rechrome 1.36.0 → 1.37.0

package/webrtc.js

@@ -0,0 +1,879 @@
+// @bun
+// webrtc.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+import { randomBytes as randomBytes2 } from "crypto";
+
+// secret.ts
+import { hkdfSync, randomBytes, timingSafeEqual } from "crypto";
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var B58 = "[1-9A-HJ-NP-Za-km-z]";
+var BODY_LEN = 22;
+var SUM_LEN = 6;
+var SECRET_BYTES = 16;
+var TOKEN_PATTERN = new RegExp(`\\brech1_${B58}{${BODY_LEN + SUM_LEN}}\\b`, "g");
+var EXACT = new RegExp(`^rech1_(${B58}{${BODY_LEN}})(${B58}{${SUM_LEN}})$`);
+function base58(bytes, width) {
+  let n = 0n;
+  for (const b of bytes)
+    n = n << 8n | BigInt(b);
+  let s = "";
+  while (n > 0n) {
+    s = ALPHABET[Number(n % 58n)] + s;
+    n /= 58n;
+  }
+  if (s.length > width)
+    throw new Error("base58 value wider than its field");
+  return s.padStart(width, "1");
+}
+function unbase58(text, length) {
+  let n = 0n;
+  for (const c of text) {
+    const i = ALPHABET.indexOf(c);
+    if (i < 0)
+      return null;
+    n = n * 58n + BigInt(i);
+  }
+  const out = new Uint8Array(length);
+  for (let i = length - 1;i >= 0; i--) {
+    out[i] = Number(n & 0xffn);
+    n >>= 8n;
+  }
+  return n === 0n ? out : null;
+}
+var CRC_TABLE = (() => {
+  const t = new Uint32Array(256);
+  for (let i = 0;i < 256; i++) {
+    let c = i;
+    for (let k = 0;k < 8; k++)
+      c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+    t[i] = c >>> 0;
+  }
+  return t;
+})();
+function crc32(bytes) {
+  let c = 4294967295;
+  for (const b of bytes)
+    c = CRC_TABLE[(c ^ b) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
+}
+var u32 = (n) => new Uint8Array([n >>> 24, n >>> 16 & 255, n >>> 8 & 255, n & 255]);
+function parseToken(token) {
+  const m = EXACT.exec(token.trim());
+  if (!m)
+    return { ok: false, reason: "format" };
+  const secret = unbase58(m[1], SECRET_BYTES), sum = unbase58(m[2], 4);
+  if (!secret || !sum)
+    return { ok: false, reason: "format" };
+  const expected = u32(crc32(secret));
+  return sum.every((b, i) => b === expected[i]) ? { ok: true, secret } : { ok: false, reason: "checksum" };
+}
+function secretOf(token) {
+  const parsed = parseToken(token);
+  if (!parsed.ok)
+    throw new Error(parsed.reason === "checksum" ? "This rech1_ link is damaged (checksum mismatch): it was copied incompletely or mistyped." : "Not a rech1_ link.");
+  return parsed.secret;
+}
+var derive = (token, label, bytes) => new Uint8Array(hkdfSync("sha256", secretOf(token), new Uint8Array(0), `rech/${label}`, bytes));
+var roomOf = (token) => base58(derive(token, "room", 12), 17);
+var roomAuthOf = (token) => Buffer.from(derive(token, "auth", 32)).toString("hex");
+
+// e2e.ts
+var PROTO = "rech-e2e-1";
+var MAX_CHUNK = 12000;
+var CONFIRM_TIMEOUT_MS = 5000;
+var FLAG_CONFIRM = 1;
+var VER = 1;
+var HEADER_LEN = 14;
+var NONCE_LEN = 12;
+var TAG_LEN = 16;
+var COUNTER_MAX = (1n << 64n) - 1n;
+var subtle = globalThis.crypto.subtle;
+var enc = new TextEncoder;
+var dec = new TextDecoder;
+var concat = (...parts) => {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let o = 0;
+  for (const p of parts) {
+    out.set(p, o);
+    o += p.length;
+  }
+  return out;
+};
+var sha256 = async (bytes) => new Uint8Array(await subtle.digest("SHA-256", bytes));
+function ikmOf(token) {
+  const parsed = parseToken(token);
+  if (!parsed.ok)
+    throw new Error("e2e: invalid share secret");
+  return parsed.secret;
+}
+async function hkdfKey(ikm, salt, info) {
+  const base = await subtle.importKey("raw", ikm, "HKDF", false, ["deriveBits"]);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt, info: enc.encode(info) }, base, 256);
+  return subtle.importKey("raw", bits, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+async function deriveDirKeys(token, transcriptHash) {
+  const ikm = ikmOf(token);
