werift 0.24.1 → 0.24.2

package/lib/index.mjs

@@ -5767,8 +5767,8 @@ var TransportContext = class {
   constructor(socket) {
     this.socket = socket;
   }
-  send = (buf) => {
-    return this.socket.send(buf);
+  send = (buf, addr) => {
+    return this.socket.send(buf, addr);
   };
 };
 
@@ -6107,12 +6107,12 @@ var DtlsSocket = class {
     return handshakes;
   }
   /**send application data */
-  send = async (buf) => {
+  send = async (buf, addr) => {
     const pkt = createPlaintext(this.dtls)(
       [{ type: 23 /* applicationData */, fragment: buf }],
       ++this.dtls.recordSequenceNumber
     )[0];
-    await this.transport.send(this.cipher.encryptPacket(pkt).serialize());
+    await this.transport.send(this.cipher.encryptPacket(pkt).serialize(), addr);
   };
   close() {
     this.transport.socket.close();
@@ -7033,6 +7033,7 @@ function parseMessage(data, integrityKey) {
   );
   const attributeRepository = new AttributeRepository();
   const rawAttributes = [];
+  let messageIntegrityVerified = false;
   for (let pos = HEADER_LENGTH; pos < data.length; ) {
     if (pos + 4 > data.length) {
       return void 0;
@@ -7070,6 +7071,7 @@ function parseMessage(data, integrityKey) {
         if (!integrity.equals(expected)) {
           return void 0;
         }
+        messageIntegrityVerified = true;
       }
     } else {
       rawAttributes.push({
@@ -7080,6 +7082,9 @@ function parseMessage(data, integrityKey) {
     }
     pos = valueEnd + padLen;
   }
+  if (integrityKey && !messageIntegrityVerified) {
+    return void 0;
+  }
   return new Message(
     messageType & 16111,
     messageType & 272,
@@ -7204,6 +7209,10 @@ function paddingLength(length) {
   return rest === 0 ? 0 : 4 - rest;
 }
 
+// ../ice/src/stun/transaction.ts
+import { promises as dns } from "node:dns";
+import { isIP as isIP2 } from "node:net";
+
 // ../ice/src/exceptions.ts
 var TransactionError = class extends Error {
   response;
@@ -7233,32 +7242,100 @@ var TransactionTimeout = class extends TransactionError {
 
 // ../ice/src/stun/transaction.ts
 var log18 = debug("werift-ice:packages/ice/src/stun/transaction.ts");
+async function resolveRequestAddress(addr, family = 0) {
+  if (isIP2(addr[0])) {
+    return addr;
+  }
+  const looked = await dns.lookup(addr[0], { family });
+  return [looked.address, addr[1]];
+}
+function normalizeTransactionOptions(retransmissionsOrOptions, onRequestSent) {
+  if (retransmissionsOrOptions !== null && typeof retransmissionsOrOptions === "object") {
+    return retransmissionsOrOptions;
+  }
+  const retransmissions = typeof retransmissionsOrOptions === "number" ? retransmissionsOrOptions : void 0;
+  return {
+    retransmissions,
+    onRequestSent
+  };
+}
+function addressEquals(a, b) {
+  return a[0] === b[0] && a[1] === b[1];
+}
 var Transaction = class {
-  constructor(request, addr, protocol, retransmissions, onRequestSent) {
+  constructor(request, addr, protocol, retransmissionsOrOptions, onRequestSent) {
     this.request = request;
     this.addr = addr;
     this.protocol = protocol;
-    this.retransmissions = retransmissions;
-    this.onRequestSent = onRequestSent;
-    this.triesMax = 1 + (this.retransmissions ?? RETRY_MAX);
-  }
-  timeoutDelay = RETRY_RTO;
+    const options = normalizeTransactionOptions(
+      retransmissionsOrOptions,
+      onRequestSent
+    );
+    this.triesMax = 1 + (options.retransmissions ?? RETRY_MAX);
+    this.timeoutDelay = options.responseTimeout ?? RETRY_RTO;
+    this.onRequestSent = options.onRequestSent;
+    this.signal = options.signal;
+    this.expectedAddr = addr;
+    this.integrityKey = options.integrityKey;
+  }
+  timeoutDelay;
   ended = false;
   tries = 0;
   triesMax;
   onResponse = new Event2();
+  onRequestSent;
+  signal;
+  /** Remote address this transaction was sent to; responses must match. */
+  expectedAddr;
+  /**
+   * When set, protocol layers re-parse the wire response with this key so
+   * MESSAGE-INTEGRITY failures are rejected before responseReceived.
