@mertushka/webrtc-node 0.1.0-alpha.0

package/lib/load-native.js

@@ -0,0 +1,42 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..");
+const moduleName = "webrtc_node.node";
+
+function existing(file) {
+  return fs.existsSync(file) ? file : null;
+}
+
+function localBuildCandidates() {
+  return [
+    path.join(root, "build", "Release", moduleName),
+    path.join(root, "build", "Debug", moduleName),
+  ];
+}
+
+function loadNative() {
+  const override = process.env.WEBRTC_NODE_NATIVE_PATH;
+  const candidates = [...(override ? [path.resolve(override)] : []), ...localBuildCandidates()];
+
+  for (const candidate of candidates) {
+    if (!existing(candidate)) continue;
+    try {
+      return require(candidate);
+    } catch (error) {
+      error.message = `Failed to load native addon at ${candidate}: ${error.message}`;
+      throw error;
+    }
+  }
+
+  const searched = candidates.map((candidate) => `  - ${candidate}`).join("\n");
+  throw new Error(
+    `Native addon not found for ${process.platform}-${process.arch}.\n` +
+      `Searched:\n${searched}\n` +
+      'Install a package with a matching prebuild or run "npm run build".',
+  );
+}
+
+module.exports = loadNative();

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@mertushka/webrtc-node",
+  "version": "0.1.0-alpha.0",
+  "description": "W3C-style RTCPeerConnection and RTCDataChannel for Node.js, backed by libdatachannel.",
+  "author": "mertushka",
+  "homepage": "https://github.com/mertushka/webrtc-node#readme",
+  "bugs": {
+    "url": "https://github.com/mertushka/webrtc-node/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mertushka/webrtc-node.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "webrtc",
+    "rtcpeerconnection",
+    "rtcdatachannel",
+    "node",
+    "node-api",
+    "n-api",
+    "libdatachannel",
+    "web-platform-tests"
+  ],
+  "main": "lib/index.js",
+  "types": "index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "require": "./lib/index.js",
+      "import": "./lib/index.js",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "docs/README.md",
+    "docs/architecture.md",
+    "docs/conformance.md",
+    "docs/development.md",
+    "docs/divergences.md",
+    "examples",
+    "lib",
+    "scripts",
+    "src",
+    "CMakeLists.txt",
+    "index.d.ts",
+    "wpt-manifest.json"
+  ],
+  "scripts": {
+    "build": "cmake-js compile",
+    "check": "biome check .",
+    "clean": "cmake-js clean",
+    "example:datachannel": "node examples/datachannel.js",
+    "format": "biome format --write .",
+    "format:check": "biome format .",
+    "install": "node scripts/install-native.js",
+    "lint": "biome lint .",
+    "native:check": "node scripts/check-native-integration.js",
+    "pack:check": "node scripts/check-package-artifact.js",
+    "prebuild:package": "node scripts/package-prebuild.js",
+    "prebuild:check": "node scripts/check-prebuilds.js",
+    "api:check": "node scripts/check-api-surface.js",
+    "test": "node --test --test-force-exit --test-timeout=30000 test/basic.test.js test/ci-evidence.test.js",
+    "types:check": "tsc -p tsconfig.types.json",
+    "wpt:ensure": "node scripts/ensure-wpt.js",
+    "wpt:smoke": "node scripts/run-wpt-smoke.js",
+    "wpt:smoke:check": "node scripts/check-wpt-results.js --fail-on-retries --expected-total 4",
+    "wpt:test": "node scripts/run-wpt-subset.js",
+    "wpt:check": "node scripts/check-wpt-results.js",
+    "wpt:check:strict": "node scripts/check-wpt-results.js --fail-on-retries",
+    "wpt:selection:check": "node scripts/check-wpt-selection.js",
+    "wpt:report": "node scripts/write-wpt-report.js",
+    "wpt:manifest": "node scripts/print-wpt-manifest.js",
+    "ci:evidence": "node scripts/write-ci-evidence.js",
+    "ci:evidence:check": "node scripts/check-ci-evidence.js"
+  },
+  "dependencies": {
+    "cmake-js": "^8.0.0",
+    "detect-libc": "^2.1.2",
+    "node-addon-api": "^8.3.1",
+    "tar": "^7.5.15"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.4.16",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MPL-2.0"
+}