+  return {
+    h2c: await hkdfKey(ikm, transcriptHash, `rech/${PROTO}/key/host->client`),
+    c2h: await hkdfKey(ikm, transcriptHash, `rech/${PROTO}/key/client->host`)
+  };
+}
+var fingerprints = (sdp) => [...sdp.matchAll(/^a=fingerprint:(.*)$/gim)].map((m) => m[1].trim().toLowerCase()).sort();
+var firstAttr = (sdp, name) => (new RegExp(`^a=${name}:(.*)$`, "im").exec(sdp)?.[1] ?? "").trim().toLowerCase();
+async function transcriptHash(offerSdp, answerSdp) {
+  const offer = fingerprints(offerSdp), answer = fingerprints(answerSdp);
+  if (!offer.length || !answer.length)
+    throw new Error("e2e: missing DTLS fingerprint");
+  if ([...offer, ...answer].some((fp) => !fp.startsWith("sha-256")))
+    throw new Error("e2e: non-sha-256 DTLS fingerprint");
+  return sha256(enc.encode(`${PROTO}
+` + `offer=${offer.join(",")};setup=${firstAttr(offerSdp, "setup")};ufrag=${firstAttr(offerSdp, "ice-ufrag")}
+` + `answer=${answer.join(",")};setup=${firstAttr(answerSdp, "setup")};ufrag=${firstAttr(answerSdp, "ice-ufrag")}`));
+}
+var newSendState = () => ({ ctr: 0n });
+var newRecvState = () => ({ last: -1n });
+function nonceOf(ctr) {
+  const n = new Uint8Array(NONCE_LEN);
+  new DataView(n.buffer).setBigUint64(4, ctr, false);
+  return n;
+}
+async function seal(key, state, flags, th, plaintext) {
+  const ctr = state.ctr;
+  if (ctr >= COUNTER_MAX)
+    throw new Error("e2e: nonce counter overflow");
+  state.ctr = ctr + 1n;
+  const nonce = nonceOf(ctr);
+  const header = new Uint8Array(HEADER_LEN);
+  header[0] = VER;
+  header[1] = flags & 255;
+  header.set(nonce, 2);
+  const sealed = new Uint8Array(await subtle.encrypt({ name: "AES-GCM", iv: nonce, additionalData: concat(header, th), tagLength: 128 }, key, plaintext));
+  return concat(header, sealed).buffer;
+}
+async function open(key, frame, th, state) {
+  const buf = frame instanceof Uint8Array ? frame : new Uint8Array(frame);
+  if (buf.length < HEADER_LEN + TAG_LEN)
+    throw new Error("e2e: short frame");
+  if (buf[0] !== VER)
+    throw new Error("e2e: bad version");
+  const header = buf.subarray(0, HEADER_LEN), nonce = buf.subarray(2, HEADER_LEN);
+  const view = new DataView(nonce.buffer, nonce.byteOffset, NONCE_LEN);
+  if (view.getUint32(0, false) !== 0)
+    throw new Error("e2e: bad epoch");
+  const ctr = view.getBigUint64(4, false);
+  const plain = await subtle.decrypt({ name: "AES-GCM", iv: nonce, additionalData: concat(header, th), tagLength: 128 }, key, buf.subarray(HEADER_LEN));
+  if (state.last === -1n && ctr !== 0n)
+    throw new Error("e2e: first frame must be counter-0");
+  if (ctr <= state.last)
+    throw new Error("e2e: replay/reorder");
+  state.last = ctr;
+  return { flags: header[1], plaintext: new Uint8Array(plain) };
+}
+var pack = (obj) => enc.encode(JSON.stringify(obj));
+var unpack = (bytes) => JSON.parse(dec.decode(bytes));
+function randomHex(n) {
+  return Buffer.from(globalThis.crypto.getRandomValues(new Uint8Array(n))).toString("hex");
+}
+
+// webrtc.ts
+var SIGNAL_PROTO = "rech-signal-1";
+var PING = '{"type":"ping"}';
+var KEEPALIVE_MS = 25000;
+var CONNECT_TIMEOUT_MS = 25000;
+var MAX_PEERS_PER_ROOM = 8;
+var DEFAULT_STUN = [{ urls: "stun:stun.cloudflare.com:3478" }, { urls: "stun:stun.l.google.com:19302" }];
+var WEBRTC_RUNTIME_DIR = join(homedir(), ".rechrome", "webrtc");
+var rtcModule;
+function loadRTC(log = (m) => console.error(m)) {
+  return rtcModule ??= (async () => {
+    try {
+      return await import("node-datachannel/polyfill");
+    } catch {}
+    const entry = () => {
+      try {
+        return Bun.resolveSync("node-datachannel/polyfill", WEBRTC_RUNTIME_DIR);
+      } catch {
+        return null;
+      }
+    };
+    let path = entry();
+    if (path)
+      try {
+        return await import(path);
+      } catch {
+        path = null;
+      }