+   */
+  integrityKey;
+  waitTimer;
+  waitResolve;
+  onAbort;
+  /**
+   * Accept a matching authenticated non-error response from the expected
+   * remote address. Wrong address, missing MESSAGE-INTEGRITY (when required),
+   * or non-success class is rejected without completing the transaction
+   * (wrong address / unauthenticated responses are ignored so we keep waiting).
+   */
   responseReceived = (message, addr) => {
-    if (this.onResponse.length > 0) {
-      if (message.messageClass === 256 /* RESPONSE */) {
-        this.onResponse.execute(message, addr);
-        this.onResponse.complete();
-      } else {
-        this.onResponse.error(new TransactionFailed(message, addr));
+    if (this.ended || this.onResponse.length === 0) {
+      return;
+    }
+    if (!addressEquals(this.expectedAddr, addr)) {
+      log18(
+        "ignore STUN response from unexpected address",
+        addr,
+        "expected",
+        this.expectedAddr
+      );
+      return;
+    }
+    if (this.integrityKey) {
+      const hasIntegrity = message.attributesKeys.includes("MESSAGE-INTEGRITY") || message.attributesKeys.includes("MESSAGE-INTEGRITY-SHA256");
+      if (!hasIntegrity) {
+        log18(
+          "ignore unauthenticated STUN response (MESSAGE-INTEGRITY required)"
+        );
+        return;
       }
     }
+    if (message.messageClass === 256 /* RESPONSE */) {
+      this.onResponse.execute(message, addr);
+      this.onResponse.complete();
+    } else {
+      this.onResponse.error(new TransactionFailed(message, addr));
+    }
   };
   run = async () => {
     try {
+      if (this.signal?.aborted) {
+        throw new TransactionTimeout();
+      }
+      this.attachAbortListener();
       this.retry().catch((e) => {
         log18("retry failed", e);
       });
@@ -7270,28 +7347,85 @@ var Transaction = class {
       this.cancel();
     }
   };
+  attachAbortListener() {
+    if (!this.signal) {
+      return;
+    }
+    this.onAbort = () => {
+      this.failWithTimeout();
+    };
+    this.signal.addEventListener("abort", this.onAbort, { once: true });
+  }
+  failWithTimeout() {
+    if (this.ended) {
+      return;
+    }
+    this.ended = true;
+    this.clearWait();
+    if (this.onResponse.length > 0) {
+      this.onResponse.error(new TransactionTimeout());
+    }
+  }
+  clearWait() {
+    if (this.waitTimer !== void 0) {
+      clearTimeout(this.waitTimer);
+      this.waitTimer = void 0;
+    }
+    const resolve = this.waitResolve;
+    this.waitResolve = void 0;
+    resolve?.();
+  }
+  wait(ms) {
+    return new Promise((resolve) => {
+      if (this.ended || this.signal?.aborted) {
+        resolve();
+        return;
+      }
+      this.waitResolve = resolve;
+      this.waitTimer = setTimeout(() => {
+        this.waitTimer = void 0;
+        this.waitResolve = void 0;
+        resolve();
+      }, ms);
+    });
+  }
   retry = async () => {
     while (this.tries < this.triesMax && !this.ended) {
       this.onRequestSent?.(this.tries);
       this.protocol.sendStun(this.request, this.addr).catch((e) => {
         log18("send stun failed", e);
       });
-      await new Promise((r) => setTimeout(r, this.timeoutDelay));
+      await this.wait(this.timeoutDelay);
       if (this.ended) {
         break;
       }
       this.timeoutDelay *= 2;
       this.tries++;
     }
-    if (this.tries >= this.triesMax) {
+    if (this.tries >= this.triesMax && !this.ended) {
       log18(`retry failed times:${this.tries} maxLimit:${this.triesMax}`);
-      this.onResponse.error(new TransactionTimeout());
+      this.failWithTimeout();
     }
   };
   cancel() {
     this.ended = true;
+    this.clearWait();
+    if (this.signal && this.onAbort) {
+      this.signal.removeEventListener("abort", this.onAbort);
+      this.onAbort = void 0;
+    }
   }
 };
+function buildTransactionOptions(integrityKey, retransmissionsOrOptions, onRequestSent) {
+  const options = normalizeTransactionOptions(
+    retransmissionsOrOptions,
+    onRequestSent
+  );
+  if (integrityKey && !options.integrityKey) {
+    options.integrityKey = integrityKey;
+  }
+  return options;
+}
 
 // ../ice/src/stun/tcpProtocol.ts
 var log19 = debug("werift-ice:packages/ice/src/stun/tcpProtocol.ts");
@@ -7390,10 +7524,13 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
         return;
       }
