werift 0.24.0 → 0.24.2

package/lib/index.mjs

@@ -1,11 +1,10 @@
 // ../common/src/binary.ts
 import { randomBytes } from "crypto";
-import { jspack } from "@shinyoshiaki/jspack";
 function random16() {
-  return jspack.Unpack("!H", randomBytes(2))[0];
+  return randomBytes(2).readUInt16BE(0);
 }
 function random32() {
-  return jspack.Unpack("!L", randomBytes(4))[0];
+  return randomBytes(4).readUInt32BE(0);
 }
 function bufferXor(a, b) {
   if (a.length !== b.length) {
@@ -2600,8 +2599,25 @@ var saltLength = (profile) => {
   }
 };
 
+// ../rtp/src/codec/leb128.ts
+function leb128encode(value) {
+  if (!Number.isInteger(value) || value < 0 || !Number.isSafeInteger(value)) {
+    throw new Error("LEB128 encode requires a non-negative safe integer");
+  }
+  const bytes = [];
+  let remaining = value;
+  do {
+    let byte = remaining & 127;
+    remaining = Math.floor(remaining / 128);
+    if (remaining !== 0) {
+      byte |= 128;
+    }
+    bytes.push(byte);
+  } while (remaining !== 0);
+  return Buffer.from(bytes);
+}
+
 // ../rtp/src/codec/av1.ts
-import { LEB128 } from "@minhducsun2002/leb128";
 var log3 = debug("werift-rtp : packages/rtp/src/codec/av1.ts");
 var AV1RtpPayload = class _AV1RtpPayload {
   /**
@@ -2731,7 +2747,7 @@ var AV1Obu = class _AV1Obu {
     const header = new BitWriter2(8).set(this.obu_forbidden_bit).set(OBU_TYPE_IDS[this.obu_type], 4).set(this.obu_extension_flag).set(this.obu_has_size_field).set(this.obu_reserved_1bit).buffer;
     let obuSize = Buffer.alloc(0);
     if (this.obu_has_size_field) {
-      obuSize = LEB128.encode(this.payload.length);
+      obuSize = leb128encode(this.payload.length);
     }
     return Buffer.concat([header, obuSize, this.payload]);
   }
@@ -2740,14 +2756,20 @@ function leb128decode(buf) {
   let value = 0;
   let leb128bytes = 0;
   for (let i = 0; i < 8; i++) {
+    if (i >= buf.length) {
+      throw new Error("LEB128 decode incomplete");
+    }
     const leb128byte = buf.readUInt8(i);
-    value |= (leb128byte & 127) << i * 7;
+    value += (leb128byte & 127) * 128 ** i;
     leb128bytes++;
     if (!(leb128byte & 128)) {
-      break;
+      if (!Number.isSafeInteger(value)) {
+        throw new Error("LEB128 value exceeds safe integer");
+      }
+      return [value, leb128bytes];
     }
   }
-  return [value, leb128bytes];
+  throw new Error("LEB128 decode incomplete");
 }
 var OBU_TYPES = {
   0: "Reserved",
@@ -4694,13 +4716,12 @@ var RtpPacket = class _RtpPacket {
 };
 
 // ../rtp/src/rtp/rtx.ts
-import { jspack as jspack2 } from "@shinyoshiaki/jspack";
 function unwrapRtx(rtx, payloadType, ssrc) {
   const packet = new RtpPacket(
     new RtpHeader({
       payloadType,
       marker: rtx.header.marker,
-      sequenceNumber: jspack2.Unpack("!H", rtx.payload.subarray(0, 2))[0],
+      sequenceNumber: rtx.payload.readUInt16BE(0),
       timestamp: rtx.header.timestamp,
       ssrc
     }),
@@ -4709,6 +4730,8 @@ function unwrapRtx(rtx, payloadType, ssrc) {
   return packet;
 }
 function wrapRtx(packet, payloadType, sequenceNumber, ssrc) {
+  const originalSequence = Buffer.allocUnsafe(2);
+  originalSequence.writeUInt16BE(packet.header.sequenceNumber, 0);
   const rtx = new RtpPacket(
     new RtpHeader({
       payloadType,
@@ -4719,17 +4742,13 @@ function wrapRtx(packet, payloadType, sequenceNumber, ssrc) {
       csrc: packet.header.csrc,
       extensions: packet.header.extensions
     }),
-    Buffer.concat([
-      Buffer.from(jspack2.Pack("!H", [packet.header.sequenceNumber])),
-      packet.payload
-    ])
+    Buffer.concat([originalSequence, packet.payload])
   );
   return rtx;
 }
 
 // ../rtp/src/srtp/context/context.ts
-import { createHmac as createHmac3 } from "crypto";
-import AES from "aes-js";
+import { createCipheriv as createCipheriv4, createHmac as createHmac3 } from "crypto";
 
 // ../rtp/src/srtp/cipher/ctr.ts
 import {
@@ -5117,6 +5136,11 @@ function finalizeAuthenticatedDecryption(decipher, packetType) {
 }
 
 // ../rtp/src/srtp/context/context.ts
+function aes128EcbEncrypt(key, plaintext) {
+  const cipher = createCipheriv4("aes-128-ecb", key, null);
+  cipher.setAutoPadding(false);
+  return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+}
 var Context = class {
   constructor(masterKey, masterSalt, profile) {
     this.masterKey = masterKey;
@@ -5183,8 +5207,7 @@ var Context = class {
       sessionKey[j] = sessionKey[j] ^ labelAndIndexOverKdr[i];
     }
     sessionKey = Buffer.concat([sessionKey, Buffer.from([0, 0])]);
-    const block = new AES.AES(this.masterKey);
-    return Buffer.from(block.encrypt(sessionKey));
+    return aes128EcbEncrypt(this.masterKey, sessionKey);
   }
   generateSessionSalt(label) {
     let sessionSalt = Buffer.from(this.masterSalt);
@@ -5201,8 +5224,7 @@ var Context = class {
       sessionSalt[j] = sessionSalt[j] ^ labelAndIndexOverKdr[i];
     }
     sessionSalt = Buffer.concat([sessionSalt, Buffer.from([0, 0])]);
-    const block = new AES.AES(this.masterKey);
-    sessionSalt = Buffer.from(block.encrypt(sessionSalt));
+    sessionSalt = aes128EcbEncrypt(this.masterKey, sessionSalt);
     return sessionSalt.subarray(0, 14);
   }
   generateSessionAuthTag(label) {
@@ -5227,9 +5249,8 @@ var Context = class {
       sessionAuthTag,
       Buffer.from([0, 1])
     ]);
-    const block = new AES.AES(this.masterKey);
-    firstRun = Buffer.from(block.encrypt(firstRun));
-    secondRun = Buffer.from(block.encrypt(secondRun));
+    firstRun = aes128EcbEncrypt(this.masterKey, firstRun);
+    secondRun = aes128EcbEncrypt(this.masterKey, secondRun);
     return Buffer.concat([firstRun, secondRun.subarray(0, 4)]);
   }
   getSrtpSsrcState(ssrc) {
@@ -5746,8 +5767,8 @@ var TransportContext = class {
   constructor(socket) {
     this.socket = socket;
   }
-  send = (buf) => {
-    return this.socket.send(buf);
+  send = (buf, addr) => {
+    return this.socket.send(buf, addr);
   };
 };
 
