p2party 0.14.2 → 0.14.7

package/lib/api/webrtc/index.d.ts

@@ -1,9 +1,10 @@
-import type { RTCPeerConnectionParams, RTCSendMessageParams, RTCSetDescriptionParams, RTCSetCandidateParams, RTCOpenChannelParams, RTCDisconnectFromRoomParams, RTCDisconnectFromAllRoomsParams, RTCDisconnectFromPeerParams, RTCDisconnectFromChannelLabelParams, RTCDisconnectFromPeerChannelLabelParams, RTCDisconnectParams } from "./interfaces";
+import type { RTCPeerConnectionParams, RTCSendMessageParams, RTCSetDescriptionParams, RTCSetCandidateParams, RTCOpenChannelParams, RTCDisconnectFromRoomParams, RTCDisconnectFromAllRoomsParams, RTCDisconnectFromPeerParams, RTCDisconnectFromChannelLabelParams, RTCDisconnectFromPeerChannelLabelParams, RTCDisconnectParams, RTCApplyRoomConfigurationParams } from "./interfaces";
 import type { SendMessageResult } from "../../handlers/handleSendMessage";
 declare const webrtcApi: import("@reduxjs/toolkit/query").Api<import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, {
     connectWithPeer: import("@reduxjs/toolkit/query").MutationDefinition<RTCPeerConnectionParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;
     setDescription: import("@reduxjs/toolkit/query").MutationDefinition<RTCSetDescriptionParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;
     setCandidate: import("@reduxjs/toolkit/query").MutationDefinition<RTCSetCandidateParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;
+    applyRoomConfiguration: import("@reduxjs/toolkit/query").MutationDefinition<RTCApplyRoomConfigurationParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;
     openChannel: import("@reduxjs/toolkit/query").MutationDefinition<RTCOpenChannelParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;
     sendMessage: import("@reduxjs/toolkit/query").MutationDefinition<RTCSendMessageParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, SendMessageResult | undefined, "webrtcApi", undefined>;
     disconnect: import("@reduxjs/toolkit/query").MutationDefinition<RTCDisconnectParams, import("@reduxjs/toolkit/query").BaseQueryFn<import("./baseQuery").RTCPeerConnectionParamsExtend, undefined>, never, undefined, "webrtcApi", undefined>;

package/lib/api/webrtc/interfaces.d.ts

@@ -16,8 +16,35 @@ export interface IRTCPeerConnection extends RTCPeerConnection {
     mainChannel?: IRTCDataChannel;
     /** Gate ownership captured when this concrete transport is created. */
     ratchetGateLease: RatchetGateLease;
+    /**
+     * How many times this RTCPeerConnection has been re-bound IN PLACE onto a
+     * new remote DTLS certificate since it last authenticated. The re-bind
+     * budget (see decideRemoteTransportChangeResponse) reads it to guarantee
+     * that a peer which keeps presenting fresh certificates converges on a
+     * replacement transport instead of looping; the handshake success path
+     * clears it.
+     */
+    remoteTransportRebinds: number;
+    /**
+     * Deadline armed by the in-place re-bind above: if this transport has not
+     * re-authenticated when it fires, the edge is torn down and rebuilt instead
+     * of waiting out the peer's 30 s handshake step timeout. Cleared by the
+     * handshake success path, by the teardown, and re-armed by a later re-bind.
+     */
+    rebindDeadline?: ReturnType<typeof setTimeout>;
+    /**
+     * The `clearTimeout` that matches whatever scheduled `rebindDeadline`. The
+     * arming site owns the scheduler (tests inject one), while the clearing
+     * sites — handshake success, peer teardown — only hold the connection.
+     */
+    rebindDeadlineClear?: (handle: ReturnType<typeof setTimeout>) => void;
     /** Resolves once the per-transport WASM dependency is ready. */
     initialization?: Promise<void>;
+    /**
+     * Re-proves signaling and applies the latest room ICE configuration before
+     * any restart. Installed by the connection owner and shared by repair paths.
+     */
+    ensureFreshIceConfiguration?: () => Promise<boolean | void>;
     ratchetState?: RatchetState;
     ratchetEstablished?: Promise<void>;
     messageKeyCache?: Map<string, Uint8Array>;
@@ -92,6 +119,14 @@ export interface RTCSetCandidateParams {
     roomId: string;
     candidate: RTCIceCandidateInit | RTCIceCandidate;
 }
+export interface RTCApplyRoomConfigurationParams {
+    roomId: string;
+    rtcConfig: RTCConfiguration;
+    /** Gather a new ICE generation after every live PC accepts the config. */
+    restartIce?: boolean;
+    /** Expiry must close on failure; rollback would restore expired secrets. */
+    failurePolicy?: "rollback" | "close";
+}
 export interface RTCOpenChannelParams {
     roomId: string;
     channel: string | RTCDataChannel;
@@ -148,6 +183,8 @@ export interface RTCDisconnectFromPeerParams {
     roomId?: string;
     alsoDeleteData?: boolean;
 }
+/** Internal dependency injected into bulk teardown queries to avoid API cycles. */
+export type DisconnectPeerTransport = (params: RTCDisconnectFromPeerParams) => Promise<void>;
 export interface RTCDisconnectFromChannelLabelParams {
     roomId: string;
     label: string;

