freehop 0.1.0-alpha.0

package/src/relay/agent.mjs

@@ -0,0 +1,230 @@
+// SPDX-License-Identifier: Apache-2.0
+// Peer gateway: a TURN server that a desktop participant (or any peer with Node) runs on its own
+// machine, made reachable through the participant's router via PCP / NAT-PMP / UPnP. It is not a
+// third-party relay: it is the participant's own front door. Peers in the same room can reach the
+// participant through it even from symmetric NATs or UDP-blocking networks, and the participant may let
+// other members of its own session use it when they cannot reach each other.
+import { networkInterfaces } from 'node:os';
+import { randomBytes, createHmac } from 'node:crypto';
+import { createTurnServer, classifyPeerAddress } from './turn-server.mjs';
+
+const TAG = /^[A-Za-z0-9_-]{8,64}$/, LABEL = /^[A-Za-z0-9_-]{1,64}$/;
+// Peer revocations per room, rooms with a credential floor; relay-port router exchanges at once, started per second, burst.
+const ROOM_REVOCATIONS = 256, MAX_FLOORS = 4096, ROUTER_SLOTS = 4, ROUTER_RATE = 8, ROUTER_BURST = 16;
+
+// The TURN destination classification: only globally routable unicast counts as public.
+export function isPublicAddress(address) { return classifyPeerAddress(address) === 'public'; }
+
+function pickLanAddress() {
+  return Object.values(networkInterfaces()).flat().find(i => i.family === 'IPv4' && !i.internal)?.address ?? null;
+}
+
+/**
+ * startGateway({ host, port, relayPortRange, portMapping, mapper, externalAddress, rooms, credentialTtlSeconds, relayScope, limits, log })
+ * Resolves with { info(), credentialsFor(), allowRoom(), revokeRoom(), revokePeer(), rotate(), stats(), close() }.
+ * info() returns public gateway metadata, or null when unreachable. Keep credentialsFor()
+ * in the privileged process and expose a bounded, authenticated broker to renderers.
+ *
+ * Credentials are TURN REST style and scoped: username "<expiry>:<room tag 8>:<peer id|self>",
+ * password = base64(HMAC-SHA1(secret, username)). Only rooms passed to allowRoom() (or the
+ * `rooms` option) are accepted, and individual peers can be revoked (kick, leave). revokeRoom()
+ * voids every credential issued for that room so far, also after the tag is allowed again.
+ *
+ * relayScope 'internal' (default) relays only between allocations on this gateway: a remote peer
+ * and the owner's own `self` allocation, or two members. 'public' also lets every member relay
+ * UDP to any public host from this machine's address; not recommended when members are untrusted.
+ */
+export async function startGateway(options = {}) {
+  const ttlSeconds = options.credentialTtlSeconds ?? 7200;
+  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > 86400) throw new TypeError('credentialTtlSeconds must be 1..86400');
+  const relayScope = options.relayScope ?? 'internal';
+  if (relayScope !== 'internal' && relayScope !== 'public') throw new TypeError("relayScope must be 'internal' or 'public'");
+  const log = options.log ?? (() => {});
+  const host = options.host ?? pickLanAddress();
+  if (!host) throw new Error('No usable local IPv4 address for the gateway.');
+  const port = options.port ?? 3478;
+  // A machine with a public address (VPS, community server, IPv4 without NAT) needs no router
+  // mapping: its listener and relay ports are reachable as they are.
+  const publicHost = isPublicAddress(host);
+  let mapper = options.mapper ?? null;
+  if (!mapper && !publicHost && options.portMapping !== false) {
+    try {
+      const { createPortMapper } = await import('./port-mapper.mjs');
+      mapper = await createPortMapper({ localAddress: host, ...(typeof options.portMapping === 'object' ? options.portMapping : {}), log });
+    } catch (error) { log('port-mapper-unavailable', { message: error.message }); mapper = null; }
+  }
+  const mappings = [];
+  let external = options.externalAddress ?? (publicHost ? host : null);
+  const listenerPorts = { udp: port, tcp: port };
+  // An operator who forwards ports by hand passes externalAddress with portMapping:false.
