@inetafrica/open-claudia 3.4.7 → 3.4.12

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 3.4.12
+
+- Keep incoming calls on their per-attempt admission policy when the organization canary setting changes; managed access supplies the assigned gateway and TURN configuration. Owner-only audio calling remains enforced.
+- Flatten ICE server URLs for Werift, whose installed parser silently omits TURN when given browser-style URL arrays. Verify actual peer-connection TURN configuration in the tests.
+- Refresh Janus grants and relay credentials for future peer connections. Existing Werift TURN allocations keep their original credentials and expiry, so the bot closes before the earliest active allocation deadline. It does not hot-swap existing allocation authentication; the default one-hour TURN lifetime exceeds the bot's thirty-minute call limit.
+- Exclude the bot's own publisher by its Janus-assigned feed ID, including when the gateway replaces display names with canonical email. Keep the legacy bot display-prefix exclusion.
+
+## 3.4.11
+
+- Verify timed-out guard processes from their parent, including forced termination and released concurrency, without racing a child-written receipt.
+- Retain the calling credential-renewal and scheduler fixes from the preceding release candidates.
+
+## 3.4.10
+
+- Include managed device ownership generations on bot call signals, reject stale refresh generations, and report local termination once.
+- Renew transport credentials before expiry on the existing Janus session.
+- Give the durable migration regression a bounded two-minute subprocess budget and report spawn errors; the CI probe exceeded its previous thirty-second limit.
+
+## 3.4.9
+
+- Keep concurrent Opus codecs valid when WebAssembly memory grows; test 100 simultaneous codecs and legacy packet interoperability.
+- Use the assigned Janus endpoint for managed calls and reject placement changes during credential refresh.
+- Route release builds through the dedicated VM runner after cluster runner startup failures.
+
+## v3.4.8 — Authenticated calling rooms and attempt-safe bot setup
+
+- Kazee calling: stage server-authorized room allocation and expiring room credentials, authenticate Janus frames and subscriber joins, preserve call attempt identity across signals, and cancel stale setup. Legacy calls remain supported while room enforcement is disabled. Owner-only audio calling policy is preserved.
+
 ## v3.4.7 — Keep scheduled follow-ups queued while the chat is busy
 
 - Scheduler: busy chats keep wakeups queued without consuming execution retries. Watch triggers and expiries are saved once, survive restart, and stop polling while delivery is pending. Concurrent callbacks cannot start overlapping runs; advisory notifications are attempted once per occurrence. Real execution failures retain bounded retries.

