@matter/protocol 0.17.0-alpha.0-20260507-059f7763b → 0.17.0-alpha.0-20260508-29ff5ae9e

package/src/dcl/DclClient.ts

@@ -9,12 +9,16 @@ import {
     DclModelModelsWithVidPidResponse,
     DclModelVersionsWithVidPidResponse,
     DclModelVersionWithVidPidSoftwareVersionResponse,
+    DclPkiAllCertificatesBySkidResponse,
     DclPkiCertificateResponse,
+    DclPkiRevocationDistributionPointRaw,
+    DclPkiRevocationPointsByIssuerResponse,
     DclPkiRootCertificatesResponse,
     DclPkiRootCertificateSubjectReference,
     DclVendorInfo,
 } from "#dcl/DclRestApiTypes.js";
 import { Duration, Logger, MatterError, Seconds } from "@matter/general";
+import { DeviceAttestationPkiRevocationDclSchema, ProductAttestationDclSchema, VendorId } from "@matter/types";
 
 const logger = new Logger("DclClient");
 
@@ -112,6 +116,29 @@ export class DclClient {
         return certList.approvedRootCertificates.certs;
     }
 
+    /**
+     * Fetch certificates by their SubjectKeyIdentifier from the DCL. Useful for looking up
+     * certificates without knowing their subject DN (e.g. CD signer certificates referenced
+     * only by SKID in Certification Declarations).
+     *
+     * Returns an empty array if no matching certificates exist.
+     */
+    async fetchCertificatesBySubjectKeyId(subjectKeyId: string, options?: DclClient.Options) {
+        // DCL expects SKID as colon-separated uppercase hex (e.g. "FE:34:3F:...")
+        const normalized = subjectKeyId.replace(/:/g, "").toUpperCase();
+        const skidWithColons = normalized.match(/.{1,2}/g)?.join(":") ?? normalized;
+        const path = `/dcl/pki/all-certificates?subjectKeyId=${encodeURIComponent(skidWithColons)}`;
+        const response = await this.#fetchJson<DclPkiAllCertificatesBySkidResponse>(path, options);
+        const groups = response?.certificates ?? [];
+        const results: ProductAttestationDclSchema[] = [];
+        for (const group of groups) {
+            for (const cert of group.certs ?? []) {
+                results.push(cert);
+            }
+        }
+        return results;
+    }
+
     async fetchRootCertificateBySubject(subject: DclPkiRootCertificateSubjectReference, options?: DclClient.Options) {
         const path = `/dcl/pki/certificates/${encodeURIComponent(subject.subject)}/${encodeURIComponent(subject.subjectKeyId)}`;
         const response = await this.#fetchJson<DclPkiCertificateResponse>(path, options);
@@ -188,6 +215,57 @@ export class DclClient {
     async fetchAllVendors(options?: DclClient.Options) {
         return this.#fetchPaginatedJson<DclVendorInfo>("/dcl/vendorinfo/vendors", "vendorInfo", options);
     }
+
+    /**
+     * Fetch all revocation distribution point entries from DCL.
+     * Uses pagination to retrieve all entries across multiple pages.
+     */
+    async fetchRevocationDistributionPoints(
+        options?: DclClient.Options,
+    ): Promise<DeviceAttestationPkiRevocationDclSchema[]> {
+        const rawItems = await this.#fetchPaginatedJson<DclPkiRevocationDistributionPointRaw>(
+            "/dcl/pki/revocation-points",
+            "PkiRevocationDistributionPoint",
+            options,
+        );
+        return rawItems.map(mapRawRevocationPoint);
+    }
+
+    /**
+     * Fetch revocation distribution points for a specific issuer by their subject key identifier.
+     */
+    async fetchRevocationDistributionPointsByIssuer(
+        issuerSubjectKeyId: string,
+        options?: DclClient.Options,
+    ): Promise<DeviceAttestationPkiRevocationDclSchema[]> {
+        const path = `/dcl/pki/revocation-points/${encodeURIComponent(issuerSubjectKeyId)}`;
+        const response = await this.#fetchJson<DclPkiRevocationPointsByIssuerResponse>(path, options);
+        const rawPoints = response?.pkiRevocationDistributionPointsByIssuerSubjectKeyID?.points ?? [];
+        return rawPoints.map(mapRawRevocationPoint);
+    }
+}
+
+/**
+ * Maps a raw DCL revocation distribution point entry to the DeviceAttestationPkiRevocationDclSchema format.
+ * The DCL API uses "issuerSubjectKeyID" (capital ID) and "dataURL" (capital URL), while the
+ * DeviceAttestationPkiRevocationDclSchema uses "issuerSubjectKeyId" and "dataUrl".
+ */
+function mapRawRevocationPoint(raw: DclPkiRevocationDistributionPointRaw): DeviceAttestationPkiRevocationDclSchema {
+    return {
+        vid: VendorId(raw.vid, false),
+        pid: raw.pid || undefined,
+        isPAA: raw.isPAA,
+        label: raw.label,
+        crlSignerDelegator: raw.crlSignerDelegator || undefined,
+        crlSignerCertificate: raw.crlSignerCertificate,
+        issuerSubjectKeyId: raw.issuerSubjectKeyID,
+        dataUrl: raw.dataURL,
+        dataFileSize: raw.dataFileSize ? parseInt(raw.dataFileSize, 10) || undefined : undefined,
+        dataDigest: raw.dataDigest || undefined,
+        dataDigestType: raw.dataDigestType || undefined,
+        revocationType: raw.revocationType,
+        schemaVersion: raw.schemaVersion,
+    };
 }
 
