pipane 0.1.6 → 0.1.7

package/dist/server/rendezvous/rendezvous-hub.js

@@ -0,0 +1,426 @@
+import { randomBytes } from "node:crypto";
+import { WebSocket } from "ws";
+import { RENDEZVOUS_PROTOCOL_VERSION, decodeBackendCommand, decodeBrowserCommand, encodeRendezvousMessage, } from "../shared/rendezvous-protocol.js";
+import { deriveBackendId, extractDtlsFingerprint, sha256Base64Url, verifyBackendChallenge, verifyBackendIdentityBinding, } from "../server/backend-identity.js";
+import { IceServerProvider, } from "./trust-store.js";
+const MAX_PAIRING_LIFETIME_MS = 15 * 60_000;
+export class RendezvousHub {
+    trustStore;
+    iceServerProvider;
+    registrationTimeoutMs;
+    now;
+    backendHandshakes = new Map();
+    backends = new Map();
+    browserRoutes = new Map();
+    routes = new Map();
+    pairings = new Map();
+    registeredListeners = new Set();
+    constructor(options) {
+        this.trustStore = options.trustStore;
+        this.iceServerProvider = options.iceServerProvider ?? new IceServerProvider();
+        this.registrationTimeoutMs = options.registrationTimeoutMs ?? 10_000;
+        this.now = options.now ?? Date.now;
+    }
+    onBackendRegistered(listener) {
+        this.registeredListeners.add(listener);
+        return () => this.registeredListeners.delete(listener);
+    }
+    isBackendOnline(backendId) {
+        return this.backends.get(backendId)?.socket.readyState === WebSocket.OPEN;
+    }
+    getBackendMetadata(backendId) {
+        return this.backends.get(backendId)?.metadata;
+    }
+    getOpenPairing(pairId) {
+        const pairing = this.pairings.get(pairId);
+        if (!pairing)
+            return undefined;
+        if (pairing.expiresAt <= this.now() || !this.isBackendOnline(pairing.backendId)) {
+            this.pairings.delete(pairId);
+            return undefined;
+        }
+        return { ...pairing };
+    }
+    notifyRevocation(result) {
+        const affectedBackends = result.backendId
+            ? [this.backends.get(result.backendId)].filter((backend) => !!backend)
+            : [...this.backends.values()].filter((backend) => this.trustStore.getBackendOwner(backend.backendId) === result.accountId);
+        for (const backend of affectedBackends) {
+            this.sendBackend(backend.socket, {
+                type: "authorization_revoked",
+                accountId: result.accountId,
+                deviceId: result.deviceId,
+            });
+        }
+        for (const route of [...this.routes.values()]) {
+            if (route.claims.accountId !== result.accountId)
+                continue;
+            if (result.backendId && route.backendId !== result.backendId)
+                continue;
+            if (result.deviceId && route.claims.deviceId !== result.deviceId)
+                continue;
+            this.removeRoute(route);
+            this.sendBrowser(route.browser, {
+                type: "connection_closed",
+                connectionId: route.connectionId,
+                reason: "Authorization revoked",
+            });
+        }
+    }
+    acceptBackend(socket) {
+        const nonce = randomBytes(32).toString("base64url");
+        const timeout = setTimeout(() => {
+            this.sendError(socket, "unauthorized_connection", "Backend registration timed out");
+            socket.close(1008, "Registration timed out");
+        }, this.registrationTimeoutMs);
+        timeout.unref?.();
+        this.backendHandshakes.set(socket, { nonce, timeout });
+        this.sendBackend(socket, { type: "challenge", nonce });
+        socket.on("message", (raw) => this.handleBackendMessage(socket, raw.toString()));
+        socket.on("close", () => this.removeBackendSocket(socket));
+    }
+    acceptBrowser(socket) {
+        socket.on("message", (raw) => this.handleBrowserMessage(socket, raw.toString()));
+        socket.on("close", () => this.removeBrowser(socket, "Browser disconnected"));
+    }
+    close() {
+        for (const handshake of this.backendHandshakes.values())
+            clearTimeout(handshake.timeout);
+        for (const backend of this.backends.values())
+            backend.socket.close(1001, "Rendezvous shutting down");
+        for (const browser of this.browserRoutes.keys())
+            browser.close(1001, "Rendezvous shutting down");
+        this.backendHandshakes.clear();
+        this.backends.clear();
+        this.browserRoutes.clear();
+        this.routes.clear();
+        this.pairings.clear();
+    }
+    handleBackendMessage(socket, raw) {
