@jsprismarine/nethernet 0.0.0 → 0.20.0

package/dist/NetherNetIdentity.js

@@ -0,0 +1,164 @@
+import { BEDROCK_CURVE, compactEs384, detachedEs384, verifiesDetachedEs384 } from "./es384.js";
+import { isRecord } from "./isRecord.js";
+import { sdpFingerprints, withSessionAttribute, withoutIdentity } from "./sdp.js";
+import { compactVerify, decodeJwt } from "jose";
+import { createPrivateKey, createPublicKey, generateKeyPairSync } from "node:crypto";
+import fs from "node:fs";
+// src/NetherNetIdentity.ts
+/** How long a signed identity token is valid; go-nethernet and Bedrock Dedicated Server use a minute. */
+var TOKEN_LIFETIME_SECONDS = 60;
+/**
+* The fingerprints as canonical JSON: keys in code point order, no whitespace. The client
+* rebuilds these exact bytes from the answer's `a=fingerprint` lines to check the signature.
+* @param fingerprints - The answer's fingerprints, in SDP order.
+*/
+var canonicalFingerprints = (fingerprints) => JSON.stringify({ fingerprint: fingerprints.map(({ algorithm, digest }) => ({
+	algorithm,
+	digest
+})) });
+/**
+* A NetherNet identity: a P-384 key whose public half a session description carries, signed, in
+* `a=identity`. A client refuses an answer without one, and Bedrock Dedicated Server refuses an
+* offer without one.
+*
+* A server's key must survive restarts: over plain HTTP the client remembers it the first time
+* and asks the player about any other. {@link NetherNetIdentity.loadOrCreate} keeps it in a file.
+*/
+var NetherNetIdentity = class NetherNetIdentity {
+	privateKey;
+	x5u;
+	cpk;
+	domain;
+	now;
+	issuedToken;
+	/**
+	* @param privateKey - A P-384 private key.
+	* @param options - How the identity presents itself; a server's by default.
+	*/
+	constructor(privateKey, options = {}) {
+		this.privateKey = privateKey;
+		const publicKey = createPublicKey(privateKey);
+		if (publicKey.asymmetricKeyDetails?.namedCurve !== "secp384r1") throw new Error(`A NetherNet identity key must be ${BEDROCK_CURVE}`);
+		this.x5u = publicKey.export({
+			type: "spki",
+			format: "der"
+		}).toString("base64");
+		this.cpk = (options.keyFormat ?? "jwk") === "jwk" ? publicKey.export({ format: "jwk" }) : this.x5u;
+		this.domain = options.domain ?? "self";
+		this.now = options.now ?? Date.now;
+		this.issuedToken = options.token;
+	}
+	/**
+	* A fresh client identity, for one connection.
+	* @param domain - The identity provider's domain, as the client names it.
+	*/
+	static client(domain = "self") {
+		const { privateKey } = generateKeyPairSync("ec", { namedCurve: BEDROCK_CURVE });
+		return new NetherNetIdentity(privateKey, {
+			domain,
+			keyFormat: "der"
+		});
+	}
+	/**
+	* Reads the key from `file`, or makes one and writes it there, readable by its owner only.
+	* @param file - Where the PKCS #8 PEM key lives.
+	*/
+	static loadOrCreate(file) {
+		if (fs.existsSync(file)) return new NetherNetIdentity(createPrivateKey(fs.readFileSync(file)));
+		const { privateKey } = generateKeyPairSync("ec", { namedCurve: BEDROCK_CURVE });
+		fs.writeFileSync(file, privateKey.export({
+			type: "pkcs8",
+			format: "pem"
+		}), { mode: 384 });
+		return new NetherNetIdentity(privateKey);
+	}
+	/**
+	* The description with `a=identity` added: a self-signed token carrying the public key as
+	* `cpk`, and a detached signature over the description's DTLS fingerprints, which binds the key
+	* to the certificate WebRTC will present.
+	* @param description - The SDP offer or answer, with its `a=fingerprint` lines.
+	* @throws {Error} When the description has no fingerprint to sign.
+	*/
+	async sign(description) {
+		const fingerprints = sdpFingerprints(description);
+		if (fingerprints.length === 0) throw new Error("An SDP description without a fingerprint cannot be signed");
+		const issuedAt = Math.floor(this.now() / 1e3);
+		const token = this.issuedToken ?? await compactEs384({ x5u: this.x5u }, {
+			exp: issuedAt + TOKEN_LIFETIME_SECONDS,
+			iat: issuedAt,
+			cpk: this.cpk
+		}, this.privateKey);
+		const identity = {
+			assertion: JSON.stringify({
+				fingerprints: await detachedEs384(canonicalFingerprints(fingerprints), this.privateKey),
+				token
+			}),
+			idp: {
+				domain: this.domain,
+				protocol: "default"
+			}
+		};
+		return withSessionAttribute(description, `a=identity:${Buffer.from(JSON.stringify(identity)).toString("base64")}`);
+	}
+};
+/** The `cpk` claim as a public key: a JWK, or base64 DER. */
+var claimedKey = (cpk) => {
+	if (typeof cpk === "string") return createPublicKey({
+		key: Buffer.from(cpk, "base64"),
+		format: "der",
+		type: "spki"
+	});
+	if (isRecord(cpk)) {
+		const { kty, crv, x, y } = cpk;
+		if (typeof kty === "string" && typeof crv === "string" && typeof x === "string" && typeof y === "string") return createPublicKey({
+			key: {
+				kty,
+				crv,
+				x,
+				y
+			},
+			format: "jwk"
+		});
+	}
+	throw new Error("The identity token has no usable cpk claim");
+};
+/**
+* Checks a self-signed `a=identity` the way a NetherNet client checks a server's: the token is
+* signed by the key in its own `cpk` claim and not expired, and the detached signature covers this
+* description's fingerprints. Offline clients sign their offers the same way; an online client's
+* token is signed by the authorization service instead, which this does not check.
+* @param description - The SDP description carrying `a=identity`.
+* @param nowMs - The clock, in milliseconds since the epoch.
+* @throws {Error} When the identity is missing, malformed, expired or does not verify.
+*/
+var verifySelfSignedIdentity = async (description, nowMs = Date.now()) => {
+	const line = description.split(/\r?\n/).find((candidate) => candidate.startsWith("a=identity:"));
+	if (line === void 0) throw new Error("The description carries no a=identity");
+	const identity = JSON.parse(Buffer.from(line.slice(11), "base64").toString());
+	if (!isRecord(identity) || typeof identity.assertion !== "string" || !isRecord(identity.idp)) throw new Error("The a=identity has no assertion");
+	const assertion = JSON.parse(identity.assertion);
+	if (!isRecord(assertion) || typeof assertion.token !== "string" || typeof assertion.fingerprints !== "string") throw new Error("The identity assertion is malformed");
+	let claims;
+	try {
+		claims = decodeJwt(assertion.token);
+	} catch {
+		throw new Error("The identity token has no claims");
+	}
+	const publicKey = claimedKey(claims.cpk);
+	try {
+		await compactVerify(assertion.token, publicKey, { algorithms: ["ES384"] });
+	} catch {
+		throw new Error("The identity token is not signed by its own key");
+	}
+	if (typeof claims.exp === "number" && claims.exp < nowMs / 1e3) throw new Error("The identity token has expired");
+	const fingerprints = canonicalFingerprints(sdpFingerprints(description));
+	if (!await verifiesDetachedEs384(assertion.fingerprints, fingerprints, publicKey)) throw new Error("The identity does not sign this description's fingerprints");
+	return {
+		publicKey,
+		domain: typeof identity.idp.domain === "string" ? identity.idp.domain : "",
+		description: withoutIdentity(description)
+	};
+};
+export { NetherNetIdentity, canonicalFingerprints, verifySelfSignedIdentity };
+
+//# sourceMappingURL=NetherNetIdentity.js.map

