rockcord 4.0.0-dev.5 → 4.0.0

package/README.md

@@ -19,7 +19,7 @@
 npm i rockcord
 ```
 
-Requires **Node.js 22 or newer**; tested on Node.js 22 and 24. Import with `require('rockcord')` or TypeScript imports from `'rockcord'`.
+Requires **Node.js 22.19.0 or newer**; tested on Node.js 22 and 24. Import with `require('rockcord')` or TypeScript imports from `'rockcord'`.
 
 Media playback also requires FFmpeg and a supported Opus binding. Keep optional dependencies enabled so npm can install DAVE's native binary for your platform.
 
@@ -30,9 +30,10 @@ Media playback also requires FFmpeg and a supported Opus binding. Keep optional
 - Components V2 support and checked runtime exports with TypeScript declarations.
 - Bounded REST retries, request deadlines, credential redaction, and connection cleanup.
 - Native DAVE/MLS encryption for audio and video, complete received video frames, and voice privacy verification codes.
-- Screen-share connections, H264/VP8/H265 playback, H264/Opus recording, video retransmission, and buffered audio reception.
+- Screen-share connections and H264, VP8, and H265 playback and recording with Opus audio.
+- Adaptive video packet pacing using authenticated receiver loss reports, bounded retransmission, and buffered audio reception.
 
-This is a **development release**. Live audio, all three video codecs, screen sharing, H264 recording, and packet-loss recovery have passed targeted checks. See the [implementation report](https://github.com/rock-forge/rockcord/blob/main/docs/audit/IMPLEMENTATION.md) for coverage and limitations.
+The **4.0.0 stable release** includes the media repairs and reviewed dependency updates. See the [media options](https://github.com/rock-forge/rockcord/blob/main/docs/MEDIA.md), [dependency review](https://github.com/rock-forge/rockcord/blob/main/docs/audit/DEPENDENCY_REVIEW.md), and [implementation report](https://github.com/rock-forge/rockcord/blob/main/docs/audit/IMPLEMENTATION.md) for configuration and verification coverage.
 
 ## Project links
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rockcord",
-  "version": "4.0.0-dev.5",
+  "version": "4.0.0",
   "description": "Rockcord: a maintained Discord client library with tested v13 APIs and DAVE media encryption",
   "main": "./src/index.js",
   "types": "./typings/index.d.ts",
@@ -58,6 +58,7 @@
   "dependencies": {
     "@discordjs/builders": "^1.6.3",
     "@discordjs/collection": "^2.1.1",
+    "@otplib/v12-adapter": "^13.5.0",
     "@sapphire/async-queue": "^1.5.5",
     "@sapphire/shapeshift": "^4.0.0",
     "@snazzah/davey": "0.1.12",
@@ -66,29 +67,31 @@
     "discord-api-types": "^0.38.15",
     "fetch-cookie": "^3.1.0",
     "find-process": "^2.0.0",
-    "otplib": "^12.0.1",
     "prism-media": "^1.3.5",
     "qrcode": "^1.5.4",
-    "tough-cookie": "^5.1.2",
+    "tough-cookie": "^6.0.2",
     "tree-kill": "^1.2.2",
-    "undici": "^7.11.0",
+    "undici": "^8.11.2",
     "werift-rtp": "^0.8.4",
     "ws": "^8.16.0"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.19.0"
   },
   "devDependencies": {
     "@discordjs/docgen": "^0.12.1",
+    "@eslint/js": "^10.0.1",
     "@types/debug": "^4.1.12",
-    "eslint": "^8.39.0",
-    "eslint-config-prettier": "^8.8.0",
-    "eslint-plugin-import": "^2.27.5",
-    "eslint-plugin-prettier": "^4.2.1",
-    "jsdoc-to-markdown": "^7.1.1",
+    "eslint": "^10.12.0",