+        const decoded = decodeBackendCommand(raw);
+        if (!decoded.ok) {
+            this.sendError(socket, decoded.error.code, decoded.error.message);
+            return;
+        }
+        const handshake = this.backendHandshakes.get(socket);
+        if (!handshake) {
+            this.sendError(socket, "unauthorized_connection", "Unknown backend connection");
+            return;
+        }
+        const command = decoded.value;
+        if (!handshake.registered) {
+            if (command.type !== "register_backend") {
+                this.sendError(socket, "unauthorized_connection", "Backend must register before other commands");
+                return;
+            }
+            this.registerBackend(socket, handshake, command.publicKey, command.signature, command.metadata);
+            return;
+        }
+        const backend = handshake.registered;
+        switch (command.type) {
+            case "register_backend":
+                this.sendError(socket, "invalid_message", "Backend is already registered");
+                break;
+            case "open_pairing":
+                this.openPairing(backend, command.pairId, command.expiresAt);
+                break;
+            case "confirm_pairing":
+                this.confirmPairing(backend, command.connectionId);
+                break;
+            case "signal":
+                this.relayBackendSignal(backend, command.connectionId, command.signal);
+                break;
+            case "connection_binding":
+                this.relayBackendBinding(backend, command.connectionId, command.binding);
+                break;
+            case "close_connection":
+                this.closeFromBackend(backend, command.connectionId, command.reason ?? "Backend closed connection");
+                break;
+        }
+    }
+    registerBackend(socket, handshake, publicKey, signature, metadata) {
+        if (!verifyBackendChallenge(publicKey, handshake.nonce, signature)) {
+            this.sendError(socket, "unauthorized_connection", "Invalid backend registration signature");
+            socket.close(1008, "Invalid registration signature");
+            return;
+        }
+        let backendId;
+        try {
+            backendId = deriveBackendId(publicKey);
+        }
+        catch {
+            this.sendError(socket, "invalid_message", "Invalid backend public key");
+            socket.close(1008, "Invalid public key");
+            return;
+        }
+        const previous = this.backends.get(backendId);
+        if (previous && previous.socket !== socket) {
+            this.removeRegisteredBackend(previous, "Backend reconnected");
+            previous.socket.close(4001, "Replaced by a newer connection");
+        }
+        clearTimeout(handshake.timeout);
+        const registered = { backendId, publicKey, metadata, socket };
+        handshake.registered = registered;
+        this.backends.set(backendId, registered);
+        this.sendBackend(socket, {
+            type: "registered",
+            backendId,
+            ticketPublicKey: this.trustStore.ticketPublicKey,
+            iceServers: this.iceServerProvider.issue(backendId),
+        });
+        const pendingRevocation = this.trustStore.getPendingBackendRevocation(backendId);
+        if (pendingRevocation) {
+            this.sendBackend(socket, {
+                type: "authorization_revoked",
+                accountId: pendingRevocation.accountId,
+            });
+        }
+        for (const listener of this.registeredListeners)
+            listener(backendId);
+    }
+    openPairing(backend, pairId, expiresAt) {
+        const now = this.now();
+        if (expiresAt <= now || expiresAt > now + MAX_PAIRING_LIFETIME_MS) {
+            this.sendError(backend.socket, "invalid_pairing", "Pairing expiry is outside the allowed window");
+            return;
+        }
+        const existing = this.getOpenPairing(pairId);
+        if (existing && existing.backendId !== backend.backendId) {
+            this.sendError(backend.socket, "invalid_pairing", "Pairing id is already active");
+            return;
+        }
+        this.pairings.set(pairId, { pairId, backendId: backend.backendId, expiresAt });
+        this.sendBackend(backend.socket, { type: "pairing_opened", pairId, expiresAt });
+    }
+    confirmPairing(backend, connectionId) {
+        const route = this.routeForBackend(backend, connectionId);
+        if (!route)
+            return;
+        if (route.claims.kind !== "pairing" || !route.claims.pairId) {
