Compare commits
2
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 enricobuehler
|
2d43275fcb | ||
|
enricobuehler
|
77ddd05b13 |
@@ -79,7 +79,7 @@ final class GamepadWireTests: XCTestCase {
|
||||
XCTAssertEqual(GamepadWire.axisRSY, UInt32(PUNKTFUNK_AXIS_RS_Y))
|
||||
XCTAssertEqual(GamepadWire.axisLT, UInt32(PUNKTFUNK_AXIS_LT))
|
||||
XCTAssertEqual(GamepadWire.axisRT, UInt32(PUNKTFUNK_AXIS_RT))
|
||||
XCTAssertEqual(GamepadWire.maxPads, Int(MAX_PADS))
|
||||
XCTAssertEqual(GamepadWire.maxPads, Int(PUNKTFUNK_MAX_PADS))
|
||||
}
|
||||
|
||||
func testPadIndexRidesFlagsOnEveryPerPadEvent() {
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
# App Store copy
|
||||
|
||||
Source of truth for what goes into App Store Connect. Every character-limited field in here has
|
||||
been counted with `check-limits.py`; run it after any edit.
|
||||
|
||||
```sh
|
||||
python3 clients/apple/store/check-limits.py
|
||||
```
|
||||
|
||||
| File | Covers |
|
||||
|------|--------|
|
||||
| [`ios.md`](ios.md) | iOS/iPadOS Promotional Text (DE + EN), with alternates |
|
||||
| [`macos.md`](macos.md) | macOS Promotional Text, Description, Keywords (DE + EN) |
|
||||
| [`tvos.md`](tvos.md) | tvOS Promotional Text, Description, Keywords (DE + EN) |
|
||||
| [`review-notes.md`](review-notes.md) | App Review notes template + pre-submission checklist |
|
||||
| [`privacy-app-addendum.md`](privacy-app-addendum.md) | App-specific privacy text to add to the existing policy page |
|
||||
|
||||
German is primary throughout and uses the same informal "du" voice as the website
|
||||
(`punktfunk-website/messages/de.json`). English is a localisation, not a translation exercise — a
|
||||
few lines diverge where the German idiom does not carry.
|
||||
|
||||
## Three things that contradicted the original brief
|
||||
|
||||
1. **A Mac cannot be a host.** The brief suggested Mac copy could cover "running as a host/server
|
||||
or client on Mac". There is no macOS host — `punktfunk-host` has no macOS capture, virtual
|
||||
display, or encode backend. The macOS copy is client-only and says so explicitly.
|
||||
2. **The existing privacy policy is website-only.** It covers server logs, Plausible, and a
|
||||
language cookie, and never mentions the apps. Linking it unchanged from App Store Connect is
|
||||
the kind of thing that draws a reviewer's attention to analytics that have nothing to do with
|
||||
the app. See `privacy-app-addendum.md` for the text to append.
|
||||
3. **App Review notes cap at 4000 characters**, not the unlimited field the brief implied. The
|
||||
template is 3919 and fits.
|
||||
|
||||
## Claims used, and where they come from
|
||||
|
||||
Everything asserted in the copy was checked against the source rather than the marketing site:
|
||||
|
||||
- Hardware decode, HDR/4:4:4, controller and input support — `clients/apple/README.md`
|
||||
- Entitlements and their justifications — `Config/Punktfunk.entitlements`,
|
||||
`Config/Punktfunk-macOS.entitlements` (both carry detailed rationale comments)
|
||||
- Background audio mode and its 2.5.4 constraints — `Config/Info.plist`
|
||||
- "Collects no data" — verified by absence: no analytics SDK in `Package.swift`, no telemetry
|
||||
symbols in `Sources/`, `URLSession` used only against the paired host
|
||||
- Host platforms and protocol details — root `README.md`, `docs/releases/v0.24.0.md`
|
||||
- Feature ship dates — `git tag --contains` on the relevant commits
|
||||
|
||||
## Not done here
|
||||
|
||||
`clients/apple` has no `PrivacyInfo.xcprivacy`. The app uses `UserDefaults`, which is a
|
||||
required-reason API, so a manifest is expected. Flagged at the end of `review-notes.md`; left
|
||||
alone because it is a code change, not copy.
|
||||
@@ -1,82 +0,0 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Check every App Store copy block in this directory against its field limit.
|
||||
|
||||
App Store Connect silently truncates or hard-rejects over-long fields, and the German copy is the
|
||||
easy one to get wrong because umlauts read as one character but two bytes. Apple counts characters,
|
||||
so `len()` on a `str` is the right measure — do not switch this to a byte count.
|
||||
|
||||
Each fenced code block in the .md files here is one field. Which limit applies is inferred from the
|
||||
nearest heading above it. Exit status is non-zero if anything is over, so CI can gate on it.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import pathlib
|
||||
import re
|
||||
import sys
|
||||
|
||||
LIMITS = {"PROMO": 170, "DESC": 4000, "KW": 100, "NOTES": 4000}
|
||||
|
||||
|
||||
def blocks(text: str):
|
||||
"""Yield (heading, body) for every fenced block, tagged with the heading above it."""
|
||||
heading = None
|
||||
buf: list[str] | None = None
|
||||
for line in text.split("\n"):
|
||||
if line.startswith("#") and buf is None:
|
||||
heading = line.lstrip("#").strip()
|
||||
if line.strip() == "```":
|
||||
if buf is None:
|
||||
buf = []
|
||||
else:
|
||||
yield heading or "", "\n".join(buf)
|
||||
buf = None
|
||||
continue
|
||||
if buf is not None:
|
||||
buf.append(line)
|
||||
|
||||
|
||||
def kind_of(heading: str, body: str) -> str:
|
||||
low = heading.lower()
|
||||
if "keyword" in low or re.fullmatch(r"(de|en) \(\d+\)", low):
|
||||
return "KW"
|
||||
if "template" in low:
|
||||
return "NOTES"
|
||||
return "DESC" if len(body) > 400 else "PROMO"
|
||||
|
||||
|
||||
def main() -> int:
|
||||
here = pathlib.Path(__file__).parent
|
||||
failures = 0
|
||||
stale = 0
|
||||
for path in sorted(here.glob("*.md")):
|
||||
found = list(blocks(path.read_text(encoding="utf-8")))
|
||||
if not found:
|
||||
continue
|
||||
print(f"\n=== {path.name} ===")
|
||||
for heading, body in found:
|
||||
kind = kind_of(heading, body)
|
||||
limit = LIMITS[kind]
|
||||
n = len(body)
|
||||
over = n > limit
|
||||
failures += over
|
||||
# Headings carry the count in parentheses; flag any that drifted from the real length.
|
||||
claimed = re.search(r"\((\d+)\)\s*$", heading)
|
||||
drift = ""
|
||||
if claimed and int(claimed.group(1)) != n:
|
||||
drift = f" [heading claims {claimed.group(1)}]"
|
||||
stale += 1
|
||||
status = "OVER" if over else "ok"
|
||||
print(f" [{kind:5}] {status:>4} {n:>4}/{limit} {heading[:48]}{drift}")
|
||||
|
||||
if failures:
|
||||
print(f"\n{failures} block(s) OVER the limit")
|
||||
elif stale:
|
||||
print(f"\nAll within limits, but {stale} heading count(s) are stale")
|
||||
else:
|
||||
print("\nAll blocks within limits, all heading counts accurate")
|
||||
return 1 if failures or stale else 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
@@ -1,71 +0,0 @@
|
||||
# iOS / iPadOS — App Store metadata
|
||||
|
||||
Existing, unchanged:
|
||||
|
||||
- **Name:** Punktfunk
|
||||
- **Subtitle (DE):** Schnell, lokal & offen.
|
||||
|
||||
Only the Promotional Text is new here. It is the one field that can be changed **without** a new
|
||||
build or a review, so it is the right place for "what landed most recently".
|
||||
|
||||
---
|
||||
|
||||
## Promotional Text (DE) — max 170 characters
|
||||
|
||||
### Primary (160)
|
||||
|
||||
```
|
||||
Neu: Profile pro Host – Auflösung, Bitrate und Ton einmal einstellen, dann mit einem Tipp verbinden. Dazu Live Activity, Sperrbildschirm-Widget und Wake-on-LAN.
|
||||
```
|
||||
|
||||
### Alternate A — evergreen hook, no "new" claim (156)
|
||||
|
||||
```
|
||||
Dein Gaming-PC auf dem iPhone, in dessen exakter Auflösung – ohne Konto, ohne Cloud, nur dein Netzwerk. Hardware-Decoding, HDR und dein DualSense mit allem.
|
||||
```
|
||||
|
||||
### Alternate B — leads on the DualSense (161)
|
||||
|
||||
```
|
||||
Dein DualSense, vollständig: Rumble, adaptive Trigger, Lightbar, Touchpad und Gyro gehen bis ins Spiel durch. Dazu Profile pro Host und Wake-on-LAN vom Sofa aus.
|
||||
```
|
||||
|
||||
### Alternate C — leads on latency (153)
|
||||
|
||||
```
|
||||
Kein Konto, keine Cloud, kein Umweg: punktfunk/1 fährt über QUIC direkt zu deinem PC. Auflösungswechsel mitten im Stream, ohne die Verbindung zu trennen.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Promotional Text (EN) — max 170 characters
|
||||
|
||||
### Primary (152)
|
||||
|
||||
```
|
||||
New: per-host profiles — set resolution, bitrate and audio once, then connect with one tap. Plus Live Activities, a Lock Screen widget, and Wake-on-LAN.
|
||||
```
|
||||
|
||||
### Alternate A — evergreen hook (159)
|
||||
|
||||
```
|
||||
Your gaming PC on your iPhone, at your iPhone's exact resolution — no account, no cloud, just your network. Hardware decoding, HDR, and your DualSense in full.
|
||||
```
|
||||
|
||||
### Alternate B — leads on the DualSense (160)
|
||||
|
||||
```
|
||||
Your DualSense, in full: rumble, adaptive triggers, lightbar, touchpad and gyro all reach the game. Plus per-host profiles and Wake-on-LAN from across the room.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Notes on the claims
|
||||
|
||||
- "Profile pro Host" shipped in **v0.22.0** (`25b12780`, `80c0ca69`) and is in every tag since. It is
|
||||
the strongest recent user-facing Apple feature, so "Neu" is defensible for one release cycle — but
|
||||
drop the word once 0.25 ships something newer.
|
||||
- Live Activities and the Hosts widget shipped long ago (`ba1caf02`, in v0.15.0+). They are safe to
|
||||
*mention* but should not be called "neu".
|
||||
- The only Apple-visible feature unique to **v0.24.0** is the "Forward controllers" off switch
|
||||
(`b297542c`), which is too niche to headline.
|
||||
@@ -1,159 +0,0 @@
|
||||
# macOS — App Store metadata
|
||||
|
||||
> **Scope correction.** The Mac app is a **client only**. There is no macOS host: `punktfunk-host`
|
||||
> has no macOS capture, virtual-display, or encode backend (the two `cfg!(target_os = "macos")` hits
|
||||
> in the host crate are OS *detection* for the host tile and a path helper; the loopback-test host
|
||||
> is a synthetic frame source for `test-loopback.sh`, not a shippable host). A macOS host is a
|
||||
> feasibility study — it needs four new backends and the private `CGVirtualDisplay` API.
|
||||
> None of the copy below claims a Mac can host, and it should not until that ships.
|
||||
|
||||
- **Name:** Punktfunk
|
||||
- **Subtitle (DE):** Schnell, lokal & offen.
|
||||
- **Subtitle (EN):** Fast, local & open.
|
||||
|
||||
---
|
||||
|
||||
## Promotional Text (DE) — max 170 characters
|
||||
|
||||
### Primary (164)
|
||||
|
||||
```
|
||||
Neu: Profile pro Host – ein Mac, mehrere Gaming-PCs, jeder mit eigenen Einstellungen. Dazu AV1-Hardware-Decoding auf M3 und neuer, HDR und volles 4:4:4 für Schrift.
|
||||
```
|
||||
|
||||
### Alternate (156)
|
||||
|
||||
```
|
||||
Dein Gaming-PC im Fenster oder im Vollbild, in der exakten Auflösung deines Displays. Maus und Tastatur gehen durch, Auflösungswechsel ohne neue Verbindung.
|
||||
```
|
||||
|
||||
## Promotional Text (EN) — max 170 characters
|
||||
|
||||
### Primary (161)
|
||||
|
||||
```
|
||||
New: per-host profiles — one Mac, several gaming PCs, each with its own settings. Plus AV1 hardware decoding on M3 and later, HDR, and full 4:4:4 for crisp text.
|
||||
```
|
||||
|
||||
### Alternate (156)
|
||||
|
||||
```
|
||||
Your gaming PC in a window or full screen, at your display's exact resolution. Mouse and keyboard pass straight through; resize without dropping the stream.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Description (DE) — max 4000 characters
|
||||
|
||||
```
|
||||
Punktfunk streamt deinen Gaming-PC auf den Mac – in der exakten Auflösung und Bildwiederholrate deines Displays, über dein eigenes Netzwerk, ohne Konto und ohne Cloud.
|
||||
|
||||
Punktfunk besteht aus zwei Hälften: einem Host auf dem PC, von dem du streamst, und dieser App auf dem Gerät, auf dem du spielst. Der Host ist quelloffen und kostenlos, läuft auf Linux und auf Windows 11 – auf dem Gaming-Rig unterm Schreibtisch, auf einem Laptop oder headless auf einem Server, an dem gar kein Monitor hängt.
|
||||
|
||||
DEIN MAC BEKOMMT SEIN EIGENES DISPLAY
|
||||
|
||||
Für jede Verbindung legt der Host ein echtes virtuelles Display an – in genau der Auflösung und Bildrate, die dein Mac meldet. Kein Skalieren, keine schwarzen Balken, kein Umsortieren deiner echten Monitore. Änderst du mitten im Stream die Fenstergröße oder gehst auf Vollbild, wird die Auflösung neu ausgehandelt, ohne die Verbindung zu trennen. Mehrere Geräte können gleichzeitig streamen, jedes auf seinem eigenen Display.
|
||||
|
||||
SCHNELL, WEIL UNS DER GANZE WEG GEHÖRT
|
||||
|
||||
Die nativen Apps sprechen punktfunk/1: eine QUIC-Steuerebene und eine verschlüsselte Datenebene mit Vorwärtsfehlerkorrektur, die Auflösung und Bildrate mitten im Stream wechselt, ohne neu zu verbinden. Dekodiert wird in Hardware über VideoToolbox – H.264, HEVC und AV1 auf Macs, die AV1 in Hardware können (M3 und neuer).
|
||||
|
||||
FÜR DEN MAC GEMACHT
|
||||
|
||||
• Im Fenster oder im Vollbild, auf jedem angeschlossenen Display
|
||||
• Maus und Tastatur gehen vollständig durch – Klick zum Fangen, Cmd+Esc oder Ctrl+Alt+Shift+Q zum Freigeben
|
||||
• Ein Stream-Menü in der Menüleiste: Maus freigeben, Trennen, Statistik einblenden
|
||||
• Mikrofon-Uplink mit Echounterdrückung – dein Mac wird zum Headset am PC
|
||||
• HDR mit PQ-Passthrough und ein optionaler Vollchroma-Modus (4:4:4), damit kleine Schrift und feine Linien scharf bleiben
|
||||
|
||||
CONTROLLER, VOLLSTÄNDIG
|
||||
|
||||
DualSense, Xbox- und weitere MFi-kompatible Controller. Beim DualSense gehen Rumble, Lightbar, Player-LEDs, adaptive Trigger, Touchpad und Gyro bis ins Spiel durch. Welchen Typ das virtuelle Gamepad am Host annimmt, richtet sich nach dem, was bei dir wirklich in der Hand liegt.
|
||||
|
||||
DEINE BIBLIOTHEK, DEIN NETZWERK
|
||||
|
||||
Installierte Steam-Titel und selbst hinzugefügte Spiele erscheinen als Raster mit Artwork und starten direkt. Hosts findet die App im Netzwerk von allein. Beim ersten Mal koppelst du einmalig mit einer PIN, danach verbindet sich der Mac über eine gepinnte Identität aus deinem Schlüsselbund – kein Konto, kein Login. Einen schlafenden PC weckt Punktfunk per Wake-on-LAN.
|
||||
|
||||
MESSEN STATT GLAUBEN
|
||||
|
||||
Ein gestuftes Overlay zeigt Bildrate, Bitrate und Latenz – über zwei Maschinen hinweg um den Uhrenversatz korrigiert, also eine Messung und kein Versprechen. Ein Geschwindigkeitstest pro Host schlägt eine passende Bitrate vor. Profile halten pro Host fest, wie gestreamt werden soll.
