backend: add user management system with SQLite database

Add authentication and authorization infrastructure: - SQLite database (db.rs) with users, sessions, and app permissions tables - Password hashing with argon2 - Session-based auth with random 256-bit tokens - Auth middleware (session validation) and admin middleware - Login/logout/me endpoints - Admin CRUD endpoints for user and permission management - Auto-seed default admin user on first run - 23 unit tests covering all DB operations Existing API endpoints are not yet gated behind auth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
backend and frontend: support out of order chunks + now it's performant on chrome
2026-04-16 02:34:02 +00:00 · 2025-08-12 02:20:46 -06:00 · 2025-08-10 21:02:03 -06:00 · 2025-08-10 02:53:16 -06:00 · 2025-08-10 01:29:56 -06:00 · 2025-08-10 01:24:39 -06:00
86 changed files with 11270 additions and 336 deletions
@@ -93,6 +93,18 @@ version = "1.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"

+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures",
+ "password-hash",
+]
+
 [[package]]
 name = "arrayvec"
 version = "0.7.6"
@@ -143,6 +155,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bindgen"
 version = "0.72.0"
@@ -181,6 +199,15 @@ dependencies = [
 "wyz",
 ]

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
@@ -424,6 +451,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
 dependencies = [
 "powerfmt",
+ "serde",
 ]

 [[package]]
@@ -520,18 +548,56 @@ dependencies = [
 "windows-sys 0.59.0",
 ]

+[[package]]
+name = "etag"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b3d0661a2ccddc26cba0b834e9b717959ed6fdd76c7129ee159c170a875bf44"
+dependencies = [
+ "str-buf",
+ "xxhash-rust",
+]
+
+[[package]]
+name = "fallible-iterator"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2acce4a10f12dc2fb14a218589d4f1f62ef011b2d0cc4b3cb1bba8e94da14649"
+
+[[package]]
+name = "fallible-streaming-iterator"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
+
 [[package]]
 name = "fastrand"
 version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"

+[[package]]
+name = "flatbuffers"
+version = "25.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1045398c1bfd89168b5fd3f1fc11f6e70b34f6f66300c87d44d3de849463abf1"
+dependencies = [
+ "bitflags",
+ "rustc_version",
+]
+
 [[package]]
 name = "fnv"
 version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"

+[[package]]
+name = "foldhash"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
@@ -562,6 +628,21 @@ version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"

+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-channel"
 version = "0.3.31"
@@ -569,6 +650,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
 dependencies = [
 "futures-core",
+ "futures-sink",
 ]

 [[package]]
@@ -577,6 +659,17 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"

+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.31"
@@ -612,6 +705,7 @@ version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
 dependencies = [
+ "futures-channel",
 "futures-core",
 "futures-io",
 "futures-macro",
@@ -628,18 +722,29 @@ name = "gamestream-webtransport-proxy"
 version = "0.1.0"
 dependencies = [
 "anyhow",
+ "argon2",
 "directories",
+ "flatbuffers",
 "getrandom 0.3.3",
+ "h3-datagram",
+ "h3-quinn",
 "hex",
+ "hmac-sha256",
+ "http",
 "libc",
 "moonlight-common-c-sys",
 "openssl",
 "rand 0.9.1",
 "reqwest",
+ "rusqlite",
 "salvo",
 "serde",
 "serde-xml-rs",
+ "serde_json",
 "tokio",
+ "tracing",
+ "tracing-subscriber",
+ "url",
 "url-constructor",
 "uuid",
 ]
@@ -722,6 +827,46 @@ dependencies = [
 "tracing",
 ]

+[[package]]
+name = "h3"
+version = "0.0.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10872b55cfb02a821b69dc7cf8dc6a71d6af25eb9a79662bec4a9d016056b3be"
+dependencies = [
+ "bytes",
+ "fastrand",
+ "futures-util",
+ "http",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "h3-datagram"
+version = "0.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d2c9f77921668673721ae40f17c729fc48b9e38a663858097cea547484fdf0f"
+dependencies = [
+ "bytes",
+ "h3",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "h3-quinn"
+version = "0.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2e732c8d91a74731663ac8479ab505042fbf547b9a207213ab7fbcbfc4f8b4"
+dependencies = [
+ "bytes",
+ "futures",
+ "h3",
+ "h3-datagram",
+ "quinn",
+ "tokio",
+ "tokio-util",
+]
+
 [[package]]
 name = "hashbrown"
 version = "0.12.3"
@@ -736,6 +881,18 @@ name = "hashbrown"
 version = "0.15.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5971ac85611da7067dbfcabef3c70ebb5606018acd9e2a3903a0da507521e0d5"
+dependencies = [
+ "foldhash",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7382cf6263419f2d8df38c55d7da83da5c18aef87fc7a7fc1fb1e344edfe14c1"
+dependencies = [
+ "hashbrown 0.15.4",
+]

 [[package]]
 name = "headers"
@@ -776,6 +933,12 @@ dependencies = [
 "digest",
 ]

+[[package]]
+name = "hmac-sha256"
+version = "1.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad6880c8d4a9ebf39c6e8b77007ce223f646a4d21ce29d99f70cb16420545425"
+
 [[package]]
 name = "http"
 version = "1.3.1"
@@ -862,6 +1025,22 @@ dependencies = [
 "webpki-roots",
 ]

+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.14"
@@ -1104,6 +1283,12 @@ dependencies = [
 "simple_asn1",
 ]

+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
 [[package]]
 name = "libc"
 version = "0.2.174"
@@ -1130,6 +1315,17 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "libsqlite3-sys"
+version = "0.32.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbb8270bb4060bd76c6e96f20c52d80620f1d82a3470885694e41e0f81ef6fe7"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.9.4"
@@ -1240,6 +1436,23 @@ dependencies = [
 "serde",
 ]

+[[package]]
+name = "native-tls"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework 2.11.1",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "nix"
 version = "0.30.1"
@@ -1262,6 +1475,16 @@ dependencies = [
 "minimal-lexical",
 ]

+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -1367,6 +1590,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"

+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.3"
@@ -1390,6 +1619,23 @@ dependencies = [
 "windows-targets 0.52.6",
 ]

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "path-slash"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e91099d4268b0e11973f036e885d652fb0b21fedcf69738c627f94db6a44f42"
+
 [[package]]
 name = "pem"
 version = "3.0.5"
@@ -1549,6 +1795,7 @@ checksum = "c3bd15a6f2967aef83887dcb9fec0014580467e33720d073560cf015a5683012"
 dependencies = [
 "bytes",
 "cfg_aliases",
+ "futures-io",
 "pin-project-lite",
 "quinn-proto",
 "quinn-udp",
@@ -1750,10 +1997,12 @@ dependencies = [
 "http-body-util",
 "hyper",
 "hyper-rustls",
+ "hyper-tls",
 "hyper-util",
 "js-sys",
 "log",
 "mime",
+ "native-tls",
 "percent-encoding",
 "pin-project-lite",
 "quinn",
@@ -1764,6 +2013,7 @@ dependencies = [
 "serde_urlencoded",
 "sync_wrapper",
 "tokio",
+ "tokio-native-tls",
 "tokio-rustls",
 "tokio-util",
 "tower",
@@ -1820,6 +2070,20 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "rusqlite"
+version = "0.34.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37e34486da88d8e051c7c0e23c3f15fd806ea8546260aa2fec247e97242ec143"
+dependencies = [
+ "bitflags",
+ "fallible-iterator",
+ "fallible-streaming-iterator",
+ "hashlink",
+ "libsqlite3-sys",
+ "smallvec",
+]
+
 [[package]]
 name = "rust-embed"
 version = "8.6.0"
@@ -1882,6 +2146,15 @@ version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "357703d41365b4b27c590e3ed91eabb1b663f07c4c084095e60cbed4362dff0d"

+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
 [[package]]
 name = "rustix"
 version = "1.0.7"
@@ -1919,7 +2192,16 @@ dependencies = [
 "openssl-probe",
 "rustls-pki-types",
 "schannel",
- "security-framework",
+ "security-framework 3.2.0",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
 ]

 [[package]]
@@ -1957,21 +2239,63 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"

 [[package]]
 name = "salvo"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca8e3fda2c363337d9179477b947546433da95c94d7d2ba325e21fa9c314ff78"
+checksum = "7ce0331005d85590a43295118391452dd04cf7826c2f8251c2362874b8d8b67a"
 dependencies = [
+ "salvo-craft",
 "salvo-jwt-auth",
 "salvo-oapi",
 "salvo-proxy",
+ "salvo-serve-static",
 "salvo_core",
+ "salvo_extra",
+]
+
+[[package]]
+name = "salvo-craft"
+version = "0.80.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e0e91ffd1029d42f100923525be9ed0cb500e651100580ba9e67cae368f34b3"
+dependencies = [
+ "salvo-craft-macros",
+]
+
+[[package]]
+name = "salvo-craft-macros"
+version = "0.80.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9514000ff4ff9697ec8334f8be2cf519a0a3c6b77685fb1ad7a271f952231dc0"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "syn 2.0.104",
+]
+
+[[package]]
+name = "salvo-http3"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8dc5ede68d4df95dbe7af4483438e739f0e8b41c679615ca864559434f24d07a"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "h3",
+ "h3-datagram",
+ "h3-quinn",
+ "http",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
 ]

 [[package]]
 name = "salvo-jwt-auth"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88690329319f476e45ea15208f947dd0f162388dcfb14f34b9fbd665e11ca286"
+checksum = "d9d41ac7983e15ce964f2c2b55d07ea83f1ec8c40abac4fc912ae2c34c272205"
 dependencies = [
 "base64",
 "bytes",
@@ -1989,9 +2313,9 @@ dependencies = [

 [[package]]
 name = "salvo-oapi"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b278c065715279c485d2d74be6823388f7ddb32200da7d47b7cdc3f4780e40f5"
+checksum = "7b9ef2a41e4bebb38f859d12b257a386e26eb736ad2932b39a7fa6b4a1574cbc"
 dependencies = [
 "anyhow",
 "base64",
@@ -2024,9 +2348,9 @@ dependencies = [

 [[package]]
 name = "salvo-oapi-macros"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d0fdfa852c79ea04fe035b5717d5cced58cb7f28fa5f20f74b16b0bbddd61"
+checksum = "e11a94dacba1e1faeeb27c0affcecea7913ae086f9dfc8476dfb115a61c9f412"
 dependencies = [
 "proc-macro-crate",
 "proc-macro2",
@@ -2039,9 +2363,9 @@ dependencies = [

 [[package]]
 name = "salvo-proxy"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ac4a3774c12134537dbf7b4de0a3a33355bc8181b7aedecf2e676f6155c16dd"
+checksum = "60554233611342021acaf1340679427e388e358486fa5ef7684d90aa738c854b"
 dependencies = [
 "fastrand",
 "futures-util",
@@ -2057,9 +2381,9 @@ dependencies = [

 [[package]]
 name = "salvo-serde-util"
-version = "0.79.0"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bf8b2a2576a893b80542c400ae4d3b1b1a903ad400ce6a7affe930e4ad9346d"
+checksum = "2014d193ab04bf917c574c155801279474becd532a02f7dbe64928bdd2b072a4"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -2067,10 +2391,30 @@ dependencies = [
 ]

 [[package]]
-name = "salvo_core"
-version = "0.79.0"
+name = "salvo-serve-static"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c7a887d957cfc87e4f25e33d37bfc8aac0544ab95478b4620faaa2f0be522c27"
+checksum = "a98e8c27387f5b28ce66c337ae5772268c6d5f728b605fad4355cd4b58f6974b"
+dependencies = [
+ "hex",
+ "mime",
+ "mime-infer",
+ "path-slash",
+ "percent-encoding",
+ "rust-embed",
+ "salvo_core",
+ "serde",
+ "serde_json",
+ "time",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "salvo_core"
+version = "0.80.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb81e2093c75ff8c3273196c7b5e3b2fb9c5f838ef7e925753ce7e58ddbd6fe4"
 dependencies = [
 "async-trait",
 "base64",
@@ -2080,6 +2424,7 @@ dependencies = [
 "form_urlencoded",
 "futures-channel",
 "futures-util",
+ "h3-datagram",
 "headers",
 "http",
 "http-body-util",
@@ -2095,8 +2440,11 @@ dependencies = [
 "parking_lot",
 "percent-encoding",
 "pin-project",
+ "quinn",
 "rand 0.9.1",
 "regex",
+ "rustls-pemfile",
+ "salvo-http3",
 "salvo_macros",
 "serde",
 "serde-xml-rs",
@@ -2111,10 +2459,32 @@ dependencies = [
 ]

 [[package]]
-name = "salvo_macros"
-version = "0.79.0"
+name = "salvo_extra"
+version = "0.80.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc781932226f47832bff8e11d32d2c799081b08116cdfe212712095aa908a7af"
+checksum = "3f90ca584472adbb3dacf4e82bdf46f8022771916342d598b5521f6bfe6b8bfd"
+dependencies = [
+ "base64",
+ "etag",
+ "futures-util",
+ "http-body-util",
+ "hyper",
+ "pin-project",
+ "salvo_core",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-tungstenite",
+ "tower",
+ "tracing",
+ "ulid",
+]
+
+[[package]]
+name = "salvo_macros"
+version = "0.80.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83c13353864ea07e0673511a843b762c775b7f9364657ff5c49ad5fccc5ce0a0"
 dependencies = [
 "proc-macro-crate",
 "proc-macro2",
@@ -2154,6 +2524,19 @@ version = "4.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"

+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags",
+ "core-foundation 0.9.4",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.2.0"
@@ -2177,6 +2560,12 @@ dependencies = [
 "libc",
 ]

+[[package]]
+name = "semver"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
+
 [[package]]
 name = "serde"
 version = "1.0.219"
@@ -2268,6 +2657,15 @@ dependencies = [
 "digest",
 ]

+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -2341,6 +2739,12 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"

+[[package]]
+name = "str-buf"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ceb97b7225c713c2fd4db0153cb6b3cab244eb37900c3f634ed4d43310d8c34"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -2469,6 +2873,15 @@ dependencies = [
 "syn 2.0.104",
 ]

+[[package]]
+name = "thread_local"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f60246a4944f24f6e018aa17cdeffb7818b76356965d03b07d6a9886e8962185"
+dependencies = [
+ "cfg-if",
+]
+
 [[package]]
 name = "time"
 version = "0.3.41"
@@ -2554,6 +2967,16 @@ dependencies = [
 "syn 2.0.104",
 ]

+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.2"
@@ -2564,6 +2987,18 @@ dependencies = [
 "tokio",
 ]

+[[package]]
+name = "tokio-tungstenite"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "489a59b6730eda1b0171fcfda8b121f4bee2b35cba8645ca35c5f7ba3eb736c1"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite",
+]
+
 [[package]]
 name = "tokio-util"
 version = "0.7.15"
@@ -2605,8 +3040,10 @@ dependencies = [
 "pin-project-lite",
 "sync_wrapper",
 "tokio",
+ "tokio-util",
 "tower-layer",
 "tower-service",
+ "tracing",
 ]

 [[package]]
@@ -2668,6 +3105,32 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d12581f227e93f094d3af2ae690a574abb8a2b9b7a96e7cfe9647b2b617678"
 dependencies = [
 "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+dependencies = [
+ "nu-ansi-term",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing-core",
+ "tracing-log",
 ]

 [[package]]
@@ -2676,6 +3139,19 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"

+[[package]]
+name = "tungstenite"
+version = "0.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eadc29d668c91fcc564941132e17b28a7ceb2f3ebf0b9dae3e03fd7a6748eb0d"
+dependencies = [
+ "bytes",
+ "log",
+ "rand 0.9.1",
+ "thiserror 2.0.12",
+ "utf-8",
+]
+
 [[package]]
 name = "typenum"
 version = "1.18.0"
@@ -2688,6 +3164,7 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
 dependencies = [
+ "rand 0.9.1",
 "web-time",
 ]

@@ -2734,6 +3211,7 @@ dependencies = [
 "form_urlencoded",
 "idna",
 "percent-encoding",
+ "serde",
 ]

 [[package]]
@@ -2742,6 +3220,12 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "76ebdb602caa7eec1e27aaf8364e23c9807d0deb2aae98c6e0fa37ea05954d6d"

+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -2756,9 +3240,16 @@ checksum = "3cf4199d1e5d15ddd86a694e4d0dffa9c323ce759fea589f00fef9d81cc1931d"
 dependencies = [
 "getrandom 0.3.3",
 "js-sys",
+ "serde",
 "wasm-bindgen",
 ]

+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
 [[package]]
 name = "vcpkg"
 version = "0.2.15"
@@ -2918,15 +3409,37 @@ dependencies = [
 "rustls-pki-types",
 ]

+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]

+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.61.0"
@@ -3182,6 +3695,12 @@ version = "0.8.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a62ce76d9b56901b19a74f19431b0d8b3bc7ca4ad685a746dfd78ca8f4fc6bda"

