wire-mesh 3.1.2 → 3.2.1

package/README.md

@@ -34,12 +34,13 @@ Every flag the CLI accepts, exactly as `wire-mesh --help` prints it. An unknown
 Usage: wire-mesh [options]
 
 Options:
-      --bind <host:port>    Address to listen on. Port 0 asks the OS for a free port. Use 127.0.0.1:8787 to accept local connections only. (default: 0.0.0.0:8787)
-      --tls-cert <path>     PEM certificate file, to serve wss:// and https://. Requires --tls-key.
-      --tls-key <path>      PEM private key file for --tls-cert. Requires --tls-cert.
-      --mailbox-dir <path>  Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given.
-  -h, --help                Print this help and exit.
-  -v, --version             Print the version and exit.
+      --bind <host:port>          Address to listen on. Port 0 asks the OS for a free port. Use 127.0.0.1:8787 to accept local connections only. (default: 0.0.0.0:8787)
+      --tls-cert <path>           PEM certificate file, to serve wss:// and https://. Requires --tls-key.
+      --tls-key <path>            PEM private key file for --tls-cert. Requires --tls-cert.
+      --mailbox-dir <path>        Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given.
+      --webtransport <host:port>  Also serve WebTransport on this UDP address, with a self-signed certificate renewed on a schedule that a browser accepts by pinning its hash, and print the address to give a console. Needs the optional @fails-components/webtransport dependency. Off unless given.
+  -h, --help                      Print this help and exit.
+  -v, --version                   Print the version and exit.
 ```
 
 **Default bind address is `0.0.0.0:8787`, not loopback.** Unlike a typical dev-server tool, whose loopback-only default assumes only the machine itself needs to reach it, this package's whole purpose is LAN reachability — a phone on the same network, a laptop in the next room. `--bind` overrides the address if you want to restrict it (loopback-only, a specific interface, a different port).
@@ -51,6 +52,8 @@ curl http://<host>:8787/health
 # {"ok":true,"node":"wire-mesh","roles":["relay"]}
 ```
 
+With `--webtransport <host:port>` the node also serves WebTransport on a UDP port, for a browser that has no way to trust a certificate for this node's LAN address. The node mints a self-signed ECDSA certificate valid for under two weeks, renews it on a schedule, and prints an address of the form `https://<host>:<port>#sha256=<hash>` for each address of this machine a client can reach (when bound to a wildcard, one per non-internal IPv4 address). Give one of them to a console (the Node field takes it as typed): a browser accepts the certificate by that hash with no certificate authority and no internet. The server is the optional `@fails-components/webtransport` dependency with its native binary; where it is not installed the flag fails at startup rather than serving without it. The prebuilt binary needs glibc 2.38 or newer on Linux. The certificate is renewed before it expires, and the new address is printed when its hash changes.
+
 With `--mailbox-dir` the node also serves the announcer role and `/health` says so (`"roles":["relay","announcer"]`). It then holds other devices' `core/data` logs in that directory while those devices are offline, so a peer that reconnects catches up from the node. Only the device that owns a log can write to it: the node takes a log's entries from the connection whose verified advert names that device and from no one else. Any client that has gossiped an advert can read a log. Entries are opaque bytes to the node, and the applications that write them sign and encrypt their own. The number of logs, the bytes in each and the size of an entry are bounded (`src/mailbox-limits.ts`), and a frame that would exceed a bound is refused whole; nothing is evicted, so a full log stays full until the directory is cleared.
 
 **TLS (`wss://`/`https://`)** is opt-in via `--tls-cert`/`--tls-key`, both required together — this package generates no certificate of its own, so bring your own (a real one from a CA, or a self-signed one for a LAN). This matters specifically for wire-mesh#182/#183: an `https://`-served PWA (`mesh.exadev.io`) can only reach a plain `ws://` node if it's literally on `localhost` of the same machine, since browsers block mixed-content WebSocket connections from a secure page to an insecure one — a self-hosted node on someone's LAN, addressed by its own IP, needs to answer `wss://` for that PWA to reach it at all. How a LAN node is meant to be reached from the HTTPS-served console, and why a certificate is not the whole answer, is worked through in [docs/lan-certificates.md](docs/lan-certificates.md).