|
||||
|
||||
WAS DU BRAUCHST
|
||||
|
||||
Einen Punktfunk-Host auf einem Linux-PC oder auf Windows 11 (22H2 oder neuer) im selben Netzwerk. Der Host ist quelloffen (MIT/Apache-2.0) und kostenlos – Anleitungen und Quellcode findest du auf punktfunk.unom.io. Diese App ist der Client: ein Mac kann derzeit nicht selbst Host sein.
|
||||
|
||||
Kein Konto. Keine Cloud. Keine Telemetrie. Die App erfasst keine Daten über dich.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Description (EN) — max 4000 characters
|
||||
|
||||
```
|
||||
Punktfunk streams your gaming PC to your Mac — at your display's exact resolution and refresh rate, over your own network, with no account and no cloud.
|
||||
|
||||
Punktfunk comes in two halves: a host on the PC you stream from, and this app on the device you play on. The host is open source and free, and runs on Linux and on Windows 11 — on the gaming rig under your desk, on a laptop, or headless on a server with no monitor attached at all.
|
||||
|
||||
YOUR MAC GETS A DISPLAY OF ITS OWN
|
||||
|
||||
For every connection, the host creates a real virtual display at exactly the resolution and refresh rate your Mac reports. No scaling, no black bars, no rearranging your actual monitors. Resize the window mid-stream or go full screen and the resolution is renegotiated without dropping the connection. Several devices can stream at once, each on its own display.
|
||||
|
||||
FAST, BECAUSE WE OWN THE WHOLE PATH
|
||||
|
||||
The native apps speak punktfunk/1: a QUIC control plane and an encrypted data plane with forward error correction, able to change resolution and frame rate mid-stream without reconnecting. Decoding is done in hardware through VideoToolbox — H.264, HEVC, and AV1 on Macs with an AV1 hardware decoder (M3 and later).
|
||||
|
||||
BUILT FOR THE MAC
|
||||
|
||||
• In a window or full screen, on any attached display
|
||||
• Mouse and keyboard pass straight through — click to capture, Cmd+Esc or Ctrl+Alt+Shift+Q to release
|
||||
• A Stream menu in the menu bar: release the mouse, disconnect, toggle the stats overlay
|
||||
• Microphone uplink with echo cancellation — your Mac becomes the headset on your PC
|
||||
• HDR with PQ passthrough, plus an optional full-chroma (4:4:4) mode that keeps small text and fine UI lines sharp
|
||||
|
||||
CONTROLLERS, IN FULL
|
||||
|
||||
DualSense, Xbox, and other MFi-compatible controllers. On a DualSense, rumble, lightbar, player LEDs, adaptive triggers, touchpad, and gyro all reach the game. The virtual gamepad the host presents takes its type from the controller actually in your hands.
|
||||
|
||||
YOUR LIBRARY, YOUR NETWORK
|
||||
|
||||
Installed Steam titles and games you add yourself appear as a grid with artwork, ready to launch. The app finds hosts on your network by itself. The first time, you pair once with a PIN; after that your Mac reconnects on a pinned identity stored in your keychain — no account, no login. Punktfunk can wake a sleeping PC over Wake-on-LAN.
|
||||
|
||||
MEASURED, NOT PROMISED
|
||||
|
||||
A tiered overlay shows frame rate, bitrate, and latency — corrected for clock skew across the two machines, so it is a measurement rather than a claim. A per-host speed test suggests a bitrate that matches your link. Profiles remember how each host should be streamed.
|
||||
|
||||
WHAT YOU NEED
|
||||
|
||||
A Punktfunk host on a Linux PC or on Windows 11 (22H2 or later) on the same network. The host is open source (MIT/Apache-2.0) and free — guides and source at punktfunk.unom.io. This app is the client: a Mac cannot currently act as a host.
|
||||
|
||||
No account. No cloud. No telemetry. This app collects no data about you.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Keywords — max 100 characters
|
||||
|
||||
Comma-separated, **no spaces after the commas** (spaces count against the limit). The app name and
|
||||
the subtitle are already indexed, so `punktfunk`, `schnell`, `lokal`, and `offen` are deliberately
|
||||
absent — repeating them would waste characters.
|
||||
|
||||
### DE (97)
|
||||
|
||||
```
|
||||
streaming,spiele,remote,desktop,fernzugriff,pc,linux,windows,controller,gamepad,latenz,quelloffen
|
||||
```
|
||||
|
||||
### EN (95)
|
||||
|
||||
```
|
||||
streaming,remote,desktop,pc,linux,windows,gaming,controller,gamepad,latency,selfhosted,lan,play
|
||||
```
|
||||
|
||||
**Deliberately excluded:** `Moonlight`, `GameStream`, `NVIDIA`, `Steam`. Punktfunk genuinely is
|
||||
GameStream-compatible and does read your Steam library, but App Store Review Guideline 4.1 and the
|
||||
metadata rules disallow third-party app, product, and company names in the **keyword** field — it is
|
||||
a routine rejection. Saying it in the description is fine; the current descriptions avoid naming
|
||||
Moonlight and mention Steam only as a factual statement about your own library.
|
||||
|
||||
The previous keyword set (`Game-Streaming, Lokal, Open-Source, Gaming`) spent characters on spaces,
|
||||
on `Lokal` (already in the subtitle), and on both `Game-Streaming` and `Gaming`, which share a stem.
|
||||
@@ -1,146 +0,0 @@
|
||||
# Privacy — what to link from App Store Connect
|
||||
|
||||
## The situation
|
||||
|
||||
You already have a privacy policy at **punktfunk.unom.io/legal/privacy**. It is good, current
|
||||
(Stand: 28. Juni 2026), and localised DE/EN. But it is a **website** privacy policy: it covers
|
||||
server log files, Plausible Analytics on `analytics.unom.io`, the `PARAGLIDE_LOCALE` cookie, and
|
||||
self-hosted fonts. It does not mention the apps at all.
|
||||
|
||||
That is a problem for App Store Connect in two directions:
|
||||
|
||||
1. Apple requires the linked policy to describe **the app's** data practices. A reviewer following
|
||||
the link finds a page about a website.
|
||||
2. It reads as *contradicting* a "Data Not Collected" declaration. The page prominently describes
|
||||
analytics and a cookie. A reviewer who skims it sees "Reichweitenmessung mit Plausible
|
||||
Analytics" and has every reason to question the App Privacy answers.
|
||||
|
||||
**Recommendation:** keep the existing page and append an app-specific section to it (the text
|
||||
below), so one URL covers both. The alternative — a separate `/legal/privacy-apps` route — also
|
||||
works, but one URL is less to keep in sync.
|
||||
|
||||
The page is CMS-driven (`src/routes/legal/privacy.tsx` renders Payload `RichText` blocks from the
|
||||
`pages` collection, slug `legal/privacy`, tenant `punktfunk`), so this is a CMS edit rather than a
|
||||
code change.
|
||||
|
||||
## Confirming the "collects no data" framing
|
||||
|
||||
Checked against the source rather than taken on trust, and it holds:
|
||||
|
||||
- **No analytics, telemetry, or crash-reporting SDK.** `Package.swift` declares no such dependency.
|
||||
A case-insensitive sweep of `Sources/` for `sentry|firebase|analytics|telemetry|amplitude|
|
||||
mixpanel|crashlytics|posthog|plausible` returns 43 hits — 43 of them the word "amplitude" in
|
||||
haptics code (rumble amplitude), and one the English word "plausible" in a comment.
|
||||
- **No outbound calls to us.** The only `URLSession` use is `LibraryClient`, fetching cover art
|
||||
**from the paired host**, over a TLS session that pins the host's own certificate. The only
|
||||
external URLs anywhere in the Swift sources are three UI links the user can tap: the docs site,
|
||||
the source on `git.unom.io`, and the Discord invite.
|
||||
- **No account system.** Identity is a client keypair in the device keychain
|
||||
(`keychain-access-groups`, `ClientIdentityStore`); pairing is SPAKE2 with a PIN, host-to-device.
|
||||
- **Data stays on device.** Saved hosts and settings live in a shared `UserDefaults` suite
|
||||
(`group.io.unom.punktfunk`) so the widget can read them. Nothing syncs; there is no CloudKit
|
||||
entitlement.
|
||||
- **No ATT.** No `NSUserTrackingUsageDescription` anywhere, consistent with no tracking.
|
||||
|
||||
So **App Privacy → "Data Not Collected"** is accurate for all four platforms. Two caveats worth
|
||||
stating in the policy text anyway, because they are true and pre-empt questions:
|
||||
|
||||
- The microphone uplink **is** audio leaving the device — but only to the host the user paired with,
|
||||
encrypted, and never to us. Apple's questionnaire asks about data collected *by you or your
|
||||
third-party partners*; streaming to the user's own machine is not collection. Saying so plainly
|
||||
is better than staying silent about a microphone permission.
|
||||
- The apps are distributed through the App Store, so **Apple** collects its own analytics. That is
|
||||
Apple's processing, not yours, but naming it avoids looking like an omission.
|
||||
|
||||
---
|
||||
|
||||
## Text to append — Deutsch
|
||||
|
||||
> ## Die Punktfunk-Apps
|
||||
>
|
||||
> Dieser Abschnitt betrifft die Punktfunk-Apps für iPhone, iPad, Apple TV, Mac, Windows, Linux und
|
||||
> Android – im Unterschied zu den vorstehenden Abschnitten, die sich auf diese Website beziehen.
|
||||
>
|
||||
> **Die Apps erheben keine personenbezogenen Daten.** Es gibt keine Benutzerkonten, keine
|
||||
> Registrierung und keine Anmeldung. Die Apps enthalten keine Analyse-, Tracking-, Werbe- oder
|
||||
> Absturzbericht-Bibliotheken von Drittanbietern. Es findet kein Tracking im Sinne des App
|
||||
> Tracking Transparency Frameworks statt, und es werden keine Daten an uns oder an Dritte
|
||||
> übermittelt.
|
||||
>
|
||||
> **Wohin die Daten fließen.** Punktfunk verbindet Ihr Gerät direkt mit einem Host-Rechner, den Sie
|
||||
> selbst betreiben – in der Regel in Ihrem eigenen Netzwerk. Video, Ton, Maus-, Tastatur- und
|
||||
> Controller-Eingaben sowie – sofern Sie ihn einschalten – Ihr Mikrofon werden ausschließlich
|
||||
> zwischen Ihrem Gerät und diesem Host übertragen, verschlüsselt und ohne Umweg über einen Server
|
||||
> von uns. Wir betreiben für den Streaming-Betrieb keine Vermittlungs-, Relay- oder Cloud-Dienste
|
||||
> und haben zu keinem Zeitpunkt Zugriff auf die Inhalte einer Sitzung.
|
||||
>
|
||||
> **Was auf dem Gerät bleibt.** Die App speichert lokal auf Ihrem Gerät: die von Ihnen
|
||||
> hinzugefügten oder im Netzwerk gefundenen Hosts, Ihre Einstellungen und Profile sowie einen
|
||||
> kryptografischen Schlüssel, mit dem sich Ihr Gerät gegenüber einem gekoppelten Host ausweist
|
||||
> (auf Apple-Geräten im Schlüsselbund). Diese Daten verlassen Ihr Gerät nicht und werden gelöscht,
|
||||
> wenn Sie die App entfernen.
|
||||
>
|
||||
> **Berechtigungen.** Die App fragt nur Berechtigungen ab, die für den Betrieb nötig sind: den
|
||||
> Zugriff auf das lokale Netzwerk, um Hosts zu finden und sich mit ihnen zu verbinden, und – nur
|
||||
> wenn Sie die Mikrofonübertragung nutzen – das Mikrofon. Das Mikrofonsignal wird an den von Ihnen
|
||||
> gekoppelten Host übertragen, wo es als virtuelles Mikrofon erscheint; es wird nicht
|
||||
> aufgezeichnet und nicht an uns gesendet.
|
||||
>
|
||||
> **Verteilung über App-Stores.** Wenn Sie die App über den App Store oder Google Play beziehen,
|
||||
> verarbeiten Apple bzw. Google im Rahmen der Auslieferung eigene Daten (etwa Kauf-, Installations-
|
||||
> und Absturzstatistiken). Darauf haben wir keinen Einfluss; es gelten die
|
||||
> Datenschutzbestimmungen des jeweiligen Anbieters. Aggregierte Statistiken, die uns Apple oder
|
||||
> Google in ihren Entwicklerkonsolen anzeigen, lassen keinen Rückschluss auf einzelne Personen zu.
|
||||
>
|
||||
> **Der Host.** Der Punktfunk-Host ist quelloffene Software, die Sie selbst auf Ihrem eigenen
|
||||
> Rechner betreiben. Welche Daten dabei anfallen – etwa lokale Protokolldateien –, bleibt
|
||||
> vollständig unter Ihrer Kontrolle; wir erhalten davon nichts. Der Quellcode ist unter
|
||||
> git.unom.io/unom/punktfunk einsehbar.
|
||||
|
||||
---
|
||||
|
||||
## Text to append — English
|
||||
|
||||
> ## The Punktfunk apps
|
||||
>
|
||||
> This section concerns the Punktfunk apps for iPhone, iPad, Apple TV, Mac, Windows, Linux, and
|
||||
> Android — as distinct from the sections above, which concern this website.
|
||||
>
|
||||
> **The apps collect no personal data.** There are no user accounts, no registration, and no sign-in.
|
||||
> The apps contain no third-party analytics, tracking, advertising, or crash-reporting libraries.
|
||||
> No tracking within the meaning of Apple's App Tracking Transparency framework takes place, and no
|
||||
> data is transmitted to us or to any third party.
|
||||
>
|
||||
> **Where your data goes.** Punktfunk connects your device directly to a host machine that you run
|
||||
> yourself, normally on your own network. Video, audio, mouse, keyboard, and controller input — and
|
||||
> your microphone, if you switch it on — travel only between your device and that host, encrypted,
|
||||
> without passing through any server of ours. We operate no brokering, relay, or cloud service for
|
||||
> streaming, and we have no access to the contents of a session at any point.
|
||||
>
|
||||
> **What stays on your device.** The app stores locally on your device: the hosts you have added or
|
||||
> discovered on your network, your settings and profiles, and a cryptographic key your device uses
|
||||
> to identify itself to a paired host (in the keychain, on Apple devices). This data does not leave
|
||||
> your device and is removed when you delete the app.
|
||||
>
|
||||
> **Permissions.** The app requests only the permissions it needs to work: access to the local
|
||||
> network, in order to find hosts and connect to them, and — only if you use microphone streaming —
|
||||
> the microphone. The microphone signal is sent to the host you paired with, where it appears as a
|
||||
> virtual microphone; it is not recorded and is not sent to us.
|
||||
>
|
||||
> **Distribution through app stores.** If you obtain the app from the App Store or Google Play,
|
||||
> Apple or Google process their own data as part of distributing it (such as purchase, installation,
|
||||
> and crash statistics). We have no influence over this, and the respective provider's privacy
|
||||
> policy applies. The aggregated statistics Apple and Google show us in their developer consoles do
|
||||
> not allow any individual to be identified.
|
||||
>
|
||||
> **The host.** The Punktfunk host is open source software that you run on your own machine. Any
|
||||
> data it produces — local log files, for instance — remains entirely under your control, and none
|
||||
> of it reaches us. The source is available at git.unom.io/unom/punktfunk.
|
||||
|
||||
---
|
||||
|
||||
## Also update
|
||||
|
||||
- Bump **Stand: / Effective date:** on the page when you add this.
|
||||
- App Store Connect → App Privacy → **Data Not Collected** for all four platforms.
|
||||
- The same URL works for Google Play's Data safety declaration; the wording above already covers it.
|
||||
@@ -1,132 +0,0 @@
|
||||
# App Review notes
|
||||
|
||||
## The core problem, stated plainly
|
||||
|
||||
Punktfunk is the client half of a two-part system. Without a reachable host it shows a host list, a
|
||||
pairing sheet, and settings — and nothing else. There is **no demo or offline mode in a release
|
||||
build**: the mock-data screens in `Sources/PunktfunkClient/Screenshots/` are wrapped in `#if DEBUG`
|
||||
and are compiled out of anything you ship. A reviewer who launches the App Store build with no host
|
||||
on their network sees an empty "On this network" list.
|
||||
|
||||
Guideline 2.1 requires you to supply whatever is needed to fully exercise the app. So you must
|
||||
attach **one** of:
|
||||
|
||||
- **(a) A reachable demo host.** Best outcome — the reviewer sees the real thing. Requires a host
|
||||
exposed to the internet with its UDP ports forwarded, plus a pairing PIN in the notes. The client
|
||||
can add a host by IP or hostname, so mDNS discovery is not required for this path.
|
||||
- **(b) A demo video.** Apple accepts this for hardware- or setup-dependent apps. Less good: a
|
||||
reviewer who cannot reproduce is a reviewer who can reject on something unrelated.
