logger.error(error);
+			if (!response.headersSent) text(response, 500, "An error occurred while handling this request");
+		}
+	}
+	async join(networkIdText, request, response) {
+		const { logger } = this.options;
+		const networkId = parseNetworkId(networkIdText);
+		const offer = await readOffer(request);
+		const from = `${remoteOf(request)} (network ${networkId})`;
+		logger.info(`NetherNet join from ${from}, offering ${describeCandidates(offer).join(", ") || "no candidates"}`);
+		const started = Date.now();
+		const result = await this.negotiate(networkId, offer);
+		if ("answer" in result) {
+			const answer = await this.options.sign(result.answer);
+			logger.info(`NetherNet join from ${from} answered in ${Date.now() - started} ms as connection ${result.connectionId}, offering ${describeCandidates(answer).join(", ") || "no candidates"}`);
+			response.writeHead(200, { "Content-Type": "application/sdp" }).end(answer);
+			return;
+		}
+		if ("error" in result) {
+			logger.warn(`NetherNet join from ${from} failed with error ${result.error}`);
+			text(response, 500, result.error);
+			return;
+		}
+		logger.warn(`NetherNet join from ${from} timed out waiting for an answer`);
+		text(response, 504, "Timed out waiting for answer");
+	}
+	/** Hands the offer to the answerer under a fresh connection ID and waits for its answer. */
+	negotiate(networkId, offer) {
+		const { answerer } = this.options;
+		let connectionId = randomUint64();
+		while (answerer.connections.has(connectionId)) connectionId = randomUint64();
+		return new Promise((resolve) => {
+			const timeout = setTimeout(() => {
+				answerer.connections.get(connectionId)?.close("Timed out waiting for answer");
+				resolve({ timedOut: true });
+			}, this.answerTimeoutMs);
+			const settle = (result) => {
+				clearTimeout(timeout);
+				resolve(result);
+			};
+			const respond = (signal) => {
+				if (signal.type === SignalType.ConnectResponse) {
+					tracePeerConnection(answerer.connections.get(connectionId)?.rtcConnection, (line) => this.options.logger.info(`NetherNet connection ${connectionId}: ${line}`));
+					settle({
+						answer: signal.data,
+						connectionId
+					});
+				} else if (signal.type === SignalType.ConnectError) settle({ error: signal.data });
+			};
+			const request = new SignalStructure(SignalType.ConnectRequest, connectionId, withoutIdentity(offer), networkId);
+			answerer.handleOffer(request, respond).catch((error) => {
+				this.options.logger.error(error);
+				settle({ error: "An error occurred while answering" });
+			});
+		});
+	}
+};
+/** Who sent the request, as `address:port`. */
+var remoteOf = (request) => `${request.socket.remoteAddress}:${request.socket.remotePort}`;
+/** Ends the response with a plain-text body, as Bedrock Dedicated Server does for its errors. */
+var text = (response, status, body) => {
+	response.writeHead(status, { "Content-Type": "text/plain" }).end(body);
+};
+/**
+* The client's network ID from the path: an unsigned 64-bit integer in decimal.
+* @throws {RefusedRequest} When it is anything else.
+*/
+var parseNetworkId = (text) => {
+	if (!/^\d{1,20}$/.test(text) || BigInt(text) > MAX_NETWORK_ID) throw new RefusedRequest(400, "Expected /v1/join/{networkId}");
+	return BigInt(text);
+};
+/**
+* The request body as text, refused when empty or larger than an offer can be.
+* @throws {RefusedRequest} When the body is empty or too large.
+*/
+var readOffer = async (request) => {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of request) {
+		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+		size += buffer.byteLength;
+		if (size > MAX_OFFER_BYTES) throw new RefusedRequest(413, "SDP offer is too large");
+		chunks.push(buffer);
+	}
+	const offer = Buffer.concat(chunks).toString("utf-8");
+	if (offer.trim() === "") throw new RefusedRequest(400, "Missing SDP offer in request body");
+	return offer;
+};
+export { HttpSignaling };
+
+//# sourceMappingURL=HttpSignaling.js.map