package/lib/api/webrtc/negotiationLock.d.ts

@@ -6,7 +6,31 @@ export declare const getRoomPeerMutex: (roomId: string, peerId: string) => Async
  * enter the same critical section concurrently.
  */
 export declare const releaseRoomPeerMutex: (roomId: string, peerId: string) => void;
+/**
+ * Serialize one negotiation operation and release its registry key once every
+ * queued owner drains. This must wrap nonterminal frames too: otherwise valid
+ * unknown-peer SDP/ICE identifiers can grow the mutex registry forever.
+ */
+export declare const runRoomPeerExclusive: <T>(roomId: string, peerId: string, operation: () => Promise<T>) => Promise<T>;
 /** Narrow test visibility without exposing the mutable registry. */
 export declare const hasRoomPeerMutex: (roomId: string, peerId: string) => boolean;
+/** Narrow test visibility without exposing the mutable registry. */
+export declare const roomPeerMutexCount: () => number;
 export declare const getRoomIdentityMutex: (roomId: string, peerPublicKey: string) => AsyncMutex;
 export declare const releaseRoomIdentityMutex: (roomId: string, peerPublicKey: string) => void;
+/**
+ * Serializes caller configuration mutation and a room-response live sweep +
+ * Redux publication with the final configuration read, construction, and
+ * registry insertion of a new PC. The key is the stable room URL, including
+ * while the room is still awaiting its server-assigned id.
+ */
+export declare const getRoomIceConfigurationMutex: (roomUrl: string) => AsyncMutex;
+export declare const releaseRoomIceConfigurationMutex: (roomUrl: string) => void;
+/** Narrow test visibility without exposing the mutable registry. */
+export declare const hasRoomIceConfigurationMutex: (roomUrl: string) => boolean;
+/**
+ * Server-assigned room ids are globally unique, so validation, live apply, and
+ * publication of assignments must be one global transaction. Room responses
+ * are rare; serializing them is simpler and safer than multi-key lock ordering.
+ */
+export declare const runRoomResponseCommitExclusive: <T>(operation: () => Promise<T>) => Promise<T>;

package/lib/api/webrtc/pendingOffer.d.ts

@@ -0,0 +1,29 @@
+import type { IRTCPeerConnection } from "./interfaces";
+/**
+ * How long a fresh transport may hold its first offer without any remote
+ * description before the transport is given up on and the room re-dialed.
+ *
+ * Must outlive the signaling server's dark-socket drop (one missed 10 s ping
+ * plus its 5 s pong window): an offer sent to a peer that was still on the
+ * roster but whose socket had already gone dark is lost when the server
+ * closes that socket, and by the time this fires the roster no longer lists
+ * the peer, so the re-dial builds nothing for it until it is really back.
+ */
+export declare const PENDING_OFFER_TIMEOUT_MS = 15000;
+/**
+ * True iff this transport holds a local offer that no remote description has
+ * ever answered, i.e. its FIRST offer is still pending.
+ *
+ * An ICE-restart offer on a negotiated transport is excluded: there the
+ * remote description of the previous round is still applied, and the ICE
+ * repair paths own that timeout. Only the identity initiator ever offers on
+ * a fresh transport (the responder creates no channel there), so a pending
+ * first offer belongs to exactly one side of an edge.
+ *
+ * Such a transport never fails on its own: without a remote description no
+ * ICE checks run, so connectionState stays "new" and nothing tears it down.
+ * A peer that later re-dials with a `connection` frame (its old transport
+ * died while its socket was dark, so it never saw the offer) finds this PC
+ * reused by ensureConnection, which would leave the edge half-built forever.
+ */
+export declare const hasUnansweredFirstOffer: (epc: Pick<IRTCPeerConnection, "signalingState" | "remoteDescription">) => boolean;

