p2party 0.8.0 → 0.14.2

package/lib/handlers/coverEdge.d.ts

@@ -0,0 +1,42 @@
+import type { CoverStatusChange } from "./coverScheduler";
+import type { IRTCPeerConnection } from "../api/webrtc/interfaces";
+import type { RoomPolicyV1 } from "../roomPolicy";
+import type { LibCrypto } from "../cryptography/libcrypto";
+export interface InstallCoverEdgeOptions {
+    readonly epc: IRTCPeerConnection;
+    readonly roomId: string;
+    readonly policy: RoomPolicyV1;
+    readonly policyHash: Uint8Array;
+    readonly amInitiator: boolean;
+    readonly module: LibCrypto;
+    readonly onRemoteCancel?: (merkleRootHex: string) => void;
+    readonly onStatusChange?: (change: CoverStatusChange) => void;
+}
+/**
+ * Stop scheduled cover on an edge and release its lanes.
+ *
+ * destroy() emits the terminal "stopped" status, so any observer of
+ * rooms[].coverStatusByPeer stops claiming cover for this edge. Safe to call
+ * on an edge that never had a runtime.
+ */
+export declare const teardownCoverEdge: (epc: IRTCPeerConnection) => void;
+/**
+ * Construct and START the scheduled-cover runtime for one authenticated edge.
+ * Called after `runHandshake` on a `coverMode: "scheduled"` room. Idempotent
+ * per connection: a replacement handshake destroys the previous runtime first.
+ */
+export declare const installCoverEdge: (options: InstallCoverEdgeOptions) => void;
+/** Record the root→transferId mapping so a terminal receipt settles the send. */
+export declare const trackScheduledSend: (epc: IRTCPeerConnection, roomId: string, peerId: string, merkleRootHex: string, transferId: string) => void;
+export interface ScheduledSendParams {
+    readonly epc: IRTCPeerConnection;
+    readonly channelMessageLabel: string;
+    readonly totalChunks: number;
+    readonly sealSlotCell: (chunkIndex: number) => Promise<Uint8Array | null>;
+    readonly getAckedChunks?: () => ReadonlySet<number>;
+}
+/**
+ * Enqueue one message as a lazy scheduled-send job on this edge's cover
+ * runtime. Returns false when the edge has no cover runtime (immediate mode).
+ */
+export declare const enqueueScheduledSend: (params: ScheduledSendParams) => boolean;