@@ -6086,12 +6107,12 @@ var DtlsSocket = class {
     return handshakes;
   }
   /**send application data */
-  send = async (buf) => {
+  send = async (buf, addr) => {
     const pkt = createPlaintext(this.dtls)(
       [{ type: 23 /* applicationData */, fragment: buf }],
       ++this.dtls.recordSequenceNumber
     )[0];
-    await this.transport.send(this.cipher.encryptPacket(pkt).serialize());
+    await this.transport.send(this.cipher.encryptPacket(pkt).serialize(), addr);
   };
   close() {
     this.transport.socket.close();
@@ -6735,17 +6756,82 @@ import { connect as connect3, createServer } from "node:net";
 // ../ice-server/src/stun/message.ts
 import { createHmac as createHmac4, randomBytes as randomBytes5 } from "crypto";
 
+// ../ice-server/src/stun/ip.ts
+import { isIPv4, isIPv6 } from "node:net";
+function ipAddressToBuffer(address) {
+  if (isIPv4(address)) {
+    const buf = Buffer.allocUnsafe(4);
+    const parts = address.split(".");
+    for (let i = 0; i < 4; i++) {
+      buf[i] = Number(parts[i]) & 255;
+    }
+    return buf;
+  }
+  if (!isIPv6(address)) {
+    throw new Error(`Invalid ip address: ${address}`);
+  }
+  const sections = address.split(":", 8);
+  for (let i = 0; i < sections.length; i++) {
+    let v4Buffer;
+    if (isIPv4(sections[i])) {
+      v4Buffer = ipAddressToBuffer(sections[i]);
+      sections[i] = v4Buffer.subarray(0, 2).toString("hex");
+    }
+    if (v4Buffer && ++i < 8) {
+      sections.splice(i, 0, v4Buffer.subarray(2, 4).toString("hex"));
+    }
+  }
+  if (sections[0] === "") {
+    while (sections.length < 8) sections.unshift("0");
+  } else if (sections[sections.length - 1] === "") {
+    while (sections.length < 8) sections.push("0");
+  } else if (sections.length < 8) {
+    let emptyIndex = 0;
+    for (; emptyIndex < sections.length && sections[emptyIndex] !== ""; emptyIndex++) ;
+    const zeros = [];
+    for (let n = 9 - sections.length; n > 0; n--) {
+      zeros.push("0");
+    }
+    sections.splice(emptyIndex, 1, ...zeros);
+  }
+  const result = Buffer.allocUnsafe(16);
+  let offset = 0;
+  for (const section of sections) {
+    const word = Number.parseInt(section, 16) || 0;
+    result[offset++] = word >> 8 & 255;
+    result[offset++] = word & 255;
+  }
+  return result;
+}
+function bufferToIpAddress(buf) {
+  if (buf.length === 4) {
+    return `${buf[0]}.${buf[1]}.${buf[2]}.${buf[3]}`;
+  }
+  if (buf.length !== 16) {
+    throw new Error(`Invalid ip address buffer length: ${buf.length}`);
+  }
+  const hextets = [];
+  for (let i = 0; i < 16; i += 2) {
+    hextets.push(buf.readUInt16BE(i).toString(16));
+  }
+  let result = hextets.join(":");
+  result = result.replace(/(^|:)0(:0)*:0(:|$)/, "$1::$3");
+  result = result.replace(/:{3,4}/, "::");
+  return result;
+}
+function isIpV4Address(address) {
+  return isIPv4(address);
+}
+
 // ../ice-server/src/stun/attributes.ts
-import * as Int64 from "int64-buffer";
-import nodeIp from "ip";
 function packAddress(value) {
   const [address] = value;
-  const protocol = nodeIp.isV4Format(address) ? IPV4_PROTOCOL : IPV6_PROTOCOL;
+  const protocol = isIpV4Address(address) ? IPV4_PROTOCOL : IPV6_PROTOCOL;
   const buffer2 = Buffer.alloc(4);
   buffer2.writeUInt8(0, 0);
   buffer2.writeUInt8(protocol, 1);
   buffer2.writeUInt16BE(value[1], 2);
-  return Buffer.concat([buffer2, nodeIp.toBuffer(address)]);
+  return Buffer.concat([buffer2, ipAddressToBuffer(address)]);
 }
 function unpackErrorCode(data) {
   if (data.length < 4) {
@@ -6768,12 +6854,12 @@ function unpackAddress(data) {
       if (address.length !== 4) {
         throw new Error("STUN address has invalid length for IPv4");
       }
-      return [nodeIp.toString(address), port];
+      return [bufferToIpAddress(address), port];
     case IPV6_PROTOCOL:
       if (address.length !== 16) {
         throw new Error("STUN address has invalid length for IPv6");
       }
-      return [nodeIp.toString(address), port];
+      return [bufferToIpAddress(address), port];
     default:
       throw new Error("STUN address has unknown protocol");
   }
@@ -6836,12 +6922,11 @@ var packUnsignedShort = (value) => {
 };
 var unpackUnsignedShort = (data) => data.readUInt16BE(0);
 var packUnsigned64 = (value) => {
-  return new Int64.Int64BE(value.toString()).toBuffer();
-};
-var unpackUnsigned64 = (data) => {
-  const int2 = new Int64.Int64BE(data);
-  return BigInt(int2.toString());
+  const buffer2 = Buffer.allocUnsafe(8);
+  buffer2.writeBigUInt64BE(value, 0);
+  return buffer2;
 };
+var unpackUnsigned64 = (data) => data.readBigUInt64BE(0);
 var packString = (value) => Buffer.from(value, "utf8");
 var unpackString = (data) => data.toString("utf8");
 var packSoftware = (value) => {
@@ -6948,6 +7033,7 @@ function parseMessage(data, integrityKey) {
   );
   const attributeRepository = new AttributeRepository();
   const rawAttributes = [];
+  let messageIntegrityVerified = false;
   for (let pos = HEADER_LENGTH; pos < data.length; ) {
     if (pos + 4 > data.length) {
       return void 0;
@@ -6985,6 +7071,7 @@ function parseMessage(data, integrityKey) {
         if (!integrity.equals(expected)) {
           return void 0;
         }
+        messageIntegrityVerified = true;
       }
     } else {
       rawAttributes.push({
@@ -6995,6 +7082,9 @@ function parseMessage(data, integrityKey) {
     }
     pos = valueEnd + padLen;
   }
+  if (integrityKey && !messageIntegrityVerified) {
+    return void 0;
+  }
   return new Message(
     messageType & 16111,
     messageType & 272,
@@ -7119,6 +7209,10 @@ function paddingLength(length) {
   return rest === 0 ? 0 : 4 - rest;
 }
 