package/channels/kazee/call/access.js

@@ -0,0 +1,86 @@
+"use strict";
+const { randomUUID } = require("crypto");
+function validServer(value) {
+  if (value === undefined) return false;
+  if (typeof value !== 'string') return false;
+  try { const url = new URL(value); return url.protocol === 'wss:' && !!url.hostname && !url.username && !url.password && !url.hash && !url.search; }
+  catch { return false; }
+}
+
+function projectAssignedIce(reply, now = Date.now()) {
+  if (!Array.isArray(reply.iceServers) || !reply.iceServers.length || reply.iceServers.length > 12
+    || !Number.isFinite(reply.iceCredentialsExpiresAt) || reply.iceCredentialsExpiresAt <= now) throw new Error("Invalid assigned call relay");
+  const iceServers = reply.iceServers.map(server => {
+    if (!server || typeof server !== 'object') throw new Error("Invalid assigned call relay");
+    const urls = Array.isArray(server.urls) ? server.urls : [server.urls];
+    if (!urls.length || urls.length > 12 || urls.some(url => typeof url !== 'string' || url.length > 1024
+      || !/^(stun|turn|turns):[^\s@?#]+(?:\?transport=(udp|tcp))?$/.test(url))) throw new Error("Invalid assigned call relay");
+    if (urls.some(url => /^turns?:/.test(url)) && (typeof server.username !== 'string' || !server.username || server.username.length > 2048
+      || typeof server.credential !== 'string' || !server.credential || server.credential.length > 2048)) throw new Error("Invalid assigned call relay");
+    return { urls: [...urls], ...(server.username === undefined ? {} : { username: server.username }), ...(server.credential === undefined ? {} : { credential: server.credential }) };
+  });
+  if (!iceServers.some(server => server.urls.some(url => /^turns?:/.test(url)))) throw new Error("Assigned call relay is unavailable");
+  return { iceServers, iceCredentialsExpiresAt: reply.iceCredentialsExpiresAt };
+}
+
+/** The bot's media adapter supports UDP TURN. TLS-only assignment fails closed. */
+function supportedIceServers(iceServers) {
+  const usable = iceServers.flatMap(server => {
+    const urls = (Array.isArray(server.urls) ? server.urls : [server.urls]).filter(url => typeof url === 'string' && (url.startsWith('stun:') || (url.startsWith('turn:') && !url.includes('transport=tcp'))));
+    // Werift's parser accepts one string URL per entry; arrays silently lose
+    // their TURN address/username despite matching the browser ICE shape.
+    return urls.map(url => ({ ...server, urls: url }));
+  });
+  if (!usable.some(server => server.urls.startsWith('turn:'))) throw new Error('Call configuration has no supported TURN route');
+  return usable;
+}
+
+function publicCallIdentity(payload = {}) {
+  return {
+    ...(payload.callAttemptId ? { callAttemptId: payload.callAttemptId } : {}),
+    ...(payload.organizationId ? { organizationId: payload.organizationId } : {}),
+    ...(payload.roomId != null ? { roomId: Number(payload.roomId) } : {}),
+  };
+}
+
+function requestRoomAccess(socket, operation, input, { signal, timeoutMs = 10000 } = {}) {
+  if (!socket?.connected) return Promise.reject(new Error("Call socket unavailable"));
+  if (signal?.aborted) return Promise.reject(new Error("Call cancelled"));
+  const requestId = randomUUID();
+  const event = `call:${operation}-result`;
+  return new Promise((resolve, reject) => {
+    const cleanup = () => { clearTimeout(timer); socket.off(event, receive); signal?.removeEventListener("abort", abort); };
+    const fail = (message) => { cleanup(); reject(new Error(message)); };
+    const abort = () => fail("Call cancelled");
+    const receive = (reply = {}) => {
+      if (reply.requestId !== requestId) return;
+      if (!reply.ok) return fail("Call room access denied");
+      if (reply.protocolVersion !== 3 || typeof reply.callAttemptId !== "string" || !/^[\w-]{16,128}$/.test(reply.callAttemptId)
+        || reply.roomAdmissionRequired !== true
+        || typeof reply.nodeId !== 'string' || !/^[\w-]{1,64}$/.test(reply.nodeId)
+        || typeof reply.organizationId !== "string" || !reply.organizationId || reply.deviceId !== input.deviceId
+        || !Number.isSafeInteger(reply.roomId) || reply.roomId <= 0 || !Number.isSafeInteger(reply.generation) || reply.generation < 0
+        || (input.callAttemptId && reply.callAttemptId !== input.callAttemptId)
+        || (input.organizationId && reply.organizationId !== input.organizationId)
+        || (input.roomId && reply.roomId !== Number(input.roomId)) || (input.chatId && reply.chatId !== input.chatId)
+        || !validServer(reply.server)
+        || (reply.janusTokenExpiresAt !== undefined && (!Number.isFinite(reply.janusTokenExpiresAt) || reply.janusTokenExpiresAt <= Date.now()))
+        || typeof reply.janusToken !== "string" || !reply.janusToken || typeof reply.roomToken !== "string" || !reply.roomToken
+        || (reply.leaseExpiresAt !== undefined && (!Number.isFinite(reply.leaseExpiresAt) || reply.leaseExpiresAt <= Date.now()))
+        || !Number.isFinite(reply.roomTokenExpiresAt) || reply.roomTokenExpiresAt <= Date.now()) return fail("Invalid call room access response");
+      let assignedIce;
+      try { assignedIce = projectAssignedIce(reply); } catch (_) { return fail("Invalid call room access response"); }
+      cleanup();
+      resolve({ ...publicCallIdentity(reply), protocolVersion: 3, deviceId: reply.deviceId, generation: reply.generation,
+        roomAdmissionRequired: true, ...assignedIce,
+        ...(reply.janusTokenExpiresAt !== undefined ? {janusTokenExpiresAt: reply.janusTokenExpiresAt} : {}),
+        chatId: reply.chatId, nodeId: reply.nodeId, ...(reply.server !== undefined ? { server: reply.server } : {}), janusToken: reply.janusToken, roomToken: reply.roomToken, roomTokenExpiresAt: reply.roomTokenExpiresAt, ...(reply.leaseExpiresAt !== undefined ? { leaseExpiresAt: reply.leaseExpiresAt } : {}) });
+    };
+    const timer = setTimeout(() => fail("Call room access timed out"), timeoutMs);
+    socket.on(event, receive);
+    signal?.addEventListener("abort", abort, { once: true });
+    try { socket.emit(`call:${operation}`, { ...input, requestId }); }
+    catch (_) { fail("Call socket unavailable"); }
+  });
+}
+module.exports = { publicCallIdentity, requestRoomAccess, projectAssignedIce, supportedIceServers };

package/channels/kazee/call/audio.js

@@ -1,6 +1,6 @@
 "use strict";
 