package/dist/server.cjs

@@ -9,6 +9,12 @@ let wire_mesh_core_adapters_node_identity = require("wire-mesh-core/adapters/nod
 let node_util = require("node:util");
 let wire_mesh_core_domain_hub_mailbox = require("wire-mesh-core/domain/hub-mailbox");
 let wire_mesh_core_adapters_node_fs_storage = require("wire-mesh-core/adapters/node-fs-storage");
+let node_crypto = require("node:crypto");
+let node_os = require("node:os");
+let wire_mesh_core_adapters_byte_stream_connection = require("wire-mesh-core/adapters/byte-stream-connection");
+let wire_mesh_core_domain_pinned_address = require("wire-mesh-core/domain/pinned-address");
+require("reflect-metadata");
+let _peculiar_x509 = require("@peculiar/x509");
 //#region src/cli-options.ts
 /** The address the server binds when --bind is not given. */
 const DEFAULT_BIND_ADDRESS = "0.0.0.0:8787";
@@ -36,6 +42,11 @@ const FLAGS = {
 		valueName: "path",
 		description: "Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given."
 	},
+	webtransport: {
+		type: "string",
+		valueName: "host:port",
+		description: "Also serve WebTransport on this UDP address, with a self-signed certificate renewed on a schedule that a browser accepts by pinning its hash, and print the address to give a console. Needs the optional @fails-components/webtransport dependency. Off unless given."
+	},
 	help: {
 		type: "boolean",
 		short: "h",
@@ -69,11 +80,11 @@ function helpText() {
 		...rows.map((row) => `  ${row.label.padEnd(labelWidth)}  ${row.description}`)
 	].join("\n");
 }
-function validatedBindAddress(address) {
+function validatedBindAddress(flag, address) {
 	const separator = address.lastIndexOf(":");
 	const host = address.slice(0, separator);
 	const port = address.slice(separator + 1);
-	if (separator === -1 || host === "" || !/^\d+$/.test(port) || Number(port) > MAX_PORT) throw new CliUsageError(`--bind expects host:port with a port from 0 to ${String(MAX_PORT)}, got "${address}"`);
+	if (separator === -1 || host === "" || !/^\d+$/.test(port) || Number(port) > MAX_PORT) throw new CliUsageError(`--${flag} expects host:port with a port from 0 to ${String(MAX_PORT)}, got "${address}"`);
 	return address;
 }
 /** Parses the process arguments (without the node and script entries) into the command they ask for. Throws CliUsageError for an unknown flag, a stray positional argument, a flag missing or given an unwanted value, a malformed --bind address, or --tls-cert without --tls-key (or the reverse). */
@@ -97,12 +108,13 @@ function parseCliArguments(argv) {
 	if (certPath === void 0 !== (keyPath === void 0)) throw new CliUsageError("--tls-cert and --tls-key must be given together");
 	return {
 		kind: "serve",
-		bindAddress: validatedBindAddress(values.bind),
+		bindAddress: validatedBindAddress("bind", values.bind),
 		tls: certPath === void 0 || keyPath === void 0 ? void 0 : {
 			certPath,
 			keyPath
 		},
-		mailboxDir: values["mailbox-dir"]
+		mailboxDir: values["mailbox-dir"],
+		webTransportAddress: values.webtransport === void 0 ? void 0 : validatedBindAddress("webtransport", values.webtransport)
 	};
 }
 //#endregion
@@ -115,6 +127,153 @@ const nodeMailboxLimits = {
 	readBatch: 64
 };
 //#endregion
+//#region src/adapters/pinned-certificate.ts
+const MILLISECONDS_PER_DAY = 864e5;
+const MAX_PINNED_CERTIFICATE_LIFETIME_DAYS = 14;
+const CLOCK_SKEW_ALLOWANCE_DAYS = 1;
+const SERIAL_NUMBER_BYTES = 16;
+const PEM_LINE_LENGTH = 64;
+/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
+const PINNED_CERTIFICATE_LIFETIME_MS = MAX_PINNED_CERTIFICATE_LIFETIME_DAYS * MILLISECONDS_PER_DAY - CLOCK_SKEW_ALLOWANCE_DAYS * MILLISECONDS_PER_DAY;
+const SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256",
+	hash: "SHA-256"
+};
+function toHex(bytes) {
+	return Buffer.from(bytes).toString("hex");
+}
+function toPem(label, der) {
+	return `-----BEGIN ${label}-----\n${(Buffer.from(der).toString("base64").match(new RegExp(`.{1,${String(PEM_LINE_LENGTH)}}`, "g")) ?? []).join("\n")}\n-----END ${label}-----\n`;
+}
+/**
+* Mints an ECDSA P-256 certificate valid from `now` for PINNED_CERTIFICATE_LIFETIME_MS. Clients pin it by hash rather than by name, so it carries only a common name.
