Repository navigation
Conversation
Adds the generic host-owned Media service: v01 Media wire types and methods 0-10 at prototype wire trait 218, RemotePermission::Calling, host-core media sessions, groups, signaling and backend boundaries, platform media capabilities, browser media backend for the JS host, native Android/iOS media backends, and playground media specs. Squashes: - wip(media): preserve implementation before approved upstream integration - fix(media): keep receive-only sessions on device revocation; wait for backend session before placing pictures - refactor(media): move Media to prototype wire trait 218
Media session_subscribe waited for MediaSignaling to start, so a cold light client ended the stream with NotConnected before any snapshot. Subscribing now only probes the backend and starts observation. One background connector owns signaling: it starts it, drives its events, and after a failure or loss restarts it with backoff (500 ms doubling to 10 s) until the runtime closes. Each binding is still fenced by the current authority and a new epoch. Mutations that need signaling wait for the binding within their operation deadline and skip the pending backoff.
…er starts The core admits a participant, and the product sees it, before the call handshake asks the backend to create its peer. The browser backend re-checked remote surfaces against its own peer table and rejected those rectangles with InvalidHandle, so Vox showed "Pictures not placed" while a call was negotiating. The core already validates participant handles; the backend now queues the rectangle and renders it once the peer media is live, like the Android and iOS backends. Unknown handles still fail in the core.
Always construct RTCPeerConnection with iceTransportPolicy relay and drop the optional override. Never signal a non-relay candidate, neither as an IceCandidate event nor embedded in a description. The playground media specs now run against a loopback coturn relay.
Lock navigator.mediaDevices.enumerateDevices on the instance and every prototype with the same NotAllowedError as capture.
Size the event queue for a full 256-statement page plus control headroom, and admit only messages a lagging consumer has room for. Unadmitted packets are not replay-recorded, so a later delivery still succeeds and the endpoint no longer ends every call with ConnectivityLost.
A waiter parked while a signaling attempt runs found no backoff to wake, so the attempt's failure still waited a full backoff. The retry request is now sticky and consumed by the next backoff wait.
…layer Merge feat/media-sessions (Media service, prototype wire trait 218, on #709 a78944c) into the integration revision 795a408 that #291 vendors. - RemotePermission keeps JamPeers at positional index 5 and appends Calling at 6 (TS codegen encodes variants positionally). - PermissionAuthorizationRequest keeps the deployed ProfileDisclosure at codec index 6 and moves Calling to index 7. - Platform super-trait, runtime adapters and wasm wiring carry both the Profile and Media platforms; JamPeerSession is retained. - Codegen keeps the receiving layer's Option<codec>/Option<bytes> argument form ahead of Media's generic Option fallback, and its receiving test passes Media's private_media flag. - The mock-permission arm count covers both JamPeers and Calling (16).
Preserve Media's generalized optional callback codecs and exports. Drop a timing-dependent wording assertion; structured cancellation and SSO cleanup coverage remain.
attachmentIsolated() probed the product frame with a discarded `frame.contentWindow.document` read inside try/catch. dotli's production build tells rolldown/oxc that property reads have no side effects, which deletes the read and leaves the check always "not isolated", so attach() failed with SurfaceUnavailable on paseo.fyi. Use contentDocument === null, whose value is used and which is null exactly for cross-origin and opaque sandboxed documents. The new media spec runs the decision in Chromium against tsc, esbuild --minify and dotli-configured rolldown builds.
|
This pull request touches an app, which is not built by default. Add a label for each build you want:
Each starts as soon as it is added and follows the branch from then on. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Bundle size reportCompared with
WebAssembly modules
Changed files (37)
Commit: ca5a6bc |
|
CI Status: 24 required jobs green, 22 passed and 2 skipped by path filter. All job results
Signing credentials: failure as of 2026-10-09, a release may fail Commit |
A Statement Store submit that outlives its budget (e.g. while the light client stalls) or loses its transport may still have been accepted. The caller then failed its outgoing link with ConnectivityLost while the callee rang, accepted, and waited for a Commit that never came (Unanswered). Invite, Accept and Commit are idempotent at the receiver, so retry them (up to four attempts, one second apart, fenced again after the wait) while the link would still send them; other messages keep the existing failure path.
Keep upload consent separate from remote capability and signing grants; scope it to product, root account and Bulletin genesis. Reserve persistent rolling usage before backend work, fence pending consent on revocation and session changes, and expose native settings plus explicit CLI revocation. Correct explicit self capture in the theme regression fixture.