 export namespace DclClient {

package/src/dcl/DclConfig.ts

@@ -35,7 +35,10 @@ export interface DclGithubConfig {
     owner: string;
     repo: string;
     branch: string;
+    /** Path within the repo to the directory containing PAA root .der files. */
     certPath: string;
+    /** Path within the repo to the directory containing CD signer .der files. */
+    cdSignerCertPath: string;
 }
 
 export namespace DclGithubConfig {
@@ -45,5 +48,6 @@ export namespace DclGithubConfig {
         repo: "connectedhomeip",
         branch: "master",
         certPath: "credentials/development/paa-root-certs",
+        cdSignerCertPath: "credentials/development/cd-certs",
     };
 }

package/src/dcl/DclRestApiTypes.ts

@@ -49,6 +49,16 @@ export interface DclPkiRootCertificatesResponse {
     };
 }
 
+/** Response for /dcl/pki/all-certificates?subjectKeyId=<skid> */
+export interface DclPkiAllCertificatesBySkidResponse {
+    certificates: Array<{
+        subject: string;
+        subjectKeyId: string;
+        certs: ProductAttestationDclSchema[];
+        schemaVersion: number;
+    }>;
+}
+
 /** Response for /dcl/pki/certificates/{subject}/{subjectKeyId} */
 export interface DclPkiCertificateResponse {
     approvedCertificates: {
@@ -89,3 +99,33 @@ export interface DclVendorInfo {
     creator: string;
     schemaVersion?: number;
 }
+
+/**
+ * Raw revocation distribution point entry as returned by the DCL REST API.
+ * Note: The DCL API uses "issuerSubjectKeyID" (capital ID) and "dataURL" (capital URL),
+ * which differ from the DeviceAttestationPkiRevocationDclSchema field naming convention.
+ */
+export interface DclPkiRevocationDistributionPointRaw {
+    vid: number;
+    pid: number;
+    isPAA: boolean;
+    label: string;
+    crlSignerDelegator: string;
+    crlSignerCertificate: string;
+    issuerSubjectKeyID: string;
+    dataURL: string;
+    dataFileSize: string;
+    dataDigest: string;
+    dataDigestType: number;
+    revocationType: number;
+    schemaVersion: number;
+}
+
+/** Response for /dcl/pki/revocation-points/{issuerSubjectKeyId} */
+export interface DclPkiRevocationPointsByIssuerResponse {
+    pkiRevocationDistributionPointsByIssuerSubjectKeyID: {
+        issuerSubjectKeyID: string;
+        points: DclPkiRevocationDistributionPointRaw[];
+        schemaVersion: number;
+    };
+}

package/src/mdns/CommissionableMdnsScanner.ts

@@ -472,8 +472,8 @@ function buildCommissionableDevice(name: DnssdName): CommissionableDevice | unde
 
     const dd = DiscoveryData(params);
 