+// ../ice/src/stun/transaction.ts
+import { promises as dns } from "node:dns";
+import { isIP as isIP2 } from "node:net";
+
 // ../ice/src/exceptions.ts
 var TransactionError = class extends Error {
   response;
@@ -7148,32 +7242,100 @@ var TransactionTimeout = class extends TransactionError {
 
 // ../ice/src/stun/transaction.ts
 var log18 = debug("werift-ice:packages/ice/src/stun/transaction.ts");
+async function resolveRequestAddress(addr, family = 0) {
+  if (isIP2(addr[0])) {
+    return addr;
+  }
+  const looked = await dns.lookup(addr[0], { family });
+  return [looked.address, addr[1]];
+}
+function normalizeTransactionOptions(retransmissionsOrOptions, onRequestSent) {
+  if (retransmissionsOrOptions !== null && typeof retransmissionsOrOptions === "object") {
+    return retransmissionsOrOptions;
+  }
+  const retransmissions = typeof retransmissionsOrOptions === "number" ? retransmissionsOrOptions : void 0;
+  return {
+    retransmissions,
+    onRequestSent
+  };
+}
+function addressEquals(a, b) {
+  return a[0] === b[0] && a[1] === b[1];
+}
 var Transaction = class {
-  constructor(request, addr, protocol, retransmissions, onRequestSent) {
+  constructor(request, addr, protocol, retransmissionsOrOptions, onRequestSent) {
     this.request = request;
     this.addr = addr;
     this.protocol = protocol;
-    this.retransmissions = retransmissions;
-    this.onRequestSent = onRequestSent;
-    this.triesMax = 1 + (this.retransmissions ?? RETRY_MAX);
-  }
-  timeoutDelay = RETRY_RTO;
+    const options = normalizeTransactionOptions(
+      retransmissionsOrOptions,
+      onRequestSent
+    );
+    this.triesMax = 1 + (options.retransmissions ?? RETRY_MAX);
+    this.timeoutDelay = options.responseTimeout ?? RETRY_RTO;
+    this.onRequestSent = options.onRequestSent;
+    this.signal = options.signal;
+    this.expectedAddr = addr;
+    this.integrityKey = options.integrityKey;
+  }
+  timeoutDelay;
   ended = false;
   tries = 0;
   triesMax;
   onResponse = new Event2();
+  onRequestSent;
+  signal;
+  /** Remote address this transaction was sent to; responses must match. */
+  expectedAddr;
+  /**
+   * When set, protocol layers re-parse the wire response with this key so
+   * MESSAGE-INTEGRITY failures are rejected before responseReceived.
+   */
+  integrityKey;
+  waitTimer;
+  waitResolve;
+  onAbort;
+  /**
+   * Accept a matching authenticated non-error response from the expected
+   * remote address. Wrong address, missing MESSAGE-INTEGRITY (when required),
+   * or non-success class is rejected without completing the transaction
+   * (wrong address / unauthenticated responses are ignored so we keep waiting).
+   */
   responseReceived = (message, addr) => {
-    if (this.onResponse.length > 0) {
-      if (message.messageClass === 256 /* RESPONSE */) {
-        this.onResponse.execute(message, addr);
-        this.onResponse.complete();
-      } else {
-        this.onResponse.error(new TransactionFailed(message, addr));
+    if (this.ended || this.onResponse.length === 0) {
+      return;
+    }
+    if (!addressEquals(this.expectedAddr, addr)) {
+      log18(
+        "ignore STUN response from unexpected address",
+        addr,
+        "expected",
+        this.expectedAddr
+      );
+      return;
+    }
+    if (this.integrityKey) {
+      const hasIntegrity = message.attributesKeys.includes("MESSAGE-INTEGRITY") || message.attributesKeys.includes("MESSAGE-INTEGRITY-SHA256");
+      if (!hasIntegrity) {
+        log18(
+          "ignore unauthenticated STUN response (MESSAGE-INTEGRITY required)"
+        );
+        return;
       }
     }
+    if (message.messageClass === 256 /* RESPONSE */) {
+      this.onResponse.execute(message, addr);
+      this.onResponse.complete();
+    } else {
+      this.onResponse.error(new TransactionFailed(message, addr));
+    }
   };
   run = async () => {
     try {
+      if (this.signal?.aborted) {
+        throw new TransactionTimeout();
+      }
+      this.attachAbortListener();
       this.retry().catch((e) => {
         log18("retry failed", e);
       });
@@ -7185,28 +7347,85 @@ var Transaction = class {
       this.cancel();
     }
   };
+  attachAbortListener() {
+    if (!this.signal) {
+      return;
+    }
+    this.onAbort = () => {
+      this.failWithTimeout();
+    };
+    this.signal.addEventListener("abort", this.onAbort, { once: true });
+  }
+  failWithTimeout() {
+    if (this.ended) {
+      return;
+    }
+    this.ended = true;
+    this.clearWait();
+    if (this.onResponse.length > 0) {
+      this.onResponse.error(new TransactionTimeout());
+    }
+  }
+  clearWait() {
+    if (this.waitTimer !== void 0) {
+      clearTimeout(this.waitTimer);
+      this.waitTimer = void 0;
+    }
+    const resolve = this.waitResolve;
+    this.waitResolve = void 0;
+    resolve?.();
+  }
+  wait(ms) {
+    return new Promise((resolve) => {
+      if (this.ended || this.signal?.aborted) {
+        resolve();
+        return;
+      }
+      this.waitResolve = resolve;
+      this.waitTimer = setTimeout(() => {
+        this.waitTimer = void 0;
+        this.waitResolve = void 0;
+        resolve();
+      }, ms);
+    });
+  }
   retry = async () => {
     while (this.tries < this.triesMax && !this.ended) {
       this.onRequestSent?.(this.tries);
       this.protocol.sendStun(this.request, this.addr).catch((e) => {
         log18("send stun failed", e);
       });
-      await new Promise((r) => setTimeout(r, this.timeoutDelay));
+      await this.wait(this.timeoutDelay);
       if (this.ended) {
         break;
       }
       this.timeoutDelay *= 2;
       this.tries++;
     }
-    if (this.tries >= this.triesMax) {
+    if (this.tries >= this.triesMax && !this.ended) {
       log18(`retry failed times:${this.tries} maxLimit:${this.triesMax}`);
-      this.onResponse.error(new TransactionTimeout());
+      this.failWithTimeout();
     }
   };
   cancel() {
     this.ended = true;
+    this.clearWait();
+    if (this.signal && this.onAbort) {
+      this.signal.removeEventListener("abort", this.onAbort);
+      this.onAbort = void 0;
+    }
   }
 };
+function buildTransactionOptions(integrityKey, retransmissionsOrOptions, onRequestSent) {
+  const options = normalizeTransactionOptions(
+    retransmissionsOrOptions,
+    onRequestSent
+  );
+  if (integrityKey && !options.integrityKey) {
+    options.integrityKey = integrityKey;
+  }
+  return options;
+}
 