package/lib/api/webrtc/rebindDeadline.d.ts

@@ -0,0 +1,61 @@
+import type { BaseQueryApi } from "@reduxjs/toolkit/query";
+import type { DisconnectPeerTransport, IRTCPeerConnection } from "./interfaces";
+/**
+ * The timer primitives the deadline uses. Injected so a test drives the
+ * deadline by hand instead of waiting out real seconds; production passes
+ * nothing and gets the platform's own.
+ */
+export interface RebindDeadlineScheduler {
+    readonly setTimeout: (callback: () => void, delayMs: number) => ReturnType<typeof setTimeout>;
+    readonly clearTimeout: (handle: ReturnType<typeof setTimeout>) => void;
+}
+/**
+ * Release a pending re-bind deadline. Idempotent, and safe on a connection
+ * that never armed one.
+ */
+export declare const clearRebindAuthenticationDeadline: (epc: Pick<IRTCPeerConnection, "rebindDeadline" | "rebindDeadlineClear">) => void;
+export interface ArmRebindAuthenticationDeadlineParams {
+    epc: IRTCPeerConnection;
+    roomId: string;
+    peerId: string;
+    api: Pick<BaseQueryApi, "dispatch" | "getState">;
+    /** Tears this room/peer transport down through the transport-failure path. */
+    disconnectPeer: DisconnectPeerTransport;
+    deadlineMs?: number;
+    schedule?: RebindDeadlineScheduler;
+}
+/**
+ * Give one in-place re-bind a wall-clock deadline to re-authenticate in.
+ *
+ * A re-bind keeps the RTCPeerConnection — and with it the SCTP association
+ * that was negotiated against the RETIRED remote certificate. Chromium will
+ * happily open our own new outbound streams on it while never delivering the
+ * peer's: on the process-freeze harness the woken responder re-binds its
+ * surviving PC, its own message channel reaches the peer two seconds later,
+ * and the peer's `main` — opened on its brand-new PC before the re-bind even
+ * happened — never arrives at all. The re-bind is then a silent black hole:
+ * ICE stays connected so no failure path replaces the transport, and the edge
+ * only heals when the PEER's handshake step timeout (30 s) tears its own side
+ * down and the normal re-dial rebuilds everything, ~37 s after the wake.
+ *
+ * So the re-bind gets a budget. When it expires with nothing authenticated,
+ * this side does what the peer's timeout would eventually have done, sooner:
+ * tear the edge down through the transport-failure path (which mints a fresh
+ * local certificate on the rebuilt transport) and ask the room to re-introduce
+ * the pair.
+ *
+ * Three guards make a late timer harmless, because the same connection object
+ * outlives the re-bind that armed the deadline:
+ *
+ * - the connection still carries the gate lease this re-bind installed (a
+ *   LATER re-bind of the same transport installed its own and re-armed);
+ * - that lease is still the edge's current one (a replacement transport, from
+ *   a re-dial or a "replace" decision, claims a fresh lease — this deadline
+ *   then belongs to a transport nobody uses any more);
+ * - the edge has not authenticated in the meantime (a live ratchet, or the
+ *   gate open under this very lease).
+ *
+ * The teardown itself is not a guard: `webrtcDisconnectPeerQuery` clears the
+ * deadline, so a torn-down connection never fires it at all.
+ */
+export declare const armRebindAuthenticationDeadline: ({ epc, roomId, peerId, api, disconnectPeer, deadlineMs, schedule, }: ArmRebindAuthenticationDeadlineParams) => void;

