Merge main into dev

Brings 31 commits from main into dev, resolving 40 conflicted files plus a
few silent both-sides-added duplicates. Where main added a feature on top of
code dev had since refactored, the feature was hand-ported onto dev's
architecture rather than dropped or taken wholesale.

Notable resolutions:

- CI (check.yml, flake.nix, nix/overlay.nix, rs/justfile): took main's
  cargo+sccache direction (it supersedes the crane checks dev only carried via
  an earlier merge), while preserving dev's wasm/vaapi devShell deps.
- Cargo.toml/Cargo.lock: qmux 0.2 (verified 0.2 keeps dev's high-level
  ws::Client/Server API), kept dev's moq-hls; also pulled boytacean 0.12.1.
- moq-native: kept dev's high-level qmux integration and Option-aware
  with_publisher/with_subscriber API; deduped a both-sides-added PeerIdentity
  in tls.rs.
- moq-relay: kept dev's API, added main's unauthenticated internal listener
  (#1810, tcp:// + unix://) and ported its smoke tests and internal.rs onto
  dev's Option-returning publisher/subscriber and announced()/track() API;
  dropped main's cluster.root tests (dev removed that field).
- moq-mux: hand-ported main's multi-SPS/PPS/VPS carriage (#1812) and generic
  verbatim MPEG-TS / mpegts catalog section (#1815) onto dev's split-based
  importer architecture, keeping dev's thiserror error types. moq-cli and
  moq-gst consumers updated to match (moq-gst also keeps main's
  broadcast-aligned timestamp fix).
- js/watch: dev had already ported main's buffered-playback latency feature
  (#1620) onto its API, so dev's expression was kept.
- demo/web: hand-ported main's #1822 multi-broadcast inspector / stats
  dashboard onto dev's @moq/hang and @moq/watch APIs. The metadata feature was
  re-expressed as a catalog "meta" section (dev's publish element cannot serve
  a custom track), a behavioral change from #1822's separate-track design.

Verified: cargo check --all-targets (minus moq-gst, which needs gstreamer
system libs unavailable here), clippy -D warnings, cargo fmt, biome, and the
js type-checks/tests all pass. moq-mux (279), moq-net, moq-token, moq-json,
hang, moq-cli, and moq-relay lib (124) tests pass. The only failing Rust tests
are environmental (IPv6 [::] binds and the relay smoke integration tests, which
fail identically on unmodified dev in this sandbox).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BQ9o9paZnRLpYRgbyjUwFV

Author: claude

.github/dependabot.yml

@@ -32,6 +32,13 @@ updates:
       cargo:
         patterns:
           - "*"
+    ignore:
+      # reqwest-middleware 0.5 requires reqwest 0.13, but http-cache-reqwest's
+      # latest stable (0.16) still pins reqwest 0.12 / reqwest-middleware 0.4.
+      # The only pairing is http-cache-reqwest 1.0.0-alpha (pre-release), so we
+      # hold reqwest-middleware at 0.4 until that line ships stable.
+      - dependency-name: "reqwest-middleware"
+        versions: [">=0.5"]
 
   - package-ecosystem: "bun"
     directory: "/"

.github/workflows/check.yml

@@ -6,15 +6,22 @@ permissions:
 
 on:
   pull_request:
+    # `closed` is here only so merging/closing a PR cancels its in-flight run
+    # via the concurrency group below; the job itself is skipped on close.
+    types: [opened, synchronize, reopened, closed]
 
-# Cancel in-flight runs when a new commit lands on the same PR.
+# Cancel in-flight runs when a new commit lands on the same PR, or when the PR
+# is merged/closed (the close event shares this group and supersedes the build).
 concurrency:
   group: check-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   check:
     name: Check
+    # Skip the actual work on close/merge: this run exists only to cancel the
+    # superseded in-flight build via the concurrency group above.
+    if: github.event.action != 'closed'
     # Trusted events run on the moq-dev self-hosted A1 runner (warm /nix/store +
     # persistent CARGO_TARGET_DIR). Fork PRs fall back to GitHub-hosted ARM so
     # untrusted code never runs on the box.

CLAUDE.md

@@ -215,11 +215,14 @@ Changes in one area usually need matching updates elsewhere, including docs. If
 | `rs/moq-token` | `js/token` |
 | `rs/moq-relay` config/behavior | `doc/bin/relay/` |
 | `rs/moq-cli` | `doc/bin/cli.md` |
+| `rs/moq-token-cli` | `doc/bin/relay/auth.md`, `doc/lib/rs/crate/moq-token.md`, `doc/lib/rs/index.md` |
 | `rs/moq-gst` | `doc/bin/gstreamer.md` |
 | `js/{watch,publish}` UI/API | `demo/web` if it consumes the API |
 
 For `swift/`, the wrapper re-exports `moq-ffi` records/enums via typealias, so new catalog/audio *fields* flow through automatically. Only a new FFI *method* (or a renamed/removed one) needs a matching change in the de-prefixed `Sources/Moq` wrapper.
 
+**When a command-line tool's interface changes (a flag, argument, subcommand, or positional renamed/added/removed/reordered), update every doc that shows an example invocation, not just the tool's primary page.** Sample commands for `moq-cli`, `moq-relay`, and `moq-token-cli` are scattered across `doc/bin/`, `doc/lib/`, `doc/setup/`, and `doc/concept/`, plus the `justfile`s under `demo/`. Grep the whole repo for the binary name and reconcile each hit against the binary's `--help`. A stale example that no longer parses is worse than no example.
+
 ## Branch Targeting
 
 Two long-lived branches:

Cargo.lock

@@ -72,7 +72,7 @@ moq-token = { version = "0.6", path = "rs/moq-token" }
 # Standalone crate (moq-dev/vaapi); vendored from cros-libva + cros-codecs.
 moq-vaapi = "0.0.2"
 moq-video = { version = "0.0.4", path = "rs/moq-video" }
-qmux = { version = "0.1.3", default-features = false }
+qmux = { version = "0.2", default-features = false }
 serde = { version = "1", features = ["derive"] }
 tokio = "1.48"
 web-async = { version = "0.1.4", features = ["tracing"] }