 // ../ice/src/stun/tcpProtocol.ts
 var log19 = debug("werift-ice:packages/ice/src/stun/tcpProtocol.ts");
@@ -7305,10 +7524,13 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
         return;
       }
       if ((message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) && this.transactions[message.transactionIdHex]) {
-        this.transactions[message.transactionIdHex].responseReceived(
-          message,
-          addr
-        );
+        const transaction = this.transactions[message.transactionIdHex];
+        const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+        if (!verified) {
+          log19("STUN response failed MESSAGE-INTEGRITY check");
+          return;
+        }
+        transaction.responseReceived(verified, addr);
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
       }
@@ -7334,7 +7556,7 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
   async sendData(data, addr) {
     await this.sendFrame(data, addr);
   }
-  async request(request, addr, integrityKey, retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactions[request.transactionIdHex]) {
       throw new Error("already requested");
     }
@@ -7342,13 +7564,13 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      retransmissions,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -7507,7 +7729,12 @@ var StunProtocol = class _StunProtocol {
       }
       if ((message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) && this.transactionsKeys.includes(message.transactionIdHex)) {
         const transaction = this.transactions[message.transactionIdHex];
-        transaction.responseReceived(message, addr);
+        const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+        if (!verified) {
+          log20("STUN response failed MESSAGE-INTEGRITY check");
+          return;
+        }
+        transaction.responseReceived(verified, addr);
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
       }
@@ -7534,19 +7761,26 @@ var StunProtocol = class _StunProtocol {
     }
     await this.transport.send(data, addr);
   }
-  async request(request, addr, integrityKey, retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactionsKeys.includes(request.transactionIdHex))
       throw new Error("already request ed");
     if (integrityKey) {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
+    const socketType = this.transport.socketType;
+    const family = socketType === "udp6" ? 6 : 4;
+    const resolvedAddr = await resolveRequestAddress(addr, family);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
+      onRequestSent
+    );
     const transaction = new Transaction(
       request,
-      addr,
+      resolvedAddr,
       this,
-      retransmissions,
-      onRequestSent
+      options
     );
     this.transactions[request.transactionIdHex] = transaction;
     try {
@@ -7717,7 +7951,12 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       if (message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) {
         const transaction = this.turn.transactions[message.transactionIdHex];
         if (transaction) {
-          transaction.responseReceived(message, addr);
+          const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+          if (!verified) {
+            log21("STUN over TURN response failed MESSAGE-INTEGRITY check");
+            return;
+          }
+          transaction.responseReceived(verified, addr);
         }
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
@@ -7726,7 +7965,7 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       log21("datagramReceived error", error);
     }
   };
-  async request(request, addr, integrityKey, _retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.turn.transactions[request.transactionIdHex]) {
       throw new Error("exist");
     }
@@ -7734,13 +7973,13 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      void 0,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.turn.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -7830,7 +8069,12 @@ var TurnProtocol = class _TurnProtocol {
       if (message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) {
         const transaction = this.transactions[message.transactionIdHex];
         if (transaction) {
-          transaction.responseReceived(message, addr);
+          const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+          if (!verified) {
+            log21("TURN STUN response failed MESSAGE-INTEGRITY check");
+            return;
+          }
+          transaction.responseReceived(verified, addr);
         }
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onData.execute(data, addr);
@@ -7902,20 +8146,20 @@ var TurnProtocol = class _TurnProtocol {
       }
     });
   };
-  async request(request, addr, _integrityKey, _retransmissions, onRequestSent) {
+  async request(request, addr, _integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactions[request.transactionIdHex]) {
       throw new Error("exist");
     }
     if (this.integrityKey) {
       request.setAttribute("USERNAME", this.username).setAttribute("REALM", this.realm).setAttribute("NONCE", this.nonce).addMessageIntegrity(this.integrityKey).addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      void 0,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      this.integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -8086,7 +8330,7 @@ function makeIntegrityKey(username, realm, password) {
 
 // ../ice/src/candidate.ts
 import { createHash as createHash3, randomUUID } from "crypto";
-import { isIPv4 } from "net";
+import { isIPv4 as isIPv42 } from "net";
 var Candidate = class _Candidate {
   constructor(foundation, component, transport, priority, host, port, type, relatedAddress, relatedPort, tcptype, generation, ufrag) {
     this.foundation = foundation;
@@ -8151,8 +8395,8 @@ var Candidate = class _Candidate {
     );
   }
   canPairWith(other) {
-    const a = isIPv4(this.host);
-    const b = isIPv4(other.host);
+    const a = isIPv42(this.host);
+    const b = isIPv42(other.host);
     return this.component === other.component && this.transport.toLowerCase() === other.transport.toLowerCase() && canPairTcpCandidates(this, other) && a === b;
   }
   toSdp() {
@@ -8257,10 +8501,8 @@ function remoteTcpTypeForIncoming(localTcpType) {
 
 // ../ice/src/ice.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { isIPv4 as isIPv42 } from "net";
-import * as Int642 from "int64-buffer";
+import { isIPv4 as isIPv43 } from "net";
 import * as timers from "node:timers/promises";
-import isEqual from "fast-deep-equal";
 
 // ../ice/src/dns/lookup.ts
 import mdns from "multicast-dns";
@@ -8383,6 +8625,18 @@ var ICE_COMPLETED = 1;
 var ICE_FAILED = 2;
 var CONSENT_INTERVAL = 5;
 var CONSENT_FAILURES = 6;
+var CONSENT_TIMEOUT = 30;
+var CONSENT_RESPONSE_TIMEOUT = 1e3;
+var CONSENT_RESPONSE_TIMEOUT_MIN = 500;
+function consentResponseTimeoutMs(rttSeconds) {
+  if (rttSeconds === void 0 || !Number.isFinite(rttSeconds) || rttSeconds <= 0) {
+    return CONSENT_RESPONSE_TIMEOUT;
+  }
+  return Math.max(
+    CONSENT_RESPONSE_TIMEOUT_MIN,
+    Math.round(rttSeconds * 1e3 * 2 + 200)
+  );
+}
 var CandidatePairState = /* @__PURE__ */ ((CandidatePairState2) => {
   CandidatePairState2[CandidatePairState2["FROZEN"] = 0] = "FROZEN";
   CandidatePairState2[CandidatePairState2["WAITING"] = 1] = "WAITING";
@@ -8461,7 +8715,34 @@ function validateAddress(addr) {
 