+    "eslint-config-prettier": "^10.1.8",
+    "eslint-import-resolver-node": "^0.3.10",
+    "eslint-plugin-import-x": "^4.17.1",
+    "eslint-plugin-prettier": "^5.5.6",
+    "globals": "^16.5.0",
+    "jsdoc-to-markdown": "^8.0.3",
     "opusscript": "0.0.8",
-    "prettier": "^2.8.8",
-    "typescript": "^5.5.4"
+    "prettier": "^3.9.9",
+    "typescript": "^5.9.3"
   },
   "overrides": {
     "jsdoc": "^4.0.5"

package/src/client/Client.js

@@ -1,11 +1,10 @@
-/* eslint-disable no-unreachable */
 'use strict';
 
 const process = require('node:process');
 const { setInterval } = require('node:timers');
 const { setTimeout } = require('node:timers');
 const { Collection } = require('@discordjs/collection');
-const { authenticator } = require('otplib');
+const { authenticator } = require('@otplib/v12-adapter');
 const BaseClient = require('./BaseClient');
 const ActionsManager = require('./actions/ActionsManager');
 const ClientVoiceManager = require('./voice/ClientVoiceManager');
@@ -205,7 +204,7 @@ class Client extends BaseClient {
      * The authenticator used for TOTP
      * @type {Object}
      */
-    this.authenticator = authenticator;
+    this.authenticator = authenticator.create({ guardrails: { MIN_SECRET_BYTES: 1 } });
 
     this.authenticator.options = {
       step: 30,
@@ -352,6 +351,7 @@ class Client extends BaseClient {
    * @returns {void}
    */
   destroy() {
+    this.user?._stopSamsungPresence?.();
     super.destroy();
 
     for (const fn of this._cleanups) fn();

package/src/client/WebhookClient.js

@@ -43,7 +43,7 @@ class WebhookClient extends BaseClient {
   }
 
   // These are here only for documentation purposes - they are implemented by Webhook
-  /* eslint-disable no-empty-function */
+
   send() {}
   sendSlackMessage() {}
   fetchMessage() {}

package/src/client/actions/VoiceStateUpdate.js

@@ -16,11 +16,11 @@ class VoiceStateUpdate extends Action {
       const newState = guild.voiceStates._add(data);
 
       // Get the member
-      let member = guild.members.cache.get(data.user_id);
+      const member = guild.members.cache.get(data.user_id);
       if (member && data.member) {
         member._patch(data.member);
       } else if (data.member?.user && data.member.joined_at) {
-        member = guild.members._add(data.member);
+        guild.members._add(data.member);
       }
 
       /**

package/src/client/voice/VoiceConnection.js

@@ -726,8 +726,8 @@ class VoiceConnection extends EventEmitter {
     }
   }
 
-  playAudio() {} // eslint-disable-line no-empty-function
-  playVideo() {} // eslint-disable-line no-empty-function
+  playAudio() {}
+  playVideo() {}
 
   /**
    * Create new connection to screenshare stream

package/src/client/voice/dispatcher/AudioDispatcher.js

@@ -133,7 +133,7 @@ class AudioDispatcher extends BaseDispatcher {
   }
 
   // Volume stubs for docs
-  /* eslint-disable no-empty-function*/
+
   get volumeDecibels() {}
   get volumeLogarithmic() {}
   setVolumeDecibels() {}

package/src/client/voice/dispatcher/BaseDispatcher.js

@@ -133,6 +133,19 @@ class BaseDispatcher extends Writable {
       this._syncDispatcher.once('start', cb);
       this._syncStartTimer = setTimeout(cb, 10_000).unref();
     }
+    // Announce both dispatchers before arbitrating the initial encrypted frame,
+    // so audio/video synchronization cannot deadlock against startup ownership.