|
||||
|
||||
**Attach (a) if you can keep a host up for the review window; (b) is the fallback.** Whichever you
|
||||
pick, fill in the placeholders before submitting — the template assumes (a) and marks the spots.
|
||||
|
||||
> **⚠ Decide before submitting:** if you go with (b), replace the "CONNECTING TO OUR DEMO HOST"
|
||||
> section with the video URL and say explicitly that no host can be provided.
|
||||
|
||||
---
|
||||
|
||||
## Notes template — paste into App Store Connect
|
||||
|
||||
The App Review Information "Notes" field caps at **4000 characters**. The block below is **3919**,
|
||||
and filling the five placeholders in shortens it further (the literal `[[FILL IN: …]]` text is
|
||||
longer than the values that replace it). If you add to it, re-check the count — an over-long note
|
||||
is silently truncated, and what gets cut is the end, where the privacy and entitlement answers
|
||||
live.
|
||||
|
||||
```
|
||||
WHAT THIS APP IS
|
||||
|
||||
Punktfunk is a low-latency game- and desktop-streaming client. It streams from a "host" the user
|
||||
installs on their own gaming PC (Linux, or Windows 11 22H2+), over their own network. The host is
|
||||
separate open-source software we publish at https://git.unom.io/unom/punktfunk; it is not sold,
|
||||
and this app has no purchases.
|
||||
|
||||
This app is the client half only: it renders video and audio from the user's own machine and
|
||||
sends input back. There is no content library and no server of ours in a session.
|
||||
|
||||
IMPORTANT: THIS APP NEEDS A HOST
|
||||
|
||||
With no reachable host, the app can only show its host list, the pairing screen and settings --
|
||||
inherent to what it is, not an incomplete build. We have provided a live host for review.
|
||||
|
||||
CONNECTING TO OUR DEMO HOST
|
||||
|
||||
1. Launch Punktfunk. The main screen lists hosts on the local network. Ours is not on yours, so
|
||||
add it by hand: "+" (top right) then "Add host"; on Apple TV, "Add host" on the main screen.
|
||||
2. Enter: Host: [[FILL IN: hostname or IP]] Port: [[FILL IN: port, default 47998]]
|
||||
Name it anything, then confirm.
|
||||
3. The app connects and asks for a pairing PIN. Enter: [[FILL IN: PIN]]
|
||||
A one-time SPAKE2 pairing; afterwards the device is remembered and needs no PIN.
|
||||
4. The host's game library appears as a grid. Select any title to stream; video and audio start
|
||||
within a few seconds.
|
||||
5. While streaming: stats overlay = Ctrl+Alt+Shift+S (or three-finger tap on iOS/iPadOS); release
|
||||
mouse = Cmd+Esc or Ctrl+Alt+Shift+Q; disconnect = Ctrl+Alt+Shift+D.
|
||||
6. Settings (gear) covers decoder, bitrate, HDR, audio, controllers and profiles; the per-host
|
||||
"Speed test" suggests a bitrate for the link.
|
||||
|
||||
The host stays reachable throughout review. If you cannot reach it, please contact
|
||||
[[FILL IN: contact email]] and we will restore it promptly.
|
||||
|
||||
WHY THE APP ASKS FOR WHAT IT ASKS FOR
|
||||
|
||||
- Local Network: finds hosts via Bonjour (_punktfunk._udp) and connects to them -- the app's
|
||||
entire purpose.
|
||||
- Microphone (optional, off by default): audio goes to the user's own paired host, appearing
|
||||
there as a virtual microphone for voice chat. Never recorded, never sent to us.
|
||||
- networking.multicast: sends the Wake-on-LAN magic packet, which must go to a broadcast address:
|
||||
a sleeping PC has no ARP entry, so unicast cannot reach it. Used for nothing else.
|
||||
- device.usb / device.bluetooth (macOS): the GameController framework reaches wired controllers
|
||||
through IOHIDLibUserClient and wireless ones through startWirelessControllerDiscovery. USB also
|
||||
drives DualSense rumble, which CoreHaptics will not. Without these, no controller input.
|
||||
- network.server (macOS): the app is outbound-only, but the App Sandbox gates bind() itself. Our
|
||||
QUIC endpoint and UDP socket each bind a local port to receive host-to-client datagrams;
|
||||
without this, no video, audio or rumble arrives.
|
||||
- UIBackgroundModes "audio" (iPhone/iPad): a session carries real, audible audio from the host,
|
||||
and this keeps it alive if the user steps away briefly. Backgrounded, video decoding stops, only
|
||||
the real audio keeps rendering, and a bounded timer disconnects automatically. We never play
|
||||
silence to stay alive, nor use the mode outside an audible session.
|
||||
|
||||
REGARDING BUILD 0.4.2 (3384)
|
||||
|
||||
That build was rejected under 2.4.5(i) for a temporary-exception entitlement
|
||||
(mach-lookup.global-name, com.apple.audioanalyticsd), added on a mistaken belief about CoreHaptics
|
||||
rumble under the App Sandbox. We have since verified rumble works without it; this build carries
|
||||
no temporary exception.
|
||||
|
||||
ACCOUNTS, PURCHASES, DATA
|
||||
|
||||
No account, no sign-in, no in-app purchase. The app collects no personal data: no analytics,
|
||||
tracking, advertising or crash-reporting SDKs, and no connection to any server of ours during a
|
||||
session. Device identity is a keychain keypair used only to authenticate to the user's own host.
|
||||
|
||||
Privacy policy: [[FILL IN: https://punktfunk.unom.io/legal/privacy]]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Before you submit — checklist
|
||||
|
||||
- [ ] Fill every `[[FILL IN: …]]` placeholder. There are five.
|
||||
- [ ] Confirm the demo host is reachable **from outside your own network** — test it on cellular,
|
||||
not on the LAN it lives on. This is the failure mode that wastes a review cycle.
|
||||
- [ ] Confirm the pairing PIN in the notes is the one the host will actually accept during the
|
||||
review window, and that pairing is left open (it is on-demand in the web console).
|
||||
- [ ] Put at least one launchable title in the demo host's library. An empty grid after a
|
||||
successful pairing looks like a broken app.
|
||||
- [ ] If submitting tvOS, verify the whole flow is reachable with the **Siri Remote alone**. A
|
||||
reviewer will not have a controller paired, and "requires an accessory to navigate" is a
|
||||
tvOS rejection.
|
||||
- [ ] Attach the demo video as a URL in the notes if you are going the (b) route.
|
||||
|
||||
## Separately worth checking: the privacy manifest
|
||||
|
||||
There is **no `PrivacyInfo.xcprivacy`** anywhere in `clients/apple`. The app does use
|
||||
`UserDefaults` (`HostStore` reads the `group.io.unom.punktfunk` suite), and `UserDefaults` is one of
|
||||
Apple's "required reason" APIs, which are expected to be declared in a privacy manifest. Apps
|
||||
missing a declaration typically get an automated **ITMS-91053** notice on upload.
|
||||
|
||||
This is adjacent to the copy work rather than part of it, so nothing has been changed here — but it
|
||||
is worth adding a manifest declaring `NSPrivacyAccessedAPICategoryUserDefaults` with reason code
|
||||
`CA92.1` (access to an app group container) and `NSPrivacyTracking` set to `false`, before the next
|
||||
submission. Confirm the current reason codes against Apple's documentation rather than taking the
|
||||
code above on trust; the list has changed since it was introduced.
|
||||
@@ -1,145 +0,0 @@
|
||||
# tvOS — App Store metadata
|
||||
|
||||
Client only, living-room framing. Things the other platforms have that the **Apple TV does not**,
|
||||
and which the copy therefore avoids claiming:
|
||||
|
||||
- **No microphone uplink.** There is no usable audio input on tvOS, so the "your Mac becomes the
|
||||
headset" line does not transfer.
|
||||
- **No gamepad console shell.** `ShotScenes` builds the gamepad home/settings screens for iOS and
|
||||
macOS only — tvOS uses the native focus engine instead.
|
||||
- **No AV1.** Apple TV 4K has no AV1 hardware decoder; HEVC and H.264 only.
|
||||
- Mouse/keyboard capture exists on tvOS but is not a living-room story, so it stays out.
|
||||
|
||||
Kept, and genuinely tvOS-shaped: Siri Remote pointer navigation (`SiriRemotePointer`), controllers
|
||||
including the full DualSense feedback set, HDR passthrough, and Wake-on-LAN — which is the single
|
||||
best Apple TV feature, because it is what removes the trip to the other room.
|
||||
|
||||
- **Name:** Punktfunk
|
||||
- **Subtitle (DE):** Schnell, lokal & offen.
|
||||
- **Subtitle (EN):** Fast, local & open.
|
||||
|
||||
---
|
||||
|
||||
## Promotional Text (DE) — max 170 characters
|
||||
|
||||
### Primary (161)
|
||||
|
||||
```
|
||||
Anschalten, Host wählen, spielen: Punktfunk weckt deinen Gaming-PC per Wake-on-LAN und verbindet sich, sobald er wach ist. In 4K, mit HDR, mit deinem Controller.
|
||||
```
|
||||
|
||||
### Alternate A — leads on the picture (157)
|
||||
|
||||
```
|
||||
Dein Gaming-PC am großen Bildschirm – in genau der Auflösung und Bildrate deines Fernsehers, mit HDR. Ohne Konto, ohne Cloud, nur über dein eigenes Netzwerk.
|
||||
```
|
||||
|
||||
### Alternate B — leads on the DualSense (160)
|
||||
|
||||
```
|
||||
Dein DualSense am Apple TV, vollständig: Rumble, adaptive Trigger, Lightbar, Touchpad und Gyro gehen bis ins Spiel durch. Dazu Profile pro Host und Wake-on-LAN.
|
||||
```
|
||||
|
||||
## Promotional Text (EN) — max 170 characters
|
||||
|
||||
### Primary (160)
|
||||
|
||||
```
|
||||
Turn on, pick a host, play: Punktfunk wakes your gaming PC over Wake-on-LAN and connects as soon as it's up. In 4K, with HDR, with the controller in your hands.
|
||||
```
|
||||
|
||||
### Alternate A — leads on the picture (148)
|
||||
|
||||
```
|
||||
Your gaming PC on the big screen — at your TV's exact resolution and refresh rate, with HDR. No account, no cloud, nothing leaving your own network.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Description (DE) — max 4000 characters
|
||||
|
||||
```
|
||||
Punktfunk macht aus deinem Apple TV die Konsole für den Gaming-PC, der ohnehin schon im Haus steht – in 4K, mit HDR, über dein eigenes Netzwerk, ohne Konto und ohne Cloud.
|
||||
|
||||
Punktfunk besteht aus zwei Hälften: einem Host auf dem PC, von dem du streamst, und dieser App auf dem Gerät, auf dem du spielst. Der Host ist quelloffen und kostenlos, läuft auf Linux und auf Windows 11 – auch headless auf einem Rechner, an dem gar kein Monitor hängt.
|
||||
|
||||
VOM SOFA AUS, VON ANFANG BIS ENDE
|
||||
|
||||
Anschalten, Host auswählen, spielen. Die App findet Hosts im Netzwerk von allein. Beim ersten Mal koppelst du einmalig mit einer PIN, danach verbindet sich der Apple TV über eine gepinnte Identität – kein Konto, kein Login, kein Abtippen von IP-Adressen. Steht dein Gaming-PC im Standby, weckt ihn Punktfunk per Wake-on-LAN und verbindet sich, sobald er wach ist. Niemand muss dafür aufstehen.
|
||||
|
||||
DAS BILD, DAS DEIN FERNSEHER WIRKLICH KANN
|
||||
|
||||
Für den Apple TV legt der Host ein echtes virtuelles Display an – in genau der Auflösung und Bildrate, die dein Fernseher meldet, bis 4K. Kein Skalieren, keine schwarzen Balken, und die Monitore am PC werden nicht umsortiert. Dekodiert wird in Hardware über VideoToolbox (HEVC und H.264), HDR wird als PQ durchgereicht, statt es flach zu rechnen.
|
||||
|
||||
CONTROLLER, VOLLSTÄNDIG
|
||||
|
||||
DualSense, Xbox- und weitere MFi-kompatible Controller. Beim DualSense gehen Rumble, Lightbar, Player-LEDs, adaptive Trigger, Touchpad und Gyro bis ins Spiel durch. Welchen Typ das virtuelle Gamepad am Host annimmt, richtet sich nach dem, was bei dir wirklich in der Hand liegt. Bedienen lässt sich alles mit der Siri Remote oder komplett mit dem Controller – die Oberfläche ist für die Fernbedienung gebaut, nicht für eine Maus.
|
||||
|
||||
DEINE BIBLIOTHEK AUF DEM FERNSEHER
|
||||
|
||||
Installierte Steam-Titel und selbst hinzugefügte Spiele erscheinen als Raster mit Artwork und starten direkt vom Sofa aus. Mehrere Geräte können gleichzeitig streamen, jedes auf seinem eigenen Display – der Apple TV im Wohnzimmer stört also niemanden, der am Schreibtisch weiterarbeitet.
|
||||
|
||||
SCHNELL, WEIL UNS DER GANZE WEG GEHÖRT
|
||||
|
||||
Die nativen Apps sprechen punktfunk/1: eine QUIC-Steuerebene und eine verschlüsselte Datenebene mit Vorwärtsfehlerkorrektur. Ein gestuftes Overlay zeigt Bildrate, Bitrate und Latenz – über zwei Maschinen hinweg um den Uhrenversatz korrigiert, also eine Messung und kein Versprechen. Ein Geschwindigkeitstest pro Host schlägt eine passende Bitrate für dein Netzwerk vor.
|
||||
|
||||
WAS DU BRAUCHST
|
||||
|
||||
Einen Punktfunk-Host auf einem Linux-PC oder auf Windows 11 (22H2 oder neuer) im selben Netzwerk. Für die beste Erfahrung hängt der Apple TV am Kabel oder an einem guten 5-GHz-WLAN. Der Host ist quelloffen (MIT/Apache-2.0) und kostenlos – Anleitungen und Quellcode findest du auf punktfunk.unom.io.
|
||||
|
||||
Kein Konto. Keine Cloud. Keine Telemetrie. Die App erfasst keine Daten über dich.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Description (EN) — max 4000 characters
|
||||
|
||||
```
|
||||
Punktfunk turns your Apple TV into a console for the gaming PC you already own — in 4K, with HDR, over your own network, with no account and no cloud.
|
||||
|
||||
Punktfunk comes in two halves: a host on the PC you stream from, and this app on the device you play on. The host is open source and free, and runs on Linux and on Windows 11 — including headless, on a machine with no monitor attached at all.
|
||||
|
||||
FROM THE COUCH, START TO FINISH
|
||||
|
||||
Turn on, pick a host, play. The app finds hosts on your network by itself. The first time, you pair once with a PIN; after that your Apple TV reconnects on a pinned identity — no account, no login, no typing IP addresses with a remote. If your gaming PC is asleep, Punktfunk wakes it over Wake-on-LAN and connects as soon as it is up. Nobody has to get up to make that happen.
|
||||
|
||||
THE PICTURE YOUR TV CAN ACTUALLY SHOW
|
||||
|
||||
For your Apple TV, the host creates a real virtual display at exactly the resolution and refresh rate your TV reports, up to 4K. No scaling, no black bars, and the monitors on your PC are left where they are. Decoding is done in hardware through VideoToolbox (HEVC and H.264), and HDR is passed through as PQ rather than flattened.
|
||||
|
||||
CONTROLLERS, IN FULL
|
||||
|
||||
DualSense, Xbox, and other MFi-compatible controllers. On a DualSense, rumble, lightbar, player LEDs, adaptive triggers, touchpad, and gyro all reach the game. The virtual gamepad the host presents takes its type from the controller actually in your hands. Everything is navigable with the Siri Remote or entirely with a controller — the interface is built for a remote, not for a mouse.
|
||||
|
||||
YOUR LIBRARY ON THE BIG SCREEN
|
||||
|
||||
Installed Steam titles and games you add yourself appear as a grid with artwork, ready to launch from the couch. Several devices can stream at once, each on its own display — so the Apple TV in the living room does not disturb anyone still working at the desk.
|
||||
|
||||
FAST, BECAUSE WE OWN THE WHOLE PATH
|
||||
|
||||
The native apps speak punktfunk/1: a QUIC control plane and an encrypted data plane with forward error correction. A tiered overlay shows frame rate, bitrate, and latency — corrected for clock skew across the two machines, so it is a measurement rather than a claim. A per-host speed test suggests a bitrate that matches your network.
|
||||
|
||||
WHAT YOU NEED
|
||||
|
||||
A Punktfunk host on a Linux PC or on Windows 11 (22H2 or later) on the same network. For the best experience, put your Apple TV on Ethernet or on good 5 GHz Wi-Fi. The host is open source (MIT/Apache-2.0) and free — guides and source at punktfunk.unom.io.
|
||||
|
||||
No account. No cloud. No telemetry. This app collects no data about you.