+  const manual = !!options.externalAddress && options.portMapping === false;
+  const mapPort = async (protocol, internalPort) => {
+    if (publicHost || manual) return internalPort;
+    if (!mapper) return null;
+    try {
+      const m = await mapper.map({ protocol, internalPort, suggestedExternalPort: internalPort, lifetimeSeconds: 7200, description: 'peerlane gateway' });
+      mappings.push(m);
+      if (!m.externalAddressIsPrivate && isPublicAddress(m.externalAddress)) external ??= m.externalAddress;
+      else log('mapping-not-public', { externalAddress: m.externalAddress });
+      return m.externalPort;
+    } catch (error) { log('mapping-failed', { protocol, internalPort, message: error.message }); return null; }
+  };
+  // Map the listener ports first: the router's answer tells us the external address that
+  // every relayed transport address must advertise.
+  listenerPorts.udp = await mapPort('udp', port);
+  listenerPorts.tcp = await mapPort('tcp', port);
+
+  // Relay ports need router mappings only when relaying leaves this machine ('public' scope);
+  // internal delivery never touches them. Router exchanges are bounded (ROUTER_SLOTS at once,
+  // ROUTER_RATE starts per second); later Allocates wait, within the TURN hook timeout. A mapping
+  // lives exactly while an allocation still uses it: the TURN server aborts `signal` when it stops.
+  const relayUsers = new Map(), relayMapped = new Map(), routerQueue = []; // internal port -> users / mapping
+  let routerBusy = 0, routerTokens = ROUTER_BURST, routerAt = Date.now(), routerTimer = null;
+  const dropMapping = m => { const i = mappings.indexOf(m); if (i >= 0) mappings.splice(i, 1); try { mapper.unmap(m)?.catch?.(() => {}); } catch {} };
+  const releaseRelay = localPort => {
+    const users = (relayUsers.get(localPort) ?? 1) - 1;
+    if (users > 0) { relayUsers.set(localPort, users); return; }
+    relayUsers.delete(localPort);
+    const m = relayMapped.get(localPort);
+    if (m) { relayMapped.delete(localPort); dropMapping(m); }
+  };
+  const pumpRouter = () => {
+    const now = Date.now();
+    routerTokens = Math.min(ROUTER_BURST, routerTokens + (now - routerAt) * ROUTER_RATE / 1000); routerAt = now;
+    while (routerQueue.length && routerBusy < ROUTER_SLOTS && routerTokens >= 1) { routerTokens--; routerBusy++; routerQueue.shift()(); }
+    if (routerQueue.length && routerBusy < ROUTER_SLOTS && !routerTimer) {
+      routerTimer = setTimeout(() => { routerTimer = null; pumpRouter(); }, Math.ceil((1 - routerTokens) * 1000 / ROUTER_RATE));
+      routerTimer.unref?.();
+    }
+  };
+  const routerSlot = signal => new Promise((resolve, reject) => {
+    const start = () => { signal.removeEventListener('abort', leave); resolve(); };
+    const leave = () => { routerQueue.splice(routerQueue.indexOf(start), 1); reject(new Error('allocation ended')); };
+    routerQueue.push(start); signal.addEventListener('abort', leave, { once: true });
+    pumpRouter();
+  });
+  const routerDone = () => { routerBusy--; pumpRouter(); };
+  async function mapRelayPort(localPort, family, signal) {
+    if (signal.aborted) return null;
+    relayUsers.set(localPort, (relayUsers.get(localPort) ?? 0) + 1);
+    signal.addEventListener('abort', () => releaseRelay(localPort), { once: true });
+    await routerSlot(signal);
+    let m;
+    try { m = await mapper.map({ protocol: 'udp', internalPort: localPort, suggestedExternalPort: localPort, lifetimeSeconds: 7200, description: 'peerlane gateway' }); }
+    catch (error) { log('mapping-failed', { protocol: 'udp', internalPort: localPort, message: error.message }); return null; }
+    finally { routerDone(); }
+    // The mapper answers one (protocol, port) request for every caller: a newer allocation on this
+    // port may share the mapping, so one that ended meanwhile releases it only when nobody waits.
+    if (signal.aborted) { if (!relayUsers.has(localPort)) dropMapping(m); return null; }
+    if (!relayMapped.has(localPort)) { relayMapped.set(localPort, m); mappings.push(m); }
+    return m.externalPort;
+  }
+
+  let secret = randomBytes(32).toString('base64url');
+  // Allowed room (tag prefix) -> { revoked: label -> ms until every credential issued so far has expired,
+  // issued: newest issue second }. Revocation state is per room: a room can only exhaust its own table.