+    const dave = this.player.voiceConnection?.dave;
+    if (dave?.beginMedia?.(this) === false) {
+      this._bootstrapWaitAt ??= performance.now();
+      if (performance.now() - this._bootstrapWaitAt > 10000) {
+        done(new Error('DAVE media bootstrap timed out'));
+        return;
+      }
+      this._bootstrapTimer = setTimeout(() => this._write(chunk, enc, done), 5).unref();
+      return;
+    }
+    this._bootstrapWaitAt = null;
     try {
       if (this.getTypeDispatcher() === 'video') {
         this._codecCallback(chunk);
@@ -152,6 +165,8 @@ class BaseDispatcher extends Writable {
   }
 
   _cleanup() {
+    clearTimeout(this._bootstrapTimer);
+    this.player.voiceConnection?.dave?.releaseMedia?.(this);
     clearTimeout(this._stepTimer);
     clearTimeout(this._syncStartTimer);
     if (this._syncStartListener) this._syncDispatcher?.removeListener('start', this._syncStartListener);
@@ -246,9 +261,12 @@ class BaseDispatcher extends Writable {
       done();
     };
     const next = (this.count + 1) * this.FRAME_LENGTH - (performance.now() - this.startTime - this._pausedTime);
-    this._stepTimer = setTimeout(() => {
-      if ((!this.pausedSince || this._silence) && this._writeCallback) this._writeCallback();
-    }, Math.max(0, next)).unref();
+    this._stepTimer = setTimeout(
+      () => {
+        if ((!this.pausedSince || this._silence) && this._writeCallback) this._writeCallback();
+      },
+      Math.max(0, next),
+    ).unref();
     this.timestamp = (this.timestamp + this.TIMESTAMP_INC) % (MAX_UINT_32 + 1);
     if (this._packetState) this._packetState.timestamp = this.timestamp;
     this.count++;
@@ -385,15 +403,22 @@ class BaseDispatcher extends Writable {
       this.emit('debug', 'Failed to send a packet - no UDP socket');
       return;
     }
-    this.player.voiceConnection.sockets.udp.send(packet).catch(e => {
-      if (this.getTypeDispatcher() === 'audio') {
-        this._setSpeaking(0);
-      } else if (this.getTypeDispatcher() === 'video') {
-        this._setVideoStatus(false);
-        this._setStreamStatus(true);
-      }
-      this.emit('debug', `Failed to send a packet - ${e}`);
-    });
+    this.player.voiceConnection.sockets.udp
+      .send(packet)
+      .then(() => {
+        if (this.getTypeDispatcher() === 'audio' || packet[1] & 0x80) {
+          this.player.voiceConnection.dave?.sentMedia?.(this);
+        }
+      })
+      .catch(e => {
+        if (this.getTypeDispatcher() === 'audio') {
+          this._setSpeaking(0);
+        } else if (this.getTypeDispatcher() === 'video') {
+          this._setVideoStatus(false);
+          this._setStreamStatus(true);
+        }
+        this.emit('debug', `Failed to send a packet - ${e}`);
+      });
   }
 
   _setSpeaking(value) {

package/src/client/voice/dispatcher/VideoDispatcher.js

@@ -1,6 +1,8 @@
 'use strict';
 
+const { setTimeout } = require('node:timers');
 const BaseDispatcher = require('./BaseDispatcher');
+const CongestionControl = require('../networking/CongestionControl');
 
 /**
  * The class that sends video packet data to the voice connection.