+            this.sendError(backend.socket, "invalid_pairing", "Connection is not a pairing attempt", connectionId);
+            return;
+        }
+        const pairing = this.getOpenPairing(route.claims.pairId);
+        if (!pairing || pairing.backendId !== backend.backendId) {
+            this.sendError(backend.socket, "invalid_pairing", "Pairing capability is missing or expired", connectionId);
+            return;
+        }
+        try {
+            const pairId = route.claims.pairId;
+            const confirmation = this.trustStore.confirmPairing(route.claims);
+            route.claims = { ...route.claims, accountId: confirmation.accountId };
+            this.pairings.delete(pairId);
+            this.sendBackend(backend.socket, {
+                type: "pairing_confirmed",
+                connectionId,
+                pairId,
+                accountId: confirmation.accountId,
+                deviceId: confirmation.deviceId,
+            });
+        }
+        catch (error) {
+            this.sendError(backend.socket, "invalid_pairing", error instanceof Error ? error.message : String(error), connectionId);
+        }
+    }
+    relayBackendSignal(backend, connectionId, signal) {
+        const route = this.routeForBackend(backend, connectionId);
+        if (!route)
+            return;
+        if (signal.kind === "description") {
+            if (signal.type !== "answer") {
+                this.sendError(backend.socket, "invalid_message", "Backend must send an SDP answer", connectionId);
+                return;
+            }
+            route.answerSdp = signal.sdp;
+        }
+        this.sendBrowser(route.browser, { type: "signal", connectionId, signal });
+    }
+    relayBackendBinding(backend, connectionId, binding) {
+        const route = this.routeForBackend(backend, connectionId);
+        if (!route)
+            return;
+        try {
+            if (!route.offerSdp || !route.answerSdp)
+                throw new Error("SDP exchange is incomplete");
+            if (binding.backendId !== backend.backendId || binding.publicKey !== backend.publicKey || binding.connectionId !== connectionId) {
+                throw new Error("Backend binding identity does not match the route");
+            }
+            if (binding.offerSha256 !== sha256Base64Url(route.offerSdp)
+                || binding.answerSha256 !== sha256Base64Url(route.answerSdp)
+                || binding.dtlsFingerprint !== extractDtlsFingerprint(route.answerSdp)
+                || binding.expiresAt !== route.claims.expiresAt
+                || !verifyBackendIdentityBinding(binding)) {
+                throw new Error("Backend identity binding is invalid");
+            }
+            this.sendBrowser(route.browser, { type: "connection_binding", connectionId, binding });
+        }
+        catch (error) {
+            this.sendError(backend.socket, "invalid_message", error instanceof Error ? error.message : String(error), connectionId);
+            this.closeFromBackend(backend, connectionId, "Backend identity binding failed");
+        }
+    }
+    closeFromBackend(backend, connectionId, reason) {
+        const route = this.routeForBackend(backend, connectionId);
+        if (!route)
+            return;
+        this.removeRoute(route);
+        this.sendBrowser(route.browser, { type: "connection_closed", connectionId, reason });
+    }
+    handleBrowserMessage(socket, raw) {
+        const decoded = decodeBrowserCommand(raw);
+        if (!decoded.ok) {
+            this.sendBrowserError(socket, decoded.error.code, decoded.error.message);
+            return;
+        }
+        const command = decoded.value;
+        if (command.type === "connect_backend") {
+            this.connectBrowser(socket, command.backendId, command.ticket);
+            return;
+        }
+        const route = this.browserRoutes.get(socket);
+        if (!route || route.connectionId !== command.connectionId) {
+            this.sendBrowserError(socket, "unauthorized_connection", "Connection does not belong to this browser", command.connectionId);
+            return;
+        }
+        const backend = this.backends.get(route.backendId);
+        if (!backend || backend.socket.readyState !== WebSocket.OPEN) {
+            this.removeRoute(route);
+            this.sendBrowserError(socket, "backend_offline", "Backend is offline", command.connectionId);
+            return;
+        }
+        if (command.type === "signal") {
+            if (command.signal.kind === "description") {