package/dist/HttpSignaling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpSignaling.js","names":[],"sources":["../src/HttpSignaling.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport http from 'node:http';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport type { AddressInfo } from 'node:net';\n\nimport { SignalStructure, SignalType } from 'nethernet';\nimport { withoutIdentity } from './sdp';\nimport { describeCandidates, tracePeerConnection } from './tracePeerConnection';\n\n/** The largest SDP offer accepted. A real offer with every candidate is a few kilobytes. */\nconst MAX_OFFER_BYTES = 64 * 1024;\n\n/** How long an offer may wait for its answer; go-nethernet's handler allows the same. */\nconst DEFAULT_ANSWER_TIMEOUT_MS = 15_000;\n\n/** The largest NetherNet network ID, an unsigned 64-bit integer. */\nconst MAX_NETWORK_ID = (1n << 64n) - 1n;\n\n/** The part of `nethernet`'s `Server` that turns an offer into an answer. */\nexport interface NetherNetOfferAnswerer {\n    /** Every peer by connection ID, which a new offer's ID must not collide with. */\n    readonly connections: ReadonlyMap<bigint, { close(reason?: string): void; readonly rtcConnection?: unknown }>;\n    /** Negotiates a peer for the offer, answering through `respond`. */\n    handleOffer(signal: SignalStructure, respond: (signal: SignalStructure) => void): Promise<void>;\n}\n\n/** Where the signaling server reports what went wrong. `@jsprismarine/logger`'s `Logger` fits. */\nexport interface SignalingLogger {\n    debug(message: string): void;\n    info(message: string): void;\n    warn(message: string): void;\n    error(error: unknown): void;\n}\n\n/** What the signaling server needs besides the answerer. */\nexport interface HttpSignalingOptions {\n    /** Turns an offer into an answer and keeps the peer it negotiates. */\n    readonly answerer: NetherNetOfferAnswerer;\n    /** The `GET /v1/join` body, read per request. */\n    readonly status: () => string;\n    /** Adds the server's `a=identity` to an answer; the client refuses one without it. */\n    readonly sign: (answer: string) => string | Promise<string>;\n    readonly logger: SignalingLogger;\n    /** How long an offer may wait for its answer. */\n    readonly answerTimeoutMs?: number;\n}\n\n/** How a negotiation ended. */\ntype Negotiation =\n    | { readonly answer: string; readonly connectionId: bigint }\n    | { readonly error: string }\n    | { readonly timedOut: true };\n\n/** Thrown while reading an offer, carrying the status the request is refused with. */\nclass RefusedRequest extends Error {\n    public constructor(\n        public readonly status: number,\n        message: string\n    ) {\n        super(message);\n    }\n}\n\n/** A random unsigned 64-bit integer. */\nconst randomUint64 = (): bigint => randomBytes(8).readBigUInt64BE();\n\n/**\n * NetherNet's HTTP signaling, which a client joining by address uses: it probes `GET /v1/join`\n * on the game port's TCP side, then posts its complete SDP offer to `POST /v1/join/{networkId}`\n * and reads the complete answer from the response. One request per attempt; trickle ICE is\n * off, so each side's candidates travel inside its description.\n *\n * The offer goes to the same `nethernet` `Server` LAN signaling feeds, so a peer negotiated\n * here reaches the server through `NetherNetTransport` like any other. HTTP carries no\n * connection ID, so this picks one for each offer, unused by any live peer.\n */\nexport class HttpSignaling {\n    private readonly server: http.Server;\n    private readonly answerTimeoutMs: number;\n\n    public constructor(private readonly options: HttpSignalingOptions) {\n        this.answerTimeoutMs = options.answerTimeoutMs ?? DEFAULT_ANSWER_TIMEOUT_MS;\n        this.server = http.createServer(\n            // A client sends one request per attempt, so a connection that lingers is not a client.\n            { requestTimeout: 10_000, headersTimeout: 5_000, keepAliveTimeout: 0 },\n            (request, response) => void this.route(request, response)\n        );\n    }\n\n    /**\n     * Listens on TCP.\n     * @param port - The game port; NetherNet signals on its TCP side.\n     * @param host - The address to bind.\n     * @returns The bound port, which differs from `port` when that was 0.\n     */\n    public listen(port: number, host: string): Promise<number> {\n        return new Promise((resolve, reject) => {\n            this.server.once('error', reject);\n            this.server.listen(port, host, () => {\n                this.server.off('error', reject);\n                const address: AddressInfo | string | null = this.server.address();\n                resolve(typeof address === 'object' && address !== null ? address.port : port);\n            });\n        });\n    }\n\n    /** Stops listening and drops open requests. */\n    public close(): void {\n        this.server.close();\n        this.server.closeAllConnections();\n    }\n\n    private async route(request: IncomingMessage, response: ServerResponse): Promise<void> {\n        response.setHeader('Connection', 'close');\n        const path = (request.url ?? '').split('?')