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Keywords — max 100 characters
|
||||
|
||||
### DE (93)
|
||||
|
||||
```
|
||||
streaming,spiele,gaming,controller,gamepad,wohnzimmer,fernseher,pc,linux,windows,4k,hdr,couch
|
||||
```
|
||||
|
||||
### EN (91)
|
||||
|
||||
```
|
||||
streaming,gaming,controller,gamepad,livingroom,tv,pc,linux,windows,4k,hdr,couch,remote,play
|
||||
```
|
||||
|
||||
Same exclusions as macOS: no `Moonlight`, `GameStream`, `NVIDIA`, or `Steam` in the keyword field.
|
||||
@@ -56,6 +56,167 @@ exclude = ["MsghdrX", "recvmsg_x", "mmsghdr", "sendmmsg", "recvmmsg"]
|
||||
"FRAME_MS" = "PUNKTFUNK_AUDIO_FRAME_MS"
|
||||
"SAMPLE_RATE_HZ" = "PUNKTFUNK_AUDIO_SAMPLE_RATE_HZ"
|
||||
|
||||
# R21: every remaining exported constant, prefixed. cbindgen emits a bare `#define` per
|
||||
# `pub const`, so without an entry here names as generic as MAX_PADS, TAG_LEN, ABI_VERSION and
|
||||
# INPUT_MAGIC land in the namespace of every C embedder that includes this header — and, as the
|
||||
# note above says, a clashing #define silently takes the last definition rather than failing to
|
||||
# compile. The table above had been doing this by hand for the handful someone noticed; this is
|
||||
# the rest of them, so the stated rule finally holds for the whole surface.
|
||||
#
|
||||
# NOT covered, deliberately: associated constants (`ColorInfo_CP_BT709`, `ClockResync_ROUNDS`,
|
||||
# `ResyncGuard_MAX_REJECTED_STREAK`). cbindgen already qualifies those with their type name,
|
||||
# which is the very property whose absence makes a bare `MAX_PADS` dangerous — they are
|
||||
# namespaced, just not by us.
|
||||
"ABI_VERSION" = "PUNKTFUNK_ABI_VERSION"
|
||||
"APP_EXITED_CLOSE_CODE" = "PUNKTFUNK_APP_EXITED_CLOSE_CODE"
|
||||
"BTN_MISC1" = "PUNKTFUNK_BTN_MISC1"
|
||||
"BTN_PADDLE1" = "PUNKTFUNK_BTN_PADDLE1"
|
||||
"BTN_PADDLE2" = "PUNKTFUNK_BTN_PADDLE2"
|
||||
"BTN_PADDLE3" = "PUNKTFUNK_BTN_PADDLE3"
|
||||
"BTN_PADDLE4" = "PUNKTFUNK_BTN_PADDLE4"
|
||||
"CHROMA_IDC_420" = "PUNKTFUNK_CHROMA_IDC_420"
|
||||
"CHROMA_IDC_444" = "PUNKTFUNK_CHROMA_IDC_444"
|
||||
"CIPHER_AES_128_GCM" = "PUNKTFUNK_CIPHER_AES_128_GCM"
|
||||
"CIPHER_CHACHA20_POLY1305" = "PUNKTFUNK_CIPHER_CHACHA20_POLY1305"
|
||||
"CLIENT_CAP_AUDIO_RED" = "PUNKTFUNK_CLIENT_CAP_AUDIO_RED"
|
||||
"CLIENT_CAP_CURSOR" = "PUNKTFUNK_CLIENT_CAP_CURSOR"
|
||||
"CLIENT_CAP_PHASE_LOCK" = "PUNKTFUNK_CLIENT_CAP_PHASE_LOCK"
|
||||
"CLIP_CANCELLED_CODE" = "PUNKTFUNK_CLIP_CANCELLED_CODE"
|
||||
"CLIP_CHUNK" = "PUNKTFUNK_CLIP_CHUNK"
|
||||
"CLIP_FETCH_CAP" = "PUNKTFUNK_CLIP_FETCH_CAP"
|
||||
"CLIP_FETCH_DENIED" = "PUNKTFUNK_CLIP_FETCH_DENIED"
|
||||
"CLIP_FETCH_OK" = "PUNKTFUNK_CLIP_FETCH_OK"
|
||||
"CLIP_FETCH_STALE" = "PUNKTFUNK_CLIP_FETCH_STALE"
|
||||
"CLIP_FETCH_UNAVAILABLE" = "PUNKTFUNK_CLIP_FETCH_UNAVAILABLE"
|
||||
"CLIP_FILE_INDEX_NONE" = "PUNKTFUNK_CLIP_FILE_INDEX_NONE"
|
||||
"CLIP_FLAG_FILES" = "PUNKTFUNK_CLIP_FLAG_FILES"
|
||||
"CLIP_MAX_KINDS" = "PUNKTFUNK_CLIP_MAX_KINDS"
|
||||
"CLIP_MAX_MIME" = "PUNKTFUNK_CLIP_MAX_MIME"
|
||||
"CLIP_POLICY_FILES" = "PUNKTFUNK_CLIP_POLICY_FILES"
|
||||
"CLIP_POLICY_TEXT" = "PUNKTFUNK_CLIP_POLICY_TEXT"
|
||||
"CLIP_REASON_BACKEND_UNAVAILABLE" = "PUNKTFUNK_CLIP_REASON_BACKEND_UNAVAILABLE"
|
||||
"CLIP_REASON_NO_FILES" = "PUNKTFUNK_CLIP_REASON_NO_FILES"
|
||||
"CLIP_REASON_OK" = "PUNKTFUNK_CLIP_REASON_OK"
|
||||
"CLIP_REASON_POLICY_DISABLED" = "PUNKTFUNK_CLIP_REASON_POLICY_DISABLED"
|
||||
"CLIP_REASON_TAKEN_OVER" = "PUNKTFUNK_CLIP_REASON_TAKEN_OVER"
|
||||
"CLIP_STREAM_KIND_FETCH" = "PUNKTFUNK_CLIP_STREAM_KIND_FETCH"
|
||||
"ClockResync_ROUNDS" = "PUNKTFUNK_ClockResync_ROUNDS"
|
||||
"CODEC_AV1" = "PUNKTFUNK_CODEC_AV1"
|
||||
"CODEC_H264" = "PUNKTFUNK_CODEC_H264"
|
||||
"CODEC_HEVC" = "PUNKTFUNK_CODEC_HEVC"
|
||||
"CODEC_PYROWAVE" = "PUNKTFUNK_CODEC_PYROWAVE"
|
||||
"ColorInfo_CP_BT2020" = "PUNKTFUNK_ColorInfo_CP_BT2020"
|
||||
"ColorInfo_CP_BT709" = "PUNKTFUNK_ColorInfo_CP_BT709"
|
||||
"ColorInfo_MC_BT2020_NCL" = "PUNKTFUNK_ColorInfo_MC_BT2020_NCL"
|
||||
"ColorInfo_MC_BT709" = "PUNKTFUNK_ColorInfo_MC_BT709"
|
||||
"ColorInfo_TRC_BT709" = "PUNKTFUNK_ColorInfo_TRC_BT709"
|
||||
"ColorInfo_TRC_HLG" = "PUNKTFUNK_ColorInfo_TRC_HLG"
|
||||
"ColorInfo_TRC_PQ" = "PUNKTFUNK_ColorInfo_TRC_PQ"
|
||||
"CURSOR_RELATIVE_HINT" = "PUNKTFUNK_CURSOR_RELATIVE_HINT"
|
||||
"CURSOR_SHAPE_MAX_SIDE" = "PUNKTFUNK_CURSOR_SHAPE_MAX_SIDE"
|
||||
"CURSOR_STATE_MAGIC" = "PUNKTFUNK_CURSOR_STATE_MAGIC"
|
||||
"CURSOR_VISIBLE" = "PUNKTFUNK_CURSOR_VISIBLE"
|
||||
"FLAG_EOF" = "PUNKTFUNK_FLAG_EOF"
|
||||
"FLAG_PIC" = "PUNKTFUNK_FLAG_PIC"
|
||||
"FLAG_PROBE" = "PUNKTFUNK_FLAG_PROBE"
|
||||
"FLAG_SOF" = "PUNKTFUNK_FLAG_SOF"
|
||||
"HDR_META_BODY_LEN" = "PUNKTFUNK_HDR_META_BODY_LEN"
|
||||
"HDR_META_MAGIC" = "PUNKTFUNK_HDR_META_MAGIC"
|
||||
"HELLO_LAUNCH_MAX" = "PUNKTFUNK_HELLO_LAUNCH_MAX"
|
||||
"HELLO_NAME_MAX" = "PUNKTFUNK_HELLO_NAME_MAX"
|
||||
"HID_RAW_FEATURE" = "PUNKTFUNK_HID_RAW_FEATURE"
|
||||
"HID_RAW_OUTPUT" = "PUNKTFUNK_HID_RAW_OUTPUT"
|
||||
"HID_REPORT_MAX" = "PUNKTFUNK_HID_REPORT_MAX"
|
||||
"HIDOUT_MAGIC" = "PUNKTFUNK_HIDOUT_MAGIC"
|
||||
"HOST_CAP_AUDIO_RED" = "PUNKTFUNK_HOST_CAP_AUDIO_RED"
|
||||
"HOST_CAP_CLIPBOARD" = "PUNKTFUNK_HOST_CAP_CLIPBOARD"
|
||||
"HOST_CAP_CURSOR" = "PUNKTFUNK_HOST_CAP_CURSOR"
|
||||
"HOST_CAP_GAMEPAD_STATE" = "PUNKTFUNK_HOST_CAP_GAMEPAD_STATE"
|
||||
"HOST_CAP_PEN" = "PUNKTFUNK_HOST_CAP_PEN"
|
||||
"HOST_CAP_TEXT_INPUT" = "PUNKTFUNK_HOST_CAP_TEXT_INPUT"
|
||||
"HOST_TIMING_MAGIC" = "PUNKTFUNK_HOST_TIMING_MAGIC"
|
||||
"INBOUND_REQ_FLAG" = "PUNKTFUNK_INBOUND_REQ_FLAG"
|
||||
"INPUT_MAGIC" = "PUNKTFUNK_INPUT_MAGIC"
|
||||
"INPUT_WIRE_LEN" = "PUNKTFUNK_INPUT_WIRE_LEN"
|
||||
"LEGACY_STALE_MS" = "PUNKTFUNK_LEGACY_STALE_MS"
|
||||
"MAX_DATAGRAM_BYTES" = "PUNKTFUNK_MAX_DATAGRAM_BYTES"
|
||||
"MAX_PADS" = "PUNKTFUNK_MAX_PADS"
|
||||
"MAX_SCALE" = "PUNKTFUNK_MAX_SCALE"
|
||||
"MIC_MAGIC" = "PUNKTFUNK_MIC_MAGIC"
|
||||
"MIN_SCALE" = "PUNKTFUNK_MIN_SCALE"
|
||||
"MIN_SHARD_PAYLOAD" = "PUNKTFUNK_MIN_SHARD_PAYLOAD"
|
||||
"MIN_STREAM_BLOCK_SHARDS" = "PUNKTFUNK_MIN_STREAM_BLOCK_SHARDS"
|
||||
"MSG_BITRATE_CHANGED" = "PUNKTFUNK_MSG_BITRATE_CHANGED"
|
||||
"MSG_CLIP_CONTROL" = "PUNKTFUNK_MSG_CLIP_CONTROL"
|
||||
"MSG_CLIP_FETCH" = "PUNKTFUNK_MSG_CLIP_FETCH"
|
||||
"MSG_CLIP_FETCH_HDR" = "PUNKTFUNK_MSG_CLIP_FETCH_HDR"
|
||||
"MSG_CLIP_OFFER" = "PUNKTFUNK_MSG_CLIP_OFFER"
|
||||
"MSG_CLIP_STATE" = "PUNKTFUNK_MSG_CLIP_STATE"
|
||||
"MSG_CLOCK_ECHO" = "PUNKTFUNK_MSG_CLOCK_ECHO"
|
||||
"MSG_CLOCK_PROBE" = "PUNKTFUNK_MSG_CLOCK_PROBE"
|
||||
"MSG_CURSOR_RENDER" = "PUNKTFUNK_MSG_CURSOR_RENDER"
|
||||
"MSG_CURSOR_SHAPE" = "PUNKTFUNK_MSG_CURSOR_SHAPE"
|
||||
"MSG_LOSS_REPORT" = "PUNKTFUNK_MSG_LOSS_REPORT"
|
||||
"MSG_PAIR_CHALLENGE" = "PUNKTFUNK_MSG_PAIR_CHALLENGE"
|
||||
"MSG_PAIR_PROOF" = "PUNKTFUNK_MSG_PAIR_PROOF"
|
||||
"MSG_PAIR_REQUEST" = "PUNKTFUNK_MSG_PAIR_REQUEST"
|
||||
"MSG_PAIR_RESULT" = "PUNKTFUNK_MSG_PAIR_RESULT"
|
||||
"MSG_PHASE_REPORT" = "PUNKTFUNK_MSG_PHASE_REPORT"
|
||||
"MSG_PROBE_REQUEST" = "PUNKTFUNK_MSG_PROBE_REQUEST"
|
||||
"MSG_PROBE_RESULT" = "PUNKTFUNK_MSG_PROBE_RESULT"
|
||||
"MSG_RECONFIGURE" = "PUNKTFUNK_MSG_RECONFIGURE"
|
||||
"MSG_RECONFIGURED" = "PUNKTFUNK_MSG_RECONFIGURED"
|
||||
"MSG_REQUEST_KEYFRAME" = "PUNKTFUNK_MSG_REQUEST_KEYFRAME"
|
||||
"MSG_RFI_REQUEST" = "PUNKTFUNK_MSG_RFI_REQUEST"
|
||||
"MSG_SET_BITRATE" = "PUNKTFUNK_MSG_SET_BITRATE"
|
||||
"MSG_SHARD_PAYLOAD_ACK" = "PUNKTFUNK_MSG_SHARD_PAYLOAD_ACK"
|
||||
"MSG_SHARD_PAYLOAD_CHANGED" = "PUNKTFUNK_MSG_SHARD_PAYLOAD_CHANGED"
|
||||
"NO_OUTPUT_KEYFRAME_STREAK" = "PUNKTFUNK_NO_OUTPUT_KEYFRAME_STREAK"
|
||||
"PAIR_APPROVAL_TIMEOUT_CLOSE_CODE" = "PUNKTFUNK_PAIR_APPROVAL_TIMEOUT_CLOSE_CODE"
|
||||
"PAIR_BOUND_OTHER_CLOSE_CODE" = "PUNKTFUNK_PAIR_BOUND_OTHER_CLOSE_CODE"
|
||||
"PAIR_DENIED_CLOSE_CODE" = "PUNKTFUNK_PAIR_DENIED_CLOSE_CODE"
|
||||
"PAIR_NO_IDENTITY_CLOSE_CODE" = "PUNKTFUNK_PAIR_NO_IDENTITY_CLOSE_CODE"
|
||||
"PAIR_NOT_ARMED_CLOSE_CODE" = "PUNKTFUNK_PAIR_NOT_ARMED_CLOSE_CODE"
|
||||
"PAIR_RATE_LIMITED_CLOSE_CODE" = "PUNKTFUNK_PAIR_RATE_LIMITED_CLOSE_CODE"
|
||||
"PAIR_SUPERSEDED_CLOSE_CODE" = "PUNKTFUNK_PAIR_SUPERSEDED_CLOSE_CODE"
|
||||
"PEN_ANGLE_UNKNOWN" = "PUNKTFUNK_PEN_ANGLE_UNKNOWN"
|
||||
"PEN_BARREL1" = "PUNKTFUNK_PEN_BARREL1"
|
||||
"PEN_BARREL2" = "PUNKTFUNK_PEN_BARREL2"
|
||||
"PEN_BATCH_MAX" = "PUNKTFUNK_PEN_BATCH_MAX"
|
||||
"PEN_DISTANCE_UNKNOWN" = "PUNKTFUNK_PEN_DISTANCE_UNKNOWN"
|
||||
"PEN_IN_RANGE" = "PUNKTFUNK_PEN_IN_RANGE"
|
||||
"PEN_PREDICTED" = "PUNKTFUNK_PEN_PREDICTED"
|
||||
"PEN_SAMPLE_WIRE_LEN" = "PUNKTFUNK_PEN_SAMPLE_WIRE_LEN"
|
||||
"PEN_TILT_UNKNOWN" = "PUNKTFUNK_PEN_TILT_UNKNOWN"
|
||||
"PEN_TOUCH_TIMEOUT_MS" = "PUNKTFUNK_PEN_TOUCH_TIMEOUT_MS"
|
||||
"PEN_TOUCHING" = "PUNKTFUNK_PEN_TOUCHING"
|
||||
"PRESETS" = "PUNKTFUNK_PRESETS"
|
||||
"QUIT_CLOSE_CODE" = "PUNKTFUNK_QUIT_CLOSE_CODE"
|
||||
"REANCHOR_MARKS_TO_LIFT" = "PUNKTFUNK_REANCHOR_MARKS_TO_LIFT"
|
||||
"REJECT_BUSY_CLOSE_CODE" = "PUNKTFUNK_REJECT_BUSY_CLOSE_CODE"
|
||||
"ResyncGuard_MAX_REJECTED_STREAK" = "PUNKTFUNK_ResyncGuard_MAX_REJECTED_STREAK"
|
||||
"RFI_MAX_RANGE" = "PUNKTFUNK_RFI_MAX_RANGE"
|
||||
"RICH_INPUT_MAGIC" = "PUNKTFUNK_RICH_INPUT_MAGIC"
|
||||
"RUMBLE_V1_LEN" = "PUNKTFUNK_RUMBLE_V1_LEN"
|
||||
"RUMBLE_V2_LEN" = "PUNKTFUNK_RUMBLE_V2_LEN"
|
||||
"SETUP_FAILED_CLOSE_CODE" = "PUNKTFUNK_SETUP_FAILED_CLOSE_CODE"
|
||||
"TAG_LEN" = "PUNKTFUNK_TAG_LEN"
|
||||
"TRIGGER_EFFECT_MAX" = "PUNKTFUNK_TRIGGER_EFFECT_MAX"
|
||||
"USER_FLAG_CHUNK_ALIGNED" = "PUNKTFUNK_USER_FLAG_CHUNK_ALIGNED"
|
||||
"USER_FLAG_RECOVERY_ANCHOR" = "PUNKTFUNK_USER_FLAG_RECOVERY_ANCHOR"
|
||||
"USER_FLAG_RECOVERY_POINT" = "PUNKTFUNK_USER_FLAG_RECOVERY_POINT"
|
||||
"USER_FLAG_SLICE_STREAM" = "PUNKTFUNK_USER_FLAG_SLICE_STREAM"
|
||||
"VIDEO_CAP_10BIT" = "PUNKTFUNK_VIDEO_CAP_10BIT"
|
||||
"VIDEO_CAP_444" = "PUNKTFUNK_VIDEO_CAP_444"
|
||||
"VIDEO_CAP_CHACHA20" = "PUNKTFUNK_VIDEO_CAP_CHACHA20"
|
||||
"VIDEO_CAP_HDR" = "PUNKTFUNK_VIDEO_CAP_HDR"
|
||||
"VIDEO_CAP_HOST_TIMING" = "PUNKTFUNK_VIDEO_CAP_HOST_TIMING"
|
||||
"VIDEO_CAP_MULTI_SLICE" = "PUNKTFUNK_VIDEO_CAP_MULTI_SLICE"
|
||||
"VIDEO_CAP_PROBE_SEQ" = "PUNKTFUNK_VIDEO_CAP_PROBE_SEQ"
|
||||
"VIDEO_CAP_STREAMED_AU" = "PUNKTFUNK_VIDEO_CAP_STREAMED_AU"
|
||||
"WIRE_VERSION" = "PUNKTFUNK_WIRE_VERSION"
|
||||
"WIRE_VERSION_CLOSE_CODE" = "PUNKTFUNK_WIRE_VERSION_CLOSE_CODE"