+[[package]]
+name = "xxhash-rust"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+
 [[package]]
 name = "yansi"
 version = "1.0.1"
@@ -0,0 +1,15 @@
+localhost:64444 {
+    tls internal
+
+    # Proxy /config path to proxy
+    reverse_proxy /api/* https://127.0.0.1:3000 {
+        transport http {
+                tls
+                tls_insecure_skip_verify
+        }
+      }
+
+    # Proxy root path to dev server
+    reverse_proxy http://localhost:5173
+
+}
@@ -0,0 +1,36 @@
+services:
+  caddy:
+    image: caddy:latest
+    ports:
+      - "64444:64444/tcp"
+      - "64444:64444/udp"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile
+    network_mode: host
+##  mumble-web2-proxy:
+##    image: rust:latest
+##    working_dir: /app
+##    volumes:
+##      - ..:/app
+##      - ./proxy-config.toml:/app/config.toml
+##    ports:
+##      - "4433:4433/tcp"
+##      - "4433:4433/udp"
+##    command: ["cargo", "run", "-p", "mumble-web2-proxy"]
+##    network_mode: host
+##
+##  mumble-server:
+##    image: mumblevoip/mumble-server:latest
+##    ports:
+##      - "64738:64738/tcp"
+##      - "64738:64738/udp"
+##    environment:
+##      - MUMBLE_CONFIG_WELCOMETEXT=Welcome to the Mumble server
+##    network_mode: host
+#volumes:
+#  caddy_data:
+#  caddy_config:
+#
+#networks:
+#  app-network:
+#    driver: bridge
@@ -0,0 +1,23 @@
+node_modules
+
+# Output
+.output
+.vercel
+.netlify
+.wrangler
+/.svelte-kit
+/build
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Env
+.env
+.env.*
+!.env.example
+!.env.test
+
+# Vite
+vite.config.js.timestamp-*
+vite.config.ts.timestamp-*
@@ -0,0 +1 @@
+engine-strict=true
@@ -0,0 +1,9 @@
+# Package Managers
+package-lock.json
+pnpm-lock.yaml
+yarn.lock
+bun.lock
+bun.lockb
+
+# Miscellaneous
+/static/
@@ -0,0 +1,16 @@
+{
+	"useTabs": true,
+	"singleQuote": true,
+	"trailingComma": "none",
+	"printWidth": 100,
+	"plugins": ["prettier-plugin-svelte", "prettier-plugin-tailwindcss"],
+	"overrides": [
+		{
+			"files": "*.svelte",
+			"options": {
+				"parser": "svelte"
+			}
+		}
+	],
+	"tailwindStylesheet": "./src/app.css"
+}
@@ -0,0 +1,38 @@
+# sv
+
+Everything you need to build a Svelte project, powered by [`sv`](https://github.com/sveltejs/cli).
+
+## Creating a project
+
+If you're seeing this, you've probably already done this step. Congrats!
+
+```bash
+# create a new project in the current directory
+npx sv create
+
+# create a new project in my-app
+npx sv create my-app
+```
+
+## Developing
+
+Once you've created a project and installed dependencies with `npm install` (or `pnpm install` or `yarn`), start a development server:
+
+```bash
+npm run dev
+
+# or start the server and open the app in a new browser tab
+npm run dev -- --open
+```
+
+## Building
+
+To create a production version of your app:
+
+```bash
+npm run build
+```
+
+You can preview the production build with `npm run preview`.
+
+> To deploy your app, you may need to install an [adapter](https://svelte.dev/docs/kit/adapters) for your target environment.
@@ -0,0 +1,40 @@
+import prettier from 'eslint-config-prettier';
+import { includeIgnoreFile } from '@eslint/compat';
+import js from '@eslint/js';
+import svelte from 'eslint-plugin-svelte';
+import globals from 'globals';
+import { fileURLToPath } from 'node:url';
+import ts from 'typescript-eslint';
+import svelteConfig from './svelte.config.js';
+
+const gitignorePath = fileURLToPath(new URL('./.gitignore', import.meta.url));
+
+export default ts.config(
+	includeIgnoreFile(gitignorePath),
+	js.configs.recommended,
+	...ts.configs.recommended,
+	...svelte.configs.recommended,
+	prettier,
+	...svelte.configs.prettier,
+	{
+		languageOptions: {
+			globals: { ...globals.browser, ...globals.node }
+		},
+		rules: {
+			// typescript-eslint strongly recommend that you do not use the no-undef lint rule on TypeScript projects.
+			// see: https://typescript-eslint.io/troubleshooting/faqs/eslint/#i-get-errors-from-the-no-undef-rule-about-global-variables-not-being-defined-even-though-there-are-no-typescript-errors
+			'no-undef': 'off'
+		}
+	},
+	{
+		files: ['**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'],
+		languageOptions: {
+			parserOptions: {
+				projectService: true,
+				extraFileExtensions: ['.svelte'],
+				parser: ts.parser,
+				svelteConfig
+			}
+		}
+	}
+);
@@ -0,0 +1,49 @@
+{
+	"name": "frontend",
+	"private": true,
+	"version": "0.0.1",
+	"type": "module",
+	"scripts": {
+		"dev": "vite dev",
+		"build": "vite build",
+		"preview": "vite preview",
+		"prepare": "svelte-kit sync || echo ''",
+		"check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+		"check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
+		"format": "prettier --write .",
+		"lint": "prettier --check . && eslint ."
+	},
+	"devDependencies": {
+		"@eslint/compat": "^1.2.5",
+		"@eslint/js": "^9.18.0",
+		"@fontsource/fira-mono": "^5.0.0",
+		"@neoconfetti/svelte": "^2.0.0",
+		"@sveltejs/adapter-static": "^3.0.8",
+		"@sveltejs/kit": "^2.22.0",
+		"@sveltejs/vite-plugin-svelte": "^6.0.0",
+		"@tailwindcss/vite": "^4.0.0",
+		"eslint": "^9.18.0",
+		"eslint-config-prettier": "^10.0.1",
+		"eslint-plugin-svelte": "^3.0.0",
+		"globals": "^16.0.0",
+		"prettier": "^3.4.2",
+		"prettier-plugin-svelte": "^3.3.3",
+		"prettier-plugin-tailwindcss": "^0.6.11",
+		"svelte": "^5.25.0",
+		"svelte-check": "^4.0.0",
+		"tailwindcss": "^4.0.0",
+		"typescript": "^5.0.0",
+		"typescript-eslint": "^8.20.0",
+		"vite": "^7.0.4"
+	},
+	"pnpm": {
+		"onlyBuiltDependencies": [
+			"esbuild"
+		]
+	},
+	"dependencies": {
+		"flatbuffers": "^25.2.10",
+		"lucide-svelte": "^0.539.0",
+		"svelte-loading-spinners": "^0.3.6"
+	}
+}
@@ -0,0 +1,106 @@
+@import 'tailwindcss';
+@import '@fontsource/fira-mono';
+
+:root {
+	--font-body:
+		Arial, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, Cantarell,
+		'Open Sans', 'Helvetica Neue', sans-serif;
+	--font-mono: 'Fira Mono', monospace;
+	--color-bg-0: rgb(202, 216, 228);
+	--color-bg-1: hsl(209, 36%, 86%);
+	--color-bg-2: hsl(224, 44%, 95%);
+	--color-theme-1: #ff3e00;
+	--color-theme-2: #4075a6;
+	--color-text: rgba(0, 0, 0, 0.7);
+	--column-width: 42rem;
+	--column-margin-top: 4rem;
+	font-family: var(--font-body);
+	color: var(--color-text);
+}
+
+body {
+	min-height: 100vh;
+	margin: 0;
+	background-attachment: fixed;
+	background-color: var(--color-bg-1);
+	background-size: 100vw 100vh;
+	background-image:
+		radial-gradient(50% 50% at 50% 50%, rgba(255, 255, 255, 0.75) 0%, rgba(255, 255, 255, 0) 100%),
+		linear-gradient(180deg, var(--color-bg-0) 0%, var(--color-bg-1) 15%, var(--color-bg-2) 50%);
+}
+
+h1,
+h2,
+p {
+	font-weight: 400;
+}
+
+p {
+	line-height: 1.5;
+}
+
+a {
+	color: var(--color-theme-1);
+	text-decoration: none;
+}
+
+a:hover {
+	text-decoration: underline;
+}
+
+h1 {
+	font-size: 2rem;
+	text-align: center;
+}
+
+h2 {
+	font-size: 1rem;
+}
+
+pre {
+	font-size: 16px;
+	font-family: var(--font-mono);
+	background-color: rgba(255, 255, 255, 0.45);
+	border-radius: 3px;
+	box-shadow: 2px 2px 6px rgb(255 255 255 / 25%);
+	padding: 0.5em;
+	overflow-x: auto;
+	color: var(--color-text);
+}
+
+.text-column {
+	display: flex;
+	max-width: 48rem;
+	flex: 0.6;
+	flex-direction: column;
+	justify-content: center;
+	margin: 0 auto;
+}
+
+input,
+button {
+	font-size: inherit;
+	font-family: inherit;
+}
+
+button:focus:not(:focus-visible) {
+	outline: none;
+}
+
+@media (min-width: 720px) {
+	h1 {
+		font-size: 2.4rem;
+	}
+}
+
+.visually-hidden {
+	border: 0;
+	clip: rect(0 0 0 0);
+	height: auto;
+	margin: 0;
+	overflow: hidden;
+	padding: 0;
+	position: absolute;
+	width: 1px;
+	white-space: nowrap;
+}
@@ -0,0 +1,13 @@
+// See https://svelte.dev/docs/kit/types#app.d.ts
+// for information about these interfaces
+declare global {
+	namespace App {
+		// interface Error {}
+		// interface Locals {}
+		// interface PageData {}
+		// interface PageState {}
+		// interface Platform {}
+	}
+}
+
+export {};
@@ -0,0 +1,12 @@
+<!doctype html>
+<html lang="en">
+	<head>
+		<meta charset="utf-8" />
+		<link rel="icon" href="%sveltekit.assets%/favicon.svg" />
+		<meta name="viewport" content="width=device-width, initial-scale=1" />
+		%sveltekit.head%
+	</head>
+	<body data-sveltekit-preload-data="hover">
+		<div style="display: contents">%sveltekit.body%</div>
+	</body>
+</html>
@@ -0,0 +1,24 @@
+import { streamVideoFromReader } from "./video";
+
+let canvas: OffscreenCanvas | undefined = undefined;
+let reader: ReadableStream | undefined = undefined;
+let resolver: any = undefined;
+const messagePromise = new Promise((resolve) => resolver = resolve);
+
+
+self.onmessage = async ({ data: payload }: { data: any }) => {
+  canvas = payload["canvas"];
+  reader = payload["reader"];
+  self.onmessage = null;
+  resolver?.();
+};
+
+console.log(`Worker spawned successfully`)
+await messagePromise;
+console.log("Worker received required objects")
+console.log("Starting video streaming")
+
+await streamVideoFromReader(reader!.getReader(), canvas!);
+
+
+export { }; // This makes TypeScript happy
@@ -0,0 +1 @@
+<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#24292f"/></svg>
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.1566,22.8189c-10.4-14.8851-30.94-19.2971-45.7914-9.8348L22.2825,29.6078A29.9234,29.9234,0,0,0,8.7639,49.6506a31.5136,31.5136,0,0,0,3.1076,20.2318A30.0061,30.0061,0,0,0,7.3953,81.0653a31.8886,31.8886,0,0,0,5.4473,24.1157c10.4022,14.8865,30.9423,19.2966,45.7914,9.8348L84.7167,98.3921A29.9177,29.9177,0,0,0,98.2353,78.3493,31.5263,31.5263,0,0,0,95.13,58.117a30,30,0,0,0,4.4743-11.1824,31.88,31.88,0,0,0-5.4473-24.1157" style="fill:#ff3e00"/><path d="M45.8171,106.5815A20.7182,20.7182,0,0,1,23.58,98.3389a19.1739,19.1739,0,0,1-3.2766-14.5025,18.1886,18.1886,0,0,1,.6233-2.4357l.4912-1.4978,1.3363.9815a33.6443,33.6443,0,0,0,10.203,5.0978l.9694.2941-.0893.9675a5.8474,5.8474,0,0,0,1.052,3.8781,6.2389,6.2389,0,0,0,6.6952,2.485,5.7449,5.7449,0,0,0,1.6021-.7041L69.27,76.281a5.4306,5.4306,0,0,0,2.4506-3.631,5.7948,5.7948,0,0,0-.9875-4.3712,6.2436,6.2436,0,0,0-6.6978-2.4864,5.7427,5.7427,0,0,0-1.6.7036l-9.9532,6.3449a19.0329,19.0329,0,0,1-5.2965,2.3259,20.7181,20.7181,0,0,1-22.2368-8.2427,19.1725,19.1725,0,0,1-3.2766-14.5024,17.9885,17.9885,0,0,1,8.13-12.0513L55.8833,23.7472a19.0038,19.0038,0,0,1,5.3-2.3287A20.7182,20.7182,0,0,1,83.42,29.6611a19.1739,19.1739,0,0,1,3.2766,14.5025,18.4,18.4,0,0,1-.6233,2.4357l-.4912,1.4978-1.3356-.98a33.6175,33.6175,0,0,0-10.2037-5.1l-.9694-.2942.0893-.9675a5.8588,5.8588,0,0,0-1.052-3.878,6.2389,6.2389,0,0,0-6.6952-2.485,5.7449,5.7449,0,0,0-1.6021.7041L37.73,51.719a5.4218,5.4218,0,0,0-2.4487,3.63,5.7862,5.7862,0,0,0,.9856,4.3717,6.2437,6.2437,0,0,0,6.6978,2.4864,5.7652,5.7652,0,0,0,1.602-.7041l9.9519-6.3425a18.978,18.978,0,0,1,5.2959-2.3278,20.7181,20.7181,0,0,1,22.2368,8.2427,19.1725,19.1725,0,0,1,3.2766,14.5024,17.9977,17.9977,0,0,1-8.13,12.0532L51.1167,104.2528a19.0038,19.0038,0,0,1-5.3,2.3287" style="fill:#fff"/></svg>
@@ -0,0 +1,152 @@
+import { Input } from "$lib/proto/input-event"
+import { InputEvent } from "$lib/proto/input"
+import { Builder } from "flatbuffers";
+
+export enum KeyAction {
+  DOWN,
+  UP,
+}
+
+export async function sendKeyboardEvent(
+  writer: WritableStreamDefaultWriter,
+  event: KeyboardEvent,
+  keyAction: KeyAction,
+) {
+  const builder = new Builder(1024);
+
+  InputEvent.KeyboardInput.startKeyboardInput(builder);
+  // Have to use keyCode even though it's deprecated beacuse .code is a unhelpful string :sigh:
+  InputEvent.KeyboardInput.addKeyCode(builder, event.keyCode);
+  InputEvent.KeyboardInput.addKeyAction(builder, keyAction);
+  const modifierState = InputEvent.ModifierState.createModifierState(
+    builder,
+    event.shiftKey,
+    event.ctrlKey,
+    event.altKey,
+    event.metaKey
+  );
+
+  InputEvent.KeyboardInput.addModifiers(builder, modifierState);
+  const keyboardInput = InputEvent.KeyboardInput.endKeyboardInput(builder);
+
+  // Create InputEvent table with union
+  InputEvent.InputEvent.startInputEvent(builder);
+  InputEvent.InputEvent.addInputType(builder, Input.Keyboard);
+  InputEvent.InputEvent.addInput(builder, keyboardInput);
+  const inputEvent = InputEvent.InputEvent.endInputEvent(builder);
+
+  // Finish the buffer
+  builder.finish(inputEvent);
+
+  // Get the buffer data
+  const bufferData = builder.asUint8Array();
+
+  // Create size prefix as big-endian u32
+  const sizePrefix = new Uint8Array(4);
+  const size = bufferData.length;
+  sizePrefix[0] = (size >> 24) & 0xFF;  // Most significant byte
+  sizePrefix[1] = (size >> 16) & 0xFF;
+  sizePrefix[2] = (size >> 8) & 0xFF;
+  sizePrefix[3] = size & 0xFF;          // Least significant byte
+
+  // Create combined buffer with size prefix + flatbuffer data
+  const combined = new Uint8Array(sizePrefix.length + bufferData.length);
+  combined.set(sizePrefix, 0);
+  combined.set(bufferData, sizePrefix.length);
+
+  // Write to stream
+  await writer.write(combined);
+}
+
+export async function sendMouseMoveEvent(
+  writer: WritableStreamDefaultWriter,
+  event: MouseEvent,
+) {
+  const builder = new Builder(1024);
+
+  const mouseMovement = InputEvent.MouseMovement.createMouseMovement(builder, event.movementX, event.movementY);
+
+  // Create InputEvent table with union
+  InputEvent.InputEvent.startInputEvent(builder);
+  InputEvent.InputEvent.addInputType(builder, Input.MouseMovement);
+  InputEvent.InputEvent.addInput(builder, mouseMovement);
+  const inputEvent = InputEvent.InputEvent.endInputEvent(builder);
+
+  // Finish the buffer
+  builder.finish(inputEvent);
+
+  // Get the buffer data
+  const bufferData = builder.asUint8Array();
+
+  // Create size prefix as big-endian u32
+  const sizePrefix = new Uint8Array(4);
+  const size = bufferData.length;
+  sizePrefix[0] = (size >> 24) & 0xFF;  // Most significant byte
+  sizePrefix[1] = (size >> 16) & 0xFF;
+  sizePrefix[2] = (size >> 8) & 0xFF;
+  sizePrefix[3] = size & 0xFF;          // Least significant byte
+
+  // Create combined buffer with size prefix + flatbuffer data
+  const combined = new Uint8Array(sizePrefix.length + bufferData.length);
+  combined.set(sizePrefix, 0);
+  combined.set(bufferData, sizePrefix.length);
+
+  // Write to stream
+  await writer.write(combined);
+}
+
+export async function sendMouseInputEvent(
+  writer: WritableStreamDefaultWriter,
+  event: MouseEvent,
+  keyAction: KeyAction,
+) {
+  const builder = new Builder(1024);
+
+  var mouseButton: InputEvent.MouseButton;
+
+  switch (event.button) {
+    case 0:
+      mouseButton = InputEvent.MouseButton.LEFT;
+      break;
+    case 1:
+      mouseButton = InputEvent.MouseButton.MIDDLE;
+      break;
+    case 2:
+      mouseButton = InputEvent.MouseButton.RIGHT;
+      break;
+    default:
+      console.log(`Unknown mouse button ${event.button}, defaulting to LEFT`);
+      mouseButton = InputEvent.MouseButton.LEFT;
+      break;
+  }
+
+  const mouseInput = InputEvent.MouseInput.createMouseInput(builder, mouseButton, keyAction);
+
+  // Create InputEvent table with union
+  InputEvent.InputEvent.startInputEvent(builder);
+  InputEvent.InputEvent.addInputType(builder, Input.MouseInput);
+  InputEvent.InputEvent.addInput(builder, mouseInput);
+  const inputEvent = InputEvent.InputEvent.endInputEvent(builder);
+
+  // Finish the buffer
+  builder.finish(inputEvent);
+
+  // Get the buffer data
+  const bufferData = builder.asUint8Array();
+
+  // Create size prefix as big-endian u32
+  const sizePrefix = new Uint8Array(4);
+  const size = bufferData.length;
+  sizePrefix[0] = (size >> 24) & 0xFF;  // Most significant byte
+  sizePrefix[1] = (size >> 16) & 0xFF;
+  sizePrefix[2] = (size >> 8) & 0xFF;
+  sizePrefix[3] = size & 0xFF;          // Least significant byte
+
+  // Create combined buffer with size prefix + flatbuffer data
+  const combined = new Uint8Array(sizePrefix.length + bufferData.length);
+  combined.set(sizePrefix, 0);
+  combined.set(bufferData, sizePrefix.length);
+
+  // Write to stream
+  await writer.write(combined);
+}
@@ -0,0 +1,12 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export { Input } from './input-event/input.js';
+export { InputEvent } from './input-event/input-event.js';
+export { KeyAction } from './input-event/key-action.js';
+export { KeyboardInput } from './input-event/keyboard-input.js';
+export { ModifierState } from './input-event/modifier-state.js';
+export { MouseButton } from './input-event/mouse-button.js';
+export { MouseInput } from './input-event/mouse-input.js';
+export { MouseMovement } from './input-event/mouse-movement.js';
@@ -0,0 +1,69 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { Input, unionToInput, unionListToInput } from '../input-event/input.js';
+
+
+export class InputEvent {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):InputEvent {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsInputEvent(bb:flatbuffers.ByteBuffer, obj?:InputEvent):InputEvent {
+  return (obj || new InputEvent()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsInputEvent(bb:flatbuffers.ByteBuffer, obj?:InputEvent):InputEvent {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new InputEvent()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+inputType():Input {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readUint8(this.bb_pos + offset) : Input.NONE;
+}
+
+input<T extends flatbuffers.Table>(obj:any):any|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__union(obj, this.bb_pos + offset) : null;
+}
+
+static startInputEvent(builder:flatbuffers.Builder) {
+  builder.startObject(2);
+}
+
+static addInputType(builder:flatbuffers.Builder, inputType:Input) {
+  builder.addFieldInt8(0, inputType, Input.NONE);
+}
+
+static addInput(builder:flatbuffers.Builder, inputOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, inputOffset, 0);
+}
+
+static endInputEvent(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static finishInputEventBuffer(builder:flatbuffers.Builder, offset:flatbuffers.Offset) {
+  builder.finish(offset);
+}
+
+static finishSizePrefixedInputEventBuffer(builder:flatbuffers.Builder, offset:flatbuffers.Offset) {
+  builder.finish(offset, undefined, true);
+}
+
+static createInputEvent(builder:flatbuffers.Builder, inputType:Input, inputOffset:flatbuffers.Offset):flatbuffers.Offset {
+  InputEvent.startInputEvent(builder);
+  InputEvent.addInputType(builder, inputType);
+  InputEvent.addInput(builder, inputOffset);
+  return InputEvent.endInputEvent(builder);
+}
+}
@@ -0,0 +1,42 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import { KeyboardInput } from '../input-event/keyboard-input.js';
+import { MouseInput } from '../input-event/mouse-input.js';
+import { MouseMovement } from '../input-event/mouse-movement.js';
+
+
+export enum Input {
+  NONE = 0,
+  Keyboard = 1,
+  MouseMovement = 2,
+  MouseInput = 3
+}
+
+export function unionToInput(
+  type: Input,
+  accessor: (obj:KeyboardInput|MouseInput|MouseMovement) => KeyboardInput|MouseInput|MouseMovement|null
+): KeyboardInput|MouseInput|MouseMovement|null {
+  switch(Input[type]) {
+    case 'NONE': return null; 
+    case 'Keyboard': return accessor(new KeyboardInput())! as KeyboardInput;
+    case 'MouseMovement': return accessor(new MouseMovement())! as MouseMovement;
+    case 'MouseInput': return accessor(new MouseInput())! as MouseInput;
+    default: return null;
+  }
+}
+
+export function unionListToInput(
+  type: Input, 
+  accessor: (index: number, obj:KeyboardInput|MouseInput|MouseMovement) => KeyboardInput|MouseInput|MouseMovement|null, 
+  index: number
+): KeyboardInput|MouseInput|MouseMovement|null {
+  switch(Input[type]) {
+    case 'NONE': return null; 
+    case 'Keyboard': return accessor(index, new KeyboardInput())! as KeyboardInput;
+    case 'MouseMovement': return accessor(index, new MouseMovement())! as MouseMovement;
+    case 'MouseInput': return accessor(index, new MouseInput())! as MouseInput;
+    default: return null;
+  }
+}
@@ -0,0 +1,8 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export enum KeyAction {
+  DOWN = 0,
+  UP = 1
+}
@@ -0,0 +1,65 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { KeyAction } from '../input-event/key-action.js';
+import { ModifierState } from '../input-event/modifier-state.js';
+
+
+export class KeyboardInput {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):KeyboardInput {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsKeyboardInput(bb:flatbuffers.ByteBuffer, obj?:KeyboardInput):KeyboardInput {
+  return (obj || new KeyboardInput()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsKeyboardInput(bb:flatbuffers.ByteBuffer, obj?:KeyboardInput):KeyboardInput {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new KeyboardInput()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+keyCode():number {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readInt16(this.bb_pos + offset) : 0;
+}
+
+keyAction():KeyAction {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt8(this.bb_pos + offset) : KeyAction.DOWN;
+}
+
+modifiers(obj?:ModifierState):ModifierState|null {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? (obj || new ModifierState()).__init(this.bb_pos + offset, this.bb!) : null;
+}
+
+static startKeyboardInput(builder:flatbuffers.Builder) {
+  builder.startObject(3);
+}
+
+static addKeyCode(builder:flatbuffers.Builder, keyCode:number) {
+  builder.addFieldInt16(0, keyCode, 0);
+}
+
+static addKeyAction(builder:flatbuffers.Builder, keyAction:KeyAction) {
+  builder.addFieldInt8(1, keyAction, KeyAction.DOWN);
+}
+
+static addModifiers(builder:flatbuffers.Builder, modifiersOffset:flatbuffers.Offset) {
+  builder.addFieldStruct(2, modifiersOffset, 0);
+}
+
+static endKeyboardInput(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+}
@@ -0,0 +1,45 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+export class ModifierState {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):ModifierState {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+shift():boolean {
+  return !!this.bb!.readInt8(this.bb_pos);
+}
+
+ctrl():boolean {
+  return !!this.bb!.readInt8(this.bb_pos + 1);
+}
+
+alt():boolean {
+  return !!this.bb!.readInt8(this.bb_pos + 2);
+}
+
+meta():boolean {
+  return !!this.bb!.readInt8(this.bb_pos + 3);
+}
+
+static sizeOf():number {
+  return 4;
+}
+
+static createModifierState(builder:flatbuffers.Builder, shift: boolean, ctrl: boolean, alt: boolean, meta: boolean):flatbuffers.Offset {
+  builder.prep(1, 4);
+  builder.writeInt8(Number(Boolean(meta)));
+  builder.writeInt8(Number(Boolean(alt)));
+  builder.writeInt8(Number(Boolean(ctrl)));
+  builder.writeInt8(Number(Boolean(shift)));
+  return builder.offset();
+}
+
+}
@@ -0,0 +1,11 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export enum MouseButton {
+  LEFT = 0,
+  MIDDLE = 1,
+  RIGHT = 2,
+  X1 = 3,
+  X2 = 4
+}
@@ -0,0 +1,62 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { KeyAction } from '../input-event/key-action.js';
+import { MouseButton } from '../input-event/mouse-button.js';
+
+
+export class MouseInput {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):MouseInput {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsMouseInput(bb:flatbuffers.ByteBuffer, obj?:MouseInput):MouseInput {
+  return (obj || new MouseInput()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsMouseInput(bb:flatbuffers.ByteBuffer, obj?:MouseInput):MouseInput {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new MouseInput()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+button():MouseButton {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readInt8(this.bb_pos + offset) : MouseButton.LEFT;
+}
+
+buttonAction():KeyAction {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt8(this.bb_pos + offset) : KeyAction.DOWN;
+}
+
+static startMouseInput(builder:flatbuffers.Builder) {
+  builder.startObject(2);
+}
+
+static addButton(builder:flatbuffers.Builder, button:MouseButton) {
+  builder.addFieldInt8(0, button, MouseButton.LEFT);
+}
+
+static addButtonAction(builder:flatbuffers.Builder, buttonAction:KeyAction) {
+  builder.addFieldInt8(1, buttonAction, KeyAction.DOWN);
+}
+
+static endMouseInput(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createMouseInput(builder:flatbuffers.Builder, button:MouseButton, buttonAction:KeyAction):flatbuffers.Offset {
+  MouseInput.startMouseInput(builder);
+  MouseInput.addButton(builder, button);
+  MouseInput.addButtonAction(builder, buttonAction);
+  return MouseInput.endMouseInput(builder);
+}
+}
@@ -0,0 +1,58 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+export class MouseMovement {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):MouseMovement {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsMouseMovement(bb:flatbuffers.ByteBuffer, obj?:MouseMovement):MouseMovement {
+  return (obj || new MouseMovement()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsMouseMovement(bb:flatbuffers.ByteBuffer, obj?:MouseMovement):MouseMovement {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new MouseMovement()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+movementX():number {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readInt16(this.bb_pos + offset) : 0;
+}
+
+movementY():number {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt16(this.bb_pos + offset) : 0;
+}
+
+static startMouseMovement(builder:flatbuffers.Builder) {
+  builder.startObject(2);
+}
+
+static addMovementX(builder:flatbuffers.Builder, movementX:number) {
+  builder.addFieldInt16(0, movementX, 0);
+}
+
+static addMovementY(builder:flatbuffers.Builder, movementY:number) {
+  builder.addFieldInt16(1, movementY, 0);
+}
+
+static endMouseMovement(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createMouseMovement(builder:flatbuffers.Builder, movementX:number, movementY:number):flatbuffers.Offset {
+  MouseMovement.startMouseMovement(builder);
+  MouseMovement.addMovementX(builder, movementX);
+  MouseMovement.addMovementY(builder, movementY);
+  return MouseMovement.endMouseMovement(builder);
+}
+}
@@ -0,0 +1,5 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export * as InputEvent from './input-event.js';
@@ -0,0 +1,10 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export { DecodeUnitBuffer } from './video-update/decode-unit-buffer.js';
+export { DecodeUnitStart } from './video-update/decode-unit-start.js';
+export { FrameType } from './video-update/frame-type.js';
+export { Setup } from './video-update/setup.js';
+export { Update } from './video-update/update.js';
+export { VideoUpdate } from './video-update/video-update.js';
@@ -0,0 +1,100 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+export class DecodeUnitBuffer {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):DecodeUnitBuffer {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsDecodeUnitBuffer(bb:flatbuffers.ByteBuffer, obj?:DecodeUnitBuffer):DecodeUnitBuffer {
+  return (obj || new DecodeUnitBuffer()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsDecodeUnitBuffer(bb:flatbuffers.ByteBuffer, obj?:DecodeUnitBuffer):DecodeUnitBuffer {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new DecodeUnitBuffer()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+frameNumber():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+bufferIndex():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+bufferOffset():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+data(index: number):number|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.readUint8(this.bb!.__vector(this.bb_pos + offset) + index) : 0;
+}
+
+dataLength():number {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.__vector_len(this.bb_pos + offset) : 0;
+}
+
+dataArray():Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? new Uint8Array(this.bb!.bytes().buffer, this.bb!.bytes().byteOffset + this.bb!.__vector(this.bb_pos + offset), this.bb!.__vector_len(this.bb_pos + offset)) : null;
+}
+
+static startDecodeUnitBuffer(builder:flatbuffers.Builder) {
+  builder.startObject(4);
+}
+
+static addFrameNumber(builder:flatbuffers.Builder, frameNumber:bigint) {
+  builder.addFieldInt64(0, frameNumber, BigInt('0'));
+}
+
+static addBufferIndex(builder:flatbuffers.Builder, bufferIndex:bigint) {
+  builder.addFieldInt64(1, bufferIndex, BigInt('0'));
+}
+
+static addBufferOffset(builder:flatbuffers.Builder, bufferOffset:bigint) {
+  builder.addFieldInt64(2, bufferOffset, BigInt('0'));
+}
+
+static addData(builder:flatbuffers.Builder, dataOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(3, dataOffset, 0);
+}
+
+static createDataVector(builder:flatbuffers.Builder, data:number[]|Uint8Array):flatbuffers.Offset {
+  builder.startVector(1, data.length, 1);
+  for (let i = data.length - 1; i >= 0; i--) {
+    builder.addInt8(data[i]!);
+  }
+  return builder.endVector();
+}
+
+static startDataVector(builder:flatbuffers.Builder, numElems:number) {
+  builder.startVector(1, numElems, 1);
+}
+
+static endDecodeUnitBuffer(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createDecodeUnitBuffer(builder:flatbuffers.Builder, frameNumber:bigint, bufferIndex:bigint, bufferOffset:bigint, dataOffset:flatbuffers.Offset):flatbuffers.Offset {
+  DecodeUnitBuffer.startDecodeUnitBuffer(builder);
+  DecodeUnitBuffer.addFrameNumber(builder, frameNumber);
+  DecodeUnitBuffer.addBufferIndex(builder, bufferIndex);
+  DecodeUnitBuffer.addBufferOffset(builder, bufferOffset);
+  DecodeUnitBuffer.addData(builder, dataOffset);
+  return DecodeUnitBuffer.endDecodeUnitBuffer(builder);
+}
+}
@@ -0,0 +1,91 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { FrameType } from '../video-update/frame-type.js';
+
+
+export class DecodeUnitStart {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):DecodeUnitStart {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsDecodeUnitStart(bb:flatbuffers.ByteBuffer, obj?:DecodeUnitStart):DecodeUnitStart {
+  return (obj || new DecodeUnitStart()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsDecodeUnitStart(bb:flatbuffers.ByteBuffer, obj?:DecodeUnitStart):DecodeUnitStart {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new DecodeUnitStart()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+frameNumber():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+frameType():FrameType {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt8(this.bb_pos + offset) : FrameType.PFRAME;
+}
+
+numBuffers():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+receiveTimeMs():number {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+fullLength():bigint {
+  const offset = this.bb!.__offset(this.bb_pos, 12);
+  return offset ? this.bb!.readUint64(this.bb_pos + offset) : BigInt('0');
+}
+
+static startDecodeUnitStart(builder:flatbuffers.Builder) {
+  builder.startObject(5);
+}
+
+static addFrameNumber(builder:flatbuffers.Builder, frameNumber:bigint) {
+  builder.addFieldInt64(0, frameNumber, BigInt('0'));
+}
+
+static addFrameType(builder:flatbuffers.Builder, frameType:FrameType) {
+  builder.addFieldInt8(1, frameType, FrameType.PFRAME);
+}
+
+static addNumBuffers(builder:flatbuffers.Builder, numBuffers:bigint) {
+  builder.addFieldInt64(2, numBuffers, BigInt('0'));
+}
+
+static addReceiveTimeMs(builder:flatbuffers.Builder, receiveTimeMs:number) {
+  builder.addFieldInt16(3, receiveTimeMs, 0);
+}
+
+static addFullLength(builder:flatbuffers.Builder, fullLength:bigint) {
+  builder.addFieldInt64(4, fullLength, BigInt('0'));
+}
+
+static endDecodeUnitStart(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createDecodeUnitStart(builder:flatbuffers.Builder, frameNumber:bigint, frameType:FrameType, numBuffers:bigint, receiveTimeMs:number, fullLength:bigint):flatbuffers.Offset {
+  DecodeUnitStart.startDecodeUnitStart(builder);
+  DecodeUnitStart.addFrameNumber(builder, frameNumber);
+  DecodeUnitStart.addFrameType(builder, frameType);
+  DecodeUnitStart.addNumBuffers(builder, numBuffers);
+  DecodeUnitStart.addReceiveTimeMs(builder, receiveTimeMs);
+  DecodeUnitStart.addFullLength(builder, fullLength);
+  return DecodeUnitStart.endDecodeUnitStart(builder);
+}
+}
@@ -0,0 +1,103 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { FrameType } from '../video-update/frame-type.js';
+
+
+export class DecodeUnit {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):DecodeUnit {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsDecodeUnit(bb:flatbuffers.ByteBuffer, obj?:DecodeUnit):DecodeUnit {
+  return (obj || new DecodeUnit()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsDecodeUnit(bb:flatbuffers.ByteBuffer, obj?:DecodeUnit):DecodeUnit {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new DecodeUnit()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+frameNumber():number {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+frameType():FrameType {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readInt8(this.bb_pos + offset) : FrameType.PFRAME;
+}
+
+receiveTimeMs():number {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+data(index: number):number|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.readUint8(this.bb!.__vector(this.bb_pos + offset) + index) : 0;
+}
+
+dataLength():number {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.__vector_len(this.bb_pos + offset) : 0;
+}
+
+dataArray():Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? new Uint8Array(this.bb!.bytes().buffer, this.bb!.bytes().byteOffset + this.bb!.__vector(this.bb_pos + offset), this.bb!.__vector_len(this.bb_pos + offset)) : null;
+}
+
+static startDecodeUnit(builder:flatbuffers.Builder) {
+  builder.startObject(4);
+}
+
+static addFrameNumber(builder:flatbuffers.Builder, frameNumber:number) {
+  builder.addFieldInt16(0, frameNumber, 0);
+}
+
+static addFrameType(builder:flatbuffers.Builder, frameType:FrameType) {
+  builder.addFieldInt8(1, frameType, FrameType.PFRAME);
+}
+
+static addReceiveTimeMs(builder:flatbuffers.Builder, receiveTimeMs:number) {
+  builder.addFieldInt16(2, receiveTimeMs, 0);
+}
+
+static addData(builder:flatbuffers.Builder, dataOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(3, dataOffset, 0);
+}
+
+static createDataVector(builder:flatbuffers.Builder, data:number[]|Uint8Array):flatbuffers.Offset {
+  builder.startVector(1, data.length, 1);
+  for (let i = data.length - 1; i >= 0; i--) {
+    builder.addInt8(data[i]!);
+  }
+  return builder.endVector();
+}
+
+static startDataVector(builder:flatbuffers.Builder, numElems:number) {
+  builder.startVector(1, numElems, 1);
+}
+
