@xtr-dev/rondevu-client 0.21.13 → 0.21.16

package/dist/api/batcher.d.ts

@@ -1,16 +1,23 @@
 /**
  * RPC Request Batcher with throttling
  *
- * Collects RPC requests over a short time window and sends them efficiently.
- *
- * Due to server authentication design (signature covers method+params),
- * authenticated requests are sent individually while unauthenticated
- * requests can be truly batched together.
+ * Collects RPC requests over a short time window and sends them in a single
+ * HTTP request. Each request includes its own auth credentials in the JSON body,
+ * allowing true batching of authenticated requests.
  */
 export interface RpcRequest {
     method: string;
     params?: any;
 }
+/**
+ * Per-request authentication credentials
+ */
+export interface RequestAuth {
+    publicKey: string;
+    timestamp: number;
+    nonce: string;
+    signature: string;
+}
 export interface RpcResponse {
     success: boolean;
     result?: any;
@@ -20,12 +27,16 @@ export interface RpcResponse {
 export interface BatcherOptions {
     /** Delay in ms before flushing queued requests (default: 10) */
     delay?: number;
-    /** Maximum batch size for unauthenticated requests (default: 50) */
+    /** Maximum batch size (default: 50) */
     maxBatchSize?: number;
 }
 /**
  * RpcBatcher - Batches RPC requests with throttling
  *
+ * All requests (authenticated and unauthenticated) are batched together
+ * into a single HTTP request. Auth credentials are included per-request
+ * in the JSON body.
+ *
  * @example
  * ```typescript
  * const batcher = new RpcBatcher('https://api.example.com', {
@@ -33,10 +44,10 @@ export interface BatcherOptions {
  *   maxBatchSize: 50
  * })
  *
- * // Requests made within the delay window are batched
+ * // Requests made within the delay window are batched into ONE HTTP call
  * const [result1, result2] = await Promise.all([
- *   batcher.add({ method: 'getOffer', params: {...} }, null),
- *   batcher.add({ method: 'getOffer', params: {...} }, null)
+ *   batcher.add({ method: 'publish', params: {...} }, auth1),
+ *   batcher.add({ method: 'discover', params: {...} }, auth2)
  * ])
  * ```
  */
@@ -50,10 +61,10 @@ export declare class RpcBatcher {
     /**
      * Add a request to the batch queue
      * @param request - The RPC request
-     * @param authHeaders - Auth headers for authenticated requests, null for unauthenticated
+     * @param auth - Per-request auth credentials, null for unauthenticated
      * @returns Promise that resolves with the request result
      */
-    add(request: RpcRequest, authHeaders: Record<string, string> | null): Promise<any>;
+    add(request: RpcRequest, auth: RequestAuth | null): Promise<any>;
     /**
      * Schedule a flush after the delay
      */
@@ -63,17 +74,8 @@ export declare class RpcBatcher {
      */
     private flush;
     /**
-     * Process unauthenticated requests in batches
-     */
-    private processUnauthenticatedBatches;
-    /**
-     * Process authenticated requests individually
-     * Each authenticated request needs its own HTTP call because
-     * the signature covers the specific method+params
-     */
-    private processAuthenticatedRequests;
-    /**
-     * Send a batch of requests
+     * Send a batch of requests in a single HTTP call
+     * Each request includes its own auth credentials in the JSON body
      */
     private sendBatch;
     /**