+*/
+async function mintPinnedCertificate(now) {
+	const keys = await crypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
+	const notAfter = new Date(now.getTime() + PINNED_CERTIFICATE_LIFETIME_MS);
+	const certificate = await _peculiar_x509.X509CertificateGenerator.createSelfSigned({
+		serialNumber: toHex(crypto.getRandomValues(new Uint8Array(SERIAL_NUMBER_BYTES))),
+		name: "CN=wire-mesh",
+		notBefore: now,
+		notAfter,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		keys,
+		extensions: [
+			new _peculiar_x509.BasicConstraintsExtension(false, void 0, true),
+			new _peculiar_x509.KeyUsagesExtension(_peculiar_x509.KeyUsageFlags.digitalSignature, true),
+			new _peculiar_x509.ExtendedKeyUsageExtension([_peculiar_x509.ExtendedKeyUsage.serverAuth], true)
+		]
+	});
+	const digest = await crypto.subtle.digest("SHA-256", certificate.rawData);
+	return {
+		certificatePem: certificate.toString("pem"),
+		privateKeyPem: toPem("PRIVATE KEY", await crypto.subtle.exportKey("pkcs8", keys.privateKey)),
+		sha256Hex: toHex(new Uint8Array(digest)),
+		notAfter
+	};
+}
+//#endregion
+//#region src/adapters/webtransport-transport.ts
+/** The path a client opens its WebTransport session on. */
+const WEBTRANSPORT_PATH = "/wire-mesh";
+const RENEWAL_DELAY_MS = PINNED_CERTIFICATE_LIFETIME_MS * .5;
+const SECRET_BYTES = 32;
+const WILDCARD_HOSTS = ["0.0.0.0", "::"];
+/** The hosts a client can dial for a listener bound to `host`: the host itself, or for a wildcard every non-internal IPv4 address of this machine. */
+function reachableHosts(host) {
+	if (!WILDCARD_HOSTS.includes(host)) return [host];
+	return Object.values((0, node_os.networkInterfaces)()).flatMap((addresses) => addresses ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal).map((entry) => entry.address);
+}
+/** The optional WebTransport package is not installed, or its native binary was not built for this platform. */
+var WebTransportUnavailableError = class extends Error {
+	constructor(cause) {
+		super("serving WebTransport needs the optional dependency @fails-components/webtransport and its native binary, which is missing: either no binary is published for this platform, or the package manager skipped its install script (an ignore-scripts setting does that)", { cause });
+		this.name = "WebTransportUnavailableError";
+	}
+};
+async function loadHttp3Server() {
+	try {
+		await import("@fails-components/webtransport-transport-http3-quiche");
+		const module = await import("@fails-components/webtransport");
+		await module.quicheLoaded;
+		return module.Http3Server;
+	} catch (error) {
+		throw new WebTransportUnavailableError(error);
+	}
+}
+function isIncomingSession(value) {
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+}
+/**
+* A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
+*
+* `listen` rejects with WebTransportUnavailableError when the optional native dependency is absent. `connect` always rejects: see its comment.
