Protocol and Session Flows

Socket Authentication Lifecycle

• Client connects to /socket.io and sends authenticate(token)
• Server validates JWT, user, and subscription state
• Client joins room with join_room(userId) after auth
• Presence and message routing are scoped to user room

Clip Relay Flow

Server validates envelope format and size limits, then emits receive_clip to other devices in room.

If no other devices are online, sender receives send_warning instead of silent drop.

socket.emit('send_clip', {
  userId: '<current-user-id>',
  clip: { v: 2, payload: '<encrypted-base64>' }
});

Private Share Flow

• share_create creates sender-side session binding
• share_join claims receiver slot (single receiver limit)
• share_metadata announces encrypted file metadata
• share_chunk streams encrypted chunks with rate limits
• share_ack and share_complete close transfer with explicit lifecycle

Reliability and Cleanup

• In-memory cleanup loops remove stale device/session state
• Disconnect handler cancels dependent sessions and notifies counterpart
• Pending tunnel requests timeout at 30 seconds to avoid hung resources