+    log(`[rech] one-time setup: installing WebRTC support (node-datachannel) into ${WEBRTC_RUNTIME_DIR}`);
+    mkdirSync(WEBRTC_RUNTIME_DIR, { recursive: true });
+    writeFileSync(join(WEBRTC_RUNTIME_DIR, "package.json"), JSON.stringify({
+      private: true,
+      dependencies: { "node-datachannel": "^0.32.3" },
+      trustedDependencies: ["node-datachannel"]
+    }, null, 2));
+    const proc = Bun.spawn([process.execPath, "install"], { cwd: WEBRTC_RUNTIME_DIR, stdout: "ignore", stderr: "pipe", env: { ...process.env, BUN_BE_BUN: "1" } });
+    const [status, stderr] = await Promise.all([proc.exited, new Response(proc.stderr).text()]);
+    path = entry();
+    if (status !== 0 || !path)
+      throw new Error(`Could not install WebRTC support (node-datachannel): ${stderr.trim().slice(-400) || `bun install exited ${status}`}`);
+    return import(path);
+  })();
+}
+function iceServersFromEnv(env = process.env) {
+  if (env.RECH_ICE_SERVERS) {
+    try {
+      return JSON.parse(env.RECH_ICE_SERVERS);
+    } catch {
+      throw new Error("RECH_ICE_SERVERS must be a JSON array of {urls, username?, credential?}");
+    }
+  }
+  return DEFAULT_STUN;
+}
+var turnCache = null;
+async function hostIceServers(log, env = process.env) {
+  const base = iceServersFromEnv(env);
+  const { CF_TURN_KEY_ID: keyId, CF_TURN_API_TOKEN: apiToken } = env;
+  if (!keyId || !apiToken)
+    return base;
+  if (turnCache && turnCache.exp > Date.now())
+    return [...base, ...turnCache.servers];
+  try {
+    const r = await fetch(`https://rtc.live.cloudflare.com/v1/turn/keys/${keyId}/credentials/generate-ice-servers`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ ttl: 3600 }),
+      signal: AbortSignal.timeout(5000)
+    });
+    if (!r.ok)
+      throw new Error(`HTTP ${r.status}`);
+    const body = await r.json();
+    const servers = [body.iceServers].flat();
+    turnCache = { servers, exp: Date.now() + 3000000 };
+    return [...base, ...servers];
+  } catch (error) {
+    log(`Cloudflare TURN credentials unavailable, using STUN only: ${error}`);
+    return base;
+  }
+}
+function signalSocketUrl(signal, room) {
+  const u = new URL(signal);
+  u.protocol = u.protocol === "https:" ? "wss:" : "ws:";
+  u.pathname = `${u.pathname.replace(/\/+$/, "")}/${room}`;
+  u.search = "";
+  u.hash = "";
+  return u.toString();
+}
+
+class SealedChannel {
+  dc;
+  role;
+  send = newSendState();
+  recv = newRecvState();
+  sendChain = Promise.resolve();
+  recvChain = Promise.resolve();
+  keys;
+  keysSet;
+  keysReady = new Promise((r) => this.keysSet = r);
+  confirmed = false;
+  confirmWaiters = [];
+  onFrame = () => {};
+  onClose = () => {};
+  closed = false;
+  constructor(dc, role) {
+    this.dc = dc;
+    this.role = role;
+    dc.binaryType = "arraybuffer";
+    dc.onmessage = (e) => {
+      this.recvChain = this.recvChain.then(() => this.receive(e.data)).catch(() => this.close());
+    };
+    dc.onclose = () => this.close();
+  }
+  async setKeys(token, th) {
+    const { h2c, c2h } = await deriveDirKeys(token, th);
+    this.keys = this.role === "host" ? { mine: h2c, theirs: c2h, th } : { mine: c2h, theirs: h2c, th };
+    this.keysSet();
+  }
+  confirm() {
+    const done = new Promise((resolve) => {
+      this.confirmWaiters.push(resolve);
+      setTimeout(() => resolve(false), CONFIRM_TIMEOUT_MS);
+    });
+    this.sendFrame({ t: "confirm", nonce: randomHex(16), proto: "rech-e2e-1" }, FLAG_CONFIRM);
+    return done;
+  }
+  sendFrame(obj, flags = 0) {
+    this.sendChain = this.sendChain.then(async () => {
+      if (this.closed || !this.keys || this.dc.readyState !== "open")
+        return;
+      const frame = await seal(this.keys.mine, this.send, flags, this.keys.th, pack(obj));
+      while (this.dc.bufferedAmount > 4194304 && this.dc.readyState === "open")
+        await new Promise((r) => setTimeout(r, 10));