+static endDecodeUnit(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createDecodeUnit(builder:flatbuffers.Builder, frameNumber:number, frameType:FrameType, receiveTimeMs:number, dataOffset:flatbuffers.Offset):flatbuffers.Offset {
+  DecodeUnit.startDecodeUnit(builder);
+  DecodeUnit.addFrameNumber(builder, frameNumber);
+  DecodeUnit.addFrameType(builder, frameType);
+  DecodeUnit.addReceiveTimeMs(builder, receiveTimeMs);
+  DecodeUnit.addData(builder, dataOffset);
+  return DecodeUnit.endDecodeUnit(builder);
+}
+}
@@ -0,0 +1,8 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export enum FrameType {
+  PFRAME = 0,
+  IDR = 1
+}
@@ -0,0 +1,80 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+export class Setup {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):Setup {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsSetup(bb:flatbuffers.ByteBuffer, obj?:Setup):Setup {
+  return (obj || new Setup()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsSetup(bb:flatbuffers.ByteBuffer, obj?:Setup):Setup {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new Setup()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+videoFormat():string|null
+videoFormat(optionalEncoding:flatbuffers.Encoding):string|Uint8Array|null
+videoFormat(optionalEncoding?:any):string|Uint8Array|null {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.__string(this.bb_pos + offset, optionalEncoding) : null;
+}
+
+width():number {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+height():number {
+  const offset = this.bb!.__offset(this.bb_pos, 8);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+redrawRate():number {
+  const offset = this.bb!.__offset(this.bb_pos, 10);
+  return offset ? this.bb!.readUint16(this.bb_pos + offset) : 0;
+}
+
+static startSetup(builder:flatbuffers.Builder) {
+  builder.startObject(4);
+}
+
+static addVideoFormat(builder:flatbuffers.Builder, videoFormatOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(0, videoFormatOffset, 0);
+}
+
+static addWidth(builder:flatbuffers.Builder, width:number) {
+  builder.addFieldInt16(1, width, 0);
+}
+
+static addHeight(builder:flatbuffers.Builder, height:number) {
+  builder.addFieldInt16(2, height, 0);
+}
+
+static addRedrawRate(builder:flatbuffers.Builder, redrawRate:number) {
+  builder.addFieldInt16(3, redrawRate, 0);
+}
+
+static endSetup(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static createSetup(builder:flatbuffers.Builder, videoFormatOffset:flatbuffers.Offset, width:number, height:number, redrawRate:number):flatbuffers.Offset {
+  Setup.startSetup(builder);
+  Setup.addVideoFormat(builder, videoFormatOffset);
+  Setup.addWidth(builder, width);
+  Setup.addHeight(builder, height);
+  Setup.addRedrawRate(builder, redrawRate);
+  return Setup.endSetup(builder);
+}
+}
@@ -0,0 +1,42 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import { DecodeUnitBuffer } from '../video-update/decode-unit-buffer.js';
+import { DecodeUnitStart } from '../video-update/decode-unit-start.js';
+import { Setup } from '../video-update/setup.js';
+
+
+export enum Update {
+  NONE = 0,
+  Setup = 1,
+  DecodeUnitStart = 2,
+  DecodeUnitBuffer = 3
+}
+
+export function unionToUpdate(
+  type: Update,
+  accessor: (obj:DecodeUnitBuffer|DecodeUnitStart|Setup) => DecodeUnitBuffer|DecodeUnitStart|Setup|null
+): DecodeUnitBuffer|DecodeUnitStart|Setup|null {
+  switch(Update[type]) {
+    case 'NONE': return null; 
+    case 'Setup': return accessor(new Setup())! as Setup;
+    case 'DecodeUnitStart': return accessor(new DecodeUnitStart())! as DecodeUnitStart;
+    case 'DecodeUnitBuffer': return accessor(new DecodeUnitBuffer())! as DecodeUnitBuffer;
+    default: return null;
+  }
+}
+
+export function unionListToUpdate(
+  type: Update, 
+  accessor: (index: number, obj:DecodeUnitBuffer|DecodeUnitStart|Setup) => DecodeUnitBuffer|DecodeUnitStart|Setup|null, 
+  index: number
+): DecodeUnitBuffer|DecodeUnitStart|Setup|null {
+  switch(Update[type]) {
+    case 'NONE': return null; 
+    case 'Setup': return accessor(index, new Setup())! as Setup;
+    case 'DecodeUnitStart': return accessor(index, new DecodeUnitStart())! as DecodeUnitStart;
+    case 'DecodeUnitBuffer': return accessor(index, new DecodeUnitBuffer())! as DecodeUnitBuffer;
+    default: return null;
+  }
+}
@@ -0,0 +1,69 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+import * as flatbuffers from 'flatbuffers';
+
+import { Update, unionToUpdate, unionListToUpdate } from '../video-update/update.js';
+
+
+export class VideoUpdate {
+  bb: flatbuffers.ByteBuffer|null = null;
+  bb_pos = 0;
+  __init(i:number, bb:flatbuffers.ByteBuffer):VideoUpdate {
+  this.bb_pos = i;
+  this.bb = bb;
+  return this;
+}
+
+static getRootAsVideoUpdate(bb:flatbuffers.ByteBuffer, obj?:VideoUpdate):VideoUpdate {
+  return (obj || new VideoUpdate()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+static getSizePrefixedRootAsVideoUpdate(bb:flatbuffers.ByteBuffer, obj?:VideoUpdate):VideoUpdate {
+  bb.setPosition(bb.position() + flatbuffers.SIZE_PREFIX_LENGTH);
+  return (obj || new VideoUpdate()).__init(bb.readInt32(bb.position()) + bb.position(), bb);
+}
+
+updateType():Update {
+  const offset = this.bb!.__offset(this.bb_pos, 4);
+  return offset ? this.bb!.readUint8(this.bb_pos + offset) : Update.NONE;
+}
+
+update<T extends flatbuffers.Table>(obj:any):any|null {
+  const offset = this.bb!.__offset(this.bb_pos, 6);
+  return offset ? this.bb!.__union(obj, this.bb_pos + offset) : null;
+}
+
+static startVideoUpdate(builder:flatbuffers.Builder) {
+  builder.startObject(2);
+}
+
+static addUpdateType(builder:flatbuffers.Builder, updateType:Update) {
+  builder.addFieldInt8(0, updateType, Update.NONE);
+}
+
+static addUpdate(builder:flatbuffers.Builder, updateOffset:flatbuffers.Offset) {
+  builder.addFieldOffset(1, updateOffset, 0);
+}
+
+static endVideoUpdate(builder:flatbuffers.Builder):flatbuffers.Offset {
+  const offset = builder.endObject();
+  return offset;
+}
+
+static finishVideoUpdateBuffer(builder:flatbuffers.Builder, offset:flatbuffers.Offset) {
+  builder.finish(offset);
+}
+
+static finishSizePrefixedVideoUpdateBuffer(builder:flatbuffers.Builder, offset:flatbuffers.Offset) {
+  builder.finish(offset, undefined, true);
+}
+
+static createVideoUpdate(builder:flatbuffers.Builder, updateType:Update, updateOffset:flatbuffers.Offset):flatbuffers.Offset {
+  VideoUpdate.startVideoUpdate(builder);
+  VideoUpdate.addUpdateType(builder, updateType);
+  VideoUpdate.addUpdate(builder, updateOffset);
+  return VideoUpdate.endVideoUpdate(builder);
+}
+}
@@ -0,0 +1,5 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+/* eslint-disable @typescript-eslint/no-unused-vars, @typescript-eslint/no-explicit-any, @typescript-eslint/no-non-null-assertion */
+
+export * as VideoUpdate from './video-update.js';
@@ -0,0 +1,189 @@
+import { VideoUpdate } from "$lib/proto/video";
+import { ByteBuffer } from "flatbuffers";
+import { DecodeUnitBuffer } from "./proto/video-update";
+import { DoorClosed, Video } from "lucide-svelte";
+
+function getVideoDecoder(canvasElement: OffscreenCanvas): VideoDecoder {
+  const canvasCtx: OffscreenCanvasRenderingContext2D | null = canvasElement.getContext('2d');
+  if (canvasCtx == null) {
+    throw new Error(`Could not get 2d canvas context`);
+  }
+
+  const videoDecoder = new VideoDecoder({
+    output: (frame) => {
+      //console.log(`rendering frame start: ${performance.now()}`);
+      //canvasElement.width = frame.displayWidth;
+      //canvasElement.height = frame.displayHeight;
+
+      //console.log(`rendering frame drawImage: ${performance.now()}`);
+      canvasCtx.drawImage(frame, 0, 0);
+
+      //console.log(`rendering frame end: ${performance.now()}`);
+      frame.close();
+      //console.log(`rendering frame close: ${performance.now()}`);
+    },
+    error: (e) => {
+      console.error('Decode error:', e);
+    }
+  });
+  return videoDecoder;
+}
+
+async function configureDecoder(videoDecoder: VideoDecoder, videoFormat: string, width: number, height: number) {
+  let config: VideoDecoderConfig = {
+    codec: videoFormat,
+    codedWidth: width,
+    codedHeight: height,
+    optimizeForLatency: true,
+    //hardwareAcceleration: "prefer-hardware",
+  };
+
+  const codecSupport = await VideoDecoder.isConfigSupported(config);
+  console.log(codecSupport);
+  if (codecSupport.supported) {
+    videoDecoder.configure(config);
+  } else {
+    throw new Error(`Could not configure decoder`);
+  }
+}
+
+class Decoder {
+  videoDecoder: VideoDecoder;
+
+  frameNumber: bigint | undefined;
+  frameType: EncodedAudioChunkType = "delta";
+  fullLength: bigint = 0n;
+  receiveTimeMs: number = 0;
+
+  //frameBroken: boolean = false;
+  //lastBufferIndex: bigint = 0n;
+  frameCollector: boolean[] = new Array<boolean>();
+  dataOffset: number = 0;
+  data: Uint8Array = new Uint8Array();
+
+  constructor(videoDecoder: VideoDecoder) {
+    this.videoDecoder = videoDecoder;
+  }
+
+  print() {
+    console.log(
+      `
+    frameNumber: ${this.frameNumber}
+    frameType: ${this.frameType}
+    fullLength: ${this.fullLength}
+    receiveTimeMs: ${this.receiveTimeMs}
+    frameCollector: ${this.frameCollector}
+    ts: ${performance.now()}
+    `
+    );
+  }
+
+  processStart(decodeUnitStart: VideoUpdate.DecodeUnitStart) {
+    //this.print();
+    const frameCompleted = !this.frameCollector.includes(false);
+    if (!frameCompleted) {
+      console.log(`Got setup packet for frame ${decodeUnitStart.frameNumber()} but the last frame has not been completed`);
+    }
+
+    this.frameNumber = decodeUnitStart.frameNumber();
+    this.frameType = "delta";
+    if (decodeUnitStart.frameType() == VideoUpdate.FrameType.IDR) {
+      this.frameType = "key";
+    }
+    this.fullLength = decodeUnitStart.fullLength();
+    this.receiveTimeMs = decodeUnitStart.receiveTimeMs();
+
+    //this.frameBroken = false;
+    //this.lastBufferIndex = -1n;
+    //this.dataOffset = 0;
+    this.frameCollector = new Array(Number(decodeUnitStart.numBuffers())).fill(false);
+
+    this.data = new Uint8Array(Number(this.fullLength));
+
+
+    //this.print();
+    //console.log(`start: `, this);
+    //console.log(performance.now());
+  }
+
+  processBuffer(decodeUnitBuffer: VideoUpdate.DecodeUnitBuffer) {
+    //console.log(`buffer: `, this);
+    //console.log(performance.now());
+    //this.print();
+
+
+    const frameNumber = decodeUnitBuffer.frameNumber();
+    if (this.frameNumber === undefined) {
+      console.log("frameNumber is undefined but we got a buffer, ignoring...");
+      return;
+    }
+    if (this.frameNumber != frameNumber) {
+      console.log(`Got buffer for frame ${frameNumber} but we are processing frame ${this.frameNumber}, ignoring...`);
+      return;
+    }
+
+    let offset = decodeUnitBuffer.bufferOffset();
+
+    for (var i = 0; i < decodeUnitBuffer.dataLength(); i++) {
+      this.data[Number(offset) + i] = decodeUnitBuffer.data(i)!;
+    }
+
+    this.frameCollector[Number(decodeUnitBuffer.bufferIndex())] = true;
+
+
+    const gotAllframes = !this.frameCollector.includes(false);
+
+    if (gotAllframes) {
+      const chunk = new EncodedVideoChunk({
+        //timestamp: this.receiveTimeMs,
+        timestamp: 0,
+        type: this.frameType,
+        data: this.data,
+      });
+
+      //console.log(`${ performance.now() }: Enqueing a new decode request, current queue size ${ this.videoDecoder.decodeQueueSize } `);
+      this.videoDecoder.decode(chunk);
+    }
+    //this.print();
+  }
+}
+
+export async function streamVideoFromReader(reader: ReadableStreamDefaultReader, canvasElement: OffscreenCanvas) {
+  const videoDecoder = getVideoDecoder(canvasElement);
+  try {
+    let decodeUnitBuffer: VideoUpdate.DecodeUnitBuffer = new VideoUpdate.DecodeUnitBuffer();
+    let decoder = new Decoder(videoDecoder);
+
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+
+      const dataToParse = new ByteBuffer(value);
+      const videoUpdate = VideoUpdate.VideoUpdate.getRootAsVideoUpdate(dataToParse);
+
+      if (videoUpdate.updateType() == VideoUpdate.Update.Setup) {
+        let setup = videoUpdate.update(new VideoUpdate.Setup());
+        await configureDecoder(videoDecoder, setup.videoFormat(), setup.width(), setup.height());
+
+      } else if (videoUpdate.updateType() == VideoUpdate.Update.DecodeUnitStart) {
+        let decodeUnitStart: VideoUpdate.DecodeUnitStart = new VideoUpdate.DecodeUnitStart();
+        videoUpdate.update(decodeUnitStart);
+        decoder.processStart(decodeUnitStart);
+
+      } else if (videoUpdate.updateType() == VideoUpdate.Update.DecodeUnitBuffer) {
+        videoUpdate.update(decodeUnitBuffer);
+        decoder.processBuffer(decodeUnitBuffer);
+
+      } else {
+        throw new Error(`Got packet of unknown type`);
+      }
+    }
+
+  } catch (e) {
+    var error = <Error>e;
+    console.error('Error connecting to stream:', error);
+    alert('Failed to connect to stream: ' + error.message);
+  }
+}
+
+
@@ -0,0 +1,57 @@
+<script lang="ts">
+	//import Header from './Header.svelte';
+	import '../app.css';
+
+	let { children } = $props();
+</script>
+
+<div class="app">
+	<!--<Header />-->
+
+	<main>
+		{@render children()}
+	</main>
+
+	<!--<footer>
+		<p>
+			visit <a href="https://svelte.dev/docs/kit">svelte.dev/docs/kit</a> to learn about SvelteKit
+		</p>
+	</footer>-->
+</div>
+
+<style>
+	.app {
+		display: flex;
+		flex-direction: column;
+		min-height: 100vh;
+	}
+
+	main {
+		/*flex: 1;*/
+		/*display: flex;*/
+		/*flex-direction: column;*/
+		/*padding: 1rem;*/
+		width: 100%;
+		/*max-width: 64rem;*/
+		margin: 0 auto;
+		box-sizing: border-box;
+	}
+
+	footer {
+		display: flex;
+		flex-direction: column;
+		justify-content: center;
+		align-items: center;
+		padding: 12px;
+	}
+
+	footer a {
+		font-weight: bold;
+	}
+
+	@media (min-width: 480px) {
+		footer {
+			padding: 12px 0;
+		}
+	}
+</style>
@@ -0,0 +1 @@
+export const ssr = false;
@@ -0,0 +1,24 @@
+<script lang="ts">
+	import Covers from './Covers.svelte';
+	import welcome from '$lib/images/svelte-welcome.webp';
+	import welcomeFallback from '$lib/images/svelte-welcome.png';
+</script>
+
+<svelte:head>
+	<title>Home</title>
+	<meta name="description" content="Svelte demo app" />
+</svelte:head>
+
+<section>
+	<Covers />
+</section>
+
+<style>
+	section {
+		display: flex;
+		flex-direction: column;
+		justify-content: center;
+		align-items: center;
+		flex: 0.6;
+	}
+</style>
@@ -0,0 +1,3 @@
+// since there's no dynamic data here, we can prerender
+// it so that it gets served as a static asset in production
+//export const prerender = true;
@@ -0,0 +1,179 @@
+<script lang="ts">
+	import type { HTMLButtonAttributes } from 'svelte/elements';
+	import { getStreamData } from './getStreamData';
+	import { type App } from './apps';
+	import { Circle } from 'svelte-loading-spinners';
+	import { goto } from '$app/navigation';
+	import { streamStore } from './stores/streamStore.svelte';
+
+	interface Props {
+		app: App;
+		server_name: string;
+		tab_index: number;
+	}
+
+	let { app, server_name, tab_index }: Props = $props();
+
+	let loading = $state(false);
+
+	async function streamApp() {
+		loading = true;
+
+		console.log(`Getting stream data for ${app.title} on ${server_name}`);
+		let streamData = await getStreamData(app.id, server_name);
+		streamStore.Url = streamData.Url;
+		streamStore.CertHash = streamData.CertHash;
+		streamStore.Width = streamData.Width;
+		streamStore.Height = streamData.Height;
+
+		console.log(`Stream data retrieved. Navigating to /stream.`);
+		await goto('/stream');
+	}
+</script>
+
+{#if loading}
+	<div class="app-box">
+		<div class="app-artwork">
+			<div class="app-loading-box">
+				<Circle size="60" color="#FF3E00" unit="px" duration="1s" />
+			</div>
+			{#if app.active}
+				<div class="running-pill">Running</div>
+			{/if}
+		</div>
+		<div class="app-title">{app.title}</div>
+		<div class="app-server">{server_name}</div>
+	</div>
+{:else}
+	<div class="app-box" onclick={streamApp} onkeydown={streamApp} role="button" tabindex={tab_index}>
+		<div class="app-artwork">
+			{#if app.active}
+				<div class="app-control-box">
+					<div class="resume-button"></div>
+					<div class="stop-button"></div>
+				</div>
+				<div class="running-pill">Running</div>
+			{:else}
+				<div class="app-control-box">
+					<div class="resume-button"></div>
+				</div>
+			{/if}
+		</div>
+		<div class="app-title">{app.title}</div>
+		<div class="app-server">{server_name}</div>
+	</div>
+{/if}
+
+<style>
+	.app-box {
+		position: relative;
+		width: 200px;
+		height: 280px;
+		cursor: pointer;
+		transition: all 0.3s ease;
+	}
+
+	.app-box:hover {
+		transform: translateY(-5px);
+		box-shadow: 0 10px 20px rgba(255, 255, 255, 0.1);
+	}
+
+	.app-artwork {
+		width: 200px;
+		height: 280px;
+		background-color: #333;
+		border: 2px solid #555;
+		border-radius: 8px;
+		position: relative;
+		overflow: hidden;
+		transition: border-color 0.3s ease;
+	}
+
+	.app-box:hover .app-artwork {
+		border-color: #00aaff;
+	}
+
+	.app-loading-box,
+	.app-control-box {
+		width: 200px;
+		height: 60px;
+		position: relative;
+		top: 50%;
+		transform: translate(0%, -50%);
+		opacity: 0;
+
+		display: flex;
+		justify-content: space-evenly;
+	}
+
+	.app-loading-box {
+		opacity: 1;
+	}
+
+	.app-box:hover .app-control-box {
+		opacity: 1;
+	}
+
+	.stop-button,
+	.resume-button {
+		width: 60px;
+		height: 60px;
+		border-radius: 50%;
+
+		background-color: rgba(0, 170, 255, 0.9);
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		transition: opacity 0.3s ease;
+		pointer-events: none;
+	}
+
+	.resume-button::after {
+		content: '';
+		width: 0;
+		height: 0;
+		border-left: 20px solid white;
+		border-top: 12px solid transparent;
+		border-bottom: 12px solid transparent;
+		margin-left: 4px;
+	}
+
+	.stop-button::after {
+		content: '';
+		width: 24px;
+		height: 24px;
+		background-color: white;
+	}
+
+	.running-pill {
+		position: absolute;
+		bottom: 12px;
+		left: 50%;
+		transform: translateX(-50%);
+		background-color: #22c55e;
+		color: white;
+		padding: 6px 16px;
+		border-radius: 20px;
+		font-size: 20px;
+		font-weight: 500;
+		text-align: center;
+		box-shadow: 0 2px 4px rgba(0, 0, 0, 0.2);
+	}
+
+	.app-title {
+		text-align: center;
+		margin: 10px 0 5px 0;
+		font-size: 16px;
+		font-weight: bold;
+		white-space: nowrap;
+		overflow: hidden;
+		text-overflow: ellipsis;
+	}
+
+	.app-server {
+		text-align: center;
+		font-size: 12px;
+		color: #aaa;
+		margin: 0;
+	}
+</style>
@@ -0,0 +1,36 @@
+<script lang="ts">
+	import Cover from './Cover.svelte';
+	import { fetchApps } from './apps';
+	import type { App } from './apps';
+
+	interface AppsResponse {
+		apps: Record<string, App[]>;
+	}
+
+	let appsPromise: Promise<AppsResponse>;
+
+	appsPromise = fetchApps();
+</script>
+
+{#await appsPromise}
+	<p>Loading...</p>
+{:then resp}
+	<div class="apps-container">
+		{#each Object.entries(resp.apps) as [server_name, apps]}
+			{#each apps as app, tab_index}
+				<Cover {app} {server_name} {tab_index}></Cover>
+			{/each}
+		{/each}
+	</div>
+{:catch error}
+	<p>Error: {error.message}</p>
+{/await}
+
+<style>
+	.apps-container {
+		display: flex;
+		flex-wrap: wrap;
+		gap: 20px;
+		padding: 20px 0;
+	}
+</style>
@@ -0,0 +1,129 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import logo from '$lib/images/svelte-logo.svg';
+	import github from '$lib/images/github.svg';
+</script>
+
+<header>
+	<div class="corner">
+		<a href="https://svelte.dev/docs/kit">
+			<img src={logo} alt="SvelteKit" />
+		</a>
+	</div>
+
+	<nav>
+		<svg viewBox="0 0 2 3" aria-hidden="true">
+			<path d="M0,0 L1,2 C1.5,3 1.5,3 2,3 L2,0 Z" />
+		</svg>
+		<ul>
+			<li aria-current={page.url.pathname === '/' ? 'page' : undefined}>
+				<a href="/">Home</a>
+			</li>
+			<li aria-current={page.url.pathname === '/about' ? 'page' : undefined}>
+				<a href="/about">About</a>
+			</li>
+			<li aria-current={page.url.pathname.startsWith('/sverdle') ? 'page' : undefined}>
+				<a href="/sverdle">Sverdle</a>
+			</li>
+		</ul>
+		<svg viewBox="0 0 2 3" aria-hidden="true">
+			<path d="M0,0 L0,3 C0.5,3 0.5,3 1,2 L2,0 Z" />
+		</svg>
+	</nav>
+
+	<div class="corner">
+		<a href="https://github.com/sveltejs/kit">
+			<img src={github} alt="GitHub" />
+		</a>
+	</div>
+</header>
+
+<style>
+	header {
+		display: flex;
+		justify-content: space-between;
+	}
+
+	.corner {
+		width: 3em;
+		height: 3em;
+	}
+
+	.corner a {
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		width: 100%;
+		height: 100%;
+	}
+
+	.corner img {
+		width: 2em;
+		height: 2em;
+		object-fit: contain;
+	}
+
+	nav {
+		display: flex;
+		justify-content: center;
+		--background: rgba(255, 255, 255, 0.7);
+	}
+
+	svg {
+		width: 2em;
+		height: 3em;
+		display: block;
+	}
+
+	path {
+		fill: var(--background);
+	}
+
+	ul {
+		position: relative;
+		padding: 0;
+		margin: 0;
+		height: 3em;
+		display: flex;
+		justify-content: center;
+		align-items: center;
+		list-style: none;
+		background: var(--background);
+		background-size: contain;
+	}
+
+	li {
+		position: relative;
+		height: 100%;
+	}
+
+	li[aria-current='page']::before {
+		--size: 6px;
+		content: '';
+		width: 0;
+		height: 0;
+		position: absolute;
+		top: 0;
+		left: calc(50% - var(--size));
+		border: var(--size) solid transparent;
+		border-top: var(--size) solid var(--color-theme-1);
+	}
+
+	nav a {
+		display: flex;
+		height: 100%;
+		align-items: center;
+		padding: 0 0.5rem;
+		color: var(--color-text);
+		font-weight: 700;
+		font-size: 0.8rem;
+		text-transform: uppercase;
+		letter-spacing: 0.1em;
+		text-decoration: none;
+		transition: color 0.2s linear;
+	}
+
+	a:hover {
+		color: var(--color-theme-1);
+	}
+</style>
@@ -0,0 +1,26 @@
+<svelte:head>
+	<title>About</title>
+	<meta name="description" content="About this app" />
+</svelte:head>
+
+<div class="text-column">
+	<h1>About this app</h1>
+
+	<p>
+		This is a <a href="https://svelte.dev/docs/kit">SvelteKit</a> app. You can make your own by typing
+		the following into your command line and following the prompts:
+	</p>
+
+	<pre>npx sv create</pre>
+
+	<p>
+		The page you're looking at is purely static HTML, with no client-side interactivity needed.
+		Because of that, we don't need to load any JavaScript. Try viewing the page's source, or opening
+		the devtools network panel and reloading.
+	</p>
+
+	<p>
+		The <a href="/sverdle">Sverdle</a> page illustrates SvelteKit's data loading and form handling. Try
+		using it with JavaScript disabled!
+	</p>
+</div>
@@ -0,0 +1,9 @@
+import { dev } from '$app/environment';
+
+// we don't need any JS on this page, though we'll load
+// it in dev so that we get hot module replacement
+export const csr = dev;
+
+// since there's no dynamic data here, we can prerender
+// it so that it gets served as a static asset in production
+export const prerender = true;
@@ -0,0 +1,20 @@
+export interface App {
+  title: string;
+  id: number;
+  hdr_supported: boolean;
+  active: boolean;
+}
+
+export interface AppsResponse {
+  apps: Record<string, App[]>;
+}
+
+
+export async function fetchApps() {
+  console.log('Getting apps');
+  const response = await fetch('/api/apps');
+  console.log(response);
+  const data = (await response.json()) as AppsResponse;
+  console.log(data);
+  return data;
+}
@@ -0,0 +1,59 @@
+type StreamData = {
+  Url: string,
+  CertHash: Array<number>,
+  Width: number,
+  Height: number,
+}
+
+export async function getStreamData(appId: number, server_name: string): Promise<StreamData> {
+  try {
+    // Create the POST request payload
+    const width = 1920;
+    const height = 1080;
+
+    const payload = {
+      id: appId,
+      server: server_name,
+      server_mode: {
+        fps: 60,
+        width: width,
+        height: height,
+      },
+      stream_config: {
+        bitrate_kbps: 1024 * 10 * 5,
+        mode: {
+          fps: 60,
+          width: width,
+          height: height,
+        }
+      }
+    };
+
+    // Make POST request to start stream
+    const response = await fetch('/api/stream/start', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify(payload)
+    });
+
+    if (!response.ok) {
+      throw new Error(`HTTP error! status: ${response.status}: ${await response.text()}`);
+    }
+
+    const streamDataResp = await response.json();
+    console.log('Stream started:', streamDataResp);
+
+    let streamData: StreamData = { Url: streamDataResp.url, CertHash: streamDataResp.cert_hash, Width: width, Height: height };
+    return streamData;
+
+
+  } catch (error) {
+    console.error('Error getting stream data: ', error);
+    throw new Error('Failed to start stream: ' + error);
+  }
+}
+
+
+
@@ -0,0 +1,6 @@
+export const streamStore = $state({
+  Url: '',
+  CertHash: [0],
+  Width: 0,
+  Height: 0,
+});
@@ -0,0 +1,32 @@
+<script lang="ts">
+	import Stream from './Stream.svelte';
+	import { streamStore } from '../stores/streamStore.svelte';
+
+	$: url = streamStore.Url;
+	$: certHash = streamStore.CertHash;
+	$: width = streamStore.Width;
+	$: height = streamStore.Height;
+</script>
+
+<svelte:head>
+	<title>Stream</title>
+	<meta name="description" content="Streaming game" />
+</svelte:head>
+
+<!--<section>
+</section>-->
+<Stream {url} {certHash} {width} {height} />
+
+<style>
+	section {
+		min-height: 100vh;
+		min-width: 100vw;
+	}
+	/*section {
+		display: flex;
+		flex-direction: column;
+		justify-content: center;
+		align-items: center;
+		flex: 0.6;
+	}*/
+</style>
@@ -0,0 +1,81 @@
+<script lang="ts">
+	import { onMount } from 'svelte';
+	import { startWebtransportStream } from './stream';
+	import StreamUi from './StreamUi.svelte';
+
+	interface Props {
+		url: string;
+		certHash: Array<number>;
+		width: number;
+		height: number;
+	}
+
+	let { url, certHash, width, height }: Props = $props();
+	let loading = $state(true);
+	let fullscreen = $state(false);
+	let gameplayView: HTMLDivElement;
+	let gameplayCanvas: HTMLCanvasElement;
+
+	async function startStream() {
+		await startWebtransportStream(
+			url,
+			certHash,
+			width,
+			height,
+			gameplayCanvas,
+			gameplayCanvas,
+			gameplayCanvas
+		);
+	}
+
+	async function requestFullscreen() {
+		// Update fullscreen var if fullscreen was exited outside our control
+		if (document.fullscreenElement == null) {
+			fullscreen = false;
+		}
+
+		if (fullscreen) {
+			await document.exitFullscreen();
+			fullscreen = false;
+		} else {
+			await gameplayCanvas.requestFullscreen();
+			fullscreen = true;
+		}
+	}
+
+	onMount(async () => {
+		await startStream();
+	});
+</script>
+
+<div id="gameplay-view" class="gameplay-view" bind:this={gameplayView}>
+	<canvas id="gamestream-canvas" class="gamestream-canvas" bind:this={gameplayCanvas} tabindex="0"
+	></canvas>
+	<StreamUi fullscreenFunc={requestFullscreen}></StreamUi>
+</div>
+
+<style>
+	.gameplay-view {
+		height: 100vh;
+		aspect-ratio: 16 / 9;
+
+		margin-left: auto;
+		margin-right: auto;
+		background-color: black;
+
+		position: relative;
+
+		display: flex;
+		flex-direction: column;
+	}
+
+	.gamestream-canvas {
+		height: 100%;
+		aspect-ratio: 16 / 9;
+
+		position: relative;
+		margin: auto;
+
+		/*z-index: 1;*/
+	}
+</style>
@@ -0,0 +1,57 @@
+<script lang="ts">
+	import { Maximize, Settings } from 'lucide-svelte';
+
+	interface Props {
+		fullscreenFunc: () => void;
+	}
+
+	let { fullscreenFunc }: Props = $props();
+</script>
+
+<div class="stream-controls">
+	<div style="flex-grow: 1"></div>
+	<div class="bar-button" role="button">
+		<Settings size="100%" />
+	</div>
+	<div style="width: 0.5%"></div>
+	<div class="bar-button" onclick={fullscreenFunc} role="button">
+		<Maximize size="100%" />
+	</div>
+	<div style="width: 0.5%"></div>
+</div>
+
+<style>
+	.bar-button {
+		height: 85%;
+		aspect-ratio: 1 / 1;
+		color: oklch(0.454 0 360);
+
+		transition:
+			transform 0.3s ease,
+			filter 0.3s ease;
+		/* Set transform origin to center so it grows from the middle */
+		transform-origin: center;
+	}
+	.bar-button:hover {
+		transform: scale(1.05);
+		filter: brightness(1.2);
+	}
+
+	.stream-controls {
+		height: 5%;
+		width: 100%;
+
+		/*position: absolute;*/
+
+		bottom: 0;
+		left: 0;
+
+		/*z-index: 2;*/
+
+		border-top-color: oklch(0.454 0 360);
+		border-top-width: 2px;
+
+		display: flex;
+		align-items: center;
+	}
+</style>
@@ -0,0 +1,99 @@
+import { sendKeyboardEvent, sendMouseInputEvent, sendMouseMoveEvent, KeyAction } from "$lib/input"
+import CanvasWorker from "$lib/canvas.worker?worker";
+
+export async function getStreamTransport(url: string, certHash: Array<number>): Promise<WebTransport> {
+  let certHashArray = new Uint8Array(certHash);
+
+  if (!window.WebTransport) {
+    throw new Error('WebTransport is not supported in this browser');
+  }
+
+  const transport = new WebTransport(url, {
+    //congestionControl: "low-latency",
+    serverCertificateHashes: [
+      {
+        algorithm: "sha-256",
+        value: certHashArray,
+      }
+    ]
+  });
+
+  console.log('Connecting to WebTransport at ', url);
+  await transport.ready;
+  console.log(`WebTransport connection established`);
+
+  return transport;
+}
+
+
+export async function spawnWorker(gameplayCanvas: HTMLCanvasElement, reader: ReadableStream) {
+  const offscreenCanvas = gameplayCanvas.transferControlToOffscreen();
+
+  const worker = new CanvasWorker();
+
+  worker.postMessage({
+    canvas: offscreenCanvas,
+    reader: reader,
+  }, [offscreenCanvas, reader]);
+
+}
+
+
+export async function startWebtransportStream(
+  url: string,
+  certHash: Array<number>,
+  width: number,
+  height: number,
+  gameplayCanvas: HTMLCanvasElement,
+  keyEventElement: HTMLElement,
+  mouseElement: HTMLElement,
+) {
+  console.log(width, height);
+  gameplayCanvas.width = width;
+  gameplayCanvas.height = height;
+
+
+  console.log(`Connecting to stream at ${url} with cert_hash ${certHash}`);
+  const transport = await getStreamTransport(url, certHash);
+
+  const datagrams = transport.datagrams;
+  datagrams.incomingHighWaterMark = 20000;
+  const stream = await transport.createBidirectionalStream();
+
+  //const reader = stream.readable
+  const datagramReader = datagrams.readable
+  const writer = stream.writable.getWriter();
+
+  spawnWorker(gameplayCanvas, datagramReader);
+
+  keyEventElement.addEventListener("keydown", (event: KeyboardEvent) => { sendKeyboardEvent(writer, event, KeyAction.DOWN) });
+  keyEventElement.addEventListener("keyup", (event: KeyboardEvent) => { sendKeyboardEvent(writer, event, KeyAction.UP) });
+
+  mouseElement.addEventListener("mousedown", (event: MouseEvent) => { sendMouseInputEvent(writer, event, KeyAction.DOWN) });
+  mouseElement.addEventListener("mouseup", (event: MouseEvent) => { sendMouseInputEvent(writer, event, KeyAction.UP) });
+
+
+  mouseElement.addEventListener("click", async () => {
+    console.log("Requesting pointer lock");
+    await mouseElement.requestPointerLock({
+      //unadjustedMovement: true,
+    });
+    console.log("Pointer lock aquired");
+  })
+
+  mouseElement.addEventListener("mousemove", (event: MouseEvent) => {
+    if (document.pointerLockElement === mouseElement) {
+      sendMouseMoveEvent(writer, event);
+    }
+  });
+
+
+  // Handle connection close
+  transport.closed
+    .then(() => {
+      console.log('WebTransport connection closed');
+    })
+    .catch((error) => {
+      console.error('WebTransport connection closed with error:', error);
+    });
+}
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.157 22.819c-10.4-14.885-30.94-19.297-45.792-9.835L22.282 29.608A29.92 29.92 0 0 0 8.764 49.65a31.5 31.5 0 0 0 3.108 20.231 30 30 0 0 0-4.477 11.183 31.9 31.9 0 0 0 5.448 24.116c10.402 14.887 30.942 19.297 45.791 9.835l26.083-16.624A29.92 29.92 0 0 0 98.235 78.35a31.53 31.53 0 0 0-3.105-20.232 30 30 0 0 0 4.474-11.182 31.88 31.88 0 0 0-5.447-24.116" style="fill:#ff3e00"/><path d="M45.817 106.582a20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.503 18 18 0 0 1 .624-2.435l.49-1.498 1.337.981a33.6 33.6 0 0 0 10.203 5.098l.97.294-.09.968a5.85 5.85 0 0 0 1.052 3.878 6.24 6.24 0 0 0 6.695 2.485 5.8 5.8 0 0 0 1.603-.704L69.27 76.28a5.43 5.43 0 0 0 2.45-3.631 5.8 5.8 0 0 0-.987-4.371 6.24 6.24 0 0 0-6.698-2.487 5.7 5.7 0 0 0-1.6.704l-9.953 6.345a19 19 0 0 1-5.296 2.326 20.72 20.72 0 0 1-22.237-8.243 19.17 19.17 0 0 1-3.277-14.502 17.99 17.99 0 0 1 8.13-12.052l26.081-16.623a19 19 0 0 1 5.3-2.329 20.72 20.72 0 0 1 22.237 8.243 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-.624 2.435l-.49 1.498-1.337-.98a33.6 33.6 0 0 0-10.203-5.1l-.97-.294.09-.968a5.86 5.86 0 0 0-1.052-3.878 6.24 6.24 0 0 0-6.696-2.485 5.8 5.8 0 0 0-1.602.704L37.73 51.72a5.42 5.42 0 0 0-2.449 3.63 5.79 5.79 0 0 0 .986 4.372 6.24 6.24 0 0 0 6.698 2.486 5.8 5.8 0 0 0 1.602-.704l9.952-6.342a19 19 0 0 1 5.295-2.328 20.72 20.72 0 0 1 22.237 8.242 19.17 19.17 0 0 1 3.277 14.503 18 18 0 0 1-8.13 12.053l-26.081 16.622a19 19 0 0 1-5.3 2.328" style="fill:#fff"/></svg>
@@ -0,0 +1,3 @@
+# https://www.robotstxt.org/robotstxt.html
+User-agent: *
+Disallow:
@@ -0,0 +1,12 @@
+import adapter from '@sveltejs/adapter-static';
+import { vitePreprocess } from '@sveltejs/vite-plugin-svelte';
+
+/** @type {import('@sveltejs/kit').Config} */
+const config = {
+	// Consult https://svelte.dev/docs/kit/integrations
+	// for more information about preprocessors
+	preprocess: vitePreprocess(),
+	kit: { adapter: adapter() }
+};
+
+export default config;
@@ -0,0 +1,19 @@
+{
+	"extends": "./.svelte-kit/tsconfig.json",
+	"compilerOptions": {
+		"allowJs": true,
+		"checkJs": true,
+		"esModuleInterop": true,
+		"forceConsistentCasingInFileNames": true,
+		"resolveJsonModule": true,
+		"skipLibCheck": true,
+		"sourceMap": true,
+		"strict": true,
+		"moduleResolution": "bundler"
+	}
+	// Path aliases are handled by https://svelte.dev/docs/kit/configuration#alias
+	// except $lib which is handled by https://svelte.dev/docs/kit/configuration#files
+	//
+	// If you want to overwrite includes/excludes, make sure to copy over the relevant includes/excludes
+	// from the referenced tsconfig.json - TypeScript does not merge them in
+}
@@ -0,0 +1,7 @@
+import tailwindcss from '@tailwindcss/vite';
+import { sveltekit } from '@sveltejs/kit/vite';
+import { defineConfig } from 'vite';
+
+export default defineConfig({
+	plugins: [tailwindcss(), sveltekit()]
+});
@@ -5,19 +5,38 @@ edition = "2024"