-    // Default T and ICD to 0 when absent, matching legacy MdnsClient behavior
-    dd.T ??= 0;
+    // Default T and ICD to "none" when absent, matching legacy MdnsClient behavior
+    dd.T ??= { tcpClient: false, tcpServer: false };
     dd.ICD ??= 0;
 
     return {

package/src/peer/ControllerCommissioner.ts

@@ -7,6 +7,7 @@
 import { ClientInteraction } from "#action/client/ClientInteraction.js";
 import { BleChannel, BleChannelClosedError } from "#ble/Ble.js";
 import { CertificateAuthority } from "#certificate/CertificateAuthority.js";
+import { DeviceAttestationValidator } from "#certificate/DeviceAttestationValidator.js";
 import { CommissionableDevice, DiscoveryData, DiscoveryDataDiagnostics } from "#common/Scanner.js";
 import { Fabric } from "#fabric/Fabric.js";
 import { CommissioningConnection } from "#peer/CommissioningConnection.js";
@@ -46,6 +47,7 @@ import {
 } from "@matter/general";
 import { NodeId, SECURE_CHANNEL_PROTOCOL_ID, SecureChannelStatusCode } from "@matter/types";
 import { GeneralCommissioning } from "@matter/types/clusters/general-commissioning";
+import { DclCertificateService } from "../dcl/DclCertificateService.js";
 import { PeerAddress } from "./PeerAddress.js";
 import { CommissioningTransitionError, PeerCommunicationError } from "./PeerCommunicationError.js";
 import { PeerSet } from "./PeerSet.js";
@@ -57,6 +59,9 @@ const logger = Logger.get("ControllerCommissioner");
  * General commissioning options.
  */
 export interface CommissioningOptions extends Partial<ControllerCommissioningFlowOptions> {
+    /** Controls behavior when device attestation produces findings. */
+    onAttestationFailure?: DeviceAttestationValidator.OnAttestationFailure;
+
     /** The fabric into which to commission. */
     fabric: Fabric;
 
@@ -546,7 +551,16 @@ export class ControllerCommissioner {
             }),
             this.#context.ca,
             fabric,
-            commissioningOptions,
+            {
+                ...commissioningOptions,
+                attestation: {
+                    challengeKey: ephemeralSession.attestationChallengeKey,
+                    dclCertificateService: this.#context.environment.has(DclCertificateService)
+                        ? this.#context.environment.get(DclCertificateService)
+                        : undefined,
+                    onFailure: options.onAttestationFailure,
+                },
+            },
             async (address, supportsConcurrentConnections) => {
                 if (!supportsConcurrentConnections) {
                     /*

package/src/peer/ControllerCommissioningFlow.ts

@@ -20,12 +20,15 @@ import {
     ChannelType,
     Diagnostic,
     Duration,
+    EcdsaSignature,
     ImplementationError,
     Instant,
     Logger,
+    MaybePromise,
     Millis,
     Minutes,
     NoResponseTimeoutError,
+    PublicKey,
     repackErrorAs,
     Seconds,
     Time,
@@ -53,8 +56,15 @@ import { OperationalCredentials } from "@matter/types/clusters/operational-crede
 import { OtaSoftwareUpdateRequestor } from "@matter/types/clusters/ota-software-update-requestor";
 import { TimeSynchronization } from "@matter/types/clusters/time-synchronization";
 import { CertificateAuthority } from "../certificate/CertificateAuthority.js";
+import {
+    AttestationFinding,
+    DeviceAttestationError,
+    DeviceAttestationValidator,
+} from "../certificate/DeviceAttestationValidator.js";
+import { Dac } from "../certificate/kinds/AttestationCertificates.js";
 import { ClusterClientObj } from "../cluster/client/ClusterClientTypes.js";
 import { TlvCertSigningRequest } from "../common/OperationalCredentialsTypes.js";
+import { DclCertificateService } from "../dcl/DclCertificateService.js";
 import { Fabric } from "../fabric/Fabric.js";
 import { CommissioningError } from "./CommissioningError.js";
 import { PeerAddress } from "./PeerAddress.js";
@@ -103,6 +113,37 @@ export type ControllerCommissioningFlowOptions = {
 