+  const rooms = new Map(), floors = new Map(); // floors: room -> { at, until }; credentials issued at or before `at` are void
+  const admit = room => rooms.set(room, { revoked: new Map(), issued: 0 });
+  for (const tag of options.rooms ?? []) admit(String(tag).slice(0, 8));
+  const sign = name => createHmac('sha1', secret).update(name).digest('base64');
+  const floorOf = room => floors.get(room)?.at ?? -Infinity;
+  // Issue time = expiry - ttl. A revoked room keeps its floor until all older credentials have expired, so
+  // re-allowing the tag never revives them; at the table's bound the secret rotates instead of forgetting one.
+  function retire(room, state) {
+    const now = Date.now(), at = Math.max(Math.floor(now / 1000), state.issued, floorOf(room));
+    if (!floors.has(room)) {
+      for (const [r, f] of floors) if (f.until <= now) floors.delete(r);
+      if (floors.size >= MAX_FLOORS) {
+        secret = randomBytes(32).toString('base64url'); floors.clear();
+        log('secret-rotated', { reason: 'revocation-capacity' });
+        return;
+      }
+    }
+    floors.set(room, { at, until: (at + ttlSeconds + 1) * 1000 });
+  }
+  const turn = await createTurnServer({
+    listen: [{ transport: 'udp', host, port }, { transport: 'tcp', host, port }],
+    relayHost: host,
+    relayPortRange: options.relayPortRange ?? [49160, 49359],
+    realm: 'peerlane',
+    authenticate: name => {
+      const [expiry, room, label, extra] = name.split(':'), state = rooms.get(room);
+      if (extra !== undefined || name.length > 128 || !label || !state) return null;
+      const seconds = Number(expiry), now = Date.now(), floor = floorOf(room);
+      // One extra second of horizon: credentials minted right after a revocation carry issue time floor + 1.
+      if (!Number.isSafeInteger(seconds) || seconds * 1000 <= now || seconds > Math.max(Math.floor(now / 1000), floor) + 1 + ttlSeconds) return null;
+      if (seconds - ttlSeconds <= floor || state.revoked.get(label) > now) return null;
+      return sign(name);
+    },
+    // No custom peer policy: loopback, link-local and private peers are refused and this machine's own
+    // addresses are relay<->relay only; the 'internal' scope refuses every other destination as well.
+    peerScope: relayScope,
+    externalAddress: external ?? undefined,
+    mapRelayPort: relayScope === 'public' && !publicHost && !manual && external && mapper ? mapRelayPort : undefined,
+    allocationScope: username => username.split(':')[1],
+    limits: { maxAllocationsPerUsername: 6, maxAllocationsPerScope: 32, scopeBitrate: 20_000_000, ...options.limits },
+    log
+  });
+  // Ports actually bound (port 0 = ephemeral, e.g. tests); directly reachable hosts advertise them.
+  const bound = { udp: turn.addresses().find(a => a.transport === 'udp')?.port, tcp: turn.addresses().find(a => a.transport === 'tcp')?.port };
+  if (publicHost || manual) { listenerPorts.udp = bound.udp; listenerPorts.tcp = bound.tcp; }
+  const bracket = a => a.includes(':') ? `[${a}]` : a;
+  const matches = (room, label) => name => { const [, r, l] = name.split(':'); return r === room && (label === undefined || l === label); };
+  function info() {
+    if (!external || !listenerPorts.udp && !listenerPorts.tcp) return null;
+    const urls = [];
+    if (listenerPorts.udp) urls.push(`turn:${bracket(external)}:${listenerPorts.udp}?transport=udp`);
+    if (listenerPorts.tcp) urls.push(`turn:${bracket(external)}:${listenerPorts.tcp}?transport=tcp`);
+    return { urls, internalUrls: [`turn:${bracket(host)}:${bound.udp}?transport=udp`, `turn:${bracket(host)}:${bound.tcp}?transport=tcp`],
+      ttlSeconds, external: [external], internal: host };
+  }
+  function revokeRoom(roomTag) {
+    const room = String(roomTag).slice(0, 8), state = rooms.get(room);
+    if (state) { retire(room, state); rooms.delete(room); }
+    return turn.revoke(matches(room));
+  }
+
+  return {
+    turn, mapper, info,
+    credentialsFor(roomTag, label) {
+      if (typeof roomTag !== 'string' || !TAG.test(roomTag) || typeof label !== 'string' || !LABEL.test(label)) return null;
+      const room = roomTag.slice(0, 8), state = rooms.get(room), now = Date.now();
+      if (!state || state.revoked.get(label) > now) return null;
+      const issued = Math.max(Math.floor(now / 1000), floorOf(room) + 1);
+      state.issued = Math.max(state.issued, issued);
+      const username = `${issued + ttlSeconds}:${room}:${label}`;
+      return { username, credential: sign(username) };
+    },
+    allowRoom(roomTag) {
+      if (typeof roomTag !== 'string' || !TAG.test(roomTag)) throw new TypeError('Invalid room tag');
+      const room = roomTag.slice(0, 8);
+      if (rooms.has(room)) return;
+      if (rooms.size >= 64) throw new Error('Gateway room capacity reached');
+      admit(room);
+    },
+    revokeRoom,
+    revokePeer(roomTag, peer) {
+      const room = String(roomTag).slice(0, 8), state = rooms.get(room), now = Date.now();
+      // Only an allowed room has valid credentials (a revoked one is covered by its floor), and only valid labels get any.