 [dependencies]
 anyhow = "1.0.98"
+argon2 = "0.5"
 directories = "6.0.0"
+flatbuffers = "25.2.10"
 getrandom = { version = "0.3.3", features = ["std"] }
+h3-datagram = "0.0.2"
+h3-quinn = "0.0.10"
 hex = "0.4.3"
+hmac-sha256 = "1.1.12"
+http = "1.3.1"
 libc = "0.2.174"
 moonlight-common-c-sys = { path = "../moonlight-common-c-sys" }
 openssl = "0.10.73"
 rand = "0.9.1"
+rusqlite = { version = "0.34", features = ["bundled"] }
 reqwest = { version = "0.12.20", features = [
  "rustls-tls",
+  "native-tls",
+  "json",
 ], default-features = false }
-salvo = { version = "0.79.0", features = ["oapi"] }
+salvo = { version = "0.80.0", features = [
+  "oapi",
+  "craft",
+  "logging",
+  "quinn",
+  "serve-static",
+] }
 serde = { version = "1.0.219", features = ["serde_derive"] }
 serde-xml-rs = "0.8.1"
+serde_json = "1.0.140"
 tokio = { version = "1.45.1", features = ["full"] }
+tracing = "0.1.41"
+tracing-subscriber = "0.3.19"
+url = { version = "2.5.4", features = ["serde"] }
 url-constructor = "0.1.0"
-uuid = { version = "1.17.0", features = ["v4"] }
+uuid = { version = "1.17.0", features = ["v4", "serde"] }
@@ -0,0 +1,148 @@
+use std::collections::HashMap;
+
+use salvo::prelude::*;
+use serde::{Deserialize, Serialize};
+use tracing::{debug, error};
+
+use crate::{
+    common,
+    common::{AppError, AppResult},
+    responses,
+    state::StateReader,
+};
+
+#[derive(Deserialize)]
+struct AppListRespApp {
+    #[serde(rename = "AppTitle")]
+    app_title: String,
+    //#[serde(rename = "UUID")]
+    //uuid: uuid::Uuid,
+    #[serde(rename = "IsHdrSupported")]
+    is_hdr_supported: bool,
+    #[serde(rename = "ID")]
+    id: u64,
+}
+
+#[derive(Deserialize)]
+struct AppListResp {
+    #[serde(rename = "App")]
+    apps: Vec<AppListRespApp>,
+}
+
+#[derive(Debug, Serialize, ToSchema)]
+struct App {
+    title: String,
+    id: u64,
+    hdr_supported: bool,
+    active: bool,
+}
+
+#[derive(Debug, Serialize, ToSchema)]
+struct GetAppsResponse {
+    apps: HashMap<String, Vec<App>>,
+}
+
+#[craft]
+impl crate::backend::Backend {
+    #[craft(endpoint(status_codes(StatusCode::OK, StatusCode::INTERNAL_SERVER_ERROR)))]
+    pub async fn get_apps(self: ::std::sync::Arc<Self>) -> AppResult<Json<GetAppsResponse>> {
+        let standard_error = Err(AppError {
+            status_code: StatusCode::INTERNAL_SERVER_ERROR,
+            description: "failed to get available apps".to_string(),
+        });
+
+        let reader = self.state.read().await;
+        let unique_id = match reader.unique_id() {
+            Ok(u) => u,
+            Err(e) => {
+                error!("could not get unique id: {e}");
+                return standard_error;
+            }
+        };
+
+        let servers = match reader.servers() {
+            Ok(s) => s,
+            Err(e) => {
+                error!("could not get servers: {e}");
+                return standard_error;
+            }
+        };
+
+        let mut get_apps_resp = GetAppsResponse {
+            apps: HashMap::new(),
+        };
+
+        for (_, server) in servers.into_iter() {
+            let mut server_info_base_url = common::base_url(
+                "https",
+                &server.host,
+                server.https_port(),
+                &unique_id,
+                "serverinfo",
+                None,
+            );
+
+            let server_info = match common::get_url(&mut server_info_base_url, true).await {
+                Ok(s) => s,
+                Err(e) => {
+                    error!("Could not get server_info: {}", e);
+                    return standard_error;
+                }
+            };
+            debug!("server_info: {server_info}");
+            let server_info: responses::ServerInfoResponse =
+                match serde_xml_rs::from_str(&server_info) {
+                    Ok(s) => s,
+                    Err(e) => {
+                        error!("Could not parse serverinfo response: {e}");
+                        return standard_error;
+                    }
+                };
+
+            let mut base_url = common::base_url(
+                "https",
+                &server.host,
+                server.https_port(),
+                &unique_id,
+                "applist",
+                None,
+            );
+
+            let resp = match common::get_url(&mut base_url, true).await {
+                Ok(r) => r,
+                Err(e) => {
+                    error!("could not get applist from server {}: {}", server.name, e);
+                    continue;
+                }
+            };
+            debug!(resp);
+
+            let applist_resp: AppListResp = match serde_xml_rs::from_str(&resp) {
+                Ok(r) => r,
+                Err(e) => {
+                    error!(
+                        "could not parse applist response from server {}: {}",
+                        server.name, e
+                    );
+                    continue;
+                }
+            };
+
+            let resp_vec = applist_resp
+                .apps
+                .into_iter()
+                .map(|a| App {
+                    title: a.app_title,
+                    hdr_supported: a.is_hdr_supported,
+                    id: a.id,
+                    active: a.id == server_info.currentgame,
+                })
+                .rev()
+                .collect();
+
+            get_apps_resp.apps.insert(server.name, resp_vec);
+        }
+
+        Ok(Json(get_apps_resp))
+    }
+}
@@ -0,0 +1,326 @@
+use std::sync::Arc;
+
+use salvo::prelude::*;
+use serde::{Deserialize, Serialize};
+use tracing::error;
+
+use crate::common::{AppError, AppResult};
+use crate::db::{AppPermission, Db, User};
+
+const SESSION_MAX_AGE_SECONDS: i64 = 7 * 24 * 3600; // 7 days
+
+// Key used to store the authenticated user in the Salvo Depot
+const USER_DEPOT_KEY: &str = "authenticated_user";
+
+pub fn get_user_from_depot(depot: &Depot) -> Option<&User> {
+    depot.get::<User>(USER_DEPOT_KEY).ok()
+}
+
+// -- Middleware --
+
+pub struct SessionAuthMiddleware {
+    pub db: Arc<Db>,
+}
+
+#[handler]
+impl SessionAuthMiddleware {
+    async fn handle(&self, req: &mut Request, depot: &mut Depot, res: &mut Response, ctrl: &mut FlowCtrl) {
+        let token = req
+            .headers()
+            .get("authorization")
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.strip_prefix("Bearer "));
+
+        let token = match token {
+            Some(t) => t,
+            None => {
+                res.status_code(StatusCode::UNAUTHORIZED);
+                Json(serde_json::json!({"description": "Missing or invalid Authorization header"})).render(res);
+                ctrl.skip_rest();
+                return;
+            }
+        };
+
+        match self.db.validate_session(token) {
+            Ok(Some(user)) => {
+                depot.insert(USER_DEPOT_KEY, user);
+            }
+            Ok(None) => {
+                res.status_code(StatusCode::UNAUTHORIZED);
+                Json(serde_json::json!({"description": "Invalid or expired session"})).render(res);
+                ctrl.skip_rest();
+                return;
+            }
+            Err(e) => {
+                error!("Session validation error: {e}");
+                res.status_code(StatusCode::INTERNAL_SERVER_ERROR);
+                Json(serde_json::json!({"description": "Internal server error"})).render(res);
+                ctrl.skip_rest();
+                return;
+            }
+        }
+    }
+}
+
+pub struct AdminCheckMiddleware;
+
+#[handler]
+impl AdminCheckMiddleware {
+    async fn handle(&self, _req: &mut Request, depot: &mut Depot, res: &mut Response, ctrl: &mut FlowCtrl) {
+        let user = match get_user_from_depot(depot) {
+            Some(u) => u,
+            None => {
+                res.status_code(StatusCode::UNAUTHORIZED);
+                Json(serde_json::json!({"description": "Not authenticated"})).render(res);
+                ctrl.skip_rest();
+                return;
+            }
+        };
+
+        if !user.is_admin {
+            res.status_code(StatusCode::FORBIDDEN);
+            Json(serde_json::json!({"description": "Admin access required"})).render(res);
+            ctrl.skip_rest();
+            return;
+        }
+    }
+}
+
+// -- Request/Response types --
+
+#[derive(Deserialize, ToSchema)]
+pub struct LoginRequest {
+    pub username: String,
+    pub password: String,
+}
+
+#[derive(Serialize, ToSchema)]
+pub struct LoginResponse {
+    pub token: String,
+}
+
+#[derive(Serialize, ToSchema)]
+pub struct MeResponse {
+    pub username: String,
+    pub is_admin: bool,
+    pub permissions: Vec<AppPermission>,
+}
+
+#[derive(Deserialize, ToSchema)]
+pub struct CreateUserRequest {
+    pub username: String,
+    pub password: String,
+    pub is_admin: bool,
+}
+
+#[derive(Deserialize, ToSchema)]
+pub struct UpdateUserRequest {
+    pub password: Option<String>,
+    pub is_admin: Option<bool>,
+}
+
+#[derive(Deserialize, ToSchema)]
+pub struct SetPermissionsRequest {
+    pub permissions: Vec<AppPermission>,
+}
+
+// -- Auth endpoint handlers --
+
+#[craft]
+impl crate::backend::Backend {
+    #[craft(handler)]
+    pub async fn login(
+        self: Arc<Self>,
+        body: salvo::oapi::extract::JsonBody<LoginRequest>,
+    ) -> AppResult<Json<LoginResponse>> {
+        let user = match self.db.verify_password(&body.username, &body.password) {
+            Ok(Some(u)) => u,
+            Ok(None) => {
+                return Err(AppError {
+                    status_code: StatusCode::UNAUTHORIZED,
+                    description: "Invalid username or password".to_string(),
+                });
+            }
+            Err(e) => {
+                error!("Login error: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Internal server error".to_string(),
+                });
+            }
+        };
+
+        let token = match self.db.create_session(&user.id, SESSION_MAX_AGE_SECONDS) {
+            Ok(t) => t,
+            Err(e) => {
+                error!("Session creation error: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Internal server error".to_string(),
+                });
+            }
+        };
+
+        Ok(Json(LoginResponse { token }))
+    }
+
+    #[craft(handler)]
+    pub async fn logout(self: Arc<Self>, req: &mut Request) -> AppResult<Json<serde_json::Value>> {
+        let token = req
+            .headers()
+            .get("authorization")
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.strip_prefix("Bearer "))
+            .unwrap_or("");
+
+        let _ = self.db.delete_session(token);
+
+        Ok(Json(serde_json::json!({"status": "ok"})))
+    }
+
+    #[craft(handler)]
+    pub async fn me(self: Arc<Self>, depot: &mut Depot) -> AppResult<Json<MeResponse>> {
+        let user = match get_user_from_depot(depot) {
+            Some(u) => u.clone(),
+            None => {
+                return Err(AppError {
+                    status_code: StatusCode::UNAUTHORIZED,
+                    description: "Not authenticated".to_string(),
+                });
+            }
+        };
+
+        let permissions = self.db.get_permissions(&user.id).unwrap_or_default();
+
+        Ok(Json(MeResponse {
+            username: user.username,
+            is_admin: user.is_admin,
+            permissions,
+        }))
+    }
+
+    // -- Admin endpoint handlers --
+
+    #[craft(handler)]
+    pub async fn admin_list_users(self: Arc<Self>) -> AppResult<Json<Vec<User>>> {
+        match self.db.list_users() {
+            Ok(users) => Ok(Json(users)),
+            Err(e) => {
+                error!("List users error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Failed to list users".to_string(),
+                })
+            }
+        }
+    }
+
+    #[craft(handler)]
+    pub async fn admin_create_user(
+        self: Arc<Self>,
+        body: salvo::oapi::extract::JsonBody<CreateUserRequest>,
+    ) -> AppResult<Json<User>> {
+        match self
+            .db
+            .create_user(&body.username, &body.password, body.is_admin)
+        {
+            Ok(user) => Ok(Json(user)),
+            Err(e) => {
+                error!("Create user error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::BAD_REQUEST,
+                    description: format!("Failed to create user: {e}"),
+                })
+            }
+        }
+    }
+
+    #[craft(handler)]
+    pub async fn admin_update_user(
+        self: Arc<Self>,
+        req: &mut Request,
+        body: salvo::oapi::extract::JsonBody<UpdateUserRequest>,
+    ) -> AppResult<Json<serde_json::Value>> {
+        let user_id = req.param::<String>("id").unwrap_or_default();
+
+        match self
+            .db
+            .update_user(&user_id, body.password.as_deref(), body.is_admin)
+        {
+            Ok(true) => Ok(Json(serde_json::json!({"status": "ok"}))),
+            Ok(false) => Err(AppError {
+                status_code: StatusCode::NOT_FOUND,
+                description: "User not found".to_string(),
+            }),
+            Err(e) => {
+                error!("Update user error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Failed to update user".to_string(),
+                })
+            }
+        }
+    }
+
+    #[craft(handler)]
+    pub async fn admin_delete_user(
+        self: Arc<Self>,
+        req: &mut Request,
+    ) -> AppResult<Json<serde_json::Value>> {
+        let user_id = req.param::<String>("id").unwrap_or_default();
+
+        match self.db.delete_user(&user_id) {
+            Ok(true) => Ok(Json(serde_json::json!({"status": "ok"}))),
+            Ok(false) => Err(AppError {
+                status_code: StatusCode::NOT_FOUND,
+                description: "User not found".to_string(),
+            }),
+            Err(e) => {
+                error!("Delete user error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Failed to delete user".to_string(),
+                })
+            }
+        }
+    }
+
+    #[craft(handler)]
+    pub async fn admin_get_permissions(
+        self: Arc<Self>,
+        req: &mut Request,
+    ) -> AppResult<Json<Vec<AppPermission>>> {
+        let user_id = req.param::<String>("id").unwrap_or_default();
+
+        match self.db.get_permissions(&user_id) {
+            Ok(perms) => Ok(Json(perms)),
+            Err(e) => {
+                error!("Get permissions error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Failed to get permissions".to_string(),
+                })
+            }
+        }
+    }
+
+    #[craft(handler)]
+    pub async fn admin_set_permissions(
+        self: Arc<Self>,
+        req: &mut Request,
+        body: salvo::oapi::extract::JsonBody<SetPermissionsRequest>,
+    ) -> AppResult<Json<serde_json::Value>> {
+        let user_id = req.param::<String>("id").unwrap_or_default();
+
+        match self.db.set_permissions(&user_id, &body.permissions) {
+            Ok(()) => Ok(Json(serde_json::json!({"status": "ok"}))),
+            Err(e) => {
+                error!("Set permissions error: {e}");
+                Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Failed to set permissions".to_string(),
+                })
+            }
+        }
+    }
+}
@@ -0,0 +1,114 @@
+use std::collections::HashMap;
+
+use anyhow::Result;
+use salvo::oapi::ToSchema;
+use serde::{Deserialize, Serialize};
+use tokio::sync::RwLock;
+
+use crate::db::Db;
+use crate::state::StateFile;
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct InputCrypto {
+    pub aes_key: [u8; 16],
+    pub aes_iv: [u8; 16],
+}
+
+impl InputCrypto {
+    pub fn new() -> Result<Self> {
+        let mut aes_key = [0u8; 16];
+        let mut aes_iv = [0u8; 16];
+        openssl::rand::rand_bytes(&mut aes_key)?;
+        openssl::rand::rand_bytes(&mut aes_iv)?;
+
+        Ok(InputCrypto { aes_key, aes_iv })
+    }
+
+    pub fn as_url_params(&self) -> (String, String) {
+        let aes_key_hex = hex::encode(self.aes_key);
+
+        // not sure why we have to do this but I'm just matching the embedded client behavior
+        // 1. Generate 16 random bytes
+        // 2. memcpy the first 4 bytes to a u32 (from_le_bytes)
+        // 3. Convert that u32 to network order (to_be) and convert it to a string with %d
+        //    (to_string)
+        let aes_iv_array = <[u8; 4]>::try_from(&self.aes_iv[0..4]).unwrap();
+        let aes_iv_u32 = u32::from_le_bytes(aes_iv_array);
+        let aes_iv_string = aes_iv_u32.to_be().to_string();
+        (aes_key_hex, aes_iv_string)
+    }
+
+    pub fn as_stream_config_params(&self) -> ([i8; 16], [i8; 16]) {
+        let aes_key_ptr = &self.aes_key as *const [u8; 16];
+        let aes_key_ptr_i8 = aes_key_ptr as *const [i8; 16];
+        let aes_key_i8 = unsafe { *aes_key_ptr_i8 };
+
+        let aes_iv_ptr = &self.aes_iv as *const [u8; 16];
+        let aes_iv_ptr_i8 = aes_iv_ptr as *const [i8; 16];
+        let aes_iv_i8 = unsafe { *aes_iv_ptr_i8 };
+
+        (aes_key_i8, aes_iv_i8)
+    }
+}
+
+#[derive(Debug, Clone, ToSchema, Serialize, Deserialize)]
+pub struct Mode {
+    pub width: i32,
+    pub height: i32,
+    pub fps: i32,
+}
+
+impl Mode {
+    pub fn as_url_string(&self) -> String {
+        format!("{}x{}x{}", self.width, self.height, self.fps)
+    }
+}
+
+#[derive(Debug, Clone, ToSchema, Serialize, Deserialize)]
+pub struct StreamConfig {
+    pub mode: Mode,
+    pub bitrate_kbps: i32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Stream {
+    pub id: uuid::Uuid,
+
+    pub url: url::Url,
+    pub game_session: u64,
+
+    pub server_address: String,
+    pub input_crypto: InputCrypto,
+    pub stream_config: StreamConfig,
+
+    pub app_version: String,
+    pub gfe_version: String,
+    pub server_codec_mode_support: i32,
+}
+
+pub struct Backend {
+    pub state: StateFile,
+    pub streams: RwLock<HashMap<uuid::Uuid, Stream>>,
+    pub port: u16,
+    pub db: Db,
+}
+
+impl Backend {
+    pub fn new(port: u16) -> Result<Self> {
+        let project_dirs =
+            directories::ProjectDirs::from("xyz", "ohea", "gamestream-webtransport-proxy")
+                .ok_or(anyhow::anyhow!("Could not get project dirs"))?;
+        let data_dir = project_dirs.data_dir();
+        std::fs::create_dir_all(data_dir)?;
+        let db_path = data_dir.join("auth.db");
+
+        let db = Db::open(&db_path)?;
+
+        Ok(Backend {
+            state: StateFile::new()?,
+            streams: RwLock::new(HashMap::new()),
+            port,
+            db,
+        })
+    }
+}
@@ -0,0 +1,254 @@
+use std::fs;
+use std::io::Write;
+use std::path::PathBuf;
+
+use anyhow::Result;
+use openssl::ec::{EcGroup, EcKey};
+use openssl::hash::MessageDigest;
+use openssl::nid::Nid;
+use openssl::pkey::{PKey, Private};
+use openssl::rsa::Rsa;
+use openssl::x509::{X509, X509NameBuilder};
+use salvo::conn::rustls::{Keycert, RustlsConfig};
+use tracing::debug;
+
+pub fn get_and_create_cert_dir() -> Result<PathBuf> {
+    let project_dirs =
+        directories::ProjectDirs::from("xyz", "ohea", "gamestream-webtransport-proxy")
+            .ok_or(anyhow::anyhow!("Could not get project dirs"))?;
+    let data_dir = project_dirs.data_dir();
+    let cert_dir = data_dir.join("certs");
+    fs::create_dir_all(&cert_dir)?;
+
+    Ok(cert_dir)
+}
+
+pub fn get_gamestream_cert_and_key() -> Result<(X509, PKey<Private>)> {
+    if let Ok((cert, key)) = load_cert_and_key_from_disk("gamestream-cert", "gamestream-key") {
+        Ok((cert, key))
+    } else {
+        generate_gamestream_cert_and_key()
+    }
+}
+
+pub fn get_http_stream_config() -> Result<RustlsConfig> {
+    let (cert, key) = match load_cert_and_key_from_disk("http-cert", "http-key") {
+        Ok((cert, key)) => (cert, key),
+        Err(_) => generate_http_cert_and_key(false, "http-cert", "http-key")?,
+    };
+
+    Ok(RustlsConfig::new(
+        Keycert::new()
+            .cert(cert.to_pem()?)
+            .key(key.private_key_to_pem_pkcs8()?),
+    ))
+}
+
+fn calculate_cert_hash(cert: &X509) -> Result<[u8; 32]> {
+    //fn calculate_cert_hash(cert: &X509) -> Result<String> {
+    let cert_hash = openssl::hash::hash(openssl::hash::MessageDigest::sha256(), &cert.to_der()?)?;
+    //Ok(hex::encode(cert_hash))
+    debug!("cert_hash: {}", hex::encode(cert_hash));
+    Ok(hmac_sha256::Hash::hash(&cert.to_der()?))
+}
+
+pub fn get_webtransport_stream_config(id: uuid::Uuid) -> Result<(RustlsConfig, [u8; 32])> {
+    //pub fn get_webtransport_stream_config(id: uuid::Uuid) -> Result<(RustlsConfig, String)> {
+    let (cert_filename, key_filename) = (&format!("{id}-cert"), &format!("{id}-key"));
+    let (cert, key) = match load_cert_and_key_from_disk(cert_filename, key_filename) {
+        Ok((cert, key)) => (cert, key),
+        Err(_) => generate_http_cert_and_key(true, cert_filename, key_filename)?,
+    };
+
+    let hash = calculate_cert_hash(&cert)?;
+
+    Ok((
+        RustlsConfig::new(
+            Keycert::new()
+                .cert(cert.to_pem()?)
+                .key(key.private_key_to_pem_pkcs8()?),
+        ),
+        hash,
+    ))
+}
+
+fn load_cert_and_key_from_disk(
+    cert_filename: &str,
+    key_filename: &str,
+) -> Result<(X509, PKey<Private>)> {
+    let cert_dir = get_and_create_cert_dir()?;
+
+    let cert_filepath = cert_dir.join(cert_filename);
+    let key_filepath = cert_dir.join(key_filename);
+
+    let cert_bytes = fs::read(cert_filepath)?;
+    let key_bytes = fs::read(key_filepath)?;
+
+    let cert = X509::from_pem(&cert_bytes)?;
+    let key = PKey::<Private>::private_key_from_pem(&key_bytes)?;
+
+    Ok((cert, key))
+}
+
+fn generate_http_cert_and_key(
+    web_transport: bool,
+    cert_filename: &str,
+    key_filename: &str,
+) -> Result<(X509, PKey<Private>)> {
+    let key = if web_transport {
+        let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)?;
+        let eckey = EcKey::generate(&group)?;
+        PKey::from_ec_key(eckey)?
+    } else {
+        let rsa = Rsa::generate(2048)?;
+        PKey::from_rsa(rsa)?
+    };
+
+    let mut cert_builder = X509::builder()?;
+
+    let now_unix = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .expect("Time went backwards")
+        .as_secs();
+    let now = openssl::asn1::Asn1Time::from_unix(now_unix as i64)?;
+
+    let expiration_time = if web_transport {
+        openssl::asn1::Asn1Time::days_from_now(12)?
+    } else {
+        openssl::asn1::Asn1Time::days_from_now(365 * 5)?
+    };
+
+    cert_builder.set_version(2)?;
+
+    let serial = openssl::bn::BigNum::from_u32(1)?;
+    let asn_serial = openssl::asn1::Asn1Integer::from_bn(&serial)?;
+    cert_builder.set_serial_number(&asn_serial)?;
+
+    // Set subject (Distinguished Name)
+    let mut name_builder = X509NameBuilder::new()?;
+    name_builder.append_entry_by_text("CN", "localhost")?;
+    let subject_name = name_builder.build();
+    cert_builder.set_subject_name(&subject_name)?;
+    cert_builder.set_issuer_name(&subject_name)?;
+
+    let context = cert_builder.x509v3_context(None, None);
+
+    let mut san = openssl::x509::extension::SubjectAlternativeName::new();
+    san.dns("localhost");
+
+    let san_extension = san.build(&context)?;
+
+    let key_usage = openssl::x509::extension::KeyUsage::new()
+        .digital_signature()
+        .key_encipherment()
+        .build()?;
+
+    let ext_key_usage = openssl::x509::extension::ExtendedKeyUsage::new()
+        .server_auth()
+        .build()?;
+
+    // Add Subject Key Identifier
+    let subject_key_id = openssl::x509::extension::SubjectKeyIdentifier::new().build(&context)?;
+
+    cert_builder.append_extension(san_extension)?;
+    cert_builder.append_extension(key_usage)?;
+    cert_builder.append_extension(ext_key_usage)?;
+    cert_builder.append_extension(subject_key_id)?;
+
+    cert_builder.set_not_before(&now)?;
+    cert_builder.set_not_after(&expiration_time)?;
+    cert_builder.set_pubkey(&key)?;
+    cert_builder.sign(&key, MessageDigest::sha256())?;
+    let cert = cert_builder.build();
+
+    save_cert_and_key_to_disk(&cert, &key, cert_filename, key_filename)?;
+
+    Ok((cert, key))
+}
+
+fn generate_gamestream_cert_and_key() -> Result<(X509, PKey<Private>)> {
+    let rsa = Rsa::generate(2048)?;
+    let key = PKey::from_rsa(rsa)?;
+
+    let mut cert_builder = X509::builder()?;
+
+    let serial_number_u32 = openssl::bn::BigNum::from_u32(0)?;
+    let serial_number = openssl::asn1::Asn1Integer::from_bn(&serial_number_u32)?;
+
+    let now_unix = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .expect("Time went backwards")
+        .as_secs()
+        - 1000000;
+    let now = openssl::asn1::Asn1Time::from_unix(now_unix as i64)?;
+    let ten_years_from_now = openssl::asn1::Asn1Time::days_from_now(365 * 10)?;
+
+    let mut x509_name_builder = openssl::x509::X509NameBuilder::new()?;
+    x509_name_builder.append_entry_by_text("CN", "NVIDIA GameStream Client")?;
+    let x509_name = x509_name_builder.build();
+
+    cert_builder.set_version(2)?;
+    cert_builder.set_not_before(&now)?;
+    cert_builder.set_not_after(&ten_years_from_now)?;
+    cert_builder.set_pubkey(&key)?;
+    cert_builder.set_serial_number(&serial_number)?;
+    cert_builder.set_issuer_name(&x509_name)?;
+    cert_builder.set_subject_name(&x509_name)?;
+    cert_builder.sign(&key, MessageDigest::sha256())?;
+    let cert = cert_builder.build();
+
+    save_cert_and_key_to_disk(&cert, &key, "gamestream-cert", "gamestream-key")?;
+
+    Ok((cert, key))
+}
+
+fn save_cert_and_key_to_disk(
+    cert: &X509,
+    key: &PKey<Private>,
+    cert_filename: &str,
+    key_filename: &str,
+) -> Result<()> {
+    let cert_dir = get_and_create_cert_dir()?;
+    let cert_filepath = cert_dir.join(cert_filename);
+    let key_filepath = cert_dir.join(key_filename);
+
+    let mut cert_file_builder = std::fs::OpenOptions::new();
+    cert_file_builder.create(true);
+    cert_file_builder.truncate(true);
+    cert_file_builder.write(true);
+
+    let mut key_file_builder = std::fs::OpenOptions::new();
+    key_file_builder.create(true);
+    key_file_builder.truncate(true);
+    key_file_builder.write(true);
+
+    #[cfg(target_family = "unix")]
+    {
+        use std::os::unix::fs::OpenOptionsExt;
+
+        key_file_builder.mode(0o600);
+        cert_file_builder.mode(0o600);
+    }
+
+    let mut cert_file = cert_file_builder.open(&cert_filepath)?;
+    let mut key_file = key_file_builder.open(&key_filepath)?;
+
+    cert_file.write_all(&cert.to_pem()?)?;
+    key_file.write_all(&key.private_key_to_pem_pkcs8()?)?;
+
+    Ok(())
+}
+
+pub fn gamestream_identity() -> Result<reqwest::tls::Identity> {
+    let cert_dir = get_and_create_cert_dir()?;
+    let cert_filepath = cert_dir.join("gamestream-cert");
+    let key_filepath = cert_dir.join("gamestream-key");
+
+    let cert_bytes = fs::read(cert_filepath)?;
+    let key_bytes = fs::read(key_filepath)?;
+
+    Ok(reqwest::tls::Identity::from_pkcs8_pem(
+        &cert_bytes,
+        &key_bytes,
+    )?)
+}
@@ -0,0 +1,96 @@
+use anyhow::Result;
+use salvo::oapi::{self, EndpointOutRegister, ToSchema};
+use salvo::prelude::*;
+use serde::Serialize;
+use tracing::debug;
+
+#[derive(Debug, Serialize, ToSchema)]
+struct ApiError {
+    pub description: String,
+}
+
+#[derive(Debug)]
+pub struct AppError {
+    pub status_code: StatusCode,
+    pub description: String,
+}
+
+pub type AppResult<T> = Result<T, AppError>;
+
+#[async_trait]
+impl Writer for AppError {
+    async fn write(self, _: &mut Request, _depot: &mut Depot, res: &mut Response) {
+        res.status_code = Some(self.status_code);
+        Json(ApiError {
+            description: self.description,
+        })
+        .render(res)
+    }
+}
+
+impl EndpointOutRegister for AppError {
+    fn register(components: &mut oapi::Components, operation: &mut oapi::Operation) {
+        let errors = vec![
+            StatusError::not_found(),
+            StatusError::request_timeout(),
+            StatusError::internal_server_error(),
+        ];
+        for StatusError { code, brief, .. } in errors {
+            operation.responses.insert(
+                code.as_str(),
+                oapi::Response::new(brief)
+                    .add_content("application/json", ApiError::to_schema(components)),
+            )
+        }
+    }
+}
+
+pub fn base_url(
+    scheme: &str,
+    host: &String,
+    base_port: u16,
+    unique_id: &String,
+    path: &str,
+    params: Option<Vec<(&str, &str)>>,
+) -> url_constructor::UrlConstructor {
+    let mut base_url = url_constructor::UrlConstructor::new();
+    base_url
+        .scheme(scheme)
+        .host(host)
+        .port(base_port)
+        .subdir(path)
+        .param("uniqueid", unique_id);
+
+    if let Some(p) = params {
+        for (k, v) in p.into_iter() {
+            base_url.param(k, v);
+        }
+    }
+    base_url
+}
+
+pub async fn get_url(
+    base_url: &mut url_constructor::UrlConstructor,
+    with_identity: bool,
+) -> Result<String> {
+    let mut uuidv2 = [0u8; 16];
+    openssl::rand::rand_bytes(&mut uuidv2)?;
+    let uuidv2_hex = hex::encode(uuidv2);
+
+    let url = base_url.param("uuid", uuidv2_hex).build();
+    debug!("Getting url: {url}");
+
+    let mut http_builder = reqwest::Client::builder();
+    http_builder = http_builder.user_agent("Mozilla/5.0");
+    http_builder = http_builder.danger_accept_invalid_certs(true);
+    if with_identity {
+        let identity = crate::certs::gamestream_identity()?;
+        http_builder = http_builder.identity(identity);
+    }
+
+    let client = http_builder.build()?;
+
+    let resp = client.get(url).send().await?;
+    let text = resp.text().await?;
+    Ok(text)
+}
@@ -0,0 +1,659 @@
+use std::path::Path;
+use std::sync::Mutex;
+
+use anyhow::{Context, Result};
+use argon2::{
+    Argon2,
+    password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString, rand_core::OsRng},
+};
+use salvo::oapi::ToSchema;
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct User {
+    pub id: String,
+    pub username: String,
+    pub is_admin: bool,
+    pub created_at: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, ToSchema)]
+pub struct AppPermission {
+    pub server: String,
+    pub app_id: i64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Session {
+    pub token: String,
+    pub user_id: String,
+    pub created_at: String,
+    pub expires_at: String,
+}
+
+pub struct Db {
+    conn: Mutex<rusqlite::Connection>,
+}
+
+impl Db {
+    pub fn open(path: &Path) -> Result<Self> {
+        let conn = rusqlite::Connection::open(path)?;
+        let db = Db {
+            conn: Mutex::new(conn),
+        };
+        db.init()?;
+        Ok(db)
+    }
+
+    fn init(&self) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute_batch("PRAGMA foreign_keys = ON;")?;
+        conn.execute_batch(
+            "CREATE TABLE IF NOT EXISTS users (
+                id         TEXT PRIMARY KEY,
+                username   TEXT UNIQUE NOT NULL,
+                password   TEXT NOT NULL,
+                is_admin   INTEGER NOT NULL DEFAULT 0,
+                created_at TEXT NOT NULL
+            );
+
+            CREATE TABLE IF NOT EXISTS user_app_permissions (
+                user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                server     TEXT NOT NULL,
+                app_id     INTEGER NOT NULL,
+                PRIMARY KEY (user_id, server, app_id)
+            );
+
+            CREATE TABLE IF NOT EXISTS sessions (
+                token      TEXT PRIMARY KEY,
+                user_id    TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+                created_at TEXT NOT NULL,
+                expires_at TEXT NOT NULL
+            );",
+        )?;
+        Ok(())
+    }
+
+    pub fn seed_admin_if_needed(&self) -> Result<Option<(String, String)>> {
+        let conn = self.conn.lock().unwrap();
+        let count: i64 = conn.query_row("SELECT COUNT(*) FROM users", [], |row| row.get(0))?;
+        if count > 0 {
+            return Ok(None);
+        }
+        drop(conn);
+
+        let password = generate_random_password();
+        let user = self.create_user("admin", &password, true)?;
+        Ok(Some((user.username, password)))
+    }
+
+    pub fn create_user(&self, username: &str, password: &str, is_admin: bool) -> Result<User> {
+        let id = uuid::Uuid::new_v4().to_string();
+        let password_hash = hash_password(password)?;
+        let created_at = now_iso8601();
+
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "INSERT INTO users (id, username, password, is_admin, created_at) VALUES (?1, ?2, ?3, ?4, ?5)",
+            rusqlite::params![id, username, password_hash, is_admin as i32, created_at],
+        ).context("Failed to create user (username may already exist)")?;
+
+        Ok(User {
+            id,
+            username: username.to_string(),
+            is_admin,
+            created_at,
+        })
+    }
+
+    pub fn verify_password(&self, username: &str, password: &str) -> Result<Option<User>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, username, password, is_admin, created_at FROM users WHERE username = ?1",
+        )?;
+
+        let mut rows = stmt.query(rusqlite::params![username])?;
+        let row = match rows.next()? {
+            Some(r) => r,
+            None => return Ok(None),
+        };
+
+        let id: String = row.get(0)?;
+        let uname: String = row.get(1)?;
+        let stored_hash: String = row.get(2)?;
+        let is_admin: bool = row.get::<_, i32>(3)? != 0;
+        let created_at: String = row.get(4)?;
+
+        let parsed_hash =
+            PasswordHash::new(&stored_hash).map_err(|e| anyhow::anyhow!("Invalid hash: {e}"))?;
+        if Argon2::default()
+            .verify_password(password.as_bytes(), &parsed_hash)
+            .is_err()
+        {
+            return Ok(None);
+        }
+
+        Ok(Some(User {
+            id,
+            username: uname,
+            is_admin,
+            created_at,
+        }))
+    }
+
+    pub fn get_user(&self, user_id: &str) -> Result<Option<User>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT id, username, is_admin, created_at FROM users WHERE id = ?1",
+        )?;
+
+        let mut rows = stmt.query(rusqlite::params![user_id])?;
+        match rows.next()? {
+            Some(row) => Ok(Some(User {
+                id: row.get(0)?,
+                username: row.get(1)?,
+                is_admin: row.get::<_, i32>(2)? != 0,
+                created_at: row.get(3)?,
+            })),
+            None => Ok(None),
+        }
+    }
+
+    pub fn list_users(&self) -> Result<Vec<User>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt =
+            conn.prepare("SELECT id, username, is_admin, created_at FROM users ORDER BY username")?;
+        let users = stmt
+            .query_map([], |row| {
+                Ok(User {
+                    id: row.get(0)?,
+                    username: row.get(1)?,
+                    is_admin: row.get::<_, i32>(2)? != 0,
+                    created_at: row.get(3)?,
+                })
+            })?
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+        Ok(users)
+    }
+
+    pub fn update_user(
+        &self,
+        user_id: &str,
+        new_password: Option<&str>,
+        new_is_admin: Option<bool>,
+    ) -> Result<bool> {
+        let conn = self.conn.lock().unwrap();
+
+        if let Some(password) = new_password {
+            let hash = hash_password(password)?;
+            conn.execute(
+                "UPDATE users SET password = ?1 WHERE id = ?2",
+                rusqlite::params![hash, user_id],
+            )?;
+        }
+
+        if let Some(is_admin) = new_is_admin {
+            conn.execute(
+                "UPDATE users SET is_admin = ?1 WHERE id = ?2",
+                rusqlite::params![is_admin as i32, user_id],
+            )?;
+        }
+
+        let changed = conn.changes() > 0;
+        Ok(changed)
+    }
+
+    pub fn delete_user(&self, user_id: &str) -> Result<bool> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute("PRAGMA foreign_keys = ON;", [])?;
+        let rows = conn.execute("DELETE FROM users WHERE id = ?1", rusqlite::params![user_id])?;
+        Ok(rows > 0)
+    }
+
+    // Session management
+
+    pub fn create_session(&self, user_id: &str, max_age_seconds: i64) -> Result<String> {
+        let token = generate_session_token();
+        let created_at = now_iso8601();
+        let expires_at = future_iso8601(max_age_seconds);
+
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "INSERT INTO sessions (token, user_id, created_at, expires_at) VALUES (?1, ?2, ?3, ?4)",
+            rusqlite::params![token, user_id, created_at, expires_at],
+        )?;
+
+        Ok(token)
+    }
+
+    pub fn validate_session(&self, token: &str) -> Result<Option<User>> {
+        let conn = self.conn.lock().unwrap();
+        let now = now_iso8601();
+
+        let mut stmt = conn.prepare(
+            "SELECT u.id, u.username, u.is_admin, u.created_at
+             FROM sessions s
+             JOIN users u ON s.user_id = u.id
+             WHERE s.token = ?1 AND s.expires_at > ?2",
+        )?;
+
+        let mut rows = stmt.query(rusqlite::params![token, now])?;
+        match rows.next()? {
+            Some(row) => Ok(Some(User {
+                id: row.get(0)?,
+                username: row.get(1)?,
+                is_admin: row.get::<_, i32>(2)? != 0,
+                created_at: row.get(3)?,
+            })),
+            None => Ok(None),
+        }
+    }
+
+    pub fn delete_session(&self, token: &str) -> Result<bool> {
+        let conn = self.conn.lock().unwrap();
+        let rows = conn.execute(
+            "DELETE FROM sessions WHERE token = ?1",
+            rusqlite::params![token],
+        )?;
+        Ok(rows > 0)
+    }
+
+    pub fn cleanup_expired_sessions(&self) -> Result<usize> {
+        let conn = self.conn.lock().unwrap();
+        let now = now_iso8601();
+        let rows = conn.execute(
+            "DELETE FROM sessions WHERE expires_at <= ?1",
+            rusqlite::params![now],
+        )?;
+        Ok(rows)
+    }
+
+    // Permission management
+
+    pub fn set_permissions(&self, user_id: &str, permissions: &[AppPermission]) -> Result<()> {
+        let conn = self.conn.lock().unwrap();
+        conn.execute(
+            "DELETE FROM user_app_permissions WHERE user_id = ?1",
+            rusqlite::params![user_id],
+        )?;
+
+        let mut stmt = conn.prepare(
+            "INSERT INTO user_app_permissions (user_id, server, app_id) VALUES (?1, ?2, ?3)",
+        )?;
+        for perm in permissions {
+            stmt.execute(rusqlite::params![user_id, perm.server, perm.app_id])?;
+        }
+
+        Ok(())
+    }
+
+    pub fn get_permissions(&self, user_id: &str) -> Result<Vec<AppPermission>> {
+        let conn = self.conn.lock().unwrap();
+        let mut stmt = conn.prepare(
+            "SELECT server, app_id FROM user_app_permissions WHERE user_id = ?1",
+        )?;
+        let perms = stmt
+            .query_map(rusqlite::params![user_id], |row| {
+                Ok(AppPermission {
+                    server: row.get(0)?,
+                    app_id: row.get(1)?,
+                })
+            })?
+            .collect::<std::result::Result<Vec<_>, _>>()?;
+        Ok(perms)
+    }
+
+    pub fn check_app_permission(
+        &self,
+        user_id: &str,
+        server: &str,
+        app_id: i64,
+    ) -> Result<bool> {
+        // Check if user is admin first
+        let conn = self.conn.lock().unwrap();
+        let is_admin: i32 = conn.query_row(
+            "SELECT is_admin FROM users WHERE id = ?1",
+            rusqlite::params![user_id],
+            |row| row.get(0),
+        )?;
+        if is_admin != 0 {
+            return Ok(true);
+        }
+
+        let count: i64 = conn.query_row(
+            "SELECT COUNT(*) FROM user_app_permissions WHERE user_id = ?1 AND server = ?2 AND app_id = ?3",
+            rusqlite::params![user_id, server, app_id],
+            |row| row.get(0),
+        )?;
+        Ok(count > 0)
+    }
+}
+
+fn hash_password(password: &str) -> Result<String> {
+    let salt = SaltString::generate(&mut OsRng);
+    let hash = Argon2::default()
+        .hash_password(password.as_bytes(), &salt)
+        .map_err(|e| anyhow::anyhow!("Failed to hash password: {e}"))?;
+    Ok(hash.to_string())
+}
+
+fn generate_session_token() -> String {
+    let mut bytes = [0u8; 32];
+    openssl::rand::rand_bytes(&mut bytes).expect("Failed to generate random bytes");
+    hex::encode(bytes)
+}
+
+fn generate_random_password() -> String {
+    let mut bytes = [0u8; 16];
+    openssl::rand::rand_bytes(&mut bytes).expect("Failed to generate random bytes");
+    hex::encode(bytes)
+}
+
+fn now_iso8601() -> String {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs()
+        .to_string()
+}
+
+fn future_iso8601(seconds_from_now: i64) -> String {
+    let now = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap()
+        .as_secs();
+    (now as i64 + seconds_from_now).to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn test_db() -> Db {
+        let conn = rusqlite::Connection::open_in_memory().unwrap();
+        let db = Db {
+            conn: Mutex::new(conn),
+        };
+        db.init().unwrap();
+        db
+    }
+
+    #[test]
+    fn test_create_and_get_user() {
+        let db = test_db();
+        let user = db.create_user("alice", "password123", false).unwrap();
+        assert_eq!(user.username, "alice");
+        assert!(!user.is_admin);
+
+        let fetched = db.get_user(&user.id).unwrap().unwrap();
+        assert_eq!(fetched.username, "alice");
+        assert_eq!(fetched.id, user.id);
+    }
+
+    #[test]
+    fn test_verify_correct_password() {
+        let db = test_db();
+        db.create_user("bob", "secret", false).unwrap();
+
+        let result = db.verify_password("bob", "secret").unwrap();
+        assert!(result.is_some());
+        assert_eq!(result.unwrap().username, "bob");
+    }
+
+    #[test]
+    fn test_verify_wrong_password() {
+        let db = test_db();
+        db.create_user("bob", "secret", false).unwrap();
+
+        let result = db.verify_password("bob", "wrong").unwrap();
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn test_verify_nonexistent_user() {
+        let db = test_db();
+        let result = db.verify_password("nobody", "pass").unwrap();
+        assert!(result.is_none());
+    }
+
+    #[test]
+    fn test_duplicate_username_rejected() {
+        let db = test_db();
+        db.create_user("alice", "pass1", false).unwrap();
+        let result = db.create_user("alice", "pass2", false);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_list_users() {
+        let db = test_db();
+        db.create_user("charlie", "pass", false).unwrap();
+        db.create_user("alice", "pass", true).unwrap();
+
+        let users = db.list_users().unwrap();
+        assert_eq!(users.len(), 2);
+        assert_eq!(users[0].username, "alice"); // sorted
+        assert_eq!(users[1].username, "charlie");
+    }
+
+    #[test]
+    fn test_update_user_password() {
+        let db = test_db();
+        let user = db.create_user("dave", "oldpass", false).unwrap();
+
+        db.update_user(&user.id, Some("newpass"), None).unwrap();
+
+        assert!(db.verify_password("dave", "oldpass").unwrap().is_none());
+        assert!(db.verify_password("dave", "newpass").unwrap().is_some());
+    }
+
+    #[test]
+    fn test_update_user_admin_status() {
+        let db = test_db();
+        let user = db.create_user("eve", "pass", false).unwrap();
+        assert!(!user.is_admin);
+
+        db.update_user(&user.id, None, Some(true)).unwrap();
+        let updated = db.get_user(&user.id).unwrap().unwrap();
+        assert!(updated.is_admin);
+    }
+
+    #[test]
+    fn test_delete_user() {
+        let db = test_db();
+        let user = db.create_user("frank", "pass", false).unwrap();
+        assert!(db.delete_user(&user.id).unwrap());
+        assert!(db.get_user(&user.id).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_delete_nonexistent_user() {
+        let db = test_db();
+        assert!(!db.delete_user("nonexistent-id").unwrap());
+    }
+
+    #[test]
+    fn test_create_and_validate_session() {
+        let db = test_db();
+        let user = db.create_user("grace", "pass", false).unwrap();
+
+        let token = db.create_session(&user.id, 3600).unwrap();
+        let validated = db.validate_session(&token).unwrap();
+        assert!(validated.is_some());
+        assert_eq!(validated.unwrap().username, "grace");
+    }
+
+    #[test]
+    fn test_expired_session_rejected() {
+        let db = test_db();
+        let user = db.create_user("heidi", "pass", false).unwrap();
+
+        // Create session that expired 10 seconds ago
+        let token = db.create_session(&user.id, -10).unwrap();
+        let validated = db.validate_session(&token).unwrap();
+        assert!(validated.is_none());
+    }
+
+    #[test]
+    fn test_invalid_token_rejected() {
+        let db = test_db();
+        let validated = db.validate_session("bogus-token").unwrap();
+        assert!(validated.is_none());
+    }
+
+    #[test]
+    fn test_delete_session() {
+        let db = test_db();
+        let user = db.create_user("ivan", "pass", false).unwrap();
+        let token = db.create_session(&user.id, 3600).unwrap();
+
+        assert!(db.delete_session(&token).unwrap());
+        assert!(db.validate_session(&token).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_delete_user_cascades_sessions() {
+        let db = test_db();
+        let user = db.create_user("judy", "pass", false).unwrap();
+        let token = db.create_session(&user.id, 3600).unwrap();
+
+        db.delete_user(&user.id).unwrap();
+        assert!(db.validate_session(&token).unwrap().is_none());
+    }
+
+    #[test]
+    fn test_delete_user_cascades_permissions() {
+        let db = test_db();
+        let user = db.create_user("karl", "pass", false).unwrap();
+        db.set_permissions(
+            &user.id,
+            &[AppPermission {
+                server: "srv".to_string(),
+                app_id: 1,
+            }],
+        )
+        .unwrap();
+
+        db.delete_user(&user.id).unwrap();
+        // Permissions table should be empty for this user
+        let perms = db.get_permissions(&user.id).unwrap();
+        assert!(perms.is_empty());
+    }
+
+    #[test]
+    fn test_set_and_get_permissions() {
+        let db = test_db();
+        let user = db.create_user("laura", "pass", false).unwrap();
+
+        let perms = vec![
+            AppPermission {
+                server: "server1".to_string(),
+                app_id: 10,
+            },
+            AppPermission {
+                server: "server1".to_string(),
+                app_id: 20,
+            },
+        ];
+        db.set_permissions(&user.id, &perms).unwrap();
+
+        let fetched = db.get_permissions(&user.id).unwrap();
+        assert_eq!(fetched.len(), 2);
+    }
+
+    #[test]
+    fn test_set_permissions_replaces_existing() {
+        let db = test_db();
+        let user = db.create_user("mike", "pass", false).unwrap();
+
+        db.set_permissions(
+            &user.id,
+            &[AppPermission {
+                server: "s1".to_string(),
+                app_id: 1,
+            }],
+        )
+        .unwrap();
+
+        db.set_permissions(
+            &user.id,
+            &[AppPermission {
+                server: "s2".to_string(),
+                app_id: 2,
+            }],
+        )
+        .unwrap();
+
+        let perms = db.get_permissions(&user.id).unwrap();
+        assert_eq!(perms.len(), 1);
+        assert_eq!(perms[0].server, "s2");
+        assert_eq!(perms[0].app_id, 2);
+    }
+
+    #[test]
+    fn test_check_app_permission_allowed() {
+        let db = test_db();
+        let user = db.create_user("nancy", "pass", false).unwrap();
+        db.set_permissions(
+            &user.id,
+            &[AppPermission {
+                server: "srv".to_string(),
+                app_id: 42,
+            }],
+        )
+        .unwrap();
+
+        assert!(db.check_app_permission(&user.id, "srv", 42).unwrap());
+    }
+
+    #[test]
+    fn test_check_app_permission_denied() {
+        let db = test_db();
+        let user = db.create_user("oscar", "pass", false).unwrap();
+
+        assert!(!db.check_app_permission(&user.id, "srv", 42).unwrap());
+    }
+
+    #[test]
+    fn test_check_app_permission_admin_bypass() {
+        let db = test_db();
+        let user = db.create_user("pat", "pass", true).unwrap();
+        // Admin has no explicit permissions but should pass
+        assert!(db.check_app_permission(&user.id, "srv", 42).unwrap());
+    }
+
+    #[test]
+    fn test_cleanup_expired_sessions() {
+        let db = test_db();
+        let user = db.create_user("quinn", "pass", false).unwrap();
+
+        let _expired = db.create_session(&user.id, -10).unwrap();
+        let valid = db.create_session(&user.id, 3600).unwrap();
+
+        let cleaned = db.cleanup_expired_sessions().unwrap();
+        assert_eq!(cleaned, 1);
+
+        // Valid session should still work
+        assert!(db.validate_session(&valid).unwrap().is_some());
+    }
+
+    #[test]
+    fn test_seed_admin_if_needed() {
+        let db = test_db();
+
+        // First call should create admin
+        let result = db.seed_admin_if_needed().unwrap();
+        assert!(result.is_some());
+        let (username, password) = result.unwrap();
+        assert_eq!(username, "admin");
+        assert!(!password.is_empty());
+
+        // Verify can login with generated password
+        let user = db.verify_password("admin", &password).unwrap().unwrap();
+        assert!(user.is_admin);
+
+        // Second call should be a no-op
+        let result = db.seed_admin_if_needed().unwrap();
+        assert!(result.is_none());
+    }
+}
@@ -0,0 +1,72 @@
+use anyhow::Result;
+use std::ffi::CString;
+
+use moonlight_common_c_sys::{
+    _SERVER_INFORMATION, _STREAM_CONFIGURATION, COLOR_RANGE_LIMITED, COLORSPACE_REC_601,
+    CONNECTION_LISTENER_CALLBACKS, ENCFLG_NONE, SCM_H264, STREAM_CFG_AUTO, STREAM_CFG_LOCAL,
+    VIDEO_FORMAT_H264, VIDEO_FORMAT_H265,
+};
+
+unsafe extern "C" {
+    #[allow(unused)]
+    fn printf(format: *const i8, ...);
+}
+
+extern "C" fn conn_listener_stage_starting(stage: std::os::raw::c_int) {
+    println!("Stage starting: {}", stage);
+}
+
+pub fn server_info(
+    stream_url: &url::Url,
+    app_version: &str,
+    gfe_version: &str,
+    address: &str,
+    server_codec_mode_support: i32,
+) -> Result<_SERVER_INFORMATION> {
+    Ok(_SERVER_INFORMATION {
+        address: CString::new(address)?.into_raw(),
+        serverInfoAppVersion: CString::new(app_version)?.into_raw(),
+        serverInfoGfeVersion: CString::new(gfe_version)?.into_raw(),
+        rtspSessionUrl: CString::new(stream_url.as_str())?.into_raw(),
+        serverCodecModeSupport: server_codec_mode_support,
+    })
+}
+
+pub fn stream_config(stream: &crate::backend::Stream) -> _STREAM_CONFIGURATION {
+    let (aes_key, aes_iv) = stream.input_crypto.as_stream_config_params();
+
+    _STREAM_CONFIGURATION {
+        width: stream.stream_config.mode.width,
+        height: stream.stream_config.mode.height,
+        fps: stream.stream_config.mode.fps,
+        bitrate: stream.stream_config.bitrate_kbps,
+        packetSize: 1024,
+        streamingRemotely: STREAM_CFG_AUTO,
+        audioConfiguration: (0x3 << 16) | (2 << 8) | 0xCA,
+        supportedVideoFormats: VIDEO_FORMAT_H264,
+        clientRefreshRateX100: 0,
+        colorSpace: COLORSPACE_REC_601,
+        colorRange: COLOR_RANGE_LIMITED,
+        encryptionFlags: ENCFLG_NONE,
+        remoteInputAesKey: aes_key,
+        remoteInputAesIv: aes_iv,
+    }
+}
+
+pub fn listener_callbacks() -> CONNECTION_LISTENER_CALLBACKS {
+    CONNECTION_LISTENER_CALLBACKS {
+        stageStarting: None,
+        stageComplete: None,
+        stageFailed: None,
+        connectionStarted: None,
+        connectionTerminated: None,
+        logMessage: Some(printf),
+        rumble: None,
+        connectionStatusUpdate: None,
+        setHdrMode: None,
+        rumbleTriggers: None,
+        setMotionEventState: None,
+        setControllerLED: None,
+        setAdaptiveTriggers: None,
+    }
+}
@@ -0,0 +1,325 @@
+use std::{slice, sync::RwLock};
+
+use anyhow::{Result, anyhow};
+use moonlight_common_c_sys::{
+    _DECODE_UNIT, _LENTRY, CAPABILITY_DIRECT_SUBMIT, DECODER_RENDERER_CALLBACKS, FRAME_TYPE_PFRAME,
+    PDECODE_UNIT, VIDEO_FORMAT_H264_HIGH8_444, VIDEO_FORMAT_H265, VIDEO_FORMAT_H265_MAIN10,
+    VIDEO_FORMAT_H265_REXT8_444, VIDEO_FRAME_HANDLE,
+};
+use salvo::{http::body::Frame, hyper::body::Buf};
+use serde::Serialize;
+use tokio::sync::mpsc;
+use tracing::{debug, error};
+
+#[derive(Serialize)]
+pub enum FrameType {
+    PFRAME,
+    IDR,
+}
+
+impl TryFrom<i32> for FrameType {
+    type Error = anyhow::Error;
+
+    fn try_from(val: i32) -> Result<Self, Self::Error> {
+        Ok(match val {
+            moonlight_common_c_sys::FRAME_TYPE_PFRAME => FrameType::PFRAME,
+            moonlight_common_c_sys::FRAME_TYPE_IDR => FrameType::IDR,
+            val => {
+                return Err(anyhow!("Unknown frame type {val}"));
+            }
+        })
+    }
+}
+
+#[derive(Serialize)]
+pub enum VideoFormat {
+    H264,
+    H264_HIGH8_444,
+    H265,
+    H265_MAIN10,
+    H265_REXT8_444,
+    H265_REXT10_444,
+    AV1_MAIN8,
+    AV1_MAIN10,
+    AV1_HIGH8_444,
+    AV1_HIGH10_444,
+}
+
+impl TryFrom<i32> for VideoFormat {
+    type Error = anyhow::Error;
+
+    fn try_from(val: i32) -> Result<Self, Self::Error> {
+        Ok(match val {
+            moonlight_common_c_sys::VIDEO_FORMAT_H264 => VideoFormat::H264,
+            moonlight_common_c_sys::VIDEO_FORMAT_H264_HIGH8_444 => VideoFormat::H264_HIGH8_444,
+            moonlight_common_c_sys::VIDEO_FORMAT_H265 => VideoFormat::H265,
+            moonlight_common_c_sys::VIDEO_FORMAT_H265_MAIN10 => VideoFormat::H265_MAIN10,
+            moonlight_common_c_sys::VIDEO_FORMAT_H265_REXT8_444 => VideoFormat::H265_REXT8_444,
+            moonlight_common_c_sys::VIDEO_FORMAT_H265_REXT10_444 => VideoFormat::H265_REXT10_444,
+            moonlight_common_c_sys::VIDEO_FORMAT_AV1_MAIN8 => VideoFormat::AV1_MAIN8,
+            moonlight_common_c_sys::VIDEO_FORMAT_AV1_MAIN10 => VideoFormat::AV1_MAIN10,
+            moonlight_common_c_sys::VIDEO_FORMAT_AV1_HIGH8_444 => VideoFormat::AV1_HIGH8_444,
+            moonlight_common_c_sys::VIDEO_FORMAT_AV1_HIGH10_444 => VideoFormat::AV1_HIGH10_444,
+            val => {
+                return Err(anyhow!("Unknown video format {val}"));
+            }
+        })
+    }
+}
+
+#[derive(Serialize)]
+enum BufferType {
+    PICDATA,
+    SPS,
+    PPS,
+    VPS,
+}
+
+impl TryFrom<i32> for BufferType {
+    type Error = anyhow::Error;
+
+    fn try_from(val: i32) -> Result<Self, Self::Error> {
+        Ok(match val {
+            moonlight_common_c_sys::BUFFER_TYPE_PICDATA => BufferType::PICDATA,
+            moonlight_common_c_sys::BUFFER_TYPE_SPS => BufferType::SPS,
+            moonlight_common_c_sys::BUFFER_TYPE_PPS => BufferType::PPS,
+            moonlight_common_c_sys::BUFFER_TYPE_VPS => BufferType::VPS,
+            _ => {
+                return Err(anyhow!("Unknown buffer type {val}"));
+            }
+        })
+    }
+}
+
+#[derive(Serialize)]
+pub struct Buffer {
+    pub data: Vec<u8>,
+    buffer_type: BufferType,
+}
+
+impl TryFrom<_LENTRY> for Buffer {
+    type Error = anyhow::Error;
+
+    fn try_from(val: _LENTRY) -> Result<Self, Self::Error> {
+        let length = <usize>::try_from(val.length)?;
+        let data = unsafe { slice::from_raw_parts(val.data as *const u8, length) }.to_vec();
+
+        let buffer_type = BufferType::try_from(val.bufferType)?;
+
+        Ok(Buffer { data, buffer_type })
+    }
+}
+
+#[derive(Serialize)]
+pub enum RendererMessage {
+    Setup {
+        video_format: VideoFormat,
+        width: u64,
+        height: u64,
+        redraw_rate: u64,
+        dr_flags: i32,
+    },
+    DecodeUnitStart {
+        frame_number: u64,
+        frame_type: FrameType,
+        num_buffers: u64,
+
+        host_processing_latency: u16,
+        receive_time_ms: u64,
+        enqueue_time_ms: u64,
+        presentation_time: u64,
+
+        full_length: u64,
+
+        hdr_active: bool,
+        colorspace: u8,
+    },
+    DecodeUnitBuffer {
+        frame_number: u64,
+        buffer_index: u64,
+        buffer_offset: u64,
+        buffer: Buffer,
+    },
+}
+
+impl RendererMessage {
+    fn from_setup_cb_args(
+        video_format: std::os::raw::c_int,
+        width: std::os::raw::c_int,
+        height: std::os::raw::c_int,
+        redraw_rate: std::os::raw::c_int,
+        dr_flags: std::os::raw::c_int,
+    ) -> Result<Self> {
+        Ok(RendererMessage::Setup {
+            video_format: VideoFormat::try_from(video_format)?,
+            width: <u64>::try_from(width)?,
+            height: <u64>::try_from(height)?,
+            redraw_rate: <u64>::try_from(redraw_rate)?,
+            dr_flags,
+        })
+    }
+
+    fn from_decode_unit(decode_unit: _DECODE_UNIT) -> Result<Vec<Self>> {
+        let mut messages = Vec::new();
+
+        if decode_unit.bufferList.is_null() {
+            return Err(anyhow!("DecodeUnit bufferList is null"));
+        }
+        let frame_number = <u64>::try_from(decode_unit.frameNumber)?;
+
+        messages.push(RendererMessage::DecodeUnitStart {
+            frame_number,
+            frame_type: FrameType::try_from(decode_unit.frameType)?,
+            num_buffers: 0,
+            host_processing_latency: decode_unit.frameHostProcessingLatency,
+            receive_time_ms: decode_unit.receiveTimeMs,
+            enqueue_time_ms: decode_unit.enqueueTimeMs,
+            presentation_time: decode_unit.presentationTimeMs as u64,
+            full_length: <u64>::try_from(decode_unit.fullLength)?,
+            hdr_active: decode_unit.hdrActive,
+            colorspace: decode_unit.colorspace,
+        });
+
+        let mut next = unsafe { *decode_unit.bufferList };
+
+        let mut index = 0;
+        let mut offset = 0;
+        loop {
+            let b = Buffer::try_from(next)?;
+            let buffer_len = b.data.len() as u64;
+
+            messages.push(RendererMessage::DecodeUnitBuffer {
+                frame_number,
+                buffer_index: index,
+                buffer_offset: offset,
+                buffer: b,
+            });
+
+            offset = offset + buffer_len;
+            index = index + 1;
+            if next.next.is_null() {
+                break;
+            }
+
+            next = unsafe { *next.next };
+        }
+
+        if let RendererMessage::DecodeUnitStart {
+            ref mut num_buffers,
+            ..
+        } = messages[0]
+        {
+            *num_buffers = index;
+        }
+
+        Ok(messages)
+    }
+}
+
+static DECODER_SENDER: RwLock<Option<mpsc::Sender<RendererMessage>>> = RwLock::new(None);
+
+fn send_message(msg: RendererMessage) -> i32 {
+    let read_guard = match DECODER_SENDER.read() {
+        Ok(r) => r,
+        Err(e) => {
+            error!("Could not lock RendererMessage RwLock: {e}");
+            return -1;
+        }
+    };
+
+    match read_guard.as_ref() {
+        Some(sender) => match sender.blocking_send(msg) {
+            Ok(()) => 0,
+            Err(e) => {
+                error!("Could not send to RendererMessage channel: {e}");
+                -1
+            }
+        },
+        None => {
+            error!("RendererMessage sender was not initalized");
+            -1
+        }
+    }
+}
+
+extern "C" fn setup_cb(
+    video_format: std::os::raw::c_int,
+    width: std::os::raw::c_int,
+    height: std::os::raw::c_int,
+    redraw_rate: std::os::raw::c_int,
+    _context: *mut std::os::raw::c_void,
+    dr_flags: std::os::raw::c_int,
+) -> std::os::raw::c_int {
+    debug!("SETUP CB");
+    let msg = match RendererMessage::from_setup_cb_args(
+        video_format,
+        width,
+        height,
+        redraw_rate,
+        dr_flags,
+    ) {
+        Ok(m) => m,
+        Err(e) => {
+            error!("Cannot construct RendererMessage: {e}");
+            return -1;
+        }
+    };
+
+    send_message(msg)
+}
+
+extern "C" fn start_cb() {
+    debug!("START CB");
+}
+
+extern "C" fn submit_decode_unit_cb(decode_unit: PDECODE_UNIT) -> std::os::raw::c_int {
+    if decode_unit.is_null() {
+        error!("Decode unit pointer was null");
+        return -1;
+    }
+    let decode_unit = unsafe { *decode_unit };
+    //debug!("decode unit bytes: {}", decode_unit.fullLength);
+
+    let messages = match RendererMessage::from_decode_unit(decode_unit) {
+        Ok(m) => m,
+        Err(e) => {
+            error!("Cannot construct RendererMessage: {e}");
+            return -1;
+        }
+    };
+    debug!(
+        "got decode unit with {} buffers: {:?}",
+        messages.len() - 1,
+        std::time::Instant::now()
+    );
+
+    for msg in messages {
+        let ret = send_message(msg);
+        if ret != 0 {
+            return ret;
+        }
+    }
+    //debug!("dispatched decode unit: {:?}", std::time::Instant::now());
+    0
+}
+
+pub fn decoder_callbacks() -> Result<(DECODER_RENDERER_CALLBACKS, mpsc::Receiver<RendererMessage>)>
+{
+    let (tx, rx) = mpsc::channel(100);
+
+    let mut writer = DECODER_SENDER.write().unwrap();
+
+    *writer = Some(tx);
+
+    Ok((
+        DECODER_RENDERER_CALLBACKS {
+            setup: Some(setup_cb),
+            start: Some(start_cb),
+            stop: None,
+            cleanup: None,
+            submitDecodeUnit: Some(submit_decode_unit_cb),
+            capabilities: CAPABILITY_DIRECT_SUBMIT,
+        },
+        rx,
+    ))
+}
@@ -0,0 +1,77 @@
+use anyhow::{Result, anyhow};
+use tokio::sync::mpsc;
+
+mod config;
+pub mod decoder;
+
+#[derive(Debug)]
+pub struct GamestreamChannels {
+    pub decoder_rx: mpsc::Receiver<decoder::RendererMessage>,
+}
+
+pub fn start_connection(
+    stream: &crate::backend::Stream,
+    address: &str,
+) -> Result<GamestreamChannels> {
+    let mut server_info = config::server_info(
+        &stream.url,
+        &stream.app_version,
+        &stream.gfe_version,
+        address,
+        stream.server_codec_mode_support,
+    )?;
+    let mut stream_config = config::stream_config(stream);
+    let mut listener_callbacks = config::listener_callbacks();
+    let (mut decoder_callbacks, decoder_rx) = decoder::decoder_callbacks()?;
+    let ret;
+    unsafe {
+        ret = moonlight_common_c_sys::LiStartConnection(
+            &mut server_info,
+            &mut stream_config,
+            &mut listener_callbacks,
+            &mut decoder_callbacks,
+            std::ptr::null_mut(),
+            std::ptr::null_mut(),
+            0,
+            std::ptr::null_mut(),
+            0,
+        );
+    }
+
+    match ret {
+        0 => Ok(GamestreamChannels { decoder_rx }),
+        _ => Err(anyhow!("Gamestream connection failed: {ret}")),
+    }
+}
+
+pub fn stop_connection() {
+    unsafe { moonlight_common_c_sys::LiStopConnection() };
+}
+
+pub fn send_keyboard_event(keycode: i16, keyaction: i8, modifiers: u8) -> Result<()> {
+    let ret =
+        unsafe { moonlight_common_c_sys::LiSendKeyboardEvent(keycode, keyaction, modifiers as i8) };
+
+    match ret {
+        0 => Ok(()),
+        _ => Err(anyhow!("Could not send keyboard event: {ret}")),
+    }
+}
+
+pub fn send_mouse_move_event(movement_x: i16, movement_y: i16) -> Result<()> {
+    let ret = unsafe { moonlight_common_c_sys::LiSendMouseMoveEvent(movement_x, movement_y) };
+
+    match ret {
+        0 => Ok(()),
+        _ => Err(anyhow!("Could not send mouse movement event: {ret}")),
+    }
+}
+
+pub fn send_mouse_input_event(action: i8, button: i32) -> Result<()> {
+    let ret = unsafe { moonlight_common_c_sys::LiSendMouseButtonEvent(action, button) };
+
+    match ret {
+        0 => Ok(()),
+        _ => Err(anyhow!("Could not send mouse input event: {ret}")),
+    }
+}
@@ -1,112 +1,175 @@
+use anyhow::{Result, anyhow};
+use salvo::logging::Logger;
 use salvo::prelude::*;
-use std::ffi::CString;
-
-use moonlight_common_c_sys::{
-    _SERVER_INFORMATION, _STREAM_CONFIGURATION, COLOR_RANGE_LIMITED, COLORSPACE_REC_601,
-    CONNECTION_LISTENER_CALLBACKS, ENCFLG_NONE, PCONNECTION_LISTENER_CALLBACKS, SCM_H264,
-    STREAM_CFG_LOCAL, VIDEO_FORMAT_H264,
-};