-const OpusScript = require("opusscript");
+const OpusScript = require("./opus-codec");
 
 const WEBRTC_RATE = 48000;
 const STT_RATE = 16000;

package/channels/kazee/call/janus-client.js

@@ -8,9 +8,10 @@ function transactionId() {
 }
 
 class JanusClient {
-  constructor({ url, WebSocketImpl = WebSocket, requestTimeoutMs = 10000, keepaliveMs = 25000 } = {}) {
+  constructor({ url, token, WebSocketImpl = WebSocket, requestTimeoutMs = 10000, keepaliveMs = 25000 } = {}) {
     if (!url) throw new Error("Janus URL is required");
     this.url = url;
+    this.token = token;
     this.WebSocketImpl = WebSocketImpl;
     this.requestTimeoutMs = requestTimeoutMs;
     this.keepaliveMs = keepaliveMs;
@@ -72,6 +73,7 @@ class JanusClient {
     const transaction = transactionId();
     const frame = {
       ...payload,
+      ...(this.token ? { token: this.token } : {}),
       ...(withSession && this.sessionId ? { session_id: this.sessionId } : {}),
       transaction,
     };

package/channels/kazee/call/lease.js

@@ -0,0 +1,70 @@
+// Same platform-neutral lease policy as the web/mobile call client.
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallLeaseHeartbeat = void 0;
+/** Only measured, accepted media activates the server's managed-call lease. */
+class CallLeaseHeartbeat {
+    constructor(transport, identity, failed, initialLeaseExpiresAt, newRequestId = () => crypto.randomUUID()) {
+        this.transport = transport;
+        this.identity = identity;
+        this.failed = failed;
+        this.newRequestId = newRequestId;
+        this.requestId = null;
+        this.leaseExpiresAt = 0;
+        this.started = false;
+        this.closed = false;
+        if (Number.isFinite(initialLeaseExpiresAt))
+            this.leaseExpiresAt = initialLeaseExpiresAt;
+        this.unsubscribe = transport.on('call:heartbeat-result', data => {
+            if (this.closed || !this.requestId || data?.requestId !== this.requestId)
+                return;
+            this.requestId = null;
+            clearTimeout(this.timeout);
+            if (!data.ok || !Number.isFinite(data.leaseExpiresAt) || data.leaseExpiresAt <= Date.now()) {
+                this.close();
+                this.failed('denied');
+                return;
+            }
+            // A malformed distant lease must not remove the local outage bound.
+            this.leaseExpiresAt = Math.min(data.leaseExpiresAt, Date.now() + 120000);
+        });
+    }
+    activate() {
+        if (this.started || this.closed)
+            return;
+        this.started = true;
+        if (!this.leaseExpiresAt)
+            this.leaseExpiresAt = Date.now() + 120000;
+        this.interval = setInterval(() => this.beat(), 30000);
+        this.beat();
+    }
+    beat() {
+        if (this.closed)
+            return;
+        if (Date.now() >= this.leaseExpiresAt) {
+            this.close();
+            this.failed('expired');
+            return;
+        }
+        if (this.requestId)
+            return;
+        const requestId = this.newRequestId();
+        this.requestId = requestId;
+        this.timeout = setTimeout(() => { if (this.requestId === requestId)
+            this.requestId = null; }, 15000);
+        try {
+            this.transport.emit('call:heartbeat', { ...this.identity(), requestId, mediaReady: true });
+        }
+        catch { /* A transient transport failure consumes time from the same lease. */ }
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        clearInterval(this.interval);
+        clearTimeout(this.timeout);
+        this.requestId = null;
+        this.unsubscribe();
+    }
+}
+exports.CallLeaseHeartbeat = CallLeaseHeartbeat;

package/channels/kazee/call/manager.js

@@ -1,5 +1,8 @@
 "use strict";
 
+const { randomUUID, randomInt } = require("crypto");
+const { CallLeaseHeartbeat } = require("./lease");
+const { publicCallIdentity, requestRoomAccess, supportedIceServers } = require("./access");
 const { canonicalForChannel } = require("../../../core/identity");
 const { KazeeCallSession } = require("./session");
 