       if ((message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) && this.transactions[message.transactionIdHex]) {
-        this.transactions[message.transactionIdHex].responseReceived(
-          message,
-          addr
-        );
+        const transaction = this.transactions[message.transactionIdHex];
+        const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+        if (!verified) {
+          log19("STUN response failed MESSAGE-INTEGRITY check");
+          return;
+        }
+        transaction.responseReceived(verified, addr);
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
       }
@@ -7419,7 +7556,7 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
   async sendData(data, addr) {
     await this.sendFrame(data, addr);
   }
-  async request(request, addr, integrityKey, retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactions[request.transactionIdHex]) {
       throw new Error("already requested");
     }
@@ -7427,13 +7564,13 @@ var BaseTcpProtocol = class _BaseTcpProtocol {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      retransmissions,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -7592,7 +7729,12 @@ var StunProtocol = class _StunProtocol {
       }
       if ((message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) && this.transactionsKeys.includes(message.transactionIdHex)) {
         const transaction = this.transactions[message.transactionIdHex];
-        transaction.responseReceived(message, addr);
+        const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+        if (!verified) {
+          log20("STUN response failed MESSAGE-INTEGRITY check");
+          return;
+        }
+        transaction.responseReceived(verified, addr);
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
       }
@@ -7619,19 +7761,26 @@ var StunProtocol = class _StunProtocol {
     }
     await this.transport.send(data, addr);
   }
-  async request(request, addr, integrityKey, retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactionsKeys.includes(request.transactionIdHex))
       throw new Error("already request ed");
     if (integrityKey) {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
+    const socketType = this.transport.socketType;
+    const family = socketType === "udp6" ? 6 : 4;
+    const resolvedAddr = await resolveRequestAddress(addr, family);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
+      onRequestSent
+    );
     const transaction = new Transaction(
       request,
-      addr,
+      resolvedAddr,
       this,
-      retransmissions,
-      onRequestSent
+      options
     );
     this.transactions[request.transactionIdHex] = transaction;
     try {
@@ -7802,7 +7951,12 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       if (message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) {
         const transaction = this.turn.transactions[message.transactionIdHex];
         if (transaction) {
-          transaction.responseReceived(message, addr);
+          const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+          if (!verified) {
+            log21("STUN over TURN response failed MESSAGE-INTEGRITY check");
+            return;
+          }
+          transaction.responseReceived(verified, addr);
         }
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onRequestReceived.execute(message, addr, data);
@@ -7811,7 +7965,7 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       log21("datagramReceived error", error);
     }
   };
-  async request(request, addr, integrityKey, _retransmissions, onRequestSent) {
+  async request(request, addr, integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.turn.transactions[request.transactionIdHex]) {
       throw new Error("exist");
     }
@@ -7819,13 +7973,13 @@ var StunOverTurnProtocol = class _StunOverTurnProtocol {
       request.addMessageIntegrity(integrityKey);
       request.addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      void 0,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.turn.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -7915,7 +8069,12 @@ var TurnProtocol = class _TurnProtocol {
       if (message.messageClass === 256 /* RESPONSE */ || message.messageClass === 272 /* ERROR */) {
         const transaction = this.transactions[message.transactionIdHex];
         if (transaction) {