     /** The Location of the OTA provider for this fabric set on the commissioned devices if OTA is supported */
     otaUpdateProviderLocation?: OtaProviderLocation;
+
+    /**
+     * Attestation validation settings. Injected by ControllerCommissioner — the only user-facing
+     * part is `onFailure` which is forwarded from CommissioningClient options.
+     */
+    attestation: {
+        /** Attestation challenge key from the PASE session, used to verify attestation and CSR signatures. */
+        challengeKey: Bytes;
+
+        /** DclCertificateService for PAA trust store and revocation checks. Looked up from environment. */
+        dclCertificateService?: DclCertificateService;
+
+        /**
+         * Controls behavior when attestation produces findings.
+         * - `false`: reject on any finding
+         * - `true`: always accept with info logging
+         * - callback: receives `AttestationFinding[]`, return `true` to proceed, `false` to reject
+         * - `undefined`: accept with warning logging (backward compatibility)
+         *
+         * The callback receives either:
+         * - A single error-level finding for hard failures (invalid chain, bad signature, revoked
+         *   certificate, untrusted PAA, DCL service unavailable). The commissioner must decide
+         *   whether to proceed despite the failure.
+         * - One or more warning/info-level findings after successful validation (e.g. provisional
+         *   CD, test CD, skipped CD signer verification, no revocation data). These are
+         *   informational and the commissioner can inspect them for detailed decisions.
+         *
+         * TODO: Make required in next breaking version and remove undefined backward-compatible accept
+         */
+        onFailure?: DeviceAttestationValidator.OnAttestationFailure;
+    };
 };
 
 /** Types representation of a general commissioning response. */
@@ -233,6 +274,7 @@ export class ControllerCommissioningFlow {
     #commissioningStartedTime: Timestamp | undefined;
     #commissioningExpiryTime: Timestamp | undefined;
     #currentFailSafeEndTime: Timestamp | undefined;
+    #dacPublicKey?: ReturnType<typeof PublicKey>;
     protected lastBreadcrumb = 1;
     protected collectedCommissioningData: CollectedCommissioningData = {};
     #defaultFailSafeTime = DEFAULT_FAILSAFE_TIME;
@@ -1093,7 +1135,6 @@ export class ControllerCommissioningFlow {
             },
         );
 
-        // TODO: extract device public key from deviceAttestation
         const { certificate: productAttestation } = await this.#invokeCommand(
             {
                 endpoint: RootEndpointNumber,
@@ -1108,14 +1149,14 @@ export class ControllerCommissioningFlow {
             },
         );
 
-        // TODO: validate deviceAttestation and productAttestation
+        const attestationNonce = this.fabric.crypto.randomBytes(32);
         const { attestationElements, attestationSignature } = await this.#invokeCommand(
             {
                 endpoint: RootEndpointNumber,
                 cluster: OperationalCredentials,
                 command: "attestationRequest",
                 fields: {
-                    attestationNonce: this.fabric.crypto.randomBytes(32),
+                    attestationNonce,
                 },
             },
             {
@@ -1123,24 +1164,92 @@ export class ControllerCommissioningFlow {
             },
         );
 
