@robota-sdk/agent-transport-webrtc 3.0.0-beta.100

package/dist/node/index.d.ts

@@ -0,0 +1,1650 @@
+import { IProtocolSession, ISessionMessageHandlerOptions, SessionResumeBridge, createSessionMessageHandler } from "@robota-sdk/agent-transport";
+import { IDeviceHandshakeIdentity, IDeviceHandshakeResult, IDeviceMeshAdmission, IDeviceRevocationList, IIdentityContext, IListUpdate, IPairRendezvous, IPairingResult, ISessionDescriptor, ISigningKeyRevocation, TDeviceCapability, startPairingHandshake } from "@robota-sdk/agent-remote-pairing";
+import { ConnectionAuthority, IFileFrameChannel, IOperatorApprover, IPeerAdmission } from "@robota-sdk/agent-interface-session-mobility";
+import { IConfigurableTransport } from "@robota-sdk/agent-interface-transport";
+//#region src/handoff-grant-gate.d.ts
+/** The frame a source device presents to show it holds a grant for this transfer. */
+interface IHandoffGrantFrame {
+  readonly t: 'handoff-grant';
+  /**
+   * The signed grant, carried opaquely.
+   *
+   * `unknown` on purpose: this package cannot import the grant type without importing the package
+   * that owns the crypto, and typing it structurally here would create a second declaration of a
+   * signed object's shape — which is how a field ends up checked in one copy and not the other.
+   * The verifier owns the type; this gate owns the envelope.
+   */
+  readonly grant: unknown;
+}
+/**
+ * The cross-device authorization this gate requires before exposing the session.
+ *
+ * Absent → the gate behaves exactly as before. Requiring a grant is opt-in because an ordinary
+ * remote peer has no hand-off to authorize, and a gate that demanded one unconditionally would
+ * refuse every legitimate remote session.
+ */
+interface IHandoffGrantProof {
+  /**
+   * Judge a presented grant. Owned by the verifier — this package asks and does not decide.
+   *
+   * Async because verifying a signature is: `verifyHandoffGrant` returns a promise, and a
+   * synchronous seam here would force the owner to block or to pre-verify, and pre-verifying means
+   * deciding before the channel that the grant is bound to even exists.
+   *
+   * Returns the admission the consumer receives, so the trust level travels as a value.
+   */
+  readonly verify: (grant: unknown) => Promise<IPeerAdmission>;
+  /**
+   * Ask the person at THIS machine whether to accept the transfer. Absent → no consent is required.
+   *
+   * Called ONLY on a verdict the verifier admitted, and given that verdict, for two reasons that
+   * both matter:
+   *
+   * The prompt can then name a PROVEN origin. Asking before verification would let anyone who can
+   * open a channel raise a dialog on someone's machine claiming to be any device they like, which
+   * turns the consent step into an attack surface instead of a control.
+   *
+   * And consent is not cryptographic policy, so it does not belong inside `verify`. A verifier that
+   * also asked a human would make "is this grant valid" and "does this person want it" one answer,
+   * and the first is the one that must be decidable without a person present.
+   *
+   * Returning false — or throwing, or having no renderer to ask — refuses. Denial fails CLOSED.
+   */
+  readonly consent?: (admission: IPeerAdmission) => Promise<boolean>;
+  /**
+   * Fired on the outcome, admitted or not.
+   *
+   * On BOTH, deliberately: a consumer told only about successes cannot distinguish "no hand-off was
+   * offered" from "a hand-off was refused", and those call for different operator responses — the
+   * second is the one that belongs in front of a person.
+   */
+  readonly onAdmission?: (admission: IPeerAdmission) => void;
+}
+/**
+ * Judge one pre-accept frame against the configured grant proof.
+ *
+ * Every path that is not an admitted verification returns a refusal — including a missing config,
+ * which cannot happen through the gate but would be a fail-OPEN if it ever did.
+ */
+declare function judgeHandoffGrant(parsed: unknown, proof: IHandoffGrantProof | undefined): Promise<IPeerAdmission>;
+/**
+ * Build the frame a source device presents on the channel.
+ *
+ * Lives beside the judge that reads it, so the two cannot drift: a sender that hand-built the object
+ * would keep compiling after the frame gains a field, and the failure would surface as a refusal on
+ * the far side with no hint that the SENDER is the stale half.
+ *
+ * Deliberately not a "send" — it returns the frame and leaves transmission to whoever owns the
+ * channel, for the same reason `localProofFrame` does.
+ */
+declare function handoffGrantFrame(grant: unknown): IHandoffGrantFrame;
+//#endregion
+//#region src/local-peer-proof.d.ts
+/** The frame a local peer presents to show it reached the guarded rendezvous. */
+interface ILocalProofFrame {
+  readonly t: 'local-proof';
+  readonly nonce: string;
+}
+/**
+ * The local-environment proof this gate requires before exposing the session.
+ *
+ * Absent → the gate behaves exactly as before. Requiring the proof is opt-in because a remote peer
+ * over WebRTC has no rendezvous to have reached, and a gate that demanded one unconditionally would
+ * refuse every legitimate remote session.
+ */
+interface ILocalPeerProof {
+  /**
+   * Redeem a presented nonce. Owned by the ledger — this package asks and does not decide.
+   *
+   * Returns the admission the consumer receives, so the trust level travels as a value rather than
+   * being re-derived from a boolean by whoever reads it next.
+   */
+  readonly redeem: (nonce: string) => IPeerAdmission;
+  /**
+   * Fired on the outcome, admitted or not.
+   *
+   * On BOTH, deliberately: a consumer told only about successes cannot distinguish "no local peer
+   * connected" from "a local peer was refused", and those call for different operator responses.
+   */
+  readonly onAdmission?: (admission: IPeerAdmission) => void;
+}
+/**
+ * Build the frame a local peer presents on the channel.
+ *
+ * Lives beside the judge that reads it, so the two cannot drift: a sender that hand-built the object
+ * would keep compiling after the frame gains a field, and the failure would surface as a refusal on
+ * the far side with no hint that the SENDER is the stale half.
+ *
+ * Deliberately not a "send" — it returns the frame and leaves transmission to whoever owns the
+ * channel. A helper that both built and sent would need a channel to be testable, and would put the
+ * frame's shape and the carrier's lifecycle in one place.
+ */
+declare function localProofFrame(nonce: string): ILocalProofFrame;
+//#endregion
+//#region src/pairing-gate-options.d.ts
+/** E3 host reconnect/enrollment config. When present, the gate runs reactive (first-frame) mode detection. */
+interface IHostReconnectConfig {
+  readonly hostIdentityId: string;
+  /** base64url SPKI advertised to a device at first-pair enrollment. */
+  readonly hostPublicSpki: string;
+  /** The host identity private key (signs reconnect challenges). */
+  readonly hostPrivateKey: CryptoKey;
+  /** Resolve a pinned device public key by id (undefined → unknown/revoked → fail closed). */
+  readonly resolveDevicePublicKey: (deviceId: string) => Promise<CryptoKey | undefined>;
+  /** Pin a device's public key on first-pair enrollment; throw to refuse before session attachment. */
+  readonly onEnroll: (deviceId: string, deviceSpki: string) => void;
+}
+/** What the receiving operator is told about a connection that would drive the session. */
+interface IConnectionApprovalContext {
+  /** The device the handshake proved, when the carrier has a stable id for it. */
+  readonly deviceId?: string;
+  /** A trusted device coming back, rather than one pairing now. */
+  readonly viaReconnect: boolean;
+  /** Aborted when the connection goes away before an answer: withdraw the question. */
+  readonly signal: AbortSignal;
+}
+/**
+ * The receiving operator's say over one connection. `approve` resolves `true` only on the operator's
+ * explicit yes; `false` or a rejection refuses the connection.
+ */
+interface IConnectionApproval {
+  approve(context: IConnectionApprovalContext): Promise<boolean>;
+}
+//#endregion
+//#region src/signaling.d.ts
+/**
+ * Signaling port (REMOTE-002). The WebRTC transport is decoupled from any concrete signaling server via this
+ * port: it exchanges opaque SDP/ICE blobs by rendezvous id. The port carries **only** SDP offers/answers + ICE
+ * candidates — never session content — so a signaling server (or the in-memory test pair) is content-blind.
+ */
+/** The kinds of signal a peer exchanges through the relay. */
+type TSignalKind = 'offer' | 'answer' | 'ice';
+/** An opaque signaling message relayed by rendezvous id. `data` is an SDP description or an ICE candidate. */
+interface ISignalMessage {
+  readonly kind: TSignalKind;
+  /** Opaque payload (serialized SDP or ICE candidate). The signaling layer never inspects it. */
+  readonly data: unknown;
+}
+/** Port a WebRTC peer uses to reach its counterpart at a rendezvous id. */
+interface ISignalingClient {
+  /** Send a signal to the counterpart at the rendezvous. */
+  send(message: ISignalMessage): void;
+  /** Subscribe to signals from the counterpart. Returns an unsubscribe function. */
+  onSignal(handler: (message: ISignalMessage) => void): () => void;
+  /** Tear down the signaling channel. */
+  close(): void;
+}
+/**
+ * An in-process pair of {@link ISignalingClient}s wired directly to each other — for tests + loopback only
+ * (no server, no network). Each side's `send` is delivered to the other side's handlers on a microtask.