+                if (command.signal.type !== "offer") {
+                    this.sendBrowserError(socket, "invalid_message", "Browser must send an SDP offer", command.connectionId);
+                    return;
+                }
+                route.offerSdp = command.signal.sdp;
+            }
+            this.sendBackend(backend.socket, { type: "signal", connectionId: command.connectionId, signal: command.signal });
+            return;
+        }
+        this.removeRoute(route);
+        this.sendBackend(backend.socket, {
+            type: "connection_closed",
+            connectionId: command.connectionId,
+            reason: command.reason ?? "Browser closed connection",
+        });
+    }
+    connectBrowser(socket, backendId, ticket) {
+        const backend = this.backends.get(backendId);
+        if (!backend || backend.socket.readyState !== WebSocket.OPEN) {
+            this.sendBrowserError(socket, "backend_offline", "Backend is offline");
+            return;
+        }
+        let claims;
+        try {
+            claims = this.trustStore.consumeRouteTicket(ticket);
+            if (claims.backendId !== backendId)
+                throw new Error("Ticket targets another backend");
+            if (claims.kind === "pairing") {
+                const pairing = claims.pairId ? this.getOpenPairing(claims.pairId) : undefined;
+                if (!pairing || pairing.backendId !== backendId)
+                    throw new Error("Pairing capability is missing or expired");
+            }
+            else if (!claims.accountId
+                || this.trustStore.getBackendOwner(backendId) !== claims.accountId
+                || !this.trustStore.isDeviceActive(claims.deviceId)) {
+                throw new Error("Ticket authorization was revoked");
+            }
+        }
+        catch (error) {
+            this.sendBrowserError(socket, "invalid_ticket", error instanceof Error ? error.message : String(error));
+            return;
+        }
+        if (this.routes.has(claims.connectionId)) {
+            this.sendBrowserError(socket, "invalid_ticket", "Connection id is already active");
+            return;
+        }
+        const previous = this.browserRoutes.get(socket);
+        if (previous) {
+            this.removeRoute(previous);
+            const previousBackend = this.backends.get(previous.backendId);
+            if (previousBackend) {
+                this.sendBackend(previousBackend.socket, {
+                    type: "connection_closed",
+                    connectionId: previous.connectionId,
+                    reason: "Browser opened another connection",
+                });
+            }
+        }
+        const route = { connectionId: claims.connectionId, backendId, browser: socket, ticket, claims };
+        this.routes.set(route.connectionId, route);
+        this.browserRoutes.set(socket, route);
+        this.sendBackend(backend.socket, {
+            type: "connection_request",
+            connectionId: route.connectionId,
+            ticket,
+            iceServers: this.iceServerProvider.issue(backendId),
+        });
+        this.sendBrowser(socket, { type: "backend_connected", backendId, connectionId: route.connectionId });
+    }
+    routeForBackend(backend, connectionId) {
+        const route = this.routes.get(connectionId);
+        if (!route || route.backendId !== backend.backendId) {
+            this.sendError(backend.socket, "unauthorized_connection", "Connection does not belong to this backend", connectionId);
+            return undefined;
+        }
+        return route;
+    }
+    removeBackendSocket(socket) {
+        const handshake = this.backendHandshakes.get(socket);
+        if (!handshake)
+            return;
+        clearTimeout(handshake.timeout);
+        this.backendHandshakes.delete(socket);
+        if (handshake.registered && this.backends.get(handshake.registered.backendId)?.socket === socket) {
+            this.removeRegisteredBackend(handshake.registered, "Backend disconnected");
+        }
+    }
+    removeRegisteredBackend(backend, reason) {
+        if (this.backends.get(backend.backendId)?.socket === backend.socket)
+            this.backends.delete(backend.backendId);
+        for (const [pairId, pairing] of this.pairings) {
+            if (pairing.backendId === backend.backendId)
+                this.pairings.delete(pairId);
+        }
+        for (const route of [...this.routes.values()]) {
+            if (route.backendId !== backend.backendId)
+                continue;