+*/
+function createWebTransportTransport(options = {}) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const reportError = (error) => {
+		options.onError?.(error);
+	};
+	return {
+		async connect() {
+			return Promise.reject(/* @__PURE__ */ new Error("a Node process cannot dial WebTransport with a pinned certificate hash; dial a wss:// address instead"));
+		},
+		async listen(address, onConnection) {
+			const Http3ServerClass = await loadHttp3Server();
+			const lastColon = address.lastIndexOf(":");
+			const host = address.slice(0, lastColon);
+			const port = Number(address.slice(lastColon + 1));
+			let certificate = await mintPinnedCertificate(now());
+			const server = new Http3ServerClass({
+				host,
+				port,
+				secret: (0, node_crypto.randomBytes)(SECRET_BYTES).toString("hex"),
+				cert: certificate.certificatePem,
+				privKey: certificate.privateKeyPem
+			});
+			server.startServer();
+			await server.ready;
+			const bound = server.address();
+			if (bound === null) throw new Error("the WebTransport server bound no address");
+			const boundAddress = `${host}:${String(bound.port)}`;
+			const advertise = () => reachableHosts(host).map((reachable) => (0, wire_mesh_core_domain_pinned_address.formatPinnedAddress)(`${reachable}:${String(bound.port)}`, certificate.sha256Hex));
+			(async () => {
+				for await (const session of server.sessionStream(WEBTRANSPORT_PATH)) (async () => {
+					if (!isIncomingSession(session)) throw new Error("the WebTransport server yielded a malformed session");
+					await session.ready;
+					const reader = session.incomingBidirectionalStreams.getReader();
+					const first = await reader.read();
+					reader.releaseLock();
+					if (!first.done) onConnection((0, wire_mesh_core_adapters_byte_stream_connection.connectionFromByteStream)(first.value));
+				})().catch(reportError);
+			})().catch(reportError);
+			const renewal = setInterval(() => {
+				mintPinnedCertificate(now()).then((renewed) => {
+					certificate = renewed;
+					server.updateCert(renewed.certificatePem, renewed.privateKeyPem, false);
+					options.onCertificateRenewed?.(advertise());
+				}).catch(reportError);
+			}, RENEWAL_DELAY_MS);
+			renewal.unref();
+			return {
+				address: boundAddress,
+				get advertisedAddresses() {
+					return advertise();
+				},
+				close: async () => {
+					clearInterval(renewal);
+					server.stopServer();
+					await server.closed;
+				},
+				unref: () => {
+					renewal.unref();
+				}
+			};
+		}
+	};
+}
+//#endregion
 //#region src/static-console.ts
 const CONTENT_TYPES = {
 	".css": "text/css; charset=utf-8",
@@ -241,6 +400,19 @@ async function main(argv) {
 		hub.handleConnection(connection);
 	});
 	logOutput(`wire-mesh listening on ${tls ? "wss" : "ws"}://${listener.address}`);
+	if (command.webTransportAddress !== void 0) {
+		const webTransport = await createWebTransportTransport({
+			onError: (error) => {
+				logError(`wire-mesh: WebTransport: ${String(error)}`);
+			},
+			onCertificateRenewed: (addresses) => {
+				logOutput(`wire-mesh WebTransport addresses changed: ${addresses.join(" ")}`);
+			}
+		}).listen(command.webTransportAddress, (connection) => {
+			hub.handleConnection(connection);
+		});
+		for (const address of webTransport.advertisedAddresses) logOutput(`wire-mesh serving WebTransport at ${address}`);
+	}
 }
 /** Runs the CLI and turns a failure into a one-line message on stderr and a non-zero exit code, instead of an unhandled rejection's stack trace. */
 async function run(argv) {

package/dist/server.mjs

@@ -8,6 +8,12 @@ import { deriveDeviceId, verifyWithPublicKey } from "wire-mesh-core/adapters/nod
 import { parseArgs } from "node:util";
 import { createMailbox } from "wire-mesh-core/domain/hub-mailbox";
 import { createNodeFsStorage } from "wire-mesh-core/adapters/node-fs-storage";
+import { randomBytes } from "node:crypto";
+import { networkInterfaces } from "node:os";
+import { connectionFromByteStream } from "wire-mesh-core/adapters/byte-stream-connection";
+import { formatPinnedAddress } from "wire-mesh-core/domain/pinned-address";
+import "reflect-metadata";
+import { BasicConstraintsExtension, ExtendedKeyUsage, ExtendedKeyUsageExtension, KeyUsageFlags, KeyUsagesExtension, X509CertificateGenerator } from "@peculiar/x509";
 //#region src/cli-options.ts
 /** The address the server binds when --bind is not given. */
 const DEFAULT_BIND_ADDRESS = "0.0.0.0:8787";
@@ -35,6 +41,11 @@ const FLAGS = {
 		valueName: "path",
 		description: "Directory to hold other devices' logs in while they are offline, which makes this node an announcer as well as a relay. Bounded by fixed limits. Off unless given."