package/scripts/check-api-surface.js

@@ -0,0 +1,149 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const api = require("..");
+
+const root = path.resolve(__dirname, "..");
+const declarations = fs.readFileSync(path.join(root, "index.d.ts"), "utf8");
+
+function fail(message) {
+  console.error(`API surface check failed: ${message}`);
+  process.exit(1);
+}
+
+function parseDeclaredClasses(source) {
+  const classes = new Map();
+  const pattern = /^export class (\w+)(?:[^{]*)\{\n([\s\S]*?)^}/gm;
+  let match;
+  while ((match = pattern.exec(source))) {
+    const [, name, body] = match;
+    const staticMembers = new Set();
+    const instanceMembers = new Set();
+    let skippingSignature = false;
+    for (const rawLine of body.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (skippingSignature) {
+        if (line.endsWith(";")) skippingSignature = false;
+        continue;
+      }
+      if (!line) continue;
+      if (line.startsWith("constructor(")) {
+        if (!line.endsWith(";")) skippingSignature = true;
+        continue;
+      }
+      if (line.endsWith(",")) continue;
+      let memberMatch = /^static\s+(\w+)\s*\(/.exec(line);
+      if (memberMatch) {
+        staticMembers.add(memberMatch[1]);
+        if (!line.endsWith(";")) skippingSignature = true;
+        continue;
+      }
+      memberMatch = /^(?:readonly\s+)?(\w+)\s*(?:\(|:)/.exec(line);
+      if (memberMatch) {
+        instanceMembers.add(memberMatch[1]);
+        if (line.includes("(") && !line.endsWith(";")) skippingSignature = true;
+      }
+    }
+    classes.set(name, { staticMembers, instanceMembers });
+  }
+  return classes;
+}
+
+function parseNonstandardNamespace(source) {
+  const namespaceMatch = /^export namespace nonstandard \{\n([\s\S]*?)^}/m.exec(source);
+  if (!namespaceMatch) return new Set();
+  const members = new Set();
+  for (const rawLine of namespaceMatch[1].split(/\r?\n/)) {
+    const line = rawLine.trim();
+    const match = /^const\s+(\w+)\s*:/.exec(line);
+    if (match) members.add(match[1]);
+  }
+  return members;
+}
+
+function createInstances() {
+  const peerConnection = new api.RTCPeerConnection();
+  const channel = peerConnection.createDataChannel("surface-check");
+  const candidate = new api.RTCIceCandidate({ sdpMid: "0" });
+  const candidatePair = Object.assign(Object.create(api.RTCIceCandidatePair.prototype), {
+    local: candidate,
+    remote: candidate,
+  });
+  const iceTransport = Object.assign(Object.create(api.RTCIceTransport.prototype), {
+    onstatechange: null,
+    ongatheringstatechange: null,
+    onselectedcandidatepairchange: null,
+  });
+  const dtlsTransport = Object.assign(Object.create(api.RTCDtlsTransport.prototype), {
+    iceTransport,
+    onstatechange: null,
+    onerror: null,
+  });
+  const sctpTransport = Object.assign(Object.create(api.RTCSctpTransport.prototype), {
+    onstatechange: null,
+  });
+  const instances = {
+    Event: new api.Event("surface-check"),
+    MessageEvent: new api.MessageEvent("message", { data: "surface-check" }),
+    EventTarget: new api.EventTarget(),
+    RTCSessionDescription: new api.RTCSessionDescription({ type: "offer", sdp: "v=0\r\n" }),
+    RTCIceCandidate: candidate,
+    RTCIceCandidatePair: candidatePair,
+    RTCCertificate: new api.RTCCertificate(),
+    RTCDataChannel: channel,
+    RTCDataChannelEvent: new api.RTCDataChannelEvent("datachannel", { channel }),
+    RTCPeerConnectionIceEvent: new api.RTCPeerConnectionIceEvent("icecandidate"),
+    RTCPeerConnectionIceErrorEvent: new api.RTCPeerConnectionIceErrorEvent("icecandidateerror"),
+    RTCError: new api.RTCError({ errorDetail: "data-channel-failure" }),
+    RTCErrorEvent: new api.RTCErrorEvent("error"),
+    RTCDtlsTransport: dtlsTransport,
+    RTCIceTransport: iceTransport,
+    RTCSctpTransport: sctpTransport,
+    RTCPeerConnection: peerConnection,
+  };
+  return { instances, cleanup: () => peerConnection.close() };
+}
+
+const declaredClasses = parseDeclaredClasses(declarations);
+const declaredNonstandardMembers = parseNonstandardNamespace(declarations);
+const declaredExports = new Set([...declaredClasses.keys(), "nonstandard"]);
+const runtimeExports = new Set(Object.keys(api));
+
+for (const name of declaredExports) {
+  if (!runtimeExports.has(name)) fail(`declared export ${name} is missing at runtime`);
+}
+
+for (const name of runtimeExports) {
+  if (!declaredExports.has(name)) fail(`runtime export ${name} is missing from index.d.ts`);
+}
+
+const { instances, cleanup } = createInstances();
+try {
+  for (const [className, members] of declaredClasses) {
+    const ctor = api[className];
+    if (typeof ctor !== "function") fail(`${className} is not a constructor at runtime`);
+    for (const member of members.staticMembers) {
+      if (!(member in ctor)) fail(`${className}.${member} is declared but missing at runtime`);
+    }
+    const instance = instances[className];
+    if (!instance) fail(`no runtime sample for ${className}`);
+    for (const member of members.instanceMembers) {
+      if (!(member in instance)) fail(`${className}#${member} is declared but missing at runtime`);
+    }
+  }
+
+  if (typeof api.nonstandard !== "object" || api.nonstandard === null) {
+    fail("nonstandard namespace is missing at runtime");
+  }
+  for (const member of declaredNonstandardMembers) {
+    if (!(member in api.nonstandard))
+      fail(`nonstandard.${member} is declared but missing at runtime`);
+  }
+} finally {
+  cleanup();
+}
+
+console.log(
+  `API surface verified: ${declaredClasses.size} classes, ${declaredNonstandardMembers.size} nonstandard members`,
+);