package/lib/api/webrtc/remoteTransportChange.d.ts

@@ -0,0 +1,142 @@
+import type { BaseQueryApi } from "@reduxjs/toolkit/query";
+import type { RebindDeadlineScheduler } from "./rebindDeadline";
+import type { DisconnectPeerTransport, IRTCDataChannel, IRTCPeerConnection } from "./interfaces";
+/**
+ * True iff both SDPs declare a sha-256 DTLS fingerprint and the two differ.
+ *
+ * A remote description whose fingerprint differs from the one already applied
+ * on this RTCPeerConnection means the peer built a NEW RTCPeerConnection (a
+ * fresh DTLS certificate is minted per PC) while this side kept its old one.
+ * The browser accepts the change and re-runs DTLS on the same PC, but every
+ * piece of edge authentication this side holds — handshake transcript (which
+ * binds both fingerprints), ratchet, PQ runtime, message keys — was proven
+ * against the OLD certificate and must not survive onto the new transport.
+ *
+ * Missing or malformed fingerprints on either side are not a change: there is
+ * nothing to compare, and the handshake itself rejects such SDPs later.
+ */
+export declare const detectRemoteTransportChange: (previousSdp: string | undefined, nextSdp: string) => boolean;
+/**
+ * True iff this room/peer edge has been authenticated on THIS
+ * RTCPeerConnection: a live ratchet, a ratchet gate opened under this
+ * transport's own lease, or an open `main` (a handshake in flight over a live
+ * SCTP association). A transport that only ever negotiated (main still
+ * connecting, gate pending) has proven nothing yet.
+ */
+export declare const isEdgeAuthenticatedOnTransport: (epc: Pick<IRTCPeerConnection, "ratchetState" | "ratchetGateLease" | "mainChannel">, roomId: string, peerId: string) => boolean;
+export type RemoteTransportChangeResponse = "reset-in-place" | "replace";
+export interface RemoteTransportChangeDecisionParams {
+    epc: Pick<IRTCPeerConnection, "ratchetState" | "ratchetGateLease" | "mainChannel" | "remoteTransportRebinds">;
+    roomId: string;
+    peerId: string;
+    descriptionType: RTCSdpType;
+    /** Whether this side is the identity initiator (the side that opens main). */
+    isInitiator: boolean;
+}
+/**
+ * What to do with an existing RTCPeerConnection whose remote DTLS fingerprint
+ * is about to change.
+ *
+ * A never-authenticated transport is simply re-bound in place: nothing proven
+ * against the old certificate exists, and the browser renegotiates DTLS on
+ * the same PC (the T1 path, `resetEdgeAuthenticationForNewRemoteTransport`).
+ *
+ * An AUTHENTICATED transport whose peer shows up with a new certificate is
+ * the stale side of the edge: its SCTP association is dead on the far side
+ * while it is still writable locally. Whether it can be re-bound in place
+ * depends on who has to open the next `main` on it:
+ *
+ * - The peer's fresh transport OFFERS: it carries the peer's channels, so a
+ *   fresh PC of our own answers it cleanly whatever our role. Replace.
+ * - We are the identity initiator and receive an ANSWER: re-binding in place
+ *   would make us create the replacement `main` on the OLD, still-writable
+ *   SCTP association, whose onopen fires before DTLS re-runs against the new
+ *   certificate; the handshake then reads the old remote certificate from
+ *   getStats and fails as a fingerprint mismatch. Replace the PC and re-dial.
+ * - We are the responder and receive an ANSWER: we open no channel on the
+ *   reset PC. The peer's fresh transport (the initiator) already holds the
+ *   next `main`, which opens only once the browser has re-run DTLS and SCTP
+ *   against the new certificate, so the in-place re-bind completes with a
+ *   clean handshake. Replacing here would instead leave the peer's fresh PC
+ *   bound to our closed one with nothing to re-offer to our channel-less
+ *   replacement (a never-connected transport does not re-dial on failure).
+ *
+ * All of that is bounded by one invariant: AT MOST ONE in-place re-bind per
+ * unauthenticated transport. An in-place re-bind changes only the REMOTE
+ * certificate — ours is minted with the RTCPeerConnection and lives as long as
+ * it does. A PC whose ICE stays connected never fails, so neither the
+ * ICE-failure re-dial nor the grace-timer teardown ever replaces it, and it
+ * keeps answering with a certificate the peer may already have retired (T9)
+ * while the peer keeps offering from ever newer ones: a livelock in which both