+      try {
+        this.dc.send(new Uint8Array(frame));
+      } catch {
+        this.close();
+      }
+    }).catch(() => this.close());
+    return this.sendChain;
+  }
+  async receive(data) {
+    if (this.closed)
+      return;
+    if (typeof data === "string")
+      return this.close();
+    await Promise.race([this.keysReady, new Promise((r) => setTimeout(r, CONFIRM_TIMEOUT_MS))]);
+    if (!this.keys)
+      return this.close();
+    const { plaintext } = await open(this.keys.theirs, data, this.keys.th, this.recv);
+    const frame = unpack(plaintext);
+    if (!this.confirmed) {
+      if (frame?.t !== "confirm")
+        return this.close();
+      this.confirmed = true;
+      for (const w of this.confirmWaiters.splice(0))
+        w(true);
+      return;
+    }
+    if (frame?.t === "confirm")
+      return;
+    this.onFrame(frame);
+  }
+  get open() {
+    return !this.closed && this.dc.readyState === "open";
+  }
+  close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    for (const w of this.confirmWaiters.splice(0))
+      w(false);
+    try {
+      this.dc.close();
+    } catch {}
+    this.onClose();
+  }
+}
+
+class SignalSocket {
+  url;
+  hello;
+  onMessage;
+  onClose;
+  ws;
+  timer;
+  constructor(url, hello, onMessage, onClose) {
+    this.url = url;
+    this.hello = hello;
+    this.onMessage = onMessage;
+    this.onClose = onClose;
+  }
+  open() {
+    return new Promise((resolve, reject) => {
+      const ws = new WebSocket(this.url, [SIGNAL_PROTO]);
+      this.ws = ws;
+      let opened = false;
+      ws.onopen = () => {
+        opened = true;
+        ws.send(JSON.stringify({ type: "hello", ...this.hello }));
+        this.timer = setInterval(() => {
+          try {
+            ws.send(PING);
+          } catch {}
+        }, KEEPALIVE_MS);
+        resolve();
+      };
+      ws.onmessage = (e) => {
+        try {
+          const m = JSON.parse(String(e.data));
+          if (m?.type !== "pong")
+            this.onMessage(m);
+        } catch {}
+      };
+      ws.onclose = (e) => {
+        clearInterval(this.timer);
+        if (!opened)
+          reject(new Error(`signal server ${new URL(this.url).host}: ${e.reason || `closed (${e.code})`}`));
+        this.onClose(e.code, e.reason);
+      };
+      ws.onerror = () => {};
+    });
+  }
+  send(obj) {
+    try {
+      this.ws?.send(JSON.stringify(obj));
+    } catch {}
+  }
+  close() {
+    clearInterval(this.timer);
+    try {
+      this.ws?.close();
+    } catch {}
+  }
+}
+
+class WebrtcHost {
+  handler;
+  log;
+  rooms = new Map;
+  constructor(handler, log) {
+    this.handler = handler;
+    this.log = log;
+  }
+  sync(creds) {
+    const wanted = new Map(creds.map((c) => [`${c.signal}\x00${c.token}`, c]));
+    for (const [key, room] of this.rooms)
+      if (!wanted.has(key)) {
+        this.stopRoom(room);
+        this.rooms.delete(key);
+      }
+    for (const [key, cred] of wanted) {
+      if (this.rooms.has(key))
+        continue;
+      const room = { cred, peers: new Map, backoff: 1000, stopped: false };
+      this.rooms.set(key, room);
+      this.connect(room);
+    }
+  }
+  stop() {
+    for (const room of this.rooms.values())
+      this.stopRoom(room);
+    this.rooms.clear();
+  }
+  get size() {
+    return this.rooms.size;
+  }
+  stopRoom(room) {
+    room.stopped = true;
+    clearTimeout(room.retry);
+    room.signal?.close();
+    for (const peer of room.peers.values()) {
+      peer.channel?.close();
+      try {
+        peer.pc.close();
+      } catch {}
+    }
+    room.peers.clear();
+  }
+  async connect(room) {
+    if (room.stopped)
+      return;
+    const { token, signal } = room.cred;
+    const sock = new SignalSocket(signalSocketUrl(signal, roomOf(token)), { role: "host", auth: roomAuthOf(token) }, (m) => void this.onSignal(room, m).catch((e) => this.log(`webrtc ${room.cred.label}: ${e}`)), (code, reason) => {
