@voltro/rooms-webtransport 0.0.0-stage → 0.87.0

package/LICENSE

@@ -0,0 +1,57 @@
+Voltro — Proprietary Software License
+
+Copyright (c) 2026 Voltro UG. All rights reserved.
+
+This software and all associated source code, documentation, and other
+materials (the "Software") are the proprietary property of Voltro UG
+("Voltro"). This is NOT open-source software.
+
+Your access to and use of the Software is governed exclusively by the Voltro
+Terms of Service at:
+
+    https://voltro.cloud/legal/terms
+
+By downloading, installing, or using the Software you agree to those Terms.
+Subject to and conditioned on your continued compliance with them, Voltro
+grants you a limited, non-exclusive, non-transferable, non-sublicensable,
+revocable license to use the Software. All rights not expressly granted in the
+Terms are reserved by Voltro. If you do not agree to the Terms, you have no
+license and may not use the Software.
+
+The Terms of Service — including the scope of permitted use, plan
+entitlements, fees, and pricing — may change from time to time. The version in
+force is the one published at the URL above. Commercial terms and pricing are
+NOT part of this notice and are not fixed by, or granted in perpetuity by, the
+version of the Software in which this file appears.
+
+Permitted use — your own software. Voltro is a development framework. You may
+use the Software to build, run, and commercially distribute your own
+applications and services, and to charge your own customers for them, without
+owing Voltro any share of that revenue or any further permission beyond the
+Terms. Applications you build with the Software are yours.
+
+Prohibited use — reselling Voltro. You may NOT redistribute, resell,
+sublicense, publish, or otherwise provide the Software itself — in whole or in
+part, in source or compiled form — to third parties as a library, framework,
+SDK, template, starter, or development tool for them to build upon, whether
+standalone or repackaged. Shipping the Software as a non-separable, bundled
+dependency inside an application you deliver (for example, compiled into your
+deployed app) is permitted; extracting or re-exposing it as a reusable
+component for others is not.
+
+Except as expressly permitted above or by the Terms, you may not copy, modify,
+merge, publish, sublicense, sell, distribute, or create derivative works of the
+Software, in whole or in part.
+
+Third-party open-source components distributed alongside the Software are the
+property of their respective owners and are licensed under their own terms; see
+THIRD-PARTY-NOTICES.md where provided. Nothing in this notice limits your
+rights, or extends Voltro's, in those components.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL
+VOLTRO BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM,
+OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR ITS USE.
+
+For licensing inquiries, contact Voltro UG.

package/README.md

@@ -1,3 +1,18 @@
-# Temporary Holding Version
+# @voltro/rooms-webtransport
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Optional WebTransport (HTTP/3 over QUIC) lane for Voltro Rooms.
+
+```sh
+pnpm add @voltro/rooms-webtransport
+```
+
+That is the whole setup. The Rooms host detects the package, starts its prebuilt
+sidecar and advertises a WebTransport endpoint next to the WebSocket one. Browsers
+that support WebTransport use it and get unreliable datagrams; everything else
+keeps using WebSocket.
+
+- **Development:** `voltro dev` mints a short-lived certificate per run and the
+  browser pins it by digest. No certificate setup.
+- **Production:** WebTransport needs UDP reachability and a certificate the
+  browser trusts. See the Rooms transport docs on voltro.dev.
+- **Platforms:** Linux and macOS (x64, arm64). Elsewhere Rooms stays on WebSocket.

package/SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+We take the security of Voltro and the applications built on it seriously. This
+document explains how to report a vulnerability and what to expect in return.
+
+## Reporting a vulnerability
+
+**Please do not open public issues or discuss suspected vulnerabilities in
+public channels.** Report them privately by email:
+
+**security contact: [support@voltro.dev](mailto:support@voltro.dev)**
+(subject line: `SECURITY`).
+
+Include, where you can:
+
+- the affected package(s) and version(s) (e.g. `@voltro/runtime@x.y.z`);
+- a description of the issue and its impact;
+- a minimal reproduction or proof of concept;
+- any suggested remediation.
+
+If you'd like to encrypt your report, ask in a first plain email and we'll
+arrange a key.
+
+## What to expect
+
+- **Acknowledgement** of your report within **3 business days**.
+- An initial assessment (severity, affected surface) and a remediation plan as
+  soon as we've reproduced the issue.
+- **Coordinated disclosure:** we'll agree a disclosure timeline with you and
+  credit you in the release notes if you wish. Please give us reasonable time to
+  ship a fix before any public disclosure.
+
+We do not currently run a paid bug-bounty program, but we genuinely appreciate
+responsible disclosure and will credit reporters.
+
+## Software Bill of Materials (SBOM)
+
+A CycloneDX SBOM of the third-party runtime dependency graph is generated for the
+published packages (`pnpm gen:sbom` → `sbom.cdx.json`). If your procurement or
+security team needs it, request it at
+[support@voltro.dev](mailto:support@voltro.dev).
+
+## Supported versions
+
+Voltro is pre-1.0 and ships in lockstep: **only the latest published minor of
+each `@voltro/*` package receives security fixes.** Please upgrade to the latest
+release before reporting, and pin exact versions in production.
+
+## Scope
+
+In scope: the published `@voltro/*` packages and the framework's own code.
+
+Out of scope: vulnerabilities in third-party dependencies that are already
+tracked upstream (we monitor these via a production-dependency audit gate in
+CI), and issues that require a non-default, explicitly-unsafe configuration. If
+you're unsure, report it anyway — we'd rather hear about it.