@@ -64,6 +66,87 @@ class VideoDispatcher extends BaseDispatcher {
   _codecCallback() {
     throw new Error('The _codecCallback method must be implemented');
   }
+
+  configureCongestion(options = {}) {
+    if (options.congestionControl === false) return;
+    const config = typeof options.congestionControl === 'object' ? options.congestionControl : {};
+    const bitrate = config.bitrate ?? (typeof options.bitrate === 'number' ? options.bitrate : 2000);
+    this.congestionControl = new CongestionControl({
+      bitrate,
+      minBitrate: Math.min(128, bitrate),
+      ...config,
+      onChange: state => this.emit('congestion', state),
+    });
+    this.player.voiceConnection._congestionControl = this.congestionControl;
+  }
+
+  _write(chunk, encoding, done) {
+    if (this.congestionControl) {
+      this._pacedPackets = [];
+      this._pacedBytes = 0;
+      this._pacingKey = this.player.voiceConnection.authentication.secret_key;
+    }
+    super._write(chunk, encoding, done);
+  }
+
+  _sendPacket(packet) {
+    if (!this._pacedPackets) return super._sendPacket(packet);
+    this._pacedBytes += packet.length;
+    if (this._pacedBytes > 4 * 1024 * 1024 || this._pacedPackets.length >= 4096) {
+      throw new RangeError('Video frame exceeds the pacing queue limit');
+    }
+    this._pacedPackets.push(packet);
+    return undefined;
+  }
+
+  _step(done) {
+    if (!this._pacedPackets) return super._step(done);
+    const packets = this._pacedPackets;
+    this._pacedPackets = null;
+    let index = 0;
+    const sendNext = () => {
+      if (this.destroyed) return;
+      if (this.paused) {
+        this._pacingTimer = setTimeout(sendNext, 20).unref();
+        return;
+      }
+      if (index === packets.length) {
+        super._step(done);
+        return;
+      }
+      const packet = packets[index++];
+      const delay = this.congestionControl.delay(packet.length);
+      this._pacingTimer = setTimeout(
+        () => {
+          if (this.destroyed) return;
+          if (this._pacingKey !== this.player.voiceConnection.authentication.secret_key) {
+            this.destroy(new Error('Video transport key changed during paced playback'));
+            return;
+          }
+          if (this.paused) {
+            index--;
+            sendNext();
+            return;
+          }
+          this.congestionControl.packetSent();
+          super._sendPacket(packet);
+          sendNext();
+        },
+        Math.max(0, delay),
+      ).unref();
+    };
+    sendNext();
+    return undefined;
+  }
+
+  _cleanup() {
+    clearTimeout(this._pacingTimer);
+    this._pacedPackets = null;
+    if (this.player.voiceConnection._congestionControl === this.congestionControl) {
+      this.player.voiceConnection._congestionControl = null;
+    }
+    super._cleanup();
+  }
 }
 
 module.exports = VideoDispatcher;

package/src/client/voice/networking/CongestionControl.js

@@ -0,0 +1,84 @@
+'use strict';
+
+/** Loss-based AIMD rate control and bounded video packet pacing. @private */
+class CongestionControl {
+  constructor({ bitrate = 2000, minBitrate = 128, onChange = () => {} } = {}) {
+    if (!Number.isFinite(bitrate) || !Number.isFinite(minBitrate) || minBitrate <= 0 || bitrate < minBitrate) {
+      throw new RangeError('Congestion bitrates must be finite, positive and ordered');
+    }
+    this.maximum = bitrate * 1000;
+    this.minimum = minBitrate * 1000;
+    this.targetBitrate = this.maximum;
+    this.onChange = onChange;
+    this.loss = 0;
+    this.reason = 'initial';
+    this.nextSendAt = 0;
