@palbase/web 3.0.0 → 4.0.1

package/dist/_mls-wasm.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/messaging/wasm/asset.ts"],"sourcesContent":["import encodedWasm from './pkg/palbe_mls_bg.wasm';\n\n// Built as a private package-import target. Keeping the bytes in their own\n// lazily imported JavaScript module lets browser bundlers carry/split the MLS\n// engine without a public-path convention, while Node ESM and CJS resolve the\n// exact same package-owned bytes.\nexport default encodedWasm;\n"],"mappings":";;;;;;AAMA,IAAO,gBAAQ;","names":[]}

package/dist/{analytics-facade-BOxQ8IP2.d.cts → analytics-facade-DwOtlXPP.d.cts}

@@ -1,4 +1,3 @@
-import { Room, ExternalE2EEKeyProvider } from 'livekit-client';
 import { S as SessionStorageAdapter } from './storage-BPaeSG8K.cjs';
 import { F } from './pooled-flags-4GtDtsiu.js';
 
@@ -533,12 +532,9 @@ declare class Call {
     private readonly _listeners;
     private readonly _room;
     private readonly _keyProvider;
-    /** @internal — obtain via PalbeCalls.start() / .accept() */
-    constructor(callId: string, room: Room, keyProvider: ExternalE2EEKeyProvider);
     get state(): CallState;
     /** Snapshot of current remote participants (does NOT include the local participant). */
     get participants(): readonly CallParticipant[];
-    get localParticipant(): Room['localParticipant'];
     /**
      * Subscribe to call changes (state + participant updates).
      * Returns an `Unsubscribe` function — matches the SDK's flags/auth pattern.
@@ -551,7 +547,7 @@ declare class Call {
     /**
      * Set a raw frame encryption key (ArrayBuffer) for this call.
      * Design seam for SP-1.x web-MLS: call this with the MLS exporter secret
-     * to enable frame-level E2EE via ExternalE2EEKeyProvider.
+     * to enable frame-level E2EE via the media engine's external key provider.
      *
      * NOTE: The room must have been opened with `e2ee` options for this to take
      * effect. Currently calls connect WITHOUT e2ee — see module docstring.
@@ -559,13 +555,13 @@ declare class Call {
      * TODO(SP-1-web): wire this to MLS-derived key on session join.
      */
     setMediaKey(key: ArrayBuffer): Promise<void>;
-    /** Leave the call and disconnect from the LiveKit room. */
+    /** Leave the call and disconnect from the media room. */
     leave(): Promise<void>;
     private _setState;
     private _emit;
     private _upsertParticipant;
     private _attachTrack;
-    private _wireRoomEvents;
+    private _wireMediaEvents;
 }
 declare class PalbeCalls {
     private readonly rt;
@@ -575,9 +571,9 @@ declare class PalbeCalls {
      *
      * @param groupId  - Messaging group display-id (`grp_<uuidv7>`)
      * @param media    - Which media tracks to publish (default: audio + video)
-     * @returns        A `Call` in `connecting` state; transitions to `active` once LiveKit connects.
+     * @returns        A `Call` in `connecting` state; transitions to `active` once the media room connects.
      *
-     * @throws BackendError('network', { code: 'call_service_unavailable' })  if LiveKit SFU is down (503)
+     * @throws BackendError('network', { code: 'call_service_unavailable' })  if the SFU is down (503)
      * @throws BackendError('forbidden', { code: 'not_group_member' })       if the caller is not a member (403)
      * @throws BackendError('conflict', { code: 'call_room_full' })          if the room is full (409)
      */
@@ -920,19 +916,6 @@ interface MentionRange {
     length: number;
     mentionedUserId: string;
 }
-interface ReactionPayload {
-    targetClientMsgId: string;
-    emoji: string;
-    op: 'add' | 'remove';
-}
-interface EditPayload {
-    targetClientMsgId: string;
-    newText: string;
-}
-interface DeletePayload {
-    targetClientMsgId: string;
-    scope: string;
-}
 /** Per-message TTL spec (decoded). senderSendTs present iff start === 'send'. */
 interface ExpirySpec {
     v: number;
@@ -941,51 +924,6 @@ interface ExpirySpec {
     senderSendTs: number | null;
 }
 