package/dist/NetherNetIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetIdentity.js","names":[],"sources":["../src/NetherNetIdentity.ts"],"sourcesContent":["import fs from 'node:fs';\nimport { createPrivateKey, createPublicKey, generateKeyPairSync } from 'node:crypto';\nimport type { KeyObject } from 'node:crypto';\n\nimport { compactVerify, decodeJwt } from 'jose';\nimport { BEDROCK_CURVE, compactEs384, detachedEs384, verifiesDetachedEs384 } from './es384';\nimport { isRecord } from './isRecord';\nimport { sdpFingerprints, withoutIdentity, withSessionAttribute } from './sdp';\nimport type { SdpFingerprint } from './sdp';\n\n/** How long a signed identity token is valid; go-nethernet and Bedrock Dedicated Server use a minute. */\nconst TOKEN_LIFETIME_SECONDS = 60;\n\n/**\n * The fingerprints as canonical JSON: keys in code point order, no whitespace. The client\n * rebuilds these exact bytes from the answer's `a=fingerprint` lines to check the signature.\n * @param fingerprints - The answer's fingerprints, in SDP order.\n */\nexport const canonicalFingerprints = (fingerprints: readonly SdpFingerprint[]): string =>\n    JSON.stringify({\n        fingerprint: fingerprints.map(({ algorithm, digest }) => ({ algorithm, digest }))\n    });\n\n/** How an identity writes its public key into the token's `cpk` claim. */\nexport type IdentityKeyFormat =\n    /** A JSON Web Key, as servers since 26.40 write it. */\n    | 'jwk'\n    /** Base64 DER, as clients write it, the form the Login packet's keys take. */\n    | 'der';\n\n/** How a {@link NetherNetIdentity} presents itself. */\nexport interface NetherNetIdentityOptions {\n    /** Shown to players on first use over plain HTTP. Bedrock Dedicated Server says `self`. */\n    readonly domain?: string;\n    /** How the token carries the public key; a server's is a JWK, a client's base64 DER. */\n    readonly keyFormat?: IdentityKeyFormat;\n    /** The clock, in milliseconds since the epoch. */\n    readonly now?: () => number;\n    /**\n     * A token an authority issued for this key, used instead of a self-signed one: a signed-in\n     * client's multiplayer token from Minecraft's authorization service, whose `cpk` claim names\n     * this key. The fingerprints are still signed with the key here.\n     */\n    readonly token?: string;\n}\n\n/**\n * A NetherNet identity: a P-384 key whose public half a session description carries, signed, in\n * `a=identity`. A client refuses an answer without one, and Bedrock Dedicated Server refuses an\n * offer without one.\n *\n * A server's key must survive restarts: over plain HTTP the client remembers it the first time\n * and asks the player about any other. {@link NetherNetIdentity.loadOrCreate} keeps it in a file.\n */\nexport class NetherNetIdentity {\n    private readonly x5u: string;\n    private readonly cpk: string | object;\n    private readonly domain: string;\n    private readonly now: () => number;\n    private readonly issuedToken: string | undefined;\n\n    /**\n     * @param privateKey - A P-384 private key.\n     * @param options - How the identity presents itself; a server's by default.\n     */\n    public constructor(\n        private readonly privateKey: KeyObject,\n        options: NetherNetIdentityOptions = {}\n    ) {\n        const publicKey = createPublicKey(privateKey);\n        if (publicKey.asymmetricKeyDetails?.namedCurve !== BEDROCK_CURVE) {\n            throw new Error(`A NetherNet identity key must be ${BEDROCK_CURVE}`);\n        }\n        this.x5u = publicKey.export({ type: 'spki', format: 'der' }).toString('base64');\n        this.cpk = (options.keyFormat ?? 'jwk') === 'jwk' ? publicKey.export({ format: 'jwk' }) : this.x5u;\n        this.domain = options.domain ?? 'self';\n        this.now = options.now ?? Date.now;\n        this.issuedToken = options.token;\n    }\n\n    /**\n     * A fresh client identity, for one connection.\n     * @param domain - The identity provider's domain, as the client names it.\n     */\n    public static client(domain = 'self'): NetherNetIdentity {\n        const { privateKey } = generateKeyPairSync('ec', { namedCurve: BEDROCK_CURVE });\n        return new NetherNetIdentity(privateKey, { domain, keyFormat: 'der' });\n    }\n\n    /**\n     * Reads the key from `file`, or makes one and writes it there, readable by its owner only.\n     * @param file - Where the PKCS #8 PEM key lives.\n     */\n    public static loadOrCreate(file: string): NetherNetIdentity {\n        if (fs.existsSync(file)) return new NetherNetIdentity(createPrivateKey(fs.readFileSync(file)));\n\n        const { privateKey } = generateKeyPairSync('ec', { namedCurve: BEDROCK_CURVE });\n        fs.writeFileSync(file, privateKey.export({ type: 'pkcs8', format: 'pem' }), { mode: 0o600 });\n        return new NetherNetIdentity(privateKey);\n    }\n\n    /**\n     * The description with `a=identity` added: a self-signed token carrying the public key as\n     * `cpk`, and a detached signature over the description's DTLS fingerprints, which binds the key\n     * to the certificate WebRTC will present.\n     * @param description - The SDP offer or answer, with its `a=fingerprint` lines.\n     * @throws {Error} When the description has no fingerprint to sign.\n     */\n    public async sign(description: string): Promise<string> {\n        const fingerprints = sdpFingerprints(description);\n        if (fingerprints.length === 0) throw new Error('An SDP description without a fingerprint cannot be signed');\n\n        const issuedAt = Math.floor(this.now() / 1000);\n        const token =\n            this.issuedToken ??\n            (await compactEs384(\n                { x5u: this.x5u },\n                { exp: issuedAt + TOKEN_LIFETIME_SECONDS, iat: issuedAt, cpk: this.cpk },\n                this.privateKey\n            ));\n        const identity = {\n            // The assertion is JSON inside a JSON string, as NetherNet nests it.