+      if (room.stopped)
+        return;
+      if (code === 1000 && /replaced/.test(reason)) {
+        this.log(`webrtc ${room.cred.label}: another host took this room over; not reconnecting`);
+        return;
+      }
+      room.retry = setTimeout(() => void this.connect(room), room.backoff);
+      room.backoff = Math.min(room.backoff * 2, 30000);
+    });
+    room.signal = sock;
+    try {
+      await sock.open();
+      room.backoff = 1000;
+    } catch (error) {
+      this.log(`webrtc ${room.cred.label}: ${error instanceof Error ? error.message : error}`);
+    }
+  }
+  async onSignal(room, m) {
+    if (m.type === "peer-join" && typeof m.peer === "string" && m.from === undefined) {
+      if (room.peers.has(m.peer))
+        this.closePeer(room, m.peer);
+      if (room.peers.size >= MAX_PEERS_PER_ROOM) {
+        this.log(`webrtc ${room.cred.label}: too many peers connecting; ignoring ${m.peer}`);
+        return;
+      }
+      return this.startPeer(room, m.peer);
+    }
+    const peer = room.peers.get(m.from);
+    if (!peer)
+      return;
+    if (m.type === "answer" && typeof m.sdp === "string") {
+      await peer.pc.setRemoteDescription({ type: "answer", sdp: m.sdp });
+      const th = await transcriptHash(peer.pc.localDescription.sdp, m.sdp);
+      peer.keysReady(th);
+    } else if (m.type === "candidate" && m.candidate) {
+      await peer.pc.addIceCandidate(m.candidate).catch(() => {});
+    } else if (m.type === "peer-leave" && m.from === undefined && !peer.channel?.confirmed) {
+      this.closePeer(room, m.from);
+    }
+  }
+  closePeer(room, id) {
+    const peer = room.peers.get(id);
+    if (!peer)
+      return;
+    room.peers.delete(id);
+    peer.channel?.close();
+    try {
+      peer.pc.close();
+    } catch {}
+  }
+  async startPeer(room, peerId) {
+    const { RTCPeerConnection } = await loadRTC(this.log);
+    const ice = await hostIceServers(this.log);
+    const pc = new RTCPeerConnection({ iceServers: ice });
+    let keysReady;
+    const keys = new Promise((r) => keysReady = r);
+    const peer = { pc, keysReady };
+    room.peers.set(peerId, peer);
+    const send = (obj) => room.signal?.send({ ...obj, to: peerId });
+    pc.onicecandidate = (e) => {
+      if (e.candidate)
+        send({ type: "candidate", candidate: { candidate: e.candidate.candidate, sdpMid: e.candidate.sdpMid } });
+    };
+    pc.onconnectionstatechange = () => {
+      if (["failed", "closed"].includes(pc.connectionState))
+        this.closePeer(room, peerId);
+    };
+    const dc = pc.createDataChannel("rech");
+    const channel = new SealedChannel(dc, "host");
+    peer.channel = channel;
+    const aborts = new Map;
+    channel.onClose = () => {
+      for (const a of aborts.values())
+        a.abort();
+      this.closePeer(room, peerId);
+    };
+    channel.onFrame = (frame) => void this.onFrame(channel, room.cred.token, aborts, frame);
+    dc.onopen = async () => {
+      await channel.setKeys(room.cred.token, await keys);
+      if (await channel.confirm())
+        this.log(`webrtc ${room.cred.label}: peer ${peerId} connected`);
+      else {
+        this.log(`webrtc ${room.cred.label}: peer ${peerId} failed key confirmation`);
+        channel.close();
+      }
+    };
+    setTimeout(() => {
+      if (!channel.confirmed)
+        this.closePeer(room, peerId);
+    }, CONNECT_TIMEOUT_MS + 5000);
+    const offer = await pc.createOffer();
+    await pc.setLocalDescription(offer);
+    send({ type: "offer", sdp: pc.localDescription.sdp, ice });
+  }
+  async onFrame(channel, token, aborts, f) {
+    if (f?.t === "abort") {
+      aborts.get(f.id)?.abort();
+      aborts.delete(f.id);
+      return;
+    }
+    if (f?.t !== "req" || typeof f.id !== "string" || typeof f.path !== "string" || !f.path.startsWith("/"))