+      if (state && typeof peer === 'string' && LABEL.test(peer) && !(state.revoked.get(peer) > now)) {
+        if (!state.revoked.has(peer) && state.revoked.size >= ROOM_REVOCATIONS) {
+          for (const [label, until] of state.revoked) if (until <= now) state.revoked.delete(label);
+          // At this room's bound revoke the room itself rather than forget a denial: its floor voids every older credential.
+          if (state.revoked.size >= ROOM_REVOCATIONS) { log('room-revocations-full', { room }); return revokeRoom(roomTag); }
+        }
+        state.revoked.set(peer, (Math.max(Math.floor(now / 1000), state.issued) + ttlSeconds + 1) * 1000);
+      }
+      return turn.revoke(matches(room, peer));
+    },
+    rotate() { secret = randomBytes(32).toString('base64url'); floors.clear(); return info(); },
+    stats() {
+      let revocations = 0;
+      for (const state of rooms.values()) revocations += state.revoked.size;
+      return { external, relayScope, rooms: rooms.size, revocations, floors: floors.size,
+        mappings: mappings.map(m => ({ method: m.method, protocol: m.protocol, internalPort: m.internalPort, externalPort: m.externalPort })), turn: turn.stats() };
+    },
+    async close() {
+      try { await turn.close(); } finally { clearTimeout(routerTimer); if (mapper) await mapper.close(); }
+    }
+  };
+}

package/src/relay/member.mjs

@@ -0,0 +1,169 @@
+// SPDX-License-Identifier: Apache-2.0
+// Gateway member: the session's own host node (a participant's desktop app or a community server
+// that hosts the session) joins the room through the same gates, never sends media and offers
+// its gateway to the session's peers, each with its own short-lived, room-scoped TURN
+// credentials. The relay cost therefore stays inside the session that uses it.
+import { deriveRoom, seal, open, randomId } from '../client/crypto.mjs';
+import { GateClient } from '../client/gate-client.mjs';
+
+export const GATEWAY_ID_PREFIX = 'gw_';
+const PEER_ID = /^[A-Za-z0-9_-]{22}$/;
+
+/**
+ * joinAsGateway({ gates, secret, app, gateway, auth })
+ * `gateway` is the object returned by startGateway(). Returns { id, stats(), drop(peer), rekey(secret, {auth}), close() }.
+ */
+export async function joinAsGateway({ gates, secret, app = 'peerlane', gateway, auth, WebSocketImpl = globalThis.WebSocket, departGraceMs = 8000, log = () => {} }) {
+  if (!gateway?.info?.() || typeof gateway.credentialsFor !== 'function') throw new TypeError('A reachable gateway from startGateway() is required.');
+  // Host nodes join through WebSocket gates; tracker gates (bt+wss://) are used by clients only.