[0];\n        try {\n            if (request.method === 'GET' && path === '/v1/join') {\n                this.options.logger.debug(`NetherNet status asked for by ${remoteOf(request)}`);\n                response.writeHead(200, { 'Content-Type': 'application/json' }).end(this.options.status());\n                return;\n            }\n            const networkId = /^\\/v1\\/join\\/([^/]*)$/.exec(path ?? '')?.[1];\n            if (request.method === 'POST' && networkId !== undefined) {\n                await this.join(networkId, request, response);\n                return;\n            }\n            text(response, 404, 'Not Found');\n        } catch (error: unknown) {\n            if (error instanceof RefusedRequest) {\n                text(response, error.status, error.message);\n                return;\n            }\n            this.options.logger.error(error);\n            if (!response.headersSent) text(response, 500, 'An error occurred while handling this request');\n        }\n    }\n\n    private async join(networkIdText: string, request: IncomingMessage, response: ServerResponse): Promise<void> {\n        const { logger } = this.options;\n        const networkId = parseNetworkId(networkIdText);\n        const offer = await readOffer(request);\n        const from = `${remoteOf(request)} (network ${networkId})`;\n        logger.info(`NetherNet join from ${from}, offering ${describeCandidates(offer).join(', ') || 'no candidates'}`);\n\n        const started = Date.now();\n        const result = await this.negotiate(networkId, offer);\n        if ('answer' in result) {\n            const answer = await this.options.sign(result.answer);\n            logger.info(\n                `NetherNet join from ${from} answered in ${Date.now() - started} ms as connection ${result.connectionId}, offering ${describeCandidates(answer).join(', ') || 'no candidates'}`\n            );\n            response.writeHead(200, { 'Content-Type': 'application/sdp' }).end(answer);\n            return;\n        }\n        if ('error' in result) {\n            logger.warn(`NetherNet join from ${from} failed with error ${result.error}`);\n            text(response, 500, result.error);\n            return;\n        }\n        logger.warn(`NetherNet join from ${from} timed out waiting for an answer`);\n        text(response, 504, 'Timed out waiting for answer');\n    }\n\n    /** Hands the offer to the answerer under a fresh connection ID and waits for its answer. */\n    private negotiate(networkId: bigint, offer: string): Promise<Negotiation> {\n        const { answerer } = this.options;\n        let connectionId = randomUint64();\n        while (answerer.connections.has(connectionId)) connectionId = randomUint64();\n\n        return new Promise((resolve) => {\n            const timeout = setTimeout(() => {\n                answerer.connections.get(connectionId)?.close('Timed out waiting for answer');\n                resolve({ timedOut: true });\n            }, this.answerTimeoutMs);\n            const settle = (result: Negotiation) => {\n                clearTimeout(timeout);\n                resolve(result);\n            };\n\n            // The answer already lists every candidate, so later CANDIDATEADD signals are dropped.\n            const respond = (signal: SignalStructure) => {\n                if (signal.type === SignalType.ConnectResponse) {\n                    // From here the join is WebRTC's: report each state change until it settles.\n                    tracePeerConnection(answerer.connections.get(connectionId)?.rtcConnection, (line) =>\n                        this.options.logger.info(`NetherNet connection ${connectionId}: ${line}`)\n                    );\n                    settle({ answer: signal.data, connectionId });\n                } else if (signal.type === SignalType.ConnectError) settle({ error: signal.data });\n            };\n            const request = new SignalStructure(\n                SignalType.ConnectRequest,\n                connectionId,\n                withoutIdentity(offer),\n                networkId\n            );\n            answerer.handleOffer(request, respond).catch((error: unknown) => {\n                this.options.logger.error(error);\n                settle({ error: 'An error occurred while answering' });\n            });\n        });\n    }\n}\n\n/** Who sent the request, as `address:port`. */\nconst remoteOf = (request: IncomingMessage): string => `${request.socket.remoteAddress}:${request.socket.remotePort}`;\n\n/** Ends the response with a plain-text body, as Bedrock Dedicated Server does for its errors. */\nconst text = (response: ServerResponse, status: number, body: string): void => {\n    response.writeHead(status, { 'Content-Type': 'text/plain' }).end(body);\n};\n\n/**\n * The client's network ID from the path: an unsigned 64-bit integer in decimal.