|
||||
|
||||
# QualifiedScreamingSnakeCase already qualifies each variant with the enum name
|
||||
# (PunktfunkStatus::Ok -> PUNKTFUNK_STATUS_OK); do NOT also set prefix_with_name or it doubles.
|
||||
[enum]
|
||||
|
||||
@@ -60,22 +60,28 @@ pub(super) async fn run(
|
||||
}
|
||||
Some(&crate::quic::RUMBLE_MAGIC) => {
|
||||
if let Some(u) = crate::quic::decode_rumble_envelope(&d) {
|
||||
// A pad index the client cannot represent is dropped outright, before either
|
||||
// consumer sees it. It used to be waved through: the seq gate was skipped (its
|
||||
// per-pad cursor has no slot for it) and it was handed to the legacy queue,
|
||||
// while the policy engine silently discarded it on its own bounds check — so
|
||||
// "both consumers are fed" below was false for exactly these, and an embedder
|
||||
// draining the queue could be handed an index it would use to subscript its
|
||||
// own per-pad array. The host never emits one; this is malformed or hostile.
|
||||
let idx = u.pad as usize;
|
||||
if idx >= crate::input::MAX_PADS {
|
||||
continue;
|
||||
}
|
||||
// Gate v2 envelopes on their per-pad seq; forward v1 (envelope: None) as-is.
|
||||
let fresh = match u.envelope {
|
||||
Some(env) => {
|
||||
let idx = u.pad as usize;
|
||||
if idx < crate::input::MAX_PADS {
|
||||
if crate::input::GamepadSnapshot::seq_newer(
|
||||
env.seq,
|
||||
rumble_last_seq[idx],
|
||||
) {
|
||||
rumble_last_seq[idx] = Some(env.seq);
|
||||
true
|
||||
} else {
|
||||
false // reordered/duplicate — drop, keep the newer state
|
||||
}
|
||||
if crate::input::GamepadSnapshot::seq_newer(
|
||||
env.seq,
|
||||
rumble_last_seq[idx],
|
||||
) {
|
||||
rumble_last_seq[idx] = Some(env.seq);
|
||||
true
|
||||
} else {
|
||||
true // out-of-range pad (host never sends these): no gate
|
||||
false // reordered/duplicate — drop, keep the newer state
|
||||
}
|
||||
}
|
||||
None => true,
|
||||
|
||||
@@ -107,6 +107,10 @@ pub use stats::Stats;
|
||||
/// v10: added `punktfunk_connection_clock_offset_now_ns` — the LIVE (mid-stream re-synced)
|
||||
/// clock offset ongoing latency math must use; the connect-time getter stays frozen by
|
||||
/// contract. Additive, client-local — no wire change, so [`WIRE_VERSION`] is unchanged.
|
||||
/// v11: added `punktfunk_connect_ex9` — `connect_ex8` plus a `client_caps` bitfield
|
||||
/// (`PUNKTFUNK_CLIENT_CAP_CURSOR`, later `…_PHASE_LOCK`), which is how a client tells the host it
|
||||
/// renders the pointer itself. Additive; the caps ride the existing Hello, so [`WIRE_VERSION`] is
|
||||
/// unchanged. (Documented late — the bump shipped without its line here.)
|
||||
/// v12: added `punktfunk_connection_set_cursor_render` — the mid-stream cursor-render flip
|
||||
/// (design/remote-desktop-sweep.md §8): the client's mouse-model chord tells the host who
|
||||
/// renders the pointer. Additive; rides the existing control stream (a new message TYPE, which
|
||||
@@ -120,7 +124,15 @@ pub use stats::Stats;
|
||||
/// uncertainty and the circular arrival-lead statistic the host's controller steers on. Additive;
|
||||
/// the wire grows only a new control message (`PhaseReport`, 0x32) an old host never reads and a
|
||||
/// strict-prefix append on the 0xCF host-timing tail, so [`WIRE_VERSION`] is unchanged.
|
||||
pub const ABI_VERSION: u32 = 14;
|
||||
/// v15: versions the shared rumble policy engine's C surface —
|
||||
/// `punktfunk_connection_next_rumble_cmd`, `punktfunk_connection_set_rumble_quirks` and the
|
||||
/// `PUNKTFUNK_RUMBLE_QUIRK_*` bits. These symbols are NOT new: they landed while this constant
|
||||
/// still read 7 and no bump was made, so every core since has exported them while advertising a
|
||||
/// version that never promised them. That cannot be corrected retroactively — a shipped binary
|
||||
/// says what it says — so v15 is the floor that *guarantees* them: at or above it the surface is
|
||||
/// present, below it an embedder must probe for the symbol. Purely a version statement; no code
|
||||
/// changed with this bump, and no wire change, so [`WIRE_VERSION`] is unchanged.
|
||||
pub const ABI_VERSION: u32 = 15;
|
||||
|
||||
/// The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
|
||||
/// Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**
|
||||
|
||||
@@ -401,6 +401,16 @@ impl RichInput {
|
||||
}
|
||||
}
|
||||
|
||||
/// Longest [`HidOutput::Trigger`] `effect` the wire carries: the DualSense adaptive-trigger
|
||||
/// parameter block is a mode byte plus ten parameters, and every consumer copies at most this many
|
||||
/// into its report.
|
||||
///
|
||||
/// The single source for the clamp on BOTH sides. `Trigger` was the only variable-length variant
|
||||
/// bounded on neither: encode appended whatever it was handed and decode took the entire tail, so
|
||||
/// an attacker-sized datagram was reproduced verbatim into a `Vec` while its sibling `HidRaw` had
|
||||
/// been bounded on both ends all along.
|
||||
pub const TRIGGER_EFFECT_MAX: usize = 11;
|
||||
|
||||
const HIDOUT_LED: u8 = 0x01;
|
||||
const HIDOUT_PLAYER_LEDS: u8 = 0x02;
|
||||
const HIDOUT_TRIGGER: u8 = 0x03;
|
||||
@@ -460,7 +470,7 @@ impl HidOutput {
|
||||
}
|
||||
HidOutput::Trigger { pad, which, effect } => {
|
||||
out.extend_from_slice(&[HIDOUT_TRIGGER, *pad, *which]);
|
||||
out.extend_from_slice(effect);
|
||||
out.extend_from_slice(&effect[..effect.len().min(TRIGGER_EFFECT_MAX)]);
|
||||
}
|
||||
HidOutput::TrackpadHaptic {
|
||||
pad,
|
||||
@@ -497,10 +507,17 @@ impl HidOutput {
|
||||
pad: b[2],
|
||||
bits: b[3],
|
||||
}),
|
||||
HIDOUT_TRIGGER if b.len() >= 4 => Some(HidOutput::Trigger {
|
||||
// `> 4`, not `>= 4`: a body with no effect bytes at all is malformed, and decoding it
|
||||
// as an EMPTY effect was actively harmful — downstream an empty block is written as an
|
||||
// all-zero trigger report, which is mode 0x00, which RELEASES a held effect. A
|
||||
// truncated datagram could therefore silently cancel the trigger a game was holding.
|
||||
// A genuine "no effect" is a full-length zero block and still decodes fine.
|
||||
HIDOUT_TRIGGER if b.len() > 4 => Some(HidOutput::Trigger {
|
||||
pad: b[2],
|
||||
which: b[3],
|
||||
effect: b[4..].to_vec(),
|
||||
// Bounded like `HidRaw` below: at most the parameter block is kept from the
|
||||
// (attacker-sized) tail.
|
||||
effect: b[4..b.len().min(4 + TRIGGER_EFFECT_MAX)].to_vec(),
|
||||
}),
|
||||
HIDOUT_TRACKPAD_HAPTIC if b.len() >= 10 => Some(HidOutput::TrackpadHaptic {
|
||||
pad: b[2],
|
||||
@@ -981,6 +998,82 @@ mod tests {
|
||||
assert!(decode_rumble_datagram(&d[..6]).is_none());
|
||||
}
|
||||
|
||||
/// `Trigger` is the only variable-length variant that used to be bounded on NEITHER side.
|
||||
/// Pinned here because both halves matter: an over-long effect must be clamped on the way out
|
||||
/// AND on the way in, and a body with no effect bytes must not decode at all.
|
||||
#[test]
|
||||
fn trigger_effect_is_clamped_on_both_encode_and_decode() {
|
||||
// Encode clamps: a caller handing over an over-long block cannot put it on the wire.
|
||||
let long = HidOutput::Trigger {
|
||||
pad: 1,
|
||||
which: 0,
|
||||
effect: vec![0xAB; 200],
|
||||
};
|
||||
let d = long.encode();
|
||||
assert_eq!(
|
||||
d.len(),
|
||||
4 + TRIGGER_EFFECT_MAX,
|
||||
"magic + kind + pad + which + at most the parameter block"
|
||||
);
|
||||
|
||||
// Decode clamps independently of encode — a hostile peer does not use our encoder.
|
||||
let mut hostile = vec![HIDOUT_MAGIC, super::HIDOUT_TRIGGER, 1, 0];
|
||||
hostile.extend_from_slice(&[0xCD; 500]);
|
||||
match HidOutput::decode(&hostile) {
|
||||
Some(HidOutput::Trigger { effect, .. }) => {
|
||||
assert_eq!(effect.len(), TRIGGER_EFFECT_MAX, "tail is bounded");
|
||||
}
|
||||
other => panic!("expected a clamped Trigger, got {other:?}"),
|
||||
}
|
||||
|
||||
// An exact-length effect survives untouched, and round-trips.
|
||||
let ok = HidOutput::Trigger {
|
||||
pad: 2,
|
||||
which: 1,
|
||||
effect: vec![0x02, 0x90, 0xA0, 0xFF, 0, 0, 0, 0, 0, 0, 0],
|
||||
};
|
||||
assert_eq!(HidOutput::decode(&ok.encode()), Some(ok));
|
||||
}
|
||||
|
||||
/// A body with no effect bytes is malformed and must be REJECTED, not read as an empty effect:
|
||||
/// downstream an empty block becomes an all-zero trigger report, which is mode 0x00 — it
|
||||
/// releases whatever effect the game was holding. A truncated datagram must not do that.
|
||||
#[test]
|
||||
fn a_trigger_with_no_effect_bytes_is_rejected_not_read_as_cancel() {
|
||||
let empty = [HIDOUT_MAGIC, super::HIDOUT_TRIGGER, 0, 0];
|
||||
assert_eq!(HidOutput::decode(&empty), None);
|
||||
|
||||
// One byte of effect is a legitimate short block (consumers zero-pad it) and still decodes.
|
||||
let one = [HIDOUT_MAGIC, super::HIDOUT_TRIGGER, 0, 0, 0x02];
|
||||
assert_eq!(
|
||||
HidOutput::decode(&one),
|
||||
Some(HidOutput::Trigger {
|
||||
pad: 0,
|
||||
which: 0,
|
||||
effect: vec![0x02]
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
/// `HidRaw`'s bound was already correct on both sides — pinned alongside `Trigger` so the pair
|
||||
/// cannot drift apart again.
|
||||
#[test]
|
||||
fn hid_raw_stays_bounded_on_both_sides() {
|
||||
let long = HidOutput::HidRaw {
|
||||
pad: 0,
|
||||
kind: HID_RAW_OUTPUT,
|
||||
data: vec![0x11; 500],
|
||||
};
|
||||
assert_eq!(long.encode().len(), 4 + HID_REPORT_MAX);
|
||||
|
||||
let mut hostile = vec![HIDOUT_MAGIC, super::HIDOUT_HID_RAW, 0, HID_RAW_FEATURE];
|
||||
hostile.extend_from_slice(&[0x22; 900]);
|
||||
match HidOutput::decode(&hostile) {
|
||||
Some(HidOutput::HidRaw { data, .. }) => assert_eq!(data.len(), HID_REPORT_MAX),
|
||||
other => panic!("expected a clamped HidRaw, got {other:?}"),
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn rumble_envelope_roundtrip_and_legacy_tolerance() {
|
||||
// v2 envelope round-trips seq + ttl.
|
||||
|
||||
+163
-139
@@ -45,6 +45,10 @@
|
||||
// v10: added `punktfunk_connection_clock_offset_now_ns` — the LIVE (mid-stream re-synced)
|
||||
// clock offset ongoing latency math must use; the connect-time getter stays frozen by
|
||||
// contract. Additive, client-local — no wire change, so [`WIRE_VERSION`] is unchanged.
|
||||
// v11: added `punktfunk_connect_ex9` — `connect_ex8` plus a `client_caps` bitfield
|
||||
// (`PUNKTFUNK_CLIENT_CAP_CURSOR`, later `…_PHASE_LOCK`), which is how a client tells the host it
|
||||
// renders the pointer itself. Additive; the caps ride the existing Hello, so [`WIRE_VERSION`] is
|
||||
// unchanged. (Documented late — the bump shipped without its line here.)