package/scripts/check-ci-evidence.js

@@ -0,0 +1,124 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..");
+const args = process.argv.slice(2);
+const artifactsIndex = args.indexOf("--artifacts");
+const artifactsRoot =
+  artifactsIndex === -1
+    ? path.join(root, "ci-artifacts")
+    : path.resolve(root, args[artifactsIndex + 1] || "");
+const manifestPath = path.join(root, "wpt-manifest.json");
+const requiredOs = ["Linux", "macOS", "Windows"];
+const requiredNodeMajors = [20, 22, 24];
+
+function fail(message) {
+  console.error(`CI evidence check failed: ${message}`);
+  process.exit(1);
+}
+
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch (error) {
+    fail(`could not read ${file}: ${error.message}`);
+  }
+}
+
+function walk(dir, matches = []) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) walk(fullPath, matches);
+    else if (entry.isFile() && entry.name === "ci-evidence.json") matches.push(fullPath);
+  }
+  return matches;
+}
+
+function nodeMajor(version) {
+  const match = /^v?(\d+)\./.exec(String(version || ""));
+  return match ? Number(match[1]) : null;
+}
+
+if (artifactsIndex !== -1 && !args[artifactsIndex + 1]) fail("--artifacts requires a directory");
+if (!fs.existsSync(artifactsRoot)) {
+  fail(`${artifactsRoot} does not exist; download CI artifacts there or pass --artifacts <dir>`);
+}
+if (!fs.statSync(artifactsRoot).isDirectory()) fail(`${artifactsRoot} is not a directory`);
+if (!fs.existsSync(manifestPath)) fail(`${manifestPath} does not exist`);
+
+const manifest = readJson(manifestPath);
+const evidenceFiles = walk(artifactsRoot);
+if (!evidenceFiles.length) fail(`no ci-evidence.json files found under ${artifactsRoot}`);
+
+const byMatrix = new Map();
+
+for (const evidencePath of evidenceFiles) {
+  const evidence = readJson(evidencePath);
+  const dir = path.dirname(evidencePath);
+  const os = evidence.runner?.os;
+  const major = nodeMajor(evidence.node?.version);
+  const key = `${os}|${major}`;
+
+  if (!requiredOs.includes(os) || !requiredNodeMajors.includes(major)) continue;
+  if (byMatrix.has(key)) fail(`duplicate evidence for ${os} Node ${major}`);
+
+  const resultsPath = path.join(dir, "wpt-results.json");
+  const reportPath = path.join(dir, "wpt-report.md");
+  const artifactManifestPath = path.join(dir, "wpt-manifest.json");
+  const manifestTextPath = path.join(dir, "wpt-manifest.txt");
+
+  for (const requiredPath of [resultsPath, reportPath, artifactManifestPath, manifestTextPath]) {
+    if (!fs.existsSync(requiredPath)) fail(`${path.relative(root, requiredPath)} is missing`);
+  }
+
+  const artifactManifest = readJson(artifactManifestPath);
+  const results = readJson(resultsPath);
+  const retries = Array.isArray(results.results)
+    ? results.results.filter((result) => Number(result.retries) > 0).length
+    : null;
+
+  if (artifactManifest.libdatachannelCommit !== manifest.libdatachannelCommit) {
+    fail(`${key} libdatachannel pin mismatch`);
+  }
+  if (artifactManifest.wptCommit !== manifest.wptCommit) fail(`${key} WPT pin mismatch`);
+  if (artifactManifest.expectedSelectedSubtests !== manifest.expectedSelectedSubtests) {
+    fail(`${key} selected subtest count mismatch`);
+  }
+  if (!Array.isArray(results.results)) fail(`${key} WPT result artifact is invalid`);
+  if (results.results.length !== results.total) fail(`${key} result length mismatch`);
+  if (results.total !== manifest.expectedSelectedSubtests) fail(`${key} WPT total mismatch`);
+  if (results.pass !== results.total || results.fail !== 0 || retries !== 0) {
+    fail(
+      `${key} WPT is not strict-green: pass=${results.pass} total=${results.total} fail=${results.fail} retries=${retries}`,
+    );
+  }
+  if (evidence.pins?.libdatachannel !== manifest.libdatachannelCommit) {
+    fail(`${key} evidence libdatachannel pin mismatch`);
+  }
+  if (evidence.pins?.wpt !== manifest.wptCommit) fail(`${key} evidence WPT pin mismatch`);
+  if (
+    evidence.wpt?.total !== manifest.expectedSelectedSubtests ||
+    evidence.wpt?.pass !== manifest.expectedSelectedSubtests ||
+    evidence.wpt?.fail !== 0 ||
+    evidence.wpt?.retries !== 0
+  ) {
+    fail(`${key} evidence WPT summary is not strict-green`);
+  }
+
+  byMatrix.set(key, { os, major, evidencePath });
+}
+
+const missing = [];
+for (const os of requiredOs) {
+  for (const major of requiredNodeMajors) {
+    if (!byMatrix.has(`${os}|${major}`)) missing.push(`${os} Node ${major}`);
+  }
+}
+
+if (missing.length) fail(`missing matrix evidence: ${missing.join(", ")}`);
+
+console.log(
+  `CI evidence verified: ${byMatrix.size}/${requiredOs.length * requiredNodeMajors.length} matrix jobs strict-green`,
+);