 // ../ice/src/utils.ts
 import * as os from "node:os";
-import nodeIp2 from "ip";
+
+// ../ice/src/internal/selectAddresses.ts
+function selectAddressesFromInterfaces(interfaces, family, options = {}, isLinkLocal) {
+  const costlyNetworks = ["ipsec", "tun", "utun", "tap"];
+  const banNetworks = ["vmnet", "veth"];
+  const { useLinkLocalAddress } = options;
+  const all = Object.keys(interfaces).map((nic) => {
+    for (const word of [...costlyNetworks, ...banNetworks]) {
+      if (nic.startsWith(word)) {
+        return {
+          nic,
+          addresses: []
+        };
+      }
+    }
+    const addresses = (interfaces[nic] ?? []).filter(
+      (details) => normalizeFamilyNodeV18(details.family) === family && !details.internal && (useLinkLocalAddress ? true : !isLinkLocal(details))
+    );
+    return {
+      nic,
+      addresses: addresses.map((address) => address.address)
+    };
+  }).filter((address) => !!address);
+  all.sort((a, b) => a.nic.localeCompare(b.nic));
+  return Object.values(all).flatMap((entry) => entry.addresses);
+}
+
+// ../ice/src/utils.ts
 var logger = debug("werift-ice : packages/ice/src/utils.ts");
 async function getGlobalIp(stunServer, interfaceAddresses) {
   const protocol = new StunProtocol();
@@ -8481,29 +8762,14 @@ function isLinkLocalAddress(info) {
 function nodeIpAddress(family, {
   useLinkLocalAddress
 } = {}) {
-  const costlyNetworks = ["ipsec", "tun", "utun", "tap"];
-  const banNetworks = ["vmnet", "veth"];
   const interfaces = os.networkInterfaces();
   logger(interfaces);
-  const all = Object.keys(interfaces).map((nic) => {
-    for (const word of [...costlyNetworks, ...banNetworks]) {
-      if (nic.startsWith(word)) {
-        return {
-          nic,
-          addresses: []
-        };
-      }
-    }
-    const addresses = interfaces[nic].filter(
-      (details) => normalizeFamilyNodeV18(details.family) === family && !nodeIp2.isLoopback(details.address) && (useLinkLocalAddress ? true : !isLinkLocalAddress(details))
-    );
-    return {
-      nic,
-      addresses: addresses.map((address) => address.address)
-    };
-  }).filter((address) => !!address);
-  all.sort((a, b) => a.nic.localeCompare(b.nic));
-  return Object.values(all).flatMap((entry) => entry.addresses);
+  return selectAddressesFromInterfaces(
+    interfaces,
+    family,
+    { useLinkLocalAddress },
+    isLinkLocalAddress
+  );
 }
 function getHostAddresses(useIpv4, useIpv6, options = {}) {
   const address = [];
@@ -8556,9 +8822,7 @@ var Connection = class {
   localCandidatesEnd = false;
   generation = -1;
   userHistory = {};
-  tieBreaker = BigInt(
-    new Int642.Uint64BE(randomBytes7(64)).toString()
-  );
+  tieBreaker = randomBytes7(8).readBigUInt64BE(0);
   state = "new";
   lookup;
   _remoteCandidates = [];
@@ -8572,6 +8836,12 @@ var Connection = class {
   localCandidatesStart = false;
   protocols = [];
   queryConsentHandle;
+  /** RFC 7675 consent-to-send: application data may use the selected pair. */
+  consentFresh = false;
+  /** Invalidates in-flight consent callbacks on restart / close / replace / expire. */
+  consentSessionId = 0;
+  consentExpiryTimer;
+  consentRequestAbort;
   onData = new Event2();
   stateChanged = new Event2();
   onIceCandidate = new Event2();
@@ -8582,13 +8852,10 @@ var Connection = class {
     if (this.iceLite) {
       value = false;
     }
-    if (this.generation > 0 || this.nominated) {
+    if (this.nominated) {
       return;
     }
-    this._iceControlling = value;
-    for (const pair of this.checkList) {
-      pair.iceControlling = value;
-    }
+    this.applyIceControlling(value);
   }
   get iceLite() {
     return this.options.iceLite;
@@ -8625,13 +8892,13 @@ var Connection = class {
         protocol.localCandidate.ufrag = this.localUsername;
       }
     }
-    this.queryConsentHandle?.resolve?.();
-    this.queryConsentHandle = void 0;
+    this.stopConsentLifecycle();
   }
   resetNominatedPair() {
     log23("resetNominatedPair");
     this.nominated = void 0;
     this.nominating = false;
+    this.stopConsentLifecycle();
   }
   setRemoteParams({
     iceLite,
@@ -8647,6 +8914,13 @@ var Connection = class {
   async gatherCandidates() {
     if (!this.localCandidatesStart) {
       this.localCandidatesStart = true;
+      for (const protocol of this.protocols) {
+        if (protocol.localCandidate) {
+          protocol.localCandidate.generation = this.generation;
+          protocol.localCandidate.ufrag = this.localUsername;
+          this.appendLocalCandidate(protocol.localCandidate);
+        }
+      }
       let address = getHostAddresses(
         this.options.useIpv4,
         this.options.useIpv6,
@@ -8752,7 +9026,7 @@ var Connection = class {
       this.ensureProtocol(protocol);
       try {
         await protocol.connectionMade(
-          isIPv42(address),
+          isIPv43(address),
           this.options.portRange,
           this.options.interfaceAddresses
         );
@@ -8853,7 +9127,7 @@ var Connection = class {
           const stunCandidatePromise = new Promise(
             async (r, f) => {
               const timer2 = setTimeout(f, timeout * 1e3);
-              if (protocol.localCandidate?.host && isIPv42(protocol.localCandidate?.host)) {
+              if (protocol.localCandidate?.host && isIPv43(protocol.localCandidate?.host)) {
                 const candidate = await serverReflexiveCandidate(
                   protocol,
                   stunServer
@@ -9039,84 +9313,211 @@ var Connection = class {
     }
     return false;
   }
-  // 4.1.1.4 ? 生存確認 life check
+  /**
+   * Stop consent request cadence, expiry timer, and outstanding transactions.
+   * Does not change ICE state by itself.
+   */
+  stopConsentLifecycle() {
+    this.consentSessionId++;
+    this.consentFresh = false;
+    if (this.consentExpiryTimer !== void 0) {
+      clearTimeout(this.consentExpiryTimer);
+      this.consentExpiryTimer = void 0;
+    }
+    this.consentRequestAbort?.abort();
+    this.consentRequestAbort = void 0;
+    const handle = this.queryConsentHandle;
+    this.queryConsentHandle = void 0;
+    handle?.resolve?.();
+  }
+  /**
+   * ICE-lite interop only (not required by RFC 7675): mirror libwebrtc
+   * semi-aggressive nomination — attach USE-CANDIDATE when we are controlling,
+   * the remote is ICE-lite, and the target is the current selected pair.
+   */
+  shouldNominateConsentRequest(pair) {
+    return this.iceControlling && this.remoteIsLite && this.nominated?.id === pair.id;
+  }
+  canSendApplicationData() {
+    if (!this.nominated) {
+      return false;
+    }
+    if (this.state === "closed" || this.state === "failed") {
+      return false;
+    }
+    if (this.iceLite) {
+      return true;
+    }
+    return this.consentFresh;
+  }
+  abortableDelay(ms, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal.aborted) {
+        reject(new DOMException("The operation was aborted", "AbortError"));
+        return;
+      }
+      const timer2 = setTimeout(() => {
+        signal.removeEventListener("abort", onAbort);
+        resolve();
+      }, ms);
+      const onAbort = () => {
+        clearTimeout(timer2);
+        reject(new DOMException("The operation was aborted", "AbortError"));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  // RFC 7675 consent freshness
   queryConsent = () => {
     if (this.iceLite) {
       return;
     }
-    if (this.queryConsentHandle) {
-      this.queryConsentHandle.resolve();
-    }
-    this.queryConsentHandle = cancelable(async (_, __, onCancel) => {
-      let failures = 0;
+    this.stopConsentLifecycle();
+    const sessionId = this.consentSessionId;
+    this.consentFresh = true;
+    const handle = cancelable(async (_, __, onCancel) => {
       let canceled = false;
       const cancelEvent = new AbortController();
+      const clearConsentExpiry = () => {
+        if (this.consentExpiryTimer === void 0) {
+          return;
+        }
+        clearTimeout(this.consentExpiryTimer);
+        this.consentExpiryTimer = void 0;
+      };
+      const refreshConsentExpiry = () => {
+        if (canceled || sessionId !== this.consentSessionId) {
+          return;
+        }
+        clearConsentExpiry();
+        this.consentExpiryTimer = setTimeout(() => {
+          this.consentExpiryTimer = void 0;
+          if (canceled || sessionId !== this.consentSessionId) {