|
||||
// v12: added `punktfunk_connection_set_cursor_render` — the mid-stream cursor-render flip
|
||||
// (design/remote-desktop-sweep.md §8): the client's mouse-model chord tells the host who
|
||||
// renders the pointer. Additive; rides the existing control stream (a new message TYPE, which
|
||||
@@ -58,7 +62,15 @@
|
||||
// uncertainty and the circular arrival-lead statistic the host's controller steers on. Additive;
|
||||
// the wire grows only a new control message (`PhaseReport`, 0x32) an old host never reads and a
|
||||
// strict-prefix append on the 0xCF host-timing tail, so [`WIRE_VERSION`] is unchanged.
|
||||
#define ABI_VERSION 14
|
||||
// v15: versions the shared rumble policy engine's C surface —
|
||||
// `punktfunk_connection_next_rumble_cmd`, `punktfunk_connection_set_rumble_quirks` and the
|
||||
// `PUNKTFUNK_RUMBLE_QUIRK_*` bits. These symbols are NOT new: they landed while this constant
|
||||
// still read 7 and no bump was made, so every core since has exported them while advertising a
|
||||
// version that never promised them. That cannot be corrected retroactively — a shipped binary
|
||||
// says what it says — so v15 is the floor that *guarantees* them: at or above it the surface is
|
||||
// present, below it an embedder must probe for the symbol. Purely a version statement; no code
|
||||
// changed with this bump, and no wire change, so [`WIRE_VERSION`] is unchanged.
|
||||
#define PUNKTFUNK_ABI_VERSION 15
|
||||
|
||||
// The punktfunk/1 **wire** version — what `Hello`/`Welcome` carry and hosts equality-check.
|
||||
// Deliberately its own constant: [`ABI_VERSION`] tracks the embeddable **C surface**
|
||||
@@ -66,7 +78,7 @@
|
||||
// `punktfunk_wake_on_lan` is client-local, and riding the C-ABI bump onto the wire locked
|
||||
// every new client out of every deployed host ("ABI mismatch: client 3 host 2", observed
|
||||
// live). Bump this ONLY when the handshake/planes actually change incompatibly.
|
||||
#define WIRE_VERSION 2
|
||||
#define PUNKTFUNK_WIRE_VERSION 2
|
||||
|
||||
// `PunktfunkHidOutput::kind` — lightbar RGB (`r`/`g`/`b` valid).
|
||||
#define PUNKTFUNK_HIDOUT_LED 1
|
||||
@@ -323,41 +335,41 @@
|
||||
// The uniform no-TTL-host staleness bound: a legacy host refreshes state every 500 ms, so two
|
||||
// missed refreshes = quiet host → silence. Replaces the per-platform zoo (1.6 s / 60 s / 1.5 s /
|
||||
// 1 s), and matches the ratio the Steam Deck ceiling shipped with.
|
||||
#define LEGACY_STALE_MS 1000
|
||||
#define PUNKTFUNK_LEGACY_STALE_MS 1000
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Per-fetch requester-side size cap (bytes). A holder that streams more than this is treated as a
|
||||
// cap breach and the fetch fails rather than buffering unboundedly (§7). Phase 0 uses one fixed
|
||||
// value; a future host-policy `PUNKTFUNK_CLIP_MAX_MB` tightens it per session.
|
||||
#define CLIP_FETCH_CAP (64 << 20)
|
||||
#define PUNKTFUNK_CLIP_FETCH_CAP (64 << 20)
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Inbound-serve `req_id`s carry this high bit so they never collide with the client-assigned
|
||||
// outbound-fetch `xfer_id`s (which count up from 1). A single [`ClipCommand::Cancel`] `id` can
|
||||
// then be routed to the right table.
|
||||
#define INBOUND_REQ_FLAG 2147483648
|
||||
#define PUNKTFUNK_INBOUND_REQ_FLAG 2147483648
|
||||
#endif
|
||||
|
||||
// Floor for a negotiated `shard_payload` (even, well under every real path). A path whose UDP
|
||||
// budget lands below this can't carry the QUIC control plane either (QUIC's own minimum is a
|
||||
// 1200-byte UDP payload), so shrinking video shards further buys nothing — the clamp helpers
|
||||
// bottom out here instead of producing degenerate confetti-sized shards.
|
||||
#define MIN_SHARD_PAYLOAD 512
|
||||
#define PUNKTFUNK_MIN_SHARD_PAYLOAD 512
|
||||
|
||||
// 16-byte AEAD authentication tag appended by either session cipher.
|
||||
#define TAG_LEN 16
|
||||
#define PUNKTFUNK_TAG_LEN 16
|
||||
|
||||
// Wire tag distinguishing an input datagram from a video packet.
|
||||
#define INPUT_MAGIC 200
|
||||
#define PUNKTFUNK_INPUT_MAGIC 200
|
||||
|
||||
// Fixed serialized size of an [`InputEvent`] on the wire (tag + fields).
|
||||
#define INPUT_WIRE_LEN (((((1 + 1) + 4) + 4) + 4) + 4)
|
||||
#define PUNKTFUNK_INPUT_WIRE_LEN (((((1 + 1) + 4) + 4) + 4) + 4)
|
||||
|
||||
// The number of gamepads addressable on the wire (`flags` pad index 0..15). Shared by the
|
||||
// client's snapshot fold and the host's per-pad accumulators.
|
||||
#define MAX_PADS 16
|
||||
#define PUNKTFUNK_MAX_PADS 16
|
||||
|
||||
#define PUNKTFUNK_BTN_DPAD_UP 1
|
||||
|
||||
@@ -390,16 +402,16 @@
|
||||
#define PUNKTFUNK_BTN_Y 32768
|
||||
|
||||
// Back grip R4 — SDL `RightPaddle1` / GameStream `PADDLE1`.
|
||||
#define BTN_PADDLE1 65536
|
||||
#define PUNKTFUNK_BTN_PADDLE1 65536
|
||||
|
||||
// Back grip L4 — SDL `LeftPaddle1` / GameStream `PADDLE2`.
|
||||
#define BTN_PADDLE2 131072
|
||||
#define PUNKTFUNK_BTN_PADDLE2 131072
|
||||
|
||||
// Back grip R5 — SDL `RightPaddle2` / GameStream `PADDLE3`.
|
||||
#define BTN_PADDLE3 262144
|
||||
#define PUNKTFUNK_BTN_PADDLE3 262144
|
||||
|
||||
// Back grip L5 — SDL `LeftPaddle2` / GameStream `PADDLE4`.
|
||||
#define BTN_PADDLE4 524288
|
||||
#define PUNKTFUNK_BTN_PADDLE4 524288
|
||||
|
||||
// DualSense touchpad click. Moonlight's extended-button position (`buttonFlags2`
|
||||
// merges in at `<< 16`, see `gamestream/gamepad.rs`), so GameStream clients land on
|
||||
@@ -407,7 +419,7 @@
|
||||
#define PUNKTFUNK_BTN_TOUCHPAD 1048576
|
||||
|
||||
// Misc / capture button — the Deck `…`/quick-access, Share/Capture / GameStream `MISC`.
|
||||
#define BTN_MISC1 2097152
|
||||
#define PUNKTFUNK_BTN_MISC1 2097152
|
||||
|
||||
// Axis ids for `InputKind::GamepadAxis`.
|
||||
#define PUNKTFUNK_AXIS_LS_X 0
|
||||
@@ -426,16 +438,16 @@
|
||||
// Identifies a punktfunk video packet (vs. an input datagram, see [`crate::input`]).
|
||||
#define PUNKTFUNK_MAGIC 201
|
||||
|
||||
#define FLAG_PIC 1
|
||||
#define PUNKTFUNK_FLAG_PIC 1
|
||||
|
||||
#define FLAG_EOF 2
|
||||
#define PUNKTFUNK_FLAG_EOF 2
|
||||
|
||||
#define FLAG_SOF 4
|
||||
#define PUNKTFUNK_FLAG_SOF 4
|
||||
|
||||
// Bandwidth-probe filler, not decodable video: a [`crate::quic::ProbeRequest`] speed test makes
|
||||
// the host burst access units carrying this flag so the client measures throughput/loss without
|
||||
// feeding them to the decoder. Punktfunk/1 only (GameStream never sets it).
|
||||
#define FLAG_PROBE 8
|
||||
#define PUNKTFUNK_FLAG_PROBE 8
|
||||
|
||||
// Application `user_flags` bit (the u32 [`PacketHeader::user_flags`] word, surfaced to the client
|
||||
// as [`crate::session::Frame::flags`]) — NOT a transport packet flag. Marks the access unit that
|
||||
@@ -444,7 +456,7 @@
|
||||
// post-loss display freeze on this bit as well as on a real keyframe — the only bitstream-invisible
|
||||
// clean point it can honor without forcing a full IDR. Lives above the low nibble because the host
|
||||
// reuses `FLAG_PIC`/`FLAG_SOF`/`FLAG_PROBE` bit values inside `user_flags`; `0x10` clears all four.
|
||||
#define USER_FLAG_RECOVERY_POINT 16
|
||||
#define PUNKTFUNK_USER_FLAG_RECOVERY_POINT 16
|
||||
|
||||
// Application `user_flags` bit — a **definitive single-frame clean re-anchor**. Unlike
|
||||
// [`USER_FLAG_RECOVERY_POINT`] (an intra-refresh wave boundary, where the first boundary after a loss
|
||||
@@ -454,7 +466,7 @@
|
||||
// already has, not an IDR. The picture is loss-free the instant this AU decodes, so the client lifts
|
||||
// its post-loss freeze on the **first** such mark. Coded `P` (no IDR), so the decoder never sets
|
||||
// `AV_FRAME_FLAG_KEY` — this host flag is the only signal.
|
||||
#define USER_FLAG_RECOVERY_ANCHOR 32
|
||||
#define PUNKTFUNK_USER_FLAG_RECOVERY_ANCHOR 32
|
||||
|
||||
// `user_flags` bit: the AU's content is **shard-aligned self-delimiting chunks** — every
|
||||
// `shard_payload`-sized window of the frame buffer starts a fresh codec packet, padded to the
|
||||
@@ -462,7 +474,7 @@
|
||||
// consequences: a receiver that opted into partial delivery can use an aged-out frame's buffer
|
||||
// AS-IS (missing shards stay zeroed; the codec's block walk skips zero windows), and even a
|
||||
// COMPLETE frame must be consumed window-by-window (the padding is not part of the stream).
|
||||
#define USER_FLAG_CHUNK_ALIGNED 64
|
||||
#define PUNKTFUNK_USER_FLAG_CHUNK_ALIGNED 64
|
||||
|
||||
// `user_flags` bit: this AU was packetized as a **slice-streamed** frame (the P2 slice
|
||||
// pipeline): its sentinel blocks (`block_count == 0`) are SLICE-granularity and carry their
|
||||
@@ -475,7 +487,7 @@
|
||||
// [`VIDEO_CAP_STREAMED_AU`](crate::quic::VIDEO_CAP_STREAMED_AU) ∧
|
||||
// [`VIDEO_CAP_MULTI_SLICE`](crate::quic::VIDEO_CAP_MULTI_SLICE) — the pair whose receivers
|
||||
// know this contract.
|
||||
#define USER_FLAG_SLICE_STREAM 128
|
||||
#define PUNKTFUNK_USER_FLAG_SLICE_STREAM 128
|
||||
|
||||
// Widest lost-frame range (frames, wrapping `last - first`) a reference-frame-invalidation
|
||||
// recovery may be asked to repair; anything wider goes straight to the keyframe path on BOTH
|
||||
@@ -484,7 +496,7 @@
|
||||
// reference anywhere, so an RFI request for it is either hopeless or (worse) a phantom range
|
||||
// from a desynced counter. Shared by the host's RFI dispatch (range → keyframe fallback) and the
|
||||
// client-side gap detectors (huge gap → resync + keyframe request, no RFI).
|
||||
#define RFI_MAX_RANGE 256
|
||||
#define PUNKTFUNK_RFI_MAX_RANGE 256
|
||||
|
||||
// Largest UDP datagram the core will send or accept. `Config::validate` bounds
|
||||
// `shard_payload` so `HEADER_LEN + shard_payload + CRYPTO_OVERHEAD ≤ MAX_DATAGRAM_BYTES`.
|
||||
@@ -498,22 +510,22 @@
|
||||
// for never having to resize buffers on a mid-session grow. Senders still derive their
|
||||
// shard payload from the path MTU (`config::mtu1500_shard_payload*`, the wire-MTU clamps);
|
||||
// this is the acceptance ceiling, not a transmit size.
|
||||
#define MAX_DATAGRAM_BYTES 9216
|
||||
#define PUNKTFUNK_MAX_DATAGRAM_BYTES 9216
|
||||
|
||||
// The slice-flush floor: a sentinel block below this many data shards costs disproportionate
|
||||
// per-block FEC parity (`ceil(k × pct/100)` ≥ 1 whatever `k`), so slice boundaries only flush
|
||||
// once this much has accumulated (~22 KB at the standard shard payload). Small slices simply
|
||||
// ride with the next one; the wire is never worse than one flush per slice.
|
||||
#define MIN_STREAM_BLOCK_SHARDS 16
|
||||
#define PUNKTFUNK_MIN_STREAM_BLOCK_SHARDS 16
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Hello::video_caps`] bit: the client can decode a 10-bit (Main10) HEVC stream.
|
||||
#define VIDEO_CAP_10BIT 1
|
||||
#define PUNKTFUNK_VIDEO_CAP_10BIT 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Hello::video_caps`] bit: the client can present BT.2020 PQ HDR10 (implies 10-bit).
|
||||
#define VIDEO_CAP_HDR 2
|
||||
#define PUNKTFUNK_VIDEO_CAP_HDR 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -525,7 +537,7 @@
|
||||
// 4:2:0 and [`Welcome::chroma_format`] reflects the real resolved value. Independent of
|
||||
// 10-bit/HDR (4:4:4 is a chroma decision, bit depth is a depth decision; the two may combine
|
||||
// where the hardware allows).
|
||||
#define VIDEO_CAP_444 4
|
||||
#define PUNKTFUNK_VIDEO_CAP_444 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -535,7 +547,7 @@
|
||||
// (design/stats-unification.md Phase 2). The host emits 0xCF ONLY when this bit is set (an older
|
||||
// host ignores it and simply never sends any); a client that doesn't set it keeps the combined
|
||||
// stage. Purely observability — never changes what the host encodes.
|
||||
#define VIDEO_CAP_HOST_TIMING 8
|
||||
#define PUNKTFUNK_VIDEO_CAP_HOST_TIMING 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -550,7 +562,7 @@
|
||||
// depends on. The host runs mid-session probe bursts ONLY against clients that set this bit — an
|
||||
// older client gets a declined (zeroed) [`ProbeResult`] instead of a measurement its single-window
|
||||
// reassembler would silently drop as stale.
|
||||
#define VIDEO_CAP_PROBE_SEQ 16
|
||||
#define PUNKTFUNK_VIDEO_CAP_PROBE_SEQ 16
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -565,7 +577,7 @@
|
||||
// — a mismatch drops the frame wholesale. The host streams ONLY to clients advertising this
|
||||
// bit; every other client gets today's whole-AU path (chunks concatenated before sealing), so
|
||||
// the fallback is zero-risk.
|
||||
#define VIDEO_CAP_STREAMED_AU 32
|
||||
#define PUNKTFUNK_VIDEO_CAP_STREAMED_AU 32
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -579,7 +591,7 @@
|
||||
// toward every other client the Welcome stays byte-identical AES-128-GCM. Purely a
|
||||
// performance choice — both AEADs are full-strength, and Hello/Welcome ride the pinned-TLS
|
||||
// control channel, so there is no downgrade surface.
|
||||
#define VIDEO_CAP_CHACHA20 64
|
||||
#define PUNKTFUNK_VIDEO_CAP_CHACHA20 64
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -595,7 +607,7 @@
|
||||
// bit (`PUNKTFUNK_NVENC_SLICES` stays the explicit operator override in both directions);
|
||||
// every other client gets single-slice frames — the pre-0.17 wire shape. NOTE: this takes the
|
||||
// video_caps byte's last free bit — the next video cap needs a second byte (ABI bump).
|
||||
#define VIDEO_CAP_MULTI_SLICE 128
|
||||
#define PUNKTFUNK_VIDEO_CAP_MULTI_SLICE 128
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -604,7 +616,7 @@
|
||||
// sequence number. A capable client then sends gamepad state as snapshots (idempotent on the
|
||||
// lossy datagram plane, periodically refreshed) instead of the fragile per-transition
|
||||
// button/axis events; toward a host that doesn't set the bit it keeps the legacy events.
|
||||
#define HOST_CAP_GAMEPAD_STATE 1
|
||||
#define PUNKTFUNK_HOST_CAP_GAMEPAD_STATE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -614,7 +626,7 @@
|
||||
// out. Purely additive: nothing clipboard-related happens until a [`ClipControl`]`{ enabled:
|
||||
// true }` crosses (see `design/clipboard-and-file-transfer.md` §3.1). Packs into the existing
|
||||
// trailing `host_caps` byte — no wire-layout change.
