Support HTTP discovery and authenticated signalling

[extremeheat]

Direct Nethernet servers can expose HTTP discovery/signalling even when LAN discovery is unavailable. Add this transport path to nethernet so consumers do not have to manipulate its WebRTC connection or verify SDP assertions themselves.

Extracted from PrismarineJS/bedrock-protocol#831, addressing PrismarineJS/bedrock-protocol#830.

• pingHttp(origin, { timeout, signal }) returns discovery metadata and the raw body. Successful empty responses are supported.
• new Client(0n, undefined, { http: { url, serverKey, onServerKey }, identity }) performs HTTP signalling. It gathers ICE completely, then signs and posts the offer, without LAN discovery or trickle messages.
• Verify the operator's identity token and signed DTLS fingerprints before applying an answer. HTTPS uses normal TLS trust; plaintext HTTP needs a pin or explicit application approval. A configured pin is always enforced. Applications own prompts and pin persistence.
• Reuse the client's existing negotiation deadline and cancellation. Authentication, Minecraft version selection, and HTTP hosting remain outside this API.

The signalling modules are grouped under src/signalling/: http.js, lan.js, messages.js, and sdpIdentity.js. LAN wire helpers move out of util.js; client/server socket ownership remains unchanged. A README-linked ARCHITECTURE.md explains the connection flow and module boundaries.

Identity verification lives alongside the existing assertion construction and reuses its fingerprint parser. JWT verification uses jsonwebtoken, already used by bedrock-protocol.

Validation: lint, types, and all 72 upstream tests pass. 55 focused Bedrock integration tests pass with this implementation. Latest stable BDS 1.26.51.1, offline and with LAN visibility disabled, passed the public-client spawn and simultaneous packet-dump test. Live online authentication and Internet/NAT behavior remain untested.

Implemented and reviewed locally by OpenAI Astra. Neither PR should be treated as a release request.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jsonwebtoken@​9.0.3

View full report

[rom1504]

Astra agent review — AI-generated, not manually written by the maintainer.

This looks ready for maintainer merge review within the HTTP signalling source/test scope. I traced offer/answer verification and cancellation: configured pins are enforced on HTTPS as well, unknown plain-HTTP identities require explicit approval after signature verification, redirects fail, and a late approval cannot apply an answer after close. The split keeps signalling/SDP here and account/trust persistence policy in consumers. Current CI is green. I inspected the signed-fixture coverage but did not run a fresh BDS/native-backend interoperability session; that remains a release integration check with bedrock-protocol #831.

Skills used: prismarine-review checked the exact head and discussion; prismarine-protocol-data-review traced the real wire contract and released dependency boundary. prismarine-architecture-review checked transport/authentication ownership; prismarine-lifecycle-action-review checked cancellation and late completion.

Reviewed current head 77a0b38e92e1 and existing discussion. This is a COMMENT review for maintainer consideration.

[extremeheat]

LGTM @rom1504