package/scripts/check-native-integration.js

@@ -0,0 +1,124 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const root = path.resolve(__dirname, "..");
+const addonPath = path.join(root, "src", "native", "addon.cc");
+const cmakePath = path.join(root, "CMakeLists.txt");
+const manifestPath = path.join(root, "wpt-manifest.json");
+const packagePath = path.join(root, "package.json");
+
+const addon = fs.readFileSync(addonPath, "utf8");
+const cmake = fs.readFileSync(cmakePath, "utf8");
+const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+const pkg = JSON.parse(fs.readFileSync(packagePath, "utf8"));
+
+function fail(message) {
+  console.error(`Native integration check failed: ${message}`);
+  process.exit(1);
+}
+
+function requireMatch(name, value, pattern) {
+  if (!pattern.test(value)) fail(`${name} is missing`);
+}
+
+function forbidMatch(name, value, pattern) {
+  const match = pattern.exec(value);
+  if (match) fail(`${name} is forbidden: ${match[0]}`);
+}
+
+requireMatch(
+  "node-addon-api dependency",
+  JSON.stringify(pkg.dependencies || {}),
+  /"node-addon-api"\s*:/,
+);
+requireMatch(
+  "detect-libc runtime dependency",
+  JSON.stringify(pkg.dependencies || {}),
+  /"detect-libc"\s*:/,
+);
+requireMatch(
+  "cmake-js source-build dependency",
+  JSON.stringify(pkg.dependencies || {}),
+  /"cmake-js"\s*:/,
+);
+requireMatch("native install script", JSON.stringify(pkg.scripts || {}), /install-native\.js/);
+requireMatch("prebuild package script", JSON.stringify(pkg.scripts || {}), /package-prebuild\.js/);
+requireMatch("prebuild check script", JSON.stringify(pkg.scripts || {}), /check-prebuilds\.js/);
+requireMatch("native <napi.h> include", addon, /#include\s+<napi\.h>/);
+requireMatch("Node-API module initializer", addon, /\bNODE_API_MODULE\s*\(/);
+requireMatch("ThreadSafeFunction dispatcher", addon, /Napi::ThreadSafeFunction::New/);
+requireMatch("nonblocking callback dispatch", addon, /\.NonBlockingCall\s*\(/);
+requireMatch("dispatcher release on close", addon, /\.Release\s*\(/);
+requireMatch("weak callback captures", addon, /\[weak\]/);
+requireMatch("peer callback reset", addon, /peerConnection->resetCallbacks\s*\(\)/);
+requireMatch("channel callback reset", addon, /->resetCallbacks\s*\(\)/);
+
+forbidMatch("direct V8 namespace usage", addon, /\bv8::/);
+forbidMatch("direct V8 include", addon, /#include\s+[<"]v8(?:-[^>"]+)?\.h[>"]/);
+forbidMatch("direct Node addon include", addon, /#include\s+[<"]node(?:_object_wrap)?\.h[>"]/);