-/** A decoded incoming message handed to chat listeners. */
-interface IncomingMessage {
-    kind: 'application' | 'commit' | 'proposal' | 'welcome';
-    group: MessagingGroup;
-    text: string | null;
-    senderDeviceId: string | null;
-    epoch: number;
-    serverSeq: number;
-    receivedAt: Date;
-    /** The client-minted idempotency id from the decoded envelope (empty string for legacy/system). */
-    clientMsgId: string;
-    /** The decoded reply reference, if present in the envelope. */
-    replyRef: ReplyRef | null;
-    /**
-     * The decoded envelope discriminator (`'text'`/`'reaction'`/`'media'`/…).
-     * Defaults to `'text'` at every existing call site — only the reaction branch
-     * sets `'reaction'`, so the Chat can route a reaction into its fold instead of
-     * appending a visible bubble. Optional for forward-compat with old emitters.
-     */
-    envelopeType?: string;
-    /** The decoded reaction payload, present only when `envelopeType === 'reaction'`. */
-    reaction?: ReactionPayload | null;
-    /** The decoded edit payload, present only when `envelopeType === 'edit'`. Lets
-     * the Chat route an edit into its EditFold instead of appending a visible bubble. */
-    edit?: EditPayload | null;
-    /** The decoded delete payload, present only when `envelopeType === 'delete'`. Lets
-     * the Chat route a delete-for-everyone tombstone into its DeleteFold instead of
-     * appending a visible bubble. */
-    delete?: DeletePayload | null;
-    /** The decoded mention ranges (raw, un-normalized). Present on a `'text'` bubble
-     * with `body_ranges` OR on an `'edit'` (the edit's replacement ranges). The Chat
-     * normalizes + resolves roster names → `ChatMessage.mentions` (mentions T6). */
-    bodyRanges?: MentionRange[] | null;
-    /** The decoded `timer_set` payload, present only when `envelopeType === 'timer_set'`
-     * (disappearing T10). Lets the Chat route a chat-default timer into its TimerFold
-     * instead of appending a visible bubble. */
-    timer?: {
-        ttlSeconds: number | null;
-        start: 'send' | 'read';
-    } | null;
-    /** The decoded per-message TTL spec, present only on a `'text'` bubble that carried an
-     * `expiry` (disappearing T10). Lets the Chat arm the message's purge on first display. */
-    expiry?: ExpirySpec | null;
-}
-
 /** The intended participants of a draft chat (held until the first send). */
 interface ChatDraft {
     mode: {
@@ -1163,16 +1101,6 @@ declare class Chat {
      * the SDK guarantees the DECISION, not the buzz. Mirrors iOS `Chat.onMentionElevation`.
      */
     onMentionElevation?: (message: ChatMessage) => void;
-    /** @internal — obtain via pb.messaging.directChat / groupChat / chat(id). */
-    constructor(args: {
-        group: MessagingGroup;
-        kind: ChatKind;
-        backend: ChatBackend;
-    } | {
-        draft: ChatDraft;
-        kind: ChatKind;
-        backend: ChatBackend;
-    });
     /** Subscribe to any change in this chat (messages/members/typing/state). */
     onChange(cb: () => void): Unsubscribe$1;
     private emit;
@@ -1212,8 +1140,6 @@ declare class Chat {
     private loadElevated;
     private hydrateHistory;
     private mergeHistory;
-    /** @internal — called by the backend's live subscription. */
-    ingestLive(incoming: IncomingMessage): Promise<void>;
     /** Normalize a decoded `IncomingMessage.expiry` / `StoredMessage.expiry` into the
      * `ExpirySpec` the arm path consumes (or null when absent). */
     private toExpirySpec;
@@ -1311,8 +1237,6 @@ declare class Chat {
      * history fold) is preserved. PRESERVES reactions + replyTo.
      */
     private applyEditOverlay;
-    /** @internal — called by the backend's conv subscription. */
-    applyConv(event: string, payload: Record<string, unknown>): void;
     private kindOf;
     private internalKey;
     private publicId;
@@ -1628,8 +1552,6 @@ declare class RealtimeChannel {
     /** The app-defined channel name (bare sub-topic, no "realtime:" prefix). */
     readonly name: string;
     private readonly owner;
-    /** @internal — obtain channels via `pb.realtime.channel(name)`. */
-    constructor(name: string, owner: PalbeRealtime);
     /**
      * Subscribe `handler` to `event` on this channel. Fire-and-forget: the
      * join rides the shared socket asynchronously. Hold the returned
@@ -1665,10 +1587,6 @@ declare class PalbeRealtime {
     destroy(): void;
     /** The observable connection status. Safe to read anywhere (reports `idle` until a socket exists). */
     get status(): RealtimeStatus;
-    /** @internal */
-    subscribe(topic: string, event: string, handler: RealtimeHandler): RealtimeSubscription;
-    /** @internal */
-    send(topic: string, event: string, payload: RealtimePayload): void;
     /** Lazily build + start the shared socket on first subscription/send. */
     private ensureSocket;
     private route;