\n            assertion: JSON.stringify({\n                fingerprints: await detachedEs384(canonicalFingerprints(fingerprints), this.privateKey),\n                token\n            }),\n            idp: { domain: this.domain, protocol: 'default' }\n        };\n        return withSessionAttribute(\n            description,\n            `a=identity:${Buffer.from(JSON.stringify(identity)).toString('base64')}`\n        );\n    }\n}\n\n/** What {@link verifySelfSignedIdentity} found in a description it accepted. */\nexport interface VerifiedIdentity {\n    /** The identity's public key, from the token's `cpk` claim. */\n    readonly publicKey: KeyObject;\n    /** The domain the identity names, which a player may be shown. */\n    readonly domain: string;\n    /** The description without `a=identity`, ready for WebRTC. */\n    readonly description: string;\n}\n\n/** The `cpk` claim as a public key: a JWK, or base64 DER. */\nconst claimedKey = (cpk: unknown): KeyObject => {\n    if (typeof cpk === 'string')\n        return createPublicKey({ key: Buffer.from(cpk, 'base64'), format: 'der', type: 'spki' });\n    if (isRecord(cpk)) {\n        const { kty, crv, x, y } = cpk;\n        if (typeof kty === 'string' && typeof crv === 'string' && typeof x === 'string' && typeof y === 'string') {\n            return createPublicKey({ key: { kty, crv, x, y }, format: 'jwk' });\n        }\n    }\n    throw new Error('The identity token has no usable cpk claim');\n};\n\n/**\n * Checks a self-signed `a=identity` the way a NetherNet client checks a server's: the token is\n * signed by the key in its own `cpk` claim and not expired, and the detached signature covers this\n * description's fingerprints. Offline clients sign their offers the same way; an online client's\n * token is signed by the authorization service instead, which this does not check.\n * @param description - The SDP description carrying `a=identity`.\n * @param nowMs - The clock, in milliseconds since the epoch.\n * @throws {Error} When the identity is missing, malformed, expired or does not verify.\n */\nexport const verifySelfSignedIdentity = async (description: string, nowMs = Date.now()): Promise<VerifiedIdentity> => {\n    const line = description.split(/\\r?\\n/).find((candidate) => candidate.startsWith('a=identity:'));\n    if (line === undefined) throw new Error('The description carries no a=identity');\n\n    const identity: unknown = JSON.parse(Buffer.from(line.slice('a=identity:'.length), 'base64').toString());\n    if (!isRecord(identity) || typeof identity.assertion !== 'string' || !isRecord(identity.idp)) {\n        throw new Error('The a=identity has no assertion');\n    }\n    const assertion: unknown = JSON.parse(identity.assertion);\n    if (!isRecord(assertion) || typeof assertion.token !== 'string' || typeof assertion.fingerprints !== 'string') {\n        throw new Error('The identity assertion is malformed');\n    }\n\n    // The key to check the token with is the one the token names, so it is read unchecked first.\n    let claims: Record<string, unknown>;\n    try {\n        claims = decodeJwt(assertion.token);\n    } catch {\n        throw new Error('The identity token has no claims');\n    }\n    const publicKey = claimedKey(claims.cpk);\n    try {\n        await compactVerify(assertion.token, publicKey, { algorithms: ['ES384'] });\n    } catch {\n        throw new Error('The identity token is not signed by its own key');\n    }\n    if (typeof claims.exp === 'number' && claims.exp < nowMs / 1000) throw new Error('The identity token has expired');\n\n    const fingerprints = canonicalFingerprints(sdpFingerprints(description));\n    if (!(await verifiesDetachedEs384(assertion.fingerprints, fingerprints, publicKey))) {\n        throw new Error(\"The identity does not sign this description's fingerprints\");\n    }\n\n    return {\n        publicKey,\n        domain: typeof identity.idp.domain === 'string' ? identity.idp.domain : '',\n        description: withoutIdentity(description)\n    };\n};\n"],"mappings":";;;;;;;;AAWA,IAAM,yBAAyB;;;;;;AAO/B,IAAa,yBAAyB,iBAClC,KAAK,UAAU,EACX,aAAa,aAAa,KAAK,EAAE,WAAW,cAAc;CAAE;CAAW;AAAO,EAAE,EACpF,CAAC;;;;;;;;;AAiCL,IAAa,oBAAb,MAAa,kBAAkB;CAYN;CAXrB;CACA;CACA;CACA;CACA;;;;;CAMA,YACI,YACA,UAAoC,CAAC,GACvC;EAFmB,KAAA,aAAA;EAGjB,MAAM,YAAY,gBAAgB,UAAU;EAC5C,IAAI,UAAU,sBAAsB,eAAA,aAChC,MAAM,IAAI,MAAM,oCAAoC,eAAe;EAEvE,KAAK,MAAM,UAAU,OAAO;GAAE,MAAM;GAAQ,QAAQ;EAAM,CAAC,CAAC,CAAC,SAAS,QAAQ;EAC9E,KAAK,OAAO,QAAQ,aAAa,WAAW,QAAQ,UAAU,OAAO,EAAE,QAAQ,MAAM,CAAC,IAAI,KAAK;EAC/F,KAAK,SAAS,QAAQ,UAAU;EAChC,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,cAAc,QAAQ;CAC/B;;;;;CAMA,OAAc,OAAO,SAAS,QAA2B;EACrD,MAAM,EAAE,eAAe,oBAAoB,MAAM,EAAE,YAAY,cAAc,CAAC;EAC9E,OAAO,IAAI,kBAAkB,YAAY;GAAE;GAAQ,WAAW;EAAM,CAAC;CACzE;;;;;CAMA,OAAc,aAAa,MAAiC;EACxD,IAAI,GAAG,WAAW,IAAI,GAAG,OAAO,IAAI,kBAAkB,iBAAiB,GAAG,aAAa,IAAI,CAAC,CAAC;EAE7F,MAAM,EAAE,eAAe,oBAAoB,MAAM,EAAE,YAAY,cAAc,CAAC;EAC9E,GAAG,cAAc,MAAM,WAAW,OAAO;GAAE,MAAM;GAAS,QAAQ;EAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;EAC3F,OAAO,IAAI,kBAAkB,UAAU;CAC3C;;;;;;;;CASA,MAAa,KAAK,aAAsC;EACpD,MAAM,eAAe,gBAAgB,WAAW;EAChD,IAAI,aAAa,WAAW,GAAG,MAAM,IAAI,MAAM,2DAA2D;EAE1G,MAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAC7C,MAAM,QACF,KAAK,eACJ,MAAM,aACH,EAAE,KAAK,KAAK,IAAI,GAChB;GAAE,KAAK,WAAW;GAAwB,KAAK;GAAU,KAAK,KAAK;EAAI,GACvE,KAAK,UACT;EACJ,MAAM,WAAW;GAEb,WAAW,KAAK,UAAU;IACtB,cAAc,MAAM,cAAc,sBAAsB,YAAY,GAAG,KAAK,UAAU;IACtF;GACJ,CAAC;GACD,KAAK;IAAE,QAAQ,KAAK;IAAQ,UAAU;GAAU;EACpD;EACA,OAAO,qBACH,aACA,cAAc,OAAO,KAAK,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,GACzE;CACJ;AACJ;;AAaA,IAAM,cAAc,QAA4B;CAC5C,IAAI,OAAO,QAAQ,UACf,OAAO,gBAAgB;EAAE,KAAK,OAAO,KAAK,KAAK,QAAQ;EAAG,QAAQ;EAAO,MAAM;CAAO,CAAC;CAC3F,IAAI,SAAS,GAAG,GAAG;EACf,MAAM,EAAE,KAAK,KAAK,GAAG,MAAM;EAC3B,IAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,YAAY,OAAO,MAAM,YAAY,OAAO,MAAM,UAC5F,OAAO,gBAAgB;GAAE,KAAK;IAAE;IAAK;IAAK;IAAG;GAAE;GAAG,QAAQ;EAAM,CAAC;CAEzE;CACA,MAAM,IAAI,MAAM,4CAA4C;AAChE;;;;;;;;;;AAWA,IAAa,2BAA2B,OAAO,aAAqB,QAAQ,KAAK,IAAI,MAAiC;CAClH,MAAM,OAAO,YAAY,MAAM,OAAO,CAAC,CAAC,MAAM,cAAc,UAAU,WAAW,aAAa,CAAC;CAC/F,IAAI,SAAS,KAAA,GAAW,MAAM,IAAI,MAAM,uCAAuC;CAE/E,MAAM,WAAoB,KAAK,MAAM,OAAO,KAAK,KAAK,MAAM,EAAoB,GAAG,QAAQ,CAAC,CAAC,SAAS,CAAC;CACvG,IAAI,CAAC,SAAS,QAAQ,KAAK,OAAO,SAAS,cAAc,YAAY,CAAC,SAAS,SAAS,GAAG,GACvF,MAAM,IAAI,MAAM,iCAAiC;CAErD,MAAM,YAAqB,KAAK,MAAM,SAAS,SAAS;CACxD,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,UAAU,UAAU,YAAY,OAAO,UAAU,iBAAiB,UACjG,MAAM,IAAI,MAAM,qCAAqC;CAIzD,IAAI;CACJ,IAAI;EACA,SAAS,UAAU,UAAU,KAAK;CACtC,QAAQ;EACJ,MAAM,IAAI,MAAM,kCAAkC;CACtD;CACA,MAAM,YAAY,WAAW,OAAO,GAAG;CACvC,IAAI;EACA,MAAM,cAAc,UAAU,OAAO,WAAW,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;CAC7E,QAAQ;EACJ,MAAM,IAAI,MAAM,iDAAiD;CACrE;CACA,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,QAAQ,KAAM,MAAM,IAAI,MAAM,gCAAgC;CAEjH,MAAM,eAAe,sBAAsB,gBAAgB,WAAW,CAAC;CACvE,IAAI,CAAE,MAAM,sBAAsB,UAAU,cAAc,cAAc,SAAS,GAC7E,MAAM,IAAI,MAAM,4DAA4D;CAGhF,OAAO;EACH;EACA,QAAQ,OAAO,SAAS,IAAI,WAAW,WAAW,SAAS,IAAI,SAAS;EACxE,aAAa,gBAAgB,WAAW;CAC5C;AACJ"}