-          transaction.responseReceived(message, addr);
+          const verified = transaction.integrityKey ? parseMessage(data, transaction.integrityKey) : message;
+          if (!verified) {
+            log21("TURN STUN response failed MESSAGE-INTEGRITY check");
+            return;
+          }
+          transaction.responseReceived(verified, addr);
         }
       } else if (message.messageClass === 0 /* REQUEST */) {
         this.onData.execute(data, addr);
@@ -7987,20 +8146,20 @@ var TurnProtocol = class _TurnProtocol {
       }
     });
   };
-  async request(request, addr, _integrityKey, _retransmissions, onRequestSent) {
+  async request(request, addr, _integrityKey, retransmissionsOrOptions, onRequestSent) {
     if (this.transactions[request.transactionIdHex]) {
       throw new Error("exist");
     }
     if (this.integrityKey) {
       request.setAttribute("USERNAME", this.username).setAttribute("REALM", this.realm).setAttribute("NONCE", this.nonce).addMessageIntegrity(this.integrityKey).addFingerprint();
     }
-    const transaction = new Transaction(
-      request,
-      addr,
-      this,
-      void 0,
+    const resolvedAddr = await resolveRequestAddress(addr);
+    const options = buildTransactionOptions(
+      this.integrityKey,
+      retransmissionsOrOptions,
       onRequestSent
     );
+    const transaction = new Transaction(request, resolvedAddr, this, options);
     this.transactions[request.transactionIdHex] = transaction;
     try {
       return await transaction.run();
@@ -8466,6 +8625,18 @@ var ICE_COMPLETED = 1;
 var ICE_FAILED = 2;
 var CONSENT_INTERVAL = 5;
 var CONSENT_FAILURES = 6;
+var CONSENT_TIMEOUT = 30;
+var CONSENT_RESPONSE_TIMEOUT = 1e3;
+var CONSENT_RESPONSE_TIMEOUT_MIN = 500;
+function consentResponseTimeoutMs(rttSeconds) {
+  if (rttSeconds === void 0 || !Number.isFinite(rttSeconds) || rttSeconds <= 0) {
+    return CONSENT_RESPONSE_TIMEOUT;
+  }
+  return Math.max(
+    CONSENT_RESPONSE_TIMEOUT_MIN,
+    Math.round(rttSeconds * 1e3 * 2 + 200)
+  );
+}
 var CandidatePairState = /* @__PURE__ */ ((CandidatePairState2) => {
   CandidatePairState2[CandidatePairState2["FROZEN"] = 0] = "FROZEN";
   CandidatePairState2[CandidatePairState2["WAITING"] = 1] = "WAITING";
@@ -8665,6 +8836,12 @@ var Connection = class {
   localCandidatesStart = false;
   protocols = [];
   queryConsentHandle;
+  /** RFC 7675 consent-to-send: application data may use the selected pair. */
+  consentFresh = false;
+  /** Invalidates in-flight consent callbacks on restart / close / replace / expire. */
+  consentSessionId = 0;
+  consentExpiryTimer;
+  consentRequestAbort;
   onData = new Event2();
   stateChanged = new Event2();
   onIceCandidate = new Event2();
@@ -8675,13 +8852,10 @@ var Connection = class {
     if (this.iceLite) {
       value = false;
     }
-    if (this.generation > 0 || this.nominated) {
+    if (this.nominated) {
       return;
     }
-    this._iceControlling = value;
-    for (const pair of this.checkList) {
-      pair.iceControlling = value;
-    }
+    this.applyIceControlling(value);
   }
   get iceLite() {
     return this.options.iceLite;
@@ -8718,13 +8892,13 @@ var Connection = class {
         protocol.localCandidate.ufrag = this.localUsername;
       }
     }
-    this.queryConsentHandle?.resolve?.();
-    this.queryConsentHandle = void 0;
+    this.stopConsentLifecycle();
   }
   resetNominatedPair() {
     log23("resetNominatedPair");
     this.nominated = void 0;
     this.nominating = false;
+    this.stopConsentLifecycle();
   }
   setRemoteParams({
     iceLite,
@@ -8740,6 +8914,13 @@ var Connection = class {
   async gatherCandidates() {
     if (!this.localCandidatesStart) {
       this.localCandidatesStart = true;
+      for (const protocol of this.protocols) {
+        if (protocol.localCandidate) {
+          protocol.localCandidate.generation = this.generation;
+          protocol.localCandidate.ufrag = this.localUsername;
+          this.appendLocalCandidate(protocol.localCandidate);
+        }
+      }
       let address = getHostAddresses(
         this.options.useIpv4,
         this.options.useIpv6,
@@ -9132,84 +9313,211 @@ var Connection = class {
     }
     return false;
   }
-  // 4.1.1.4 ? 生存確認 life check
+  /**
+   * Stop consent request cadence, expiry timer, and outstanding transactions.