-        // TODO: validate attestationSignature using device public key
-        if (
-            deviceAttestation.byteLength === 0 ||
-            productAttestation.byteLength === 0 ||
-            attestationElements.byteLength === 0 ||
-            attestationSignature.byteLength === 0
-        ) {
-            // TODO: validate the data really
-            throw new CommissioningError("Device Attestation data missing from device");
+        const { attestation } = this.commissioningOptions;
+
+        try {
+            const result = await DeviceAttestationValidator.validate(
+                {
+                    crypto: this.fabric.crypto,
+                    dclCertificateService: attestation.dclCertificateService,
+                    attestationChallenge: attestation.challengeKey,
+                },
+                {
+                    dac: deviceAttestation,
+                    pai: productAttestation,
+                    attestationElements,
+                    attestationSignature,
+                    attestationNonce,
+                    vendorId: this.collectedCommissioningData.vendorId!,
+                    productId: this.collectedCommissioningData.productId!,
+                },
+            );
+
+            if (result.findings.length > 0) {
+                const proceed = await this.#resolveAttestationFindings(result.findings);
+                if (!proceed) {
+                    throw new CommissioningError(
+                        `Device attestation produced ${result.findings.length} finding(s) and was rejected by policy`,
+                    );
+                }
+                logger.info(
+                    `Device attestation successfully verified with ${result.findings.length} accepted finding(s)`,
+                );
+            } else {
+                logger.info("Device attestation successfully verified");
+            }
+        } catch (error) {
+            if (error instanceof DeviceAttestationError) {
+                const errorFinding: AttestationFinding = {
+                    level: "error",
+                    type: error.failure,
+                    message: error.message,
+                };
+                const proceed = await this.#resolveAttestationFindings([errorFinding]);
+                if (!proceed) {
+                    throw error;
+                }
+            } else {
+                throw error;
+            }
         }
+
+        // Extract DAC public key for CSR signature verification in #certificates()
+        this.#dacPublicKey = PublicKey(Dac.fromAsn1(deviceAttestation).cert.ellipticCurvePublicKey);
+
         return {
             code: CommissioningStepResultCode.Success,
             breadcrumb: this.lastBreadcrumb,
         };
+    }
+
+    /** Resolve attestation findings according to the configured policy. */
+    #resolveAttestationFindings(findings: AttestationFinding[]): MaybePromise<boolean> {
+        const policy = this.commissioningOptions.attestation.onFailure;
+
+        if (typeof policy === "function") {
+            return policy(findings);
+        }
+
+        for (const f of findings) {
+            switch (policy) {
+                case undefined:
+                    // TODO: Remove backward-compatible accept in next breaking version
+                    logger.warn("Attestation finding accepted for backward compatibility:", f.type, f.message);
+                    break;
+                case true:
+                    logger.info("Attestation finding accepted by policy:", f.type, f.message);
+                    break;
+                case false:
+                    logger.info("Attestation finding, rejecting:", f.type, f.message);
+                    break;
+            }
+        }
 
-        // TODO consider Distributed Compliance Ledger Info about Commissioning Flow
+        return policy !== false;
     }
 
+    // TODO consider Distributed Compliance Ledger Info about Commissioning Flow
+
     /**
      * Step 11-13
      * 11: Following the Device Attestation Procedure yielding a decision to proceed with commissioning, the Commissioner
@@ -1171,10 +1280,22 @@ export class ControllerCommissioningFlow {
         );
 
         if (nocsrElements.byteLength === 0 || csrSignature.byteLength === 0) {
-            // TODO: validate the data really
             throw new UnexpectedDataError("Invalid response from device");
         }
-        // TODO: validate csrSignature using device public key
+
+        // Verify CSR attestation signature using DAC public key (extracted in step 10)
+        if (this.#dacPublicKey !== undefined) {
+            try {
+                await this.fabric.crypto.verifyEcdsa(
+                    this.#dacPublicKey,
+                    Bytes.concat(nocsrElements, this.commissioningOptions.attestation!.challengeKey),
+                    new EcdsaSignature(csrSignature),
+                );
+            } catch {
+                throw new CommissioningError("CSR signature verification failed against DAC public key");
+            }
+        }
+
         const { certSigningRequest } = TlvCertSigningRequest.decode(nocsrElements);
         const operationalPublicKey = await Certificate.getPublicKeyFromCsr(this.ca.crypto, certSigningRequest);
 

package/src/peer/Peer.ts

@@ -25,6 +25,7 @@ import {
     Duration,
     Identity,
     Instant,
+    IpChannelType,
     IpService,
     isIpNetworkChannel,
     Lifetime,
@@ -65,8 +66,12 @@ export class Peer {
 
     /**
      * Preferred transport for outgoing connections to this peer.
+     *
+     * Only `ChannelType.TCP` has meaning here — UDP is the default with no preference, and BLE is
+     * not used for operational connections. Setting TCP is a soft hint: the connect path still falls
+     * back to UDP if the peer does not advertise TCP server support.
      */
-    transportPreference?: ChannelType;
+    transportPreference?: ChannelType.TCP;
     #connecting?: ConnectionProcess;
     #service: IpService;
     #observers = new ObserverGroup();
@@ -117,8 +122,8 @@ export class Peer {
         });
 
         this.#observers.on(this.#sessions.added, session => {
-            const updateNetworkAddress = (networkAddress: ServerAddressIp) => {
-                this.#descriptor.operationalAddress = networkAddress;
+            const tagUdp = (addr: ServerAddressIp) => {
+                this.#descriptor.operationalAddress = { ...addr, type: "udp" };
             };
 