package/dist/{analytics-facade-yfMJ69vw.d.ts → analytics-facade-Nk6J9Ncm.d.ts}

@@ -1,4 +1,3 @@
-import { Room, ExternalE2EEKeyProvider } from 'livekit-client';
 import { S as SessionStorageAdapter } from './storage-BPaeSG8K.js';
 import { F } from './pooled-flags-4GtDtsiu.js';
 
@@ -533,12 +532,9 @@ declare class Call {
     private readonly _listeners;
     private readonly _room;
     private readonly _keyProvider;
-    /** @internal — obtain via PalbeCalls.start() / .accept() */
-    constructor(callId: string, room: Room, keyProvider: ExternalE2EEKeyProvider);
     get state(): CallState;
     /** Snapshot of current remote participants (does NOT include the local participant). */
     get participants(): readonly CallParticipant[];
-    get localParticipant(): Room['localParticipant'];
     /**
      * Subscribe to call changes (state + participant updates).
      * Returns an `Unsubscribe` function — matches the SDK's flags/auth pattern.
@@ -551,7 +547,7 @@ declare class Call {
     /**
      * Set a raw frame encryption key (ArrayBuffer) for this call.
      * Design seam for SP-1.x web-MLS: call this with the MLS exporter secret
-     * to enable frame-level E2EE via ExternalE2EEKeyProvider.
+     * to enable frame-level E2EE via the media engine's external key provider.
      *
      * NOTE: The room must have been opened with `e2ee` options for this to take
      * effect. Currently calls connect WITHOUT e2ee — see module docstring.
@@ -559,13 +555,13 @@ declare class Call {
      * TODO(SP-1-web): wire this to MLS-derived key on session join.
      */
     setMediaKey(key: ArrayBuffer): Promise<void>;
-    /** Leave the call and disconnect from the LiveKit room. */
+    /** Leave the call and disconnect from the media room. */
     leave(): Promise<void>;
     private _setState;
     private _emit;
     private _upsertParticipant;
     private _attachTrack;
-    private _wireRoomEvents;
+    private _wireMediaEvents;
 }
 declare class PalbeCalls {
     private readonly rt;
@@ -575,9 +571,9 @@ declare class PalbeCalls {
      *
      * @param groupId  - Messaging group display-id (`grp_<uuidv7>`)
      * @param media    - Which media tracks to publish (default: audio + video)
-     * @returns        A `Call` in `connecting` state; transitions to `active` once LiveKit connects.
+     * @returns        A `Call` in `connecting` state; transitions to `active` once the media room connects.
      *
-     * @throws BackendError('network', { code: 'call_service_unavailable' })  if LiveKit SFU is down (503)
+     * @throws BackendError('network', { code: 'call_service_unavailable' })  if the SFU is down (503)
      * @throws BackendError('forbidden', { code: 'not_group_member' })       if the caller is not a member (403)
      * @throws BackendError('conflict', { code: 'call_room_full' })          if the room is full (409)
      */
@@ -920,19 +916,6 @@ interface MentionRange {
     length: number;
     mentionedUserId: string;
 }
-interface ReactionPayload {
-    targetClientMsgId: string;
-    emoji: string;
-    op: 'add' | 'remove';
-}
-interface EditPayload {
-    targetClientMsgId: string;
-    newText: string;
-}
-interface DeletePayload {
-    targetClientMsgId: string;
-    scope: string;
-}
 /** Per-message TTL spec (decoded). senderSendTs present iff start === 'send'. */
 interface ExpirySpec {
     v: number;
@@ -941,51 +924,6 @@ interface ExpirySpec {
     senderSendTs: number | null;
 }
 