package/lib/handlers/coverRuntime.d.ts

@@ -0,0 +1,91 @@
+import { type CoverClock, type CoverJob, type CoverJobInterruption, type CoverJobResult, type CoverSchedule, type CoverScheduler, type CoverSchedulerStatus, type CoverStatusChange } from "./coverScheduler";
+import { type CoverCellContent } from "../cryptography/coverCell";
+import type { IRTCPeerConnection } from "../api/webrtc/interfaces";
+import type { LibCrypto } from "../cryptography/libcrypto";
+/** The transport surface a cover lane needs from an RTCDataChannel. */
+export interface CoverLaneChannel {
+    readonly label: string;
+    readonly readyState: RTCDataChannelState | string;
+    readonly bufferedAmount: number;
+    send(data: ArrayBuffer): void;
+    close(): void;
+}
+export interface CoverRuntimeOptions {
+    readonly epc: IRTCPeerConnection;
+    readonly roomId: string;
+    readonly module: LibCrypto;
+    readonly amInitiator: boolean;
+    /** Authenticated room policy values (already validated by roomPolicy). */
+    readonly schedule: Omit<CoverSchedule, "phaseOffsetMs">;
+    /** Authenticated canonical room-policy hash: the shared phase source. */
+    readonly policyHash: Uint8Array;
+    /** Constant-shape name element shared by real and dummy lane labels. */
+    readonly laneLabelName: string;
+    /** Open one outbound lane; the caller owns RTCDataChannel construction. */
+    readonly openLaneChannel: (label: string) => CoverLaneChannel;
+    readonly onStatusChange?: (change: CoverStatusChange) => void;
+    readonly onJobResult?: (result: CoverJobResult) => void;
+    readonly onJobInterrupted?: (interruption: CoverJobInterruption) => void;
+    /**
+     * Real-timer drift tolerance. Defaults to just under one slot spacing so a
+     * healthy browser's setTimeout jitter does not suspend cover; a larger slip
+     * still degrades. Deterministic (fake-clock) tests pass 0.
+     */
+    readonly maxTimerDriftMs?: number;
+    /** Authenticated remote CANCEL for one transfer root (lowercase hex). */
+    readonly onRemoteCancel?: (merkleRootHex: string) => void;
+    /** Authenticated scheduled receipt token scoped to its transfer root. */
+    readonly onScheduledReceipt?: (merkleRootHex: string, token: Uint8Array) => void;
+    readonly clock?: CoverClock;
+}
+/**
+ * Every peer derives the identical absolute phase from the authenticated
+ * policy hash, so all edges of the room share one cycle grid without any
+ * negotiation message.
+ */
+export declare const deriveCoverPhaseOffsetMs: (policyHash: Uint8Array, coverCadenceMs: number) => number;
+export declare class CoverRuntime {
+    #private;
+    constructor(options: CoverRuntimeOptions);
+    /** Total cells one lane emits over a full cycle: F × D. */
+    cellsPerLanePerCycle(): number;
+    /**
+     * Fire a one-shot callback when the given job settles (completed, cancelled,
+     * or failed). Used to re-arm a long control backlog across cycles.
+     */
+    onJobSettled(jobId: string, callback: () => void): void;
+    /** A constant-shape lane label with a fresh random root (dummy/control). */
+    randomLaneLabel(): string;
+    /** starting | active | degraded | suspended | stopped */
+    get status(): CoverSchedulerStatus;
+    start(): void;
+    stop(): void;
+    destroy(): void;
+    /** A browser-imposed gap: close at the boundary, never claim the gap. */
+    suspend(reason: string): void;
+    /** Resume begins at a strictly future cycle boundary; gaps stay gaps. */
+    resume(): void;
+    enqueue(job: CoverJob): void;
+    cancel(jobId: string): ReturnType<CoverScheduler["cancel"]>;
+    complete(jobId: string): void;
+    getQueuedJobIds(): readonly string[];
+    /**
+     * Seal one authenticated non-dummy cover cell (CANCEL or scheduled receipt)
+     * for substitution into an already-scheduled slot.
+     */
+    sealCoverContent(content: CoverCellContent): Uint8Array;
+    /**
+     * Authenticate one inbound FRAME_TYPE_COVER cell. Dummy cells vanish;
+     * CANCEL/receipt dispatch to their hooks bound to the transfer root. An
+     * unauthentic, replayed, or wrong-epoch cell is dropped (returns false) —
+     * cover lanes may legitimately race an epoch transition by one flight.
+     */
+    processInboundCoverCell(frame: Uint8Array): boolean;
+    /**
+     * A dummy lane advertises a plausible same-shape label: the identical name
+     * element with a fresh random 64-byte "Merkle root". Labels are visible to
+     * the authenticated peer only — never to the signaling server or a network
+     * observer — so shape (not secrecy) is the requirement.
+     */
+    makeDummyLaneLabel(): Promise<string>;
+}