+forbidMatch("NAN include", addon, /#include\s+[<"]nan\.h[>"]/);
+forbidMatch("NAN namespace usage", addon, /\bNan::/);
+forbidMatch("non-Node-API module initializer", addon, /\bNODE_MODULE\s*\(/);
+
+const callbackCallMatches = [...addon.matchAll(/\bcallback\.Call\s*\(/g)];
+if (callbackCallMatches.length !== 1) {
+  fail(
+    `expected exactly one callback.Call site inside EventDispatcher::Dispatch, found ${callbackCallMatches.length}`,
+  );
+}
+
+const cmakePinMatch = /set\s*\(\s*LIBDATACHANNEL_PINNED_COMMIT\s+"([0-9a-f]{40})"/i.exec(cmake);
+if (!cmakePinMatch) fail("CMake libdatachannel pin is missing");
+const cmakePin = cmakePinMatch[1];
+if (cmakePin !== manifest.libdatachannelCommit) {
+  fail(
+    `CMake libdatachannel pin ${cmakePin} does not match manifest ${manifest.libdatachannelCommit}`,
+  );
+}
+
+requireMatch(
+  "FetchContent libdatachannel fallback",
+  cmake,
+  /FetchContent_Declare\s*\(\s*libdatachannel_pinned[\s\S]*GIT_TAG\s+"\$\{LIBDATACHANNEL_PINNED_COMMIT\}"/,
+);
+requireMatch(
+  "local checkout pin verification",
+  cmake,
+  /verify_libdatachannel_pin\s*\(\s*"\$\{LIBDATACHANNEL_RESOLVED_SOURCE_DIR\}"\s*\)/,
+);
+requireMatch(
+  "NO_MEDIA scoped build",
+  cmake,
+  /set\s*\(\s*NO_MEDIA\s+ON\s+CACHE\s+BOOL\s+""\s+FORCE\s*\)/,
+);
+requireMatch(
+  "NO_WEBSOCKET scoped build",
+  cmake,
+  /set\s*\(\s*NO_WEBSOCKET\s+ON\s+CACHE\s+BOOL\s+""\s+FORCE\s*\)/,
+);
+requireMatch("Node-API version definition", cmake, /NAPI_VERSION=\$\{WEBRTC_NODE_NAPI_VERSION\}/);
+requireMatch("prebuild napi build version", cmake, /napi_build_version/);
+requireMatch("release static OpenSSL option", cmake, /WEBRTC_NODE_STATIC_OPENSSL/);
+requireMatch("node-addon-api include discovery", cmake, /require\('node-addon-api'\)\.include_dir/);
+requireMatch("static libdatachannel target", cmake, /LibDataChannel::LibDataChannelStatic/);
+
+const localLibDataChannel = path.join(root, "libdatachannel");
+if (fs.existsSync(path.join(localLibDataChannel, ".git"))) {
+  const git = spawnSync("git", ["-C", localLibDataChannel, "rev-parse", "HEAD"], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  if (git.status !== 0)
+    fail(`could not read local libdatachannel commit: ${git.stderr || git.error?.message}`);
+  const actual = git.stdout.trim();
+  if (actual !== cmakePin) {
+    fail(`local libdatachannel checkout is ${actual}, expected ${cmakePin}`);
+  }
+}
+
+console.log(
+  `Native integration verified: Node-API addon, TSFN dispatch, libdatachannel ${cmakePin}`,
+);

