[kixelated]

Problem

Relays on main report a WebTransport session as "transport": "webtransport" (moq-dev/moq#5293), and gateway sessions as rtmp, srt, or webrtc. The newest published @moq/auth (0.2.2, from release) has a closed TransportSchema enum, so an auth server built on it refuses every such request. #5293 says to upgrade auth servers before relays, but no published @moq/auth can parse the new value, and the next major release also carries breaking @moq/auth changes (see js/auth/MIGRATE.md on main).

Approach

Port main's TransportSchema and its tests unchanged: the known names gain rtmp, srt, webrtc, webtransport, and unknown, and any other string reads as unknown. Non-string values still fail. Bump @moq/auth 0.2.2 -> 0.2.3 (and its bun.lock workspace entry) so Release JS publishes it. Backports without a bump skipped publishing before (moq-dev/moq#7019).

Impact

• Public API: Transport widens from 6 to 11 names, and TransportSchema becomes a pipe with a catch. The regenerated js/auth/api/index.api.md shows only that. An exhaustive switch over Transport needs the new arms, as main's MIGRATE.md already notes for 0.3. That is the only source change. A narrower enum that only adds webtransport would still refuse the gateway names main sends.
• Auth JSON: a request with a transport name this version doesn't know now parses as unknown instead of failing. Malformed input (missing, null, number, object) is still refused.
• Rust moq-auth 0.2.x has the same closed enum. Not changed here: adding variants to its exhaustive enum is a semver-breaking crate change, so it is left to the next major release.

Validation

• The new WebTransport and future transport names follow the Rust contract test fails against release's schema and passes with this change. js/auth: 116 pass, 0 fail.
• just check origin/release passes. The first run hit a 5 s timeout in the unrelated js/common/worklet.test.ts (builds leave no child process behind) at load average 78. It passed alone in 3.6 s, and the full rerun passed.

Follow-ups

• Merge and let Release JS publish @moq/auth@0.2.3.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T07:32:16.482990Z	2cb981d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: 2cb981d

No actionable bugs found in the five-file release backport. The direction is sound: reuse main's transport parser, validate the input as a string before the unknown-name fallback, and keep the package/lockfile version and generated API aligned. This avoids importing unrelated main-branch auth changes. The widened Transport union and changed exported schema type remain intentional source-compatibility tradeoffs, not a transparent API-only patch.

Verification: inspected the complete diff, request-schema integration, regression tests, package metadata, and main's corresponding parser/migration notes. Tests and publishing were not run; the PR's reported test results were not independently reproduced.

[kixelated]

Merge summary: no changes made to this PR.

• CI: all 19 checks pass on 2cb981d, including Check and Release gate.
• Reviews: Codex had no findings (👍), and the automated review from the maintainer account found no actionable bugs. It notes the wider Transport union is an intentional source-compatibility tradeoff, which the Impact section already documents.
• release has no api-diff workflow, so the API widening doesn't block this backport. The @moq/auth 0.2.2 -> 0.2.3 bump is kept so Release JS publishes it.
• quest check --base origin/release passes.

Landing with a merge commit, as CONTRIBUTING.md requires for PRs into release.

(Written by Claude Opus 5.5)