package/dist/api/batcher.js

@@ -1,15 +1,17 @@
 /**
  * RPC Request Batcher with throttling
  *
- * Collects RPC requests over a short time window and sends them efficiently.
- *
- * Due to server authentication design (signature covers method+params),
- * authenticated requests are sent individually while unauthenticated
- * requests can be truly batched together.
+ * Collects RPC requests over a short time window and sends them in a single
+ * HTTP request. Each request includes its own auth credentials in the JSON body,
+ * allowing true batching of authenticated requests.
  */
 /**
  * RpcBatcher - Batches RPC requests with throttling
  *
+ * All requests (authenticated and unauthenticated) are batched together
+ * into a single HTTP request. Auth credentials are included per-request
+ * in the JSON body.
+ *
  * @example
  * ```typescript
  * const batcher = new RpcBatcher('https://api.example.com', {
@@ -17,10 +19,10 @@
  *   maxBatchSize: 50
  * })
  *
- * // Requests made within the delay window are batched
+ * // Requests made within the delay window are batched into ONE HTTP call
  * const [result1, result2] = await Promise.all([
- *   batcher.add({ method: 'getOffer', params: {...} }, null),
- *   batcher.add({ method: 'getOffer', params: {...} }, null)
+ *   batcher.add({ method: 'publish', params: {...} }, auth1),
+ *   batcher.add({ method: 'discover', params: {...} }, auth2)
  * ])
  * ```
  */
@@ -35,12 +37,12 @@ export class RpcBatcher {
     /**
      * Add a request to the batch queue
      * @param request - The RPC request
-     * @param authHeaders - Auth headers for authenticated requests, null for unauthenticated
+     * @param auth - Per-request auth credentials, null for unauthenticated
      * @returns Promise that resolves with the request result
      */
-    add(request, authHeaders) {
+    add(request, auth) {
         return new Promise((resolve, reject) => {
-            this.queue.push({ request, authHeaders, resolve, reject });
+            this.queue.push({ request, auth, resolve, reject });
             this.scheduleFlush();
         });
     }
@@ -63,59 +65,35 @@ export class RpcBatcher {
             return;
         const items = this.queue;
         this.queue = [];
-        // Separate authenticated vs unauthenticated requests
-        const unauthenticated = [];
-        const authenticated = [];
-        for (const item of items) {
-            if (item.authHeaders) {
-                authenticated.push(item);
-            }
-            else {
-                unauthenticated.push(item);
-            }
-        }
-        // Process unauthenticated requests in batches
-        await this.processUnauthenticatedBatches(unauthenticated);
-        // Process authenticated requests individually (each needs unique signature)
-        await this.processAuthenticatedRequests(authenticated);
-    }
-    /**
-     * Process unauthenticated requests in batches
-     */
-    async processUnauthenticatedBatches(items) {
-        if (items.length === 0)
-            return;
-        // Split into chunks of maxBatchSize
+        // Split into chunks of maxBatchSize and send each chunk
         for (let i = 0; i < items.length; i += this.maxBatchSize) {
             const chunk = items.slice(i, i + this.maxBatchSize);
-            await this.sendBatch(chunk, null);
+            await this.sendBatch(chunk);
         }
     }
     /**
-     * Process authenticated requests individually
-     * Each authenticated request needs its own HTTP call because
-     * the signature covers the specific method+params
-     */
-    async processAuthenticatedRequests(items) {
-        // Send all authenticated requests in parallel, each as its own batch of 1
-        await Promise.all(items.map(item => this.sendBatch([item], item.authHeaders)));
-    }
-    /**
-     * Send a batch of requests
+     * Send a batch of requests in a single HTTP call
+     * Each request includes its own auth credentials in the JSON body
      */
-    async sendBatch(items, authHeaders) {
+    async sendBatch(items) {
         try {
-            const requests = items.map(item => item.request);
-            const headers = {
-                'Content-Type': 'application/json',
-            };
-            if (authHeaders) {
-                Object.assign(headers, authHeaders);
-            }
+            // Build wire requests with per-request auth
+            const wireRequests = items.map(item => {
+                const wireReq = {
+                    method: item.request.method,
+                    params: item.request.params,
+                };
+                if (item.auth) {
+                    wireReq.auth = item.auth;
+                }
+                return wireReq;
+            });
             const response = await fetch(`${this.baseUrl}/rpc`, {
                 method: 'POST',
-                headers,
-                body: JSON.stringify(requests), // Always send as array
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify(wireRequests),
             });
             if (!response.ok) {
                 const error = new Error(`HTTP ${response.status}: ${response.statusText}`);

package/dist/api/client.d.ts

@@ -4,7 +4,7 @@
 import { CryptoAdapter, KeyPair } from '../crypto/adapter.js';
 import { BatcherOptions } from './batcher.js';
 export type { KeyPair } from '../crypto/adapter.js';
-export type { BatcherOptions } from './batcher.js';
+export type { BatcherOptions, RequestAuth } from './batcher.js';
 export interface OfferRequest {
     sdp: string;
 }
@@ -96,7 +96,7 @@ export declare class RondevuAPI {
      */
     private generateNonce;
     /**
-     * Generate authentication headers for RPC request
+     * Generate per-request authentication credentials
      * Uses Ed25519 signature with nonce for replay protection
      *
      * Security notes:
@@ -110,10 +110,11 @@ export declare class RondevuAPI {
      *   - Each nonce can only be used once within the timestamp validity window
      *   - Server maintains nonce cache with expiration matching timestamp window
      */
-    private generateAuthHeaders;
+    private generateAuth;
     /**
      * Execute RPC call via batcher
      * Requests are batched with throttling for efficiency
+     * All requests within the batch delay window are sent in a single HTTP call
      */
     private rpc;
     /**
@@ -147,6 +148,15 @@ export declare class RondevuAPI {
     deleteOffer(offerId: string): Promise<{
         success: boolean;
     }>;
+    /**
+     * Update tags for all offers owned by this identity
+     * @param tags New tags to set on all offers
+     * @returns Number of offers updated
+     */
+    updateOfferTags(tags: string[]): Promise<{
+        success: boolean;
+        count: number;
+    }>;
     /**
      * Answer an offer
      * @param offerId The offer ID to answer