package/scripts/check-package-artifact.js

@@ -0,0 +1,91 @@
+"use strict";
+
+const { spawnSync } = require("node:child_process");
+
+function fail(message) {
+  console.error(`Package artifact check failed: ${message}`);
+  process.exit(1);
+}
+
+const npmCommand = process.env.npm_execpath ? process.execPath : "npm";
+const npmArgs = process.env.npm_execpath
+  ? [process.env.npm_execpath, "pack", "--dry-run", "--json"]
+  : ["pack", "--dry-run", "--json"];
+const result = spawnSync(npmCommand, npmArgs, {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "pipe"],
+});
+
+if (result.error) fail(result.error.message);
+if (result.status !== 0 || result.signal) {
+  fail(result.stderr.trim() || result.stdout.trim() || `npm pack exited with ${result.status}`);
+}
+
+let payload;
+try {
+  payload = JSON.parse(result.stdout);
+} catch (error) {
+  fail(`could not parse npm pack JSON: ${error.message}`);
+}
+
+const artifact = payload?.[0];
+if (!artifact || !Array.isArray(artifact.files)) fail("npm pack did not return file metadata");
+
+const files = new Set(artifact.files.map((file) => file.path.replace(/\\/g, "/")));
+const requiredFiles = [
+  "package.json",
+  "README.md",
+  "LICENSE",
+  "CMakeLists.txt",
+  "index.d.ts",
+  "lib/index.js",
+  "lib/load-native.js",
+  "src/native/addon.cc",
+  "scripts/check-prebuilds.js",
+  "scripts/install-native.js",
+  "scripts/package-prebuild.js",
+  "scripts/run-wpt-smoke.js",
+  "examples/datachannel.js",
+  "docs/README.md",
+  "docs/architecture.md",
+  "docs/conformance.md",
+  "docs/development.md",
+  "docs/divergences.md",
+  "wpt-manifest.json",
+];
+
+for (const file of requiredFiles) {
+  if (!files.has(file)) fail(`missing required file ${file}`);
+}
+
+const forbiddenPrefixes = [
+  ".github/",
+  "build/",
+  "ci-artifacts/",
+  "coverage/",
+  "libdatachannel/",
+  "node_modules/",
+  "prebuild-artifacts/",
+  "prebuilds/",
+  "test/",
+  "wpt/",
+];
+const forbiddenFiles = new Set([
+  "AGENTS.md",
+  "CONTRIBUTING.md",
+  "SECURITY.md",
+  "ci-evidence.json",
+  "wpt-results.json",
+  "wpt-report.md",
+  "wpt-manifest.txt",
+]);
+
+for (const file of files) {
+  if (forbiddenFiles.has(file)) fail(`forbidden file included: ${file}`);
+  const forbiddenPrefix = forbiddenPrefixes.find((prefix) => file.startsWith(prefix));
+  if (forbiddenPrefix) fail(`forbidden path included: ${file}`);
+}
+
+console.log(
+  `Package artifact verified: ${artifact.files.length} files, ${artifact.unpackedSize} bytes unpacked`,
+);

package/scripts/check-prebuilds.js

@@ -0,0 +1,31 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..");
+const packageJson = require("../package.json");
+const prebuildsDir = path.join(root, "prebuild-artifacts");
+const requiredTargets = [
+  "linux-x64-glibc",
+  "linux-x64-musl",
+  "darwin-x64",
+  "darwin-arm64",
+  "win32-x64",
+];
+
+function fail(message) {
+  console.error(`Prebuild check failed: ${message}`);
+  process.exit(1);
+}
+
+for (const target of requiredTargets) {
+  const file = path.join(
+    prebuildsDir,
+    `webrtc-node-v${packageJson.version}-napi-v8-${target}.tar.gz`,
+  );
+  if (!fs.existsSync(file)) fail(`missing ${path.relative(root, file).replace(/\\/g, "/")}`);
+  if (fs.statSync(file).size === 0) fail(`empty ${path.relative(root, file).replace(/\\/g, "/")}`);
+}
+
+console.log(`Prebuild release assets verified: ${requiredTargets.join(", ")}`);