package/dist/NetherNetStatus.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What a NetherNet client is told about a server before it joins: the LAN advertisement on UDP
+ * 7551 and the `GET /v1/join` answer on the game port both carry these.
+ */
+export interface NetherNetStatus {
+    readonly motd: string;
+    readonly levelName: string;
+    readonly protocol: number;
+    /** The game version, such as `1.26.51`. */
+    readonly version: string;
+    readonly playerCount: number;
+    readonly maxPlayers: number;
+    /** The `Gametype` id: 0 survival, 1 creative, 2 adventure. */
+    readonly gameType: number;
+}
+/**
+ * The `GET /v1/join` body: the status under the field names Bedrock Dedicated Server 1.26.51
+ * answers with, in its order.
+ */
+export declare const joinStatusJson: (status: NetherNetStatus) => string;
+/**
+ * Reads a `GET /v1/join` body back into the status.
+ * @param body - The JSON the server answered with.
+ * @throws {Error} When a field is missing or has the wrong type.
+ */
+export declare const decodeJoinStatus: (body: string) => NetherNetStatus;
+//# sourceMappingURL=NetherNetStatus.d.ts.map

package/dist/NetherNetStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetStatus.d.ts","sources":["../src/NetherNetStatus.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,eAAe,KAAG,MASnD,CAAC;AAEP;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,eAsB/C,CAAC"}

package/dist/NetherNetStatus.js

@@ -0,0 +1,46 @@
+import { isRecord } from "./isRecord.js";
+// src/NetherNetStatus.ts
+/**
+* The `GET /v1/join` body: the status under the field names Bedrock Dedicated Server 1.26.51
+* answers with, in its order.
+*/
+var joinStatusJson = (status) => JSON.stringify({
+	name: status.motd,
+	protocol: status.protocol,
+	version: status.version,
+	level: status.levelName,
+	players: status.playerCount,
+	maxPlayers: status.maxPlayers,
+	gameType: status.gameType
+});
+/**
+* Reads a `GET /v1/join` body back into the status.
+* @param body - The JSON the server answered with.
+* @throws {Error} When a field is missing or has the wrong type.
+*/
+var decodeJoinStatus = (body) => {
+	const parsed = JSON.parse(body);
+	if (!isRecord(parsed)) throw new Error("The join status is not an object");
+	const text = (key) => {
+		const value = parsed[key];
+		if (typeof value !== "string") throw new Error(`The join status has no string ${key}`);
+		return value;
+	};
+	const number = (key) => {
+		const value = parsed[key];
+		if (typeof value !== "number") throw new Error(`The join status has no number ${key}`);
+		return value;
+	};
+	return {
+		motd: text("name"),
+		protocol: number("protocol"),
+		version: text("version"),
+		levelName: text("level"),
+		playerCount: number("players"),
+		maxPlayers: number("maxPlayers"),
+		gameType: number("gameType")
+	};
+};
+export { decodeJoinStatus, joinStatusJson };
+
+//# sourceMappingURL=NetherNetStatus.js.map

package/dist/NetherNetStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NetherNetStatus.js","names":[],"sources":["../src/NetherNetStatus.ts"],"sourcesContent":["import { isRecord } from './isRecord';\n\n/**\n * What a NetherNet client is told about a server before it joins: the LAN advertisement on UDP\n * 7551 and the `GET /v1/join` answer on the game port both carry these.\n */\nexport interface NetherNetStatus {\n    readonly motd: string;\n    readonly levelName: string;\n    readonly protocol: number;\n    /** The game version, such as `1.26.51`. */\n    readonly version: string;\n    readonly playerCount: number;\n    readonly maxPlayers: number;\n    /** The `Gametype` id: 0 survival, 1 creative, 2 adventure. */\n    readonly gameType: number;\n}\n\n/**\n * The `GET /v1/join` body: the status under the field names Bedrock Dedicated Server 1.26.51\n * answers with, in its order.\n */\nexport const joinStatusJson = (status: NetherNetStatus): string =>\n    JSON.stringify({\n        name: status.motd,\n        protocol: status.protocol,\n        version: status.version,\n        level: status.levelName,\n        players: status.playerCount,\n        maxPlayers: status.maxPlayers,\n        gameType: status.gameType\n    });\n\n/**\n * Reads a `GET /v1/join` body back into the status.\n * @param body - The JSON the server answered with.\n * @throws {Error} When a field is missing or has the wrong type.\n */\nexport const decodeJoinStatus = (body: string): NetherNetStatus => {\n    const parsed: unknown = JSON.parse(body);\n    if (!isRecord(parsed)) throw new Error('The join status is not an object');\n    const text = (key: string): string => {\n        const value = parsed[key];\n        if (typeof value !== 'string') throw new Error(`The join status has no string ${key}`);\n        return value;\n    };\n    const number = (key: string): number => {\n        const value = parsed[key];\n        if (typeof value !== 'number') throw new Error(`The join status has no number ${key}`);\n        return value;\n    };\n    return {\n        motd: text('name'),\n        protocol: number('protocol'),\n        version: text('version'),\n        levelName: text('level'),\n        playerCount: number('players'),\n        maxPlayers: number('maxPlayers'),\n        gameType: number('gameType')\n    };\n};\n"],"mappings":";;;;;;AAsBA,IAAa,kBAAkB,WAC3B,KAAK,UAAU;CACX,MAAM,OAAO;CACb,UAAU,OAAO;CACjB,SAAS,OAAO;CAChB,OAAO,OAAO;CACd,SAAS,OAAO;CAChB,YAAY,OAAO;CACnB,UAAU,OAAO;AACrB,CAAC;;;;;;AAOL,IAAa,oBAAoB,SAAkC;CAC/D,MAAM,SAAkB,KAAK,MAAM,IAAI;CACvC,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,IAAI,MAAM,kCAAkC;CACzE,MAAM,QAAQ,QAAwB;EAClC,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,UAAU,MAAM,IAAI,MAAM,iCAAiC,KAAK;EACrF,OAAO;CACX;CACA,MAAM,UAAU,QAAwB;EACpC,MAAM,QAAQ,OAAO;EACrB,IAAI,OAAO,UAAU,UAAU,MAAM,IAAI,MAAM,iCAAiC,KAAK;EACrF,OAAO;CACX;CACA,OAAO;EACH,MAAM,KAAK,MAAM;EACjB,UAAU,OAAO,UAAU;EAC3B,SAAS,KAAK,SAAS;EACvB,WAAW,KAAK,OAAO;EACvB,aAAa,OAAO,SAAS;EAC7B,YAAY,OAAO,YAAY;EAC/B,UAAU,OAAO,UAAU;CAC/B;AACJ"}