+ * sides negotiate forever and no `main` ever opens. Requiring the first
+ * re-bind to have actually authenticated before granting a second one caps the
+ * loop at one round — the second fingerprint change replaces the transport,
+ * which mints a new local certificate the peer has never retired, and the edge
+ * converges.
+ */
+export declare const decideRemoteTransportChangeResponse: ({ epc, roomId, peerId, descriptionType, isInitiator, }: RemoteTransportChangeDecisionParams) => RemoteTransportChangeResponse;
+export interface ResetEdgeAuthenticationParams {
+    epc: IRTCPeerConnection;
+    roomId: string;
+    peerId: string;
+    api: Pick<BaseQueryApi, "dispatch" | "getState">;
+    /**
+     * The shared open-channel registry. Passed in explicitly (the caller already
+     * holds it) so this helper stays store-free and unit-testable: it owns the
+     * retirement of the generation's channels, which live in BOTH this array and
+     * `epc.messageChannels`.
+     */
+    dataChannels: IRTCDataChannel[];
+    /**
+     * Tears this room/peer transport down through the transport-failure path.
+     * Injected exactly as setDescriptionQuery's own teardown is, so the deadline
+     * armed below needs no import of the API that registers it.
+     */
+    disconnectPeer: DisconnectPeerTransport;
+    /** Test seams for the re-bind deadline; production takes the defaults. */
+    deadlineMs?: number;
+    schedule?: RebindDeadlineScheduler;
+    reason: Error;
+}
+/**
+ * Drop everything that authenticated this room/peer edge against the previous
+ * remote DTLS certificate, WITHOUT tearing the RTCPeerConnection down.
+ *
+ * This is the "reset-in-place" response of decideRemoteTransportChangeResponse:
+ * a transport that never authenticated, or the responder's transport when the
+ * initiator answers from a fresh one. The PC itself survives: the browser
+ * renegotiates DTLS on it against the new remote certificate, and the next
+ * `main` (created by the identity initiator on a never-authenticated PC, or
+ * arriving from the initiator's fresh transport on the responder's) opens
+ * only over the re-run DTLS/SCTP, so the new handshake binds the new
+ * fingerprint pair. The old `main` is closed here; its onclose handler
+ * observes a stale gate lease (replaced below) and returns early, so closing
+ * it never cascades into a disconnectFromPeer of the edge we are keeping.
+ *
+ * EVERY other channel of the retired generation goes with it. A per-message
+ * channel belongs to the ratchet generation that opened it: it captured that
+ * generation's gate lease, so once the lease is replaced here its next inbound
+ * frame can only be rejected as application data before peer authentication —
+ * and that rejection closes the channel, which on a live transfer cascades
+ * into closing `main` and tearing down the very edge this re-bind exists to
+ * keep. (Observed on the process-freeze harness: an 8 MiB transfer in flight
+ * across the freeze left its data channel OPEN on the surviving PC, and the
+ * first frame after the re-bind killed the edge.) A send in flight over such a
+ * channel loses nothing: the gate lease replaced here is exactly what tells
+ * handleSendMessage that the close was OURS, so the transfer resumes on the
+ * re-authenticated generation (re-opening its channel, re-stepping the ratchet)
+ * instead of being read as a cancel by the peer. Cover lanes are NOT swept
+ * here — `teardownCoverEdge` above closes each one, and the close listener
+ * `registerCoverChannelUntilClose` installed unregisters it from both
+ * `epc.coverChannels` and the shared array.
+ *
+ * Detaching those handlers also skips the receive-side bookkeeping a normal
+ * close would have run — `forgetCompletedReceiveMessageKey`. That is
+ * deliberate: retiring a key durably is asynchronous I/O and this reset is a
+ * synchronous step on the description path. Every key is wiped from RAM below
+ * (message-key cache filled with zeros, ratchet wiped, PQ runtime destroyed),
+ * and the durable edge checkpoint is keyed by (roomId, peerPublicKey) and
+ * rewritten whole by the next handshake's persist, so a completed transfer's
+ * key survives only until this edge re-authenticates.
+ */
+export declare const resetEdgeAuthenticationForNewRemoteTransport: ({ epc, roomId, peerId, api, dataChannels, disconnectPeer, deadlineMs, schedule, reason, }: ResetEdgeAuthenticationParams) => void;

