# `@aphrodite/vr` retirement gateway

The former public, process-local VR capture/playback simulation is retired. This
deployable no longer mounts its capture, playback, tracking, interaction, or
Socket.IO services and must not be used as a media or session authority.

All legacy `/api`, `/api/*`, and `/ws` requests return HTTP 410 with
`Cache-Control: no-store` and point callers to Aphrodite Viewer protected
playback. Health endpoints report the service as retired; readiness means only
that this fail-closed gateway can reject legacy traffic. CORS is disabled unless
an explicit `CORS_ORIGIN` is configured, and unexpected errors are sanitized.

The authoritative browser path is composed by `apps/aphrodite/viewer` over
`@oshun/live-media/browser` and `aphrodite.immersive.v1`. It requires an exact
active viewer lease and a succeeded protected browser-player operation before
accepting bounded render evidence. The current claim is flat or cardboard
browser presentation for supported equirectangular media. WebXR, OpenXR,
visionOS, capture/stitching, cubemap/EAC, and ambisonic playback remain
unimplemented and fail closed.

The legacy TypeScript exports remain temporarily available for source
compatibility, but the executable does not instantiate them. New consumers must
not add dependencies on those simulation services.

## Configuration

- `PORT` — retirement gateway port; defaults to `3008`.
- `HOST` — bind host; defaults to `0.0.0.0`.
- `CORS_ORIGIN` — optional explicit allowed origin. Unset means no CORS
  middleware.
- `PROTECTED_PLAYBACK_PATH` — replacement path disclosed in 410 responses;
  defaults to `/api/streams/:streamId/playback`.

## Verification

```bash
pnpm nx test aphrodite-vr
pnpm nx lint aphrodite-vr
pnpm nx typecheck aphrodite-vr
pnpm nx build aphrodite-vr
```

The tests prove 410 retirement behavior, no wildcard CORS, honest health, and
continued fail-closed WebSocket authentication helpers.