A browser runtime attached before its event stream opens buffered the attach-time detach (None) and the measured viewport. Opening the stream pushed the current viewport first and then replayed both, so the core took the revisionless None and dropped the repeated revision as stale: pictures never rendered until the viewport changed again. The stream already opens with the current viewport, so viewport changes are no longer buffered while no stream is open.
Merge cf424c9 into e1808d8 with explicit approval. Preserve scoped Media permissions and live-resource revocation alongside upload consent, notification trust, correlated SSO decoding and ordered native theme updates. Use the integration storage CAS for shared upload quota and stale consent answers. Rust and Android product suites pass; real isolated CLI revocation advances consent generation without erasing usage. Browser artifacts and iOS qualification follow from this merge.
Every accepted layout rebuilt the compositor planes from scratch, so a product that re-submits its rectangles on each scroll frame replaced the <video> on every frame. A fresh element shows nothing until its first decoded frame: traced in Chromium, 60 scroll-frame layouts created 61 elements and left the picture blank for the whole scroll, with the product's dark placeholder showing through. render() now keys planes by placement, session and surface id and keeps the element while its track is unchanged, updating only the geometry in place; removed or retracked pictures still release their element. The playground regression drives 20 scroll-frame layouts over a live relay pair and checks the element survives, lands at the last accepted rectangle, and that a stale layout leaves it alone.
# Conflicts: # rust/crates/truapi/tests/wire_result_shape.rs
iOS simulator previewBuilt from gh run download 37994765007 --name simulator-preview-ca5a6bcd2
unzip polkadot-app-*.app.zip
xcrun simctl install booted polkadot-app.app
xcrun simctl launch booted io.parity.polkadotapp.developOr download it in a browser, which arrives as a zip wrapping An arm64 simulator slice, so it needs an Apple Silicon Mac and does not |
Remove the obsolete mock installation assertion while checking camera and microphone denial without permission requests. Remove redundant awaits on immutable peer IDs and the nonisolated presentation initializer.
Summary
Integration layer that adds the host-owned Media service (#838, RFC #839) to the JamPeerTransport-on-Seity line (#1011), so the dotli layer that deploys paseo.fyi can vendor one host with Seity, JamPeerTransport and Media.
The integration began with a
--no-ffmerge:795a40820: the chore(deploy): Seity layer + JamPeerTransport (#1001 + #1010) #1011 revision that dotli fix(host): cover Dotli signing regressions #291 currently vendorsd8105398b: the Media feature layer (feat/media-sessions, on feat: add Chat v2 product authority operations #709a78944c23)It now also integrates the Tommy platform fixes from #1216 and subsequent Media updates. Source feature layers remain separate; this PR assembles them above #1011.
Media in one paragraph
Products get calling without touching WebRTC. The host owns capture, signaling (sealed packets over the Statement Store), relay-only ICE through TURN, and picture compositing. Products see opaque session, participant and operation handles, authoritative snapshots, peer product-account keys, and submit picture rectangles. No SDP, ICE candidates, IP addresses, device ids or media bytes reach product memory. Calling consent is a separate permission scoped to product, network and account; camera and microphone keep their own device consent.
Wire
Mediais prototype wire trait 218, methods 0–10. Sequential trait 20 is Contacts upstream; 218 keeps this unreviewed service clear of the range assigned in merge order. Only the trait byte moves when it is allocated for real.RemotePermissionorder:…, StatementSubmit, JamPeers, Calling(JamPeers keeps 5, already deployed on paseo.fyi).PermissionAuthorizationRequestorder:…, ProfileDisclosure (6), Calling (7).Initial Media qualification (historical)
cargo test -p truapi --lib: 1615 passed (media 28, permission 103, jam 10, profile 31, calling 7)bun test: truapi-host 371, truapi 921, js/container 126795a40820(unnecessary_lazy_evaluationsin capabilities/platform.rs, twotoo_many_argumentsin the receiving code); none in Media codeDraft: not for merge; it exists so the paseo.fyi integration layer has a pushed host revision and review surface.
Current integration qualification
8e735637702df560eb3af7853301d06cf1c942fb; client and production/testing signing-host WASM retain the verified44b87fea6fbe430589bb53c31a3e38b620ad5374build. The intervening changes do not change Rust/WASM. All 110 host archive files and 143 client archive files match the browser vendor, allowing only its declared local client dependency override.Known qualification limits: the exact legacy TrUAPI 0.7 storage probe still times out; no claim is made that historical #263 is fixed. Physical-device theme appearance, fully-quit native notification activation, and Tommy’s historical paired-device identity case are not covered by the simulator/local-browser evidence.