-/** A decoded incoming message handed to chat listeners. */
-interface IncomingMessage {
-    kind: 'application' | 'commit' | 'proposal' | 'welcome';
-    group: MessagingGroup;
-    text: string | null;
-    senderDeviceId: string | null;
-    epoch: number;
-    serverSeq: number;
-    receivedAt: Date;
-    /** The client-minted idempotency id from the decoded envelope (empty string for legacy/system). */
-    clientMsgId: string;
-    /** The decoded reply reference, if present in the envelope. */
-    replyRef: ReplyRef | null;
-    /**
-     * The decoded envelope discriminator (`'text'`/`'reaction'`/`'media'`/…).
-     * Defaults to `'text'` at every existing call site — only the reaction branch
-     * sets `'reaction'`, so the Chat can route a reaction into its fold instead of
-     * appending a visible bubble. Optional for forward-compat with old emitters.
-     */
-    envelopeType?: string;
-    /** The decoded reaction payload, present only when `envelopeType === 'reaction'`. */
-    reaction?: ReactionPayload | null;
-    /** The decoded edit payload, present only when `envelopeType === 'edit'`. Lets
-     * the Chat route an edit into its EditFold instead of appending a visible bubble. */
-    edit?: EditPayload | null;
-    /** The decoded delete payload, present only when `envelopeType === 'delete'`. Lets
-     * the Chat route a delete-for-everyone tombstone into its DeleteFold instead of
-     * appending a visible bubble. */
-    delete?: DeletePayload | null;
-    /** The decoded mention ranges (raw, un-normalized). Present on a `'text'` bubble
-     * with `body_ranges` OR on an `'edit'` (the edit's replacement ranges). The Chat
-     * normalizes + resolves roster names → `ChatMessage.mentions` (mentions T6). */
-    bodyRanges?: MentionRange[] | null;
-    /** The decoded `timer_set` payload, present only when `envelopeType === 'timer_set'`
-     * (disappearing T10). Lets the Chat route a chat-default timer into its TimerFold
-     * instead of appending a visible bubble. */
-    timer?: {
-        ttlSeconds: number | null;
-        start: 'send' | 'read';
-    } | null;
-    /** The decoded per-message TTL spec, present only on a `'text'` bubble that carried an
-     * `expiry` (disappearing T10). Lets the Chat arm the message's purge on first display. */
-    expiry?: ExpirySpec | null;
-}
-
 /** The intended participants of a draft chat (held until the first send). */
 interface ChatDraft {
     mode: {
@@ -1163,16 +1101,6 @@ declare class Chat {
      * the SDK guarantees the DECISION, not the buzz. Mirrors iOS `Chat.onMentionElevation`.
      */
     onMentionElevation?: (message: ChatMessage) => void;
-    /** @internal — obtain via pb.messaging.directChat / groupChat / chat(id). */
-    constructor(args: {
-        group: MessagingGroup;
-        kind: ChatKind;
-        backend: ChatBackend;
-    } | {
-        draft: ChatDraft;
-        kind: ChatKind;
-        backend: ChatBackend;
-    });
     /** Subscribe to any change in this chat (messages/members/typing/state). */
     onChange(cb: () => void): Unsubscribe$1;
     private emit;
@@ -1212,8 +1140,6 @@ declare class Chat {
     private loadElevated;
     private hydrateHistory;
     private mergeHistory;
-    /** @internal — called by the backend's live subscription. */
-    ingestLive(incoming: IncomingMessage): Promise<void>;
     /** Normalize a decoded `IncomingMessage.expiry` / `StoredMessage.expiry` into the
      * `ExpirySpec` the arm path consumes (or null when absent). */
     private toExpirySpec;
@@ -1311,8 +1237,6 @@ declare class Chat {
      * history fold) is preserved. PRESERVES reactions + replyTo.
      */
     private applyEditOverlay;
-    /** @internal — called by the backend's conv subscription. */
-    applyConv(event: string, payload: Record<string, unknown>): void;
     private kindOf;
     private internalKey;
     private publicId;
@@ -1628,8 +1552,6 @@ declare class RealtimeChannel {
     /** The app-defined channel name (bare sub-topic, no "realtime:" prefix). */
     readonly name: string;
     private readonly owner;
-    /** @internal — obtain channels via `pb.realtime.channel(name)`. */
-    constructor(name: string, owner: PalbeRealtime);
     /**
      * Subscribe `handler` to `event` on this channel. Fire-and-forget: the
      * join rides the shared socket asynchronously. Hold the returned
@@ -1665,10 +1587,6 @@ declare class PalbeRealtime {
     destroy(): void;
     /** The observable connection status. Safe to read anywhere (reports `idle` until a socket exists). */
     get status(): RealtimeStatus;
-    /** @internal */
-    subscribe(topic: string, event: string, handler: RealtimeHandler): RealtimeSubscription;
-    /** @internal */
-    send(topic: string, event: string, payload: RealtimePayload): void;
     /** Lazily build + start the shared socket on first subscription/send. */
     private ensureSocket;
     private route;