+      return;
+    const ac = new AbortController;
+    aborts.set(f.id, ac);
+    try {
+      const req = new Request(`http://webrtc.rech${f.path}`, {
+        method: f.method || "GET",
+        headers: f.ct ? { "Content-Type": f.ct } : {},
+        body: f.body != null && !["GET", "HEAD"].includes(f.method) ? f.body : undefined,
+        signal: ac.signal
+      });
+      const res = await this.handler(req, token);
+      await channel.sendFrame({ t: "res", id: f.id, status: res.status, ct: res.headers.get("content-type") ?? "" });
+      if (res.body) {
+        const reader = res.body.getReader();
+        for (;; ) {
+          const { done, value } = await reader.read();
+          if (done || ac.signal.aborted)
+            break;
+          for (let i = 0;i < value.length; i += MAX_CHUNK)
+            channel.sendFrame({ t: "data", id: f.id, b64: Buffer.from(value.subarray(i, i + MAX_CHUNK)).toString("base64") });
+        }
+      }
+      await channel.sendFrame({ t: "end", id: f.id });
+    } catch (error) {
+      if (!ac.signal.aborted)
+        await channel.sendFrame({ t: "end", id: f.id, error: String(error instanceof Error ? error.message : error) });
+    } finally {
+      aborts.delete(f.id);
+    }
+  }
+}
+
+class WebrtcClient {
+  token;
+  signal;
+  log;
+  channel;
+  pc;
+  pending = new Map;
+  onClose = () => {};
+  constructor(token, signal, log = () => {}) {
+    this.token = token;
+    this.signal = signal;
+    this.log = log;
+  }
+  get connected() {
+    return !!this.channel?.open && this.channel.confirmed;
+  }
+  async connect() {
+    const { RTCPeerConnection } = await loadRTC(this.log);
+    const token = this.token;
+    let sock;
+    const result = new Promise((resolve, reject) => {
+      const fail = (message) => {
+        reject(new Error(message));
+      };
+      const timer = setTimeout(() => fail("timed out connecting to the host over WebRTC (no direct path; the host may be behind a strict NAT: ask them to enable TURN, or use a Tailscale/LAN share)"), CONNECT_TIMEOUT_MS);
+      sock = new SignalSocket(signalSocketUrl(this.signal, roomOf(token)), { role: "client", auth: roomAuthOf(token) }, async (m) => {
+        try {
+          if (m.type === "welcome" && m.hostPresent === false)
+            fail("the host is offline (its rech daemon isn't connected to the signal server)");
+          else if (m.type === "host-leave" && !this.connected)
+            fail("the host left before the connection finished");
+          else if (m.type === "offer" && typeof m.sdp === "string" && !this.pc) {
+            const pc = new RTCPeerConnection({ iceServers: Array.isArray(m.ice) ? m.ice : iceServersFromEnv() });
+            this.pc = pc;
+            pc.onicecandidate = (e) => {
+              if (e.candidate)
+                sock.send({ type: "candidate", candidate: { candidate: e.candidate.candidate, sdpMid: e.candidate.sdpMid } });
+            };
+            pc.onconnectionstatechange = () => {
+              if (["failed", "closed"].includes(pc.connectionState))
+                this.close();
+            };
+            const th = new Promise((r) => {
+              pc.ondatachannel = (e) => {
+                const channel = new SealedChannel(e.channel, "client");
+                this.channel = channel;
+                channel.onFrame = (f) => this.onFrame(f);
+                channel.onClose = () => this.close();
+                const ready = async () => {
+                  await channel.setKeys(token, await th);
+                  if (await channel.confirm()) {
+                    clearTimeout(timer);
+                    resolve();
+                  } else
+                    fail("the host could not prove it holds this link's secret (key confirmation failed)");
+                };