+            return;
+          }
+          if (this.state === "closed" || this.state === "failed") {
+            return;
+          }
+          log23("Consent to send expired");
+          this.consentFresh = false;
+          this.consentSessionId++;
+          this.consentRequestAbort?.abort();
+          this.consentRequestAbort = void 0;
+          if (this.queryConsentHandle === handle) {
+            this.queryConsentHandle = void 0;
+          }
+          canceled = true;
+          cancelEvent.abort();
+          this.setState("failed");
+        }, CONSENT_TIMEOUT * 1e3);
+      };
       onCancel.once(() => {
         canceled = true;
-        failures += CONSENT_FAILURES;
+        if (sessionId === this.consentSessionId) {
+          clearConsentExpiry();
+          this.consentRequestAbort?.abort();
+          this.consentRequestAbort = void 0;
+        }
         cancelEvent.abort();
-        this.queryConsentHandle = void 0;
+        if (this.queryConsentHandle === handle) {
+          this.queryConsentHandle = void 0;
+        }
       });
-      const { localUsername, remoteUsername, iceControlling } = this;
+      refreshConsentExpiry();
+      const randomizedConsentInterval = () => CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1e3;
+      let nextConsentAt = Date.now() + randomizedConsentInterval();
+      const isTerminalState = () => this.state === "closed" || this.state === "failed";
       try {
-        while (this.state !== "closed" && !canceled) {
-          await timers.setTimeout(
-            CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1e3,
-            void 0,
-            { signal: cancelEvent.signal }
+        while (!isTerminalState() && !canceled && sessionId === this.consentSessionId) {
+          await this.abortableDelay(
+            Math.max(0, nextConsentAt - Date.now()),
+            cancelEvent.signal
           );
+          if (canceled || isTerminalState() || sessionId !== this.consentSessionId) {
+            break;
+          }
+          nextConsentAt = Date.now() + randomizedConsentInterval();
           const nominated = this.nominated;
-          if (!nominated || canceled) {
+          if (!nominated) {
             break;
           }
+          const pairId = nominated.id;
+          const generation = this.generation;
+          const remotePassword = this.remotePassword;
+          const { localUsername, remoteUsername, iceControlling } = this;
           const request = this.buildRequest({
-            nominate: false,
+            nominate: this.shouldNominateConsentRequest(nominated),
             localUsername,
             remoteUsername,
             iceControlling,
             localCandidate: nominated.localCandidate
           });
-          try {
-            nominated.consentRequestsSent++;
-            nominated.requestsSent++;
-            await nominated.protocol.request(
-              request,
-              nominated.remoteAddr,
-              Buffer.from(this.remotePassword, "utf8"),
-              0,
-              (attempt) => {
+          this.consentRequestAbort?.abort();
+          const requestAbort = new AbortController();
+          this.consentRequestAbort = requestAbort;
+          nominated.consentRequestsSent++;
+          nominated.requestsSent++;
+          const responseTimeout = consentResponseTimeoutMs(nominated.rtt);
+          const requestStartedAt = performance.now();
+          nominated.protocol.request(
+            request,
+            nominated.remoteAddr,
+            Buffer.from(remotePassword, "utf8"),
+            {
+              retransmissions: 0,
+              responseTimeout,
+              signal: requestAbort.signal,
+              onRequestSent: (attempt) => {
                 if (attempt > 0) {
                   nominated.retransmissionsSent++;
                 }
               }
-            );
+            }
+          ).then(() => {
+            if (sessionId !== this.consentSessionId || canceled) {
+              return;
+            }
+            const state = this.state;
+            if (state === "closed" || state === "failed") {
+              return;
+            }
+            if (this.nominated?.id !== pairId) {
+              return;
+            }
+            if (this.generation !== generation) {
+              return;
+            }
+            if (this.remotePassword !== remotePassword) {
+              return;
+            }
+            const rtt = (performance.now() - requestStartedAt) / 1e3;
+            nominated.rtt = rtt;
+            nominated.totalRoundTripTime += rtt;
+            nominated.roundTripTimeMeasurements++;
             nominated.responsesReceived++;
-            failures = 0;
-            if (this.state === "disconnected") {
+            this.consentFresh = true;
+            refreshConsentExpiry();
+            if (state === "disconnected") {
               this.setState("connected");
             }
-          } catch (error) {
-            if (nominated.id === this.nominated?.id) {
-              log23("no stun response");
-              failures++;
-              this.setState("disconnected");
-              break;
+          }).catch((error) => {
+            if (sessionId === this.consentSessionId && this.nominated?.id === pairId) {
+              log23("no stun response", error);
             }
-          }
-          if (failures >= CONSENT_FAILURES) {
-            log23("Consent to send expired");
-            this.queryConsentHandle = void 0;
-            this.setState("closed");
-            break;
-          }
+          });
         }
       } catch (error) {
+      } finally {
+        if (sessionId === this.consentSessionId) {
+          clearConsentExpiry();
+        }
       }
     });
+    this.queryConsentHandle = handle;
   };
   async close() {
     this.setState("closed");
-    this.queryConsentHandle?.resolve?.();
+    this.stopConsentLifecycle();
     if (this.checkList && !this.checkListDone) {
       this.checkListState.put(
         new Promise((r) => {
@@ -9166,14 +9567,13 @@ var Connection = class {
     this.sortCheckList();
   }
   send = async (data) => {
-    const activePair = this.nominated;
-    if (activePair) {
-      await activePair.protocol.sendData(data, activePair.remoteAddr);
-      activePair.packetsSent++;
-      activePair.bytesSent += data.length;
-    } else {
+    if (!this.canSendApplicationData()) {
       return;
     }
+    const activePair = this.nominated;
+    await activePair.protocol.sendData(data, activePair.remoteAddr);
+    activePair.packetsSent++;
+    activePair.bytesSent += data.length;
   };
   getDefaultCandidate() {
     const candidates = this.localCandidates.sort(
@@ -9208,13 +9608,22 @@ var Connection = class {
   }
   findPair(protocol, remoteCandidate) {
     const pair = this.checkList.find(
-      (pair2) => isEqual(pair2.protocol, protocol) && isEqual(pair2.remoteCandidate, remoteCandidate)
+      (pair2) => pair2.protocol === protocol && pair2.remoteCandidate === remoteCandidate
     );
     return pair;
   }
+  applyIceControlling(iceControlling) {
+    this._iceControlling = iceControlling;
+    for (const pair of this.checkList) {
+      pair.iceControlling = iceControlling;
+    }
+  }
   switchRole(iceControlling) {
     log23("switch role", iceControlling);
-    this.iceControlling = iceControlling;
+    if (this.iceLite) {
+      iceControlling = false;
+    }
+    this.applyIceControlling(iceControlling);
     this.sortCheckList();
   }
   checkComplete(pair) {
@@ -9226,6 +9635,9 @@ var Connection = class {
         this.nominated = pair;
         this.nominating = false;
         this.pruneTcpConnections(pair);
+        if (!this.iceLite && (this.state === "connected" || this.state === "completed")) {
+          this.queryConsent();
+        }
         for (const p of this.checkList) {
           if (p.component === pair.component && [1 /* WAITING */, 0 /* FROZEN */].includes(
             p.state
@@ -9351,7 +9763,7 @@ var Connection = class {
         return;
       }
     }
-    if (!isEqual(result.addr, pair.remoteAddr)) {
+    if (result.addr[0] !== pair.remoteAddr[0] || result.addr[1] !== pair.remoteAddr[1]) {
       pair.updateState(4 /* FAILED */);
       this.checkComplete(pair);
       r();
@@ -10763,8 +11175,7 @@ var StreamStatistics = class {
 