package/lib/handlers/coverScheduler.d.ts

@@ -0,0 +1,184 @@
+export type CoverSchedulerStatus = "starting" | "active" | "degraded" | "suspended" | "stopped";
+export type CoverJobKind = "real" | "control";
+export type CoverCellSource = CoverJobKind | "cancel" | "dummy";
+type MaybePromise<T> = T | PromiseLike<T>;
+export interface CoverClock {
+    now(): number;
+    setTimeout(callback: () => void, delayMs: number): unknown;
+    clearTimeout(handle: unknown): void;
+}
+/**
+ * The phase is an absolute clock offset. Epoch zero starts at phaseOffsetMs;
+ * negative epoch/cycle indices are valid when a test or monotonic clock starts
+ * before that offset.
+ */
+export interface CoverSchedule {
+    phaseOffsetMs: number;
+    coverCadenceMs: number;
+    coverLanes: number;
+    coverFramesPerCell: number;
+    coverDurationEpochs: number;
+}
+export interface CoverSlot {
+    readonly deadlineMs: number;
+    readonly cycleIndex: number;
+    readonly cycleStartMs: number;
+    readonly cycleEndMs: number;
+    readonly epochIndex: number;
+    readonly epochInCycle: number;
+    readonly laneIndex: number;
+    readonly frameIndex: number;
+    readonly laneSlotIndex: number;
+}
+export interface CoverJobSlot extends CoverSlot {
+    readonly jobId: string;
+    readonly jobKind: CoverJobKind;
+    /** Index of the next not-yet-accepted job cell. */
+    readonly jobCellIndex: number;
+}
+/**
+ * A producer is deliberately lazy: ratchet state and encrypted cell bytes can
+ * be prepared at the scheduled slot instead of buffering a complete cycle.
+ * Returning null substitutes a dummy for this slot without consuming a job
+ * cell. declaredCellCount enforces the authenticated F x D capacity class.
+ */
+export interface CoverJob {
+    readonly id: string;
+    readonly kind: CoverJobKind;
+    readonly declaredCellCount: number;
+    readonly priority?: number;
+    nextCell(slot: CoverJobSlot): MaybePromise<Uint8Array | null>;
+    cancelCell?(slot: CoverJobSlot): MaybePromise<Uint8Array>;
+}
+export interface CoverJobSummary {
+    readonly id: string;
+    readonly kind: CoverJobKind;
+    readonly declaredCellCount: number;
+}
+export interface CoverLaneOpenContext {
+    readonly cycleIndex: number;
+    readonly cycleStartMs: number;
+    readonly cycleEndMs: number;
+    readonly laneIndex: number;
+    readonly job: CoverJobSummary | null;
+}
+export interface CoverSendRequest {
+    readonly cell: Uint8Array;
+    readonly source: CoverCellSource;
+    readonly slot: CoverSlot;
+    readonly jobId?: string;
+    readonly jobCellIndex?: number;
+}
+export interface CoverLaneCloseContext extends CoverLaneOpenContext {
+    readonly reason: "boundary" | "late-cleanup";
+}
+export interface CoverLane {
+    /**
+     * Return false only when the transport rejected the cell for backpressure.
+     * A thrown/rejected send is treated as a transport failure.
+     */
+    send(request: CoverSendRequest): MaybePromise<boolean | void>;
+    close(context: CoverLaneCloseContext): void;
+}
+export type CoverJobOutcome = "completed" | "cancelled-before-admission" | "cancelled" | "failed";
+export interface CoverJobResult {
+    readonly jobId: string;
+    readonly outcome: CoverJobOutcome;
+    readonly reason?: "capacity-exhausted" | "stopped";
+}
+export interface CoverJobInterruption {
+    readonly jobId: string;
+    readonly reason: "backpressure" | "cell-production-failed" | "lane-open-failed" | "missed-deadline" | "send-failed" | "suspended";
+}
+export interface CoverStatusChange {
+    readonly previous: CoverSchedulerStatus;
+    readonly status: CoverSchedulerStatus;
+    readonly reason?: string;
+}
+export interface CoverSchedulerOptions {
+    readonly schedule: CoverSchedule;
+    readonly clock: CoverClock;
+    readonly laneFactory: (context: CoverLaneOpenContext) => CoverLane;
+    readonly makeDummy: (slot: CoverSlot) => MaybePromise<Uint8Array>;
+    /**
+     * Defaults to zero. A runtime may opt into a small, explicit timer tolerance;
+     * deadlines and metadata remain the absolute unshifted values.
+     */
+    readonly maxTimerDriftMs?: number;
+    readonly onStatusChange?: (change: CoverStatusChange) => void;
+    readonly onJobResult?: (result: CoverJobResult) => void;
+    readonly onJobInterrupted?: (interruption: CoverJobInterruption) => void;
+}
+export type CoverCancelResult = "not-found" | "cancelled-before-admission" | "cancel-pending";
+export declare class CoverScheduler {
+    readonly schedule: Readonly<CoverSchedule>;
+    private readonly clock;
+    private readonly laneFactory;
+    private readonly makeDummy;
+    private readonly maxTimerDriftMs;
+    private readonly onStatusChange?;
+    private readonly onJobResult?;
+    private readonly onJobInterrupted?;
+    private readonly cycleDurationMs;
+    private readonly slotsPerEpoch;
+    private readonly slotsPerLane;
+    private status;
+    private running;
+    private sequence;
+    private generation;
+    private timer;
+    private hasTimer;
+    private cycle?;
+    private readonly queued;
+    private readonly jobs;
+    constructor(options: CoverSchedulerOptions);
+    getStatus(): CoverSchedulerStatus;
+    getQueuedJobIds(): readonly string[];
+    enqueue(job: CoverJob): void;
+    cancel(jobId: string): CoverCancelResult;
+    /**
+     * Mark a producer complete without adding a terminal frame. Receipt/control
+     * traffic is queued as its own control job; this lane becomes dummy tail.
+     */
+    complete(jobId: string): boolean;
+    start(): boolean;
+    suspend(reason?: string): boolean;
+    resume(): boolean;
+    /**
+     * Stop is graceful for an already-open cover cycle: sends cease immediately,
+     * but channel close remains pinned to the authenticated cycle boundary.
+     */
+    stop(): boolean;
+    private assertClockNow;
+    private nextCycleBoundary;
+    private cycleIndexAtBoundary;
+    private sortQueue;
+    private removeQueued;
+    private dequeue;
+    private requeue;
+    private settle;
+    private setStatus;
+    private safeNotify;
+    private disarm;
+    private arm;
+    private armOpenBoundary;
+    private armCycleBoundary;
+    private armSlot;
+    private handleLateTimer;
+    private openCycle;
+    private slotAt;
+    private jobSlot;
+    private requestForSlot;
+    private cacheUnsent;
+    private acceptSent;
+    private sendSlot;
+    private degrade;
+    private interruptCycle;
+    private finalizeCycleJobs;
+    private closeCurrentCycle;
+    private handleCycleBoundary;
+}
+export declare const coverSlotSpacingMs: (schedule: CoverSchedule) => number;
+export declare const validateCoverSchedule: (schedule: CoverSchedule) => void;
+export declare const createCoverScheduler: (options: CoverSchedulerOptions) => CoverScheduler;
+export {};