 	},
+	webtransport: {
+		type: "string",
+		valueName: "host:port",
+		description: "Also serve WebTransport on this UDP address, with a self-signed certificate renewed on a schedule that a browser accepts by pinning its hash, and print the address to give a console. Needs the optional @fails-components/webtransport dependency. Off unless given."
+	},
 	help: {
 		type: "boolean",
 		short: "h",
@@ -68,11 +79,11 @@ function helpText() {
 		...rows.map((row) => `  ${row.label.padEnd(labelWidth)}  ${row.description}`)
 	].join("\n");
 }
-function validatedBindAddress(address) {
+function validatedBindAddress(flag, address) {
 	const separator = address.lastIndexOf(":");
 	const host = address.slice(0, separator);
 	const port = address.slice(separator + 1);
-	if (separator === -1 || host === "" || !/^\d+$/.test(port) || Number(port) > MAX_PORT) throw new CliUsageError(`--bind expects host:port with a port from 0 to ${String(MAX_PORT)}, got "${address}"`);
+	if (separator === -1 || host === "" || !/^\d+$/.test(port) || Number(port) > MAX_PORT) throw new CliUsageError(`--${flag} expects host:port with a port from 0 to ${String(MAX_PORT)}, got "${address}"`);
 	return address;
 }
 /** Parses the process arguments (without the node and script entries) into the command they ask for. Throws CliUsageError for an unknown flag, a stray positional argument, a flag missing or given an unwanted value, a malformed --bind address, or --tls-cert without --tls-key (or the reverse). */
@@ -96,12 +107,13 @@ function parseCliArguments(argv) {
 	if (certPath === void 0 !== (keyPath === void 0)) throw new CliUsageError("--tls-cert and --tls-key must be given together");
 	return {
 		kind: "serve",
-		bindAddress: validatedBindAddress(values.bind),
+		bindAddress: validatedBindAddress("bind", values.bind),
 		tls: certPath === void 0 || keyPath === void 0 ? void 0 : {
 			certPath,
 			keyPath
 		},
-		mailboxDir: values["mailbox-dir"]
+		mailboxDir: values["mailbox-dir"],
+		webTransportAddress: values.webtransport === void 0 ? void 0 : validatedBindAddress("webtransport", values.webtransport)
 	};
 }
 //#endregion
@@ -114,6 +126,153 @@ const nodeMailboxLimits = {
 	readBatch: 64
 };
 //#endregion
+//#region src/adapters/pinned-certificate.ts
+const MILLISECONDS_PER_DAY = 864e5;
+const MAX_PINNED_CERTIFICATE_LIFETIME_DAYS = 14;
+const CLOCK_SKEW_ALLOWANCE_DAYS = 1;
+const SERIAL_NUMBER_BYTES = 16;
+const PEM_LINE_LENGTH = 64;
+/** Slack under the maximum, so clock skew between the node and a browser cannot push the certificate over the limit. */
+const PINNED_CERTIFICATE_LIFETIME_MS = MAX_PINNED_CERTIFICATE_LIFETIME_DAYS * MILLISECONDS_PER_DAY - CLOCK_SKEW_ALLOWANCE_DAYS * MILLISECONDS_PER_DAY;
+const SIGNING_ALGORITHM = {
+	name: "ECDSA",
+	namedCurve: "P-256",
+	hash: "SHA-256"
+};
+function toHex(bytes) {
+	return Buffer.from(bytes).toString("hex");
+}
+function toPem(label, der) {
+	return `-----BEGIN ${label}-----\n${(Buffer.from(der).toString("base64").match(new RegExp(`.{1,${String(PEM_LINE_LENGTH)}}`, "g")) ?? []).join("\n")}\n-----END ${label}-----\n`;
+}
+/**
+* Mints an ECDSA P-256 certificate valid from `now` for PINNED_CERTIFICATE_LIFETIME_MS. Clients pin it by hash rather than by name, so it carries only a common name.