+    this.windowStart = performance.now();
+    this.lastUpdate = -Infinity;
+    this.lastReport = -Infinity;
+    this.sent = 0;
+    this.totalSent = 0;
+    this.missing = new Set();
+    this.reports = new Map();
+  }
+
+  get state() {
+    return { targetBitrate: this.targetBitrate, loss: this.loss, packetsSent: this.totalSent, reason: this.reason };
+  }
+
+  report(loss, highest, reporter, now = performance.now()) {
+    if (!Number.isFinite(loss) || loss < 0 || loss > 1) return;
+    const previous = this.reports.get(reporter);
+    const distance = previous ? (highest - previous.highest) >>> 0 : 1;
+    if (distance >= 0x80000000 || !distance) return;
+    for (const [id, report] of this.reports) if (now - report.time > 3000) this.reports.delete(id);
+    if (!this.reports.has(reporter) && this.reports.size >= 32) return;
+    this.reports.set(reporter, { highest, loss, time: now });
+    this.lastReport = now;
+    this._update(Math.max(...[...this.reports.values()].map(report => report.loss)), now, true);
+  }
+
+  nack(sequence) {
+    if (this.missing.size < 512) this.missing.add(sequence);
+  }
+
+  packetSent(now = performance.now()) {
+    if (now - this.windowStart >= 1000) {
+      if (now - this.lastReport > 2000 && this.sent >= 20 && this.missing.size) {
+        this._update(Math.min(1, this.missing.size / this.sent), now, false);
+      }
+      this.windowStart = now;
+      this.sent = 0;
+      this.missing.clear();
+    }
+    this.sent++;
+    this.totalSent++;
+  }
+
+  _update(loss, now, canIncrease) {
+    if (now - this.lastUpdate < 1000) return;
+    this.lastUpdate = now;
+    this.loss = loss;
+    const before = this.targetBitrate;
+    if (loss >= 0.1) {
+      this.targetBitrate *= 0.75;
+      this.reason = 'high-loss';
+    } else if (loss >= 0.02) {
+      this.targetBitrate *= 0.9;
+      this.reason = 'loss';
+    } else if (canIncrease && loss < 0.02) {
+      this.targetBitrate += Math.max(8000, this.targetBitrate * 0.05);
+      this.reason = 'recovery';
+    }
+    this.targetBitrate = Math.round(Math.max(this.minimum, Math.min(this.maximum, this.targetBitrate)));
+    if (before !== this.targetBitrate) this.onChange(this.state);
+  }
+
+  delay(bytes, now = performance.now()) {
+    const due = Math.max(now, this.nextSendAt);
+    this.nextSendAt = due + (bytes * 8000) / this.targetBitrate;
+    return due - now;
+  }
+}
+
+module.exports = CongestionControl;

package/src/client/voice/networking/DAVE.js

@@ -51,6 +51,8 @@ class DAVE {
   }
 
   reinit(version = this.targetVersion) {
+    this._mediaStarted = false;
+    this._bootstrapSender = null;
     this.validateVersion(version);
     this.blocked = true;
     if (!version) return;
@@ -81,6 +83,8 @@ class DAVE {
     this.version = this.targetVersion = this.pending.get(id);
     this.pending.delete(id);
     this.lastTransition = id;
+    this._mediaStarted = false;
+    this._bootstrapSender = null;
     this.recovering = false;
     this.blocked = this.version > 0 && !this.session?.ready;
     // When upgrading, expire the explicitly permitted plaintext grace period after ten seconds.
@@ -137,7 +141,11 @@ class DAVE {
   encrypt(frame, codec = 'OPUS') {
     if (this.closed || !this.negotiated) return null;
     // The protocol's Opus silence marker is exempt from frame encryption, including while joining.
-    if (codec === 'OPUS' && SILENCE_FRAME.equals(frame)) return frame;
+    if (codec === 'OPUS' && SILENCE_FRAME.equals(frame)) {
+      // Exempt silence must not unlock nonce-zero startup ordering.