+            this.removeRoute(route);
+            this.sendBrowser(route.browser, { type: "connection_closed", connectionId: route.connectionId, reason });
+        }
+    }
+    removeBrowser(socket, reason) {
+        const route = this.browserRoutes.get(socket);
+        if (!route)
+            return;
+        this.removeRoute(route);
+        const backend = this.backends.get(route.backendId);
+        if (backend)
+            this.sendBackend(backend.socket, { type: "connection_closed", connectionId: route.connectionId, reason });
+    }
+    removeRoute(route) {
+        if (this.routes.get(route.connectionId) === route)
+            this.routes.delete(route.connectionId);
+        if (this.browserRoutes.get(route.browser) === route)
+            this.browserRoutes.delete(route.browser);
+    }
+    sendBackend(socket, payload) {
+        this.send(socket, payload);
+    }
+    sendBrowser(socket, payload) {
+        this.send(socket, payload);
+    }
+    sendError(socket, code, message, connectionId) {
+        this.sendBackend(socket, { type: "error", code, message, connectionId });
+    }
+    sendBrowserError(socket, code, message, connectionId) {
+        this.sendBrowser(socket, { type: "error", code, message, connectionId });
+    }
+    send(socket, payload) {
+        if (socket.readyState !== WebSocket.OPEN)
+            return;
+        socket.send(encodeRendezvousMessage({ protocolVersion: RENDEZVOUS_PROTOCOL_VERSION, ...payload }));
+    }
+}

package/dist/server/rendezvous/server.js

@@ -0,0 +1,247 @@
+import express from "express";
+import { createServer } from "node:http";
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { WebSocketServer } from "ws";
+import { RENDEZVOUS_PROTOCOL_VERSION } from "../shared/rendezvous-protocol.js";
+import { RendezvousHub } from "./rendezvous-hub.js";
+import { IceServerProvider, RendezvousTrustStore, } from "./trust-store.js";
+const BACKEND_PATH = `/v${RENDEZVOUS_PROTOCOL_VERSION}/rendezvous/backend`;
+const BROWSER_PATH = `/v${RENDEZVOUS_PROTOCOL_VERSION}/rendezvous/browser`;
+const MAX_SIGNAL_MESSAGE_BYTES = 256 * 1024;
+const PING_INTERVAL_MS = 30_000;
+export function createRendezvousServer(options = {}) {
+    const app = express();
+    const server = createServer(app);
+    const trustStore = options.trustStore ?? new RendezvousTrustStore(options);
+    const iceServerProvider = new IceServerProvider(options.iceServers, options.turn, options.now);
+    const hub = new RendezvousHub({
+        trustStore,
+        iceServerProvider,
+        registrationTimeoutMs: options.registrationTimeoutMs,
+        now: options.now,
+    });
+    const backendWss = new WebSocketServer({ noServer: true, maxPayload: MAX_SIGNAL_MESSAGE_BYTES });
+    const browserWss = new WebSocketServer({ noServer: true, maxPayload: MAX_SIGNAL_MESSAGE_BYTES });
+    const alive = new WeakMap();
+    app.use(express.json({ limit: "32kb" }));
+    app.use("/v1", (_request, response, next) => {
+        response.setHeader("Cache-Control", "no-store");
+        next();
+    });
+    const track = (socket) => {
+        alive.set(socket, true);
+        socket.on("pong", () => alive.set(socket, true));
+    };
+    backendWss.on("connection", (socket) => {
+        track(socket);
+        hub.acceptBackend(socket);
+    });
+    browserWss.on("connection", (socket) => {
+        track(socket);
+        hub.acceptBrowser(socket);
+    });
+    server.on("upgrade", (request, socket, head) => {
+        const pathname = new URL(request.url ?? "/", "http://localhost").pathname;
+        const target = pathname === BACKEND_PATH
+            ? backendWss
+            : pathname === BROWSER_PATH
+                ? browserWss
+                : undefined;
+        if (!target) {
+            socket.write("HTTP/1.1 404 Not Found\r\nConnection: close\r\n\r\n");
+            socket.destroy();
+            return;
+        }
+        target.handleUpgrade(request, socket, head, (webSocket) => target.emit("connection", webSocket, request));
+    });
+    app.get("/health", (_request, response) => {
+        response.setHeader("Cache-Control", "no-store");
+        response.json({ ok: true });
+    });
+    app.get("/api/rendezvous/backends/:backendId", (request, response) => {
+        const backendId = request.params.backendId;
+        const online = hub.isBackendOnline(backendId);
+        const metadata = hub.getBackendMetadata(backendId);
+        response.status(online ? 200 : 404).json({ backendId, online, ...(metadata ? { metadata } : {}) });
+    });