+*/
+async function mintPinnedCertificate(now) {
+	const keys = await crypto.subtle.generateKey(SIGNING_ALGORITHM, true, ["sign", "verify"]);
+	const notAfter = new Date(now.getTime() + PINNED_CERTIFICATE_LIFETIME_MS);
+	const certificate = await X509CertificateGenerator.createSelfSigned({
+		serialNumber: toHex(crypto.getRandomValues(new Uint8Array(SERIAL_NUMBER_BYTES))),
+		name: "CN=wire-mesh",
+		notBefore: now,
+		notAfter,
+		signingAlgorithm: SIGNING_ALGORITHM,
+		keys,
+		extensions: [
+			new BasicConstraintsExtension(false, void 0, true),
+			new KeyUsagesExtension(KeyUsageFlags.digitalSignature, true),
+			new ExtendedKeyUsageExtension([ExtendedKeyUsage.serverAuth], true)
+		]
+	});
+	const digest = await crypto.subtle.digest("SHA-256", certificate.rawData);
+	return {
+		certificatePem: certificate.toString("pem"),
+		privateKeyPem: toPem("PRIVATE KEY", await crypto.subtle.exportKey("pkcs8", keys.privateKey)),
+		sha256Hex: toHex(new Uint8Array(digest)),
+		notAfter
+	};
+}
+//#endregion
+//#region src/adapters/webtransport-transport.ts
+/** The path a client opens its WebTransport session on. */
+const WEBTRANSPORT_PATH = "/wire-mesh";
+const RENEWAL_DELAY_MS = PINNED_CERTIFICATE_LIFETIME_MS * .5;
+const SECRET_BYTES = 32;
+const WILDCARD_HOSTS = ["0.0.0.0", "::"];
+/** The hosts a client can dial for a listener bound to `host`: the host itself, or for a wildcard every non-internal IPv4 address of this machine. */
+function reachableHosts(host) {
+	if (!WILDCARD_HOSTS.includes(host)) return [host];
+	return Object.values(networkInterfaces()).flatMap((addresses) => addresses ?? []).filter((entry) => entry.family === "IPv4" && !entry.internal).map((entry) => entry.address);
+}
+/** The optional WebTransport package is not installed, or its native binary was not built for this platform. */
+var WebTransportUnavailableError = class extends Error {
+	constructor(cause) {
+		super("serving WebTransport needs the optional dependency @fails-components/webtransport and its native binary, which is missing: either no binary is published for this platform, or the package manager skipped its install script (an ignore-scripts setting does that)", { cause });
+		this.name = "WebTransportUnavailableError";
+	}
+};
+async function loadHttp3Server() {
+	try {
+		await import("@fails-components/webtransport-transport-http3-quiche");
+		const module = await import("@fails-components/webtransport");
+		await module.quicheLoaded;
+		return module.Http3Server;
+	} catch (error) {
+		throw new WebTransportUnavailableError(error);
+	}
+}
+function isIncomingSession(value) {
+	return typeof value === "object" && value !== null && "ready" in value && value.ready instanceof Promise && "incomingBidirectionalStreams" in value && value.incomingBidirectionalStreams instanceof ReadableStream;
+}
+/**
+* A WebTransport Transport: each session carries one connection, on the first bidirectional stream the client opens, framed as length-prefixed CBOR (core's byte-stream-connection). A server binds a UDP port and serves a self-signed ECDSA certificate it renews on a schedule, which a browser accepts by pinning its hash (`serverCertificateHashes`) with no certificate authority involved.