package/lib/handlers/coverTransfer.d.ts

@@ -0,0 +1,46 @@
+import type { CoverJob } from "./coverScheduler";
+import type { CoverRuntime } from "./coverRuntime";
+import type { IRTCPeerConnection } from "../api/webrtc/interfaces";
+/**
+ * Queue one scheduled receipt (per-cell ack or terminal completion token) for
+ * the next available reverse control slots. Returns false when the edge has no
+ * cover runtime (immediate mode) so the caller falls back to immediate
+ * receipts, and drops oldest-first beyond the flood bound.
+ */
+export declare const queueScheduledReceipt: (epc: IRTCPeerConnection, merkleRoot: Uint8Array, token: Uint8Array) => boolean;
+/** Wipe and drop every queued scheduled receipt (edge teardown). */
+export declare const releaseScheduledReceipts: (epc: IRTCPeerConnection) => void;
+/**
+ * A synthetic constant-shape label for receipt routing: handleReadReceipt only
+ * consumes the Merkle-root element, so the name element is canonical zeros.
+ */
+export declare const syntheticScheduledLabel: (merkleRootHex: string) => string;
+/** Seal exactly one already-staged chunk into its uniform 65,490-byte cell. */
+export type SealTransferSlotCell = (chunkIndex: number) => Promise<Uint8Array | null> | Uint8Array | null;
+export interface ScheduledSendJobOptions {
+    readonly runtime: CoverRuntime;
+    /** The compiled per-message channel label; it is the job/lane id. */
+    readonly channelMessageLabel: string;
+    readonly totalChunks: number;
+    /** Seal the sender's cell for one chunk index (real bytes). */
+    readonly sealSlotCell: SealTransferSlotCell;
+    /** Set of already-acked real chunk indices for reconcile skipping. */
+    readonly getAckedChunks?: () => ReadonlySet<number>;
+    /** Real chunk indices only (decoys never resend); default is all indices. */
+    readonly realChunkIndices?: readonly number[];
+}
+/**
+ * Build the lazy scheduled-send job for one message on one edge. It seals at
+ * most ONE chunk per scheduled slot (never a burst), returns null (dummy
+ * substitution) once every not-yet-acked real chunk has been offered this
+ * pass, and refuses admission if the declared cell count cannot fit the
+ * authenticated `F × D` capacity class. Reconcile is scheduled, not burst: an
+ * un-acked chunk is re-offered on the next pass through the job's cells.
+ */
+export declare const buildScheduledSendJob: (options: ScheduledSendJobOptions) => CoverJob;
+/**
+ * The scheduled-mode wire CANCEL for one transfer on one edge: scheduler
+ * cancellation emits the encrypted CANCEL cell in the job's next slot and
+ * leaves a dummy tail through the fixed boundary. Never a channel close.
+ */
+export declare const cancelScheduledTransfer: (epc: IRTCPeerConnection, channelLabel: string, merkleRootHex: string) => Promise<boolean>;