|
||||
#define HOST_CAP_CLIPBOARD 2
|
||||
#define PUNKTFUNK_HOST_CAP_CLIPBOARD 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -626,7 +638,7 @@
|
||||
// non-Latin scripts, emoji) through `TextInput` instead of lossy VK synthesis; absent the bit it
|
||||
// keeps the VK fallback. Packs into the existing trailing `host_caps` byte — no wire-layout
|
||||
// change; an older host ignores the unknown input tag anyway (input is lossy by design).
|
||||
#define HOST_CAP_TEXT_INPUT 4
|
||||
#define PUNKTFUNK_HOST_CAP_TEXT_INPUT 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -638,7 +650,7 @@
|
||||
// (`SessionPlan.cursor_blend = false`) or the user sees it twice. Active only when the host
|
||||
// answers with [`HOST_CAP_CURSOR`] (capable-and-agreed, the 444/clipboard precedent); toward
|
||||
// an older or incapable host nothing changes.
|
||||
#define CLIENT_CAP_CURSOR 1
|
||||
#define PUNKTFUNK_CLIENT_CAP_CURSOR 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -647,7 +659,7 @@
|
||||
// capture/send tick to the client's display latch (design/phase-locked-capture.md). Without
|
||||
// the bit the host never arms the phase controller; toward an older host the reports are
|
||||
// simply ignored — no behavior change in either direction.
|
||||
#define CLIENT_CAP_PHASE_LOCK 2
|
||||
#define PUNKTFUNK_CLIENT_CAP_PHASE_LOCK 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -660,7 +672,7 @@
|
||||
// cursor/clipboard precedent). Toward an older host, or a host that declines because the link is
|
||||
// clean, the client keeps receiving the plain `0xC9` plane — so a client may always set this bit.
|
||||
// `0x04` — `0x01`/`0x02` are cursor / phase-lock.
|
||||
#define CLIENT_CAP_AUDIO_RED 4
|
||||
#define PUNKTFUNK_CLIENT_CAP_AUDIO_RED 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -671,7 +683,7 @@
|
||||
// host stops blending and ships [`CursorShape`](super::control::CursorShape) +
|
||||
// [`CursorState`](super::datagram::CursorState) instead. `0x08` — `0x04` is
|
||||
// [`HOST_CAP_TEXT_INPUT`], `0x01`/`0x02` are gamepad-state / clipboard.
|
||||
#define HOST_CAP_CURSOR 8
|
||||
#define PUNKTFUNK_HOST_CAP_CURSOR 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -685,7 +697,7 @@
|
||||
// wire ships ahead of the backend (P0): no host sets this bit until the P1 injector lands —
|
||||
// which is exactly why the gate exists. `0x10` — `0x08` is [`HOST_CAP_CURSOR`], `0x04` is
|
||||
// [`HOST_CAP_TEXT_INPUT`], `0x01`/`0x02` are gamepad-state / clipboard.
|
||||
#define HOST_CAP_PEN 16
|
||||
#define PUNKTFUNK_HOST_CAP_PEN 16
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -699,25 +711,25 @@
|
||||
// loss-gated — a clean LAN shouldn't pay for it), which is why clients decode BOTH tags
|
||||
// unconditionally and treat this bit as "expect redundancy", not "only redundancy".
|
||||
// `0x20` — `0x10` is [`HOST_CAP_PEN`], `0x08` is [`HOST_CAP_CURSOR`].
|
||||
#define HOST_CAP_AUDIO_RED 32
|
||||
#define PUNKTFUNK_HOST_CAP_AUDIO_RED 32
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Hello::video_codecs`] bit: the client can decode H.264 / AVC. The GPU-less **software**
|
||||
// encode path (openh264) emits H.264, so a client that wants to stream from a software host MUST
|
||||
// advertise this.
|
||||
#define CODEC_H264 1
|
||||
#define PUNKTFUNK_CODEC_H264 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Hello::video_codecs`] bit: the client can decode H.265 / HEVC — the default every existing
|
||||
// build produces and decodes (a peer that omits [`Hello::video_codecs`] is treated as HEVC-only).
|
||||
#define CODEC_HEVC 2
|
||||
#define PUNKTFUNK_CODEC_HEVC 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Hello::video_codecs`] bit: the client can decode AV1.
|
||||
#define CODEC_AV1 4
|
||||
#define PUNKTFUNK_CODEC_AV1 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -731,18 +743,18 @@
|
||||
// (`crates/pyrowave-sys/vendor/pyrowave/PUNKTFUNK-VENDOR.txt`): upstream has no bitstream
|
||||
// version field, so a vendored bump that changes the bitstream bumps the punktfunk protocol
|
||||
// version instead (plan §4.2).
|
||||
#define CODEC_PYROWAVE 8
|
||||
#define PUNKTFUNK_CODEC_PYROWAVE 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// HEVC `chroma_format_idc` for 4:2:0 — what every pre-4:4:4 build produced and the back-compat
|
||||
// default when a peer omits [`Welcome::chroma_format`].
|
||||
#define CHROMA_IDC_420 1
|
||||
#define PUNKTFUNK_CHROMA_IDC_420 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// HEVC `chroma_format_idc` for full-chroma 4:4:4 (Range Extensions).
|
||||
#define CHROMA_IDC_444 3
|
||||
#define PUNKTFUNK_CHROMA_IDC_444 3
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -793,195 +805,195 @@
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`Reconfigure`] (first byte after the magic).
|
||||
#define MSG_RECONFIGURE 1
|
||||
#define PUNKTFUNK_MSG_RECONFIGURE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`Reconfigured`].
|
||||
#define MSG_RECONFIGURED 2
|
||||
#define PUNKTFUNK_MSG_RECONFIGURED 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`RequestKeyframe`].
|
||||
#define MSG_REQUEST_KEYFRAME 3
|
||||
#define PUNKTFUNK_MSG_REQUEST_KEYFRAME 3
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`LossReport`].
|
||||
#define MSG_LOSS_REPORT 4
|
||||
#define PUNKTFUNK_MSG_LOSS_REPORT 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`SetBitrate`].
|
||||
#define MSG_SET_BITRATE 5
|
||||
#define PUNKTFUNK_MSG_SET_BITRATE 5
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`BitrateChanged`].
|
||||
#define MSG_BITRATE_CHANGED 6
|
||||
#define PUNKTFUNK_MSG_BITRATE_CHANGED 6
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`RfiRequest`].
|
||||
#define MSG_RFI_REQUEST 7
|
||||
#define PUNKTFUNK_MSG_RFI_REQUEST 7
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ShardPayloadChanged`].
|
||||
#define MSG_SHARD_PAYLOAD_CHANGED 8
|
||||
#define PUNKTFUNK_MSG_SHARD_PAYLOAD_CHANGED 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ShardPayloadAck`].
|
||||
#define MSG_SHARD_PAYLOAD_ACK 9
|
||||
#define PUNKTFUNK_MSG_SHARD_PAYLOAD_ACK 9
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ProbeRequest`].
|
||||
#define MSG_PROBE_REQUEST 32
|
||||
#define PUNKTFUNK_MSG_PROBE_REQUEST 32
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ProbeResult`].
|
||||
#define MSG_PROBE_RESULT 33
|
||||
#define PUNKTFUNK_MSG_PROBE_RESULT 33
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClockProbe`].
|
||||
#define MSG_CLOCK_PROBE 48
|
||||
#define PUNKTFUNK_MSG_CLOCK_PROBE 48
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClockEcho`].
|
||||
#define MSG_CLOCK_ECHO 49
|
||||
#define PUNKTFUNK_MSG_CLOCK_ECHO 49
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`PhaseReport`].
|
||||
#define MSG_PHASE_REPORT 50
|
||||
#define PUNKTFUNK_MSG_PHASE_REPORT 50
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClipControl`] (client → host): enable/disable the shared clipboard for this
|
||||
// session. Idempotent; opt-in is enforced here, not just in UI.
|
||||
#define MSG_CLIP_CONTROL 64
|
||||
#define PUNKTFUNK_MSG_CLIP_CONTROL 64
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClipState`] (host → client): ack + unsolicited policy/backend updates.
|
||||
#define MSG_CLIP_STATE 65
|
||||
#define PUNKTFUNK_MSG_CLIP_STATE 65
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClipOffer`] (symmetric): the lazy announcement — format list only, no bytes.
|
||||
#define MSG_CLIP_OFFER 66
|
||||
#define PUNKTFUNK_MSG_CLIP_OFFER 66
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClipFetch`] (requester → holder, **fetch stream only**): pull one format of the
|
||||
// current offer.
|
||||
#define MSG_CLIP_FETCH 67
|
||||
#define PUNKTFUNK_MSG_CLIP_FETCH 67
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`ClipFetchHdr`] (holder → requester, **fetch stream only**): the fetch response
|
||||
// header that precedes the data chunks.
|
||||
#define MSG_CLIP_FETCH_HDR 68
|
||||
#define PUNKTFUNK_MSG_CLIP_FETCH_HDR 68
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipControl::flags`] bit: the client permits file kinds to be offered/fetched this session.
|
||||
// Absent ⇒ files are filtered out of offers in both directions (text/rich/image only).
|
||||
#define CLIP_FLAG_FILES 1
|
||||
#define PUNKTFUNK_CLIP_FLAG_FILES 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::policy`] bit: the host permits non-file formats (text/RTF/HTML/image). Always set
|
||||
// while enabled unless a future direction limit clears it.
|
||||
#define CLIP_POLICY_TEXT 1
|
||||
#define PUNKTFUNK_CLIP_POLICY_TEXT 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::policy`] bit: the host permits file formats. Cleared by the operator `no-files`
|
||||
// / `text-only` policy so the client can grey out "Include files".
|
||||
#define CLIP_POLICY_FILES 2
|
||||
#define PUNKTFUNK_CLIP_POLICY_FILES 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::reason`]: normal ack, nothing exceptional.
|
||||
#define CLIP_REASON_OK 0
|
||||
#define PUNKTFUNK_CLIP_REASON_OK 0
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::reason`]: this session type has no working clipboard backend (e.g. a gamescope
|
||||
// session with no data-control global) — the client shows "not supported in this session type".
|
||||
#define CLIP_REASON_BACKEND_UNAVAILABLE 1
|
||||
#define PUNKTFUNK_CLIP_REASON_BACKEND_UNAVAILABLE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::reason`]: another client took over the single per-desktop clipboard binding; this
|
||||
// one was disabled (last `ClipControl{enabled}` wins).
|
||||
#define CLIP_REASON_TAKEN_OVER 2
|
||||
#define PUNKTFUNK_CLIP_REASON_TAKEN_OVER 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::reason`]: the host operator policy (`PUNKTFUNK_CLIPBOARD=off`) disables clipboard.
|
||||
#define CLIP_REASON_POLICY_DISABLED 3
|
||||
#define PUNKTFUNK_CLIP_REASON_POLICY_DISABLED 3
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipState::reason`]: enabled, but the host policy forbids file transfer (`no-files` /
|
||||
// `text-only`) — surfaced so the client greys "Include files" with a footnote.
|
||||
#define CLIP_REASON_NO_FILES 4
|
||||
#define PUNKTFUNK_CLIP_REASON_NO_FILES 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipFetchHdr::status`]: the requested format is being served; data chunks follow until FIN.
|
||||
#define CLIP_FETCH_OK 0
|
||||
#define PUNKTFUNK_CLIP_FETCH_OK 0
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipFetchHdr::status`]: the fetch named a `seq` that is no longer the holder's current offer;
|
||||
// the requester degrades the paste to "nothing inserted" rather than wrong data. No chunks follow.
|
||||
#define CLIP_FETCH_STALE 1
|
||||
#define PUNKTFUNK_CLIP_FETCH_STALE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipFetchHdr::status`]: the format/index is not available (no backend, or it vanished). No
|
||||
// chunks follow.
|
||||
#define CLIP_FETCH_UNAVAILABLE 2
|
||||
#define PUNKTFUNK_CLIP_FETCH_UNAVAILABLE 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipFetchHdr::status`]: policy/cap denies this fetch (e.g. a file fetch under `no-files`). No
|
||||
// chunks follow.
|
||||
#define CLIP_FETCH_DENIED 3
|
||||
#define PUNKTFUNK_CLIP_FETCH_DENIED 3
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Maximum number of [`ClipKind`] entries in one [`ClipOffer`] (resource cap, §7).
|
||||
#define CLIP_MAX_KINDS 16
|
||||
#define PUNKTFUNK_CLIP_MAX_KINDS 16
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Maximum length in bytes of a [`ClipKind::mime`] string (resource cap, §7).
|
||||
#define CLIP_MAX_MIME 128
|
||||
#define PUNKTFUNK_CLIP_MAX_MIME 128
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`ClipFetch::file_index`] sentinel meaning "not a file fetch" (a whole non-file format, or the
|
||||
// file *manifest* itself). Real file fetches use `0..n`.
|
||||
#define CLIP_FILE_INDEX_NONE UINT32_MAX
|
||||
#define PUNKTFUNK_CLIP_FILE_INDEX_NONE UINT32_MAX
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`CursorShape`] (host → client): the pointer's bitmap + hotspot changed.
|
||||
#define MSG_CURSOR_SHAPE 80
|
||||
#define PUNKTFUNK_MSG_CURSOR_SHAPE 80
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`CursorRenderMode`] (client → host): who renders the pointer right now.
|
||||
#define MSG_CURSOR_RENDER 81
|
||||
#define PUNKTFUNK_MSG_CURSOR_RENDER 81
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -990,7 +1002,7 @@
|
||||
// overshoots before the 17-byte header. 120² (57.6 KiB + header) fits with headroom and covers
|
||||
// real cursors (typically ≤ 64 px, ≤ 96 px at HiDPI scale); the HOST downscales anything
|
||||
// larger before forwarding, so the cap is invisible to clients.
|
||||
#define CURSOR_SHAPE_MAX_SIDE 120
|
||||
#define PUNKTFUNK_CURSOR_SHAPE_MAX_SIDE 120
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1010,21 +1022,21 @@
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Microphone uplink: the client's mic, Opus-encoded, client → host (the inverse of
|
||||
// [`AUDIO_MAGIC`]). The host feeds it into a virtual PipeWire source so its apps can record it.
|
||||
#define MIC_MAGIC 203
|
||||
#define PUNKTFUNK_MIC_MAGIC 203
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Rich client→host input: events too big for the fixed 18-byte [`InputEvent`]
|
||||
// (crate::input::InputEvent) — the DualSense touchpad and motion sensors. Variable-length,
|
||||
// kind-tagged (see [`RichInput`]).
|
||||
#define RICH_INPUT_MAGIC 204
|
||||
#define PUNKTFUNK_RICH_INPUT_MAGIC 204
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// HID output, host → client: DualSense feedback a game wrote to the host's virtual controller
|
||||
// (lightbar, player LEDs, adaptive triggers) — the rich analog of [`RUMBLE_MAGIC`]. See
|
||||
// [`HidOutput`].
|
||||
#define HIDOUT_MAGIC 205
|
||||
#define PUNKTFUNK_HIDOUT_MAGIC 205
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1064,7 +1076,7 @@
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Wire length of a v1 (legacy, level) rumble datagram.
|
||||
#define RUMBLE_V1_LEN 7
|
||||
#define PUNKTFUNK_RUMBLE_V1_LEN 7
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1072,48 +1084,60 @@
|
||||
// tail. Decoders are length-tolerant (see [`decode_rumble_envelope`]): an old client reads the
|
||||
// first 7 bytes as a plain level and ignores the tail, so no wire-version bump is needed — the
|
||||
// same dual-size idiom the HDR-luminance `AddRequest` tail uses.
|
||||
#define RUMBLE_V2_LEN 10
|
||||
#define PUNKTFUNK_RUMBLE_V2_LEN 10
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Longest raw HID report a [`RichInput::HidReport`] / [`HidOutput::HidRaw`] can carry — the
|
||||
// 64-byte interrupt/feature report size every Valve controller uses (Triton input reports are
|
||||
// 46–54 bytes; feature and output reports are at most 64).
|
||||
#define HID_REPORT_MAX 64
|
||||
#define PUNKTFUNK_HID_REPORT_MAX 64
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Longest [`HidOutput::Trigger`] `effect` the wire carries: the DualSense adaptive-trigger
|
||||
// parameter block is a mode byte plus ten parameters, and every consumer copies at most this many
|
||||
// into its report.
|
||||
//
|
||||
// The single source for the clamp on BOTH sides. `Trigger` was the only variable-length variant
|
||||
// bounded on neither: encode appended whatever it was handed and decode took the entire tail, so
|
||||
// an attacker-sized datagram was reproduced verbatim into a `Vec` while its sibling `HidRaw` had
|
||||
// been bounded on both ends all along.