\n * @throws {RefusedRequest} When it is anything else.\n */\nconst parseNetworkId = (text: string): bigint => {\n    if (!/^\\d{1,20}$/.test(text) || BigInt(text) > MAX_NETWORK_ID) {\n        throw new RefusedRequest(400, 'Expected /v1/join/{networkId}');\n    }\n    return BigInt(text);\n};\n\n/**\n * The request body as text, refused when empty or larger than an offer can be.\n * @throws {RefusedRequest} When the body is empty or too large.\n */\nconst readOffer = async (request: IncomingMessage): Promise<string> => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    for await (const chunk of request) {\n        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));\n        size += buffer.byteLength;\n        if (size > MAX_OFFER_BYTES) throw new RefusedRequest(413, 'SDP offer is too large');\n        chunks.push(buffer);\n    }\n    const offer = Buffer.concat(chunks).toString('utf-8');\n    if (offer.trim() === '') throw new RefusedRequest(400, 'Missing SDP offer in request body');\n    return offer;\n};\n"],"mappings":";;;;;;;AAUA,IAAM,kBAAkB;;AAGxB,IAAM,4BAA4B;;AAGlC,IAAM,kBAAkB,MAAM,OAAO;;AAsCrC,IAAM,iBAAN,cAA6B,MAAM;CAEX;CADpB,YACI,QACA,SACF;EACE,MAAM,OAAO;EAHG,KAAA,SAAA;CAIpB;AACJ;;AAGA,IAAM,qBAA6B,YAAY,CAAC,CAAC,CAAC,gBAAgB;;;;;;;;;;;AAYlE,IAAa,gBAAb,MAA2B;CAIa;CAHpC;CACA;CAEA,YAAmB,SAAgD;EAA/B,KAAA,UAAA;EAChC,KAAK,kBAAkB,QAAQ,mBAAmB;EAClD,KAAK,SAAS,KAAK,aAEf;GAAE,gBAAgB;GAAQ,gBAAgB;GAAO,kBAAkB;EAAE,IACpE,SAAS,aAAa,KAAK,KAAK,MAAM,SAAS,QAAQ,CAC5D;CACJ;;;;;;;CAQA,OAAc,MAAc,MAA+B;EACvD,OAAO,IAAI,SAAS,SAAS,WAAW;GACpC,KAAK,OAAO,KAAK,SAAS,MAAM;GAChC,KAAK,OAAO,OAAO,MAAM,YAAY;IACjC,KAAK,OAAO,IAAI,SAAS,MAAM;IAC/B,MAAM,UAAuC,KAAK,OAAO,QAAQ;IACjE,QAAQ,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO,IAAI;GACjF,CAAC;EACL,CAAC;CACL;;CAGA,QAAqB;EACjB,KAAK,OAAO,MAAM;EAClB,KAAK,OAAO,oBAAoB;CACpC;CAEA,MAAc,MAAM,SAA0B,UAAyC;EACnF,SAAS,UAAU,cAAc,OAAO;EACxC,MAAM,QAAQ,QAAQ,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC;EAC5C,IAAI;GACA,IAAI,QAAQ,WAAW,SAAS,SAAS,YAAY;IACjD,KAAK,QAAQ,OAAO,MAAM,iCAAiC,SAAS,OAAO,GAAG;IAC9E,SAAS,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,OAAO,CAAC;IACzF;GACJ;GACA,MAAM,YAAY,wBAAwB,KAAK,QAAQ,EAAE,CAAC,GAAG;GAC7D,IAAI,QAAQ,WAAW,UAAU,cAAc,KAAA,GAAW;IACtD,MAAM,KAAK,KAAK,WAAW,SAAS,QAAQ;IAC5C;GACJ;GACA,KAAK,UAAU,KAAK,WAAW;EACnC,SAAS,OAAgB;GACrB,IAAI,iBAAiB,gBAAgB;IACjC,KAAK,UAAU,MAAM,QAAQ,MAAM,OAAO;IAC1C;GACJ;GACA,KAAK,QAAQ,OAAO,MAAM,KAAK;GAC/B,IAAI,CAAC,SAAS,aAAa,KAAK,UAAU,KAAK,+CAA+C;EAClG;CACJ;CAEA,MAAc,KAAK,eAAuB,SAA0B,UAAyC;EACzG,MAAM,EAAE,WAAW,KAAK;EACxB,MAAM,YAAY,eAAe,aAAa;EAC9C,MAAM,QAAQ,MAAM,UAAU,OAAO;EACrC,MAAM,OAAO,GAAG,SAAS,OAAO,EAAE,YAAY,UAAU;EACxD,OAAO,KAAK,uBAAuB,KAAK,aAAa,mBAAmB,KAAK,CAAC,CAAC,KAAK,IAAI,KAAK,iBAAiB;EAE9G,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,SAAS,MAAM,KAAK,UAAU,WAAW,KAAK;EACpD,IAAI,YAAY,QAAQ;GACpB,MAAM,SAAS,MAAM,KAAK,QAAQ,KAAK,OAAO,MAAM;GACpD,OAAO,KACH,uBAAuB,KAAK,eAAe,KAAK,IAAI,IAAI,QAAQ,oBAAoB,OAAO,aAAa,aAAa,mBAAmB,MAAM,CAAC,CAAC,KAAK,IAAI,KAAK,iBAClK;GACA,SAAS,UAAU,KAAK,EAAE,gBAAgB,kBAAkB,CAAC,CAAC,CAAC,IAAI,MAAM;GACzE;EACJ;EACA,IAAI,WAAW,QAAQ;GACnB,OAAO,KAAK,uBAAuB,KAAK,qBAAqB,OAAO,OAAO;GAC3E,KAAK,UAAU,KAAK,OAAO,KAAK;GAChC;EACJ;EACA,OAAO,KAAK,uBAAuB,KAAK,iCAAiC;EACzE,KAAK,UAAU,KAAK,8BAA8B;CACtD;;CAGA,UAAkB,WAAmB,OAAqC;EACtE,MAAM,EAAE,aAAa,KAAK;EAC1B,IAAI,eAAe,aAAa;EAChC,OAAO,SAAS,YAAY,IAAI,YAAY,GAAG,eAAe,aAAa;EAE3E,OAAO,IAAI,SAAS,YAAY;GAC5B,MAAM,UAAU,iBAAiB;IAC7B,SAAS,YAAY,IAAI,YAAY,CAAC,EAAE,MAAM,8BAA8B;IAC5E,QAAQ,EAAE,UAAU,KAAK,CAAC;GAC9B,GAAG,KAAK,eAAe;GACvB,MAAM,UAAU,WAAwB;IACpC,aAAa,OAAO;IACpB,QAAQ,MAAM;GAClB;GAGA,MAAM,WAAW,WAA4B;IACzC,IAAI,OAAO,SAAS,WAAW,iBAAiB;KAE5C,oBAAoB,SAAS,YAAY,IAAI,YAAY,CAAC,EAAE,gBAAgB,SACxE,KAAK,QAAQ,OAAO,KAAK,wBAAwB,aAAa,IAAI,MAAM,CAC5E;KACA,OAAO;MAAE,QAAQ,OAAO;MAAM;KAAa,CAAC;IAChD,OAAO,IAAI,OAAO,SAAS,WAAW,cAAc,OAAO,EAAE,OAAO,OAAO,KAAK,CAAC;GACrF;GACA,MAAM,UAAU,IAAI,gBAChB,WAAW,gBACX,cACA,gBAAgB,KAAK,GACrB,SACJ;GACA,SAAS,YAAY,SAAS,OAAO,CAAC,CAAC,OAAO,UAAmB;IAC7D,KAAK,QAAQ,OAAO,MAAM,KAAK;IAC/B,OAAO,EAAE,OAAO,oCAAoC,CAAC;GACzD,CAAC;EACL,CAAC;CACL;AACJ;;AAGA,IAAM,YAAY,YAAqC,GAAG,QAAQ,OAAO,cAAc,GAAG,QAAQ,OAAO;;AAGzG,IAAM,QAAQ,UAA0B,QAAgB,SAAuB;CAC3E,SAAS,UAAU,QAAQ,EAAE,gBAAgB,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI;AACzE;;;;;AAMA,IAAM,kBAAkB,SAAyB;CAC7C,IAAI,CAAC,aAAa,KAAK,IAAI,KAAK,OAAO,IAAI,IAAI,gBAC3C,MAAM,IAAI,eAAe,KAAK,+BAA+B;CAEjE,OAAO,OAAO,IAAI;AACtB;;;;;AAMA,IAAM,YAAY,OAAO,YAA8C;CACnE,MAAM,SAAmB,CAAC;CAC1B,IAAI,OAAO;CACX,WAAW,MAAM,SAAS,SAAS;EAC/B,MAAM,SAAS,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,OAAO,KAAK,CAAC;EACzE,QAAQ,OAAO;EACf,IAAI,OAAO,iBAAiB,MAAM,IAAI,eAAe,KAAK,wBAAwB;EAClF,OAAO,KAAK,MAAM;CACtB;CACA,MAAM,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC,SAAS,OAAO;CACpD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,IAAI,eAAe,KAAK,mCAAmC;CAC1F,OAAO;AACX"}