@@ -9,10 +12,7 @@ const DEFAULT_ICE_SERVERS = [
   { urls: "stun:stun.l.google.com:19302" },
 ];
 // FCM push TTL is 60s and chat-central treats ringing logs as fresh for 90s.
-// Must comfortably outlast the mobile client's own 30s ring timeout: a callee
-// device auto-ends at 30s, the human then answers late, and chat-central
-// revives the CallLog — the room has to still exist when that answer lands
-// (first live outbound test 2026-08-08: end at 30s, real answer at 44s).
+// This is the outbound invitation deadline; terminal server events end it early.
 const RING_TIMEOUT_MS = 60_000;
 const OUTGOING_GREETING = "Hey, it's Claudia. Can you hear me okay?";
 // Inbound must greet too: callers get silence until they speak first, which
@@ -21,19 +21,21 @@ const INCOMING_GREETING = "Hey, it's Claudia — you're through. Can you hear me
 
 class KazeeCallManager {
   constructor({ adapter, SessionImpl = KazeeCallSession, janusUrl = process.env.KAZEE_JANUS_URL || DEFAULT_JANUS_URL,
-    iceServers = DEFAULT_ICE_SERVERS } = {}) {
+    iceServers = DEFAULT_ICE_SERVERS, deviceId = randomUUID() } = {}) {
     this.adapter = adapter;
     this.SessionImpl = SessionImpl;
     this.janusUrl = janusUrl;
     this.iceServers = iceServers;
     this.session = null;
+    this.deviceId = deviceId;
+    this._pending = null;
     this._ringTimer = null;
   }
 