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,11 @@
+# Third-Party Notices — @voltro/rooms-webtransport
+
+This package uses the open-source software listed below. Each is the
+property of its respective copyright holders and is used under the terms of
+its license. This file is provided for attribution; it grants no rights in
+@voltro/rooms-webtransport itself, which is proprietary (see LICENSE).
+
+Generated from the resolved runtime dependency closure (0 packages).
+
+---
+

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/** Resolve one of this package's own dependencies. Bundled into an app's serve bundle, this
+ * module no longer sits next to them (pnpm keeps the platform package under this package), so
+ * the fallback goes through this package as the app at `root` installed it. */
+export declare const resolveOwnDependency: (name: string, from?: string, root?: string) => string;
+
+/** Find this platform's sidecar binary in its optional package. Never downloads,
+ * builds or runs anything; a missing binary is a reason to stay on WebSocket. */
+export declare const resolveRoomsWebTransportSidecar: (platform?: string, resolvePackage?: (name: string) => string) => RoomsWebTransportResolution;
+
+export declare type RoomsWebTransportPlatform = (typeof roomsWebTransportPlatforms)[number];
+
+/** Platforms with a prebuilt sidecar. Others keep Rooms on WebSocket. */
+export declare const roomsWebTransportPlatforms: readonly ["linux-x64", "linux-arm64", "darwin-x64", "darwin-arm64"];
+
+export declare type RoomsWebTransportResolution = {
+    readonly status: 'available';
+    readonly sidecar: RoomsWebTransportSidecar;
+} | {
+    readonly status: 'unsupported-platform';
+    readonly platform: string;
+} | {
+    readonly status: 'binary-missing';
+    readonly platform: RoomsWebTransportPlatform;
+};
+
+export declare interface RoomsWebTransportSidecar {
+    readonly platform: RoomsWebTransportPlatform;
+    readonly executablePath: string;
+}
+
+export { }

package/dist/index.js

@@ -0,0 +1,64 @@
+import { accessSync as e, chmodSync as t, constants as n, statSync as r } from "node:fs";
+import { createRequire as i } from "node:module";
+import { dirname as a, join as o } from "node:path";
+//#region src/index.ts
+var s = Object.freeze([
+	"linux-x64",
+	"linux-arm64",
+	"darwin-x64",
+	"darwin-arm64"
+]), c = (i) => {
+	try {
+		if (!r(i).isFile()) return !1;
+	} catch {
+		return !1;
+	}
+	try {
+		return e(i, n.X_OK), !0;
+	} catch {}
+	try {
+		return t(i, 493), e(i, n.X_OK), !0;
+	} catch {
+		return !1;
+	}
+}, l = (e, t = import.meta.url, n = process.cwd()) => {
+	try {
+		return i(t).resolve(e);
+	} catch (t) {
+		let r;
+		try {
+			r = i(o(n, "package.json")).resolve("@voltro/rooms-webtransport/package.json");
+		} catch {
+			throw t;
+		}
+		return i(r).resolve(e);
+	}
+}, u = (e = `${process.platform}-${process.arch}`, t = (e) => l(e)) => {
+	let n = s.find((t) => t === e);
+	if (n === void 0) return Object.freeze({
+		status: "unsupported-platform",
+		platform: e
+	});
+	let r;
+	try {
+		r = a(t(`@voltro/rooms-webtransport-${n}/package.json`));
+	} catch {
+		return Object.freeze({
+			status: "binary-missing",
+			platform: n
+		});
+	}
+	let i = o(r, "dist", "voltro-rooms-sidecar");
+	return c(i) ? Object.freeze({
+		status: "available",
+		sidecar: Object.freeze({
+			platform: n,
+			executablePath: i
+		})
+	}) : Object.freeze({
+		status: "binary-missing",
+		platform: n
+	});
+};
+//#endregion
+export { l as resolveOwnDependency, u as resolveRoomsWebTransportSidecar, s as roomsWebTransportPlatforms };

package/package.json

@@ -1,6 +1,44 @@
 {
   "name": "@voltro/rooms-webtransport",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.87.0",
+  "description": "Optional WebTransport lane for Voltro Rooms: a prebuilt native sidecar the Rooms host starts on its own; without it Rooms stays on WebSocket.",
+  "keywords": [
+    "voltro",
+    "typescript",
+    "framework"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "homepage": "https://voltro.dev",
+  "bugs": {
+    "email": "support@voltro.dev"
+  },
+  "author": {
+    "name": "Voltro UG",
+    "url": "https://voltro.dev"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "optionalDependencies": {
+    "@voltro/rooms-webtransport-darwin-arm64": "0.87.0",
+    "@voltro/rooms-webtransport-darwin-x64": "0.87.0",
+    "@voltro/rooms-webtransport-linux-arm64": "0.87.0",
+    "@voltro/rooms-webtransport-linux-x64": "0.87.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}