+ */
+declare function createInMemorySignalingPair(): [ISignalingClient, ISignalingClient];
+//#endregion
+//#region src/datachannel-loader.d.ts
+/** The slice of a `node-datachannel` data channel this transport drives. */
+interface INdcDataChannel {
+  close(): void;
+  sendMessage(message: string): boolean;
+  isOpen(): boolean;
+  bufferedAmount(): number;
+  /** The label the opening side gave the channel. */
+  getLabel?(): string;
+  onOpen(callback: () => void): void;
+  onClosed(callback: () => void): void;
+  onError(callback: (error: string) => void): void;
+  onMessage(callback: (message: string | Buffer | ArrayBuffer) => void): void;
+}
+/** An ICE server as `node-datachannel` takes it. */
+interface INdcIceServer {
+  readonly hostname: string;
+  readonly port: number;
+  readonly username?: string;
+  readonly password?: string;
+  readonly relayType?: 'TurnUdp' | 'TurnTcp' | 'TurnTls';
+}
+interface INdcConfig {
+  iceServers: (string | INdcIceServer)[];
+  iceTransportPolicy?: 'all' | 'relay';
+  disableAutoNegotiation?: boolean;
+}
+/** The slice of a `node-datachannel` peer connection this transport drives. */
+interface INdcPeerConnection {
+  close(): void;
+  setLocalDescription(type?: 'offer' | 'answer'): void;
+  setRemoteDescription(sdp: string, type: 'offer' | 'answer'): void;
+  localDescription(): {
+    type: string;
+    sdp: string;
+  } | null;
+  remoteFingerprint(): {
+    value: string;
+    algorithm: string;
+  };
+  addRemoteCandidate(candidate: string, mid: string): void;
+  createDataChannel(label: string): INdcDataChannel;
+  state(): string;
+  /** Diagnostics; not every build exposes them. */
+  iceState?(): string;
+  gatheringState?(): string;
+  signalingState?(): string;
+  onLocalDescription(callback: (sdp: string, type: string) => void): void;
+  onLocalCandidate(callback: (candidate: string, mid: string) => void): void;
+  onStateChange(callback: (state: string) => void): void;
+  onDataChannel(callback: (channel: INdcDataChannel) => void): void;
+}
+/** The subset of the `node-datachannel` module surface this transport constructs. */
+interface IDataChannelModule {
+  PeerConnection: new (name: string, config: INdcConfig) => INdcPeerConnection;
+}
+/** Resolve a module by id. The default resolves the real module; tests inject a throwing resolver. */
+type TModuleResolver = (id: string) => unknown;
+declare function loadDataChannel(resolve?: TModuleResolver): IDataChannelModule;
+//#endregion
+//#region src/webrtc-transport-options.d.ts
+/**
+ * A single ICE (STUN/TURN) server for the host transport. `urls` is one `stun:`/`stuns:`/`turn:`/`turns:` url
+ * (optionally `?transport=tcp`); TURN servers carry username/credential. The browser peer uses the native DOM
+ * `RTCIceServer`, a separate, wider shape. Kept a plain interface (no DOM dependency here).
+ */
+interface IIceServer {
+  readonly urls: string;
+  readonly username?: string;
+  readonly credential?: string;
+}
+/**
+ * Construction options for {@link WebRtcTransport}. The signaling client is injected; the transport declares no
+ * settings schema of its own (`optionsSchema` is empty).
+ */
+interface IWebRtcTransportOptions {
+  readonly cryptoContext: IIdentityContext;
+  /** Host-owned usage read models, available only after admission. */
+  readonly personalUsageReporter?: ISessionMessageHandlerOptions['personalUsageReporter'];
+  readonly usageReporter?: ISessionMessageHandlerOptions['usageReporter'];
+  readonly storedSessionUsageReporter?: ISessionMessageHandlerOptions['storedSessionUsageReporter'];
+  /** Signaling port used to exchange SDP/ICE with the remote peer by rendezvous id. */
+  readonly signaling: ISignalingClient;
+  /** Optional ICE servers (STUN/TURN). Omitted → host-candidate/loopback only. */
+  readonly iceServers?: readonly IIceServer[];
+  /**
+   * REMOTE-004 defense-in-depth: when true, restrict ICE to **relay (TURN) candidates only**, so
+   * host/server-reflexive candidates are never used. Requires a TURN server in `iceServers`. Mapped to the
+   * connection's `iceTransportPolicy: 'relay'`.
+   */
+  readonly forceTurn?: boolean;
+  /**
+   * REMOTE-008 pairing secret. When set, the data channel is **pairing-gated**: it carries only pairing frames
+   * until the directional-HMAC handshake accepts (channel-bound to the DTLS fingerprints), and only THEN is the
+   * session exposed — fail closed on mismatch/timeout. When omitted, the constructor throws unless the caller
+   * explicitly opts out with `open: true` and an `openReason` (loopback / tests); only then is the channel
+   * exposed immediately with no pairing.
+   */
+  readonly secret?: string;
+  /**
+   * SEC-008: run with NO pairing gate. Requires `openReason`.
+   *
+   * Omitting `secret` used to mean this implicitly, which is how a remote peer reached the session
+   * because a field was left unset. It is still a legitimate mode — loopback, tests — but it is now
+   * a thing the host says rather than a thing that happens.
+   */
+  readonly open?: boolean;
+  /** SEC-008: why running with no pairing gate is correct here. Required when `open` is true. */
+  readonly openReason?: string;
+  /** REMOTE-008: fired when pairing accepts + the session is exposed (host lifecycle → status 'paired'). Carries the first-pair result (E4 uses its sessionKey). */
+  readonly onPaired?: (result?: IPairingResult) => void;
+  /** REMOTE-008: fired when pairing rejects/times out (host lifecycle → teardown; the channel is already closed). */
+  readonly onPairingFailed?: () => void;
+  /** REMOTE-012 E3: host reconnect/enrollment config. When set, the gate admits first-pair (with enrollment) OR a pinned-device reconnect. */
+  readonly reconnect?: IHostReconnectConfig;
+  /** SEC-010 (#1810): require a guarded-rendezvous nonce before the session is exposed. Absent → unchanged. */
+  readonly localPeer?: ILocalPeerProof;
+  /** Ask the receiving operator before each connection reaches the session. Absent → unchanged. */
+  readonly connectionApproval?: IConnectionApproval;
+  /** REMOTE-013 E4: a session-scoped resume bridge (owned by the controller across reconnects). Passed to the gate so the paired session flows through it (seq/buffer) and survives channel drops. */
+  readonly resumeBridge?: SessionResumeBridge;
+  /** REMOTE-013 E4: fired when a PAIRED data channel drops (so the controller can run the reconnect loop). Not fired for a pre-accept failure (that is `onPairingFailed`). */
+  readonly onDropped?: () => void;
+  /** Observe an outbound session-event delivery failure before the carrier drops. */
+  readonly onDeliveryError?: (error: Error, event: string) => void;
+  /** Test seam: inject the `node-datachannel` module (defaults to the real lazy loader). */
+  readonly loadDataChannel?: () => IDataChannelModule;
+}
+//#endregion
+//#region src/webrtc-transport.d.ts
+/**
+ * WebRTC P2P transport (REMOTE-001/002): carries an `IProtocolSession` over an `RTCDataChannel` using the
+ * SAME transport-neutral session bridge as the WebSocket transport (`createSessionMessageHandler` from
+ * `@robota-sdk/agent-transport`). The host is the offerer: it creates the data channel + offer and wires the
+ * channel as soon as it is created. `defaultEnabled: false` — nothing starts it automatically. Admission is
+ * fixed at construction: a pairing `secret` gates the session behind the pairing handshake, and running
+ * without one requires `open: true` with an `openReason`. The signaling client is injected and can be an
+ * in-memory loopback for tests.
+ */
+declare class WebRtcTransport implements IConfigurableTransport<IProtocolSession> {
+  private readonly options;
+  readonly name = "webrtc";
+  readonly lifecycle: Readonly<{
+    kind: "service";
+  }>;
+  readonly defaultEnabled = false;
+  readonly optionsSchema: {};
+  private session?;
+  private peer?;
+  private unsubscribeSignal?;
+  private cleanupHandler?;
+  /** Invalidates pending async startup work and scopes pairing/drop state to one start generation. */
+  private generation;
+  /** Local DTLS fingerprint captured for pairing channel binding. */
+  private localFingerprint?;
+  /** Pairing gate for the current channel. */
+  private pairingGate?;
+  /** Whether this start generation has sent its offer; local candidates wait for it. */
+  private offerSent;
+  private localCandidates;
+  /** Whether this start generation has taken its one answer; any later answer is ignored. */
+  private answered;
+  /** Pre-gate channel frames, replayed into the gate once it exists. Bounded. */
+  private pendingFrames;
+  private stopAwaitingCertificate?;
+  private readonly deliveryLifecycle;
+  constructor(options: IWebRtcTransportOptions);
+  validateOptions(): boolean;
+  attach(session: IProtocolSession): void;
+  private createPeer;
+  private wireSignaling;
+  private sendCandidate;
+  private requireCurrentPeer;
+  start(): Promise<void>;
+  /**
+   * With a pairing secret, the answer must advertise exactly one DTLS fingerprint; its algorithm is the one the
+   * verified certificate is hashed with. A refused answer fails pairing and closes the channel.
+   */
+  private remoteFingerprintAlgorithm;
+  private failPairing;
+  /** Build the pairing gate once the DTLS layer has verified the remote certificate. */
+  private awaitVerifiedCertificate;
+  private startPairing;
+  private wireChannel;
+  stop(): Promise<void>;
+}
+//#endregion
+//#region src/ws-signaling-client.d.ts
+/** A minimal WebSocket-like surface — so tests can inject a fake without a real socket. */
+interface IWebSocketLike {
+  send(data: string): void;
+  close(): void;
+  readyState: number;
+  on(event: 'open' | 'message' | 'error' | 'close', handler: (arg: unknown) => void): void;
+}
+interface IWsSignalingClientOptions {
+  /** Relay URL, e.g. `ws://127.0.0.1:1234`. */
+  readonly url: string;
+  /** Rendezvous id to join. */
+  readonly rendezvous: string;
+  /**
+   * Explicit error sink. Called on a relay `error` frame, a socket error, or a close-before-join — the signaling
+   * channel cannot function and the caller must know (no silent degrade).
