Deliver browser call participant roster updates

CHANGELOG.md

@@ -2,16 +2,25 @@
 
 ## Unreleased
 
+- Export typed terminal Calls webhooks. `call.ended` preserves a nullable caller
+  identity for `pod_lost`; `call.telemetry` preserves cumulative traffic values.
+
+- Browser WebRTC calls now receive participant joins, state changes, and
+  departures through the lifecycle stream. Late invitation replies cannot
+  overwrite newer roster state or restore a participant who already left. The
+  TypeScript webhook catalog exports payload types for the same three events.
+
 - Keep call controls and media available after a failed reject or hangup, with
   a localized retry message in React and custom elements.
 
 - Send call rejection without a request body, matching the API contract.
 
-- Refreshed the pinned API contracts and recorded the five implemented
-  programmatic Calls methods. The ledger retains missing QuickLink and
-  Platform methods and removes obsolete widget mappings. Coverage is 226 of
-  402 operations, with 103 missing and 73 excluded; no new SDK methods or
-  package releases are included in this reconciliation.
+- Refreshed the pinned API contracts through the completed Calls and TURN
+  producer changes. The snapshots now include literal webhook event names,
+  nullable terminal-call callers, participant lifecycle events, client-token
+  delegation scopes, and TURN health diagnostics. Coverage remains 226 of 402
+  operations, with 103 missing and 73 excluded; no SDK package release is
+  included in this reconciliation.
 - Added `createBrowserCalls`: direct client-token placement, shared call models
   and lifecycle events connected to the existing WebRTC controller and UI.
   Browser mode auto-answers remotely; Answer attaches local media and Reject

README.md

@@ -6,7 +6,7 @@ The development branch contains the TypeScript server SDK, a framework-neutral
 browser runtime, shared UI contracts, Web Components, React bindings, thin
 Next.js server helpers, and a production-gated developer assistant. It follows
 the Messaging and Platform contracts recorded at source revision
-`3bf3a6ba3de8b19a547afd16fca1f3b368d7d4e7`. Graph-compatible APIs are outside
+`8c244aab0e5626d101a2c8c4915287427f39e014`. Graph-compatible APIs are outside
 this SDK's initial scope.
 
 ## Package architecture
@@ -277,12 +277,11 @@ if (isEvent(event, "message.received")) {
 
 Native deliveries use the hexadecimal `X-Webhook-Signature` value. The helper
 also accepts the `sha256=<hex>` compatibility form. Verification uses
-HMAC-SHA256 and constant-time comparison over the unmodified bytes. Known
-events narrow to exported payload types for all 33 event schemas in the pinned
-Messaging contract, including messages, sessions, groups, presence, contacts,
-chats, calls, labels, history sync, command results, and business quick
-replies. Unknown event names and payloads are preserved for forward
-compatibility.
+HMAC-SHA256 and constant-time comparison over the unmodified bytes. Recognized
+events narrow to exported payload types, including messages, sessions, groups,
+presence, contacts, chats, calls, labels, history sync, command results, and
+business quick replies. Unknown event names and payloads are preserved for
+forward compatibility.
 
 Messaging server credentials can manage webhook registrations through
 `MessagingClient.webhooks`. The Platform contract also defines organization
@@ -368,8 +367,9 @@ and video) or `cloudApi` (the WhatsApp Business Calling API, audio only). Every
 component gates on the snapshot's `capabilities`, never on the line name. The
 controller also owns capture/playback device choice (`setPreferredDevices`,
 `switchDevice`, `refreshDevices`) so a microphone or camera swap mid-call is a
-track replacement, not a renegotiation. The shared call model supports participant invitations. Live roster updates
-are available on programmatic media sockets, not the browser WebRTC path.
+track replacement, not a renegotiation. The shared call model supports
+participant invitations. Browser WebRTC calls receive live participant joins,
+state changes, and departures through the lifecycle stream.
 
 `@polymorfa/react` ships the complete call UI: `CallSurface` (incoming card,
 stage, control dock, and a pop-out window), plus `IncomingCallCard`,

contracts/README.md

@@ -2,7 +2,7 @@
 
 The snapshots are byte-identical copies of the Messaging and Platform OpenAPI
 files at `polymorfa/polymorfa` commit
-`3bf3a6ba3de8b19a547afd16fca1f3b368d7d4e7`. `source.json` records their original
+`8c244aab0e5626d101a2c8c4915287427f39e014`. `source.json` records their original
 paths and SHA-256 hashes. `coverage.json` uses the same source revision.
 
 | Status              | Operations |
@@ -20,8 +20,18 @@ successful live call.
 
 ## Reconciliation
 
-This snapshot adds 22 operations and removes 11 widget operations relative to
-the previous snapshot. The added operations are five implemented Calls
+This refresh adds and removes no operations. Two Messaging operation
+fingerprints changed: browser candidate retrieval remains excluded from the
+server SDK, and `MessagingClient.voip.agentToken` remains covered by its typed
+method and request test. Schema updates include literal webhook event names,
+nullable terminal-call callers, participant lifecycle events, client-token
+delegation scopes, and TURN health diagnostics. These changes do not alter the
+operation coverage totals or the existing missing-operation inventory.
+
+## Previous reconciliation
+
+The previous snapshot added 22 operations and removed 11 widget operations.
+The added operations were five implemented Calls
 operations, ten missing QuickLink operations, and seven Console-only
 operations excluded by their credential contract.
 

contracts/coverage.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceCommit": "3bf3a6ba3de8b19a547afd16fca1f3b368d7d4e7",
+  "sourceCommit": "8c244aab0e5626d101a2c8c4915287427f39e014",
   "excludedContracts": [
     {
       "family": "graph",
@@ -359,7 +359,7 @@
       "method": "GET",
       "path": "/api/voip/calls/{id}/candidates",
       "operationId": "voipCandidates",
-      "fingerprint": "7fe4f817d13b49bf9910a47de56d9cb398d97e15f4573624670a75c94a30a212",
+      "fingerprint": "a0a6899c811800145bd65e05c019c38d68bdffb0b4bb269789ce50baa473021d",
       "typescript": {
         "status": "excluded",
         "reason": "Browser client-token signaling route served by @polymorfa/browser (CallsSignalingClient over BrowserTransport); it does not accept the server credential used by the TypeScript server SDK.",
@@ -1162,7 +1162,7 @@
       "method": "POST",
       "path": "/api/voip/calls/{id}/agent-token",
       "operationId": "voipAgentToken",
-      "fingerprint": "03d4c5cd14a2c755d10ffb96fc7cbeee43b8ccfd7635d5922fdd0a5087d196a3",
+      "fingerprint": "789a8b72ea1c84104018e36eede3e84c52272dc242a0781491e81d4d84703678",
       "typescript": {
         "status": "covered",
         "method": "MessagingClient.voip.agentToken"