             // Ensure the operational address is always set to the most recent IP
@@ -129,14 +134,15 @@ export class Peer {
                         // For incoming TCP the remote port is ephemeral — use the mDNS port
                         const discoveredPort = [...this.#service.addresses][0]?.port;
                         if (discoveredPort !== undefined) {
-                            updateNetworkAddress({
+                            this.#descriptor.operationalAddress = {
+                                type: "tcp",
                                 ip: channel.networkAddress.ip,
                                 port: discoveredPort,
-                            });
+                            };
                         }
                     } else {
-                        updateNetworkAddress(channel.networkAddress);
-                        channel.networkAddressChanged.on(updateNetworkAddress);
+                        tagUdp(channel.networkAddress);
+                        channel.networkAddressChanged.on(tagUdp);
                     }
                 }
             }
@@ -146,7 +152,7 @@ export class Peer {
                 this.#sessions.delete(session);
                 const channel = session.channel.transportChannel;
                 if (isIpNetworkChannel(channel)) {
-                    channel.networkAddressChanged.off(updateNetworkAddress);
+                    channel.networkAddressChanged.off(tagUdp);
                 }
             });
 
@@ -270,6 +276,31 @@ export class Peer {
         return Timestamp.delta(this.service.status.connectionInitiatedAt, Time.nowMs);
     }
 
+    /**
+     * Resolve the ordered list of transports to attempt for this peer.
+     *
+     * - `requiredTransport` is a hard constraint: only that transport.
+     * - Else effective soft preference is `preferredTransport ?? transportPreference`. When TCP
+     *   and the peer advertises TCP server support, returns `[TCP, UDP]`.
+     * - Else `undefined` (default UDP, no constraint).
+     */
+    resolveTransports(requiredTransport?: ChannelType, preferredTransport?: ChannelType): IpChannelType[] | undefined {
+        if (requiredTransport === ChannelType.TCP || requiredTransport === ChannelType.UDP) {
+            return [requiredTransport];
+        }
+        const effectivePreference = preferredTransport ?? this.transportPreference;
+        if (effectivePreference !== ChannelType.TCP) {
+            return undefined;
+        }
+        // Live-read from service TXT params; the descriptor cache lags by one observer tick when
+        // operational TXT and addresses arrive in the same mDNS response. Trade-off: if `tcpServer`
+        // is later withdrawn, the heap ordering of already-enqueued addresses becomes stale —
+        // acceptable since TCP-server-capability withdrawal mid-connect is not a real-world flow.
+        const liveT = DiscoveryData(this.#service.parameters).T;
+        const T = liveT ?? this.#descriptor.discoveryData?.T;
+        return T?.tcpServer ? [ChannelType.TCP, ChannelType.UDP] : undefined;
+    }
+
     /**
      * Obtain a session with the peer, establishing anew as necessary.
      */
@@ -279,7 +310,16 @@ export class Peer {
         }
 
         while (true) {
-            const session = this.newestSession(options?.transport);
+            const transports = this.resolveTransports(options?.requiredTransport, options?.preferredTransport);
+            let session: NodeSession | undefined;
+            if (transports === undefined) {
+                session = this.newestSession();
+            } else {
+                for (const t of transports) {
+                    session = this.newestSession(t);
+                    if (session) break;
+                }
+            }
             if (session) {
                 return session;
             }
@@ -465,7 +505,8 @@ export class Peer {
             done: PeerConnection(this, this.#context, {
                 network: options?.network,
                 timing: options?.timing,
-                transport: options?.transport,
+                requiredTransport: options?.requiredTransport,
+                preferredTransport: options?.preferredTransport,
                 handleError: options?.handleError,
                 abort,
                 kicker,
@@ -535,9 +576,16 @@ export namespace Peer {
         timing?: Partial<PeerTimingParameters>;
 
         /**
-         * Constrain the transport type for this connection.
+         * Hard transport constraint for this connection (e.g. Large Message Quality requires TCP).
+         * When omitted, transports are resolved per {@link Peer.resolveTransports}.
+         */
+        requiredTransport?: ChannelType;
+
+        /**
+         * Per-call soft transport preference. Overrides {@link Peer.transportPreference} for this
+         * connection only and is honored only when the peer advertises matching server capability.
          */
-        transport?: ChannelType;
+        preferredTransport?: ChannelType;
 
         /**
          * Per-call error handler, overrides {@link PeerConnection.Context.handleError} for this connection only.