+   */
+  readonly onError?: (error: Error) => void;
+  /** Called once the relay confirms the rendezvous `join` (the `joined` frame). */
+  readonly onReady?: () => void;
+  /** Injectable socket factory (defaults to a real `ws` WebSocket) — for tests. */
+  readonly createSocket?: (url: string) => IWebSocketLike;
+}
+declare class WsSignalingClient implements ISignalingClient {
+  private readonly options;
+  private readonly socket;
+  private readonly handlers;
+  private readonly outbox;
+  private joined;
+  private closed;
+  constructor(options: IWsSignalingClientOptions);
+  private handleOpen;
+  private handleMessage;
+  private handleClose;
+  private fail;
+  private writeSignal;
+  send(message: ISignalMessage): void;
+  onSignal(handler: (message: ISignalMessage) => void): () => void;
+  close(): void;
+}
+//#endregion
+//#region src/rtc-peer.d.ts
+type TRtcPeerState = 'new' | 'connecting' | 'connected' | 'disconnected' | 'failed' | 'closed';
+type TRtcChannelState = 'connecting' | 'open' | 'closed';
+/** Why and how a connection or channel ended, for a refusal a person can act on. */
+interface IRtcPeerDiagnostics {
+  readonly state: TRtcPeerState;
+  readonly ice?: string;
+  readonly gathering?: string;
+  readonly signaling?: string;
+  /** The states the connection went through, in order. */
+  readonly history: readonly TRtcPeerState[];
+  /** `local`: this side closed it; `handler-error`: a handler threw and the connection was closed. */
+  readonly closedBy?: 'local' | 'handler-error';
+  readonly handlerError?: string;
+  readonly localCandidates: number;
+  readonly remoteCandidates: number;
+}
+interface IRtcCandidate {
+  readonly candidate: string;
+  readonly mid: string;
+}
+interface IRtcPeerOptions {
+  readonly iceServers?: readonly IIceServer[];
+  /** Relay (TURN) candidates only. */
+  readonly forceTurn?: boolean;
+  /** Test seam: the `node-datachannel` module. */
+  readonly loadDataChannel?: () => IDataChannelModule;
+}
+declare class RtcChannel {
+  private readonly native;
+  private readonly fault;
+  private stateValue;
+  private closeCauseValue?;
+  private closedLocally;
+  private readonly messageHandlers;
+  private readonly stateHandlers;
+  constructor(native: INdcDataChannel, fault: (error: unknown) => void);
+  private guard;
+  private closedWith;
+  /** Why the channel closed, once it has. */
+  get closeCause(): string | undefined;
+  private setState;
+  get readyState(): TRtcChannelState;
+  /** The label the opening side gave the channel; empty when the implementation does not say. */
+  get label(): string;
+  get bufferedAmount(): number;
+  /** Throws when the channel is not open or the message cannot be sent. */
+  send(text: string): void;
+  onMessage(handler: (text: string) => void): () => void;
+  onStateChange(handler: (state: TRtcChannelState) => void): () => void;
+  /**
+   * Closed for this side at once; the stream is reset after a grace, so what was sent just before
+   * still reaches the peer.
+   */
+  close(): void;
+}
+declare class RtcPeer {
+  private readonly native;
+  private stateValue;
+  private readonly stateHandlers;
+  private readonly candidateHandlers;
+  private readonly channelHandlers;
+  private readonly descriptionWaiters;
+  private hasRemoteDescription;
+  private readonly history;
+  private closedBy?;
+  private handlerError?;
+  private localCandidateCount;
+  private remoteCandidateCount;
+  /**
+   * Local candidates gathered before the remote description, handed out right after it. An offerer's
+   * candidates let the answerer reach it and start DTLS; the binding makes the remote description the
+   * DTLS layer checks the peer's certificate against only after the ICE layer has it, so a handshake
+   * that arrives while the answer is being applied is refused. Holding the candidates until the
+   * answer is applied keeps the answerer from reaching this side before then.
+   */
+  private readonly heldLocalCandidates;
+  /** Remote candidates that arrived before the remote description, applied right after it. */
+  private readonly earlyCandidates;
+  private closed;
+  constructor(options?: IRtcPeerOptions);
+  private guard;
+  private fault;
+  private remember;
+  /** What the connection went through, for explaining why it ended. */
+  diagnostics(): IRtcPeerDiagnostics;
+  get state(): TRtcPeerState;
+  createDataChannel(label: string): RtcChannel;
+  private localDescription;
+  /** Create and apply the local offer; resolves with its SDP. */
+  createOffer(): Promise<string>;
+  /** Apply the remote offer, then create and apply the answer; resolves with its SDP. */
+  acceptOffer(sdp: string): Promise<string>;
+  acceptAnswer(sdp: string): void;
+  private remoteDescriptionApplied;
+  private handOut;
+  /**
+   * Apply a remote candidate. One that arrives before the remote description waits for it (bounded);
+   * one the binding refuses is dropped.
+   */
+  addRemoteCandidate(candidate: IRtcCandidate): void;
+  /**
+   * The fingerprint of the certificate the DTLS layer accepted, once connected; `undefined` before.
+   * The DTLS layer (OpenSSL) accepts a certificate only after verifying the peer's handshake signature
+   * with it and matching it against the remote description's fingerprint.
+   */
+  remoteFingerprint(): {
+    readonly value: string;
+    readonly algorithm: string;
+  } | undefined;
+  onStateChange(handler: (state: TRtcPeerState) => void): () => void;
+  onLocalCandidate(handler: (candidate: IRtcCandidate) => void): () => void;
+  onDataChannel(handler: (channel: RtcChannel) => void): () => void;
+  close(): void;
+}
+//#endregion
+//#region src/mesh-peer-link.d.ts
+/** The offerer creates the data channel and the offer; the answerer answers it. */
+type TMeshLinkRole = 'offerer' | 'answerer';
+/** Why a link ended. `closed` is an orderly close by either side after or before admission. */
+type TMeshLinkEnd = 'closed' | 'signaling' | 'channel-binding' | 'handshake' | 'protocol' | 'timeout';
+/** How far a link got before it ended. */
+type TMeshLinkStage = 'signaling' | 'connecting' | 'awaiting-channel' | 'handshake' | 'confirming' | 'admitted';
+/**
+ * Why a link ended, with what the connection under it went through, so a refusal says more than
+ * "closed". `cause` is the underlying error when there was one (e.g. the device handshake refusal).
+ */
+declare class MeshLinkEndedError extends Error {
+  readonly end: TMeshLinkEnd;
+  readonly stage: TMeshLinkStage;
+  readonly role: TMeshLinkRole;
+  readonly peer?: IRtcPeerDiagnostics;
+  /** Why the data channel closed, when it had. */
+  readonly channelClose?: string;
+  readonly cause?: unknown;
+  constructor(details: {
+    readonly end: TMeshLinkEnd;
+    readonly stage: TMeshLinkStage;
+    readonly role: TMeshLinkRole;
+    readonly detail?: string;
+    readonly peer?: IRtcPeerDiagnostics;
+    readonly channelClose?: string;
+    readonly cause?: unknown;
+  });
+}
+/** The DTLS fingerprints of one admitted connection, as each side sees them. */
+interface IMeshChannelBinding {
+  readonly localFingerprint: string;
+  /** Of the certificate the DTLS layer verified. */
+  readonly remoteFingerprint: string;
+}
+//#endregion
+//#region src/stun-message.d.ts
+interface ITransportAddress {
+  readonly address: string;
+  readonly port: number;
+}
+//#endregion
+//#region src/turn-server.d.ts
+/** Who a username belongs to, and the password it was issued with. */
+interface ITurnAuthorization {
+  /** The owner quotas are counted against and {@link TurnServer.retain} names. */
+  readonly owner: string;
+  readonly password: string;
+}
+interface ITurnQuotas {
+  /** Allocations one owner may hold at once. */
+  readonly allocationsPerOwner: number;
+  /** Allocations the server holds at once. */
+  readonly totalAllocations: number;
+  /** Bytes relayed per second for one owner, both directions together; more is dropped. */
+  readonly bytesPerSecondPerOwner: number;
+  /** The longest lifetime one Allocate or Refresh grants. */
+  readonly maxLifetimeSeconds: number;
+  /** How long an allocation may live however often it is refreshed. */
+  readonly maxAllocationAgeMs: number;
+  readonly permissionsPerAllocation: number;
+  readonly channelsPerAllocation: number;
+}
+declare const DEFAULT_TURN_QUOTAS: ITurnQuotas;
+/**
+ * Answers to requests nobody has authenticated, per second. Such a request may carry a forged
+ * source address, so what it is answered with must not be worth sending it for.
+ */
+interface IUnauthenticatedLimits {
+  readonly perSourcePerSecond: number;
+  readonly totalPerSecond: number;
+}
+declare const DEFAULT_UNAUTHENTICATED_LIMITS: IUnauthenticatedLimits;
+interface ITurnServerOptions {
+  /** The address the server and its relayed sockets bind (default every IPv4 interface). */
+  readonly host?: string;
+  /** The server's UDP port (default 3478; 0 picks a free one). */
+  readonly port?: number;
+  /**
+   * The ports relayed sockets take, inclusive (default: any free port). A relay behind a NAT needs
+   * this range forwarded to it as well as its own port.
+   */
+  readonly relayPorts?: {
+    readonly min: number;
+    readonly max: number;
+  };
+  /** The address relayed transport addresses carry (default `host`, or this machine's first external IPv4). */
+  readonly relayAddress?: string;
+  /**
+   * Default `r`: a realm travels in the clear, so it names nothing. At most 4 bytes: a challenge is
+   * never larger than the request it answers, and a longer realm would not fit the first request of
+   * the mesh's WebRTC stack.