package/lib/handlers/frameType.d.ts

@@ -0,0 +1,10 @@
+export interface ClassifiedFrame {
+    type: number;
+    payload: Uint8Array;
+}
+/**
+ * Reads the protocol-v3 1-byte frame tag and returns it together with a
+ * zero-copy view of the remaining bytes. An empty frame is reported as type -1
+ * so the caller can log-and-drop rather than throw.
+ */
+export declare const classifyFrame: (data: Uint8Array) => ClassifiedFrame;

package/lib/handlers/handleChallenge.d.ts

@@ -1,4 +1,3 @@
 import type { MiddlewareAPI } from "@reduxjs/toolkit";
 import type { KeyPair } from "../reducers/keyPairSlice";
 export declare const handleChallenge: (keyPair: KeyPair, peerId: string, challenge: string, store: MiddlewareAPI) => Promise<void>;
-//# sourceMappingURL=handleChallenge.d.ts.map

package/lib/handlers/handleConnectToPeer.d.ts

@@ -4,4 +4,3 @@ export interface IRTCPeerConnectionParams extends RTCPeerConnectionParams {
     peerConnections: IRTCPeerConnection[];
 }
 export declare const handleConnectToPeer: ({ peerId, peerPublicKey, roomId, peerConnections, rtcConfig, }: IRTCPeerConnectionParams, api: BaseQueryApi) => Promise<IRTCPeerConnection>;
-//# sourceMappingURL=handleConnectToPeer.d.ts.map