+mod apps;
+mod auth;
+mod backend;
+mod certs;
+mod common;
+mod db;
+mod gamestream;
 mod pair;
+mod proxy;
+mod responses;
+mod state;
+mod stream;

-fn get_server_info() -> _SERVER_INFORMATION {
-    _SERVER_INFORMATION {
-        // TODO: these all leak
-        address: CString::new("10.0.1.8")
-            .expect("CString::new failed")
-            .into_raw(),
-        serverInfoAppVersion: CString::new("foo").expect("CString::new failed").into_raw(),
-        serverInfoGfeVersion: CString::new("foo").expect("CString::new failed").into_raw(),
-        rtspSessionUrl: CString::new("foo").expect("CString::new failed").into_raw(),
-        serverCodecModeSupport: SCM_H264,
-    }
+use salvo::serve_static::{StaticDir, static_embed};
+
+#[cfg(not(debug_assertions))]
+use rust_embed::RustEmbed;
+
+// Only compile this in release builds
+#[cfg(not(debug_assertions))]
+#[derive(RustEmbed)]
+#[folder = "webroot"]
+struct Assets;
+
+#[cfg(debug_assertions)]
+fn create_static_handler() -> StaticDir {
+    // Debug build: serve live files from filesystem
+    StaticDir::new(["webroot"])
+        .defaults("index.html")
+        .auto_list(false)
 }

-fn get_stream_config() -> _STREAM_CONFIGURATION {
-    let mut remote_input_aes_key_u8: [u8; 16] = [0; 16];
-    let remote_input_aes_iv: [i8; 16] = [0; 16];
-
-    getrandom::fill(&mut remote_input_aes_key_u8)
-        .expect("Failed to generate cryptographic random bytes");
-
-    let remote_input_aes_key: [i8; 16] =
-        unsafe { *(&mut remote_input_aes_key_u8 as *mut [u8; 16] as *mut [i8; 16]) };
-
-    _STREAM_CONFIGURATION {
-        width: 1280,
-        height: 720,
-        fps: 60,
-        bitrate: 50 * 1024 * 1024,
-        packetSize: 1024,
-        streamingRemotely: STREAM_CFG_LOCAL,
-        audioConfiguration: (0x3 << 16) | (2 << 8) | 0xCA,
-        supportedVideoFormats: VIDEO_FORMAT_H264,
-        clientRefreshRateX100: 6000,
-        colorSpace: COLORSPACE_REC_601,
-        colorRange: COLOR_RANGE_LIMITED,
-        encryptionFlags: ENCFLG_NONE,
-        remoteInputAesKey: remote_input_aes_key,
-        remoteInputAesIv: remote_input_aes_iv,
-    }
+#[cfg(not(debug_assertions))]
+fn create_static_handler() -> impl Handler {
+    // Release build: serve embedded files
+    static_embed::<Assets>().fallback("index.html")
 }

-unsafe extern "C" {
-    fn printf(format: *const i8, ...) -> ();
-}
+async fn run_backend(port: u16) -> Result<()> {
+    let backend = backend::Backend::new(port)?;

-fn get_listener_callbacks() -> CONNECTION_LISTENER_CALLBACKS {
-    CONNECTION_LISTENER_CALLBACKS {
-        stageStarting: None,
-        stageComplete: None,
-        stageFailed: None,
-        connectionStarted: None,
-        connectionTerminated: None,
-        logMessage: Some(printf),
-        rumble: None,
-        connectionStatusUpdate: None,
-        setHdrMode: None,
-        rumbleTriggers: None,
-        setMotionEventState: None,
-        setControllerLED: None,
-        setAdaptiveTriggers: None,
-    }
-}
-
-fn barmain() {
-    //let server_info = moonlight_common_c_sys::LiInitializeServerInformation();
-    let mut server_info = get_server_info();
-    let mut stream_config = get_stream_config();
-    let mut listener_callbacks = get_listener_callbacks();
-    let mut ret = 0;
-    unsafe {
-        ret = moonlight_common_c_sys::LiStartConnection(
-            &mut server_info,
-            &mut stream_config,
-            &mut listener_callbacks,
-            std::ptr::null_mut(),
-            std::ptr::null_mut(),
-            std::ptr::null_mut(),
-            0,
-            std::ptr::null_mut(),
-            0,
-        );
+    // Seed default admin user if no users exist
+    if let Some((username, password)) = backend.db.seed_admin_if_needed()? {
+        tracing::info!("Created default admin user: {username}");
+        println!("===========================================");
+        println!("  Default admin credentials:");
+        println!("  Username: {username}");
+        println!("  Password: {password}");
+        println!("===========================================");
    }

-    println!("{ret}");
+    // Clean up expired sessions on startup
+    if let Ok(cleaned) = backend.db.cleanup_expired_sessions() {
+        if cleaned > 0 {
+            tracing::info!("Cleaned up {cleaned} expired sessions");
+        }
+    }

-    loop {}
+    let backend_arc = std::sync::Arc::new(backend);