package/dist/LanAdvertisement.d.ts

@@ -0,0 +1,36 @@
+import type { NetherNetStatus } from './NetherNetStatus';
+/** The advertisement layout Bedrock Dedicated Server 1.26.51 answers LAN discovery with. */
+export declare const LAN_ADVERTISEMENT_VERSION = 7;
+/**
+ * What a server tells a client looking for games on the local network, in the answer to a
+ * NetherNet discovery request on UDP 7551. The client lists it among its LAN games.
+ */
+export interface LanAdvertisement extends NetherNetStatus {
+    readonly editorWorld: boolean;
+    readonly hardcore: boolean;
+    /** Whether a client signed in to Xbox Live may join. */
+    readonly acceptsOnlineAuth: boolean;
+    /** Whether a client that signs its own login may join, which an online-mode server refuses. */
+    readonly acceptsSelfSignedAuth: boolean;
+    /** A random token per server start; Bedrock Dedicated Server sends 64 random bits in hex. */
+    readonly nonce: string;
+    readonly connectionType: number;
+}
+/**
+ * The advertisement for a server.
+ * @param status - What every NetherNet client is told about the server.
+ * @param onlineMode - Whether the server requires Xbox Live sign-in.
+ * @param nonce - This server start's token.
+ */
+export declare const lanAdvertisementOf: (status: NetherNetStatus, onlineMode: boolean, nonce: string) => LanAdvertisement;
+/**
+ * Encodes the advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}: a version byte, then
+ * varint-prefixed strings, zigzag varints and booleans in a fixed order.
+ */
+export declare const encodeLanAdvertisement: (advertisement: LanAdvertisement) => Buffer;
+/**
+ * Decodes an advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}.
+ * @throws {Error} When the buffer carries another layout version or ends early.
+ */
+export declare const decodeLanAdvertisement: (buffer: Buffer) => LanAdvertisement;
+//# sourceMappingURL=LanAdvertisement.d.ts.map

package/dist/LanAdvertisement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanAdvertisement.d.ts","sources":["../src/LanAdvertisement.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAK3C;;;GAGG;AACH,MAAM,WAAW,gBAAiB,SAAQ,eAAe;IACrD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,+FAA+F;IAC/F,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACnC;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,eAAe,cAAc,OAAO,SAAS,MAAM,KAAG,gBAQ/F,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,sBAAsB,kBAAmB,gBAAgB,KAAG,MAiBxE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,WAAY,MAAM,KAAG,gBAqBvD,CAAC"}