+    app.get("/v1/pairings/:pairId", route((request, response) => {
+        const pairing = hub.getOpenPairing(param(request, "pairId"));
+        if (!pairing) {
+            response.status(404).json({ error: "Pairing capability is missing or expired" });
+            return;
+        }
+        response.json(pairing);
+    }));
+    app.post("/v1/auth/challenges", route((request, response) => {
+        const challengeRequest = request.body;
+        if (challengeRequest?.purpose === "pair") {
+            const pairing = challengeRequest.pairId ? hub.getOpenPairing(challengeRequest.pairId) : undefined;
+            if (!pairing || pairing.backendId !== challengeRequest.backendId) {
+                response.status(404).json({ error: "Pairing capability is missing or expired" });
+                return;
+            }
+        }
+        else if (challengeRequest?.purpose === "connect"
+            && challengeRequest.backendId
+            && !hub.isBackendOnline(challengeRequest.backendId)) {
+            response.status(404).json({ error: "Backend is offline" });
+            return;
+        }
+        response.json(trustStore.createChallenge(challengeRequest));
+    }));
+    app.post("/v1/pairings/:pairId/tickets", route((request, response) => {
+        const pairing = hub.getOpenPairing(param(request, "pairId"));
+        if (!pairing) {
+            response.status(404).json({ error: "Pairing capability is missing or expired" });
+            return;
+        }
+        const { challengeId, signature } = requireSignatureBody(request.body);
+        const issued = trustStore.issuePairingTicket(challengeId, signature);
+        if (issued.claims.pairId !== pairing.pairId || issued.claims.backendId !== pairing.backendId) {
+            throw new Error("Device challenge does not match this pairing capability");
+        }
+        response.json({ ticket: issued.ticket, iceServers: iceServerProvider.issue(issued.claims.deviceId) });
+    }));
+    app.post("/v1/connections/tickets", route((request, response) => {
+        const { challengeId, signature } = requireSignatureBody(request.body);
+        const issued = trustStore.issueConnectionTicket(challengeId, signature);
+        response.json({ ticket: issued.ticket, iceServers: iceServerProvider.issue(issued.claims.deviceId) });
+    }));
+    app.post("/v1/accounts/backends", route((request, response) => {
+        const { challengeId, signature } = requireSignatureBody(request.body);
+        const backends = trustStore
+            .listAuthorizedBackendIds(challengeId, signature)
+            .map((backendId) => {
+            const metadata = hub.getBackendMetadata(backendId);
+            return {
+                backendId,
+                ...(metadata?.name ? { name: metadata.name } : {}),
+                ...(metadata?.softwareVersion ? { softwareVersion: metadata.softwareVersion } : {}),
+                protocolVersions: metadata?.protocolVersions ?? [],
+                online: hub.isBackendOnline(backendId),
+            };
+        });
+        response.json({ backends });
+    }));
+    app.post("/v1/revocations/devices", route((request, response) => {
+        const { challengeId, signature } = requireSignatureBody(request.body);
+        const result = trustStore.revokeDevice(challengeId, signature);
+        hub.notifyRevocation(result);
+        response.json({ ok: true });
+    }));
+    app.post("/v1/revocations/backends", route((request, response) => {
+        const { challengeId, signature } = requireSignatureBody(request.body);
+        const result = trustStore.revokeBackend(challengeId, signature);
+        hub.notifyRevocation(result);
+        response.json({ ok: true });
+    }));
+    const packagedClientDist = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../client");
+    const clientDist = options.clientDist === false
+        ? undefined
+        : options.clientDist ?? (process.env.NODE_ENV === "production" ? packagedClientDist : undefined);
+    if (clientDist && existsSync(path.join(clientDist, "index.html"))) {
+        app.use(express.static(clientDist));
+        app.use((request, response, next) => {
+            if (request.method === "GET" && (/^\/pair\/[^/]+$/u.test(request.path) || /^\/backend\/[^/]+$/u.test(request.path))) {
+                response.sendFile(path.join(clientDist, "index.html"));
+                return;
+            }
+            next();
+        });
+    }
+    // Translate expected trust failures into stable JSON without exposing stacks.