+  const socketGates = list => list.filter(url => !url.startsWith('bt+'));
+  let usable = socketGates(gates);
+  if (!usable.length) throw new TypeError('A host node needs at least one WebSocket gate (ws:// or wss://) in its ticket.');
+  if (typeof WebSocketImpl !== 'function') throw new TypeError('No WebSocket implementation: use Node.js 22 or newer, or pass WebSocketImpl.');
+  const id = GATEWAY_ID_PREFIX + randomId(16).slice(0, 19);
+  const stats = { peersServed: 0, envelopesSent: 0, envelopesReceived: 0, revoked: 0 };
+  let room, clients = [], n = 0, closed = false, currentAuth = auth;
+  const presence = new Map();    // peer -> Set(gate)
+  const lastContact = new Map();
+  const greeted = new Map();     // peer -> expiry of the credentials we sent
+  const sequences = new Map();   // peer -> highest envelope counter seen (replay guard)
+  const tags = new Set();        // every room tag this member served (kept until close)
+  const issued = new Set();      // peers that received credentials in this epoch: the only revocation targets
+  let rekeyTask = Promise.resolve();
+
+  const capsFor = peer => {
+    const info = gateway.info(), creds = gateway.credentialsFor(room.tag, peer);
+    if (!info || !creds) return null;
+    return { v: 1, role: 'gateway', forward: false, peers: [],
+      gateway: { urls: info.urls, username: creds.username, credential: creds.credential, external: info.external, internal: info.internal } };
+  };
+  async function greet(peer) {
+    if (closed || peer === id || !PEER_ID.test(peer) || peer.startsWith(GATEWAY_ID_PREFIX)) return;
+    const epoch = room;
+    const caps = capsFor(peer); if (!caps) return;
+    const box = await seal(epoch, id, peer, { kind: 'caps', caps, n: ++n });
+    if (closed || epoch !== room) return;
+    let sent = false;
+    for (const gate of presence.get(peer) ?? []) sent = gate.send(peer, box) || sent;
+    if (sent) {
+      if (!greeted.has(peer)) stats.peersServed++;
+      greeted.set(peer, Number(caps.gateway.username.split(':')[0])); stats.envelopesSent++;
+      issued.add(peer); if (issued.size > 1024) issued.delete(issued.values().next().value);
+    }
+  }
+  function openGates() {
+    clients = usable.map(url => {
+      // Auth is read at every (re)connect, so refreshed tokens apply without a rotation.
+      const gate = new GateClient(url, { room: room.tag, peer: id, auth: gateUrl => currentAuth && typeof currentAuth === 'object' ? currentAuth[gateUrl] : currentAuth, WebSocketImpl });
+      const seen = peer => {
+        if (!presence.has(peer) && presence.size >= 64) return false;
+        const set = presence.get(peer) ?? new Set(); set.add(gate); presence.set(peer, set); return true;
+      };
+      // Roster entries consume no state for strangers: clients must first prove membership. A
+      // peer that already authenticated in this epoch is restored after our own gate reconnects,
+      // and greeted again if the sweep forgot it, so credential renewal continues.
+      const restore = peer => {
+        if (closed || typeof peer !== 'string' || !sequences.has(peer) || !seen(peer)) return;
+        lastContact.set(peer, Date.now());
+        if (!greeted.has(peer)) greet(peer);
+      };
+      gate.on('joined', ({ peers } = {}) => { if (Array.isArray(peers)) for (const peer of peers.slice(0, 256)) restore(peer); });
+      gate.on('left', () => { for (const [peer, sources] of presence) { sources.delete(gate); if (!sources.size) lastContact.set(peer, Date.now()); } });
+      gate.on('peer', ({ peer, on }) => {
+        if (on) { restore(peer); return; }
+        presence.get(peer)?.delete(gate);
+        if (presence.has(peer) && !presence.get(peer).size) lastContact.set(peer, Date.now());
+      });
+      gate.on('recv', async ({ from, box }) => {
+        if (closed || !PEER_ID.test(from) || from.startsWith(GATEWAY_ID_PREFIX)) return;
+        const epoch = room;
+        const p = await open(epoch, from, id, box);
+        if (closed || epoch !== room || !p || !Number.isSafeInteger(p.n) || p.n < 1 || p.n <= (sequences.get(from) ?? 0)) return;
+        if (!seen(from)) return;
+        lastContact.set(from, Date.now());
+        sequences.delete(from); sequences.set(from, p.n);
+        // Keep recent departure replay guards without consuming active membership slots.