   wire(socket) {
-    socket.on("call:incoming", (payload) => this.incoming(payload));
-    socket.on("call:ended", (payload) => this.ended(payload));
-    socket.on("call:rejected", (payload) => this.rejected(payload));
+    socket.on("call:incoming", (payload) => this.incoming(payload).catch(() => console.error("Kazee call incoming failed")));
+    socket.on("call:ended", (payload) => this.ended(payload).catch(() => console.error("Kazee call cleanup failed")));
+    socket.on("call:rejected", (payload) => this.rejected(payload).catch(() => console.error("Kazee call cleanup failed")));
     socket.on("call:accepted", (payload) => this.accepted(payload));
     socket.on("call:ringing", (payload) => {
       if (this.session) console.log(`Kazee call ringing: chat=${String(payload?.chatId || "")}`);
@@ -46,26 +48,70 @@ class KazeeCallManager {
   // TURN credentials at /webrtc/config — the same endpoint the web and mobile
   // clients use. werift's ICE stack is UDP-only, so tcp/tls variants are
   // filtered out before they can break candidate gathering.
-  async _fetchIceServers() {
-    if (typeof this.adapter?._request !== "function") return this.iceServers;
-    try {
-      const res = await this.adapter._request("GET", "/webrtc/config");
-      const fetched = Array.isArray(res?.config?.iceServers) ? res.config.iceServers : [];
-      const usable = fetched.filter((server) => {
-        const url = String(Array.isArray(server.urls) ? server.urls[0] : server.urls || "");
-        if (url.startsWith("stun:")) return true;
-        return url.startsWith("turn:") && !url.includes("transport=tcp");
-      });
-      const turns = usable.filter((s) => String(Array.isArray(s.urls) ? s.urls[0] : s.urls).startsWith("turn:")).length;
-      if (turns > 0) {
-        console.log(`Kazee call ICE config: ${usable.length} servers (${turns} TURN) from /webrtc/config`);
-        return usable;
-      }
-      console.warn("Kazee call ICE config: /webrtc/config returned no usable TURN entry, using defaults");
-    } catch (error) {
-      console.error(`Kazee call ICE config fetch failed, using defaults: ${error.message}`);
-    }
-    return this.iceServers;
+  async _fetchCallConfig() {
+    // Dependency-only test adapters may supply their own media configuration.
+    if (typeof this.adapter?._request !== "function") return { iceServers: this.iceServers, janusServer: this.janusUrl, roomAdmissionEnabled: false };
+    let res;
+    try { res = await this.adapter._request("GET", "/webrtc/config"); }
+    catch (_) { throw new Error("Call configuration unavailable"); }
+    const config = res?.config;
+    if (!config || !Array.isArray(config.iceServers)) throw new Error("Call configuration unavailable");
+    const usable = supportedIceServers(config.iceServers);
+    return { iceServers: usable, janusServer: config.janusServer || this.janusUrl, janusToken: config.janusToken,
+      iceCredentialsExpiresAt: config.iceCredentialsExpiresAt,
+      roomAdmissionEnabled: config.roomAdmissionEnabled === true };
+  }
+
+  async _fetchIceServers() { return (await this._fetchCallConfig()).iceServers; }
+
+  _matches(payload, session = this.session) {
+    if (!session || (!payload.callAttemptId && payload.roomId == null && !payload.chatId)) return false;
+    const identity = session.callIdentity || {};
+    if (payload.callAttemptId && payload.callAttemptId !== identity.callAttemptId) return false;
+    if (payload.organizationId && identity.organizationId && payload.organizationId !== identity.organizationId) return false;
+    if (payload.roomId != null && Number(payload.roomId) !== session.roomId) return false;
+    if (payload.chatId && payload.chatId !== session.chatId) return false;
+    return true;
+  }
+
+  _sessionOptions(config, access, identity, signal) {
+    return { janusUrl: access?.server || config.janusServer, iceServers: access ? supportedIceServers(access.iceServers) : config.iceServers, janusToken: access?.janusToken || config.janusToken,
+      iceCredentialsExpiresAt: access?.iceCredentialsExpiresAt ?? config.iceCredentialsExpiresAt,
+      janusTokenExpiresAt: access?.janusTokenExpiresAt, managedRoom: !!access, roomToken: access?.roomToken, roomTokenExpiresAt: access?.roomTokenExpiresAt,
+      refreshRoomAccess: access ? async () => {
+        const next = await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, deviceId: this.deviceId }, { signal });
+        if (next.server !== access?.server || next.nodeId !== access?.nodeId || next.generation !== access?.generation) throw new Error('Call room placement changed');
+        return { ...next, iceServers: supportedIceServers(next.iceServers) };
+      } : undefined };
+  }
+
+  _sessionEnded(session, reason) {
+    if (this.session !== session) return;
+    this.session = null;
+    if (this.adapter._socket?.connected) this.adapter._socket.emit("call:end", {
+      ...session.callIdentity, chatId: session.chatId, toUserId: session.callerId, reason,
+    });
+  }
+
+  _manageLease(session, access) {
+    if (!access) return;
+    const socket = this.adapter._socket;
+    session._leaseHeartbeat = new CallLeaseHeartbeat({
+      emit: (event, payload) => socket.emit(event, payload),
+      on: (event, listener) => { socket.on(event, listener); return () => socket.off(event, listener); },
+    }, () => ({ ...session.callIdentity, deviceId: this.deviceId, generation: access.generation }), reason => {
+      if (this.session !== session || session.closed) return;
+      console.warn(`Kazee managed call lease ${reason}`);
+      socket.emit("call:end", { ...session.callIdentity, deviceId: this.deviceId, chatId: session.chatId, toUserId: session.callerId, reason: "network-timeout" });
+      this.session = null;
+      session.close(`lease-${reason}`).catch(() => console.error("Kazee call lease cleanup failed"));
+    }, access.leaseExpiresAt, randomUUID);
+  }
+
+  _mediaReady(session) {
+    if (!session || session.closed || this.session !== session) return;
+    session._mediaReady = true;
+    if (session._accepted) session._leaseHeartbeat?.activate();
   }
 