-    //println!("Hello, world!");
-}
+    let auth_middleware = auth::SessionAuthMiddleware {
+        db: std::sync::Arc::new(
+            db::Db::open(
+                &directories::ProjectDirs::from("xyz", "ohea", "gamestream-webtransport-proxy")
+                    .ok_or(anyhow!("Could not get project dirs"))?
+                    .data_dir()
+                    .join("auth.db"),
+            )?,
+        ),
+    };

-#[tokio::main]
-async fn main() {
-    let mut router = Router::new().push(Router::with_path("pair").post(pair::post_pair));
+    let router = Router::new()
+        // Public auth routes
+        .push(Router::with_path("api/auth/login").post(backend_arc.login()))
+        // Existing routes (not yet gated - will be gated in a subsequent commit)
+        .push(Router::with_path("api/pair").post(backend_arc.post_pair()))
+        .push(Router::with_path("api/apps").get(backend_arc.get_apps()))
+        .push(Router::with_path("api/stream/start").post(backend_arc.post_stream_start()))
+        // Authenticated routes
+        .push(
+            Router::with_path("api")
+                .hoop(auth_middleware)
+                .push(Router::with_path("auth/logout").post(backend_arc.logout()))
+                .push(Router::with_path("auth/me").get(backend_arc.me()))
+                // Admin-only routes
+                .push(
+                    Router::with_path("admin")
+                        .hoop(auth::AdminCheckMiddleware)
+                        .push(
+                            Router::with_path("users")
+                                .get(backend_arc.admin_list_users())
+                                .post(backend_arc.admin_create_user()),
+                        )
+                        .push(
+                            Router::with_path("users/<id>")
+                                .put(backend_arc.admin_update_user())
+                                .delete(backend_arc.admin_delete_user()),
+                        )
+                        .push(
+                            Router::with_path("users/<id>/permissions")
+                                .get(backend_arc.admin_get_permissions())
+                                .put(backend_arc.admin_set_permissions()),
+                        ),
+                ),
+        )
+        .push(Router::with_path("{*path}").get(create_static_handler()));
    let doc = OpenApi::new("test api", "0.0.1").merge_router(&router);
    let router = router
        .unshift(doc.into_router("/api-doc/openapi.json"))
        .unshift(SwaggerUi::new("/api-doc/openapi.json").into_router("/swagger-ui"));
-    let listener = TcpListener::new("0.0.0.0:3001");
-    let acceptor = listener.join(TcpListener::new("0.0.0.0:3000")).bind().await;
-    salvo::Server::new(acceptor).serve(router).await;
+    let service = Service::new(router).hoop(Logger::new());
+
+    let config = certs::get_http_stream_config()?;
+
+    let listener = TcpListener::new(("0.0.0.0", port))
+        .rustls(config.clone())
+        .bind()
+        .await;
+    salvo::Server::new(listener).serve(service).await;
+
+    Ok(())
+}
+
+async fn run_proxy(port: u16, stream_id: uuid::Uuid) -> Result<()> {
+    let (config, cert_hash) = certs::get_webtransport_stream_config(stream_id)?;
+    let proxy = proxy::Proxy::new(cert_hash);
+    let proxy_arc = std::sync::Arc::new(proxy);
+
+    let router = Router::new()
+        .push(Router::with_path("api/stream/setup").post(proxy_arc.stream_setup()))
+        .push(Router::with_path("api/stream/connect/").goal(proxy_arc.stream_connect()));
+    let service = Service::new(router).hoop(Logger::new());
+
+    let listener = TcpListener::new(("0.0.0.0", port)).rustls(config.clone());
+    let acceptor = QuinnListener::new(config, ("0.0.0.0", port))
+        .join(listener)
+        .bind()
+        .await;
+    salvo::Server::new(acceptor).serve(service).await;
+
+    Ok(())
+}
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::DEBUG)
+        .init();
+
+    let mode = std::env::args()
+        .nth(1)
+        .ok_or(anyhow!("Mode argument missing"))?;
+    let port = std::env::args()
+        .nth(2)
+        .ok_or(anyhow!("Port argument missing"))?
+        .parse::<u16>()?;
+
+    match mode.as_str() {
+        "backend" => run_backend(port).await,
+        "proxy" => {
+            let stream_id = uuid::Uuid::parse_str(
+                &std::env::args()
+                    .nth(3)
+                    .ok_or(anyhow!("Cert ID argument missing"))?,
+            )?;
+
+            run_proxy(port, stream_id).await
+        }
+        _ => Err(anyhow!("Unknown mode: {mode}")),
+    }
 }
@@ -1,20 +1,20 @@
 use anyhow::Result;
-use openssl::hash::MessageDigest;
 use openssl::pkey::{PKey, Private};
-use openssl::rsa::Rsa;
 use openssl::sha::Sha256;
 use openssl::x509::X509;
 use rand::Rng;
 use salvo::prelude::*;
 use serde::{Deserialize, Serialize};
-use std::fs;
-use std::io::Write;
+use tracing::{debug, error, info};
+
+use crate::common::{AppError, AppResult, get_url};
+use crate::state::{StateReader, StateWriter};

 #[derive(Debug, Deserialize, ToSchema)]
 struct PostPairParams {
+    name: String,
    host: String,
-    port: u16,
-    pair_endpoint: Option<String>,
+    base_port: u16,
 }

 #[derive(Debug, Serialize, ToSchema)]
@@ -24,6 +24,7 @@ struct PostPairReturn {

 #[derive(Debug, Deserialize)]
 struct ServerCertResponse {
+    #[allow(unused)]
    paired: i32,
    plaincert: String,
 }
@@ -35,6 +36,7 @@ struct ClientChallengeResponse {

 #[derive(Debug, Deserialize)]
 struct ServerChallengeResponseResponse {
+    #[allow(unused)]
    paired: i32,
    pairingsecret: String,
 }
@@ -55,99 +57,6 @@ struct ServerPairingSecret {
    signature: Vec<u8>,
 }

-fn get_cert_and_private_key() -> Result<(X509, PKey<Private>)> {
-    let rsa = Rsa::generate(2048)?;
-    let key_pair = PKey::from_rsa(rsa)?;
-
-    let mut cert_builder = X509::builder()?;
-
-    let serial_number_u32 = openssl::bn::BigNum::from_u32(0)?;
-    let serial_number = openssl::asn1::Asn1Integer::from_bn(&serial_number_u32)?;
-
-    let now_unix = std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .expect("Time went backwards")
-        .as_secs()
-        - 1000000;
-    let now = openssl::asn1::Asn1Time::from_unix(now_unix as i64)?;
-    let ten_years_from_now = openssl::asn1::Asn1Time::days_from_now(365 * 10)?;
-
-    let mut x509_name_builder = openssl::x509::X509NameBuilder::new()?;
-    x509_name_builder.append_entry_by_text("CN", "NVIDIA GameStream Client")?;
-    let x509_name = x509_name_builder.build();
-
-    cert_builder.set_version(2)?;
-    cert_builder.set_not_before(&now)?;
-    cert_builder.set_not_after(&ten_years_from_now)?;
-    cert_builder.set_pubkey(&key_pair)?;
-    cert_builder.set_serial_number(&serial_number)?;
-    cert_builder.set_issuer_name(&x509_name)?;
-    cert_builder.set_subject_name(&x509_name)?;
-    cert_builder.sign(&key_pair, MessageDigest::sha256())?;
-    let cert = cert_builder.build();
-    Ok((cert, key_pair))
-}
-
-fn save_cert_and_key_to_disk(
-    cert: X509,
-    key: PKey<Private>,
-    host: &String,
-    port: u16,
-) -> Result<()> {
-    let project_dirs =
-        directories::ProjectDirs::from("xyz", "ohea", "gamestream-webtransport-proxy")
-            .ok_or(anyhow::anyhow!("Could not get project dirs"))?;
-    let data_dir = project_dirs.data_dir();
-    let cert_dir = data_dir.join("certs");
-    fs::create_dir_all(&cert_dir)?;
-
-    let cert_filepath = cert_dir.join(format!("{host}_{port}_cert"));
-    let key_filepath = cert_dir.join(format!("{host}_{port}_key"));
-
-    let mut cert_file_builder = std::fs::OpenOptions::new();
-    cert_file_builder.create(true);
-    cert_file_builder.truncate(true);
-    cert_file_builder.write(true);
-
-    let mut key_file_builder = std::fs::OpenOptions::new();
-    key_file_builder.create(true);
-    key_file_builder.truncate(true);
-    key_file_builder.write(true);
-
-    #[cfg(target_family = "unix")]
-    {
-        use std::os::unix::fs::OpenOptionsExt;
-
-        key_file_builder.mode(0o600);
-        cert_file_builder.mode(0o600);
-    }
-
-    let mut cert_file = cert_file_builder.open(&cert_filepath)?;
-    let mut key_file = key_file_builder.open(&key_filepath)?;
-
-    cert_file.write_all(&cert.to_pem()?)?;
-    key_file.write_all(&key.private_key_to_pem_pkcs8()?)?;
-
-    Ok(())
-}
-
-async fn get_url(base_url: &mut url_constructor::UrlConstructor) -> Result<String> {
-    let mut uuidv2 = [0u8; 16];
-    openssl::rand::rand_bytes(&mut uuidv2)?;
-    let uuidv2_hex = hex::encode(uuidv2);
-
-    let url = base_url.param("uuid", uuidv2_hex).build();
-    //println!("Getting url: {url}");
-
-    let mut http_builder = reqwest::Client::builder();
-    http_builder = http_builder.user_agent("Mozilla/5.0");
-    let client = http_builder.build().unwrap();
-
-    let resp = client.get(url).send().await?;
-    let text = resp.text().await?;
-    Ok(text)
-}
-
 async fn get_server_cert(
    mut base_url: url_constructor::UrlConstructor,
    salt_hex: String,
@@ -159,7 +68,7 @@ async fn get_server_cert(
        .param("salt", &salt_hex)
        .param("clientcert", &cert_hex);

-    let text = get_url(url).await?;
+    let text = get_url(url, false).await?;
    let server_cert: ServerCertResponse = serde_xml_rs::from_str(&text)?;

    let server_cert_bytes = hex::decode(server_cert.plaincert)?;
@@ -191,7 +100,7 @@ async fn get_server_challenge(
    let challenge_hex = hex::encode(challenge_enc);

    let url = base_url.param("clientchallenge", challenge_hex);
-    let text = get_url(url).await?;
+    let text = get_url(url, false).await?;

    Ok(serde_xml_rs::from_str(&text)?)
 }
@@ -227,7 +136,7 @@ fn generate_challenge_response(
    cipher_ctx.cipher_final(&mut client_challenge_response_data)?;

    let client_challenge_response_data_hex = hex::encode(&client_challenge_response_data);
-    //println!("client_challenge_response_data_hex: {client_challenge_response_data_hex}");
+    debug!("client_challenge_response_data_hex: {client_challenge_response_data_hex}");

    // Extract ASN.1 signature from certificate
    let asn_signature = cert.signature();
@@ -242,7 +151,7 @@ fn generate_challenge_response(
    challenge_response.extend_from_slice(client_secret_data);

    let challenge_response_hex = hex::encode(&challenge_response);
-    //println!("challenge_response_hex: {challenge_response_hex}");
+    debug!("challenge_response_hex: {challenge_response_hex}");

    let mut hasher = Sha256::new();
    hasher.update(&challenge_response);
@@ -271,7 +180,7 @@ async fn send_server_challenge_response(
 ) -> Result<ServerChallengeResponseResponse> {
    let url = base_url.param("serverchallengeresp", server_challenge_response);

-    let text = get_url(url).await?;
+    let text = get_url(url, false).await?;
    Ok(serde_xml_rs::from_str(&text)?)
 }

@@ -294,10 +203,10 @@ async fn do_challenge(
 ) -> Result<ServerPairingSecret> {
    let aes_key = generate_aes_key(salt, pin);
    let aes_hex = hex::encode(&aes_key);
-    //println!("aes_hex: {aes_hex}");
+    debug!("aes_hex: {aes_hex}");

    let client_challenge_response = get_server_challenge(base_url.clone(), &aes_key).await?;
-    //println!("{client_challenge_response:?}");
+    debug!("{client_challenge_response:?}");

    let challenge_response = generate_challenge_response(
        client_challenge_response.challengeresponse,
@@ -316,32 +225,16 @@ async fn do_challenge(
    })
 }

-fn get_base_url(host: &String, port: u16, unique_id: String) -> url_constructor::UrlConstructor {
-    let mut base_url = url_constructor::UrlConstructor::new();
-    base_url
-        .scheme("http")
-        .host(host)
-        .port(port)
-        .subdir("pair")
-        .param("uniqueid", unique_id)
-        .param("devicename", "roth") // TODO: what is this roth thing?
-        .param("updateState", "1");
-    base_url
-}
-
 fn generate_pin() -> [u8; 4] {
    let mut pin = [0u8; 4];
    {
-        print!("pairing pin: ");
-
-        // TODO: reenable real RNG
        let mut rng = rand::rng();
        for i in 0..pin.len() {
            // Generate ascii number 0-9
            pin[i] = rng.random_range(48..58);
-            print!("{}", pin[i] as char);
        }
-        println!("");
+        let pin_string: String = pin.iter().map(|&b| b as char).collect();
+        info!("pairing pin: {}", pin_string);
    }
    pin
 }
@@ -392,115 +285,192 @@ async fn send_client_pairing_secret(

    let url = base_url.param("clientpairingsecret", client_secret_hex);

-    let text = get_url(url).await?;
+    let text = get_url(url, false).await?;

    Ok(serde_xml_rs::from_str(&text)?)
 }

-fn get_unique_id() -> Result<String> {
-    let mut bytes = [0u8; 8];
-    openssl::rand::rand_bytes(&mut bytes)?;
-    Ok(hex::encode(bytes))
-}
+#[craft]
+impl crate::backend::Backend {
+    #[craft(endpoint(status_codes(
+        StatusCode::OK,
+        StatusCode::BAD_REQUEST,
+        StatusCode::INTERNAL_SERVER_ERROR
+    )))]
+    pub async fn post_pair(
+        self: ::std::sync::Arc<Self>,
+        body: salvo::oapi::extract::JsonBody<PostPairParams>,
+    ) -> AppResult<()> {
+        let params = body.into_inner();

-#[salvo::oapi::endpoint]
-pub async fn post_pair(body: salvo::oapi::extract::JsonBody<PostPairParams>) -> StatusCode {
-    let params = body.into_inner();
+        let server = crate::state::GamestreamServer {
+            host: params.host,
+            base_port: params.base_port,
+            name: params.name,
+        };

-    let unique_id = match get_unique_id() {
-        Ok(u) => u,
-        Err(e) => {
-            println!("Could not generate unique id: {e}");
-            return StatusCode::INTERNAL_SERVER_ERROR;
-        }
-    };
+        let reader = self.state.read().await;

-    let base_url = get_base_url(&params.host, params.port, unique_id);
-
-    let pin = generate_pin();
-
-    let mut client_secret_data = [0u8; 16];
-    if let Err(e) = openssl::rand::rand_bytes(&mut client_secret_data) {
-        println!("Could not generate client secret data: {e}");
-        return StatusCode::INTERNAL_SERVER_ERROR;
-    }
-
-    // Generate certificates
-    let (cert, private_key) = match get_cert_and_private_key() {
-        Ok(v) => v,
-        Err(e) => {
-            println!("Could not generate certs: {e}");
-            return StatusCode::INTERNAL_SERVER_ERROR;
-        }
-    };
-
-    // Convert to hex
-    let cert_pem = cert.to_pem().unwrap();
-    let cert_hex = hex::encode(&cert_pem);
-
-    // Generate salt and convert to hex
-    let mut salt = [0u8; 16];
-    openssl::rand::rand_bytes(&mut salt).unwrap();
-    let salt_hex = hex::encode(salt);
-
-    // Get the server certificate and start the pairing process
-    // This returns once the user has submitted the pin to the
-    // server out of band.
-    let server_cert = match get_server_cert(base_url.clone(), salt_hex, cert_hex).await {
-        Ok(s) => s,
-        Err(e) => {
-            println!("Could not get server cert: {e}");
-            return StatusCode::INTERNAL_SERVER_ERROR;
-        }
-    };
-    //println!("{server_cert:?}");
-
-    // Do the challenge response process
-    // This returns the pairing secret
-    let server_pairing_secret =
-        match do_challenge(base_url.clone(), &client_secret_data, pin, salt, &cert).await {
+        let servers = match reader.servers() {
            Ok(s) => s,
            Err(e) => {
-                println!("Could not do challenge: {e}");
-                return StatusCode::INTERNAL_SERVER_ERROR;
+                error!("Could not get servers: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Pairing failed".to_string(),
+                });
            }
        };
-    //println!("{server_pairing_secret:?}");

-    // Verify the pairing_secret signature
-    if let Err(e) = verify_signature(
-        server_pairing_secret.pairing_secret,
-        server_pairing_secret.signature,
-        server_cert.cert,
-    ) {
-        println!("Could not verify signature: {e}");
-        return StatusCode::INTERNAL_SERVER_ERROR;
-    }
+        if servers.contains_key(&server.name) {
+            error!(
+                "Could not pair server with name {}, server with that name already exists.",
+                server.name
+            );
+            return Err(AppError {
+                status_code: StatusCode::BAD_REQUEST,
+                description: format!("Server with name {} already exists.", server.name),
+            });
+        }

-    let client_pairing_secret_response =
-        match send_client_pairing_secret(base_url.clone(), &client_secret_data, &private_key).await
-        {
-            Ok(p) => p,
+        let unique_id = match self.state.read().await.unique_id() {
+            Ok(u) => u,
            Err(e) => {
-                println!("Could not send client pairing secret: {e}");
-                return StatusCode::INTERNAL_SERVER_ERROR;
+                error!("Could not get unique id: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Pairing failed".to_string(),
+                });
            }
        };