+   */
+  readonly realm?: string;
+  /** Who `username` belongs to and its password; `undefined` refuses it. Asked once per allocation. */
+  readonly authorize: (username: string) => Promise<ITurnAuthorization | undefined>;
+  readonly quotas?: Partial<ITurnQuotas>;
+  /** How many requests nobody authenticated are answered, per source address and in all. */
+  readonly unauthenticatedLimits?: Partial<IUnauthenticatedLimits>;
+  /**
+   * Whether the default peer rule lets data reach private, link-local and shared (carrier-grade
+   * NAT) ranges: the relay host's own network (default true — a relayed connection to a device on
+   * that network needs it).
+   */
+  readonly allowPrivatePeers?: boolean;
+  /**
+   * Whether data may be relayed to or from `address`. Default: not unspecified, multicast or
+   * broadcast addresses, not loopback unless the relay itself is on loopback, and not private
+   * ranges when `allowPrivatePeers` is false.
+   */
+  readonly allowPeer?: (address: string) => boolean;
+  readonly now?: () => number;
+  /** A socket failed; the server keeps running. */
+  readonly onError?: (error: Error) => void;
+}
+declare class TurnServer {
+  private readonly socket;
+  private readonly options;
+  private readonly bindHost;
+  private readonly relayAddress;
+  private readonly allocations;
+  private readonly buckets;
+  private readonly quotas;
+  private readonly realm;
+  private readonly limits;
+  /** Answers to requests nobody has authenticated yet, per source address and in all. */
+  private readonly answerBuckets;
+  private answerBudget?;
+  private readonly nonceSecret;
+  private readonly ownAddresses;
+  private readonly allowPeer;
+  private readonly sweeper;
+  /** Once {@link TurnServer.retain} has named them: the only owners that may allocate. */
+  private retained?;
+  private closed;
+  private constructor();
+  /** Bind the server's socket and start serving. */
+  static start(options: ITurnServerOptions): Promise<TurnServer>;
+  /** Where clients reach the server. */
+  get address(): ITransportAddress;
+  /** Allocations held, by one owner or in all. */
+  allocationCount(owner?: string): number;
+  /**
+   * Close every allocation whose owner is not one of `owners`, and allocate for these owners only
+   * from now on — also for a request whose authorization was answered before this call.
+   */
+  retain(owners: ReadonlySet<string>): void;
+  close(): Promise<void>;
+  private now;
+  private receive;
+  private send;
+  private reply;
+  private fail;
+  /** A nonce: when it was issued and a MAC binding that to the client's address, 16 characters. */
+  private nonce;
+  private nonceMac;
+  private nonceValid;
+  /**
+   * Answer a request nobody has authenticated. Its source may be forged, so the answer is never
+   * larger than the request (no reflection gain), and answers are limited per source address and in
+   * all; what is over is dropped unanswered.
+   */
+  private answerUnauthenticated;
+  /** An error answer to an unauthenticated request; the reason phrase is left empty to keep it small. */
+  private refuseUnauthenticated;
+  private challenge;
+  /**
+   * Authenticate a request. On an existing allocation only its own username and key count;
+   * otherwise the caller's authorization is asked. `undefined`: already answered with an error.
+   */
+  private authenticate;
+  private unknownAttributes;
+  private request;
+  private authenticatedRequest;
+  private allocate;
+  /** A socket for a relayed address: any free port, or a free one of the configured range. */
+  private relayedSocket;
+  private allocationPorts;
+  /** Whether `peer` is this server's own listening socket: relaying there would loop TURN into itself. */
+  private isServerItself;
+  /** The lifetime granted: what was asked, within the quota and the allocation's remaining age. */
+  private grantedLifetime;
+  private refresh;
+  private peerAddresses;
+  private permit;
+  private bindChannel;
+  private permitted;
+  /** Take `bytes` from the owner's budget for this second; false when it is spent. */
+  private spend;
+  private live;
+  private fromClientSend;
+  private fromClientChannel;
+  private fromPeer;
+  private remove;
+  private sweep;
+}
+//#endregion
+//#region src/mesh-turn-relay.d.ts
+/** Where a paired device's relay listens. */
+interface IMeshRelayEndpoint {
+  readonly host: string;
+  readonly port: number;
+}
+/** A device the relay serves, with the pair's rendezvous. */
+interface IMeshRelayPeer {
+  readonly deviceId: string;
+  readonly rendezvous: IPairRendezvous;
+}
+/** How long a relay credential is good for, by default. */
+declare const DEFAULT_RELAY_CREDENTIAL_TTL_MS: number;
+/** The longest a relay accepts: a credential cannot outlive the tag epochs its relay looks up. */
+declare const MAX_RELAY_CREDENTIAL_TTL_MS: number;
+/** A relay credential this device presents to `rendezvous`'s peer's relay, good until `now + ttlMs`. */
+declare function meshRelayCredential(rendezvous: IPairRendezvous, now: number, ttlMs?: number): Promise<{
+  readonly username: string;
+  readonly credential: string;
+}>;
+/** ICE servers for a paired device's relay endpoints, with this pair's credential. */
+declare function meshRelayIceServers(rendezvous: IPairRendezvous, endpoints: readonly IMeshRelayEndpoint[], now: number, ttlMs?: number): Promise<IIceServer[]>;
+/**
+ * Why a relay was needed: only relayed connections are allowed, or a direct attempt got as far as
+ * trying paths and found none.
+ */
+type TMeshRelayNeed = 'relay-only' | 'no-direct-path';
+/**
+ * A connection needed a relay and none could be tried. Never a silent degrade — the connection is
+ * refused with this error, which carries what the direct attempt went through as its `cause`.
+ */
+declare class MeshRelayNeededError extends Error {
+  readonly deviceId: string;
+  readonly need: TMeshRelayNeed;
+  constructor(deviceId: string, need: TMeshRelayNeed, options?: {
+    readonly cause?: unknown;
+  });
+}
+interface IMeshTurnRelayOptions {
+  /** Default every IPv4 interface. */
+  readonly host?: string;
+  /** Default 3478; 0 picks a free port. */
+  readonly port?: number;
+  /** The address relayed transport addresses carry, e.g. this device's public address. */
+  readonly relayAddress?: string;
+  /** The ports relayed addresses take; behind a NAT, forward them with the relay's own port. */
+  readonly relayPorts?: {
+    readonly min: number;
+    readonly max: number;
+  };
+  readonly quotas?: Partial<ITurnQuotas>;
+  /** Default true: see {@link TurnServer}. */
+  readonly allowPrivatePeers?: boolean;
+  /** Default: see {@link TurnServer}. */
+  readonly allowPeer?: (address: string) => boolean;
+  readonly now?: () => number;
+  readonly onError?: (error: Error) => void;
+}
+/** This device's relay for its paired devices. */
+declare class MeshTurnRelay {
+  private readonly server;
+  private readonly now;
+  private peers;
+  /** Whose each relay-user tag is, for the peers in force and one epoch: derived once, not per request. */
+  private owners?;
+  private constructor();
+  static start(options?: IMeshTurnRelayOptions): Promise<MeshTurnRelay>;
+  /** Where the relay listens. */
+  get endpoint(): IMeshRelayEndpoint;
+  /** Allocations held, by one device or in all. */
+  allocationCount(deviceId?: string): number;
+  /**
+   * The devices the relay serves: the current, unrevoked peers of the lists in force. Any other
+   * device's credentials stop working, and its allocations close at once.
+   */
+  declarePeers(peers: readonly IMeshRelayPeer[]): void;
+  private authorize;
+  /** The peers' relay-user tags for `epoch` and the adjacent ones, by tag. */
+  private tagOwners;
+  close(): Promise<void>;
+}
+//#endregion
+//#region src/mesh-discovery.d.ts
+/** A direct signaling endpoint a peer might be listening on. */
+interface IMeshCandidate {
+  readonly host: string;
+  readonly port: number;
+}
+/** A peer device a node signals, with the pair's rendezvous and relay inbox topics. */
+interface IMeshPeerRoute {
+  readonly deviceId: string;
+  /** Where this device listens for the peer on a relay. */
+  readonly inbound: string;
+  /** Where this device sends to reach the peer on a relay. */
+  readonly outbound: string;
+  readonly rendezvous: IPairRendezvous;
+}
+/** One way of finding a peer's direct signaling endpoint. */
+interface IMeshCandidateSource {
+  /** How long a lookup of this source may take; default: the caller's. */
+  readonly timeoutMs?: number;
+  /** Candidates for `peer`, best first; empty when this source knows none. Never throws. */
+  candidates(peer: IMeshPeerRoute, signal: AbortSignal): Promise<readonly IMeshCandidate[]>;
+}
+/** The last candidates that worked for each peer device, most recent first. */
+interface IMeshAddressCache {
+  recall(deviceId: string): readonly IMeshCandidate[];
+  remember(deviceId: string, candidate: IMeshCandidate): void;
+  /** Forget every device but these: a device that left the lists has no address worth keeping. */
+  retain(deviceIds: readonly string[]): void;
+  /** The port this device listened on last, to listen on again so peers' caches stay useful. */
+  lastListenPort(): number | undefined;
+  rememberListenPort(port: number): void;
+}
+/** Candidates per device the cache keeps. */
+declare const MAX_CACHED_CANDIDATES = 3;
+/** The cache, as the first candidate source. */
+declare function addressCacheSource(cache: IMeshAddressCache): IMeshCandidateSource;
+/** An address cache that lives as long as the process — for tests and callers without a state dir. */
+declare function createInMemoryMeshAddressCache(): IMeshAddressCache;
+//#endregion
+//#region src/mesh-relay.d.ts
+interface IMeshRelay {
+  /** Be present at exactly these topics (replaces any earlier declaration). */
+  declarePresence(topics: readonly string[]): void;
+  /** Deliver `data` to whoever is present at `topic`. */
+  send(topic: string, data: unknown): void;
+  /** Messages delivered to a topic this relay client is present at. Returns an unsubscribe. */
+  onMessage(handler: (topic: string, data: unknown) => void): () => void;
+  /** Nobody was present at `topic` when a message was sent there. Returns an unsubscribe. */
+  onAbsent(handler: (topic: string) => void): () => void;
+  /**
+   * The peers the node signals now (replaces any earlier declaration), for a relay that looks for
+   * peers itself rather than only delivering to topics.