package/dist/LanAdvertisement.js

@@ -0,0 +1,70 @@
+import BinaryStream from "@jsprismarine/binaryutils";
+// src/LanAdvertisement.ts
+/** The advertisement layout Bedrock Dedicated Server 1.26.51 answers LAN discovery with. */
+var LAN_ADVERTISEMENT_VERSION = 7;
+/** The connection type Bedrock Dedicated Server 1.26.51 advertises on the LAN. Its meaning is not documented. */
+var LAN_CONNECTION_TYPE = 4;
+/**
+* The advertisement for a server.
+* @param status - What every NetherNet client is told about the server.
+* @param onlineMode - Whether the server requires Xbox Live sign-in.
+* @param nonce - This server start's token.
+*/
+var lanAdvertisementOf = (status, onlineMode, nonce) => ({
+	...status,
+	editorWorld: false,
+	hardcore: false,
+	acceptsOnlineAuth: true,
+	acceptsSelfSignedAuth: !onlineMode,
+	nonce,
+	connectionType: LAN_CONNECTION_TYPE
+});
+/**
+* Encodes the advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}: a version byte, then
+* varint-prefixed strings, zigzag varints and booleans in a fixed order.
+*/
+var encodeLanAdvertisement = (advertisement) => {
+	const stream = new BinaryStream();
+	stream.writeByte(7);
+	stream.writeVarString(advertisement.motd);
+	stream.writeVarInt(advertisement.protocol);
+	stream.writeVarString(advertisement.version);
+	stream.writeVarString(advertisement.levelName);
+	stream.writeVarInt(advertisement.playerCount);
+	stream.writeVarInt(advertisement.maxPlayers);
+	stream.writeVarInt(advertisement.gameType);
+	stream.writeBoolean(advertisement.editorWorld);
+	stream.writeBoolean(advertisement.hardcore);
+	stream.writeBoolean(advertisement.acceptsOnlineAuth);
+	stream.writeBoolean(advertisement.acceptsSelfSignedAuth);
+	stream.writeVarString(advertisement.nonce);
+	stream.writeVarInt(advertisement.connectionType);
+	return stream.getBuffer();
+};
+/**
+* Decodes an advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}.
+* @throws {Error} When the buffer carries another layout version or ends early.
+*/
+var decodeLanAdvertisement = (buffer) => {
+	const stream = new BinaryStream(buffer);
+	const version = stream.readByte();
+	if (version !== 7) throw new Error(`Unsupported LAN advertisement version ${version}`);
+	return {
+		motd: stream.readVarString(),
+		protocol: stream.readVarInt(),
+		version: stream.readVarString(),
+		levelName: stream.readVarString(),
+		playerCount: stream.readVarInt(),
+		maxPlayers: stream.readVarInt(),
+		gameType: stream.readVarInt(),
+		editorWorld: stream.readBoolean(),
+		hardcore: stream.readBoolean(),
+		acceptsOnlineAuth: stream.readBoolean(),
+		acceptsSelfSignedAuth: stream.readBoolean(),
+		nonce: stream.readVarString(),
+		connectionType: stream.readVarInt()
+	};
+};
+export { LAN_ADVERTISEMENT_VERSION, decodeLanAdvertisement, encodeLanAdvertisement, lanAdvertisementOf };
+
+//# sourceMappingURL=LanAdvertisement.js.map