+        if (sequences.size > 256) { const stale = [...sequences.keys()].find(peer => !presence.has(peer)); if (stale) sequences.delete(stale); }
+        stats.envelopesReceived++;
+        if (p.kind === 'bye') { drop(from); return; }
+        // Credentials only for peers that proved room membership with a sealed envelope.
+        if (p.kind === 'caps' && !greeted.has(from)) greet(from);
+      });
+      gate.connect();
+      return gate;
+    });
+  }
+  // Only peers we issued credentials to are revoked: a member cannot fill the gateway's
+  // revocation table with made-up ids (a departure of an unknown id has nothing to revoke).
+  function drop(peer) {
+    if (issued.delete(peer)) for (const tag of tags) stats.revoked += gateway.revokePeer(tag, peer) ?? 0;
+    greeted.delete(peer); presence.delete(peer); lastContact.delete(peer);
+  }
+  async function enter(newSecret) {
+    const next = await deriveRoom(newSecret, app);
+    if (closed) return;
+    room = next;
+    tags.add(room.tag); gateway.allowRoom(room.tag);
+    openGates();
+  }
+  await enter(secret);
+  const sweep = () => {
+    for (const [peer, sources] of presence) if (!sources.size && Date.now() - (lastContact.get(peer) ?? 0) >= departGraceMs) {
+      // A mailbox outage is not authenticated revocation: existing TURN media must survive.
+      presence.delete(peer); greeted.delete(peer); lastContact.delete(peer);
+    }
+  };
+  const sweeper = setInterval(sweep, Math.max(10, Math.min(departGraceMs, 1000))); sweeper.unref?.();
+  // Renew credentials well before they expire.
+  const ttl = gateway.info()?.ttlSeconds ?? 7200;
+  const renew = setInterval(() => {
+    const soon = Math.floor(Date.now() / 1000) + ttl / 2;
+    for (const [peer, expiry] of greeted) if (expiry < soon) greet(peer);
+  }, Math.min(ttl * 250, 60000));
+  renew.unref?.();
+  return {
+    id,
+    stats: () => ({ ...stats, peers: presence.size }),
+    drop,
+    // Every old-epoch allocation is revoked, including aliases the backend never learned. The new
+    // room is admitted first: if the gateway refuses it, the old room keeps working and a retry of
+    // the same rotation runs again (state only advances after success).
+    rekey(newSecret, { auth: nextAuth, dropped = [], gates: nextGates } = {}) {
+      const task = rekeyTask.then(async () => {
+        if (closed) return;
+        const next = await deriveRoom(newSecret, app);
+        if (closed || next.tag === room.tag) return;
+        const nextUsable = nextGates === undefined ? usable : Array.isArray(nextGates) ? socketGates(nextGates) : [];
+        if (!nextUsable.length) throw new TypeError('A host node needs at least one WebSocket gate (ws:// or wss://) in its ticket.');
+        try { gateway.allowRoom(next.tag); }
+        catch (error) {
+          // At room capacity the old epoch's slots are what the new room needs: retire them first.
+          // Any other refusal leaves the old room untouched, so the rotation can simply be retried.
+          if (!/capacity/i.test(String(error?.message))) throw error;
+          for (const tag of tags) gateway.revokeRoom(tag);
+          gateway.allowRoom(next.tag);
+        }
+        for (const peer of dropped) drop(peer);
+        currentAuth = nextAuth; usable = nextUsable;
+        for (const gate of clients) gate.close();
+        for (const tag of tags) if (tag !== next.tag) gateway.revokeRoom(tag);
+        tags.clear(); presence.clear(); lastContact.clear(); greeted.clear(); sequences.clear(); issued.clear();
+        room = next; tags.add(room.tag);
+        openGates();
+      });
+      rekeyTask = task.catch(() => {});
+      return task;
+    },
+    /** Use refreshed gate tokens for the same epoch at the next (re)connect. */
+    setAuth(nextAuth) { if (!closed) currentAuth = nextAuth; },
+    async close() {
+      closed = true; clearInterval(renew); clearInterval(sweeper);
+      for (const peer of greeted.keys()) {
+        const box = await seal(room, id, peer, { kind: 'bye', n: ++n });
+        for (const gate of presence.get(peer) ?? []) gate.send(peer, box);
+      }
+      for (const gate of clients) gate.close();
+      for (const tag of tags) gateway.revokeRoom(tag);
+    }
+  };
+}