+      this._bootstrapSender = null;
+      return frame;
+    }
     if (this.blocked) return null;
     if (this.version === 0) return frame;
     if (!this.session?.ready) return null;
@@ -146,6 +154,23 @@ class DAVE {
     return this.session.encrypt(codec === 'OPUS' ? api.MediaType.AUDIO : api.MediaType.VIDEO, api.Codec[codec], frame);
   }
 
+  beginMedia(sender) {
+    if (this._mediaStarted || !this.version || this.blocked || !this.negotiated || !this.session?.ready) return true;
+    if (this._bootstrapSender && this._bootstrapSender !== sender) return false;
+    this._bootstrapSender = sender;
+    return true;
+  }
+
+  sentMedia(sender) {
+    if (this._bootstrapSender !== sender) return;
+    this._mediaStarted = true;
+    this._bootstrapSender = null;
+  }
+
+  releaseMedia(sender) {
+    if (this._bootstrapSender === sender) this._bootstrapSender = null;
+  }
+
   decrypt(frame, userId, video = false) {
     if (this.closed || !this.negotiated) return null;
     if (!video && SILENCE_FRAME.equals(frame)) return frame;

package/src/client/voice/networking/MediaRecovery.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { setInterval } = require('node:timers');
+const { setInterval, setTimeout } = require('node:timers');
 const Util = require('../../../util/Util');
 const { encrypt, decrypt } = require('../util/TransportCrypto');
 
@@ -11,6 +11,7 @@ class MediaRecovery {
     this.connection = connection;
     this.cache = new Map();
     this.sources = new Map();
+    this.pendingRtx = new Set();
     this.rtxSequence = 0;
     this.stats = { requested: 0, retransmitted: 0, recovered: 0, expired: 0 };
   }
@@ -39,14 +40,34 @@ class MediaRecovery {
     });
   }
 
-  receive(packet) {
+  receive(packet, retransmission = false) {
     const { ssrc, sequenceNumber: seq } = packet.header;
     let source = this.sources.get(ssrc);
+    if (retransmission) {
+      if (source?.missing.delete(seq)) this.stats.recovered++;
+      return;
+    }
     if (!source) {
       if (this.sources.size >= 32) return;
-      this.sources.set(ssrc, (source = { highest: seq, missing: new Map() }));
+      this.sources.set(ssrc, {
+        highest: seq,
+        highestExtended: seq,
+        first: seq,
+        received: 1,
+        seen: new Set([seq]),
+        missing: new Map(),
+        reportedExpected: 0,
+        reportedReceived: 0,
+      });
+      if (!this.reportTimer) this.reportTimer = setInterval(() => this._report(), 1000).unref();
       return;
     }
+    if (!source.seen.has(seq)) {
+      const age = (source.highest - seq) & 65535;
+      if (age < 128 || age >= 32768) source.received++;
+      source.seen.add(seq);
+      if (source.seen.size > 512) source.seen.delete(source.seen.values().next().value);
+    }
     if (source.missing.delete(seq)) this.stats.recovered++;
     const distance = (seq - source.highest) & 65535;
     if (!distance || distance >= 32768) return;
@@ -61,6 +82,7 @@ class MediaRecovery {
       }
     }
     source.highest = seq;
+    source.highestExtended += distance;
     if (source.missing.size && !this.timer) this.timer = setInterval(() => this._tick(), 20).unref();
   }
 
@@ -129,11 +151,61 @@ class MediaRecovery {
       if (packet[offset] >> 6 !== 2 || size < 8 || offset + size > packet.length) return;
       if (packet[offset + 1] === 205 && (packet[offset] & 31) === 1 && size >= 16 && size % 4 === 0) {
         messages.push(packet.subarray(offset, offset + size));
+      } else if (packet[offset + 1] === 201 || packet[offset + 1] === 200) {
+        const base = packet[offset + 1] === 201 ? 8 : 28;
+        if (size < base + (packet[offset] & 31) * 24) return;
+        messages.push(packet.subarray(offset, offset + size));
       }
       offset += size;
     }
     if (offset !== packet.length) return;
-    for (const message of messages) this._handleNack(message);
+    for (const message of messages) {
+      if (message[1] === 205) this._handleNack(message);
+      else this._handleReport(message);
+    }
+  }
+
+  _handleReport(packet) {
+    const control = this.connection._congestionControl;