+                if (e.channel.readyState === "open")
+                  ready();
+                else
+                  e.channel.onopen = ready;
+              };
+              (async () => {
+                await pc.setRemoteDescription({ type: "offer", sdp: m.sdp });
+                const answer = await pc.createAnswer();
+                await pc.setLocalDescription(answer);
+                sock.send({ type: "answer", sdp: pc.localDescription.sdp });
+                r(await transcriptHash(m.sdp, pc.localDescription.sdp));
+              })().catch((e) => fail(String(e)));
+            });
+          } else if (m.type === "candidate" && m.candidate && this.pc) {
+            await this.pc.addIceCandidate(m.candidate).catch(() => {});
+          }
+        } catch (error) {
+          fail(String(error));
+        }
+      }, (code, reason) => {
+        if (!this.connected)
+          fail(code === 4404 ? "the host is offline (its rech daemon isn't connected to the signal server)" : code === 1008 ? `the signal server refused this link (${reason || "forbidden"})` : `signal server closed the connection (${reason || code})`);
+      });
+      sock.open().catch((e) => fail(e.message));
+    });
+    try {
+      await result;
+    } catch (error) {
+      sock?.close();
+      this.close();
+      throw error;
+    }
+    sock?.close();
+  }
+  onFrame(f) {
+    const p = this.pending.get(f?.id);
+    if (!p)
+      return;
+    if (f.t === "res")
+      p.onRes(f.status, f.ct);
+    else if (f.t === "data" && typeof f.b64 === "string")
+      p.onData(new Uint8Array(Buffer.from(f.b64, "base64")));
+    else if (f.t === "end") {
+      this.pending.delete(f.id);
+      p.onEnd(f.error);
+    }
+  }
+  request(method, path, body, ct, signal) {
+    if (!this.channel || !this.connected)
+      return Promise.reject(new Error("not connected"));
+    const id = randomHex(8), channel = this.channel;
+    return new Promise((resolve, reject) => {
+      let controller;
+      const stream = new ReadableStream({ start: (c) => {
+        controller = c;
+      }, cancel: () => {
+        channel.sendFrame({ t: "abort", id });
+        this.pending.delete(id);
+      } });
+      let answered = false;
+      this.pending.set(id, {
+        onRes: (status, resCt) => {
+          answered = true;
+          resolve(new Response(stream, { status, headers: resCt ? { "Content-Type": resCt } : {} }));
+        },
+        onData: (chunk) => {
+          try {
+            controller.enqueue(chunk);
+          } catch {}
+        },
+        onEnd: (error) => {
+          if (!answered)
+            reject(new Error(error || "the host closed the request"));
+          try {
+            error ? controller.error(new Error(error)) : controller.close();
+          } catch {}
+        }
+      });
+      signal?.addEventListener("abort", () => {
+        channel.sendFrame({ t: "abort", id });
+        this.pending.get(id)?.onEnd("aborted");
+      });
+      channel.sendFrame({ t: "req", id, method, path, ct, body });
+    });
+  }
+  close() {
+    const had = !!this.pc;
+    this.channel?.close();
+    try {
+      this.pc?.close();
+    } catch {}
+    this.channel = undefined;
+    this.pc = undefined;
+    for (const p of this.pending.values())
+      p.onEnd("connection closed");
+    this.pending.clear();
+    if (had)
+      this.onClose();
+  }
+}
+var BRIDGE_DIR = join(homedir(), ".rechrome", "bridges");
+var BRIDGE_IDLE_MS = Number(process.env.RECH_BRIDGE_IDLE_MS) || 900000;
+var bridgeFile = (token, dir = BRIDGE_DIR) => join(dir, `${roomOf(token)}.json`);
+function readBridge(token, dir = BRIDGE_DIR) {
+  try {
+    return JSON.parse(readFileSync(bridgeFile(token, dir), "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function runBridge(token, signal, opts = {}) {
+  const log = opts.log ?? (() => {});
+  const dir = opts.dir ?? BRIDGE_DIR;