   async incoming(payload = {}) {
@@ -73,46 +119,47 @@ class KazeeCallManager {
     const chatId = String(payload.chatId || "");
     const roomId = Number(payload.roomId);
     const callType = String(payload.callType || "");
-    const owner = String(this.adapter.ownerUserId || "");
-    console.log(`Kazee call incoming: room=${roomId} chat=${chatId} from=${callerId} type=${callType}`);
-    const reject = (reason) => {
-      console.log(`Kazee call rejected: room=${roomId} from=${callerId} reason=${reason}`);
-      this.adapter._socket?.emit("call:reject", {
-        toUserId: callerId, callType, chatId, roomId, reason,
-      });
-    };
-
-    if (!callerId || !chatId || !Number.isSafeInteger(roomId)) return reject("invalid_call");
-    if (callerId !== owner) return reject("not_allowed");
+    const identity = publicCallIdentity(payload);
+    const reject = (reason) => this.adapter._socket?.emit("call:reject", { ...identity, ...(identity.callAttemptId ? { deviceId: this.deviceId, generation: Number.isSafeInteger(payload.generation) && payload.generation >= 0 ? payload.generation : 0 } : {}), toUserId: callerId, callType, chatId, roomId, reason });
+    if (!callerId || !chatId || !Number.isSafeInteger(roomId) || roomId <= 0) return reject("invalid_call");
+    if (payload.roomAdmissionRequired !== undefined && typeof payload.roomAdmissionRequired !== 'boolean') return reject("invalid_call");
+    if (callerId !== String(this.adapter.ownerUserId || "")) return reject("not_allowed");
     if (callType !== "audio") return reject("unsupported_media");
-    if (this.session) return reject("busy");
-
-    // Human callee devices emit call:ringing as soon as they show the ring UI;
-    // chat-central relays it and the caller's client uses it to advance the
-    // status flow (calling -> ringing). Without it a web caller sits on
-    // "calling" with no feedback while we fetch ICE + join Janus (2026-08-16).
-    this.adapter._socket?.emit("call:ringing", { toUserId: callerId, chatId });
-
-    const iceServers = await this._fetchIceServers();
-    const session = new this.SessionImpl({
-      roomId, chatId, callerId, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers, greeting: INCOMING_GREETING,
-      onTranscript: (text, meta) => this._transcript(text, payload, meta),
-      onEnded: () => { if (this.session === session) this.session = null; },
-    });
-    this.session = session;
+    if (this.session || this._pending) return reject("busy");
+    const pending = { identity: { ...identity, chatId }, controller: new AbortController() };
+    this._pending = pending;
+    this.adapter._socket?.emit("call:ringing", { ...identity, toUserId: callerId, chatId });
+    let session;
     try {
-      await session.start();
-      console.log(`Kazee call accepted: room=${roomId} from=${callerId}`);
-      this.adapter._socket?.emit("call:accept", {
-        toUserId: callerId, callType: "audio", chatId, roomId,
+      const config = await this._fetchCallConfig();
+      // Server event metadata belongs to this attempt. The latest org flag only
+      // controls new outgoing allocation, never an existing call's admission.
+      const managed = payload.roomAdmissionRequired === true;
+      if (managed && !identity.callAttemptId) throw new Error("Call identity required");
+      const access = managed ? await requestRoomAccess(this.adapter._socket, "room-access", { ...identity, chatId, deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      if (pending.controller.signal.aborted) return;
+      const boundIdentity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : identity;
+      session = new this.SessionImpl({ roomId, chatId, callerId, botUserId: this.adapter.botUserId,
+        ...this._sessionOptions(config, access, boundIdentity, pending.controller.signal), greeting: INCOMING_GREETING,
+        onTranscript: (text, meta) => this._transcript(text, { ...payload, ...boundIdentity }, meta),
+        onMediaReady: () => this._mediaReady(session),
+        onEnded: reason => { session?._leaseHeartbeat?.close(); pending.controller.abort(); this._sessionEnded(session, reason); },
       });
-    } catch (error) {
-      console.error("Kazee call connect:", error.message);
-      this.session = null;
-      await session.close("connect-failed").catch(() => {});
-      reject("connection_failed");
-    }
+      session.callIdentity = boundIdentity;
+      session.chatId = chatId;
+      this.session = session;
+      this._manageLease(session, access);
+      await session.start();
+      if (this.session !== session || session.closed || pending.controller.signal.aborted) return;
+      this.adapter._socket?.emit("call:accept", { ...boundIdentity, toUserId: callerId, callType: "audio", chatId, roomId });
+      session._accepted = true;
+      if (session._mediaReady) session._leaseHeartbeat?.activate();
+    } catch (_) {
+      const cancelled = pending.controller.signal.aborted;
+      if (this.session === session) this.session = null;
+      if (session) await session.close("connect-failed").catch(() => {});
+      if (!cancelled) reject("connection_failed");
+    } finally { if (this._pending === pending) this._pending = null; }
   }
 