package/dist/{chunk-S7NAY3MW.js → chunk-NXEPAEF5.js}

@@ -1,9 +1,3 @@
-var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-
 // src/api-key.ts
 var API_KEY_RE = /^pb_([a-z0-9]+)_[cs][A-Za-z0-9]{20}$/;
 var PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;
@@ -17,8 +11,7 @@ function environmentRefFromPublishableApiKey(apiKey) {
 }
 
 export {
-  __export,
   environmentRefFromApiKey,
   environmentRefFromPublishableApiKey
 };
-//# sourceMappingURL=chunk-S7NAY3MW.js.map
+//# sourceMappingURL=chunk-NXEPAEF5.js.map

package/dist/{chunk-S7NAY3MW.js.map → chunk-NXEPAEF5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/api-key.ts"],"sourcesContent":["/**\n * `pb_<environmentRef>_<scope><random>` → environmentRef ('' if malformed).\n * Utility for callers that only have a raw key. App-bound runtime storage and\n * palbe/next cookie naming use the explicit `PalbeConfig.environmentRef` emitted\n * by `palbe-gen`.\n *\n * The key is shape-validated (prefix `pb`, non-empty environmentRef, and a\n * `<scope><20-base62-random>` secret segment where scope ∈ {c,s}) before a ref\n * is returned. A structurally-invalid key returns '' so session storage stays\n * UNSCOPED rather than getting bound to a partially-parsed ref — a loose parse\n * (e.g. `pb_victim_cXX`) must not scope persisted sessions to `victim` and\n * hydrate a session belonging to a different, real key. The backend remains the\n * authority that rejects a bad key on the first request; this keeps the client's\n * local session-storage scoping honest. (Audit finding apikey-ref-mismatch.)\n */\nconst API_KEY_RE = /^pb_([a-z0-9]+)_[cs][A-Za-z0-9]{20}$/;\nconst PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;\n\nexport function environmentRefFromApiKey(apiKey: string): string {\n  const m = API_KEY_RE.exec(apiKey);\n  return m ? (m[1] ?? '') : '';\n}\n\n/** Internal app-runtime parser: browser config accepts publishable keys only. */\nexport function environmentRefFromPublishableApiKey(apiKey: string): string {\n  const match = PUBLISHABLE_API_KEY_RE.exec(apiKey);\n  return match ? (match[1] ?? '') : '';\n}\n"],"mappings":";;;;;;;AAeA,IAAM,aAAa;AACnB,IAAM,yBAAyB;AAExB,SAAS,yBAAyB,QAAwB;AAC/D,QAAM,IAAI,WAAW,KAAK,MAAM;AAChC,SAAO,IAAK,EAAE,CAAC,KAAK,KAAM;AAC5B;AAGO,SAAS,oCAAoC,QAAwB;AAC1E,QAAM,QAAQ,uBAAuB,KAAK,MAAM;AAChD,SAAO,QAAS,MAAM,CAAC,KAAK,KAAM;AACpC;","names":[]}