+*
+* `listen` rejects with WebTransportUnavailableError when the optional native dependency is absent. `connect` always rejects: see its comment.
+*/
+function createWebTransportTransport(options = {}) {
+	const now = options.now ?? (() => /* @__PURE__ */ new Date());
+	const reportError = (error) => {
+		options.onError?.(error);
+	};
+	return {
+		async connect() {
+			return Promise.reject(/* @__PURE__ */ new Error("a Node process cannot dial WebTransport with a pinned certificate hash; dial a wss:// address instead"));
+		},
+		async listen(address, onConnection) {
+			const Http3ServerClass = await loadHttp3Server();
+			const lastColon = address.lastIndexOf(":");
+			const host = address.slice(0, lastColon);
+			const port = Number(address.slice(lastColon + 1));
+			let certificate = await mintPinnedCertificate(now());
+			const server = new Http3ServerClass({
+				host,
+				port,
+				secret: randomBytes(SECRET_BYTES).toString("hex"),
+				cert: certificate.certificatePem,
+				privKey: certificate.privateKeyPem
+			});
+			server.startServer();
+			await server.ready;
+			const bound = server.address();
+			if (bound === null) throw new Error("the WebTransport server bound no address");
+			const boundAddress = `${host}:${String(bound.port)}`;
+			const advertise = () => reachableHosts(host).map((reachable) => formatPinnedAddress(`${reachable}:${String(bound.port)}`, certificate.sha256Hex));
+			(async () => {
+				for await (const session of server.sessionStream(WEBTRANSPORT_PATH)) (async () => {
+					if (!isIncomingSession(session)) throw new Error("the WebTransport server yielded a malformed session");
+					await session.ready;
+					const reader = session.incomingBidirectionalStreams.getReader();
+					const first = await reader.read();
+					reader.releaseLock();
+					if (!first.done) onConnection(connectionFromByteStream(first.value));
+				})().catch(reportError);
+			})().catch(reportError);
+			const renewal = setInterval(() => {
+				mintPinnedCertificate(now()).then((renewed) => {
+					certificate = renewed;
+					server.updateCert(renewed.certificatePem, renewed.privateKeyPem, false);
+					options.onCertificateRenewed?.(advertise());
+				}).catch(reportError);
+			}, RENEWAL_DELAY_MS);
+			renewal.unref();
+			return {
+				address: boundAddress,
+				get advertisedAddresses() {
+					return advertise();
+				},
+				close: async () => {
+					clearInterval(renewal);
+					server.stopServer();
+					await server.closed;
+				},
+				unref: () => {
+					renewal.unref();
+				}
+			};
+		}
+	};
+}
+//#endregion
 //#region src/static-console.ts
 const CONTENT_TYPES = {
 	".css": "text/css; charset=utf-8",
@@ -240,6 +399,19 @@ async function main(argv) {
 		hub.handleConnection(connection);
 	});
 	logOutput(`wire-mesh listening on ${tls ? "wss" : "ws"}://${listener.address}`);
+	if (command.webTransportAddress !== void 0) {
+		const webTransport = await createWebTransportTransport({
+			onError: (error) => {
+				logError(`wire-mesh: WebTransport: ${String(error)}`);
+			},
+			onCertificateRenewed: (addresses) => {
+				logOutput(`wire-mesh WebTransport addresses changed: ${addresses.join(" ")}`);
+			}
+		}).listen(command.webTransportAddress, (connection) => {
+			hub.handleConnection(connection);
+		});
+		for (const address of webTransport.advertisedAddresses) logOutput(`wire-mesh serving WebTransport at ${address}`);
+	}
 }
 /** Runs the CLI and turns a failure into a one-line message on stderr and a non-zero exit code, instead of an unhandled rejection's stack trace. */
 async function run(argv) {