package/dist/api/client.js

@@ -128,7 +128,7 @@ export class RondevuAPI {
         return this.crypto.bytesToHex(randomBytes);
     }
     /**
-     * Generate authentication headers for RPC request
+     * Generate per-request authentication credentials
      * Uses Ed25519 signature with nonce for replay protection
      *
      * Security notes:
@@ -142,25 +142,26 @@ export class RondevuAPI {
      *   - Each nonce can only be used once within the timestamp validity window
      *   - Server maintains nonce cache with expiration matching timestamp window
      */
-    async generateAuthHeaders(request) {
+    async generateAuth(request) {
         const timestamp = Date.now();
         const nonce = this.generateNonce();
         // Build message and generate Ed25519 signature
         const message = this.buildSignatureMessage(timestamp, nonce, request.method, request.params);
         const signature = await this.crypto.signMessage(this.keyPair.privateKey, message);
         return {
-            'X-PublicKey': this.keyPair.publicKey,
-            'X-Timestamp': timestamp.toString(),
-            'X-Nonce': nonce,
-            'X-Signature': signature,
+            publicKey: this.keyPair.publicKey,
+            timestamp,
+            nonce,
+            signature,
         };
     }
     /**
      * Execute RPC call via batcher
      * Requests are batched with throttling for efficiency
+     * All requests within the batch delay window are sent in a single HTTP call
      */
-    async rpc(request, authHeaders) {
-        return this.batcher.add(request, authHeaders);
+    async rpc(request, auth) {
+        return this.batcher.add(request, auth);
     }
     // ============================================
     // Identity Management (Ed25519 Public Key)
@@ -191,8 +192,8 @@ export class RondevuAPI {
                 ttl: request.ttl,
             },
         };
-        const authHeaders = await this.generateAuthHeaders(rpcRequest);
-        return await this.rpc(rpcRequest, authHeaders);
+        const auth = await this.generateAuth(rpcRequest);
+        return await this.rpc(rpcRequest, auth);
     }
     /**
      * Discover offers by tags
@@ -208,8 +209,8 @@ export class RondevuAPI {
                 offset: request.offset,
             },
         };
-        const authHeaders = await this.generateAuthHeaders(rpcRequest);
-        return await this.rpc(rpcRequest, authHeaders);
+        const auth = await this.generateAuth(rpcRequest);
+        return await this.rpc(rpcRequest, auth);
     }
     /**
      * Count available offers by tags
@@ -225,8 +226,8 @@ export class RondevuAPI {
                 ...(request.unique !== undefined && { unique: request.unique }),
             },
         };
-        const authHeaders = await this.generateAuthHeaders(rpcRequest);
-        return await this.rpc(rpcRequest, authHeaders);
+        const auth = await this.generateAuth(rpcRequest);
+        return await this.rpc(rpcRequest, auth);
     }
     /**
      * Delete an offer by ID
@@ -236,8 +237,21 @@ export class RondevuAPI {
             method: 'deleteOffer',
             params: { offerId },
         };
-        const authHeaders = await this.generateAuthHeaders(request);
-        return await this.rpc(request, authHeaders);
+        const auth = await this.generateAuth(request);
+        return await this.rpc(request, auth);
+    }
+    /**
+     * Update tags for all offers owned by this identity
+     * @param tags New tags to set on all offers
+     * @returns Number of offers updated
+     */
+    async updateOfferTags(tags) {
+        const request = {
+            method: 'updateOfferTags',
+            params: { tags },
+        };
+        const auth = await this.generateAuth(request);
+        return await this.rpc(request, auth);
     }
     // ============================================
     // WebRTC Signaling
@@ -253,8 +267,8 @@ export class RondevuAPI {
             method: 'answerOffer',
             params: { offerId, sdp, matchedTags },
         };
-        const authHeaders = await this.generateAuthHeaders(request);
-        await this.rpc(request, authHeaders);
+        const auth = await this.generateAuth(request);
+        await this.rpc(request, auth);
     }
     /**
      * Get answer for a specific offer (offerer polls this)
@@ -265,8 +279,8 @@ export class RondevuAPI {
                 method: 'getOfferAnswer',
                 params: { offerId },
             };
-            const authHeaders = await this.generateAuthHeaders(request);
-            return await this.rpc(request, authHeaders);
+            const auth = await this.generateAuth(request);
+            return await this.rpc(request, auth);
         }
         catch (err) {
             if (err.message.includes('not yet answered')) {
@@ -283,8 +297,8 @@ export class RondevuAPI {
             method: 'poll',
             params: { since },
         };
-        const authHeaders = await this.generateAuthHeaders(request);
-        return await this.rpc(request, authHeaders);
+        const auth = await this.generateAuth(request);
+        return await this.rpc(request, auth);
     }
     /**
      * Add ICE candidates to a specific offer
@@ -294,8 +308,8 @@ export class RondevuAPI {
             method: 'addIceCandidates',
             params: { offerId, candidates },
         };
-        const authHeaders = await this.generateAuthHeaders(request);
-        return await this.rpc(request, authHeaders);
+        const auth = await this.generateAuth(request);
+        return await this.rpc(request, auth);
     }
     /**
      * Get ICE candidates for a specific offer
@@ -305,8 +319,8 @@ export class RondevuAPI {
             method: 'getIceCandidates',
             params: { offerId, since },
         };
-        const authHeaders = await this.generateAuthHeaders(request);
-        const result = await this.rpc(request, authHeaders);
+        const auth = await this.generateAuth(request);
+        const result = await this.rpc(request, auth);
         return {
             candidates: result.candidates || [],
             offerId: result.offerId,