+   * Does not change ICE state by itself.
+   */
+  stopConsentLifecycle() {
+    this.consentSessionId++;
+    this.consentFresh = false;
+    if (this.consentExpiryTimer !== void 0) {
+      clearTimeout(this.consentExpiryTimer);
+      this.consentExpiryTimer = void 0;
+    }
+    this.consentRequestAbort?.abort();
+    this.consentRequestAbort = void 0;
+    const handle = this.queryConsentHandle;
+    this.queryConsentHandle = void 0;
+    handle?.resolve?.();
+  }
+  /**
+   * ICE-lite interop only (not required by RFC 7675): mirror libwebrtc
+   * semi-aggressive nomination — attach USE-CANDIDATE when we are controlling,
+   * the remote is ICE-lite, and the target is the current selected pair.
+   */
+  shouldNominateConsentRequest(pair) {
+    return this.iceControlling && this.remoteIsLite && this.nominated?.id === pair.id;
+  }
+  canSendApplicationData() {
+    if (!this.nominated) {
+      return false;
+    }
+    if (this.state === "closed" || this.state === "failed") {
+      return false;
+    }
+    if (this.iceLite) {
+      return true;
+    }
+    return this.consentFresh;
+  }
+  abortableDelay(ms, signal) {
+    return new Promise((resolve, reject) => {
+      if (signal.aborted) {
+        reject(new DOMException("The operation was aborted", "AbortError"));
+        return;
+      }
+      const timer2 = setTimeout(() => {
+        signal.removeEventListener("abort", onAbort);
+        resolve();
+      }, ms);
+      const onAbort = () => {
+        clearTimeout(timer2);
+        reject(new DOMException("The operation was aborted", "AbortError"));
+      };
+      signal.addEventListener("abort", onAbort, { once: true });
+    });
+  }
+  // RFC 7675 consent freshness
   queryConsent = () => {
     if (this.iceLite) {
       return;
     }
-    if (this.queryConsentHandle) {
-      this.queryConsentHandle.resolve();
-    }
-    this.queryConsentHandle = cancelable(async (_, __, onCancel) => {
-      let failures = 0;
+    this.stopConsentLifecycle();
+    const sessionId = this.consentSessionId;
+    this.consentFresh = true;
+    const handle = cancelable(async (_, __, onCancel) => {
       let canceled = false;
       const cancelEvent = new AbortController();
+      const clearConsentExpiry = () => {
+        if (this.consentExpiryTimer === void 0) {
+          return;
+        }
+        clearTimeout(this.consentExpiryTimer);
+        this.consentExpiryTimer = void 0;
+      };
+      const refreshConsentExpiry = () => {
+        if (canceled || sessionId !== this.consentSessionId) {
+          return;
+        }
+        clearConsentExpiry();
+        this.consentExpiryTimer = setTimeout(() => {
+          this.consentExpiryTimer = void 0;
+          if (canceled || sessionId !== this.consentSessionId) {
+            return;
+          }
+          if (this.state === "closed" || this.state === "failed") {
+            return;
+          }
+          log23("Consent to send expired");
+          this.consentFresh = false;
+          this.consentSessionId++;
+          this.consentRequestAbort?.abort();
+          this.consentRequestAbort = void 0;
+          if (this.queryConsentHandle === handle) {
+            this.queryConsentHandle = void 0;
+          }
+          canceled = true;
+          cancelEvent.abort();
+          this.setState("failed");
+        }, CONSENT_TIMEOUT * 1e3);
+      };
       onCancel.once(() => {
         canceled = true;
-        failures += CONSENT_FAILURES;
+        if (sessionId === this.consentSessionId) {
+          clearConsentExpiry();
+          this.consentRequestAbort?.abort();
+          this.consentRequestAbort = void 0;
+        }
         cancelEvent.abort();
-        this.queryConsentHandle = void 0;
+        if (this.queryConsentHandle === handle) {
+          this.queryConsentHandle = void 0;
+        }
       });
-      const { localUsername, remoteUsername, iceControlling } = this;