+  const client = new WebrtcClient(token, signal, log);
+  let connecting = null;
+  const ensure = async () => {
+    if (client.connected)
+      return;
+    connecting ??= client.connect().finally(() => {
+      connecting = null;
+    });
+    await connecting;
+  };
+  const key = randomBytes2(24).toString("base64url");
+  let lastUsed = Date.now();
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: opts.port ?? 0,
+    idleTimeout: 0,
+    async fetch(req) {
+      const url = new URL(req.url);
+      if (url.pathname === "/__bridge")
+        return Response.json({ ok: true, connected: client.connected, pid: process.pid, room: roomOf(token) });
+      if (req.headers.get("authorization") !== `Bearer ${key}`)
+        return new Response("Unauthorized", { status: 401 });
+      lastUsed = Date.now();
+      try {
+        await ensure();
+      } catch (error) {
+        return Response.json({ status: 1, stdout: "", stderr: `[rech] WebRTC: ${error instanceof Error ? error.message : error}
+` }, { status: 502 });
+      }
+      const body = ["GET", "HEAD"].includes(req.method) ? undefined : await req.text();
+      try {
+        return await client.request(req.method, url.pathname + url.search, body, req.headers.get("content-type") ?? undefined, req.signal);
+      } catch (error) {
+        return Response.json({ status: 1, stdout: "", stderr: `[rech] WebRTC: ${error instanceof Error ? error.message : error}
+` }, { status: 502 });
+      }
+    }
+  });
+  const info = { pid: process.pid, port: server.port, key, signal, room: roomOf(token) };
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const path = bridgeFile(token, dir);
+  writeFileSync(path, JSON.stringify(info), { mode: 384 });
+  const idle = setInterval(() => {
+    if (Date.now() - lastUsed > BRIDGE_IDLE_MS)
+      stop();
+  }, 30000);
+  const stop = () => {
+    clearInterval(idle);
+    client.close();
+    server.stop(true);
+    try {
+      if (readBridge(token, dir)?.pid === process.pid)
+        unlinkSync(path);
+    } catch {}
+    opts.onStop?.();
+  };
+  ensure().catch((error) => log(`[rech] WebRTC: ${error instanceof Error ? error.message : error}`));
+  return { info, stop };
+}
+async function liveBridge(token, dir = BRIDGE_DIR) {
+  const info = readBridge(token, dir);
+  if (!info)
+    return null;
+  const body = await fetch(`http://127.0.0.1:${info.port}/__bridge`, { signal: AbortSignal.timeout(1000) }).then((r) => r.ok ? r.json() : null, () => null);
+  if (body?.room === info.room && body.pid === info.pid)
+    return info;
+  try {
+    unlinkSync(bridgeFile(token, dir));
+  } catch {}
+  return null;
+}
+async function spawnBridge(token, signal, entry, dir = BRIDGE_DIR) {
+  const existing = await liveBridge(token, dir);
+  if (existing)
+    return existing;
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const logPath = join(dir, `${roomOf(token)}.log`);
+  const proc = Bun.spawn([...entry, "bridge"], {
+    env: { ...process.env, RECH_BRIDGE_TOKEN: token, RECH_BRIDGE_SIGNAL: signal },
+    stdin: "ignore",
+    stdout: Bun.file(logPath),
+    stderr: Bun.file(logPath),
+    windowsHide: true
+  });
+  proc.unref();
+  for (let i = 0;i < 100; i++) {
+    const info = await liveBridge(token, dir);
+    if (info)
+      return info;
+    if (proc.exitCode !== null)
+      break;
+    await new Promise((r) => setTimeout(r, 100));
+  }
+  const tail = existsSync(logPath) ? readFileSync(logPath, "utf8").trim().split(`
+`).slice(-3).join(`
+`) : "";
+  throw new Error(`the local WebRTC bridge did not start${tail ? `:
+${tail}` : ""}`);
+}
+export {
+  BRIDGE_DIR,
+  SIGNAL_PROTO,
+  WEBRTC_RUNTIME_DIR,
+  WebrtcClient,
+  WebrtcHost,
+  bridgeFile,
+  hostIceServers,
+  iceServersFromEnv,
+  liveBridge,
+  loadRTC,
+  readBridge,
+  runBridge,
+  signalSocketUrl,
+  spawnBridge
+};