package/dist/constrainIcePorts.d.ts

@@ -0,0 +1,14 @@
+import type { PortRange } from './udpPorts';
+/**
+ * Makes every peer connection a `nethernet` `Server` builds take its UDP ports from `range`.
+ *
+ * `nethernet` 1.1.2 passes nothing but ICE servers to the peer connections it builds, so there is
+ * no option to set; this wraps the backend it holds instead. Werift, its default backend, honors
+ * `icePortRange`; the optional native backend ignores it. Replace this with an option once
+ * `nethernet` takes a peer connection configuration.
+ * @param server - The `nethernet` `Server`, before it negotiates any peer.
+ * @param range - The ports to allocate from, at least two.
+ * @throws {Error} When the server does not hold a backend in the shape this expects.
+ */
+export declare const constrainIcePorts: (server: object, range: PortRange) => void;
+//# sourceMappingURL=constrainIcePorts.d.ts.map

package/dist/constrainIcePorts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainIcePorts.d.ts","sources":["../src/constrainIcePorts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU5C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,WAAY,MAAM,SAAS,SAAS,KAAG,IAYpE,CAAC"}

package/dist/constrainIcePorts.js

@@ -0,0 +1,35 @@
+import { isRecord } from "./isRecord.js";
+// src/constrainIcePorts.ts
+var isBackend = (value) => isRecord(value) && typeof value.RTCPeerConnection === "function";
+/**
+* Makes every peer connection a `nethernet` `Server` builds take its UDP ports from `range`.
+*
+* `nethernet` 1.1.2 passes nothing but ICE servers to the peer connections it builds, so there is
+* no option to set; this wraps the backend it holds instead. Werift, its default backend, honors
+* `icePortRange`; the optional native backend ignores it. Replace this with an option once
+* `nethernet` takes a peer connection configuration.
+* @param server - The `nethernet` `Server`, before it negotiates any peer.
+* @param range - The ports to allocate from, at least two.
+* @throws {Error} When the server does not hold a backend in the shape this expects.
+*/
+var constrainIcePorts = (server, range) => {
+	const backend = Reflect.get(server, "webrtc");
+	if (!isBackend(backend)) throw new Error("This nethernet server has no WebRTC backend to give a port range");
+	const Base = backend.RTCPeerConnection;
+	const icePortRange = [range.start, range.end];
+	class RangedPeerConnection extends Base {
+		constructor(configuration) {
+			super({
+				...configuration,
+				icePortRange
+			});
+		}
+	}
+	Reflect.set(server, "webrtc", {
+		...backend,
+		RTCPeerConnection: RangedPeerConnection
+	});
+};
+export { constrainIcePorts };
+
+//# sourceMappingURL=constrainIcePorts.js.map

package/dist/constrainIcePorts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constrainIcePorts.js","names":[],"sources":["../src/constrainIcePorts.ts"],"sourcesContent":["import { isRecord } from './isRecord';\nimport type { PortRange } from './udpPorts';\n\n/** The WebRTC backend npm `nethernet` builds peer connections from, as far as this needs it. */\ninterface WebRtcBackend {\n    readonly RTCPeerConnection: new (configuration: Record<string, unknown>) => object;\n}\n\nconst isBackend = (value: unknown): value is WebRtcBackend =>\n    isRecord(value) && typeof value.RTCPeerConnection === 'function';\n\n/**\n * Makes every peer connection a `nethernet` `Server` builds take its UDP ports from `range`.\n *\n * `nethernet` 1.1.2 passes nothing but ICE servers to the peer connections it builds, so there is\n * no option to set; this wraps the backend it holds instead. Werift, its default backend, honors\n * `icePortRange`; the optional native backend ignores it. Replace this with an option once\n * `nethernet` takes a peer connection configuration.\n * @param server - The `nethernet` `Server`, before it negotiates any peer.\n * @param range - The ports to allocate from, at least two.\n * @throws {Error} When the server does not hold a backend in the shape this expects.\n */\nexport const constrainIcePorts = (server: object, range: PortRange): void => {\n    const backend: unknown = Reflect.get(server, 'webrtc');\n    if (!isBackend(backend)) throw new Error('This nethernet server has no WebRTC backend to give a port range');\n\n    const Base = backend.RTCPeerConnection;\n    const icePortRange: [number, number] = [range.start, range.end];\n    class RangedPeerConnection extends Base {\n        public constructor(configuration: Record<string, unknown>) {\n            super({ ...configuration, icePortRange });\n        }\n    }\n    Reflect.set(server, 'webrtc', { ...backend, RTCPeerConnection: RangedPeerConnection });\n};\n"],"mappings":";;AAQA,IAAM,aAAa,UACf,SAAS,KAAK,KAAK,OAAO,MAAM,sBAAsB;;;;;;;;;;;;AAa1D,IAAa,qBAAqB,QAAgB,UAA2B;CACzE,MAAM,UAAmB,QAAQ,IAAI,QAAQ,QAAQ;CACrD,IAAI,CAAC,UAAU,OAAO,GAAG,MAAM,IAAI,MAAM,kEAAkE;CAE3G,MAAM,OAAO,QAAQ;CACrB,MAAM,eAAiC,CAAC,MAAM,OAAO,MAAM,GAAG;CAC9D,MAAM,6BAA6B,KAAK;EACpC,YAAmB,eAAwC;GACvD,MAAM;IAAE,GAAG;IAAe;GAAa,CAAC;EAC5C;CACJ;CACA,QAAQ,IAAI,QAAQ,UAAU;EAAE,GAAG;EAAS,mBAAmB;CAAqB,CAAC;AACzF"}

package/dist/es384.d.ts

@@ -0,0 +1,26 @@
+import type { KeyObject } from 'node:crypto';
+/** The curve Bedrock signs with: the login chain, the encryption handshake and NetherNet identities. */
+export declare const BEDROCK_CURVE = "secp384r1";
+/**
+ * A compact ES384 JWS (a JWT, when the payload is a claim set): `header.payload.signature`,
+ * signed by `jose`.
+ * @param header - Header fields besides `alg`, such as `x5u`.
+ * @param payload - The JSON payload.
+ * @param privateKey - A P-384 private key.
+ */
+export declare const compactEs384: (header: Readonly<Record<string, unknown>>, payload: unknown, privateKey: KeyObject) => Promise<string>;
+/**
+ * A detached ES384 JWS over exact payload bytes (RFC 7515 appendix F): `header..signature`. The
+ * verifier rebuilds the payload itself, so its bytes must be the canonical ones it will build.
+ * @param payload - The payload bytes, signed as given.
+ * @param privateKey - A P-384 private key.
+ */
+export declare const detachedEs384: (payload: string, privateKey: KeyObject) => Promise<string>;
+/**
+ * Whether `jws` is a detached ES384 signature over `payload` by `publicKey`.
+ * @param jws - The detached JWS, `header..signature`.
+ * @param payload - The payload bytes the signer should have signed.
+ * @param publicKey - The P-384 key it should verify against.
+ */
+export declare const verifiesDetachedEs384: (jws: string, payload: string, publicKey: KeyObject) => Promise<boolean>;
+//# sourceMappingURL=es384.d.ts.map