+   */
+  declarePeers?(peers: readonly IMeshPeerRoute[]): void;
+  /** A connection to `deviceId` was admitted: the way its signals went worked. */
+  confirmPeer?(deviceId: string): void;
+  close(): void;
+}
+interface IInMemoryMeshRelayHub {
+  /** A new relay client attached to this hub. */
+  connect(): IMeshRelay;
+}
+/**
+ * An in-process relay hub with the relay's delivery rules — for tests and loopback only: one holder
+ * per topic (the newest), never an echo to the sender, `absent` when nobody holds the topic.
+ * Deliveries run on a microtask, as a network would never deliver synchronously.
+ */
+declare function createInMemoryMeshRelayHub(): IInMemoryMeshRelayHub;
+//#endregion
+//#region src/device-mesh-node.d.ts
+/**
+ * How a connection reaches a peer no direct path reaches: a relay a paired device runs first, then
+ * the TURN servers the user configured. With neither, a connection that needs a relay is refused
+ * with {@link MeshRelayNeededError} rather than left to fail silently.
+ */
+interface IDeviceMeshRelayOptions {
+  /** The relays `peers` advertise, by device id, as found over their pairwise records. */
+  readonly advertised?: (peers: readonly IMeshPeerRoute[], signal: AbortSignal) => Promise<ReadonlyMap<string, readonly IMeshRelayEndpoint[]>>;
+  /** TURN servers the user configured, tried once the advertised relays did not carry a connection. */
+  readonly configured?: readonly IIceServer[];
+  /** Relay candidates only: for a network where no direct path can work. */
+  readonly relayOnly?: boolean;
+  /** How long a relay credential lasts (default: see `meshRelayCredential`). */
+  readonly credentialTtlMs?: number;
+}
+interface IDeviceMeshNodeOptions {
+  readonly cryptoContext: IIdentityContext;
+  readonly identity: IDeviceHandshakeIdentity;
+  /** This device's signed descriptor of the session it offers to peers. */
+  readonly sessionDescriptor: ISessionDescriptor;
+  /** What this device lets a peer be asked for; an admission grants the intersection. */
+  readonly localPolicy: readonly TDeviceCapability[];
+  readonly relay: IMeshRelay;
+  /**
+   * The operator of this session, asked before a peer may use a capability that needs approval.
+   * Absent: such capabilities are refused.
+   */
+  readonly operatorApprover?: IOperatorApprover;
+  readonly iceServers?: readonly IIceServer[];
+  readonly relays?: IDeviceMeshRelayOptions;
+  /** This device's own relay: told which devices it serves whenever the lists in force change. */
+  readonly relayServer?: {
+    declarePeers(peers: readonly IMeshRelayPeer[]): void;
+  };
+  /** Before a remote admission, ask a signing-key holder for newer lists (see the device handshake). */
+  readonly fetchLatestLists?: (signal: AbortSignal) => Promise<unknown>;
+  /** Newer verified lists adopted during a handshake, for the caller to persist. */
+  readonly onListsAdopted?: (update: IListUpdate) => void;
+  /** From the first signal of an attempt to its admission (default 20 s). */
+  readonly connectTimeoutMs?: number;
+  readonly handshakeTimeoutMs?: number;
+  /** Test seam: inject the `node-datachannel` module. */
+  readonly loadDataChannel?: () => IDataChannelModule;
+  readonly now?: () => number;
+}
+/** An admitted connection to one peer device. */
+interface IDeviceMeshLink {
+  readonly admission: IDeviceMeshAdmission;
+  readonly result: IDeviceHandshakeResult;
+  /** The DTLS fingerprints the handshake bound this connection to. */
+  readonly channelBinding: IMeshChannelBinding;
+  /** What the peer may do on this connection; ask it before acting on the peer's request. */
+  readonly authority: ConnectionAuthority;
+  send(body: string): void;
+  onMessage(handler: (body: string) => void): () => void;
+  /**
+   * A channel of its own for one file transfer. What travels on it is the file carrier's; the peer
+   * decides on it with its operator, and this side's authority is not asked.
+   */
+  openFileChannel(): Promise<IFileFrameChannel>;
+  /**
+   * Channels the peer opened to send a file. Whoever takes them decides on each transfer, asking
+   * {@link IDeviceMeshLink.authority}; with no handler, such channels are closed unread.
+   */
+  onFileChannel(handler: (channel: IFileFrameChannel) => void): () => void;
+  onClose(handler: () => void): () => void;
+  close(): void;
+}
+/** A connection attempt that ended before admission. */
+interface IDeviceMeshRefusal {
+  readonly deviceId: string;
+  readonly end: TMeshLinkEnd;
+  /**
+   * Why: a {@link MeshLinkEndedError} (its `cause` is e.g. the handshake refusal), a
+   * {@link MeshRelayNeededError} when the peer needs a relay and none could be tried, or why the
+   * device was dropped.
+   */
+  readonly error?: unknown;
+}
+declare class DeviceMeshNode {
+  private readonly options;
+  /** This run's instance id. */
+  readonly instance: string;
+  private identity;
+  private sessionDescriptor;
+  private readonly peers;
+  private readonly byInbound;
+  private readonly linkHandlers;
+  private readonly refusalHandlers;
+  private readonly waiters;
+  private readonly unsubscribes;
+  private started;
+  private stopped;
+  private sync;
+  constructor(options: IDeviceMeshNodeOptions);
+  get deviceId(): string;
+  /** Derive the inbox topics, be present at them, and announce this run to every peer device. */
+  start(): Promise<void>;
+  /**
+   * Use newer lists or a new session descriptor from the next handshake on. A list older than the
+   * one in force is ignored. Peers the lists no longer name, or revoke, are dropped with their
+   * connections; new ones are announced to.
+   */
+  refresh(update: {
+    readonly identity?: IDeviceHandshakeIdentity;
+    readonly sessionDescriptor?: ISessionDescriptor;
+  }): Promise<void>;
+  /** Send the lists in force over every admitted connection. */
+  private pushLists;
+  /**
+   * Lists a peer pushed: taken only when newer than the ones in force, issued by this user's signing
+   * key (a signing-key revocation by the master key), and verifying for this device; anything else is
+   * ignored and the connection stays.
+   */
+  private receiveLists;
+  /** Recompute the peer set from the current lists; serialized so two refreshes never interleave. */
+  private syncPeers;
+  private drop;
+  /** The offerer for a pair is the device with the lower id. */
+  roleFor(deviceId: string): TMeshLinkRole | undefined;
+  /** The admitted link to `deviceId`, if there is one. */
+  link(deviceId: string): IDeviceMeshLink | undefined;
+  /**
+   * An admitted link to `deviceId`: the existing one, or a new one once the peer is reachable.
+   * Rejects for a device this node will not talk to, when an attempt is refused, on timeout, or when
+   * the node stops.
+   */
+  connect(deviceId: string, timeoutMs?: number): Promise<IDeviceMeshLink>;
+  onLink(handler: (link: IDeviceMeshLink) => void): () => void;
+  onRefusal(handler: (refusal: IDeviceMeshRefusal) => void): () => void;
+  stop(): void;
+  private hello;
+  private receive;
+  /** The run already being served, or being connected to. */
+  private serves;
+  private onHello;
+  private onOffer;
+  /** A new attempt replaces any other pending one, never the admitted connection. */
+  private startAttempt;
+  /** Lists the handshake verified and found newer: in force here at once, then handed to the caller. */
+  private adoptLists;
+  private admitted;
+  private ended;
+  /**
+   * The relays the next attempt to `state`'s peer uses: the ones paired devices advertise, then the
+   * configured ones once those did not carry a connection, and round again. None: a direct attempt,
+   * or — when only relay candidates may be used — a refusal naming the missing relay.
+   */
+  private relayStage;
+  /** The routes of every peer, `first`'s first: a lookup bounded to some peers covers it. */
+  private peerRoutes;
+  /**
+   * ICE servers for the relays paired devices advertise, with this pair's credential for each: the
+   * peer's own relay first. Only a device the lists in force name, unrevoked, is asked to relay.
+   */
+  private embeddedRelays;
+  /**
+   * A connection with a DTLS certificate of its own (the implementation makes one per connection):
+   * a per-process certificate would be a stable identifier the relay could link across connections.
+   * No ICE server is contacted unless one is configured or a paired device advertises its relay.
+   */
+  private createPeer;
+}
+//#endregion
+//#region src/mesh-signal.d.ts
+/**
+ * What two device mesh nodes say to each other through the relay, and the frames their data channel
+ * carries. Everything here arrives from an untrusted relay or an unadmitted peer, so every field is
+ * bounded and shape-checked before it is used, and a failure names no value.
+ *
+ * `hello` is presence: a node announces its instance to a peer's inbox. The instance is a random id
+ * per node run, so a restarted peer is told apart from its previous run without naming the device.
+ * An attempt (`cid`) scopes an offer, its answer and their ICE candidates to one connection.