+{"version":3,"sources":["../src/api-key.ts"],"sourcesContent":["/**\n * `pb_<environmentRef>_<scope><random>` → environmentRef ('' if malformed).\n * Utility for callers that only have a raw key. App-bound runtime storage and\n * palbe/next cookie naming use the explicit `PalbeConfig.environmentRef` emitted\n * by `palbe-gen`.\n *\n * The key is shape-validated (prefix `pb`, non-empty environmentRef, and a\n * `<scope><20-base62-random>` secret segment where scope ∈ {c,s}) before a ref\n * is returned. A structurally-invalid key returns '' so session storage stays\n * UNSCOPED rather than getting bound to a partially-parsed ref — a loose parse\n * (e.g. `pb_victim_cXX`) must not scope persisted sessions to `victim` and\n * hydrate a session belonging to a different, real key. The backend remains the\n * authority that rejects a bad key on the first request; this keeps the client's\n * local session-storage scoping honest. (Audit finding apikey-ref-mismatch.)\n */\nconst API_KEY_RE = /^pb_([a-z0-9]+)_[cs][A-Za-z0-9]{20}$/;\nconst PUBLISHABLE_API_KEY_RE = /^pb_([a-z0-9]+)_c[A-Za-z0-9]{20}$/;\n\nexport function environmentRefFromApiKey(apiKey: string): string {\n  const m = API_KEY_RE.exec(apiKey);\n  return m ? (m[1] ?? '') : '';\n}\n\n/** Internal app-runtime parser: browser config accepts publishable keys only. */\nexport function environmentRefFromPublishableApiKey(apiKey: string): string {\n  const match = PUBLISHABLE_API_KEY_RE.exec(apiKey);\n  return match ? (match[1] ?? '') : '';\n}\n"],"mappings":";AAeA,IAAM,aAAa;AACnB,IAAM,yBAAyB;AAExB,SAAS,yBAAyB,QAAwB;AAC/D,QAAM,IAAI,WAAW,KAAK,MAAM;AAChC,SAAO,IAAK,EAAE,CAAC,KAAK,KAAM;AAC5B;AAGO,SAAS,oCAAoC,QAAwB;AAC1E,QAAM,QAAQ,uBAAuB,KAAK,MAAM;AAChD,SAAO,QAAS,MAAM,CAAC,KAAK,KAAM;AACpC;","names":[]}

package/dist/chunk-PZ5AY32C.js

@@ -0,0 +1,10 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+export {
+  __export
+};
+//# sourceMappingURL=chunk-PZ5AY32C.js.map

package/dist/chunk-PZ5AY32C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/{chunk-3HVTEZ7N.js → chunk-TGDS6VMT.js}