package/lib/handlers/handleHandshake.d.ts

@@ -0,0 +1,74 @@
+import { type PersistInitialRatchetState, type RollbackInitialRatchetState } from "./ratchetPersist";
+import { SparsePqHealingState } from "./pqHealingRuntime";
+import { type PqHealingBootstrap } from "./handshakeCore";
+import type { LibCrypto } from "../cryptography/libcrypto";
+import type { RatchetRootSuite } from "../utils/constants";
+import type { RatchetState } from "../cryptography/ratchet";
+import type { RatchetGateLease } from "./ratchetGate";
+import type { RoomPqMode } from "../roomPolicy";
+import type { IRTCPeerConnection, IRTCDataChannel } from "../api/webrtc/interfaces";
+/**
+ * Raw bytes of the `a=fingerprint:sha-256 XX:XX:...` line in an SDP blob.
+ * Throws if no sha-256 fingerprint attribute is present, or if the one found
+ * doesn't decode to exactly 32 bytes.
+ */
+export declare const parseFingerprintFromSdp: (sdp: string) => Uint8Array;
+/**
+ * Post-connect DTLS binding check (spec §5): the fingerprint declared in the
+ * SDP (and bound into the CPace channel-input via buildChannelInput) must
+ * equal the live certificate reported by getStats(). A disagreement means the
+ * DTLS transport terminates on a different certificate than the one that was
+ * authenticated by the handshake — i.e. a signaling server (or any on-path
+ * attacker) swapped the SDP fingerprint/cert after the CPace transcript was
+ * bound. This is the actual MITM tripwire, so it THROWS (never returns a
+ * boolean, never logs-and-continues) — the caller must abort the channel.
+ */
+export declare const verifyDtlsFingerprints: (epc: IRTCPeerConnection) => Promise<void>;
+/** Opaque owner of one concrete main-channel handshake attempt. */
+export interface HandshakeLease {
+    readonly token: symbol;
+}
+export declare const setHandshakeChannel: (roomId: string, peerId: string, channel: IRTCDataChannel | {
+    send: (b: ArrayBuffer | Uint8Array) => void;
+}, pqMode?: RoomPqMode, expectFinish?: boolean) => HandshakeLease;
+export declare const clearHandshakeChannel: (roomId: string, peerId: string, reason?: Error, lease?: HandshakeLease) => boolean;
+export declare const deliverHandshakeFrame: (roomId: string, peerId: string, payload: Uint8Array, lease: HandshakeLease) => boolean;
+/**
+ * Consume the handshake's PQ-healing bootstrap into a live store-free runtime.
+ * The constructor copies the root/binding, so the caller-owned bootstrap
+ * buffers are wiped on every exit — including a failed construction — leaving
+ * the returned runtime as the only holder of the derived PQ root.
+ */
+export declare const createHandshakePqRuntime: (module: LibCrypto, pqMode: RoomPqMode, rootSuite: RatchetRootSuite, amInitiator: boolean, bootstrap: PqHealingBootstrap) => SparsePqHealingState;
+export interface EdgeCryptoCandidate {
+    readonly state: RatchetState;
+    readonly pqRuntime: SparsePqHealingState;
+}
+/**
+ * Atomically persist the handshake-established Double Ratchet together with
+ * the initial sparse-PQ checkpoint in ONE stable-edge row, then synchronously
+ * install both on the live connection. The candidate serializer hook is
+ * installed before the row is written, so even the very first persisted row
+ * carries a non-null encrypted edge state. `beforeInstall` runs inside the
+ * synchronous activation (lease/gate checks); if it — or persistence — throws,
+ * the hook is removed, the seed row is rolled back by the persistence layer,
+ * nothing is installed, and ownership of both candidates stays with the
+ * caller (which must wipe/destroy them). Ownership transfers to `epc` only
+ * when this resolves.
+ */
+export declare const persistAndActivateEdgeCrypto: (epc: IRTCPeerConnection, roomId: string, candidate: EdgeCryptoCandidate, beforeInstall: () => void, persist?: PersistInitialRatchetState, rollback?: RollbackInitialRatchetState) => Promise<void>;
+/**
+ * Orchestrates the handshake on the persistent `main` channel (spec §5): verifies
+ * the DTLS fingerprints (getStats vs SDP), runs the triple-confirmation core,
+ * then — ONLY
+ * on success — seeds + persists the (wrapped) ratchet together with the
+ * initial sparse-PQ checkpoint in one row, sets epc.ratchetState /
+ * epc.pqHealingState, and opens the per-peer gate. Any failure (fingerprint
+ * mismatch,
+ * CPace/interactive-3DH error, key-confirmation mismatch, a bad/short frame,
+ * a transport or
+ * persistence error) rejects the gate and re-throws, having persisted NOTHING —
+ * the caller tears the channel down. No PQ root, binding, or runtime survives
+ * a failure path outside this function.
+ */
+export declare const runHandshake: (epc: IRTCPeerConnection, roomId: string, mode: "pin" | "nopin", pqMode: RoomPqMode, pin: Uint8Array | null, channelInput: Uint8Array, module: LibCrypto, handshakeLease: HandshakeLease, gateLease: RatchetGateLease) => Promise<void>;