package/dist/connections/answerer.d.ts

@@ -15,6 +15,8 @@ export interface AnswererOptions {
     webrtcAdapter?: WebRTCAdapter;
     config?: Partial<ConnectionConfig>;
     matchedTags?: string[];
+    /** Callback invoked when RTCPeerConnection is created, before signaling starts */
+    onPeerConnectionCreated?: (pc: RTCPeerConnection) => void;
 }
 /**
  * Answerer connection - processes offers and creates answers
@@ -26,6 +28,7 @@ export declare class AnswererConnection extends RondevuConnection {
     private offerId;
     private offerSdp;
     private matchedTags?;
+    private onPeerConnectionCreated?;
     constructor(options: AnswererOptions);
     /**
      * Initialize the connection by processing offer and creating answer

package/dist/connections/answerer.js

@@ -15,6 +15,7 @@ export class AnswererConnection extends RondevuConnection {
         this.offerId = options.offerId;
         this.offerSdp = options.offerSdp;
         this.matchedTags = options.matchedTags;
+        this.onPeerConnectionCreated = options.onPeerConnectionCreated;
     }
     /**
      * Initialize the connection by processing offer and creating answer
@@ -25,6 +26,11 @@ export class AnswererConnection extends RondevuConnection {
         this.createPeerConnection();
         if (!this.pc)
             throw new Error('Peer connection not created');
+        // Call the callback to allow creating negotiated data channels
+        // This must happen BEFORE signaling starts so channels exist on both sides
+        if (this.onPeerConnectionCreated) {
+            this.onPeerConnectionCreated(this.pc);
+        }
         // Setup ondatachannel handler BEFORE setting remote description
         // This is critical to avoid race conditions
         this.pc.ondatachannel = event => {

package/dist/core/offer-pool.d.ts

@@ -72,9 +72,9 @@ export declare class OfferPool extends EventEmitter<OfferPoolEvents> {
      */
     getOfferCount(): number;
     /**
-     * Update tags for new offers
-     * Existing offers keep their old tags until they expire/rotate
-     * New offers created during fill will use the updated tags
+     * Update tags for all offers (local and server-side)
+     * Updates existing offers on the server immediately for discoverability
+     * New offers created during fill will also use the updated tags
      */
     updateTags(newTags: string[]): void;
     /**