+    app.use((error, _request, response, _next) => {
+        response.status(400).json({ error: error instanceof Error ? error.message : "Invalid request" });
+    });
+    const pingInterval = setInterval(() => {
+        for (const wss of [backendWss, browserWss]) {
+            for (const socket of wss.clients) {
+                if (alive.get(socket) === false) {
+                    socket.terminate();
+                    continue;
+                }
+                alive.set(socket, false);
+                socket.ping();
+            }
+        }
+    }, options.pingIntervalMs ?? PING_INTERVAL_MS);
+    pingInterval.unref?.();
+    return {
+        app,
+        server,
+        hub,
+        trustStore,
+        listen(port = 0, host = "127.0.0.1") {
+            return new Promise((resolve, reject) => {
+                const onError = (error) => reject(error);
+                server.once("error", onError);
+                server.listen(port, host, () => {
+                    server.off("error", onError);
+                    const address = server.address();
+                    if (!address || typeof address === "string") {
+                        reject(new Error("Rendezvous server did not bind a TCP port"));
+                        return;
+                    }
+                    resolve(address.port);
+                });
+            });
+        },
+        async close() {
+            clearInterval(pingInterval);
+            hub.close();
+            for (const wss of [backendWss, browserWss]) {
+                for (const socket of wss.clients)
+                    socket.terminate();
+            }
+            if (!server.listening)
+                return;
+            await new Promise((resolve, reject) => {
+                server.close((error) => error ? reject(error) : resolve());
+            });
+        },
+    };
+}
+function route(handler) {
+    return (request, response, next) => {
+        Promise.resolve(handler(request, response)).catch(next);
+    };
+}
+function param(request, name) {
+    const value = request.params[name];
+    if (typeof value !== "string" || !value)
+        throw new Error(`Missing ${name}`);
+    return value;
+}
+function requireSignatureBody(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Request body must be an object");
+    const body = value;
+    if (typeof body.challengeId !== "string" || !body.challengeId || typeof body.signature !== "string" || !body.signature) {
+        throw new Error("challengeId and signature are required");
+    }
+    return { challengeId: body.challengeId, signature: body.signature };
+}
+function envUrls(name) {
+    return (process.env[name] ?? "").split(",").map((value) => value.trim()).filter(Boolean);
+}
+const isMain = process.argv[1]
+    && path.resolve(process.argv[1]) === path.resolve(fileURLToPath(import.meta.url));
+if (isMain) {
+    const port = Number.parseInt(process.env.PORT || "8787", 10);
+    const host = process.env.HOST || "0.0.0.0";
+    const stunUrls = envUrls("PIPANE_STUN_URLS");
+    const turnUrls = envUrls("PIPANE_TURN_URLS");
+    const turnSecret = process.env.PIPANE_TURN_SECRET;
+    const rendezvous = createRendezvousServer({
+        iceServers: stunUrls.length > 0 ? [{ urls: stunUrls }] : [],
+        turn: turnUrls.length > 0 && turnSecret ? { urls: turnUrls, secret: turnSecret } : undefined,
+    });
+    void rendezvous.listen(port, host).then((boundPort) => {
+        console.log(`pipane rendezvous listening on http://${host}:${boundPort}`);
+    }).catch((error) => {
+        console.error(error);
+        process.exitCode = 1;
+    });
+}