+    if (!control) return;
+    const reporter = packet.readUInt32BE(4);
+    const videoSsrc = this.connection.authentication.ssrc + 1;
+    const base = packet[1] === 201 ? 8 : 28;
+    for (let index = 0; index < (packet[0] & 31); index++) {
+      const offset = base + index * 24;
+      if (packet.readUInt32BE(offset) === videoSsrc) {
+        control.report(packet[offset + 4] / 256, packet.readUInt32BE(offset + 8), reporter);
+      }
+    }
+  }
+
+  _report() {
+    for (const [ssrc, source] of this.sources) {
+      const expected = source.highestExtended - source.first + 1;
+      const intervalExpected = expected - source.reportedExpected;
+      const intervalReceived = source.received - source.reportedReceived;
+      source.reportedExpected = expected;
+      source.reportedReceived = source.received;
+      if (!intervalExpected) continue;
+      const packet = Buffer.alloc(32);
+      packet[0] = 0x81;
+      packet[1] = 201;
+      packet.writeUInt16BE(7, 2);
+      packet.writeUInt32BE(this.connection.authentication.ssrc, 4);
+      packet.writeUInt32BE(ssrc, 8);
+      packet[12] = Math.max(
+        0,
+        Math.min(255, Math.floor(((intervalExpected - intervalReceived) * 256) / intervalExpected)),
+      );
+      packet.writeUIntBE(Math.max(0, Math.min(0x7fffff, expected - source.received)), 13, 3);
+      packet.writeUInt32BE(source.highestExtended >>> 0, 16);
+      try {
+        const header = packet.subarray(0, 8);
+        this._send(Buffer.concat([header, ...encrypt(this.connection, packet.subarray(8), header)]));
+      } catch (error) {
+        this.connection.receiver?.emit('debug', error);
+      }
+    }
   }
 
   _handleNack(packet) {
@@ -154,6 +226,7 @@ class MediaRecovery {
     const auth = this.connection.authentication;
     if (
       !item ||
+      !auth.secret_key ||
       !this.key?.equals(Buffer.from(auth.secret_key)) ||
       now - item.time > 2000 ||
       item.retries >= 3 ||
@@ -166,6 +239,7 @@ class MediaRecovery {
     if (!rtx) return;
     item.retries++;
     item.last = now;
+    if (ssrc === auth.ssrc + 1) this.connection._congestionControl?.nack(sequence);
     const header = Buffer.from(item.header);
     header[0] = 0x80;
     header[1] = (header[1] & 0x80) | item.type;
@@ -173,12 +247,37 @@ class MediaRecovery {
     header.writeUInt32BE(rtx, 8);
     const original = Buffer.alloc(2);
     original.writeUInt16BE(sequence);
-    try {
-      this._send(Buffer.concat([header, ...encrypt(this.connection, Buffer.concat([original, item.payload]), header)]));
-      this.stats.retransmitted++;
-    } catch (error) {
-      this.connection.receiver?.emit('debug', error);
+    const send = () => {
+      const current = this.connection.authentication;
+      if (
+        !current.secret_key ||
+        !this.key?.equals(Buffer.from(current.secret_key)) ||
+        performance.now() - item.time > 2000
+      )
+        return;
+      try {
+        this._send(
+          Buffer.concat([header, ...encrypt(this.connection, Buffer.concat([original, item.payload]), header)]),
+        );
+        this.stats.retransmitted++;
+      } catch (error) {
+        this.connection.receiver?.emit('debug', error);
+      }
+    };
+    const control = this.connection._congestionControl;
+    if (!control) {
+      send();
+      return;
     }
+    if (this.pendingRtx.size >= 128) return;
+    if (control.nextSendAt - performance.now() > 500) return;
+    const delay = control.delay(header.length + original.length + item.payload.length + 20);
+    if (delay > 500) return;
+    const timer = setTimeout(() => {
+      this.pendingRtx.delete(timer);
+      send();
+    }, delay).unref();
+    this.pendingRtx.add(timer);
   }
 
   _send(packet) {
@@ -187,9 +286,13 @@ class MediaRecovery {
 
   reset() {
     clearInterval(this.timer);
+    clearInterval(this.reportTimer);
+    this.reportTimer = null;
     this.timer = null;
     this.cache.clear();
     this.sources.clear();
+    for (const timer of this.pendingRtx) clearTimeout(timer);
+    this.pendingRtx.clear();
     this.rtxSequence = 0;
   }
 }