-    if client_pairing_secret_response.paired != 1 {
-        println!("Failed to pair with server");
-        return StatusCode::INTERNAL_SERVER_ERROR;
-    } else {
-        let host = &params.host;
-        let port = params.port;
-        println!("Paired with server {host}:{port} successfully!");
+        let base_url = crate::common::base_url(
+            "http",
+            &server.host,
+            server.http_port(),
+            &unique_id,
+            "pair",
+            Some(vec![("devicename", "roth"), ("updateState", "1")]),
+        );
+
+        let pin = generate_pin();
+
+        let mut client_secret_data = [0u8; 16];
+        if let Err(e) = openssl::rand::rand_bytes(&mut client_secret_data) {
+            error!("Could not generate client secret data: {e}");
+            return Err(AppError {
+                status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                description: "Pairing failed".to_string(),
+            });
+        }
+
+        // Get or generate cert / private key
+        let (cert, private_key) = match crate::certs::get_gamestream_cert_and_key() {
+            Ok(v) => v,
+            Err(e) => {
+                error!("Could not generate certs: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Pairing failed".to_string(),
+                });
+            }
+        };
+
+        // Convert to hex
+        let cert_pem = cert.to_pem().unwrap();
+        let cert_hex = hex::encode(&cert_pem);
+
+        // Generate salt and convert to hex
+        let mut salt = [0u8; 16];
+        openssl::rand::rand_bytes(&mut salt).unwrap();
+        let salt_hex = hex::encode(salt);
+
+        // Get the server certificate and start the pairing process
+        // This returns once the user has submitted the pin to the
+        // server out of band.
+        let server_cert = match get_server_cert(base_url.clone(), salt_hex, cert_hex).await {
+            Ok(s) => s,
+            Err(e) => {
+                error!("Could not get server cert: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Pairing failed".to_string(),
+                });
+            }
+        };
+        let server_cert_hex = hex::encode(&server_cert.cert);
+        debug!("server_cert_hex: {server_cert_hex:?}");
+
+        // Do the challenge response process
+        // This returns the pairing secret
+        let server_pairing_secret =
+            match do_challenge(base_url.clone(), &client_secret_data, pin, salt, &cert).await {
+                Ok(s) => s,
+                Err(e) => {
+                    error!("Could not do challenge: {e}");
+                    return Err(AppError {
+                        status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                        description: "Pairing failed".to_string(),
+                    });
+                }
+            };
+        let server_pairing_secret_hex = hex::encode(&server_pairing_secret.pairing_secret);
+        debug!("server_pairing_secret_hex: {server_pairing_secret_hex:?}");
+
+        // Verify the pairing_secret signature
+        if let Err(e) = verify_signature(
+            server_pairing_secret.pairing_secret,
+            server_pairing_secret.signature,
+            server_cert.cert,
+        ) {
+            error!("Could not verify signature: {e}");
+            return Err(AppError {
+                status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                description: "Pairing failed".to_string(),
+            });
+        }
+
+        let client_pairing_secret_response =
+            match send_client_pairing_secret(base_url.clone(), &client_secret_data, &private_key)
+                .await
+            {
+                Ok(p) => p,
+                Err(e) => {
+                    error!("Could not send client pairing secret: {e}");
+                    return Err(AppError {
+                        status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                        description: "Pairing failed".to_string(),
+                    });
+                }
+            };
+
+        if client_pairing_secret_response.paired != 1 {
+            error!("Failed to pair with server");
+            return Err(AppError {
+                status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                description: "Pairing failed".to_string(),
+            });
+        } else {
+            info!(
+                "Paired with server {}:{} successfully!",
+                server.host, server.base_port
+            );
+        }
+
+        // Release the reader so we can create a writer
+        drop(reader);
+
+        match self.state.write().await.add_server(server) {
+            Ok(_) => (),
+            Err(e) => {
+                error!("Could not write to state file: {e}");
+                return Err(AppError {
+                    status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                    description: "Pairing failed".to_string(),
+                });
+            }
+        }
+
+        Ok(())
    }
-
-    // Save certificate to disk so it can be used for subsequent connections
-    if let Err(e) = save_cert_and_key_to_disk(cert, private_key, &params.host, params.port) {
-        println!("Could not save cert and key to disk");
-        return StatusCode::INTERNAL_SERVER_ERROR;
-    };
-
-    StatusCode::OK
 }
@@ -0,0 +1,117 @@
+use anyhow::{Result, anyhow};
+
+use salvo::{
+    prelude::*,
+    proto::quic::BidiStream,
+    webtransport::{self},
+};
+use serde::{Deserialize, Serialize};
+use tracing::{error, info};
+
+use crate::{
+    backend,
+    common::{AppError, AppResult},
+};
+
+#[derive(Serialize, Deserialize)]
+pub struct ProxySetupParams {
+    pub stream: backend::Stream,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct ProxySetupResponse {
+    pub cert_hash: [u8; 32],
+    //pub cert_hash: String,
+}
+
+async fn setup_webtransport(
+    req: &mut Request,
+) -> Result<(
+    impl tokio::io::AsyncWrite + Send + Sync + 'static,
+    impl tokio::io::AsyncRead + Send + Sync + 'static,
+    h3_datagram::datagram_handler::DatagramSender<
+        <h3_quinn::Connection as h3_datagram::quic_traits::DatagramConnectionExt<
+            salvo::hyper::body::Bytes,
+        >>::SendDatagramHandler,
+        salvo::hyper::body::Bytes,
+    >,
+    //salvo::webtransport::stream::SendStream<
+    //    impl salvo::proto::quic::SendStream<salvo::hyper::body::Bytes>,
+    //    salvo::hyper::body::Bytes,
+    //>,
+    //salvo::webtransport::stream::RecvStream<
+    //    impl salvo::proto::quic::RecvStream,
+    //    salvo::hyper::body::Bytes,
+    //>,
+)> {
+    let session = req.web_transport_mut().await?;
+
+    let datagram_send = session.datagram_sender();
+
+    let bidirectional_stream = session
+        .accept_bi()
+        .await?
+        .ok_or(anyhow!("No bidirectional stream"))?;
+
+    if let webtransport::server::AcceptedBi::BidiStream(_, stream) = bidirectional_stream {
+        let (stream_send, stream_recv) = stream.split();
+        Ok((stream_send, stream_recv, datagram_send))
+    } else {
+        Err(anyhow!("bidirectional stream was of the wrong type"))
+    }
+}
+
+#[craft]
+impl crate::proxy::Proxy {
+    #[craft(handler)]
+    pub async fn stream_setup(
+        self: ::std::sync::Arc<Self>,
+        body: salvo::oapi::extract::JsonBody<ProxySetupParams>,
+    ) -> AppResult<Json<ProxySetupResponse>> {
+        let mut writer = self.stream.write().await;
+        *writer = Some(body.stream.clone());
+
+        info!("Configured proxy with config: {:?}", body.stream);
+
+        Ok(Json(ProxySetupResponse {
+            cert_hash: self.cert_hash,
+        }))
+    }
+
+    #[craft(handler)]
+    pub async fn stream_connect(self: ::std::sync::Arc<Self>, req: &mut Request) -> AppResult<()> {
+        let standard_error = Err(crate::common::AppError {
+            status_code: StatusCode::INTERNAL_SERVER_ERROR,
+            description: "Could not start stream".to_string(),
+        });
+
+        info!("WebTransport connection initiated");
+        let (wt_stream_send, wt_stream_recv, wt_datagram_send) = match setup_webtransport(req).await
+        {
+            Ok(w) => w,
+            Err(e) => {
+                error!("Could not upgrade connection to WebTransport: {e}");
+                return standard_error;
+            }
+        };
+
+        let stream = match self.stream.read().await.clone() {
+            Some(s) => s,
+            None => {
+                error!("Stream has not been configured, cannot connect to server");
+                return Err(AppError {
+                    status_code: StatusCode::BAD_REQUEST,
+                    description: "Proxy has not been configured yet: THIS IS A BUG".to_string(),
+                });
+            }
+        };
+
+        match super::proxy_main(stream, wt_stream_send, wt_stream_recv, wt_datagram_send).await {
+            Ok(()) => Ok(()),
+            Err(e) => {
+                error!("Proxy main loop failed: {e}");
+                standard_error
+            }
+        }
+    }
+}
@@ -0,0 +1 @@
+pub mod input_generated;
@@ -0,0 +1,101 @@
+use anyhow::{Context, Result};
+use tokio::{io::AsyncReadExt, io::AsyncWriteExt, select, sync::RwLock};
+use tracing::{debug, error, info};
+
+use crate::{backend, gamestream};
+
+pub mod handler;
+mod input;
+mod packet_parser;
+mod video;
+
+pub struct Proxy {
+    pub cert_hash: [u8; 32],
+    //pub cert_hash: String,
+    pub stream: RwLock<Option<backend::Stream>>,
+}
+
+impl Proxy {
+    pub fn new(cert_hash: [u8; 32]) -> Self {
+        //pub fn new(cert_hash: String) -> Self {
+        Proxy {
+            stream: RwLock::new(None),
+            cert_hash,
+        }
+    }
+}
+
+pub struct Channels {
+    gamestream_channels: gamestream::GamestreamChannels,
+    stop_tx: tokio::sync::oneshot::Sender<()>,
+}
+
+async fn proxy_main(
+    stream: backend::Stream,
+    mut wt_send: impl tokio::io::AsyncWrite + Send + Sync + 'static + std::marker::Unpin,
+    mut wt_recv: impl tokio::io::AsyncRead + Send + Sync + 'static + std::marker::Unpin,
+    mut wt_datagram_send: h3_datagram::datagram_handler::DatagramSender<
+        <h3_quinn::Connection as h3_datagram::quic_traits::DatagramConnectionExt<
+            salvo::hyper::body::Bytes,
+        >>::SendDatagramHandler,
+        salvo::hyper::body::Bytes,
+    >,
+) -> Result<()> {
+    debug!(
+        "Connecting to stream at address {} with stream config {:?}",
+        stream.server_address, stream
+    );
+
+    let mut channels = spawn_gamestream(stream).await?;
+
+    let mut packet_buffer = packet_parser::PacketBuffer::new();
+    let mut buffer = [0u8; 65536];
+
+    loop {
+        select! {
+            gamestream_packet = channels.gamestream_channels.decoder_rx.recv() => {
+                match gamestream_packet {
+                    Some(frame) => {
+                        video::send_video_update(&frame, &mut wt_datagram_send).await?;
+                    }
+                    None => {
+                        error!("Decoder channel is None");
+                        break;
+                    }
+                }
+            },
+            ret = wt_recv.read(&mut buffer) => {
+                let bytes_read = ret?;
+
+                packet_parser::handle_client_packet(&mut packet_buffer, &buffer[..bytes_read])?;
+
+            }
+        }
+    }
+
+    channels.stop_tx.send(());
+
+    Ok(())
+}
+
+async fn spawn_gamestream(stream: backend::Stream) -> Result<Channels> {
+    let (tx, rx) = tokio::sync::oneshot::channel();
+    let (stop_tx, stop_rx) = tokio::sync::oneshot::channel::<()>();
+
+    std::thread::spawn(move || {
+        let result = gamestream::start_connection(&stream, &stream.server_address);
+
+        let _ = tx.send(result);
+
+        let _ = stop_rx.blocking_recv();
+
+        gamestream::stop_connection();
+    });
+
+    Ok(Channels {
+        stop_tx,
+        gamestream_channels: rx
+            .await?
+            .context("Could not get gamestream communication channels")?,
+    })
+}
@@ -0,0 +1,158 @@
+use anyhow::{Result, anyhow};
+use tracing::{debug, error, info};
+
+use super::input::input_generated::input_event;
+use crate::gamestream;
+
+pub struct PacketBuffer {
+    buffer: Vec<u8>,
+    expected_length: Option<usize>,
+    length_bytes_needed: usize,
+}
+
+impl PacketBuffer {
+    pub fn new() -> Self {
+        Self {
+            buffer: Vec::new(),
+            expected_length: None,
+            length_bytes_needed: 4, // Assuming u32 length (4 bytes)
+        }
+    }
+
+    /// Process incoming data and return complete packets
+    pub fn process_data(&mut self, data: &[u8]) -> Vec<Vec<u8>> {
+        let mut complete_packets = Vec::new();
+        self.buffer.extend_from_slice(data);
+
+        loop {
+            // If we don't know the expected length yet, try to read it
+            if self.expected_length.is_none() {
+                if self.buffer.len() >= self.length_bytes_needed {
+                    // Read length from first 4 bytes (adjust as needed)
+                    let length = u32::from_be_bytes([
+                        self.buffer[0],
+                        self.buffer[1],
+                        self.buffer[2],
+                        self.buffer[3],
+                    ]) as usize;
+
+                    self.expected_length = Some(length);
+                } else {
+                    // Not enough data to read length yet
+                    break;
+                }
+            }
+
+            // We know the expected length, check if we have a complete packet
+            if let Some(expected_len) = self.expected_length {
+                let total_packet_size = self.length_bytes_needed + expected_len;
+
+                if self.buffer.len() >= total_packet_size {
+                    // We have a complete packet - extract just the data portion
+                    let packet_data =
+                        self.buffer[self.length_bytes_needed..total_packet_size].to_vec();
+                    complete_packets.push(packet_data);
+
+                    // Remove the processed packet from buffer
+                    self.buffer.drain(0..total_packet_size);
+                    self.expected_length = None;
+                } else {
+                    // Packet is incomplete
+                    break;
+                }
+            }
+        }
+
+        complete_packets
+    }
+}
+
+pub fn process_keyboard_event(input_event: input_event::InputEvent) -> Result<()> {
+    let Some(table) = input_event.input() else {
+        debug!("Keyboard event table was empty, ignoring");
+        return Err(anyhow!("Keyboard event table was empty"));
+    };
+    let keyboard_event = unsafe { input_event::KeyboardInput::init_from_table(table) };
+
+    let key_action_i8 = match keyboard_event.key_action() {
+        input_event::KeyAction::DOWN => moonlight_common_c_sys::KEY_ACTION_DOWN,
+        input_event::KeyAction::UP => moonlight_common_c_sys::KEY_ACTION_UP,
+        _ => {
+            debug!("Invalid KeyAction value, ignoring");
+            return Err(anyhow!("Invalid KeyAction value"));
+        }
+    };
+
+    gamestream::send_keyboard_event(keyboard_event.key_code(), key_action_i8, 0)
+}
+
+pub fn process_mouse_move_event(input_event: input_event::InputEvent) -> Result<()> {
+    let Some(table) = input_event.input() else {
+        debug!("MouseMovement event table was empty, ignoring");
+        return Err(anyhow!("MouseMovement event table was empty"));
+    };
+    let mouse_event = unsafe { input_event::MouseMovement::init_from_table(table) };
+
+    gamestream::send_mouse_move_event(mouse_event.movement_x(), mouse_event.movement_y())
+}
+
+pub fn process_mouse_input_event(input_event: input_event::InputEvent) -> Result<()> {
+    let Some(table) = input_event.input() else {
+        debug!("MouseInput event table was empty, ignoring");
+        return Err(anyhow!("MouseInput event table was empty"));
+    };
+    let mouse_event = unsafe { input_event::MouseInput::init_from_table(table) };
+
+    let button_action_i8 = match mouse_event.button_action() {
+        input_event::KeyAction::DOWN => moonlight_common_c_sys::BUTTON_ACTION_PRESS,
+        input_event::KeyAction::UP => moonlight_common_c_sys::BUTTON_ACTION_RELEASE,
+        _ => {
+            error!("Invalid KeyAction value, ignoring",);
+            return Err(anyhow!("Invalid KeyAction value"));
+        }
+    };
+
+    let mouse_button_i32 = match mouse_event.button() {
+        input_event::MouseButton::LEFT => moonlight_common_c_sys::BUTTON_LEFT,
+        input_event::MouseButton::MIDDLE => moonlight_common_c_sys::BUTTON_MIDDLE,
+        input_event::MouseButton::RIGHT => moonlight_common_c_sys::BUTTON_RIGHT,
+        input_event::MouseButton::X1 => moonlight_common_c_sys::BUTTON_X1,
+        input_event::MouseButton::X2 => moonlight_common_c_sys::BUTTON_X2,
+        _ => {
+            error!("Invalid MouseButton value, ignoring",);
+            return Err(anyhow!("Invalid MouseButton value"));
+        }
+    };
+
+    gamestream::send_mouse_input_event(button_action_i8, mouse_button_i32)
+}
+
+pub fn handle_client_packet(packet_buffer: &mut PacketBuffer, buffer: &[u8]) -> anyhow::Result<()> {
+    let complete_packets = packet_buffer.process_data(buffer);
+
+    // TODO: only supports input packets. this should use a union wrapper or something
+    for packet_data in complete_packets {
+        let input_event = input_event::root_as_input_event(&packet_data)?;
+        match input_event.input_type() {
+            input_event::Input::Keyboard => {
+                process_keyboard_event(input_event)?;
+            }
+            input_event::Input::MouseMovement => {
+                process_mouse_move_event(input_event)?;
+            }
+            input_event::Input::MouseInput => {
+                process_mouse_input_event(input_event)?;
+            }
+
+            input_event::Input::NONE => {
+                debug!("Input event was empty, ignoring.")
+            }
+            _ => {
+                error!("Unknown InputEvent type");
+                return Err(anyhow!("Unknown InputEvent type"));
+            }
+        }
+    }
+
+    Ok(())
+}
@@ -0,0 +1,185 @@
+use anyhow::Result;
+use tracing::debug;
+
+use crate::gamestream;
+use video_generated::video_update;
+
+mod video_generated;
+
+fn create_setup_videoupdate(
+    video_format: &gamestream::decoder::VideoFormat,
+    width: u64,
+    height: u64,
+    redraw_rate: u64,
+) -> Vec<u8> {
+    let mut builder = flatbuffers::FlatBufferBuilder::with_capacity(1024);
+
+    //TODO: this is hardcoded to h264 main profile
+    let video_format = Some(builder.create_string("avc1.4D401E"));
+
+    let setup = video_update::Setup::create(
+        &mut builder,
+        &video_update::SetupArgs {
+            video_format,
+            width: width as u16,
+            height: height as u16,
+            redraw_rate: redraw_rate as u16,
+        },
+    );
+
+    let video_update = video_update::VideoUpdate::create(
+        &mut builder,
+        &video_update::VideoUpdateArgs {
+            update_type: video_update::Update::Setup,
+            update: Some(setup.as_union_value()),
+        },
+    );
+
+    builder.finish(video_update, None);
+
+    builder.finished_data().to_vec()
+}
+
+fn create_decodeunitstart_videoupdate(
+    frame_number: u64,
+    frame_type: &gamestream::decoder::FrameType,
+    num_buffers: u64,
+    receive_time_ms: u64,
+    full_length: u64,
+) -> Vec<u8> {
+    let mut builder = flatbuffers::FlatBufferBuilder::with_capacity(1024);
+
+    let frame_type_fb = match frame_type {
+        gamestream::decoder::FrameType::IDR => video_update::FrameType::IDR,
+        gamestream::decoder::FrameType::PFRAME => video_update::FrameType::PFRAME,
+    };
+
+    let decode_unit_start = video_update::DecodeUnitStart::create(
+        &mut builder,
+        &video_update::DecodeUnitStartArgs {
+            frame_number,
+            frame_type: frame_type_fb,
+            num_buffers,
+            receive_time_ms: receive_time_ms as u16,
+            full_length,
+        },
+    );
+
+    let video_update = video_update::VideoUpdate::create(
+        &mut builder,
+        &video_update::VideoUpdateArgs {
+            update_type: video_update::Update::DecodeUnitStart,
+            update: Some(decode_unit_start.as_union_value()),
+        },
+    );
+
+    builder.finish(video_update, None);
+
+    builder.finished_data().to_vec()
+}
+
+fn create_decodeunitbuffer_videoupdate(
+    frame_number: u64,
+    buffer_index: u64,
+    buffer_offset: u64,
+    buffer: &gamestream::decoder::Buffer,
+) -> Vec<u8> {
+    let mut builder = flatbuffers::FlatBufferBuilder::with_capacity(1024);
+
+    let data_vector = builder.create_vector(&buffer.data);
+
+    let decode_unit_buffer = video_update::DecodeUnitBuffer::create(
+        &mut builder,
+        &video_update::DecodeUnitBufferArgs {
+            frame_number,
+            buffer_index,
+            buffer_offset,
+            data: Some(data_vector),
+        },
+    );
+
+    let video_update = video_update::VideoUpdate::create(
+        &mut builder,
+        &video_update::VideoUpdateArgs {
+            update_type: video_update::Update::DecodeUnitBuffer,
+            update: Some(decode_unit_buffer.as_union_value()),
+        },
+    );
+
+    builder.finish(video_update, None);
+
+    builder.finished_data().to_vec()
+}
+
+pub async fn send_video_update(
+    frame: &gamestream::decoder::RendererMessage,
+    wt_datagram_send: &mut h3_datagram::datagram_handler::DatagramSender<
+        <h3_quinn::Connection as h3_datagram::quic_traits::DatagramConnectionExt<
+            salvo::hyper::body::Bytes,
+        >>::SendDatagramHandler,
+        salvo::hyper::body::Bytes,
+    >,
+) -> Result<()> {
+    let mut print_time = false;
+    let buffer = match frame {
+        gamestream::decoder::RendererMessage::Setup {
+            video_format,
+            width,
+            height,
+            redraw_rate,
+            dr_flags,
+        } => create_setup_videoupdate(video_format, *width, *height, *redraw_rate),
+        gamestream::decoder::RendererMessage::DecodeUnitStart {
+            frame_number,
+            frame_type,
+            num_buffers,
+            host_processing_latency,
+            receive_time_ms,
+            enqueue_time_ms,
+            presentation_time,
+            full_length,
+            hdr_active,
+            colorspace,
+        } => {
+            //debug!(
+            //    "sending decodeunitstart {}: {:?}",
+            //    *frame_number,
+            //    std::time::Instant::now()
+            //);
+            create_decodeunitstart_videoupdate(
+                *frame_number,
+                frame_type,
+                *num_buffers,
+                *receive_time_ms,
+                *full_length,
+            )
+        }
+        gamestream::decoder::RendererMessage::DecodeUnitBuffer {
+            frame_number,
+            buffer_index,
+            buffer_offset,
+            buffer,
+        } => {
+            //debug!(
+            //    "sending decodeunitbuffer {}/{}: {:?}",
+            //    *frame_number,
+            //    *buffer_index,
+            //    std::time::Instant::now()
+            //);
+            create_decodeunitbuffer_videoupdate(
+                *frame_number,
+                *buffer_index,
+                *buffer_offset,
+                buffer,
+            )
+        }
+    };
+
+    let bytes = salvo::hyper::body::Bytes::copy_from_slice(&buffer);
+
+    wt_datagram_send.send_datagram(bytes)?;
+    debug!("sent start: {:?}", std::time::Instant::now());
+    //if (print_time) {
+    //}
+    Ok(())
+}
@@ -0,0 +1,925 @@
+// automatically generated by the FlatBuffers compiler, do not modify
+
+
+// @generated
+
+use core::mem;
+use core::cmp::Ordering;
+
+extern crate flatbuffers;
+use self::flatbuffers::{EndianScalar, Follow};
+
+#[allow(unused_imports, dead_code)]
+pub mod video_update {
+
+  use core::mem;
+  use core::cmp::Ordering;
+
+  extern crate flatbuffers;
+  use self::flatbuffers::{EndianScalar, Follow};
+
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+pub const ENUM_MIN_FRAME_TYPE: i8 = 0;
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+pub const ENUM_MAX_FRAME_TYPE: i8 = 1;
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+#[allow(non_camel_case_types)]
+pub const ENUM_VALUES_FRAME_TYPE: [FrameType; 2] = [
+  FrameType::PFRAME,
+  FrameType::IDR,
+];
+
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Default)]
+#[repr(transparent)]
+pub struct FrameType(pub i8);
+#[allow(non_upper_case_globals)]
+impl FrameType {
+  pub const PFRAME: Self = Self(0);
+  pub const IDR: Self = Self(1);
+
+  pub const ENUM_MIN: i8 = 0;
+  pub const ENUM_MAX: i8 = 1;
+  pub const ENUM_VALUES: &'static [Self] = &[
+    Self::PFRAME,
+    Self::IDR,
+  ];
+  /// Returns the variant's name or "" if unknown.
+  pub fn variant_name(self) -> Option<&'static str> {
+    match self {
+      Self::PFRAME => Some("PFRAME"),
+      Self::IDR => Some("IDR"),
+      _ => None,
+    }
+  }
+}
+impl core::fmt::Debug for FrameType {
+  fn fmt(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
+    if let Some(name) = self.variant_name() {
+      f.write_str(name)
+    } else {
+      f.write_fmt(format_args!("<UNKNOWN {:?}>", self.0))
+    }
+  }
+}
+impl<'a> flatbuffers::Follow<'a> for FrameType {
+  type Inner = Self;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    let b = flatbuffers::read_scalar_at::<i8>(buf, loc);
+    Self(b)
+  }
+}
+
+impl flatbuffers::Push for FrameType {
+    type Output = FrameType;
+    #[inline]
+    unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
+        flatbuffers::emplace_scalar::<i8>(dst, self.0);
+    }
+}
+
+impl flatbuffers::EndianScalar for FrameType {
+  type Scalar = i8;
+  #[inline]
+  fn to_little_endian(self) -> i8 {
+    self.0.to_le()
+  }
+  #[inline]
+  #[allow(clippy::wrong_self_convention)]
+  fn from_little_endian(v: i8) -> Self {
+    let b = i8::from_le(v);
+    Self(b)
+  }
+}
+
+impl<'a> flatbuffers::Verifiable for FrameType {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    i8::run_verifier(v, pos)
+  }
+}
+
+impl flatbuffers::SimpleToVerifyInSlice for FrameType {}
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+pub const ENUM_MIN_UPDATE: u8 = 0;
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+pub const ENUM_MAX_UPDATE: u8 = 3;
+#[deprecated(since = "2.0.0", note = "Use associated constants instead. This will no longer be generated in 2021.")]
+#[allow(non_camel_case_types)]
+pub const ENUM_VALUES_UPDATE: [Update; 4] = [
+  Update::NONE,
+  Update::Setup,
+  Update::DecodeUnitStart,
+  Update::DecodeUnitBuffer,
+];
+
+#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Default)]
+#[repr(transparent)]
+pub struct Update(pub u8);
+#[allow(non_upper_case_globals)]
+impl Update {
+  pub const NONE: Self = Self(0);
+  pub const Setup: Self = Self(1);
+  pub const DecodeUnitStart: Self = Self(2);
+  pub const DecodeUnitBuffer: Self = Self(3);
+
+  pub const ENUM_MIN: u8 = 0;
+  pub const ENUM_MAX: u8 = 3;
+  pub const ENUM_VALUES: &'static [Self] = &[
+    Self::NONE,
+    Self::Setup,
+    Self::DecodeUnitStart,
+    Self::DecodeUnitBuffer,
+  ];
+  /// Returns the variant's name or "" if unknown.
+  pub fn variant_name(self) -> Option<&'static str> {
+    match self {
+      Self::NONE => Some("NONE"),
+      Self::Setup => Some("Setup"),
+      Self::DecodeUnitStart => Some("DecodeUnitStart"),
+      Self::DecodeUnitBuffer => Some("DecodeUnitBuffer"),
+      _ => None,
+    }
+  }
+}
+impl core::fmt::Debug for Update {
+  fn fmt(&self, f: &mut core::fmt::Formatter) -> core::fmt::Result {
+    if let Some(name) = self.variant_name() {
+      f.write_str(name)
+    } else {
+      f.write_fmt(format_args!("<UNKNOWN {:?}>", self.0))
+    }
+  }
+}
+impl<'a> flatbuffers::Follow<'a> for Update {
+  type Inner = Self;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    let b = flatbuffers::read_scalar_at::<u8>(buf, loc);
+    Self(b)
+  }
+}
+
+impl flatbuffers::Push for Update {
+    type Output = Update;
+    #[inline]
+    unsafe fn push(&self, dst: &mut [u8], _written_len: usize) {
+        flatbuffers::emplace_scalar::<u8>(dst, self.0);
+    }
+}
+
+impl flatbuffers::EndianScalar for Update {
+  type Scalar = u8;
+  #[inline]
+  fn to_little_endian(self) -> u8 {
+    self.0.to_le()
+  }
+  #[inline]
+  #[allow(clippy::wrong_self_convention)]
+  fn from_little_endian(v: u8) -> Self {
+    let b = u8::from_le(v);
+    Self(b)
+  }
+}
+
+impl<'a> flatbuffers::Verifiable for Update {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    u8::run_verifier(v, pos)
+  }
+}
+
+impl flatbuffers::SimpleToVerifyInSlice for Update {}
+pub struct UpdateUnionTableOffset {}
+
+pub enum SetupOffset {}
+#[derive(Copy, Clone, PartialEq)]
+
+pub struct Setup<'a> {
+  pub _tab: flatbuffers::Table<'a>,
+}
+
+impl<'a> flatbuffers::Follow<'a> for Setup<'a> {
+  type Inner = Setup<'a>;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
+  }
+}
+
+impl<'a> Setup<'a> {
+  pub const VT_VIDEO_FORMAT: flatbuffers::VOffsetT = 4;
+  pub const VT_WIDTH: flatbuffers::VOffsetT = 6;
+  pub const VT_HEIGHT: flatbuffers::VOffsetT = 8;
+  pub const VT_REDRAW_RATE: flatbuffers::VOffsetT = 10;
+
+  #[inline]
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+    Setup { _tab: table }
+  }
+  #[allow(unused_mut)]
+  pub fn create<'bldr: 'args, 'args: 'mut_bldr, 'mut_bldr, A: flatbuffers::Allocator + 'bldr>(
+    _fbb: &'mut_bldr mut flatbuffers::FlatBufferBuilder<'bldr, A>,
+    args: &'args SetupArgs<'args>
+  ) -> flatbuffers::WIPOffset<Setup<'bldr>> {
+    let mut builder = SetupBuilder::new(_fbb);
+    if let Some(x) = args.video_format { builder.add_video_format(x); }
+    builder.add_redraw_rate(args.redraw_rate);
+    builder.add_height(args.height);
+    builder.add_width(args.width);
+    builder.finish()
+  }
+
+
+  #[inline]
+  pub fn video_format(&self) -> Option<&'a str> {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<flatbuffers::ForwardsUOffset<&str>>(Setup::VT_VIDEO_FORMAT, None)}
+  }
+  #[inline]
+  pub fn width(&self) -> u16 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u16>(Setup::VT_WIDTH, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn height(&self) -> u16 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u16>(Setup::VT_HEIGHT, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn redraw_rate(&self) -> u16 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u16>(Setup::VT_REDRAW_RATE, Some(0)).unwrap()}
+  }
+}
+
+impl flatbuffers::Verifiable for Setup<'_> {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    v.visit_table(pos)?
+     .visit_field::<flatbuffers::ForwardsUOffset<&str>>("video_format", Self::VT_VIDEO_FORMAT, false)?
+     .visit_field::<u16>("width", Self::VT_WIDTH, false)?
+     .visit_field::<u16>("height", Self::VT_HEIGHT, false)?
+     .visit_field::<u16>("redraw_rate", Self::VT_REDRAW_RATE, false)?
+     .finish();
+    Ok(())
+  }
+}
+pub struct SetupArgs<'a> {
+    pub video_format: Option<flatbuffers::WIPOffset<&'a str>>,
+    pub width: u16,
+    pub height: u16,
+    pub redraw_rate: u16,
+}
+impl<'a> Default for SetupArgs<'a> {
+  #[inline]
+  fn default() -> Self {
+    SetupArgs {
+      video_format: None,
+      width: 0,
+      height: 0,
+      redraw_rate: 0,
+    }
+  }
+}
+
+pub struct SetupBuilder<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> {
+  fbb_: &'b mut flatbuffers::FlatBufferBuilder<'a, A>,
+  start_: flatbuffers::WIPOffset<flatbuffers::TableUnfinishedWIPOffset>,
+}
+impl<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> SetupBuilder<'a, 'b, A> {
+  #[inline]
+  pub fn add_video_format(&mut self, video_format: flatbuffers::WIPOffset<&'b  str>) {
+    self.fbb_.push_slot_always::<flatbuffers::WIPOffset<_>>(Setup::VT_VIDEO_FORMAT, video_format);
+  }
+  #[inline]
+  pub fn add_width(&mut self, width: u16) {
+    self.fbb_.push_slot::<u16>(Setup::VT_WIDTH, width, 0);
+  }
+  #[inline]
+  pub fn add_height(&mut self, height: u16) {
+    self.fbb_.push_slot::<u16>(Setup::VT_HEIGHT, height, 0);
+  }
+  #[inline]
+  pub fn add_redraw_rate(&mut self, redraw_rate: u16) {
+    self.fbb_.push_slot::<u16>(Setup::VT_REDRAW_RATE, redraw_rate, 0);
+  }
+  #[inline]
+  pub fn new(_fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>) -> SetupBuilder<'a, 'b, A> {
+    let start = _fbb.start_table();
+    SetupBuilder {
+      fbb_: _fbb,
+      start_: start,
+    }
+  }
+  #[inline]
+  pub fn finish(self) -> flatbuffers::WIPOffset<Setup<'a>> {
+    let o = self.fbb_.end_table(self.start_);
+    flatbuffers::WIPOffset::new(o.value())
+  }
+}
+
+impl core::fmt::Debug for Setup<'_> {
+  fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+    let mut ds = f.debug_struct("Setup");
+      ds.field("video_format", &self.video_format());
+      ds.field("width", &self.width());
+      ds.field("height", &self.height());
+      ds.field("redraw_rate", &self.redraw_rate());
+      ds.finish()
+  }
+}
+pub enum DecodeUnitStartOffset {}
+#[derive(Copy, Clone, PartialEq)]
+
+pub struct DecodeUnitStart<'a> {
+  pub _tab: flatbuffers::Table<'a>,
+}
+
+impl<'a> flatbuffers::Follow<'a> for DecodeUnitStart<'a> {
+  type Inner = DecodeUnitStart<'a>;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
+  }
+}
+
+impl<'a> DecodeUnitStart<'a> {
+  pub const VT_FRAME_NUMBER: flatbuffers::VOffsetT = 4;
+  pub const VT_FRAME_TYPE: flatbuffers::VOffsetT = 6;
+  pub const VT_NUM_BUFFERS: flatbuffers::VOffsetT = 8;
+  pub const VT_RECEIVE_TIME_MS: flatbuffers::VOffsetT = 10;
+  pub const VT_FULL_LENGTH: flatbuffers::VOffsetT = 12;
+
+  #[inline]
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+    DecodeUnitStart { _tab: table }
+  }
+  #[allow(unused_mut)]
+  pub fn create<'bldr: 'args, 'args: 'mut_bldr, 'mut_bldr, A: flatbuffers::Allocator + 'bldr>(
+    _fbb: &'mut_bldr mut flatbuffers::FlatBufferBuilder<'bldr, A>,
+    args: &'args DecodeUnitStartArgs
+  ) -> flatbuffers::WIPOffset<DecodeUnitStart<'bldr>> {
+    let mut builder = DecodeUnitStartBuilder::new(_fbb);
+    builder.add_full_length(args.full_length);
+    builder.add_num_buffers(args.num_buffers);
+    builder.add_frame_number(args.frame_number);
+    builder.add_receive_time_ms(args.receive_time_ms);
+    builder.add_frame_type(args.frame_type);
+    builder.finish()
+  }
+
+
+  #[inline]
+  pub fn frame_number(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitStart::VT_FRAME_NUMBER, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn frame_type(&self) -> FrameType {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<FrameType>(DecodeUnitStart::VT_FRAME_TYPE, Some(FrameType::PFRAME)).unwrap()}
+  }
+  #[inline]
+  pub fn num_buffers(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitStart::VT_NUM_BUFFERS, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn receive_time_ms(&self) -> u16 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u16>(DecodeUnitStart::VT_RECEIVE_TIME_MS, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn full_length(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitStart::VT_FULL_LENGTH, Some(0)).unwrap()}
+  }
+}
+
+impl flatbuffers::Verifiable for DecodeUnitStart<'_> {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    v.visit_table(pos)?
+     .visit_field::<u64>("frame_number", Self::VT_FRAME_NUMBER, false)?
+     .visit_field::<FrameType>("frame_type", Self::VT_FRAME_TYPE, false)?
+     .visit_field::<u64>("num_buffers", Self::VT_NUM_BUFFERS, false)?
+     .visit_field::<u16>("receive_time_ms", Self::VT_RECEIVE_TIME_MS, false)?
+     .visit_field::<u64>("full_length", Self::VT_FULL_LENGTH, false)?
+     .finish();
+    Ok(())
+  }
+}
+pub struct DecodeUnitStartArgs {
+    pub frame_number: u64,
+    pub frame_type: FrameType,
+    pub num_buffers: u64,
+    pub receive_time_ms: u16,
+    pub full_length: u64,
+}
+impl<'a> Default for DecodeUnitStartArgs {
+  #[inline]
+  fn default() -> Self {
+    DecodeUnitStartArgs {
+      frame_number: 0,
+      frame_type: FrameType::PFRAME,
+      num_buffers: 0,
+      receive_time_ms: 0,
+      full_length: 0,
+    }
+  }
+}
+
+pub struct DecodeUnitStartBuilder<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> {
+  fbb_: &'b mut flatbuffers::FlatBufferBuilder<'a, A>,
+  start_: flatbuffers::WIPOffset<flatbuffers::TableUnfinishedWIPOffset>,
+}
+impl<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> DecodeUnitStartBuilder<'a, 'b, A> {
+  #[inline]
+  pub fn add_frame_number(&mut self, frame_number: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitStart::VT_FRAME_NUMBER, frame_number, 0);
+  }
+  #[inline]
+  pub fn add_frame_type(&mut self, frame_type: FrameType) {
+    self.fbb_.push_slot::<FrameType>(DecodeUnitStart::VT_FRAME_TYPE, frame_type, FrameType::PFRAME);
+  }
+  #[inline]
+  pub fn add_num_buffers(&mut self, num_buffers: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitStart::VT_NUM_BUFFERS, num_buffers, 0);
+  }
+  #[inline]
+  pub fn add_receive_time_ms(&mut self, receive_time_ms: u16) {
+    self.fbb_.push_slot::<u16>(DecodeUnitStart::VT_RECEIVE_TIME_MS, receive_time_ms, 0);
+  }
+  #[inline]
+  pub fn add_full_length(&mut self, full_length: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitStart::VT_FULL_LENGTH, full_length, 0);
+  }
+  #[inline]
+  pub fn new(_fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>) -> DecodeUnitStartBuilder<'a, 'b, A> {
+    let start = _fbb.start_table();
+    DecodeUnitStartBuilder {
+      fbb_: _fbb,
+      start_: start,
+    }
+  }
+  #[inline]
+  pub fn finish(self) -> flatbuffers::WIPOffset<DecodeUnitStart<'a>> {
+    let o = self.fbb_.end_table(self.start_);
+    flatbuffers::WIPOffset::new(o.value())
+  }
+}
+
+impl core::fmt::Debug for DecodeUnitStart<'_> {
+  fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+    let mut ds = f.debug_struct("DecodeUnitStart");
+      ds.field("frame_number", &self.frame_number());
+      ds.field("frame_type", &self.frame_type());
+      ds.field("num_buffers", &self.num_buffers());
+      ds.field("receive_time_ms", &self.receive_time_ms());
+      ds.field("full_length", &self.full_length());
+      ds.finish()
+  }
+}
+pub enum DecodeUnitBufferOffset {}
+#[derive(Copy, Clone, PartialEq)]