package/lib/api/webrtc/retiredRemoteTransports.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Remote DTLS certificates this side has stopped believing in, per
+ * (roomId, peerId) edge.
+ *
+ * A description is only ever meaningful for the transport pair it belongs to,
+ * but nothing on the wire correlates an answer with the offer it answers (the
+ * SDK cannot add signaling fields without a server change). So a description
+ * that a peer produced on a transport we already retired can land on a
+ * transport of ours that has no remote description yet — where the
+ * fingerprint-change detection of `remoteTransportChange` returns false BY
+ * CONSTRUCTION, because there is nothing to compare against — and bind our
+ * fresh RTCPeerConnection to a certificate that is already dead.
+ *
+ * That is exactly how a frozen phone whose signaling socket stayed open
+ * deadlocks an edge: the peer's queued ICE-restart offer is answered from its
+ * old, still-authenticated transport after the thaw; the answer arrives at
+ * our brand-new PC, is accepted, and the correct answer that follows it is
+ * then dropped as "stale" because the PC is already `stable`. Neither side's
+ * transport ever connects, so no failure path re-dials either.
+ *
+ * Remembering the fingerprint of every transport we retire closes that hole:
+ * an ANSWER carrying one is discarded before it is applied (setDescriptionQuery
+ * explains why an offer is instead accepted, and un-retires the transport it
+ * binds through `forgetRetiredRemoteTransport`).
+ *
+ * The set is bounded twice, because it is keyed by a peer-supplied identifier
+ * and must never grow without limit nor lock a peer out forever:
+ *
+ * - at most MAX_RETIRED_REMOTE_TRANSPORTS_PER_EDGE fingerprints per edge, the
+ *   oldest evicted first;
+ * - each entry expires RETIRED_REMOTE_TRANSPORT_TTL_MS after it was retired.
+ *
+ * Chromium mints a fresh certificate for every RTCPeerConnection and this
+ * codebase never passes `RTCConfiguration.certificates` for its own
+ * connections (roomSlice only CLONES a caller-supplied configuration), so a
+ * rebuilt peer transport always presents a fingerprint we have never retired.
+ * If a caller DOES pin a certificate, its peer's replacement transport
+ * presents the very fingerprint we retired and its descriptions are discarded
+ * until the TTL expires; the edge then heals on the next re-dial, one TTL
+ * later, instead of immediately.
+ */
+export declare const MAX_RETIRED_REMOTE_TRANSPORTS_PER_EDGE = 4;
+export declare const RETIRED_REMOTE_TRANSPORT_TTL_MS = 120000;
+/**
+ * Remember that this side has stopped believing in the remote transport that
+ * presented `transport` (an SDP blob or its raw sha-256 fingerprint) on the
+ * (roomId, peerId) edge. Returns whether a fingerprint was actually recorded.
+ */
+export declare const retireRemoteTransport: (roomId: string, peerId: string, transport: string | Uint8Array | null | undefined, now?: number) => boolean;
+/**
+ * True iff `sdp` declares the certificate of a remote transport already
+ * retired for this edge, i.e. the description must not be applied.
+ */
+export declare const isRetiredRemoteTransport: (roomId: string, peerId: string, sdp: string | null | undefined, now?: number) => boolean;
+/**
+ * Un-retire one transport of an edge: this side is bound to it again.
+ *
+ * A retired fingerprint means "we are not bound to this remote certificate",
+ * so the moment a description from it IS applied — the peer offered on the
+ * transport we had given up on, proving it negotiates there — the retirement
+ * is void. Without this, the answer to our own next ICE restart on that very
+ * binding would be discarded as retired.
+ */
+export declare const forgetRetiredRemoteTransport: (roomId: string, peerId: string, transport: string | Uint8Array | null | undefined) => void;
+/**
+ * Forget every retired transport of one edge. Called when the edge itself is
+ * terminal — its room was left or purged — so a room the user rejoins later
+ * starts with a clean slate.
+ */
+export declare const forgetRetiredRemoteTransports: (roomId: string, peerId: string) => void;