|
||||
#define PUNKTFUNK_TRIGGER_EFFECT_MAX 11
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`HidOutput::HidRaw`] `kind`: an OUTPUT report — what the host's hidraw client wrote with
|
||||
// `write()`/`SDL_hid_write` (Triton rumble `0x80`, haptic pulse `0x81`, …). The client replays
|
||||
// it on the physical device's interrupt-OUT endpoint / GATT write.
|
||||
#define HID_RAW_OUTPUT 0
|
||||
#define PUNKTFUNK_HID_RAW_OUTPUT 0
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`HidOutput::HidRaw`] `kind`: a FEATURE report — what the host's hidraw client sent with
|
||||
// `SET_REPORT` (`SDL_hid_send_feature_report`: lizard mode, IMU enable, settings). The client
|
||||
// replays it as a USB `SET_REPORT(Feature)` control transfer / GATT feature write.
|
||||
#define HID_RAW_FEATURE 1
|
||||
#define PUNKTFUNK_HID_RAW_FEATURE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// HDR static-metadata datagram tag, host → client (the static analog of the per-frame VUI;
|
||||
// see [`HdrMeta`]). Next tag after [`HIDOUT_MAGIC`].
|
||||
#define HDR_META_MAGIC 206
|
||||
#define PUNKTFUNK_HDR_META_MAGIC 206
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Wire length of an [`HdrMeta`] body (no tag byte): 6×u16 primaries + 2×u16 white + 2×u32
|
||||
// luminance + 2×u16 CLL/FALL = 28 bytes. Shared by the [`HDR_META_MAGIC`] datagram (which
|
||||
// prefixes the tag) and the `Hello::display_hdr` trailing field (which carries the bare body).
|
||||
#define HDR_META_BODY_LEN (((12 + 4) + 8) + 4)
|
||||
#define PUNKTFUNK_HDR_META_BODY_LEN (((12 + 4) + 8) + 4)
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Per-AU host-timing datagram tag, host → client (see [`HostTiming`]). Next tag after
|
||||
// [`HDR_META_MAGIC`]. Emitted once per access unit, right after its last packet left the host's
|
||||
// socket, and only when the client advertised [`VIDEO_CAP_HOST_TIMING`].
|
||||
#define HOST_TIMING_MAGIC 207
|
||||
#define PUNKTFUNK_HOST_TIMING_MAGIC 207
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1124,18 +1148,18 @@
|
||||
// self-healing under loss (latest-wins, no refresh timer). The bitmap itself rides the
|
||||
// reliable control stream ([`CursorShape`](super::control::CursorShape)); this 14-byte
|
||||
// datagram only moves/hides the pointer.
|
||||
#define CURSOR_STATE_MAGIC 208
|
||||
#define PUNKTFUNK_CURSOR_STATE_MAGIC 208
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`CursorState::flags`] bit: the host cursor is visible.
|
||||
#define CURSOR_VISIBLE 1
|
||||
#define PUNKTFUNK_CURSOR_VISIBLE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`CursorState::flags`] bit: a host app captured/hid the pointer — the client SHOULD run
|
||||
// relative/captured (M3 auto-flip; advisory, user override always wins).
|
||||
#define CURSOR_RELATIVE_HINT 2
|
||||
#define PUNKTFUNK_CURSOR_RELATIVE_HINT 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1144,7 +1168,7 @@
|
||||
// `ApplicationClosed` reason and tears the session's virtual display down immediately, skipping the
|
||||
// keep-alive linger; any other close reason (idle timeout, reset, a bare code 0) still lingers so a
|
||||
// reconnect can resume. Shared so host + every client agree on the code.
|
||||
#define QUIT_CLOSE_CODE 81
|
||||
#define PUNKTFUNK_QUIT_CLOSE_CODE 81
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1154,107 +1178,107 @@
|
||||
// surfacing a failure (`design/gamemode-and-dedicated-sessions.md` §5.3). Sibling of
|
||||
// [`QUIT_CLOSE_CODE`]; a client that doesn't special-case it still ends the session (every client
|
||||
// returns to its launcher on session end), so it is purely refinement. Shared so host + clients agree.
|
||||
#define APP_EXITED_CLOSE_CODE 82
|
||||
#define PUNKTFUNK_APP_EXITED_CLOSE_CODE 82
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Longest device name carried in a [`Hello`] (bytes of UTF-8; longer names are truncated on
|
||||
// encode, rejected on decode — a one-byte length prefix caps it at 255 anyway).
|
||||
#define HELLO_NAME_MAX 64
|
||||
#define PUNKTFUNK_HELLO_NAME_MAX 64
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Longest library id carried in a [`Hello::launch`] (bytes of UTF-8). Ids are short
|
||||
// (`steam:<appid>` / `custom:<12 hex>`); the cap just bounds an attacker-controlled field.
|
||||
#define HELLO_LAUNCH_MAX 128
|
||||
#define PUNKTFUNK_HELLO_LAUNCH_MAX 128
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Welcome::cipher`] id: AES-128-GCM — the default session AEAD every peer speaks (and the
|
||||
// only one pre-cipher builds know).
|
||||
#define CIPHER_AES_128_GCM 0
|
||||
#define PUNKTFUNK_CIPHER_AES_128_GCM 0
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`Welcome::cipher`] id: ChaCha20-Poly1305 (RFC 8439) — negotiated via
|
||||
// [`VIDEO_CAP_CHACHA20`] for clients without hardware AES.
|
||||
#define CIPHER_CHACHA20_POLY1305 1
|
||||
#define PUNKTFUNK_CIPHER_CHACHA20_POLY1305 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`PairRequest`].
|
||||
#define MSG_PAIR_REQUEST 16
|
||||
#define PUNKTFUNK_MSG_PAIR_REQUEST 16
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`PairChallenge`].
|
||||
#define MSG_PAIR_CHALLENGE 17
|
||||
#define PUNKTFUNK_MSG_PAIR_CHALLENGE 17
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`PairProof`].
|
||||
#define MSG_PAIR_PROOF 18
|
||||
#define PUNKTFUNK_MSG_PAIR_PROOF 18
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Type byte of [`PairResult`].
|
||||
#define MSG_PAIR_RESULT 19
|
||||
#define PUNKTFUNK_MSG_PAIR_RESULT 19
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::state`] bit: the pen is in the hover range of the surface. Implied by
|
||||
// [`PEN_TOUCHING`] (decode normalizes, so a client that only sets TOUCHING still produces a
|
||||
// coherent contact).
|
||||
#define PEN_IN_RANGE 1
|
||||
#define PUNKTFUNK_PEN_IN_RANGE 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::state`] bit: the tip is in contact with the surface.
|
||||
#define PEN_TOUCHING 2
|
||||
#define PUNKTFUNK_PEN_TOUCHING 2
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::state`] bit: the primary barrel button (or the client's squeeze mapping) is held.
|
||||
#define PEN_BARREL1 4
|
||||
#define PUNKTFUNK_PEN_BARREL1 4
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::state`] bit: the secondary barrel button (or the client's double-tap mapping)
|
||||
// is held.
|
||||
#define PEN_BARREL2 8
|
||||
#define PUNKTFUNK_PEN_BARREL2 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::state`] bit, RESERVED: a predicted (not yet observed) sample. Never sent v1;
|
||||
// receivers MUST ignore samples carrying it until a capability negotiates otherwise
|
||||
// (design/pen-tablet-input.md §8).
|
||||
#define PEN_PREDICTED 128
|
||||
#define PUNKTFUNK_PEN_PREDICTED 128
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::tilt_deg`] sentinel: the client has no tilt sensor / no reading.
|
||||
#define PEN_TILT_UNKNOWN 255
|
||||
#define PUNKTFUNK_PEN_TILT_UNKNOWN 255
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::azimuth_deg`] / [`PenSample::roll_deg`] sentinel: no reading.
|
||||
#define PEN_ANGLE_UNKNOWN 65535
|
||||
#define PUNKTFUNK_PEN_ANGLE_UNKNOWN 65535
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// [`PenSample::distance`] sentinel: no hover-distance reading.
|
||||
#define PEN_DISTANCE_UNKNOWN 65535
|
||||
#define PUNKTFUNK_PEN_DISTANCE_UNKNOWN 65535
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Most samples one [`PenBatch`] can carry. Sized for coalesced capture at video-frame cadence
|
||||
// (240 Hz pen ÷ 30 fps = 8); a client producing more splits into consecutive batches.
|
||||
#define PEN_BATCH_MAX 8
|
||||
#define PUNKTFUNK_PEN_BATCH_MAX 8
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Wire length of one encoded [`PenSample`].
|
||||
#define PEN_SAMPLE_WIRE_LEN 21
|
||||
#define PUNKTFUNK_PEN_SAMPLE_WIRE_LEN 21
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1265,13 +1289,13 @@
|
||||
// pen is naturally silent — senders MUST repeat the last sample at least every ~100 ms while
|
||||
// the pen is in range or touching (it re-decodes as pure Motion, harmless), keeping a live
|
||||
// stationary stroke two heartbeats clear of the deadline.
|
||||
#define PEN_TOUCH_TIMEOUT_MS 200
|
||||
#define PUNKTFUNK_PEN_TOUCH_TIMEOUT_MS 200
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Stream-kind byte: a clipboard fetch (request/response of one format). Future stream kinds
|
||||
// (e.g. a bulk file-content push) mux under the same [`STREAM_MAGIC`] with a different byte.
|
||||
#define CLIP_STREAM_KIND_FETCH 1
|
||||
#define PUNKTFUNK_CLIP_STREAM_KIND_FETCH 1
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
@@ -1281,18 +1305,18 @@
|
||||
// `0x52`), the connection reject code `0x42`, and the pairing-rejection close block
|
||||
// `0x60`–`0x67` — stream reset codes and connection close codes are separate QUIC namespaces,
|
||||
// but the vocabularies stay disjoint on purpose so a captured code is unambiguous.
|
||||
#define CLIP_CANCELLED_CODE 112
|
||||
#define PUNKTFUNK_CLIP_CANCELLED_CODE 112
|
||||
#endif
|
||||
|
||||
#if defined(PUNKTFUNK_FEATURE_QUIC)
|
||||
// Chunk size for streaming fetch data (64 KiB writes — matches the control-frame bound).
|
||||
#define CLIP_CHUNK (64 * 1024)
|
||||
#define PUNKTFUNK_CLIP_CHUNK (64 * 1024)
|
||||
#endif
|
||||
|
||||
// Consecutive no-output AUs that force a keyframe request. ~50 ms at 60 Hz — long enough not to fire
|
||||
// on a one-frame decoder hiccup, short enough that a lost initial IDR (or a mid-GOP join) unfreezes
|
||||
// almost immediately instead of never.
|
||||
#define NO_OUTPUT_KEYFRAME_STREAK 3
|
||||
#define PUNKTFUNK_NO_OUTPUT_KEYFRAME_STREAK 3
|
||||
|
||||
// How many host intra-refresh recovery marks ([`USER_FLAG_RECOVERY_POINT`]) must arrive since the
|
||||
// latest loss before the gate lifts its freeze on an IDR-free stream. TWO, not one: with a continuous
|
||||
@@ -1304,12 +1328,12 @@
|
||||
// deliberate "hold longer, never show garbage" trade.
|
||||
//
|
||||
// [`USER_FLAG_RECOVERY_POINT`]: crate::packet::USER_FLAG_RECOVERY_POINT
|
||||
#define REANCHOR_MARKS_TO_LIFT 2
|
||||
#define PUNKTFUNK_REANCHOR_MARKS_TO_LIFT 2
|
||||
|
||||
// QUIC application error code the host closes with on a `mode_conflict = reject` admission
|
||||
// refusal, carrying the human-readable busy reason (live mode + client label). A distinct code
|
||||
// lets a client tell "host busy" apart from a transport failure. Shared so clients can render it.
|
||||
#define REJECT_BUSY_CLOSE_CODE 66
|
||||
#define PUNKTFUNK_REJECT_BUSY_CLOSE_CODE 66
|
||||
|
||||
// QUIC application close codes the host sends on **pairing-gate rejections**, so a client can
|
||||
// tell the user WHY it was turned away instead of collapsing every close into a generic
|
||||
@@ -1318,44 +1342,44 @@
|
||||
// their own 0x60 block, disjoint from [`REJECT_BUSY_CLOSE_CODE`] (0x42) and the deliberate-end
|
||||
// codes (0x51/0x52). Purely additive: an older client treats them as a bare close (exactly the
|
||||
// pre-code behavior), an older host never sends them. Decode with [`RejectReason::from_close_code`].
|
||||
#define PAIR_NOT_ARMED_CLOSE_CODE 96
|
||||
#define PUNKTFUNK_PAIR_NOT_ARMED_CLOSE_CODE 96
|
||||
|
||||
// Pairing window armed, but bound to a DIFFERENT device fingerprint (the attempt does not
|
||||
// consume the window). See [`PAIR_NOT_ARMED_CLOSE_CODE`] for the block's contract.
|
||||
#define PAIR_BOUND_OTHER_CLOSE_CODE 97
|
||||
#define PUNKTFUNK_PAIR_BOUND_OTHER_CLOSE_CODE 97
|
||||
|
||||
// PIN attempt inside the host's global pairing cooldown — retry shortly.
|
||||
#define PAIR_RATE_LIMITED_CLOSE_CODE 98
|
||||
#define PUNKTFUNK_PAIR_RATE_LIMITED_CLOSE_CODE 98
|
||||
|
||||
// Unpaired client presented no certificate: nothing to approve, and the SPAKE2 ceremony needs an
|
||||
// identity to bind — the PIN flow with a client identity is the way in.
|
||||
#define PAIR_NO_IDENTITY_CLOSE_CODE 99
|
||||
#define PUNKTFUNK_PAIR_NO_IDENTITY_CLOSE_CODE 99
|
||||
|
||||
// The operator explicitly denied this pairing request in the host console.
|
||||
#define PAIR_DENIED_CLOSE_CODE 100
|
||||
#define PUNKTFUNK_PAIR_DENIED_CLOSE_CODE 100
|
||||
|
||||
// Nobody decided on the parked pairing request before the host's approval wait elapsed.
|
||||
#define PAIR_APPROVAL_TIMEOUT_CLOSE_CODE 101
|
||||
#define PUNKTFUNK_PAIR_APPROVAL_TIMEOUT_CLOSE_CODE 101
|
||||
|
||||
// This parked knock was superseded by a newer connection from the same device — only the
|
||||
// newest is admitted on approval.
|
||||
#define PAIR_SUPERSEDED_CLOSE_CODE 102
|
||||
#define PUNKTFUNK_PAIR_SUPERSEDED_CLOSE_CODE 102
|
||||
|
||||
// The client's wire (protocol) version does not match the host's — one side needs updating.
|
||||
#define WIRE_VERSION_CLOSE_CODE 103
|
||||
#define PUNKTFUNK_WIRE_VERSION_CLOSE_CODE 103
|
||||
|
||||
// The host admitted the connection but could not stand the stream session up (compositor /
|
||||
// capture / encoder setup failed host-side). The close reason bytes carry the specific error
|
||||
// text for logs/diagnostics; clients render a stable "host-side failure" sentence. Before this
|
||||
// code, a setup failure reached the client as a bare dropped connection ("control stream
|
||||
// finished mid-frame") — indistinguishable from transport trouble.
|
||||
#define SETUP_FAILED_CLOSE_CODE 104
|
||||
#define PUNKTFUNK_SETUP_FAILED_CLOSE_CODE 104
|
||||
|
||||
// Minimum supported multiplier (renders under native, upscaled on present).
|
||||
#define MIN_SCALE 0.5
|
||||
#define PUNKTFUNK_MIN_SCALE 0.5
|
||||
|
||||
// Maximum supported multiplier (supersamples, clamped to the codec ceiling per axis).
|
||||
#define MAX_SCALE 4.0
|
||||
#define PUNKTFUNK_MAX_SCALE 4.0
|
||||
|
||||
// Stable C ABI status codes. `Ok` is 0; all errors are negative so callers can
|
||||
// test `rc < 0`. Do not renumber existing variants — only append.
|
||||
@@ -1901,7 +1925,7 @@ typedef struct {
|
||||
|
||||
// The multipliers a picker offers. `1.0` (Native) is the default; the rest are the round stops
|
||||
// users reason about. Shared so every client's list stays identical.
|
||||
#define PRESETS { 0.5, 0.67, 0.75, 1.0, 1.25, 1.5, 2.0, 3.0, 4.0, }
|
||||
#define PUNKTFUNK_PRESETS { 0.5, 0.67, 0.75, 1.0, 1.25, 1.5, 2.0, 3.0, 4.0, }
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
|
||||
Reference in New Issue
Block a user