package/dist/es384.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"es384.d.ts","sources":["../src/es384.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAI7C,wGAAwG;AACxG,eAAO,MAAM,aAAa,cAAc,CAAC;AAKzC;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,WACb,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,WAChC,OAAO,cACJ,SAAS,KACtB,OAAO,CAAC,MAAM,CAGQ,CAAC;AAE1B;;;;;GAKG;AACH,eAAO,MAAM,aAAa,YAAmB,MAAM,cAAc,SAAS,KAAG,OAAO,CAAC,MAAM,CAG1F,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,QAAe,MAAM,WAAW,MAAM,aAAa,SAAS,KAAG,OAAO,CAAC,OAAO,CAa/G,CAAC"}

package/dist/es384.js

@@ -0,0 +1,50 @@
+import { CompactSign, FlattenedSign, flattenedVerify } from "jose";
+// src/es384.ts
+/** The curve Bedrock signs with: the login chain, the encryption handshake and NetherNet identities. */
+var BEDROCK_CURVE = "secp384r1";
+var ES384 = "ES384";
+var encoder = new TextEncoder();
+/**
+* A compact ES384 JWS (a JWT, when the payload is a claim set): `header.payload.signature`,
+* signed by `jose`.
+* @param header - Header fields besides `alg`, such as `x5u`.
+* @param payload - The JSON payload.
+* @param privateKey - A P-384 private key.
+*/
+var compactEs384 = (header, payload, privateKey) => new CompactSign(encoder.encode(JSON.stringify(payload))).setProtectedHeader({
+	alg: ES384,
+	...header
+}).sign(privateKey);
+/**
+* A detached ES384 JWS over exact payload bytes (RFC 7515 appendix F): `header..signature`. The
+* verifier rebuilds the payload itself, so its bytes must be the canonical ones it will build.
+* @param payload - The payload bytes, signed as given.
+* @param privateKey - A P-384 private key.
+*/
+var detachedEs384 = async (payload, privateKey) => {
+	const signed = await new FlattenedSign(encoder.encode(payload)).setProtectedHeader({ alg: ES384 }).sign(privateKey);
+	return `${signed.protected ?? ""}..${signed.signature}`;
+};
+/**
+* Whether `jws` is a detached ES384 signature over `payload` by `publicKey`.
+* @param jws - The detached JWS, `header..signature`.
+* @param payload - The payload bytes the signer should have signed.
+* @param publicKey - The P-384 key it should verify against.
+*/
+var verifiesDetachedEs384 = async (jws, payload, publicKey) => {
+	const [header, detached, signature, ...extra] = jws.split(".");
+	if (header === void 0 || detached !== "" || signature === void 0 || extra.length > 0) return false;
+	try {
+		await flattenedVerify({
+			protected: header,
+			payload: Buffer.from(payload).toString("base64url"),
+			signature
+		}, publicKey, { algorithms: [ES384] });
+		return true;
+	} catch {
+		return false;
+	}
+};
+export { BEDROCK_CURVE, compactEs384, detachedEs384, verifiesDetachedEs384 };
+
+//# sourceMappingURL=es384.js.map

package/dist/es384.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"es384.js","names":[],"sources":["../src/es384.ts"],"sourcesContent":["import type { KeyObject } from 'node:crypto';\n\nimport { CompactSign, FlattenedSign, flattenedVerify } from 'jose';\n\n/** The curve Bedrock signs with: the login chain, the encryption handshake and NetherNet identities. */\nexport const BEDROCK_CURVE = 'secp384r1';\n\nconst ES384 = 'ES384';\nconst encoder = new TextEncoder();\n\n/**\n * A compact ES384 JWS (a JWT, when the payload is a claim set): `header.payload.signature`,\n * signed by `jose`.\n * @param header - Header fields besides `alg`, such as `x5u`.\n * @param payload - The JSON payload.\n * @param privateKey - A P-384 private key.\n */\nexport const compactEs384 = (\n    header: Readonly<Record<string, unknown>>,\n    payload: unknown,\n    privateKey: KeyObject\n): Promise<string> =>\n    new CompactSign(encoder.encode(JSON.stringify(payload)))\n        .setProtectedHeader({ alg: ES384, ...header })\n        .sign(privateKey);\n\n/**\n * A detached ES384 JWS over exact payload bytes (RFC 7515 appendix F): `header..signature`. The\n * verifier rebuilds the payload itself, so its bytes must be the canonical ones it will build.\n * @param payload - The payload bytes, signed as given.\n * @param privateKey - A P-384 private key.\n */\nexport const detachedEs384 = async (payload: string, privateKey: KeyObject): Promise<string> => {\n    const signed = await new FlattenedSign(encoder.encode(payload)).setProtectedHeader({ alg: ES384 }).sign(privateKey);\n    return `${signed.protected ?? ''}..${signed.signature}`;\n};\n\n/**\n * Whether `jws` is a detached ES384 signature over `payload` by `publicKey`.\n * @param jws - The detached JWS, `header..signature`.\n * @param payload - The payload bytes the signer should have signed.\n * @param publicKey - The P-384 key it should verify against.\n */\nexport const verifiesDetachedEs384 = async (jws: string, payload: string, publicKey: KeyObject): Promise<boolean> => {\n    const [header, detached, signature, ...extra] = jws.split('.');\n    if (header === undefined || detached !== '' || signature === undefined || extra.length > 0) return false;\n    try {\n        await flattenedVerify(\n            { protected: header, payload: Buffer.from(payload).toString('base64url'), signature },\n            publicKey,\n            { algorithms: [ES384] }\n        );\n        return true;\n    } catch {\n        return false;\n    }\n};\n"],"mappings":";;;AAKA,IAAa,gBAAgB;AAE7B,IAAM,QAAQ;AACd,IAAM,UAAU,IAAI,YAAY;;;;;;;;AAShC,IAAa,gBACT,QACA,SACA,eAEA,IAAI,YAAY,QAAQ,OAAO,KAAK,UAAU,OAAO,CAAC,CAAC,CAAC,CACnD,mBAAmB;CAAE,KAAK;CAAO,GAAG;AAAO,CAAC,CAAC,CAC7C,KAAK,UAAU;;;;;;;AAQxB,IAAa,gBAAgB,OAAO,SAAiB,eAA2C;CAC5F,MAAM,SAAS,MAAM,IAAI,cAAc,QAAQ,OAAO,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,UAAU;CAClH,OAAO,GAAG,OAAO,aAAa,GAAG,IAAI,OAAO;AAChD;;;;;;;AAQA,IAAa,wBAAwB,OAAO,KAAa,SAAiB,cAA2C;CACjH,MAAM,CAAC,QAAQ,UAAU,WAAW,GAAG,SAAS,IAAI,MAAM,GAAG;CAC7D,IAAI,WAAW,KAAA,KAAa,aAAa,MAAM,cAAc,KAAA,KAAa,MAAM,SAAS,GAAG,OAAO;CACnG,IAAI;EACA,MAAM,gBACF;GAAE,WAAW;GAAQ,SAAS,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,WAAW;GAAG;EAAU,GACpF,WACA,EAAE,YAAY,CAAC,KAAK,EAAE,CAC1B;EACA,OAAO;CACX,QAAQ;EACJ,OAAO;CACX;AACJ"}