package/dist/LanAdvertisement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LanAdvertisement.js","names":[],"sources":["../src/LanAdvertisement.ts"],"sourcesContent":["import BinaryStream from '@jsprismarine/binaryutils';\nimport type { NetherNetStatus } from './NetherNetStatus';\n\n/** The advertisement layout Bedrock Dedicated Server 1.26.51 answers LAN discovery with. */\nexport const LAN_ADVERTISEMENT_VERSION = 7;\n\n/** The connection type Bedrock Dedicated Server 1.26.51 advertises on the LAN. Its meaning is not documented. */\nconst LAN_CONNECTION_TYPE = 4;\n\n/**\n * What a server tells a client looking for games on the local network, in the answer to a\n * NetherNet discovery request on UDP 7551. The client lists it among its LAN games.\n */\nexport interface LanAdvertisement extends NetherNetStatus {\n    readonly editorWorld: boolean;\n    readonly hardcore: boolean;\n    /** Whether a client signed in to Xbox Live may join. */\n    readonly acceptsOnlineAuth: boolean;\n    /** Whether a client that signs its own login may join, which an online-mode server refuses. */\n    readonly acceptsSelfSignedAuth: boolean;\n    /** A random token per server start; Bedrock Dedicated Server sends 64 random bits in hex. */\n    readonly nonce: string;\n    readonly connectionType: number;\n}\n\n/**\n * The advertisement for a server.\n * @param status - What every NetherNet client is told about the server.\n * @param onlineMode - Whether the server requires Xbox Live sign-in.\n * @param nonce - This server start's token.\n */\nexport const lanAdvertisementOf = (status: NetherNetStatus, onlineMode: boolean, nonce: string): LanAdvertisement => ({\n    ...status,\n    editorWorld: false,\n    hardcore: false,\n    acceptsOnlineAuth: true,\n    acceptsSelfSignedAuth: !onlineMode,\n    nonce,\n    connectionType: LAN_CONNECTION_TYPE\n});\n\n/**\n * Encodes the advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}: a version byte, then\n * varint-prefixed strings, zigzag varints and booleans in a fixed order.\n */\nexport const encodeLanAdvertisement = (advertisement: LanAdvertisement): Buffer => {\n    const stream = new BinaryStream();\n    stream.writeByte(LAN_ADVERTISEMENT_VERSION);\n    stream.writeVarString(advertisement.motd);\n    stream.writeVarInt(advertisement.protocol);\n    stream.writeVarString(advertisement.version);\n    stream.writeVarString(advertisement.levelName);\n    stream.writeVarInt(advertisement.playerCount);\n    stream.writeVarInt(advertisement.maxPlayers);\n    stream.writeVarInt(advertisement.gameType);\n    stream.writeBoolean(advertisement.editorWorld);\n    stream.writeBoolean(advertisement.hardcore);\n    stream.writeBoolean(advertisement.acceptsOnlineAuth);\n    stream.writeBoolean(advertisement.acceptsSelfSignedAuth);\n    stream.writeVarString(advertisement.nonce);\n    stream.writeVarInt(advertisement.connectionType);\n    return stream.getBuffer();\n};\n\n/**\n * Decodes an advertisement in layout {@link LAN_ADVERTISEMENT_VERSION}.\n * @throws {Error} When the buffer carries another layout version or ends early.\n */\nexport const decodeLanAdvertisement = (buffer: Buffer): LanAdvertisement => {\n    const stream = new BinaryStream(buffer);\n    const version = stream.readByte();\n    if (version !== LAN_ADVERTISEMENT_VERSION) {\n        throw new Error(`Unsupported LAN advertisement version ${version}`);\n    }\n    return {\n        motd: stream.readVarString(),\n        protocol: stream.readVarInt(),\n        version: stream.readVarString(),\n        levelName: stream.readVarString(),\n        playerCount: stream.readVarInt(),\n        maxPlayers: stream.readVarInt(),\n        gameType: stream.readVarInt(),\n        editorWorld: stream.readBoolean(),\n        hardcore: stream.readBoolean(),\n        acceptsOnlineAuth: stream.readBoolean(),\n        acceptsSelfSignedAuth: stream.readBoolean(),\n        nonce: stream.readVarString(),\n        connectionType: stream.readVarInt()\n    };\n};\n"],"mappings":";;;AAIA,IAAa,4BAA4B;;AAGzC,IAAM,sBAAsB;;;;;;;AAwB5B,IAAa,sBAAsB,QAAyB,YAAqB,WAAqC;CAClH,GAAG;CACH,aAAa;CACb,UAAU;CACV,mBAAmB;CACnB,uBAAuB,CAAC;CACxB;CACA,gBAAgB;AACpB;;;;;AAMA,IAAa,0BAA0B,kBAA4C;CAC/E,MAAM,SAAS,IAAI,aAAa;CAChC,OAAO,UAAA,CAAmC;CAC1C,OAAO,eAAe,cAAc,IAAI;CACxC,OAAO,YAAY,cAAc,QAAQ;CACzC,OAAO,eAAe,cAAc,OAAO;CAC3C,OAAO,eAAe,cAAc,SAAS;CAC7C,OAAO,YAAY,cAAc,WAAW;CAC5C,OAAO,YAAY,cAAc,UAAU;CAC3C,OAAO,YAAY,cAAc,QAAQ;CACzC,OAAO,aAAa,cAAc,WAAW;CAC7C,OAAO,aAAa,cAAc,QAAQ;CAC1C,OAAO,aAAa,cAAc,iBAAiB;CACnD,OAAO,aAAa,cAAc,qBAAqB;CACvD,OAAO,eAAe,cAAc,KAAK;CACzC,OAAO,YAAY,cAAc,cAAc;CAC/C,OAAO,OAAO,UAAU;AAC5B;;;;;AAMA,IAAa,0BAA0B,WAAqC;CACxE,MAAM,SAAS,IAAI,aAAa,MAAM;CACtC,MAAM,UAAU,OAAO,SAAS;CAChC,IAAI,YAAA,GACA,MAAM,IAAI,MAAM,yCAAyC,SAAS;CAEtE,OAAO;EACH,MAAM,OAAO,cAAc;EAC3B,UAAU,OAAO,WAAW;EAC5B,SAAS,OAAO,cAAc;EAC9B,WAAW,OAAO,cAAc;EAChC,aAAa,OAAO,WAAW;EAC/B,YAAY,OAAO,WAAW;EAC9B,UAAU,OAAO,WAAW;EAC5B,aAAa,OAAO,YAAY;EAChC,UAAU,OAAO,YAAY;EAC7B,mBAAmB,OAAO,YAAY;EACtC,uBAAuB,OAAO,YAAY;EAC1C,OAAO,OAAO,cAAc;EAC5B,gBAAgB,OAAO,WAAW;CACtC;AACJ"}

package/dist/NetherNetDefaults.d.ts

@@ -0,0 +1,3 @@
+/** The UDP port NetherNet LAN discovery and signaling use. The protocol fixes it; npm `nethernet` binds it. */
+export declare const NETHERNET_LAN_PORT = 7551;
+//# sourceMappingURL=NetherNetDefaults.d.ts.map

package/dist/NetherNetDefaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetDefaults.d.ts","sources":["../src/NetherNetDefaults.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,eAAO,MAAM,kBAAkB,OAAO,CAAC"}

package/dist/NetherNetDefaults.js

@@ -0,0 +1,6 @@
+// src/NetherNetDefaults.ts
+/** The UDP port NetherNet LAN discovery and signaling use. The protocol fixes it; npm `nethernet` binds it. */
+var NETHERNET_LAN_PORT = 7551;
+export { NETHERNET_LAN_PORT };
+
+//# sourceMappingURL=NetherNetDefaults.js.map

package/dist/NetherNetDefaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetDefaults.js","names":[],"sources":["../src/NetherNetDefaults.ts"],"sourcesContent":["/** The UDP port NetherNet LAN discovery and signaling use. The protocol fixes it; npm `nethernet` binds it. */\nexport const NETHERNET_LAN_PORT = 7551;\n"],"mappings":";;AACA,IAAa,qBAAqB"}