+ */
+/** Largest message body a data-channel `mesh-msg` frame carries. */
+declare const MAX_MESH_MESSAGE_CHARS = 60000;
+//#endregion
+//#region src/ws-mesh-relay-client.d.ts
+interface IWsMeshRelayClientOptions {
+  /** Relay URL, e.g. `wss://relay.example`. */
+  readonly url: string;
+  readonly onError?: (error: Error) => void;
+  /** Called each time the relay confirms a presence declaration. */
+  readonly onPresent?: () => void;
+  /** Injectable socket factory (defaults to a real `ws` WebSocket) — for tests. */
+  readonly createSocket?: (url: string) => IWebSocketLike;
+}
+declare class WsMeshRelayClient implements IMeshRelay {
+  private readonly options;
+  private readonly socket;
+  private readonly messages;
+  private readonly absents;
+  private readonly outbox;
+  private topics;
+  private closed;
+  constructor(options: IWsMeshRelayClientOptions);
+  private flush;
+  private write;
+  private receive;
+  declarePresence(topics: readonly string[]): void;
+  send(topic: string, data: unknown): void;
+  onMessage(handler: (topic: string, data: unknown) => void): () => void;
+  onAbsent(handler: (topic: string) => void): () => void;
+  close(): void;
+}
+//#endregion
+//#region src/mesh-lan-listener.d.ts
+interface IMeshLanListener {
+  /** The port it listens on. */
+  readonly port: number;
+  /** Hold exactly these topics (replaces any earlier set). */
+  setPresence(topics: readonly string[]): void;
+  /** A signal delivered to a held topic, named by the topic. Returns an unsubscribe. */
+  onMessage(handler: (topic: string, data: unknown) => void): () => void;
+  close(): Promise<void>;
+}
+interface IMeshLanListenerOptions {
+  /** The port to listen on; when it is taken, any free port. Default: any free port. */
+  readonly port?: number;
+  /** The address to bind; default: every interface. */
+  readonly host?: string;
+}
+declare function startMeshLanListener(options?: IMeshLanListenerOptions): Promise<IMeshLanListener>;
+//#endregion
+//#region src/mesh-mdns.d.ts
+/** The DNS-SD service type. Generic on purpose: it must not name the product. */
+declare const MESH_MDNS_SERVICE = "_rdv._tcp.local";
+/** A DNS resource record, in the shape `multicast-dns` reads and writes. */
+interface IMdnsRecord {
+  readonly name: string;
+  readonly type: string;
+  readonly ttl?: number;
+  readonly data?: unknown;
+}
+interface IMdnsQuestion {
+  readonly name: string;
+  readonly type: string;
+}
+interface IMdnsPacket {
+  readonly questions?: readonly IMdnsQuestion[];
+  readonly answers?: readonly IMdnsRecord[];
+  readonly additionals?: readonly IMdnsRecord[];
+}
+interface IMdnsRemote {
+  readonly address: string;
+}
+/** The slice of a `multicast-dns` instance this module drives. */
+interface IMdnsTransport {
+  on(event: 'query' | 'response', listener: (packet: IMdnsPacket, rinfo: IMdnsRemote) => void): void;
+  on(event: 'error' | 'warning', listener: (error: Error) => void): void;
+  removeListener(event: 'response', listener: (packet: IMdnsPacket, rinfo: IMdnsRemote) => void): void;
+  query(packet: {
+    readonly questions: readonly IMdnsQuestion[];
+  }): void;
+  respond(packet: {
+    readonly answers: readonly IMdnsRecord[];
+    readonly additionals?: readonly IMdnsRecord[];
+  }): void;
+  destroy(): void;
+}
+interface IMeshMdnsOptions {
+  /** Default: a `multicast-dns` socket on the standard group and port. */
+  readonly createTransport?: () => IMdnsTransport;
+  /** This device's addresses for the A/AAAA records. Default: its non-internal interfaces. */
+  readonly addresses?: () => readonly string[];
+  readonly lookupTimeoutMs?: number;
+  /** After the first match, how much longer a lookup listens (within `lookupTimeoutMs`). */
+  readonly answerGraceMs?: number;
+  readonly minAnswerIntervalMs?: number;
+  /** mDNS cannot run (e.g. the port is unavailable): the other candidate sources still do. */
+  readonly onError?: (error: Error) => void;
+  readonly now?: () => number;
+}
+/** This device's non-internal interface addresses (no IPv6 link-local). */
+declare function localInterfaceAddresses(): string[];
+/** How many instances `count` real ones are announced as. */
+declare function paddedInstanceCount(count: number): number;
+declare class MeshMdns implements IMeshCandidateSource {
+  private readonly options;
+  private transport?;
+  private routes;
+  private port?;
+  private records?;
+  private instances;
+  private timer?;
+  private generation;
+  private closed;
+  /** This epoch's padding labels and host name. */
+  private epochCover?;
+  /** What was last announced, to announce again only when it changes. */
+  private announced?;
+  private lastAnswer?;
+  private answerTimer?;
+  constructor(options?: IMeshMdnsOptions);
+  private now;
+  /** The transport, created on first use. `undefined` once it failed or the source is closed. */
+  private open;
+  /** Announce this device to `routes`' peers, as a signaling endpoint on `port`. */
+  advertise(routes: readonly IMeshPeerRoute[], port: number): Promise<void>;
+  private rebuild;
+  private schedule;
+  private onQuery;
+  /** Answer now, or once the interval since the last answer has passed; queries meanwhile share it. */
+  private answer;
+  candidates(peer: IMeshPeerRoute, signal: AbortSignal): Promise<readonly IMeshCandidate[]>;
+  close(): void;
+}
+interface IInMemoryMdnsBus {
+  /** A transport on this bus whose answers come from `address`. */
+  transport(address: string): IMdnsTransport;
+  /** Every packet answered on the bus, in order. */
+  readonly responses: readonly IMdnsPacket[];
+}
+/**
+ * An in-process multicast group — for tests and loopback only. A query reaches every member,
+ * itself included, as multicast loops back; an answer reaches every member with the answering
+ * member's address. Packets cross as JSON and are delivered on a microtask, as a network would.
+ */
+declare function createInMemoryMdnsBus(): IInMemoryMdnsBus;
+//#endregion
+//#region src/mesh-records.d.ts
+/** A one-time Ed25519 key: the public half, and a signer. */
+interface IItemKey {
+  readonly publicKey: Uint8Array;
+  sign(message: Uint8Array): Promise<Uint8Array>;
+}
+/** A BEP 44 mutable item, as signed. */
+interface IMutableItem {
+  readonly k: Uint8Array;
+  readonly salt?: Uint8Array;
+  readonly seq: number;
+  readonly v: Uint8Array;
+  readonly sig: Uint8Array;
+}
+/** Where one pair's record of one purpose lives in one direction at one epoch. */
+interface IItemAddress {
+  readonly key: IItemKey;
+  readonly salt: Uint8Array;
+}
+//#endregion
+//#region src/mesh-item-store.d.ts
+interface IRendezvousItemStore {
+  /** Publish `value` at `address`, as of `now` (ms); rejects when no holder took it. */
+  put(address: IItemAddress, value: Uint8Array, now: number, signal?: AbortSignal): Promise<void>;
+  /** The verified value at `publicKey` and `salt`; `undefined` when none verifies. Never throws. */
+  get(publicKey: Uint8Array, salt: Uint8Array, signal: AbortSignal): Promise<Uint8Array | undefined>;
+  close(): void;
+}
+interface IInMemoryItemNetwork {
+  /** A store client attached to this network. */
+  store(): IRendezvousItemStore;
+  /** Every item the network holds, as stored. */
+  items(): readonly IMutableItem[];
+  /** Replace what the network serves (a hostile node): return the item to serve, or `undefined`. */
+  serve(rewrite: (item: IMutableItem) => IMutableItem | undefined): void;
+}
+/**
+ * An in-process item network with a DHT node's rules: it refuses an item whose signature does not
+ * verify, and a sequence number lower than the one it holds.
+ */
+declare function createInMemoryItemNetwork(): IInMemoryItemNetwork;
+interface IPkarrRelayStoreOptions {
+  /** Relay base URLs (`https://…`), each run by whoever the user chose; several operators. */
+  readonly relays: readonly string[];
+  /** Default: the global `fetch`. */
+  readonly fetch?: typeof fetch;
+}
+/**
+ * A store over several pkarr relays. A put goes to every relay and succeeds when one took it; a get
+ * asks every relay and keeps the newest item that verifies. A relay is only a cache in front of the
+ * DHT: it can withhold or serve stale items, never forge one.
+ */
+declare function createPkarrRelayStore(options: IPkarrRelayStoreOptions): IRendezvousItemStore;
+//#endregion
+//#region src/mesh-dht.d.ts
+/** Longest delay before a pair's records are published, by default. */
+declare const DEFAULT_MAX_PUBLISH_JITTER_MS = 90000;
+/** The device lists this device hands on to its peers. */
+interface IPublishedLists {
+  readonly revocation: IDeviceRevocationList;
+  readonly signingKeyRevocation?: ISigningKeyRevocation;
+}
+/** What a freshness lookup found, as received, newest first: each candidate is verified before use. */
+interface IFetchedLists {
+  readonly revocation?: readonly unknown[];
+  readonly signingKeyRevocation?: readonly unknown[];
+}
+interface IMeshDhtOptions {
+  /** Where records go and come from; every one is written to and read from. */
+  readonly stores: readonly IRendezvousItemStore[];
+  /** This device's addresses to publish with its endpoint port. */
+  readonly addresses: () => readonly string[];
+  /** Where this device's relay listens, published to each paired device with its hints; none: no relay. */
+  readonly relayEndpoints?: () => readonly IMeshCandidate[];
+  /** The newest lists this device holds; absent or `undefined`: no list records are published. */
+  readonly lists?: () => IPublishedLists | undefined;
+  readonly maxPublishJitterMs?: number;
+  /** How long a candidate lookup may take. */
+  readonly lookupTimeoutMs?: number;
+  readonly random?: () => number;
+  readonly now?: () => number;
+  /** A record could not be published; lookups still run. */
+  readonly onError?: (error: Error) => void;
+}
+declare class MeshDht implements IMeshCandidateSource {
+  private readonly options;
+  readonly timeoutMs: number;
+  private readonly scheduled;
+  private routes;
+  /** The lists found by the last lookup that finished, for a lookup that runs out of time. */
+  private listsFound;
+  private prefetchedEpoch?;
+  /** The relays peers advertised, by device: the epoch and time they were looked up. */
+  private readonly relaysFound;
+  /** Relay lookups running, by device. */
+  private readonly relayLookups;
+  private closed;
+  constructor(options: IMeshDhtOptions);
+  private now;
+  /** The peer's endpoint addresses from its hints record, at this epoch or an adjacent one. */
+  candidates(peer: IMeshPeerRoute, signal: AbortSignal): Promise<readonly IMeshCandidate[]>;
+  /** The relay endpoints in the newest of `found`, the peer's hints records. */
+  private rememberRelays;
+  /**
+   * The relays `peers` advertise to this device, by device id. What a lookup found holds for the
+   * epoch, and "no relay" for a short while, so connection attempts do not wait on lookups; a
+   * lookup still running when `signal` ends goes on, and the next call has its answer. Only a
+   * peer's own sealed hints record says where its relay is, so no one else learns it and no one
+   * else can plant one.