+
+pub struct DecodeUnitBuffer<'a> {
+  pub _tab: flatbuffers::Table<'a>,
+}
+
+impl<'a> flatbuffers::Follow<'a> for DecodeUnitBuffer<'a> {
+  type Inner = DecodeUnitBuffer<'a>;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
+  }
+}
+
+impl<'a> DecodeUnitBuffer<'a> {
+  pub const VT_FRAME_NUMBER: flatbuffers::VOffsetT = 4;
+  pub const VT_BUFFER_INDEX: flatbuffers::VOffsetT = 6;
+  pub const VT_BUFFER_OFFSET: flatbuffers::VOffsetT = 8;
+  pub const VT_DATA: flatbuffers::VOffsetT = 10;
+
+  #[inline]
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+    DecodeUnitBuffer { _tab: table }
+  }
+  #[allow(unused_mut)]
+  pub fn create<'bldr: 'args, 'args: 'mut_bldr, 'mut_bldr, A: flatbuffers::Allocator + 'bldr>(
+    _fbb: &'mut_bldr mut flatbuffers::FlatBufferBuilder<'bldr, A>,
+    args: &'args DecodeUnitBufferArgs<'args>
+  ) -> flatbuffers::WIPOffset<DecodeUnitBuffer<'bldr>> {
+    let mut builder = DecodeUnitBufferBuilder::new(_fbb);
+    builder.add_buffer_offset(args.buffer_offset);
+    builder.add_buffer_index(args.buffer_index);
+    builder.add_frame_number(args.frame_number);
+    if let Some(x) = args.data { builder.add_data(x); }
+    builder.finish()
+  }
+
+
+  #[inline]
+  pub fn frame_number(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitBuffer::VT_FRAME_NUMBER, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn buffer_index(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitBuffer::VT_BUFFER_INDEX, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn buffer_offset(&self) -> u64 {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<u64>(DecodeUnitBuffer::VT_BUFFER_OFFSET, Some(0)).unwrap()}
+  }
+  #[inline]
+  pub fn data(&self) -> Option<flatbuffers::Vector<'a, u8>> {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<flatbuffers::ForwardsUOffset<flatbuffers::Vector<'a, u8>>>(DecodeUnitBuffer::VT_DATA, None)}
+  }
+}
+
+impl flatbuffers::Verifiable for DecodeUnitBuffer<'_> {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    v.visit_table(pos)?
+     .visit_field::<u64>("frame_number", Self::VT_FRAME_NUMBER, false)?
+     .visit_field::<u64>("buffer_index", Self::VT_BUFFER_INDEX, false)?
+     .visit_field::<u64>("buffer_offset", Self::VT_BUFFER_OFFSET, false)?
+     .visit_field::<flatbuffers::ForwardsUOffset<flatbuffers::Vector<'_, u8>>>("data", Self::VT_DATA, false)?
+     .finish();
+    Ok(())
+  }
+}
+pub struct DecodeUnitBufferArgs<'a> {
+    pub frame_number: u64,
+    pub buffer_index: u64,
+    pub buffer_offset: u64,
+    pub data: Option<flatbuffers::WIPOffset<flatbuffers::Vector<'a, u8>>>,
+}
+impl<'a> Default for DecodeUnitBufferArgs<'a> {
+  #[inline]
+  fn default() -> Self {
+    DecodeUnitBufferArgs {
+      frame_number: 0,
+      buffer_index: 0,
+      buffer_offset: 0,
+      data: None,
+    }
+  }
+}
+
+pub struct DecodeUnitBufferBuilder<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> {
+  fbb_: &'b mut flatbuffers::FlatBufferBuilder<'a, A>,
+  start_: flatbuffers::WIPOffset<flatbuffers::TableUnfinishedWIPOffset>,
+}
+impl<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> DecodeUnitBufferBuilder<'a, 'b, A> {
+  #[inline]
+  pub fn add_frame_number(&mut self, frame_number: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitBuffer::VT_FRAME_NUMBER, frame_number, 0);
+  }
+  #[inline]
+  pub fn add_buffer_index(&mut self, buffer_index: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitBuffer::VT_BUFFER_INDEX, buffer_index, 0);
+  }
+  #[inline]
+  pub fn add_buffer_offset(&mut self, buffer_offset: u64) {
+    self.fbb_.push_slot::<u64>(DecodeUnitBuffer::VT_BUFFER_OFFSET, buffer_offset, 0);
+  }
+  #[inline]
+  pub fn add_data(&mut self, data: flatbuffers::WIPOffset<flatbuffers::Vector<'b , u8>>) {
+    self.fbb_.push_slot_always::<flatbuffers::WIPOffset<_>>(DecodeUnitBuffer::VT_DATA, data);
+  }
+  #[inline]
+  pub fn new(_fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>) -> DecodeUnitBufferBuilder<'a, 'b, A> {
+    let start = _fbb.start_table();
+    DecodeUnitBufferBuilder {
+      fbb_: _fbb,
+      start_: start,
+    }
+  }
+  #[inline]
+  pub fn finish(self) -> flatbuffers::WIPOffset<DecodeUnitBuffer<'a>> {
+    let o = self.fbb_.end_table(self.start_);
+    flatbuffers::WIPOffset::new(o.value())
+  }
+}
+
+impl core::fmt::Debug for DecodeUnitBuffer<'_> {
+  fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+    let mut ds = f.debug_struct("DecodeUnitBuffer");
+      ds.field("frame_number", &self.frame_number());
+      ds.field("buffer_index", &self.buffer_index());
+      ds.field("buffer_offset", &self.buffer_offset());
+      ds.field("data", &self.data());
+      ds.finish()
+  }
+}
+pub enum VideoUpdateOffset {}
+#[derive(Copy, Clone, PartialEq)]
+
+pub struct VideoUpdate<'a> {
+  pub _tab: flatbuffers::Table<'a>,
+}
+
+impl<'a> flatbuffers::Follow<'a> for VideoUpdate<'a> {
+  type Inner = VideoUpdate<'a>;
+  #[inline]
+  unsafe fn follow(buf: &'a [u8], loc: usize) -> Self::Inner {
+    Self { _tab: flatbuffers::Table::new(buf, loc) }
+  }
+}
+
+impl<'a> VideoUpdate<'a> {
+  pub const VT_UPDATE_TYPE: flatbuffers::VOffsetT = 4;
+  pub const VT_UPDATE: flatbuffers::VOffsetT = 6;
+
+  #[inline]
+  pub unsafe fn init_from_table(table: flatbuffers::Table<'a>) -> Self {
+    VideoUpdate { _tab: table }
+  }
+  #[allow(unused_mut)]
+  pub fn create<'bldr: 'args, 'args: 'mut_bldr, 'mut_bldr, A: flatbuffers::Allocator + 'bldr>(
+    _fbb: &'mut_bldr mut flatbuffers::FlatBufferBuilder<'bldr, A>,
+    args: &'args VideoUpdateArgs
+  ) -> flatbuffers::WIPOffset<VideoUpdate<'bldr>> {
+    let mut builder = VideoUpdateBuilder::new(_fbb);
+    if let Some(x) = args.update { builder.add_update(x); }
+    builder.add_update_type(args.update_type);
+    builder.finish()
+  }
+
+
+  #[inline]
+  pub fn update_type(&self) -> Update {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<Update>(VideoUpdate::VT_UPDATE_TYPE, Some(Update::NONE)).unwrap()}
+  }
+  #[inline]
+  pub fn update(&self) -> Option<flatbuffers::Table<'a>> {
+    // Safety:
+    // Created from valid Table for this object
+    // which contains a valid value in this slot
+    unsafe { self._tab.get::<flatbuffers::ForwardsUOffset<flatbuffers::Table<'a>>>(VideoUpdate::VT_UPDATE, None)}
+  }
+  #[inline]
+  #[allow(non_snake_case)]
+  pub fn update_as_setup(&self) -> Option<Setup<'a>> {
+    if self.update_type() == Update::Setup {
+      self.update().map(|t| {
+       // Safety:
+       // Created from a valid Table for this object
+       // Which contains a valid union in this slot
+       unsafe { Setup::init_from_table(t) }
+     })
+    } else {
+      None
+    }
+  }
+
+  #[inline]
+  #[allow(non_snake_case)]
+  pub fn update_as_decode_unit_start(&self) -> Option<DecodeUnitStart<'a>> {
+    if self.update_type() == Update::DecodeUnitStart {
+      self.update().map(|t| {
+       // Safety:
+       // Created from a valid Table for this object
+       // Which contains a valid union in this slot
+       unsafe { DecodeUnitStart::init_from_table(t) }
+     })
+    } else {
+      None
+    }
+  }
+
+  #[inline]
+  #[allow(non_snake_case)]
+  pub fn update_as_decode_unit_buffer(&self) -> Option<DecodeUnitBuffer<'a>> {
+    if self.update_type() == Update::DecodeUnitBuffer {
+      self.update().map(|t| {
+       // Safety:
+       // Created from a valid Table for this object
+       // Which contains a valid union in this slot
+       unsafe { DecodeUnitBuffer::init_from_table(t) }
+     })
+    } else {
+      None
+    }
+  }
+
+}
+
+impl flatbuffers::Verifiable for VideoUpdate<'_> {
+  #[inline]
+  fn run_verifier(
+    v: &mut flatbuffers::Verifier, pos: usize
+  ) -> Result<(), flatbuffers::InvalidFlatbuffer> {
+    use self::flatbuffers::Verifiable;
+    v.visit_table(pos)?
+     .visit_union::<Update, _>("update_type", Self::VT_UPDATE_TYPE, "update", Self::VT_UPDATE, false, |key, v, pos| {
+        match key {
+          Update::Setup => v.verify_union_variant::<flatbuffers::ForwardsUOffset<Setup>>("Update::Setup", pos),
+          Update::DecodeUnitStart => v.verify_union_variant::<flatbuffers::ForwardsUOffset<DecodeUnitStart>>("Update::DecodeUnitStart", pos),
+          Update::DecodeUnitBuffer => v.verify_union_variant::<flatbuffers::ForwardsUOffset<DecodeUnitBuffer>>("Update::DecodeUnitBuffer", pos),
+          _ => Ok(()),
+        }
+     })?
+     .finish();
+    Ok(())
+  }
+}
+pub struct VideoUpdateArgs {
+    pub update_type: Update,
+    pub update: Option<flatbuffers::WIPOffset<flatbuffers::UnionWIPOffset>>,
+}
+impl<'a> Default for VideoUpdateArgs {
+  #[inline]
+  fn default() -> Self {
+    VideoUpdateArgs {
+      update_type: Update::NONE,
+      update: None,
+    }
+  }
+}
+
+pub struct VideoUpdateBuilder<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> {
+  fbb_: &'b mut flatbuffers::FlatBufferBuilder<'a, A>,
+  start_: flatbuffers::WIPOffset<flatbuffers::TableUnfinishedWIPOffset>,
+}
+impl<'a: 'b, 'b, A: flatbuffers::Allocator + 'a> VideoUpdateBuilder<'a, 'b, A> {
+  #[inline]
+  pub fn add_update_type(&mut self, update_type: Update) {
+    self.fbb_.push_slot::<Update>(VideoUpdate::VT_UPDATE_TYPE, update_type, Update::NONE);
+  }
+  #[inline]
+  pub fn add_update(&mut self, update: flatbuffers::WIPOffset<flatbuffers::UnionWIPOffset>) {
+    self.fbb_.push_slot_always::<flatbuffers::WIPOffset<_>>(VideoUpdate::VT_UPDATE, update);
+  }
+  #[inline]
+  pub fn new(_fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>) -> VideoUpdateBuilder<'a, 'b, A> {
+    let start = _fbb.start_table();
+    VideoUpdateBuilder {
+      fbb_: _fbb,
+      start_: start,
+    }
+  }
+  #[inline]
+  pub fn finish(self) -> flatbuffers::WIPOffset<VideoUpdate<'a>> {
+    let o = self.fbb_.end_table(self.start_);
+    flatbuffers::WIPOffset::new(o.value())
+  }
+}
+
+impl core::fmt::Debug for VideoUpdate<'_> {
+  fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
+    let mut ds = f.debug_struct("VideoUpdate");
+      ds.field("update_type", &self.update_type());
+      match self.update_type() {
+        Update::Setup => {
+          if let Some(x) = self.update_as_setup() {
+            ds.field("update", &x)
+          } else {
+            ds.field("update", &"InvalidFlatbuffer: Union discriminant does not match value.")
+          }
+        },
+        Update::DecodeUnitStart => {
+          if let Some(x) = self.update_as_decode_unit_start() {
+            ds.field("update", &x)
+          } else {
+            ds.field("update", &"InvalidFlatbuffer: Union discriminant does not match value.")
+          }
+        },
+        Update::DecodeUnitBuffer => {
+          if let Some(x) = self.update_as_decode_unit_buffer() {
+            ds.field("update", &x)
+          } else {
+            ds.field("update", &"InvalidFlatbuffer: Union discriminant does not match value.")
+          }
+        },
+        _ => {
+          let x: Option<()> = None;
+          ds.field("update", &x)
+        },
+      };
+      ds.finish()
+  }
+}
+#[inline]
+/// Verifies that a buffer of bytes contains a `VideoUpdate`
+/// and returns it.
+/// Note that verification is still experimental and may not
+/// catch every error, or be maximally performant. For the
+/// previous, unchecked, behavior use
+/// `root_as_video_update_unchecked`.
+pub fn root_as_video_update(buf: &[u8]) -> Result<VideoUpdate, flatbuffers::InvalidFlatbuffer> {
+  flatbuffers::root::<VideoUpdate>(buf)
+}
+#[inline]
+/// Verifies that a buffer of bytes contains a size prefixed
+/// `VideoUpdate` and returns it.
+/// Note that verification is still experimental and may not
+/// catch every error, or be maximally performant. For the
+/// previous, unchecked, behavior use
+/// `size_prefixed_root_as_video_update_unchecked`.
+pub fn size_prefixed_root_as_video_update(buf: &[u8]) -> Result<VideoUpdate, flatbuffers::InvalidFlatbuffer> {
+  flatbuffers::size_prefixed_root::<VideoUpdate>(buf)
+}
+#[inline]
+/// Verifies, with the given options, that a buffer of bytes
+/// contains a `VideoUpdate` and returns it.
+/// Note that verification is still experimental and may not
+/// catch every error, or be maximally performant. For the
+/// previous, unchecked, behavior use
+/// `root_as_video_update_unchecked`.
+pub fn root_as_video_update_with_opts<'b, 'o>(
+  opts: &'o flatbuffers::VerifierOptions,
+  buf: &'b [u8],
+) -> Result<VideoUpdate<'b>, flatbuffers::InvalidFlatbuffer> {
+  flatbuffers::root_with_opts::<VideoUpdate<'b>>(opts, buf)
+}
+#[inline]
+/// Verifies, with the given verifier options, that a buffer of
+/// bytes contains a size prefixed `VideoUpdate` and returns
+/// it. Note that verification is still experimental and may not
+/// catch every error, or be maximally performant. For the
+/// previous, unchecked, behavior use
+/// `root_as_video_update_unchecked`.
+pub fn size_prefixed_root_as_video_update_with_opts<'b, 'o>(
+  opts: &'o flatbuffers::VerifierOptions,
+  buf: &'b [u8],
+) -> Result<VideoUpdate<'b>, flatbuffers::InvalidFlatbuffer> {
+  flatbuffers::size_prefixed_root_with_opts::<VideoUpdate<'b>>(opts, buf)
+}
+#[inline]
+/// Assumes, without verification, that a buffer of bytes contains a VideoUpdate and returns it.
+/// # Safety
+/// Callers must trust the given bytes do indeed contain a valid `VideoUpdate`.
+pub unsafe fn root_as_video_update_unchecked(buf: &[u8]) -> VideoUpdate {
+  flatbuffers::root_unchecked::<VideoUpdate>(buf)
+}
+#[inline]
+/// Assumes, without verification, that a buffer of bytes contains a size prefixed VideoUpdate and returns it.
+/// # Safety
+/// Callers must trust the given bytes do indeed contain a valid size prefixed `VideoUpdate`.
+pub unsafe fn size_prefixed_root_as_video_update_unchecked(buf: &[u8]) -> VideoUpdate {
+  flatbuffers::size_prefixed_root_unchecked::<VideoUpdate>(buf)
+}
+#[inline]
+pub fn finish_video_update_buffer<'a, 'b, A: flatbuffers::Allocator + 'a>(
+    fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>,
+    root: flatbuffers::WIPOffset<VideoUpdate<'a>>) {
+  fbb.finish(root, None);
+}
+
+#[inline]
+pub fn finish_size_prefixed_video_update_buffer<'a, 'b, A: flatbuffers::Allocator + 'a>(fbb: &'b mut flatbuffers::FlatBufferBuilder<'a, A>, root: flatbuffers::WIPOffset<VideoUpdate<'a>>) {
+  fbb.finish_size_prefixed(root, None);
+}
+}  // pub mod VideoUpdate
+
@@ -0,0 +1,23 @@
+use serde::Deserialize;
+
+#[derive(Deserialize)]
+pub struct ServerInfoResponse {
+    pub hostname: String,
+    pub appversion: String,
+    pub GfeVersion: String,
+    pub uniqueid: uuid::Uuid,
+    pub HttpsPort: u16,
+    pub ExternalPort: u16,
+    pub MaxLumaPixelsHEVC: u64,
+    pub mac: String,
+    //pub ServerCommand: String,
+    //pub Permission: u64,
+    //pub VirtualDisplayCapable: bool,
+    //pub VirtualDisplayDriverReady: bool,
+    pub LocalIP: String,
+    pub ServerCodecModeSupport: i32,
+    pub PairStatus: u64,
+    pub currentgame: u64,
+    pub state: String,
+}
+
@@ -0,0 +1,158 @@
+use std::{
+    collections::HashMap,
+    fs::{self, File},
+    path::PathBuf,
+};
+
+use anyhow::{Result, anyhow};
+use serde::{Deserialize, Serialize};
+use tokio::sync::{RwLockReadGuard, RwLockWriteGuard};
+
+#[derive(Serialize, Deserialize, Clone)]
+pub struct GamestreamServer {
+    pub name: String,
+    pub host: String,
+    pub base_port: u16,
+}
+
+impl GamestreamServer {
+    pub fn http_port(&self) -> u16 {
+        self.base_port + 189
+    }
+    pub fn https_port(&self) -> u16 {
+        self.base_port + 184
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+struct State {
+    servers: HashMap<String, GamestreamServer>,
+    unique_id: String,
+}
+
+pub struct StateFile {
+    lock: tokio::sync::RwLock<()>,
+    path: PathBuf,
+}
+
+pub trait StateReader {
+    fn servers(&self) -> Result<HashMap<String, GamestreamServer>>;
+    fn unique_id(&self) -> Result<String>;
+}
+
+pub trait StateWriter {
+    fn add_server(&self, server: GamestreamServer) -> Result<()>;
+}
+
+pub struct StateReadAccess<'a> {
+    _guard: RwLockReadGuard<'a, ()>,
+    state: &'a StateFile,
+}
+
+pub struct StateWriteAccess<'a> {
+    _guard: RwLockWriteGuard<'a, ()>,
+    state: &'a StateFile,
+}
+
+impl StateFile {
+    fn load_state(&self) -> Result<State> {
+        tracing::debug!("parsing state file");
+
+        let state_file = File::open(&self.path)?;
+        Ok(serde_json::from_reader(state_file)?)
+    }
+
+    fn write_state(&self, state: State) -> Result<()> {
+        tracing::debug!("serializing state file");
+        let state_file = File::create(&self.path)?;
+        Ok(serde_json::to_writer_pretty(state_file, &state)?)
+    }
+
+    pub fn new() -> Result<Self> {
+        let project_dirs =
+            directories::ProjectDirs::from("xyz", "ohea", "gamestream-webtransport-proxy")
+                .ok_or(anyhow::anyhow!("Could not get project dirs"))?;
+
+        let data_dir = project_dirs.data_dir();
+        fs::create_dir_all(data_dir)?;
+
+        let state_path = data_dir.join("state.json");
+
+        if let Err(e) = File::open(&state_path) {
+            if e.kind() == std::io::ErrorKind::NotFound {
+                write_default_state_to_path(&state_path)?;
+            } else {
+                return Err(anyhow!(e));
+            }
+        }
+
+        Ok(StateFile {
+            lock: tokio::sync::RwLock::new(()),
+            path: state_path,
+        })
+    }
+}
+
+impl StateFile {
+    pub async fn read(&self) -> StateReadAccess {
+        StateReadAccess {
+            _guard: self.lock.read().await,
+            state: self,
+        }
+    }
+
+    pub async fn write(&self) -> StateWriteAccess {
+        StateWriteAccess {
+            _guard: self.lock.write().await,
+            state: self,
+        }
+    }
+}
+
+impl<'a> StateReader for StateReadAccess<'a> {
+    fn servers(&self) -> Result<HashMap<String, GamestreamServer>> {
+        let state = self.state.load_state()?;
+        Ok(state.servers)
+    }
+
+    fn unique_id(&self) -> Result<String> {
+        let state = self.state.load_state()?;
+        Ok(state.unique_id)
+    }
+}
+
+impl<'a> StateWriter for StateWriteAccess<'a> {
+    fn add_server(&self, server: GamestreamServer) -> Result<()> {
+        let mut state = self.state.load_state()?;
+
+        if state.servers.contains_key(&server.name) {
+            return Err(anyhow!(
+                "cannot add duplicate server with name: {}",
+                server.name
+            ));
+        }
+
+        state.servers.insert(server.name.clone(), server);
+
+        self.state.write_state(state)?;
+
+        Ok(())
+    }
+}
+
+fn get_unique_id() -> Result<String> {
+    let mut bytes = [0u8; 8];
+    openssl::rand::rand_bytes(&mut bytes)?;
+    Ok(hex::encode(bytes))
+}
+
+fn write_default_state_to_path(path: &PathBuf) -> Result<()> {
+    let default_state = State {
+        servers: HashMap::new(),
+        unique_id: get_unique_id()?,
+    };
+
+    let state_file = File::create(path)?;
+
+    Ok(serde_json::to_writer_pretty(state_file, &default_state)?)
+}
@@ -0,0 +1,333 @@
+use std::str::FromStr;
+
+use anyhow::{Context, Result};
+use moonlight_common_c_sys::SCM_H264;
+use salvo::prelude::*;
+use serde::{Deserialize, Serialize};
+use tracing::{debug, error, info};
+
+use crate::{
+    common::{AppError, AppResult, get_url},
+    proxy, responses,
+    state::{GamestreamServer, StateReadAccess, StateReader},
+};
+
+#[derive(Deserialize, ToSchema)]
+struct PostStreamStartParams {
+    server: String,
+    id: u64,
+    stream_config: crate::backend::StreamConfig,
+    server_mode: Option<crate::backend::Mode>,
+}
+
+#[derive(Serialize, ToSchema)]
+struct PostStreamStartResponse {
+    url: String,
+    cert_hash: [u8; 32],
+    //cert_hash: String,
+}
+
+#[derive(Deserialize)]
+struct LaunchResponse {
+    #[serde(rename = "@status_code")]
+    status_code: String,
+    #[serde(rename = "@status_message")]
+    status_message: Option<String>,
+    #[serde(rename = "sessionUrl0")]
+    session_url_0: Option<url::Url>,
+    #[serde(rename = "gamesession")]
+    game_session: Option<u64>,
+}
+
+fn get_server(reader: &StateReadAccess, server: &String) -> Result<Option<GamestreamServer>> {
+    let servers = reader.servers().context("Failed to get servers")?;
+    Ok(servers.get(server).cloned())
+}
+
+async fn setup_proxy(
+    port: u16,
+    stream: crate::backend::Stream,
+) -> Result<proxy::handler::ProxySetupResponse> {
+    let url = url_constructor::UrlConstructor::new()
+        .scheme("https")
+        .host("localhost")
+        .port(port)
+        .subdir("api/stream/setup")
+        .build();
+
+    let client = reqwest::Client::builder()
+        .danger_accept_invalid_certs(true)
+        .build()?;
+
+    //let resp = client.post(url).send().await?;
+    //let text = resp.text().await?;
+    //debug!(text);
+
+    //Ok(serde_json::from_str(&text)?)
+
+    Ok(client
+        .post(url)
+        .json(&proxy::handler::ProxySetupParams { stream })
+        .send()
+        .await?
+        .json::<proxy::handler::ProxySetupResponse>()
+        .await?)
+}
+
+#[craft]
+impl crate::backend::Backend {
+    #[craft(endpoint(status_codes(StatusCode::OK, StatusCode::INTERNAL_SERVER_ERROR)))]
+    pub async fn post_stream_start(
+        self: ::std::sync::Arc<Self>,
+        body: salvo::oapi::extract::JsonBody<PostStreamStartParams>,
+        req: &mut Request,
+    ) -> AppResult<Json<PostStreamStartResponse>> {
+        let standard_error = Err(crate::common::AppError {
+            status_code: StatusCode::INTERNAL_SERVER_ERROR,
+            description: "Could not start stream".to_string(),
+        });
+
+        let reader = self.state.read().await;
+
+        let server = match get_server(&reader, &body.server) {
+            Ok(s) => match s {
+                Some(s) => s,
+                None => {
+                    error!("No server with name: {}", body.server);
+                    return Err(AppError {
+                        status_code: StatusCode::BAD_REQUEST,
+                        description: "No server configured with that name.".to_string(),
+                    });
+                }
+            },
+            Err(e) => {
+                error!("Could not get server: {e}");
+                return standard_error;
+            }
+        };
+
+        let unique_id = match reader.unique_id() {
+            Ok(u) => u,
+            Err(e) => {
+                error!("could not get unique id: {e}");
+                return standard_error;
+            }
+        };
+
+        let mut base_url = crate::common::base_url(
+            "https",
+            &server.host,
+            server.https_port(),
+            &unique_id,
+            "serverinfo",
+            None,
+        );
+
+        let server_info = crate::common::get_url(&mut base_url, true).await.unwrap();
+        debug!("server_info: {server_info}");
+        let server_info: responses::ServerInfoResponse = match serde_xml_rs::from_str(&server_info)
+        {
+            Ok(s) => s,
+            Err(e) => {
+                error!("Could not parse serverinfo response: {e}");
+                return standard_error;
+            }
+        };
+
+        //"%s://%s:%d/serverinfo?uniqueid=%s&uuid=%s",
+
+        let input_crypto = match crate::backend::InputCrypto::new() {
+            Ok(i) => i,
+            Err(e) => {
+                error!("Could not create input crypto: {e}");
+                return standard_error;
+            }
+        };
+
+        let (remote_input_aes_key_string, remote_input_aes_iv_string) =
+            input_crypto.as_url_params();
+
+        let mode = match &body.server_mode {
+            Some(m) => m.as_url_string(),
+            None => body.stream_config.mode.as_url_string(),
+        };
+
+        let id_string = body.id.to_string();
+
+        let params = vec![
+            ("appid", id_string.as_str()),
+            ("mode", mode.as_str()),
+            ("additionalStates", "1"),
+            ("sops", "1"),
+            ("rikey", remote_input_aes_key_string.as_str()),
+            ("rikeyid", remote_input_aes_iv_string.as_str()),
+            ("localAudioPlayMode", "0"),
+            ("surroundAudioInfo", "196610"),
+            ("remoteControllersBitmap", "0"),
+            ("gcmap", "0"),
+            ("corever", "1"),
+        ];
+
+        // moonlight-embedded url params
+        //https://
+        //    %s:                           server->serverInfo.address
+        //    %u/                           server->httpsPort,
+        //    %s?                           server->currentGame ? "resume" : "launch",
+        //    &uniqueid=%s                  unique_id,
+        //    &uuid=%s                      uuid_str,
+        //    &appid=%d                     appId
+        //    &mode=%dx%dx%d                config->width, config->height, fps
+        //    &additionalStates=1
+        //    &sops=%d                      sops
+        //    &rikey=%s                     rikey_hex
+        //    &rikeyid=%d                   rikeyid
+        //    &localAudioPlayMode=%d        localaudio
+        //    &surroundAudioInfo=%d         surround_info
+        //    &remoteControllersBitmap=%d   gamepad_mask
+        //    &gcmap=%d%s%s"                gamepad_mask,
+
+        let mut base_url = crate::common::base_url(
+            "https",
+            &server.host,
+            server.https_port(),
+            &unique_id,
+            "launch",
+            Some(params),
+        );
+
+        let resp = match get_url(&mut base_url, true).await {
+            Ok(r) => r,
+            Err(e) => {
+                error!("Cannot start game: {e}");
+                return standard_error;
+            }
+        };
+
+        debug!("/launch response: {}", resp.replace("\n", ""));
+
+        let launch_response: LaunchResponse = match serde_xml_rs::from_str(&resp) {
+            Ok(r) => r,
+            Err(e) => {
+                error!("Could not parse server launch response: {e}");
+                return standard_error;
+            }
+        };
+
+        let Ok(launch_resp_status) = http::StatusCode::from_str(&launch_response.status_code)
+        else {
+            error!(
+                "Server returned invalid status code: {}",
+                launch_response.status_code
+            );
+            return standard_error;
+        };
+        if !launch_resp_status.is_success() {
+            let status_message = launch_response
+                .status_message
+                .unwrap_or("Server did not provide a status message".to_string());
+
+            info!("Could not launch game: {}", status_message,);
+            return Err(AppError {
+                status_code: StatusCode::INTERNAL_SERVER_ERROR,
+                description: format!("Could not launch game: {}", status_message),
+            });
+        }
+
+        let Some(url) = launch_response.session_url_0 else {
+            error!("Server response was missing session_url_0");
+            return standard_error;
+        };
+
+        let Some(game_session) = launch_response.game_session else {
+            error!("Server response was missing game_session");
+            return standard_error;
+        };
+
+        let stream_id = uuid::Uuid::new_v4();
+
+        let server_codec_mode_support = if server_info.ServerCodecModeSupport == 0 {
+            SCM_H264
+        } else {
+            server_info.ServerCodecModeSupport
+        };
+
+        let stream = crate::backend::Stream {
+            id: stream_id,
+            url,
+            game_session,
+            server_address: server.host.clone(),
+            stream_config: body.stream_config.clone(),
+            app_version: server_info.appversion,
+            gfe_version: server_info.GfeVersion,
+            server_codec_mode_support,
+            input_crypto,
+        };
+
+        info!(
+            "Launched stream {stream_id} on {} with config {stream:?}",
+            server.name
+        );
+        let mut writer = self.streams.write().await;
+        (*writer).insert(stream.id, stream.clone());
+
+        let port = self.port + <u16>::try_from((*writer).len()).unwrap();
+
+        // Spawn WebTransport proxy
+        let binary_path = match std::env::current_exe() {
+            Ok(b) => b,
+            Err(e) => {
+                error!("Could not get binary path to spawn proxy: {e}");
+                return standard_error;
+            }
+        };
+        info!(
+            "Spawning proxy process for stream {} on port {}",
+            stream_id, port
+        );
+        match tokio::process::Command::new(binary_path)
+            .args(["proxy", &port.to_string(), &stream_id.to_string()])
+            .spawn()
+        {
+            Ok(_) => (),
+            Err(e) => {
+                error!("Failed to spawn proxy process: {e}");
+                return standard_error;
+            }
+        }
+
+        tokio::time::sleep(tokio::time::Duration::from_millis(1000)).await;
+
+        let setup_resp = match setup_proxy(port, stream).await {
+            Ok(r) => r,
+            Err(e) => {
+                error!("Could not setup proxy: {e}");
+                return standard_error;
+            }
+        };
+
+        let host = match req.uri_mut().host() {
+            Some(h) => h,
+            None => {
+                error!("Request URI does not have a host");
+                return standard_error;
+            }
+        };
+
+        let webtransport_url = url_constructor::UrlConstructor::new()
+            .scheme("https")
+            // TODO: this is hardcoded to 127.0.0.1 to fix problems with
+            // tls certificates and IPv6 in chrome. This needs to eventually be fixed
+            // but I don't actually know what the fix is
+            .host("127.0.0.1")
+            .port(port)
+            .subdir("api/stream/connect")
+            .build();
+
+        let post_stream_response = PostStreamStartResponse {
+            url: webtransport_url,
+            cert_hash: setup_resp.cert_hash,
+        };
+
+        Ok(Json(post_stream_response))
+    }
+}
@@ -12,9 +12,13 @@ struct CustomCallbacks;
 impl ParseCallbacks for CustomCallbacks {
    fn int_macro(&self, name: &str, _value: i64) -> Option<IntKind> {
        match name {
-            "STREAM_CFG_LOCAL" => Some(IntKind::I32),
-            "STREAM_CFG_REMOTE" => Some(IntKind::I32),
-            "STREAM_CFG_AUTO" => Some(IntKind::I32),
+            //"STREAM_CFG_LOCAL" => Some(IntKind::I32),
+            //"STREAM_CFG_REMOTE" => Some(IntKind::I32),
+            //"STREAM_CFG_AUTO" => Some(IntKind::I32),
+            "KEY_ACTION_DOWN" => Some(IntKind::I8),
+            "KEY_ACTION_UP" => Some(IntKind::I8),
+            "BUTTON_ACTION_PRESS" => Some(IntKind::I8),
+            "BUTTON_ACTION_RELEASE" => Some(IntKind::I8),
            _ => None, // Default behavior for all others
        }
    }
@@ -34,7 +38,7 @@ fn main() {
    let bindings = bindgen::Builder::default()
        .header("moonlight-common-c/src/Limelight.h")
        .clang_arg(format!("-I{}/src", dst.display())) // Include built headers
-        //.parse_callbacks(Box::new(CustomCallbacks))
+        .parse_callbacks(Box::new(CustomCallbacks))
        .default_macro_constant_type(bindgen::MacroTypeVariation::Signed)
        .generate()
        .expect("Failed to generate bindings");
@@ -0,0 +1,53 @@
+namespace InputEvent;
+
+
+enum KeyAction: byte {
+  DOWN,
+  UP,
+}
+
+
+table MouseMovement {
+  movement_x: int16;
+  movement_y: int16;
+}
+
+enum MouseButton: byte {
+  LEFT,
+  MIDDLE,
+  RIGHT,
+  X1,
+  X2
+}
+
+table MouseInput {
+  button: MouseButton;
+  button_action: KeyAction;
+}
+
+
+struct ModifierState {
+  shift: bool;
+  ctrl: bool;
+  alt: bool;
+  meta: bool;
+}
+
+table KeyboardInput {
+  key_code: int16;
+  key_action: KeyAction;
+  modifiers: ModifierState;
+}
+
+union Input {
+  Keyboard:KeyboardInput,
+  MouseMovement:MouseMovement,
+  MouseInput:MouseInput,
+}
+
+table InputEvent {
+  input: Input;
+}
+
+root_type InputEvent;
+
@@ -0,0 +1,43 @@
+namespace VideoUpdate;
+
+
+table Setup {
+  video_format: string;
+  width: uint16;
+  height: uint16;
+  redraw_rate: uint16;
+}
+
+enum FrameType: byte {
+  PFRAME,
+  IDR,
+}
+
+table DecodeUnitStart {
+  frame_number: uint64;
+  frame_type: FrameType;
+  num_buffers: uint64;
+
+  receive_time_ms: uint16;
+  full_length: uint64;
+
+}
+
+table DecodeUnitBuffer {
+  frame_number: uint64;
+  buffer_index: uint64;
+  buffer_offset: uint64;
+  data: [ubyte]; 
+}
+
+union Update {
+    Setup:Setup,
+    DecodeUnitStart:DecodeUnitStart,
+    DecodeUnitBuffer:DecodeUnitBuffer,
+}
+
+table VideoUpdate {
+    update: Update; 
+}
+
+root_type VideoUpdate;
Author	SHA1	Message	Date
restitux	22f9405229	backend: add user management system with SQLite database Add authentication and authorization infrastructure: - SQLite database (db.rs) with users, sessions, and app permissions tables - Password hashing with argon2 - Session-based auth with random 256-bit tokens - Auth middleware (session validation) and admin middleware - Login/logout/me endpoints - Admin CRUD endpoints for user and permission management - Auto-seed default admin user on first run - 23 unit tests covering all DB operations Existing API endpoints are not yet gated behind auth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-16 02:34:02 +00:00
restitux	e80543144a	backend and frontend: support out of order chunks + now it's performant on chrome	2025-08-12 02:20:46 -06:00
restitux	7afd8db8d8	backend and frontend: port frame sending to flatbuffers	2025-08-10 21:02:03 -06:00
restitux	209c1cffc4	frontend: port video decoding to web worker	2025-08-10 02:53:16 -06:00
restitux	a78bb2460e	frontend: refactor input functions to their own file	2025-08-10 01:29:56 -06:00
restitux	d5e341e232	frontend: support input + refactoring	2025-08-10 01:24:39 -06:00
restitux	9afd4e63c4	backend: forward keyboard and mouse input from client	2025-08-10 01:23:41 -06:00
restitux	d4777fcf08	frontend: stream and fullscreen cleanup	2025-08-09 14:22:34 -06:00
restitux	9f9bb68e22	frontend: improve stream UI and add fullscreen	2025-08-09 01:35:09 -06:00
restitux	411c1c74e6	backend: handle server-info request failure	2025-08-09 01:12:44 -06:00
restitux	31481c6812	frontend: improve launch UI and refactor stream to new page	2025-08-08 00:18:38 -06:00
restitux	2b5b6f190d	backend: handle app already running logic + refactor response	2025-08-08 00:18:14 -06:00
restitux	a11a12828c	frontend: video streaming now works!! - changed the backend to append the buffers together and dispatch them as such (this is what moonlight-embedded does) - fixed the frontend trying to playback an empty buffer because types are hard (this is why I should have used protobuf...)	2025-07-21 02:06:55 -06:00
restitux	7a2b0fd4d6	frontend: add svelte frontend	2025-07-20 23:51:54 -06:00
restitux	a01ec82833	docker: add caddy setup for testing	2025-07-20 23:51:29 -06:00
restitux	ac67658ad2	backend: send decoder packets as json	2025-07-20 23:51:19 -06:00
restitux	52e594f916	frontend: bad improvements	2025-07-20 23:51:03 -06:00
restitux	fae7971f2b	backend: refactor proxy code	2025-07-20 16:44:23 -06:00
restitux	a11b4deb31	meta: WebTransport now works - added a small frontend for starting - added logic to serve the frontend - split out the gamestream logic into a separate process - added logic to scaffold the separate proxy process	2025-07-20 14:08:47 -06:00
restitux	188005ab11	backend: add support for receiving a gamestream stream	2025-07-20 01:13:28 -06:00
restitux	e3892e7134	backend: fix pair blocking on update state	2025-07-19 12:38:09 -06:00
restitux	053ed8c054	meta: renamed config to state and wrapped in a server object	2025-07-18 18:07:33 -06:00
restitux	6ae459ddf5	backend: blocked pairing server with duplicate name	2025-07-18 17:44:42 -06:00
restitux	0edf7c60c1	meta: cleanup and added apps endpoint - Added (working) apps endpoint - Added config file (actually a state file) wrapper to handle shared mutability - Refactored base url and http get shared code into common - Added tracing based logging and converted debug statemets to it - More things that I forgot	2025-07-18 17:23:54 -06:00
restitux	5391d6c6dd	meta: cleanup and use new AppResult type	2025-07-15 19:35:49 -06:00
restitux	a1f33b5de3	certs: cleanup logic and add new util functions	2025-07-15 19:04:14 -06:00
restitux	b4e22e09b8	certs: refactor certificate logic into module	2025-07-05 16:41:45 -06:00
				`@@ -0,0 +1 @@`
				<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#24292f"/></svg>
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" width="107" height="128" viewBox="0 0 107 128"><title>svelte-logo</title><path d="M94.1566,22.8189c-10.4-14.8851-30.94-19.2971-45.7914-9.8348L22.2825,29.6078A29.9234,29.9234,0,0,0,8.7639,49.6506a31.5136,31.5136,0,0,0,3.1076,20.2318A30.0061,30.0061,0,0,0,7.3953,81.0653a31.8886,31.8886,0,0,0,5.4473,24.1157c10.4022,14.8865,30.9423,19.2966,45.7914,9.8348L84.7167,98.3921A29.9177,29.9177,0,0,0,98.2353,78.3493,31.5263,31.5263,0,0,0,95.13,58.117a30,30,0,0,0,4.4743-11.1824,31.88,31.88,0,0,0-5.4473-24.1157" style="fill:#ff3e00"/><path d="M45.8171,106.5815A20.7182,20.7182,0,0,1,23.58,98.3389a19.1739,19.1739,0,0,1-3.2766-14.5025,18.1886,18.1886,0,0,1,.6233-2.4357l.4912-1.4978,1.3363.9815a33.6443,33.6443,0,0,0,10.203,5.0978l.9694.2941-.0893.9675a5.8474,5.8474,0,0,0,1.052,3.8781,6.2389,6.2389,0,0,0,6.6952,2.485,5.7449,5.7449,0,0,0,1.6021-.7041L69.27,76.281a5.4306,5.4306,0,0,0,2.4506-3.631,5.7948,5.7948,0,0,0-.9875-4.3712,6.2436,6.2436,0,0,0-6.6978-2.4864,5.7427,5.7427,0,0,0-1.6.7036l-9.9532,6.3449a19.0329,19.0329,0,0,1-5.2965,2.3259,20.7181,20.7181,0,0,1-22.2368-8.2427,19.1725,19.1725,0,0,1-3.2766-14.5024,17.9885,17.9885,0,0,1,8.13-12.0513L55.8833,23.7472a19.0038,19.0038,0,0,1,5.3-2.3287A20.7182,20.7182,0,0,1,83.42,29.6611a19.1739,19.1739,0,0,1,3.2766,14.5025,18.4,18.4,0,0,1-.6233,2.4357l-.4912,1.4978-1.3356-.98a33.6175,33.6175,0,0,0-10.2037-5.1l-.9694-.2942.0893-.9675a5.8588,5.8588,0,0,0-1.052-3.878,6.2389,6.2389,0,0,0-6.6952-2.485,5.7449,5.7449,0,0,0-1.6021.7041L37.73,51.719a5.4218,5.4218,0,0,0-2.4487,3.63,5.7862,5.7862,0,0,0,.9856,4.3717,6.2437,6.2437,0,0,0,6.6978,2.4864,5.7652,5.7652,0,0,0,1.602-.7041l9.9519-6.3425a18.978,18.978,0,0,1,5.2959-2.3278,20.7181,20.7181,0,0,1,22.2368,8.2427,19.1725,19.1725,0,0,1,3.2766,14.5024,17.9977,17.9977,0,0,1-8.13,12.0532L51.1167,104.2528a19.0038,19.0038,0,0,1-5.3,2.3287" style="fill:#fff"/></svg>