   // Bot-initiated call. Mirrors what a human caller's client does: create the
@@ -124,44 +171,49 @@ class KazeeCallManager {
     const target = String(toUserId || this.adapter.ownerUserId || "");
     const chat = String(chatId || "");
     if (!target || !chat) throw new Error("missing chatId/toUserId");
-    if (this.session) throw new Error("busy: a call session is already active");
+    if (target !== String(this.adapter.ownerUserId || "")) throw new Error("Calls are restricted to the owner");
+    if (this.session || this._pending) throw new Error("busy: a call session is already active");
     if (!this.adapter._socket?.connected) throw new Error("kazee socket is not connected");
-    const roomId = Math.floor(Math.random() * 1e9);
-    const iceServers = await this._fetchIceServers();
-    // _transcript() reads chatId/fromUserId/roomId off the inbound invite
-    // payload; for outbound the remote human is the "from" side.
-    const remote = { chatId: chat, fromUserId: target, roomId, fromUserName: "" };
-    const session = new this.SessionImpl({
-      roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
-      janusUrl: this.janusUrl, iceServers, asCaller: true, greeting: OUTGOING_GREETING,
-      onTranscript: (text, meta) => this._transcript(text, remote, meta),
-      onEnded: () => {
-        this._clearRingTimer();
-        if (this.session === session) this.session = null;
-      },
-    });
-    this.session = session;
+    const pending = { identity: { chatId: chat }, controller: new AbortController() };
+    this._pending = pending;
+    let session;
     try {
+      const config = await this._fetchCallConfig();
+      const access = config.roomAdmissionEnabled ? await requestRoomAccess(this.adapter._socket, "allocate", { chatId: chat, participants: [target], callType: "audio", deviceId: this.deviceId }, { signal: pending.controller.signal }) : null;
+      if (pending.controller.signal.aborted) throw new Error("Call cancelled");
+      const identity = access ? { ...publicCallIdentity(access), deviceId: this.deviceId, generation: access.generation } : { callAttemptId: randomUUID(), roomId: randomInt(1000000, 2 ** 48 - 1) };
+      const roomId = identity.roomId;
+      pending.identity = { ...identity, chatId: chat };
+      const remote = { ...identity, chatId: chat, fromUserId: target, fromUserName: "" };
+      session = new this.SessionImpl({ roomId, chatId: chat, callerId: target, botUserId: this.adapter.botUserId,
+        ...this._sessionOptions(config, access, identity, pending.controller.signal), asCaller: true, greeting: OUTGOING_GREETING,
+        onTranscript: (text, meta) => this._transcript(text, remote, meta),
+        onMediaReady: () => this._mediaReady(session),
+        onEnded: reason => { session?._leaseHeartbeat?.close(); pending.controller.abort(); this._clearRingTimer(); this._sessionEnded(session, reason); },
+      });
+      session.callIdentity = identity;
+      session.chatId = chat;
+      this.session = session;
+      this._manageLease(session, access);
       await session.start();
+      if (this.session !== session || session.closed || pending.controller.signal.aborted) throw new Error("Call cancelled");
+      this.adapter._socket.emit("call:invite", { ...identity, toUserId: target, callType: "audio", chatId: chat });
+      this._ringTimer = setTimeout(() => { this._ringTimer = null; this._ringTimeout(target, chat, roomId).catch(() => console.error("Kazee call ring timeout failed")); }, RING_TIMEOUT_MS);
+      this._ringTimer.unref?.();
+      return { ...identity, chatId: chat, toUserId: target };
     } catch (error) {
-      this.session = null;
-      await session.close("connect-failed").catch(() => {});
+      if (this.session === session) this.session = null;
+      if (session) await session.close("connect-failed").catch(() => {});
       throw error;
-    }
-    console.log(`Kazee call outgoing: room=${roomId} chat=${chat} to=${target}`);
-    this.adapter._socket.emit("call:invite", { toUserId: target, callType: "audio", chatId: chat, roomId });
-    this._ringTimer = setTimeout(() => {
-      this._ringTimer = null;
-      this._ringTimeout(target, chat, roomId).catch((error) => console.error("Kazee call ring timeout:", error.message));
-    }, RING_TIMEOUT_MS);
-    if (typeof this._ringTimer.unref === "function") this._ringTimer.unref();
-    return { roomId, chatId: chat, toUserId: target };
+    } finally { if (this._pending === pending) this._pending = null; }
   }
 
   accepted(payload = {}) {
-    if (!this.session || !this._ringTimer) return;
+    if (!this.session || !this._matches(payload)) return;
     console.log(`Kazee call answered: room=${this.session.roomId} chat=${String(payload.chatId || "")}`);
     this._clearRingTimer();
+    this.session._accepted = true;
+    if (this.session._mediaReady) this.session._leaseHeartbeat?.activate();
   }
 
   async _ringTimeout(toUserId, chatId, roomId) {
@@ -170,7 +222,7 @@ class KazeeCallManager {
     console.log(`Kazee call unanswered: room=${roomId} to=${toUserId}`);
     // Caller hanging up while ringing: chat-central finalizes the CallLog as
     // missed and dismisses the callee's ringing UI/push.
-    this.adapter._socket?.emit("call:end", { toUserId, chatId });
+    this.adapter._socket?.emit("call:end", { ...session.callIdentity, toUserId, chatId });
     this.session = null;
     await session.close("no-answer").catch(() => {});
   }
@@ -218,25 +270,17 @@ class KazeeCallManager {
   }
 