package/dist/core/offer-pool.js

@@ -68,13 +68,23 @@ export class OfferPool extends EventEmitter {
         return this.activeConnections.size;
     }
     /**
-     * Update tags for new offers
-     * Existing offers keep their old tags until they expire/rotate
-     * New offers created during fill will use the updated tags
+     * Update tags for all offers (local and server-side)
+     * Updates existing offers on the server immediately for discoverability
+     * New offers created during fill will also use the updated tags
      */
     updateTags(newTags) {
         this.debug(`Updating tags: ${newTags.join(', ')}`);
         this.tags = newTags;
+        // Update tags on existing offers via server API
+        // Fire and forget - errors are logged but don't block
+        this.api
+            .updateOfferTags(newTags)
+            .then(result => {
+            this.debug(`Server updated ${result.count} offers with new tags`);
+        })
+            .catch(err => {
+            this.debug('Failed to update offer tags on server:', err);
+        });
     }
     /**
      * Get current tags

package/dist/core/peer.d.ts

@@ -43,6 +43,12 @@ export interface PeerOptions {
     rtcConfig?: RTCConfiguration;
     /** Optional: connection behavior configuration */
     config?: Partial<ConnectionConfig>;
+    /**
+     * Optional callback invoked when RTCPeerConnection is created.
+     * Use this to create negotiated data channels that must exist
+     * before the connection opens (e.g., control channels).
+     */
+    onPeerConnectionCreated?: (pc: RTCPeerConnection) => void;
 }
 /**
  * Internal options passed from Rondevu
@@ -92,6 +98,7 @@ export declare class Peer extends EventEmitter<PeerEventMap> {
     private webrtcAdapter?;
     private connectionConfig?;
     private debugEnabled;
+    private onPeerConnectionCreated?;
     private _state;
     private _peerPublicKey;
     private _offerId;

package/dist/core/peer.js

@@ -50,6 +50,7 @@ export class Peer extends EventEmitter {
         this.webrtcAdapter = options.webrtcAdapter;
         this.connectionConfig = options.config;
         this.debugEnabled = options.debug || false;
+        this.onPeerConnectionCreated = options.onPeerConnectionCreated;
     }
     /**
      * Initialize the peer connection (called internally by Rondevu.peer())
@@ -78,6 +79,9 @@ export class Peer extends EventEmitter {
         this._peerPublicKey = offer.publicKey;
         this._offerId = offer.offerId;
         this.debug(`Selected offer ${offer.offerId} from ${offer.publicKey}`);
+        // Find which of our search tags actually exist on the offer (exact match)
+        const actualMatchedTags = this.tags.filter(searchTag => offer.tags.includes(searchTag));
+        this.debug(`Matched tags: ${actualMatchedTags.join(', ')} (from search: ${this.tags.join(', ')})`);
         // Create the underlying AnswererConnection
         this.connection = new AnswererConnection({
             api: this.api,
@@ -94,7 +98,8 @@ export class Peer extends EventEmitter {
                 ...this.connectionConfig,
                 debug: this.debugEnabled,
             },
-            matchedTags: this.tags, // Pass the tags we used to discover this offer
+            matchedTags: actualMatchedTags.length > 0 ? actualMatchedTags : undefined,
+            onPeerConnectionCreated: this.onPeerConnectionCreated,
         });
         // Wire up events
         this.setupEventHandlers();

package/dist/core/polling-manager.js

@@ -75,11 +75,6 @@ export class PollingManager extends EventEmitter {
             return;
         try {
             const result = await this.api.poll(this.lastPollTimestamp);
-            // Log poll results for debugging (only when there are results)
-            const iceCount = Object.values(result.iceCandidates).reduce((sum, candidates) => sum + candidates.length, 0);
-            if (result.answers.length > 0 || iceCount > 0) {
-                console.log(`[PollingManager] Poll: ${result.answers.length} answers, ${iceCount} ICE (since: ${this.lastPollTimestamp})`);
-            }
             // Emit answer events
             for (const answer of result.answers) {
                 this.debug(`Poll: answer for ${answer.offerId}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xtr-dev/rondevu-client",
-  "version": "0.21.13",
+  "version": "0.21.16",
   "description": "TypeScript client for Rondevu with durable WebRTC connections, automatic reconnection, and message queuing",
   "type": "module",
   "main": "dist/core/index.js",
@@ -13,7 +13,7 @@
     "lint:fix": "eslint src test --ext .ts,.tsx,.js --fix",
     "format": "prettier --write \"src/**/*.{ts,tsx,js}\" \"test/**/*.{ts,tsx,js}\"",
     "prepublishOnly": "npm run build",
-    "prepare": "husky"
+    "prepare": "npm run build && husky || true"
   },
   "keywords": [
     "webrtc",