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export { BEDROCK_CURVE, compactEs384, detachedEs384, verifiesDetachedEs384 } from './es384';
+export { HttpSignaling } from './HttpSignaling';
+export type { HttpSignalingOptions, NetherNetOfferAnswerer, SignalingLogger } from './HttpSignaling';
+export { decodeLanAdvertisement, encodeLanAdvertisement, LAN_ADVERTISEMENT_VERSION, lanAdvertisementOf } from './LanAdvertisement';
+export type { LanAdvertisement } from './LanAdvertisement';
+export { NETHERNET_LAN_PORT } from './NetherNetDefaults';
+export { canonicalFingerprints, NetherNetIdentity, verifySelfSignedIdentity } from './NetherNetIdentity';
+export type { IdentityKeyFormat, NetherNetIdentityOptions, VerifiedIdentity } from './NetherNetIdentity';
+export { decodeJoinStatus, joinStatusJson } from './NetherNetStatus';
+export { exchangeOffer, JoinRefusedError, probeJoin } from './joinByAddress';
+export type { JoinProbe, SignalingAddress } from './joinByAddress';
+export type { NetherNetStatus } from './NetherNetStatus';
+export { constrainIcePorts } from './constrainIcePorts';
+export { sdpFingerprints, withoutIdentity, withSessionAttribute } from './sdp';
+export { describeCandidates, tracePeerConnection } from './tracePeerConnection';
+export { parseUdpPorts, withMappedCandidates } from './udpPorts';
+export type { PortMapping, PortRange, UdpPorts } from './udpPorts';
+export type { SdpFingerprint } from './sdp';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACrG,OAAO,EACH,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,EACzB,kBAAkB,EACrB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACzG,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC7E,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACjE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC"}

package/dist/index.js

@@ -0,0 +1,12 @@
+import { BEDROCK_CURVE, compactEs384, detachedEs384, verifiesDetachedEs384 } from "./es384.js";
+import { HttpSignaling } from "./HttpSignaling.js";
+import { LAN_ADVERTISEMENT_VERSION, decodeLanAdvertisement, encodeLanAdvertisement, lanAdvertisementOf } from "./LanAdvertisement.js";
+import { NETHERNET_LAN_PORT } from "./NetherNetDefaults.js";
+import { NetherNetIdentity, canonicalFingerprints, verifySelfSignedIdentity } from "./NetherNetIdentity.js";
+import { decodeJoinStatus, joinStatusJson } from "./NetherNetStatus.js";
+import { JoinRefusedError, exchangeOffer, probeJoin } from "./joinByAddress.js";
+import { constrainIcePorts } from "./constrainIcePorts.js";
+import { sdpFingerprints, withSessionAttribute, withoutIdentity } from "./sdp.js";
+import { describeCandidates, tracePeerConnection } from "./tracePeerConnection.js";
+import { parseUdpPorts, withMappedCandidates } from "./udpPorts.js";
+export { BEDROCK_CURVE, HttpSignaling, JoinRefusedError, LAN_ADVERTISEMENT_VERSION, NETHERNET_LAN_PORT, NetherNetIdentity, canonicalFingerprints, compactEs384, constrainIcePorts, decodeJoinStatus, decodeLanAdvertisement, describeCandidates, detachedEs384, encodeLanAdvertisement, exchangeOffer, joinStatusJson, lanAdvertisementOf, parseUdpPorts, probeJoin, sdpFingerprints, tracePeerConnection, verifiesDetachedEs384, verifySelfSignedIdentity, withMappedCandidates, withSessionAttribute, withoutIdentity };

package/dist/isRecord.d.ts

@@ -0,0 +1,3 @@
+/** Whether a value is a non-null object, which is what parsed JSON has to be before its fields are read. */
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+//# sourceMappingURL=isRecord.d.ts.map

package/dist/isRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isRecord.d.ts","sources":["../src/isRecord.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACD,CAAC"}

package/dist/isRecord.js

@@ -0,0 +1,6 @@
+// src/isRecord.ts
+/** Whether a value is a non-null object, which is what parsed JSON has to be before its fields are read. */
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+export { isRecord };
+
+//# sourceMappingURL=isRecord.js.map

package/dist/isRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isRecord.js","names":[],"sources":["../src/isRecord.ts"],"sourcesContent":["/** Whether a value is a non-null object, which is what parsed JSON has to be before its fields are read. */\nexport const isRecord = (value: unknown): value is Record<string, unknown> =>\n    typeof value === 'object' && value !== null && !Array.isArray(value);\n"],"mappings":";;AACA,IAAa,YAAY,UACrB,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK"}

package/dist/joinByAddress.d.ts

@@ -0,0 +1,41 @@
+import type { NetherNetStatus } from './NetherNetStatus';
+/** Where a NetherNet server signals: the TCP side of its game port. */
+export interface SignalingAddress {
+    readonly host: string;
+    readonly port: number;
+}
+/** A failed `POST /v1/join/{networkId}`, with what the server answered. */
+export declare class JoinRefusedError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string);
+}
+/** What `GET /v1/join` said about a server that speaks NetherNet. */
+export interface JoinProbe {
+    /**
+     * The server's status, when it sent one. Bedrock Dedicated Server 1.26.51 answers with an empty
+     * body when LAN visibility is off, and go-nethernet does when it has no status to give.
+     */
+    readonly status?: NetherNetStatus;
+}
+/**
+ * Asks whether the server speaks NetherNet, as a client does before it joins by address: any 2xx
+ * from `GET /v1/join` means yes, whatever the body says.
+ * @param address - The server's host and game port.
+ * @param signal - Aborts the request.
+ * @returns What the server said, or undefined when it does not speak NetherNet there.
+ * @throws {Error} When a 2xx body is present but is not a join status.
+ */
+export declare const probeJoin: (address: SignalingAddress, signal?: AbortSignal) => Promise<JoinProbe | undefined>;
+/**
+ * Trades a complete SDP offer for the server's complete answer, the one request a client sends
+ * per attempt.
+ * @param address - The server's host and game port.
+ * @param networkId - The client's own network ID.
+ * @param offer - The offer, with every candidate and the client's `a=identity`.
+ * @param signal - Aborts the request.
+ * @returns The answer.
+ * @throws {JoinRefusedError} When the server answers anything but 2xx.
+ */
+export declare const exchangeOffer: (address: SignalingAddress, networkId: bigint, offer: string, signal?: AbortSignal) => Promise<string>;
+//# sourceMappingURL=joinByAddress.d.ts.map

package/dist/joinByAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"joinByAddress.d.ts","sources":["../src/joinByAddress.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzD,uEAAuE;AACvE,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,2EAA2E;AAC3E,qBAAa,gBAAiB,SAAQ,KAAK;aAEnB,MAAM,EAAE,MAAM;aACd,IAAI,EAAE,MAAM;IAFhC,YACoB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EAG/B;CACJ;AAMD,qEAAqE;AACrE,MAAM,WAAW,SAAS;IACtB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,YAAmB,gBAAgB,WAAW,WAAW,KAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAK9G,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,YACb,gBAAgB,aACd,MAAM,SACV,MAAM,WACJ,WAAW,KACrB,OAAO,CAAC,MAAM,CAUhB,CAAC"}