 // src/sdp.ts
 import { randomBytes as randomBytes9 } from "crypto";
-import { isIPv4 as isIPv43 } from "net";
-import * as Int643 from "int64-buffer";
+import { isIPv4 as isIPv44 } from "net";
 
 // src/transport/dtls.ts
 import { Certificate as Certificate3, PrivateKey as PrivateKey2 } from "@fidm/x509";
@@ -11698,11 +12109,9 @@ var RTCIceParameters = class {
 
 // src/transport/sctp.ts
 import { randomUUID as randomUUID8 } from "crypto";
-import { jspack as jspack5 } from "@shinyoshiaki/jspack";
 
 // ../sctp/src/sctp.ts
 import { createHmac as createHmac5, randomBytes as randomBytes8 } from "crypto";
-import { jspack as jspack4 } from "@shinyoshiaki/jspack";
 
 // ../sctp/src/chunk.ts
 var Chunk = class _Chunk {
@@ -12155,7 +12564,6 @@ function createEventsFromList(list) {
 }
 
 // ../sctp/src/param.ts
-import { jspack as jspack3 } from "@shinyoshiaki/jspack";
 var OutgoingSSNResetRequestParam = class _OutgoingSSNResetRequestParam {
   // Outgoing SSN Reset Request Parameter
   constructor(requestSequence, responseSequence, lastTsn, streams) {
@@ -12169,26 +12577,26 @@ var OutgoingSSNResetRequestParam = class _OutgoingSSNResetRequestParam {
     return _OutgoingSSNResetRequestParam.type;
   }
   get bytes() {
-    const data = Buffer.from(
-      jspack3.Pack("!LLL", [
-        this.requestSequence,
-        this.responseSequence,
-        this.lastTsn
-      ])
-    );
+    const data = Buffer.allocUnsafe(12);
+    data.writeUInt32BE(this.requestSequence, 0);
+    data.writeUInt32BE(this.responseSequence, 4);
+    data.writeUInt32BE(this.lastTsn, 8);
     return Buffer.concat([
       data,
-      ...this.streams.map((stream) => Buffer.from(jspack3.Pack("!H", [stream])))
+      ...this.streams.map((stream) => {
+        const buf = Buffer.allocUnsafe(2);
+        buf.writeUInt16BE(stream, 0);
+        return buf;
+      })
     ]);
   }
   static parse(data) {
-    const [requestSequence, responseSequence, lastTsn] = jspack3.Unpack(
-      "!LLL",
-      data
-    );
+    const requestSequence = data.readUInt32BE(0);
+    const responseSequence = data.readUInt32BE(4);
+    const lastTsn = data.readUInt32BE(8);
     const stream = [];
     for (let pos = 12; pos < data.length; pos += 2) {
-      stream.push(jspack3.Unpack("!H", data.slice(pos))[0]);
+      stream.push(data.readUInt16BE(pos));
     }
     return new _OutgoingSSNResetRequestParam(
       requestSequence,
@@ -12209,12 +12617,15 @@ var StreamAddOutgoingParam = class _StreamAddOutgoingParam {
     return _StreamAddOutgoingParam.type;
   }
   get bytes() {
-    return Buffer.from(
-      jspack3.Pack("!LHH", [this.requestSequence, this.newStreams, 0])
-    );
+    const buf = Buffer.allocUnsafe(8);
+    buf.writeUInt32BE(this.requestSequence, 0);
+    buf.writeUInt16BE(this.newStreams, 4);
+    buf.writeUInt16BE(0, 6);
+    return buf;
   }
   static parse(data) {
-    const [requestSequence, newStreams] = jspack3.Unpack("!LHH", data);
+    const requestSequence = data.readUInt32BE(0);
+    const newStreams = data.readUInt16BE(4);
     return new _StreamAddOutgoingParam(requestSequence, newStreams);
   }
 };
@@ -12233,12 +12644,14 @@ var ReconfigResponseParam = class _ReconfigResponseParam {
     return _ReconfigResponseParam.type;
   }
   get bytes() {
-    return Buffer.from(
-      jspack3.Pack("!LL", [this.responseSequence, this.result])
-    );
+    const buf = Buffer.allocUnsafe(8);
+    buf.writeUInt32BE(this.responseSequence, 0);
+    buf.writeUInt32BE(this.result, 4);
+    return buf;
   }
   static parse(data) {
-    const [requestSequence, result] = jspack3.Unpack("!LL", data);
+    const requestSequence = data.readUInt32BE(0);
+    const result = data.readUInt32BE(4);
     return new _ReconfigResponseParam(requestSequence, result);
   }
 };
@@ -12507,8 +12920,10 @@ var SCTP = class _SCTP {
           ack.inboundStreams = this._inboundStreamsCount;
           ack.initialTsn = this.localTsn;
           this.setExtensions(ack.params);
-          const time = Date.now() / 1e3;
-          let cookie = Buffer.from(jspack4.Pack("!L", [time]));
+          const time = Math.floor(Date.now() / 1e3);
+          const cookieTime = Buffer.allocUnsafe(4);
+          cookieTime.writeUInt32BE(time, 0);
+          let cookie = cookieTime;
           cookie = Buffer.concat([
             cookie,
             createHmac5("sha1", this.hmacKey).update(cookie).digest()
@@ -12599,8 +13014,8 @@ var SCTP = class _SCTP {
             log30("x State cookie is invalid");
             return;
           }
-          const now = Date.now() / 1e3;
-          const stamp = jspack4.Unpack("!L", cookie)[0];
+          const now = Math.floor(Date.now() / 1e3);
+          const stamp = cookie.readUInt32BE(0);
           if (stamp < now - COOKIE_LIFETIME || stamp > now) {
             const error = new ErrorChunk(0, void 0);
             error.params.push([
@@ -13230,10 +13645,9 @@ var SCTP = class _SCTP {
     if (this.associationState !== 4 /* ESTABLISHED */) return;
     if (this.flightSize === 0 && this.outboundQueue.length === 0) {
       const heartbeat = new HeartbeatChunk();
-      heartbeat.params.push([
-        1,
-        Buffer.from(jspack4.Pack("!L", [Math.floor(Date.now() / 1e3)]))
-      ]);