+      refreshConsentExpiry();
+      const randomizedConsentInterval = () => CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1e3;
+      let nextConsentAt = Date.now() + randomizedConsentInterval();
+      const isTerminalState = () => this.state === "closed" || this.state === "failed";
       try {
-        while (this.state !== "closed" && !canceled) {
-          await timers.setTimeout(
-            CONSENT_INTERVAL * (0.8 + 0.4 * Math.random()) * 1e3,
-            void 0,
-            { signal: cancelEvent.signal }
+        while (!isTerminalState() && !canceled && sessionId === this.consentSessionId) {
+          await this.abortableDelay(
+            Math.max(0, nextConsentAt - Date.now()),
+            cancelEvent.signal
           );
+          if (canceled || isTerminalState() || sessionId !== this.consentSessionId) {
+            break;
+          }
+          nextConsentAt = Date.now() + randomizedConsentInterval();
           const nominated = this.nominated;
-          if (!nominated || canceled) {
+          if (!nominated) {
             break;
           }
+          const pairId = nominated.id;
+          const generation = this.generation;
+          const remotePassword = this.remotePassword;
+          const { localUsername, remoteUsername, iceControlling } = this;
           const request = this.buildRequest({
-            nominate: false,
+            nominate: this.shouldNominateConsentRequest(nominated),
             localUsername,
             remoteUsername,
             iceControlling,
             localCandidate: nominated.localCandidate
           });
-          try {
-            nominated.consentRequestsSent++;
-            nominated.requestsSent++;
-            await nominated.protocol.request(
-              request,
-              nominated.remoteAddr,
-              Buffer.from(this.remotePassword, "utf8"),
-              0,
-              (attempt) => {
+          this.consentRequestAbort?.abort();
+          const requestAbort = new AbortController();
+          this.consentRequestAbort = requestAbort;
+          nominated.consentRequestsSent++;
+          nominated.requestsSent++;
+          const responseTimeout = consentResponseTimeoutMs(nominated.rtt);
+          const requestStartedAt = performance.now();
+          nominated.protocol.request(
+            request,
+            nominated.remoteAddr,
+            Buffer.from(remotePassword, "utf8"),
+            {
+              retransmissions: 0,
+              responseTimeout,
+              signal: requestAbort.signal,
+              onRequestSent: (attempt) => {
                 if (attempt > 0) {
                   nominated.retransmissionsSent++;
                 }
               }
-            );
+            }
+          ).then(() => {
+            if (sessionId !== this.consentSessionId || canceled) {
+              return;
+            }
+            const state = this.state;
+            if (state === "closed" || state === "failed") {
+              return;
+            }
+            if (this.nominated?.id !== pairId) {
+              return;
+            }
+            if (this.generation !== generation) {
+              return;
+            }
+            if (this.remotePassword !== remotePassword) {
+              return;
+            }
+            const rtt = (performance.now() - requestStartedAt) / 1e3;
+            nominated.rtt = rtt;
+            nominated.totalRoundTripTime += rtt;
+            nominated.roundTripTimeMeasurements++;
             nominated.responsesReceived++;
-            failures = 0;
-            if (this.state === "disconnected") {
+            this.consentFresh = true;
+            refreshConsentExpiry();
+            if (state === "disconnected") {
               this.setState("connected");
             }
-          } catch (error) {
-            if (nominated.id === this.nominated?.id) {