   async ended(payload = {}) {
-    if (!this.session) return;
+    if (this._pending && (!payload.callAttemptId || payload.callAttemptId === this._pending.identity.callAttemptId) && (!payload.chatId || payload.chatId === this._pending.identity.chatId) && (payload.roomId == null || this._pending.identity.roomId == null || Number(payload.roomId) === this._pending.identity.roomId)) this._pending.controller.abort();
+    if (!this.session || !this._matches(payload)) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
-    // While our outbound ring is live, a call:ended is usually a callee DEVICE
-    // giving up (mobile auto-ends its ring at 30s), not the human declining.
-    // chat-central revives the CallLog if they answer late, so the caller must
-    // keep the room alive until its own ring timeout — tearing down here left
-    // the late answer joining a destroyed room, stuck on "Connecting" (2026-08-08).
-    // A deliberate decline arrives as call:rejected and still closes.
-    if (this._ringTimer) {
-      console.log(`Kazee call ignoring ended-while-ringing: room=${this.session.roomId}`);
-      return;
-    }
+    // Terminal server state is authoritative; ended attempts are never revived.
     const session = this.session;
     this.session = null;
     await session.close("remote-ended");
   }
 
   async rejected(payload = {}) {
-    if (!this.session) return;
+    if (!this.session || !this._matches(payload)) return;
     if (payload.roomId != null && Number(payload.roomId) !== this.session.roomId) return;
     const session = this.session;
     this.session = null;
@@ -244,6 +288,8 @@ class KazeeCallManager {
   }
 
   async stop() {
+    this._pending?.controller.abort();
+    this._clearRingTimer();
     if (!this.session) return;
     const session = this.session;
     this.session = null;

package/channels/kazee/call/opus-codec.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// opusscript 0.1.1 caches typed-array views that detach when its shared WASM
+// memory grows. Use the same packaged native binding with fresh views for each
+// operation. Native _encode/_decode represent PCM bytes as uint16 elements.
+let native;
+class OpusCodec {
+  constructor(rate, channels, application) {
+    native ||= require("opusscript/build/opusscript_native_wasm.js")();
+    this.channels = channels;
+    this.handler = new native.OpusScriptHandler(rate, channels, application);
+    this.pcmElements = 5760 * channels;
+    this.packetBytes = 3828;
+    this.pcmInput = native._malloc(this.pcmElements * 2);
+    this.pcmOutput = native._malloc(this.pcmElements * 2);
+    this.packetInput = native._malloc(this.packetBytes);
+    this.packetOutput = native._malloc(this.packetBytes);
+  }
+  encode(bytes, samples) {
+    if (!this.handler) throw new Error("Opus codec closed");
+    if (bytes.length > this.pcmElements) throw new Error("Opus PCM exceeds frame limit");
+    native.HEAPU16.set(bytes, this.pcmInput / 2);
+    const length = this.handler._encode(this.pcmInput, bytes.length, this.packetOutput, samples);
+    if (length < 0 || length > this.packetBytes) throw new Error(`Opus encode failed (${length})`);
+    return Buffer.from(native.HEAPU8.subarray(this.packetOutput, this.packetOutput + length));
+  }
+  decode(bytes) {
+    if (!this.handler) throw new Error("Opus codec closed");
+    if (bytes.length > this.packetBytes) throw new Error("Opus packet exceeds size limit");
+    native.HEAPU8.set(bytes, this.packetInput);
+    const samples = this.handler._decode(this.packetInput, bytes.length, this.pcmOutput);
+    const length = samples * this.channels * 2;
+    if (samples < 0 || length > this.pcmElements) throw new Error(`Opus decode failed (${samples})`);
+    return Buffer.from(native.HEAPU16.subarray(this.pcmOutput / 2, this.pcmOutput / 2 + length));
+  }
+  delete() {
+    if (!this.handler) return;
+    native.OpusScriptHandler.destroy_handler(this.handler);
+    this.handler = null;
+    for (const pointer of [this.pcmInput,this.pcmOutput,this.packetInput,this.packetOutput]) native._free(pointer);
+  }
+}
+OpusCodec.Application = { VOIP: 2048 };
+module.exports = OpusCodec;