package/lib/handlers/handleMessageQueueing.d.ts

@@ -1,5 +1,54 @@
+import { type ReceiveMessageResult } from "./handleReceiveMessage";
 import type { LibCrypto } from "../cryptography/libcrypto";
-import type { BaseQueryApi } from "@reduxjs/toolkit/dist/query";
-import type { IRTCDataChannel } from "../api/webrtc/interfaces";
-export declare const enqueue: (data: Uint8Array, queue: Uint8Array[], seen: Set<string>, draining: boolean, api: BaseQueryApi, roomId: string, peerId: string, channelLabel: string, merkleRootHex: string, extChannel: IRTCDataChannel | undefined, decrypted: Uint8Array | undefined, messageArray: Uint8Array | undefined, merkleRootArray: Uint8Array | undefined, senderPublicKeyArray: Uint8Array | undefined, receiverSecretKeyArray: Uint8Array | undefined, receiveMessageModule: LibCrypto) => void;
-//# sourceMappingURL=handleMessageQueueing.d.ts.map
+import type { BaseQueryApi } from "@reduxjs/toolkit/query";
+import type { IRTCDataChannel, IRTCPeerConnection } from "../api/webrtc/interfaces";
+/**
+ * True while this room/peer edge still has queued inbound chunk frames or an
+ * in-flight frame handler. The sparse-PQ orchestrator drains to quiescence
+ * before an epoch transition so old-epoch first-chunks are not orphaned.
+ */
+export declare const hasQueuedEdgeReceiveWork: (roomId: string, peerId: string) => boolean;
+export declare const waitForEdgeReceiveQuiescence: (roomId: string, peerId: string) => Promise<void>;
+/**
+ * A terminal receipt may ride an immediate frame only in immediate mode. In a
+ * scheduled-cover room acknowledgement substitutes into a reverse cover slot,
+ * so an immediate frame here would be an unscheduled emission correlated with
+ * message completion.
+ */
+export declare const shouldSendImmediateTerminalReceipt: (epc?: Pick<IRTCPeerConnection, "coverRuntime">) => boolean;
+export declare const MAX_QUEUED_FRAMES_PER_CHANNEL = 64;
+export declare const MAX_QUEUED_BYTES_PER_EDGE: number;
+export declare const MAX_QUEUED_RECEIPTS_PER_CHANNEL = 2048;
+export declare const MAX_QUEUED_RECEIPTS_PER_EDGE = 8192;
+export interface MessageProcessingState {
+    value: boolean;
+    released?: boolean;
+    idleWaiters?: Set<() => void>;
+}
+export declare const waitForQueuedMessageFrames: (queue: Uint8Array[], state: MessageProcessingState) => Promise<void>;
+export declare const releaseQueuedMessageFrames: (queue: Uint8Array[], roomId: string, peerId: string, state?: MessageProcessingState) => void;
+export interface ReceiptProcessingQueue {
+    readonly roomId: string;
+    readonly peerId: string;
+    readonly pending: Uint8Array[];
+    readonly seen: Set<string>;
+    draining: boolean;
+    released: boolean;
+}
+export declare const createReceiptProcessingQueue: (roomId: string, peerId: string) => ReceiptProcessingQueue;
+export declare const releaseQueuedReceipts: (state: ReceiptProcessingQueue) => void;
+/**
+ * Queue one already-classified 64-byte receipt token. This is deliberately a
+ * bounded data queue, not one promise per onmessage event. At most one handler
+ * executes per room/peer edge, even when many message channels are open.
+ */
+export declare const enqueueReceipt: (receipt: Uint8Array, state: ReceiptProcessingQueue, processReceipt: (receipt: Uint8Array) => Promise<void>) => boolean;
+type PerFrameReceiptResult = Pick<ReceiveMessageResult, "chunkHash" | "chunkIndex" | "chunkSize" | "totalSize">;
+/**
+ * Emit exactly one receipt-shaped frame for every inbound chunk frame. Real
+ * cells use their rooted token; cover/dropped cells use an unlinkable random
+ * token so an observer cannot infer which slot carried bytes.
+ */
+export declare const sendReceiveFrameReceipt: (result: PerFrameReceiptResult, channel: IRTCDataChannel | undefined) => boolean;
+export declare const enqueue: (data: Uint8Array, queue: Uint8Array[], seen: Set<string>, drainingRef: MessageProcessingState, api: BaseQueryApi, roomId: string, peerId: string, channelLabel: string, merkleRootHex: string, merkleRoot: Uint8Array, extChannel: IRTCDataChannel | undefined, epc: IRTCPeerConnection | undefined, receiveMessageModule: LibCrypto, signal?: AbortSignal) => boolean;
+export {};

package/lib/handlers/handleOpenChannel.d.ts

@@ -1,10 +1,12 @@
 import type { BaseQueryApi } from "@reduxjs/toolkit/query";
 import type { IRTCPeerConnection, IRTCDataChannel } from "../api/webrtc/interfaces";
+export declare const MAX_MESSAGE_CHANNELS_PER_EDGE = 64;
 export interface OpenChannelHelperParams {
     channel: string | RTCDataChannel;
     epc: IRTCPeerConnection;
     roomId: string;
     dataChannels: IRTCDataChannel[];
+    /** True only for a channel delivered by RTCPeerConnection.ondatachannel. */
+    incoming?: boolean;
 }
-export declare const handleOpenChannel: ({ channel, epc, roomId, dataChannels }: OpenChannelHelperParams, api: BaseQueryApi) => Promise<IRTCDataChannel>;
-//# sourceMappingURL=handleOpenChannel.d.ts.map
+export declare const handleOpenChannel: ({ channel, epc, roomId, dataChannels, incoming, }: OpenChannelHelperParams, api: BaseQueryApi) => Promise<IRTCDataChannel>;