+   */
+  relayAdverts(peers: readonly IMeshPeerRoute[], signal: AbortSignal): Promise<ReadonlyMap<string, readonly IMeshCandidate[]>>;
+  /** One lookup of a peer's relay at a time, bounded by the lookup timeout, not by any caller. */
+  private lookUpRelay;
+  /** The records of `purpose` the peer published for this device, opened; empty when none. */
+  private lookup;
+  /** One chunk of the peer's record, opened; `undefined` when it is not there or not the peer's. */
+  private read;
+  /** The device lists the peer published for this device, whole; one per store and epoch found. */
+  private lookupLists;
+  /**
+   * Publish this device's records for `routes`, each pair after its own random delay. A pair already
+   * waiting to publish for this epoch and port keeps its delay.
+   */
+  advertise(routes: readonly IMeshPeerRoute[], port: number): Promise<void>;
+  private publish;
+  /**
+   * The lists the peers published for this device, as received — candidates for the freshness
+   * lookup before a remote admission, each verified there. Any paired device can publish anything
+   * here, so candidates are returned rather than the one that claims to be newest, and each peer's
+   * newest few come before any peer's next, so one peer's records cannot crowd out another's. When
+   * `signal` ends first, what the last finished lookup found. `undefined`: none.
+   */
+  latestLists(signal: AbortSignal): Promise<IFetchedLists | undefined>;
+  private findLists;
+  close(): void;
+}
+//#endregion
+//#region src/discovering-mesh-relay.d.ts
+/** Announces this device to its peers somewhere they look. */
+interface IMeshAdvertiser {
+  advertise(routes: readonly IMeshPeerRoute[], port: number): Promise<void>;
+  close(): void;
+}
+interface IDiscoveringMeshRelayOptions {
+  /**
+   * The self-hosted relay: the last resort. Absent with no `signaling` either: a pair no candidate
+   * reaches cannot be signaled.
+   */
+  readonly relay?: IMeshRelay;
+  /** Public signaling carriers, tried in order before `relay` when no candidate answers. */
+  readonly signaling?: readonly IMeshRelay[];
+  /** This device's direct signaling endpoint. */
+  readonly listener: IMeshLanListener;
+  /** Where to look for a peer's endpoint, in order. */
+  readonly sources: readonly IMeshCandidateSource[];
+  /** Remembers candidates that carried an admitted connection. */
+  readonly cache?: IMeshAddressCache;
+  /** Told the peers and this device's endpoint port, to announce this device; closed with this relay. */
+  readonly advertisers?: readonly IMeshAdvertiser[];
+  /** Test seam: open a socket to a candidate. */
+  readonly connect?: (candidate: IMeshCandidate) => IWebSocketLike;
+  readonly probeTimeoutMs?: number;
+  readonly sourceTimeoutMs?: number;
+  readonly relayRecheckMs?: number;
+  /** How long a direct path may carry signals without an admission before it is set aside. */
+  readonly admissionTimeoutMs?: number;
+  readonly onError?: (error: Error) => void;
+  readonly now?: () => number;
+}
+declare class DiscoveringMeshRelay implements IMeshRelay {
+  private readonly options;
+  private readonly routes;
+  private readonly byDevice;
+  /** LAN topic → the relay inbox topic the node knows the pair by. */
+  private lanIn;
+  private readonly messages;
+  private readonly absents;
+  private readonly unsubscribes;
+  private readonly abort;
+  private sync;
+  /** Peer declarations not yet in force; signals sent meanwhile wait for them, in order. */
+  private pendingPeers;
+  private waiting;
+  private timer?;
+  private closed;
+  constructor(options: IDiscoveringMeshRelayOptions);
+  private now;
+  /** Where a pair's signals go when no candidate answers, in order. */
+  private carriers;
+  private deliver;
+  private absent;
+  declarePresence(topics: readonly string[]): void;
+  declarePeers(peers: readonly IMeshPeerRoute[]): void;
+  /** Recompute the pairs' LAN topics for the current epoch and hold them. */
+  private applyPeers;
+  private scheduleEpoch;
+  confirmPeer(deviceId: string): void;
+  /** A cache that cannot be written costs the next connection a lookup, nothing more. */
+  private cacheWrite;
+  send(topic: string, data: unknown): void;
+  private sendDirect;
+  /** A signal for a topic that is no declared pair's: the last carrier, if there is one. */
+  private viaRelay;
+  private viaCarrier;
+  /** Try the sources in order; the first candidate that holds the pair's topic carries its signals. */
+  private resolve;
+  /**
+   * The first carrier not set aside carries the pair's signals for a while (the last one when all
+   * are). Without a carrier there is nothing to wait on: the next signal looks again, since the
+   * peer's endpoint may simply not have been up yet.
+   */
+  private fallBack;
+  private recheckMs;
+  private look;
+  /** A socket to `candidate` once it proves it holds `lanTopic`; `undefined` otherwise. */
+  private probe;
+  /**
+   * An endpoint or carrier that carries an attempt but no admission is set aside, so it cannot keep
+   * the pair from the next way — whether it never forwarded, or forwarded one attempt and swallows
+   * the next. One that fails again is set aside for longer, so it is not tried every recheck.
+   */
+  private armDeadline;
+  private useDirect;
+  private reset;
+  onMessage(handler: (topic: string, data: unknown) => void): () => void;
+  onAbsent(handler: (topic: string) => void): () => void;
+  close(): void;
+}
+interface IStartLanMeshRelayOptions {
+  /** The self-hosted relay: the last carrier. */
+  readonly relay?: IMeshRelay;
+  /**
+   * Beyond the local network: public records to find peers by (closed with the relay), and public
+   * signaling carriers tried before the self-hosted relay (the caller's to close).
+   */
+  readonly internet?: {
+    readonly dht?: MeshDht;
+    readonly signaling?: readonly IMeshRelay[];
+  };
+  /** Default: one that lives as long as the process. */
+  readonly cache?: IMeshAddressCache;
+  /** The address the direct signaling endpoint binds; default: every interface. */
+  readonly host?: string;
+  /** mDNS options, or `false` for none (the cache and the relay still work). */
+  readonly mdns?: IMeshMdnsOptions | false;
+  readonly onError?: (error: Error) => void;
+}
+/**
+ * A {@link DiscoveringMeshRelay} over this device's direct signaling endpoint, looking for peers in
+ * the address cache, with mDNS, then in public records, and signaling through the public carriers,
+ * then the self-hosted relay, when no candidate answers.
+ */
+declare function startLanMeshRelay(options?: IStartLanMeshRelayOptions): Promise<DiscoveringMeshRelay>;
+//#endregion
+//#region src/mainline-dht-store.d.ts
+/** A BEP 44 item as `bittorrent-dht` hands it over. */
+interface IDhtGetResult {
+  readonly v?: Uint8Array;
+  readonly k?: Uint8Array;
+  readonly sig?: Uint8Array;
+  readonly seq?: number;
+  readonly salt?: Uint8Array;
+}
+/** The slice of a `bittorrent-dht` instance this store drives. */
+interface IMainlineDht {
+  put(item: {
+    readonly k: Buffer;
+    readonly salt: Buffer;
+    readonly seq: number;
+    readonly v: Buffer;
+    readonly sig: Buffer;
+  }, callback: (error: Error | null, hash: Buffer, responses?: number) => void): void;
+  get(target: Buffer, options: {
+    readonly salt: Buffer;
+    readonly cache: false;
+  }, callback: (error: Error | null, result: IDhtGetResult | null) => void): void;
+  on(event: 'error' | 'warning', listener: (error: Error) => void): void;
+  destroy(callback?: () => void): void;
+}
+interface IMainlineDhtStoreOptions {
+  /** Test seam: the DHT client; default a `bittorrent-dht` node on the public bootstrap nodes. */
+  readonly createDht?: (verify: TDhtVerify) => IMainlineDht | Promise<IMainlineDht>;
+  readonly onError?: (error: Error) => void;
+}
+type TDhtVerify = (signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array) => boolean;
+/**
+ * A Mainline DHT store. The node joins the DHT when the store is created and stays for the life of
+ * the store, since joining takes seconds a lookup should not wait on each time.
+ */
+declare function startMainlineDhtStore(options?: IMainlineDhtStoreOptions): Promise<IRendezvousItemStore>;
+//#endregion
+//#region src/nostr-mesh-relay.d.ts
+/** A Nostr event as relays carry it. */
+interface INostrEvent {
+  readonly id: string;
+  readonly pubkey: string;
+  readonly created_at: number;
+  readonly kind: number;
+  readonly tags: readonly (readonly string[])[];
+  readonly content: string;
+  readonly sig: string;
+}
+interface INostrFilter {
+  readonly kinds: readonly number[];
+  readonly authors: readonly string[];
+  readonly since?: number;
+}
+/** The relays a device signals through. */
+interface INostrRelayPool {
+  /** Send `event` to every relay; resolves `true` when at least one took it. Never rejects. */
+  publish(event: INostrEvent): Promise<boolean>;
+  /** Events matching `filter` from any relay, as received. */
+  subscribe(filter: INostrFilter, onEvent: (event: unknown) => void): {
+    close(): void;
+  };
+  close(): void;
+}
+interface INostrMeshRelayOptions {
+  readonly pool: INostrRelayPool;
+  readonly maxEventAgeS?: number;
+  readonly now?: () => number;
+  readonly onError?: (error: Error) => void;
+}
+/**
+ * A mesh relay over Nostr. It needs the peers (see {@link IMeshRelay.declarePeers}) to derive their
+ * keys, and addresses a pair by its outbound topic. It reports a topic absent only when it knows no
+ * pair by it: whether the peer is listening, a relay that forwards ephemeral events cannot tell.