-              log23("no stun response");
-              failures++;
-              this.setState("disconnected");
-              break;
+          }).catch((error) => {
+            if (sessionId === this.consentSessionId && this.nominated?.id === pairId) {
+              log23("no stun response", error);
             }
-          }
-          if (failures >= CONSENT_FAILURES) {
-            log23("Consent to send expired");
-            this.queryConsentHandle = void 0;
-            this.setState("closed");
-            break;
-          }
+          });
         }
       } catch (error) {
+      } finally {
+        if (sessionId === this.consentSessionId) {
+          clearConsentExpiry();
+        }
       }
     });
+    this.queryConsentHandle = handle;
   };
   async close() {
     this.setState("closed");
-    this.queryConsentHandle?.resolve?.();
+    this.stopConsentLifecycle();
     if (this.checkList && !this.checkListDone) {
       this.checkListState.put(
         new Promise((r) => {
@@ -9259,14 +9567,13 @@ var Connection = class {
     this.sortCheckList();
   }
   send = async (data) => {
-    const activePair = this.nominated;
-    if (activePair) {
-      await activePair.protocol.sendData(data, activePair.remoteAddr);
-      activePair.packetsSent++;
-      activePair.bytesSent += data.length;
-    } else {
+    if (!this.canSendApplicationData()) {
       return;
     }
+    const activePair = this.nominated;
+    await activePair.protocol.sendData(data, activePair.remoteAddr);
+    activePair.packetsSent++;
+    activePair.bytesSent += data.length;
   };
   getDefaultCandidate() {
     const candidates = this.localCandidates.sort(
@@ -9305,9 +9612,18 @@ var Connection = class {
     );
     return pair;
   }
+  applyIceControlling(iceControlling) {
+    this._iceControlling = iceControlling;
+    for (const pair of this.checkList) {
+      pair.iceControlling = iceControlling;
+    }
+  }
   switchRole(iceControlling) {
     log23("switch role", iceControlling);
-    this.iceControlling = iceControlling;
+    if (this.iceLite) {
+      iceControlling = false;
+    }
+    this.applyIceControlling(iceControlling);
     this.sortCheckList();
   }
   checkComplete(pair) {
@@ -9319,6 +9635,9 @@ var Connection = class {
         this.nominated = pair;
         this.nominating = false;
         this.pruneTcpConnections(pair);
+        if (!this.iceLite && (this.state === "connected" || this.state === "completed")) {
+          this.queryConsent();
+        }
         for (const p of this.checkList) {
           if (p.component === pair.component && [1 /* WAITING */, 0 /* FROZEN */].includes(
             p.state
@@ -16648,6 +16967,11 @@ var SecureTransportManager = class {
     log36("iceConnectionStateChange", newState);
     this.iceConnectionState = newState;
     this.iceConnectionStateChange.execute(newState);
+    if (newState === "failed" && this.connectionState !== "closed") {
+      this.setConnectionState("failed");
+    } else if (newState === "disconnected" && this.connectionState === "connected") {
+      this.setConnectionState("disconnected");
+    }
   }
   async gatherCandidates(remoteIsBundled) {
     const connected = this.iceTransports.find(
@@ -16664,6 +16988,9 @@ var SecureTransportManager = class {
     }
   }
   setConnectionState(state) {
+    if (this.connectionState === state) {
+      return;
+    }
     log36("connectionStateChange", state);
     this.connectionState = state;
     this.connectionStateChange.execute(state);
@@ -18023,6 +18350,9 @@ export {
   BufferChain,
   CONSENT_FAILURES,
   CONSENT_INTERVAL,
+  CONSENT_RESPONSE_TIMEOUT,
+  CONSENT_RESPONSE_TIMEOUT_MIN,
+  CONSENT_TIMEOUT,
   COOKIE,
   Candidate,
   CandidatePair,
@@ -18178,6 +18508,7 @@ export {
   codecParametersFromString,
   codecParametersToString,
   compactNtp,
+  consentResponseTimeoutMs,
   crc32,
   crc32c,
   createBufferWriter,