package/lib/api/webrtc/roomEdgeBudget.d.ts

@@ -0,0 +1,10 @@
+import type { Peer } from "../../reducers/roomSlice";
+import type { IRTCPeerConnection } from "./interfaces";
+/**
+ * Enforce one cumulative edge budget across Redux roster state and concrete
+ * transports, including PCs inserted while their WASM initialization awaits.
+ *
+ * Callers run this under the stable room-configuration mutex immediately
+ * before registry insertion, making concurrent identities observe each other.
+ */
+export declare const assertRoomEdgeBudget: (roomId: string, peers: readonly Peer[], peerConnections: readonly IRTCPeerConnection[], candidatePublicKey: string) => void;

package/lib/api/webrtc/setDescriptionQuery.d.ts

@@ -1,9 +1,16 @@
 import type { BaseQueryFn } from "@reduxjs/toolkit/query";
-import type { RTCSetDescriptionParams, IRTCPeerConnection, IRTCIceCandidate, IRTCDataChannel } from "./interfaces";
+import type { RTCSetDescriptionParams, IRTCPeerConnection, IRTCIceCandidate, IRTCDataChannel, DisconnectPeerTransport } from "./interfaces";
 export interface RTCSetDescriptionParamsExtension extends RTCSetDescriptionParams {
     peerConnections: IRTCPeerConnection[];
     iceCandidates: IRTCIceCandidate[];
     dataChannels: IRTCDataChannel[];
+    /**
+     * Tears one room/peer transport down through the same path as a transport
+     * failure (disconnectFromPeer). Injected, like the bulk teardown queries
+     * do, so this module needs no import of the API that registers it and a
+     * test can bind the real query to its own transport registry.
+     */
+    disconnectPeer: DisconnectPeerTransport;
 }
 declare const webrtcSetDescriptionQuery: BaseQueryFn<RTCSetDescriptionParamsExtension, undefined>;
 export default webrtcSetDescriptionQuery;

package/lib/api/webrtc/settleOnClose.d.ts

@@ -0,0 +1,36 @@
+/** The slice of an RTCPeerConnection that proves the transport is gone. */
+export type PcOperationTarget = Pick<RTCPeerConnection, "signalingState" | "connectionState">;
+export interface AwaitPcOperationOptions {
+    /** How often the transport is inspected while the operation is in flight. */
+    readonly pollMs?: number;
+    /** Wall-clock budget after which the operation is abandoned. */
+    readonly maxMs?: number;
+    /** Named in the timeout warning so a stuck operation is identifiable. */
+    readonly name?: string;
+}
+export declare const isPcOperationTargetClosed: (epc: PcOperationTarget) => boolean;
+/**
+ * Await one RTCPeerConnection operation without ever waiting forever on it.
+ *
+ * Closing an RTCPeerConnection aborts every operation in flight on it, and the
+ * specification aborts them *without settling* their promises — while close()
+ * itself fires no `connectionstatechange`. An `await pc.addIceCandidate(...)`
+ * or `await pc.setRemoteDescription(...)` on a connection that closes
+ * underneath it therefore never returns. In this codebase those awaits run
+ * inside the (room, peer) negotiation mutex, which is entered from the socket's
+ * strictly serial ingress queue: one such await strands the edge's mutex
+ * forever AND stops every later signaling frame on that socket, so a peer's
+ * re-introductions go unanswered indefinitely.
+ *
+ * The returned promise settles three ways:
+ * - the operation's own result (or rejection, rethrown for the caller's
+ *   existing error handling),
+ * - `"closed"` as soon as a poll observes the transport closed — the operation
+ *   is abandoned, since nothing it could still do matters,
+ * - `"timeout"` once the budget expires, which callers treat exactly like a
+ *   failure of that operation.
+ *
+ * An abandoned operation's later rejection is consumed here, so walking away
+ * from it can never surface as an unhandled rejection.
+ */
+export declare const awaitPcOperation: <T>(epc: PcOperationTarget, operation: Promise<T>, { pollMs, maxMs, name, }?: AwaitPcOperationOptions) => Promise<T | "closed" | "timeout">;

package/lib/blindRendezvous/admissionInput.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Closed error for malformed or fabricated inputs at the trusted admission
+ * kernel boundary. Policy denials are ordinary result values and never use
+ * this error.
+ */
+export declare class AdmissionInputError extends Error {
+    readonly name = "AdmissionInputError";
+    readonly code: "invalid-admission-kernel-input";
+    constructor(message: string);
+}
+export declare const invalidAdmissionInput: (message: string) => never;