package/dist/NetherNetIdentity.d.ts

@@ -0,0 +1,88 @@
+import type { KeyObject } from 'node:crypto';
+import type { SdpFingerprint } from './sdp';
+/**
+ * The fingerprints as canonical JSON: keys in code point order, no whitespace. The client
+ * rebuilds these exact bytes from the answer's `a=fingerprint` lines to check the signature.
+ * @param fingerprints - The answer's fingerprints, in SDP order.
+ */
+export declare const canonicalFingerprints: (fingerprints: readonly SdpFingerprint[]) => string;
+/** How an identity writes its public key into the token's `cpk` claim. */
+export type IdentityKeyFormat = 
+/** A JSON Web Key, as servers since 26.40 write it. */
+'jwk'
+/** Base64 DER, as clients write it, the form the Login packet's keys take. */
+ | 'der';
+/** How a {@link NetherNetIdentity} presents itself. */
+export interface NetherNetIdentityOptions {
+    /** Shown to players on first use over plain HTTP. Bedrock Dedicated Server says `self`. */
+    readonly domain?: string;
+    /** How the token carries the public key; a server's is a JWK, a client's base64 DER. */
+    readonly keyFormat?: IdentityKeyFormat;
+    /** The clock, in milliseconds since the epoch. */
+    readonly now?: () => number;
+    /**
+     * A token an authority issued for this key, used instead of a self-signed one: a signed-in
+     * client's multiplayer token from Minecraft's authorization service, whose `cpk` claim names
+     * this key. The fingerprints are still signed with the key here.
+     */
+    readonly token?: string;
+}
+/**
+ * A NetherNet identity: a P-384 key whose public half a session description carries, signed, in
+ * `a=identity`. A client refuses an answer without one, and Bedrock Dedicated Server refuses an
+ * offer without one.
+ *
+ * A server's key must survive restarts: over plain HTTP the client remembers it the first time
+ * and asks the player about any other. {@link NetherNetIdentity.loadOrCreate} keeps it in a file.
+ */
+export declare class NetherNetIdentity {
+    private readonly privateKey;
+    private readonly x5u;
+    private readonly cpk;
+    private readonly domain;
+    private readonly now;
+    private readonly issuedToken;
+    /**
+     * @param privateKey - A P-384 private key.
+     * @param options - How the identity presents itself; a server's by default.
+     */
+    constructor(privateKey: KeyObject, options?: NetherNetIdentityOptions);
+    /**
+     * A fresh client identity, for one connection.
+     * @param domain - The identity provider's domain, as the client names it.
+     */
+    static client(domain?: string): NetherNetIdentity;
+    /**
+     * Reads the key from `file`, or makes one and writes it there, readable by its owner only.
+     * @param file - Where the PKCS #8 PEM key lives.
+     */
+    static loadOrCreate(file: string): NetherNetIdentity;
+    /**
+     * The description with `a=identity` added: a self-signed token carrying the public key as
+     * `cpk`, and a detached signature over the description's DTLS fingerprints, which binds the key
+     * to the certificate WebRTC will present.
+     * @param description - The SDP offer or answer, with its `a=fingerprint` lines.
+     * @throws {Error} When the description has no fingerprint to sign.
+     */
+    sign(description: string): Promise<string>;
+}
+/** What {@link verifySelfSignedIdentity} found in a description it accepted. */
+export interface VerifiedIdentity {
+    /** The identity's public key, from the token's `cpk` claim. */
+    readonly publicKey: KeyObject;
+    /** The domain the identity names, which a player may be shown. */
+    readonly domain: string;
+    /** The description without `a=identity`, ready for WebRTC. */
+    readonly description: string;
+}
+/**
+ * Checks a self-signed `a=identity` the way a NetherNet client checks a server's: the token is
+ * signed by the key in its own `cpk` claim and not expired, and the detached signature covers this
+ * description's fingerprints. Offline clients sign their offers the same way; an online client's
+ * token is signed by the authorization service instead, which this does not check.
+ * @param description - The SDP description carrying `a=identity`.
+ * @param nowMs - The clock, in milliseconds since the epoch.
+ * @throws {Error} When the identity is missing, malformed, expired or does not verify.
+ */
+export declare const verifySelfSignedIdentity: (description: string, nowMs?: number) => Promise<VerifiedIdentity>;
+//# sourceMappingURL=NetherNetIdentity.d.ts.map

package/dist/NetherNetIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetIdentity.d.ts","sources":["../src/NetherNetIdentity.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAM7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAK5C;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,iBAAkB,SAAS,cAAc,EAAE,KAAG,MAG1E,CAAC;AAEP,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB;AACzB,uDAAuD;AACrD,KAAK;AACP,8EAA8E;GAC5E,KAAK,CAAC;AAEZ,uDAAuD;AACvD,MAAM,WAAW,wBAAwB;IACrC,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAYtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAX/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAkB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IAEjD;;;OAGG;IACH,YACqB,UAAU,EAAE,SAAS,EACtC,OAAO,GAAE,wBAA6B,EAWzC;IAED;;;OAGG;IACH,OAAc,MAAM,CAAC,MAAM,SAAS,GAAG,iBAAiB,CAGvD;IAED;;;OAGG;IACH,OAAc,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAM1D;IAED;;;;;;OAMG;IACU,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBtD;CACJ;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC7B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAChC;AAeD;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,gBAAuB,MAAM,qBAAuB,OAAO,CAAC,gBAAgB,CAsChH,CAAC"}