+ */
+declare class NostrMeshRelay implements IMeshRelay {
+  private readonly options;
+  private readonly messages;
+  private readonly absents;
+  private outbound;
+  private inbound;
+  private subscription?;
+  private chain;
+  private readonly seen;
+  private routes;
+  private epoch?;
+  private timer?;
+  private closed;
+  constructor(options: INostrMeshRelayOptions);
+  private now;
+  private report;
+  /** Run `task` after everything queued before it, so keys are in place before a send uses them. */
+  private enqueue;
+  /** Resolves once every declaration, send and receipt queued so far has run. */
+  whenIdle(): Promise<void>;
+  declarePresence(): void;
+  declarePeers(peers: readonly IMeshPeerRoute[]): void;
+  /** The pairs' keys and kinds for this epoch, and a subscription for the peers' adjacent epochs. */
+  private derive;
+  send(topic: string, data: unknown): void;
+  private receive;
+  private remember;
+  onMessage(handler: (topic: string, data: unknown) => void): () => void;
+  onAbsent(handler: (topic: string) => void): () => void;
+  close(): void;
+}
+interface IInMemoryNostrHub {
+  /** A client of every relay of this hub. */
+  pool(): INostrRelayPool;
+  /** Every event the hub forwarded, as received. */
+  readonly events: readonly INostrEvent[];
+  /** Deliver `event` as a relay would, to every matching subscription (a hostile relay's injection). */
+  inject(event: unknown): void;
+}
+/**
+ * In-process relays with a relay's rules for ephemeral events: an event whose signature does not
+ * verify is refused, and one that passes is forwarded to matching subscriptions and not stored.
+ * Deliveries run on a microtask, as a network would never deliver synchronously.
+ */
+declare function createInMemoryNostrHub(): IInMemoryNostrHub;
+/**
+ * A pool over `relays` (`wss://…`, several operators) with `nostr-tools`, connecting on first use.
+ * The relays see one-time keys, rotating kinds and ciphertext; they are trusted with nothing.
+ */
+declare function createNostrRelayPool(relays: readonly string[]): INostrRelayPool;
+//#endregion
+//#region src/mesh-public-relays.d.ts
+/**
+ * Default public infrastructure for finding and signaling a peer device beyond the local network.
+ *
+ * These are well-known relays run by different operators, chosen so that no single operator sees
+ * every record or every signal. None of them is trusted: they carry signed ciphertext under
+ * one-time keys, and a peer is admitted by the device handshake alone. They are defaults only —
+ * settings replace them, and a self-hosted relay remains an option.
+ */
+/** Nostr relays for live signaling, one per operator. */
+declare const DEFAULT_NOSTR_RELAYS: readonly string[];
+/**
+ * pkarr relays, for a client that cannot reach the Mainline DHT directly (a browser, or a network
+ * that blocks UDP). Two operators: Synonym (pubky) and n0 (iroh).
+ */
+declare const DEFAULT_PKARR_RELAYS: readonly string[];
+//#endregion
+//#region src/enrollment-link.d.ts
+/** A data channel bound to one negotiated connection, carrying JSON frames. */
+interface IEnrollmentChannel {
+  readonly localFingerprint: string;
+  /** Of the certificate the DTLS layer verified. */
+  readonly remoteFingerprint: string;
+  /** Send one frame; a closed channel drops it (the peer learns of the close instead). */
+  send(frame: unknown): void;
+  /** Each inbound frame, JSON-decoded; text that is not JSON arrives as `undefined`. */
+  onFrame(handler: (frame: unknown) => void): () => void;
+  onClose(handler: () => void): () => void;
+  close(): void;
+}
+/**
+ * Why no channel came about. `absent`: nobody waits at the topic — the code is wrong, expired or
+ * already used.
+ */
+type TEnrollmentLinkFailure = 'absent' | 'timeout' | 'signaling' | 'channel-binding' | 'closed';
+declare class EnrollmentLinkError extends Error {
+  readonly reason: TEnrollmentLinkFailure;
+  constructor(reason: TEnrollmentLinkFailure, detail?: string);
+}
+interface IEnrollmentRendezvous {
+  readonly relay: IMeshRelay;
+  /** The topic this side waits at. */
+  readonly inbound: string;
+  /** The topic the other side waits at. */
+  readonly outbound: string;
+  readonly iceServers?: readonly IIceServer[];
+  /** Test seam: inject the `node-datachannel` module. */
+  readonly loadDataChannel?: () => IDataChannelModule;
+  /** From the first signal of an attempt to a bound, open channel (default 20 s). */
+  readonly connectTimeoutMs?: number;
+}
+/**
+ * New device: connect to whoever waits at `outbound`. Resolves with the bound channel; rejects when
+ * nobody waits there (`absent`), on timeout, or when the connection fails. The relay stays the
+ * caller's.
+ */
+declare function dialEnrollment(options: IEnrollmentRendezvous): Promise<IEnrollmentChannel>;
+interface IEnrollmentListener {
+  /**
+   * Stop taking new attempts. A channel already handed over stays open. The topic is held until the
+   * caller closes the relay or declares other topics.
+   */
+  close(): void;
+}
+/**
+ * Existing device: wait at `inbound` for a new device, one attempt at a time. Each bound channel goes
+ * to `onChannel`; the next attempt is taken once that channel closes. The relay stays the caller's.
+ */
+declare function listenForEnrollment(options: IEnrollmentRendezvous & {
+  readonly onChannel: (channel: IEnrollmentChannel) => void;
+  /** An attempt that ended before its channel was bound. */
+  readonly onAttemptFailed?: (error: EnrollmentLinkError) => void;
+}): IEnrollmentListener;
+//#endregion
+export { DEFAULT_MAX_PUBLISH_JITTER_MS, DEFAULT_NOSTR_RELAYS, DEFAULT_PKARR_RELAYS, DEFAULT_RELAY_CREDENTIAL_TTL_MS, DEFAULT_TURN_QUOTAS, DEFAULT_UNAUTHENTICATED_LIMITS, DeviceMeshNode, DiscoveringMeshRelay, EnrollmentLinkError, type IConnectionApproval, type IConnectionApprovalContext, type IDataChannelModule, type IDeviceMeshLink, type IDeviceMeshNodeOptions, type IDeviceMeshRefusal, type IDeviceMeshRelayOptions, type IDiscoveringMeshRelayOptions, type IEnrollmentChannel, type IEnrollmentListener, type IEnrollmentRendezvous, type IFetchedLists, type IHandoffGrantFrame, type IHandoffGrantProof, type IHostReconnectConfig, type IIceServer, type IInMemoryItemNetwork, type IInMemoryMdnsBus, type IInMemoryMeshRelayHub, type IInMemoryNostrHub, type ILocalPeerProof, type ILocalProofFrame, type IMainlineDht, type IMainlineDhtStoreOptions, type IMdnsPacket, type IMdnsRecord, type IMdnsTransport, type IMeshAddressCache, type IMeshAdvertiser, type IMeshCandidate, type IMeshCandidateSource, type IMeshChannelBinding, type IMeshDhtOptions, type IMeshLanListener, type IMeshLanListenerOptions, type IMeshMdnsOptions, type IMeshPeerRoute, type IMeshRelay, type IMeshRelayEndpoint, type IMeshRelayPeer, type IMeshTurnRelayOptions, type INostrEvent, type INostrFilter, type INostrMeshRelayOptions, type INostrRelayPool, type IPkarrRelayStoreOptions, type IPublishedLists, type IRendezvousItemStore, type IRtcCandidate, type IRtcPeerDiagnostics, type IRtcPeerOptions, type ISignalMessage, type ISignalingClient, type IStartLanMeshRelayOptions, type ITurnAuthorization, type ITurnQuotas, type ITurnServerOptions, type IUnauthenticatedLimits, type IWebRtcTransportOptions, type IWebSocketLike, type IWsMeshRelayClientOptions, type IWsSignalingClientOptions, MAX_CACHED_CANDIDATES, MAX_MESH_MESSAGE_CHARS, MAX_RELAY_CREDENTIAL_TTL_MS, MESH_MDNS_SERVICE, MeshDht, MeshLinkEndedError, MeshMdns, MeshRelayNeededError, MeshTurnRelay, NostrMeshRelay, RtcChannel, RtcPeer, type TEnrollmentLinkFailure, type TMeshLinkEnd, type TMeshLinkRole, type TMeshLinkStage, type TMeshRelayNeed, type TModuleResolver, type TRtcChannelState, type TRtcPeerState, type TSignalKind, TurnServer, WebRtcTransport, WsMeshRelayClient, WsSignalingClient, addressCacheSource, createInMemoryItemNetwork, createInMemoryMdnsBus, createInMemoryMeshAddressCache, createInMemoryMeshRelayHub, createInMemoryNostrHub, createInMemorySignalingPair, createNostrRelayPool, createPkarrRelayStore, dialEnrollment, handoffGrantFrame, judgeHandoffGrant, listenForEnrollment, loadDataChannel, localInterfaceAddresses, localProofFrame, meshRelayCredential, meshRelayIceServers, paddedInstanceCount, startLanMeshRelay, startMainlineDhtStore, startMeshLanListener };
+//# sourceMappingURL=index.d.ts.map