package/lib/handlers/handleQueuedIceCandidates.d.ts

@@ -1,3 +1,2 @@
 import type { IRTCPeerConnection } from "../api/webrtc/interfaces";
 export declare const handleQueuedIceCandidates: (epc: IRTCPeerConnection) => Promise<void>;
-//# sourceMappingURL=handleQueuedIceCandidates.d.ts.map

package/lib/handlers/handleReadReceipt.d.ts

@@ -1,4 +1,17 @@
-import type { BaseQueryApi } from "@reduxjs/toolkit/dist/query";
-import type { Room } from "../reducers/roomSlice";
-export declare const handleReadReceipt: (receivedChunkHash: Uint8Array, channel: string, peerId: string, room: Room, api: BaseQueryApi) => Promise<void>;
-//# sourceMappingURL=handleReadReceipt.d.ts.map
+import type { BaseQueryApi } from "@reduxjs/toolkit/query";
+export type ReadReceiptOutcome = {
+    kind: "ignored";
+    peerId: string;
+} | {
+    kind: "chunk-acked";
+    peerId: string;
+    transferId: string;
+    chunkIndex: number;
+    newlyAccepted: boolean;
+} | {
+    kind: "peer-complete";
+    peerId: string;
+    transferId: string;
+    newlyAccepted: boolean;
+};
+export declare const handleReadReceipt: (receivedChunkHash: Uint8Array, channel: string, peerId: string, roomId: string, api: BaseQueryApi) => Promise<ReadReceiptOutcome>;

package/lib/handlers/handleReceiveMessage.d.ts

@@ -1,5 +1,8 @@
 import type { LibCrypto } from "../cryptography/libcrypto";
-export declare const handleReceiveMessage: (decrypted: Uint8Array, messageArray: Uint8Array, merkleRootArray: Uint8Array, senderPublicKeyArray: Uint8Array, receiverSecretKeyArray: Uint8Array, module: LibCrypto) => Promise<{
+import type { IRTCPeerConnection } from "../api/webrtc/interfaces";
+import type { ReceiveChunk, ReceiveChunkStoreResult } from "../db/types";
+import type { PersistRatchetState } from "./ratchetPersist";
+export interface ReceiveMessageResult {
     date: Date;
     chunkSize: number;
     chunkIndex: number;
@@ -8,7 +11,22 @@ export declare const handleReceiveMessage: (decrypted: Uint8Array, messageArray:
     totalSize: number;
     messageType: number;
     filename: string;
+    /** 64-byte root/index/leaf-bound receipt token (legacy field name). */
     chunkHash: Uint8Array;
     messageHash: Uint8Array;
-}>;
-//# sourceMappingURL=handleReceiveMessage.d.ts.map
+}
+type ReceiveChunkStore = (chunk: ReceiveChunk) => Promise<ReceiveChunkStoreResult>;
+export interface ReceiveMessageDependencies {
+    /** Test/fault-injection seam; production uses the ratchet worker database. */
+    persistRatchetState?: PersistRatchetState;
+    /** Test/fault-injection seam; production uses the receive-chunk worker. */
+    storeReceiveChunk?: ReceiveChunkStore;
+}
+/**
+ * Worker storage is the durability boundary for a receipt. A failed write must
+ * look exactly like a decoy/drop to the caller, and the owned real-byte copy is
+ * erased after postMessage has cloned it (or after an injected failure).
+ */
+export declare const storeReceiveChunkFailClosed: (chunk: Omit<ReceiveChunk, "data">, realChunk: Uint8Array, store?: ReceiveChunkStore) => Promise<ReceiveChunkStoreResult | null>;
+export declare const handleReceiveMessage: (frame: Uint8Array, roomId: string, channelLabel: string, epc: IRTCPeerConnection, merkleRoot: Uint8Array, module: LibCrypto, signal?: AbortSignal, dependencies?: ReceiveMessageDependencies) => Promise<ReceiveMessageResult>;
+export {};