@@ -1,7 +1,9 @@
 import {
-  __export,
   environmentRefFromPublishableApiKey
-} from "./chunk-S7NAY3MW.js";
+} from "./chunk-NXEPAEF5.js";
+import {
+  __export
+} from "./chunk-PZ5AY32C.js";
 
 // ../core/dist/index.js
 var CACHE_TTL_MS = 5 * 60 * 1e3;
@@ -1735,19 +1737,29 @@ import {
   RoomEvent,
   Track
 } from "livekit-client";
-var Call = class {
+var Call = class _Call {
   id;
   _state = "connecting";
   _participants = /* @__PURE__ */ new Map();
   _listeners = /* @__PURE__ */ new Set();
   _room;
   _keyProvider;
-  /** @internal — obtain via PalbeCalls.start() / .accept() */
+  // PRIVATE constructor + `@internal` factory: the media-engine types (`Room`,
+  // `ExternalE2EEKeyProvider`) appear ONLY on a private constructor and an
+  // `@internal` static factory, both of which `stripInternal` (set in this
+  // package's tsconfig) removes from the emitted public `.d.ts`. So no engine type
+  // ever reaches the public API surface — the same "no engine type in the public
+  // interface" contract the iOS SDK enforces. Consumers obtain a `Call` only
+  // through `pb.calls.start()` / `.accept()`.
   constructor(callId, room, keyProvider) {
     this.id = callId;
     this._room = room;
     this._keyProvider = keyProvider;
-    this._wireRoomEvents();
+    this._wireMediaEvents();
+  }
+  /** @internal — facade-only factory; stripped from the public `.d.ts`. */
+  static _create(callId, room, keyProvider) {
+    return new _Call(callId, room, keyProvider);
   }
   // ─── State ──────────────────────────────────────────────────────────────
   get state() {
@@ -1757,9 +1769,9 @@ var Call = class {
   get participants() {
     return Array.from(this._participants.values());
   }
-  get localParticipant() {
-    return this._room.localParticipant;
-  }
+  // (No `localParticipant` accessor: it would return a raw media-engine participant
+  // object and leak the engine type onto the public API. Local mic/camera control is
+  // exposed engine-agnostically via `mute()` / `setCamera()` below.)
   // ─── Subscribe ──────────────────────────────────────────────────────────
   /**
    * Subscribe to call changes (state + participant updates).
@@ -1783,7 +1795,7 @@ var Call = class {
   /**
    * Set a raw frame encryption key (ArrayBuffer) for this call.
    * Design seam for SP-1.x web-MLS: call this with the MLS exporter secret
-   * to enable frame-level E2EE via ExternalE2EEKeyProvider.
+   * to enable frame-level E2EE via the media engine's external key provider.
    *
    * NOTE: The room must have been opened with `e2ee` options for this to take
    * effect. Currently calls connect WITHOUT e2ee — see module docstring.
@@ -1793,7 +1805,7 @@ var Call = class {
   async setMediaKey(key) {
     await this._keyProvider.setKey(key);
   }
-  /** Leave the call and disconnect from the LiveKit room. */
+  /** Leave the call and disconnect from the media room. */
   async leave() {
     await this._room.disconnect();
     this._setState("ended");
@@ -1835,7 +1847,7 @@ var Call = class {
     }
     this._emit();
   }
-  _wireRoomEvents() {
+  _wireMediaEvents() {
     this._room.on(RoomEvent.Connected, () => {
       this._setState("active");
     }).on(
@@ -1876,9 +1888,9 @@ var PalbeCalls = class {
    *
    * @param groupId  - Messaging group display-id (`grp_<uuidv7>`)
    * @param media    - Which media tracks to publish (default: audio + video)