+      const heartbeatTime = Buffer.allocUnsafe(4);
+      heartbeatTime.writeUInt32BE(Math.floor(Date.now() / 1e3), 0);
+      heartbeat.params.push([1, heartbeatTime]);
       await this.sendChunk(heartbeat).catch((err5) => {
         log30("send heartbeat failed", err5.message);
       });
@@ -13599,14 +14013,10 @@ var RTCSctpTransport = class _RTCSctpTransport {
               return;
             }
             if (!Object.keys(this.dataChannels).includes(streamId.toString())) {
-              const [
-                ,
-                channelType,
-                ,
-                reliability,
-                labelLength,
-                protocolLength
-              ] = jspack5.Unpack("!BBHLHH", data);
+              const channelType = data.readUInt8(1);
+              const reliability = data.readUInt32BE(4);
+              const labelLength = data.readUInt16BE(8);
+              const protocolLength = data.readUInt16BE(10);
               let pos = 12;
               const label = data.slice(pos, pos + labelLength).toString("utf8");
               pos += labelLength;
@@ -13637,11 +14047,9 @@ var RTCSctpTransport = class _RTCSctpTransport {
               log31("datachannel already opened", "retransmit ack");
             }
             const channel = this.dataChannels[streamId];
-            this.dataChannelQueue.push([
-              channel,
-              WEBRTC_DCEP,
-              Buffer.from(jspack5.Pack("!B", [DATA_CHANNEL_ACK]))
-            ]);
+            const ack = Buffer.allocUnsafe(1);
+            ack.writeUInt8(DATA_CHANNEL_ACK, 0);
+            this.dataChannelQueue.push([channel, WEBRTC_DCEP, ack]);
             await this.dataChannelFlush();
           }
           break;
@@ -13716,16 +14124,15 @@ var RTCSctpTransport = class _RTCSctpTransport {
       channelType = 2;
       reliability = channel.maxPacketLifeTime;
     }
-    const data = jspack5.Pack("!BBHLHH", [
-      DATA_CHANNEL_OPEN,
-      channelType,
-      priority,
-      reliability,
-      channel.label.length,
-      channel.protocol.length
-    ]);
+    const data = Buffer.allocUnsafe(12);
+    data.writeUInt8(DATA_CHANNEL_OPEN, 0);
+    data.writeUInt8(channelType, 1);
+    data.writeUInt16BE(priority, 2);
+    data.writeUInt32BE(reliability, 4);
+    data.writeUInt16BE(channel.label.length, 8);
+    data.writeUInt16BE(channel.protocol.length, 10);
     const send = Buffer.concat([
-      Buffer.from(data),
+      data,
       Buffer.from(channel.label, "utf8"),
       Buffer.from(channel.protocol, "utf8")
     ]);
@@ -14332,7 +14739,7 @@ function ipAddressFromSdp(sdp) {
   return m[2];
 }
 function ipAddressToSdp(addr) {
-  const version = isIPv43(addr) ? 4 : 6;
+  const version = isIPv44(addr) ? 4 : 6;
   return `IN IP${version} ${addr}`;
 }
 function candidateToSdp(c) {
@@ -14422,7 +14829,7 @@ var RTCSessionDescription = class {
 };
 function addSDPHeader(type, description) {
   const username = "-";
-  const sessionId = new Int643.Uint64BE(randomBytes9(64)).toString().slice(0, 8);
+  const sessionId = randomBytes9(8).readBigUInt64BE(0).toString().slice(0, 8);
   const sessionVersion = 0;
   description.origin = `${username} ${sessionId} ${sessionVersion} IN IP4 0.0.0.0`;
   description.msidSemantic.push(new GroupDescription("WMS", ["*"]));
@@ -14977,7 +15384,6 @@ var RtpRouter = class {
 
 // src/media/rtpSender.ts
 import { randomBytes as randomBytes10 } from "crypto";
-import { jspack as jspack6 } from "@shinyoshiaki/jspack";
 import { randomUUID as randomUUID10 } from "crypto";
 import { setTimeout as setTimeout9 } from "timers/promises";
 
@@ -15140,8 +15546,8 @@ var RTCRtpSender = class {
   }
   type = "sender";
   kind;
-  ssrc = jspack6.Unpack("!L", randomBytes10(4))[0];
-  rtxSsrc = jspack6.Unpack("!L", randomBytes10(4))[0];
+  ssrc = randomBytes10(4).readUInt32BE(0);
+  rtxSsrc = randomBytes10(4).readUInt32BE(0);
   trackId = randomUUID10().toString();
   onReady = new Event2();
   onRtcp = new Event2();
@@ -16561,6 +16967,11 @@ var SecureTransportManager = class {
     log36("iceConnectionStateChange", newState);
     this.iceConnectionState = newState;
     this.iceConnectionStateChange.execute(newState);
+    if (newState === "failed" && this.connectionState !== "closed") {
+      this.setConnectionState("failed");
+    } else if (newState === "disconnected" && this.connectionState === "connected") {
+      this.setConnectionState("disconnected");
+    }
   }
   async gatherCandidates(remoteIsBundled) {
     const connected = this.iceTransports.find(
@@ -16577,6 +16988,9 @@ var SecureTransportManager = class {
     }
   }
   setConnectionState(state) {
+    if (this.connectionState === state) {
+      return;
+    }
     log36("connectionStateChange", state);
     this.connectionState = state;
     this.connectionStateChange.execute(state);
@@ -17936,6 +18350,9 @@ export {
   BufferChain,
   CONSENT_FAILURES,
   CONSENT_INTERVAL,
+  CONSENT_RESPONSE_TIMEOUT,
+  CONSENT_RESPONSE_TIMEOUT_MIN,
+  CONSENT_TIMEOUT,
   COOKIE,
   Candidate,
   CandidatePair,
@@ -18091,6 +18508,7 @@ export {
   codecParametersFromString,
   codecParametersToString,
   compactNtp,
+  consentResponseTimeoutMs,
   crc32,
   crc32c,
   createBufferWriter,