package/dist/joinByAddress.js

@@ -0,0 +1,52 @@
+import { decodeJoinStatus } from "./NetherNetStatus.js";
+// src/joinByAddress.ts
+/** A failed `POST /v1/join/{networkId}`, with what the server answered. */
+var JoinRefusedError = class extends Error {
+	status;
+	body;
+	constructor(status, body) {
+		super(`The server refused the offer with HTTP ${status}${body === "" ? "" : `: ${body}`}`);
+		this.status = status;
+		this.body = body;
+	}
+};
+/** The signaling origin, with an IPv6 host in brackets as a URL needs. */
+var origin = ({ host, port }) => `http://${host.includes(":") ? `[${host}]` : host}:${port}`;
+/**
+* Asks whether the server speaks NetherNet, as a client does before it joins by address: any 2xx
+* from `GET /v1/join` means yes, whatever the body says.
+* @param address - The server's host and game port.
+* @param signal - Aborts the request.
+* @returns What the server said, or undefined when it does not speak NetherNet there.
+* @throws {Error} When a 2xx body is present but is not a join status.
+*/
+var probeJoin = async (address, signal) => {
+	const response = await fetch(`${origin(address)}/v1/join`, { signal });
+	if (!response.ok) return void 0;
+	const body = await response.text();
+	return body.trim() === "" ? {} : { status: decodeJoinStatus(body) };
+};
+/**
+* Trades a complete SDP offer for the server's complete answer, the one request a client sends
+* per attempt.
+* @param address - The server's host and game port.
+* @param networkId - The client's own network ID.
+* @param offer - The offer, with every candidate and the client's `a=identity`.
+* @param signal - Aborts the request.
+* @returns The answer.
+* @throws {JoinRefusedError} When the server answers anything but 2xx.
+*/
+var exchangeOffer = async (address, networkId, offer, signal) => {
+	const response = await fetch(`${origin(address)}/v1/join/${networkId}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/sdp" },
+		body: offer,
+		signal
+	});
+	const body = await response.text();
+	if (!response.ok) throw new JoinRefusedError(response.status, body);
+	return body;
+};
+export { JoinRefusedError, exchangeOffer, probeJoin };
+
+//# sourceMappingURL=joinByAddress.js.map

package/dist/joinByAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"joinByAddress.js","names":[],"sources":["../src/joinByAddress.ts"],"sourcesContent":["import { decodeJoinStatus } from './NetherNetStatus';\nimport type { NetherNetStatus } from './NetherNetStatus';\n\n/** Where a NetherNet server signals: the TCP side of its game port. */\nexport interface SignalingAddress {\n    readonly host: string;\n    readonly port: number;\n}\n\n/** A failed `POST /v1/join/{networkId}`, with what the server answered. */\nexport class JoinRefusedError extends Error {\n    public constructor(\n        public readonly status: number,\n        public readonly body: string\n    ) {\n        super(`The server refused the offer with HTTP ${status}${body === '' ? '' : `: ${body}`}`);\n    }\n}\n\n/** The signaling origin, with an IPv6 host in brackets as a URL needs. */\nconst origin = ({ host, port }: SignalingAddress): string =>\n    `http://${host.includes(':') ? `[${host}]` : host}:${port}`;\n\n/** What `GET /v1/join` said about a server that speaks NetherNet. */\nexport interface JoinProbe {\n    /**\n     * The server's status, when it sent one. Bedrock Dedicated Server 1.26.51 answers with an empty\n     * body when LAN visibility is off, and go-nethernet does when it has no status to give.\n     */\n    readonly status?: NetherNetStatus;\n}\n\n/**\n * Asks whether the server speaks NetherNet, as a client does before it joins by address: any 2xx\n * from `GET /v1/join` means yes, whatever the body says.\n * @param address - The server's host and game port.\n * @param signal - Aborts the request.\n * @returns What the server said, or undefined when it does not speak NetherNet there.\n * @throws {Error} When a 2xx body is present but is not a join status.\n */\nexport const probeJoin = async (address: SignalingAddress, signal?: AbortSignal): Promise<JoinProbe | undefined> => {\n    const response = await fetch(`${origin(address)}/v1/join`, { signal });\n    if (!response.ok) return undefined;\n    const body = await response.text();\n    return body.trim() === '' ? {} : { status: decodeJoinStatus(body) };\n};\n\n/**\n * Trades a complete SDP offer for the server's complete answer, the one request a client sends\n * per attempt.\n * @param address - The server's host and game port.\n * @param networkId - The client's own network ID.\n * @param offer - The offer, with every candidate and the client's `a=identity`.\n * @param signal - Aborts the request.\n * @returns The answer.\n * @throws {JoinRefusedError} When the server answers anything but 2xx.\n */\nexport const exchangeOffer = async (\n    address: SignalingAddress,\n    networkId: bigint,\n    offer: string,\n    signal?: AbortSignal\n): Promise<string> => {\n    const response = await fetch(`${origin(address)}/v1/join/${networkId}`, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/sdp' },\n        body: offer,\n        signal\n    });\n    const body = await response.text();\n    if (!response.ok) throw new JoinRefusedError(response.status, body);\n    return body;\n};\n"],"mappings":";;;AAUA,IAAa,mBAAb,cAAsC,MAAM;CAEpB;CACA;CAFpB,YACI,QACA,MACF;EACE,MAAM,0CAA0C,SAAS,SAAS,KAAK,KAAK,KAAK,QAAQ;EAHzE,KAAA,SAAA;EACA,KAAA,OAAA;CAGpB;AACJ;;AAGA,IAAM,UAAU,EAAE,MAAM,WACpB,UAAU,KAAK,SAAS,GAAG,IAAI,IAAI,KAAK,KAAK,KAAK,GAAG;;;;;;;;;AAmBzD,IAAa,YAAY,OAAO,SAA2B,WAAyD;CAChH,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;CACrE,IAAI,CAAC,SAAS,IAAI,OAAO,KAAA;CACzB,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,OAAO,KAAK,KAAK,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,iBAAiB,IAAI,EAAE;AACtE;;;;;;;;;;;AAYA,IAAa,gBAAgB,OACzB,SACA,WACA,OACA,WACkB;CAClB,MAAM,WAAW,MAAM,MAAM,GAAG,OAAO,OAAO,EAAE,WAAW,aAAa;EACpE,QAAQ;EACR,SAAS,EAAE,gBAAgB,kBAAkB;EAC7C,MAAM;EACN;CACJ,CAAC;CACD,MAAM,OAAO,MAAM,SAAS,KAAK;CACjC,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,iBAAiB,SAAS,QAAQ,IAAI;CAClE,OAAO;AACX"}

package/dist/sdp.d.ts

@@ -0,0 +1,26 @@
+/** One `a=fingerprint` attribute: the DTLS certificate hash the peer must present. */
+export interface SdpFingerprint {
+    /** The hash function, such as `sha-256`. */
+    readonly algorithm: string;
+    /** The hash, colon-separated hex, as the SDP spells it. */
+    readonly digest: string;
+}
+/**
+ * Every `a=fingerprint` in a description, in the order they appear.
+ * @param sdp - The session description.
+ */
+export declare const sdpFingerprints: (sdp: string) => SdpFingerprint[];
+/**
+ * The description with every `a=identity` line removed. The identity is NetherNet's, checked
+ * before the description reaches WebRTC, which does not know the attribute.
+ * @param sdp - The session description.
+ */
+export declare const withoutIdentity: (sdp: string) => string;
+/**
+ * The description with one session-level attribute added: after every other session-level line
+ * and before the first media section, which is where NetherNet expects `a=identity`.
+ * @param sdp - The session description.
+ * @param attribute - The attribute line, such as `a=identity:…`.
+ */
+export declare const withSessionAttribute: (sdp: string, attribute: string) => string;
+//# sourceMappingURL=sdp.d.ts.map