-   * @returns        A `Call` in `connecting` state; transitions to `active` once LiveKit connects.
+   * @returns        A `Call` in `connecting` state; transitions to `active` once the media room connects.
    *
-   * @throws BackendError('network', { code: 'call_service_unavailable' })  if LiveKit SFU is down (503)
+   * @throws BackendError('network', { code: 'call_service_unavailable' })  if the SFU is down (503)
    * @throws BackendError('forbidden', { code: 'not_group_member' })       if the caller is not a member (403)
    * @throws BackendError('conflict', { code: 'call_room_full' })          if the room is full (409)
    */
@@ -1935,7 +1947,7 @@ var PalbeCalls = class {
       adaptiveStream: true,
       dynacast: true
     });
-    const call = new Call(callId, room, keyProvider);
+    const call = Call._create(callId, room, keyProvider);
     await room.connect(edgeUrl, token);
     if (media.includes("audio")) {
       await room.localParticipant.setMicrophoneEnabled(true);
@@ -6422,26 +6434,25 @@ var GLUE_MODULE = "./palbe_mls_bg.js";
 var SNIPPET_MODULE = "./snippets/mls-rs-core-f99cdecbb456b09c/inline0.js";
 var inflight = null;
 var ready = null;
-async function loadWasmModule() {
-  const wasmUrl = new URL("./pkg/palbe_mls_bg.wasm", import.meta.url);
-  if (wasmUrl.protocol === "file:") {
-    const fsSpecifier = ["node", "fs/promises"].join(":");
-    const { readFile } = await import(
-      /* webpackIgnore: true */
-      fsSpecifier
-    );
-    const bytes = await readFile(wasmUrl);
-    return WebAssembly.compile(bytes);
+function decodeBase64(encoded) {
+  if (typeof encoded !== "string" || encoded.length === 0 || typeof globalThis.atob !== "function") {
+    throw new Error("palbe-mls WASM asset is invalid");
   }
-  const response = await fetch(wasmUrl);
-  if (typeof WebAssembly.compileStreaming === "function") {
-    try {
-      return await WebAssembly.compileStreaming(Promise.resolve(response));
-    } catch {
-    }
+  let binary;
+  try {
+    binary = globalThis.atob(encoded);
+  } catch {
+    throw new Error("palbe-mls WASM asset is invalid");
+  }
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
   }
-  const buffer = await response.arrayBuffer();
-  return WebAssembly.compile(buffer);
+  return bytes.buffer;
+}
+async function loadWasmModule() {
+  const asset = await import("#palbase-mls-wasm");
+  return WebAssembly.compile(decodeBase64(asset.default));
 }
 function buildImports() {
   return {
@@ -6452,7 +6463,7 @@ function buildImports() {
 function initMls() {
   if (ready) return Promise.resolve(ready);
   if (inflight) return inflight;
-  inflight = (async () => {
+  const attempt = (async () => {
     const module2 = await loadWasmModule();
     const instance = await WebAssembly.instantiate(module2, buildImports());
     const setWasm = __wbg_set_wasm;
@@ -6471,7 +6482,11 @@ function initMls() {
     ready = g;
     return g;
   })();
-  return inflight;
+  inflight = attempt;
+  void attempt.catch(() => {
+    if (inflight === attempt) inflight = null;
+  });
+  return attempt;
 }
 function requireMls() {
   if (!ready) {
@@ -8924,7 +8939,7 @@ function defaultSessionStorage(key) {
 }
 
 // src/version.ts
-var VERSION = "3.0.0";
+var VERSION = "4.0.1";
 
 // src/runtime.ts
 function buildRuntime(config) {
@@ -9351,4 +9366,4 @@ export {
   pb,
   createBoundClient
 };
-//# sourceMappingURL=chunk-3HVTEZ7N.js.map
+//# sourceMappingURL=chunk-TGDS6VMT.js.map