@rapidmx/meet-plugin 0.9.2 → 0.10.0

package/dist/apps/meet/_meetApi.d.ts

@@ -14,6 +14,19 @@ export interface PublicVideoMeeting {
     visibility: VideoMeetingVisibility;
     status: VideoMeetingStatus;
     hostDisplayName?: string;
+    /** The account uid that owns the meeting - the sole source of a "host" identity on the client. Absent when the
+     * server can't resolve one (an orphaned mailbox, or a server that predates this field), in which case no host
+     * controls are shown to anyone. */
+    hostUid?: string;
+    /** When `true`, a joining participant's microphone starts muted - see `useLocalMedia`'s `forceMuteOnJoin`
+     * option, which this is threaded into. Absent reads as `false`. */
+    forceMuteOnJoin?: boolean;
+    /** Whether this meeting currently requires a password - never the password or its hash, just whether one is
+     * set. Absent reads as `false`. */
+    hasPassword?: boolean;
+    /** Whether this meeting currently requires the host to admit each participant before they join - see
+     * `requestAdmission()`. Absent reads as `false`. */
+    waitingRoomEnabled?: boolean;
 }
 /**
  * Mirrors `BaseVideoMeetingRoute.ts`'s `VideoMeetingJoinResult`. `authenticated: true` means the visiting browser
@@ -42,6 +55,31 @@ export interface VideoMeetingJoinResult {
      * hosts them (`mail:videoconf:effects:assets_url`). Absent means the public CDN defaults. */
     effectsAssetsUrl?: string;
 }
+/** Mirrors `BaseVideoMeetingRoute.ts`'s `VideoMeetingPasswordRequiredResult` - returned by `joinMeeting()` in place
+ * of a `VideoMeetingJoinResult` when the meeting requires a password that hasn't been submitted yet. Carries only
+ * enough to show a password prompt (the meeting's title/host); nothing here grants anything. Narrow on
+ * `"requiresPassword" in result && result.requiresPassword`. */
+export interface VideoMeetingPasswordRequiredResult {
+    meeting: PublicVideoMeeting;
+    requiresPassword: true;
+}
+/** Mirrors `BaseVideoMeetingRoute.ts`'s `VideoMeetingAdmissionRequiredResult` - returned by `requestAdmission()`
+ * (and re-returned by `pollAdmission()`) while a `waitingRoomEnabled` meeting's admission request is still
+ * pending. Unlike `VideoMeetingPasswordRequiredResult`, this carries `selfUid` (and, for a guest, `token`) - a
+ * caller needs a stable, authenticated identity to poll with. `joinMeeting()` itself also answers this shape, with
+ * none of those fields, when a waiting room applies and no request has been filed yet. Narrow on
+ * `"requiresAdmission" in result`. */
+export interface VideoMeetingAdmissionRequiredResult {
+    meeting: PublicVideoMeeting;
+    requiresAdmission: true;
+    authenticated?: boolean;
+    selfUid?: string;
+    token?: string;
+    expiresAt?: string;
+}
+/** `joinMeeting()`'s actual return type - see `VideoMeetingPasswordRequiredResult`'s and
+ * `VideoMeetingAdmissionRequiredResult`'s own doc comments. */
+export type VideoMeetingJoinResponse = VideoMeetingJoinResult | VideoMeetingPasswordRequiredResult | VideoMeetingAdmissionRequiredResult;
 /** Resolves a join token (an invitee's own link) or a public meeting's slug to its meeting info, ICE servers, and
  * either a short-lived guest signaling token (the common anonymous case) or confirmation that the caller's own
  * existing session already grants them signaling access (`authenticated: true` - see
@@ -50,4 +88,58 @@ export interface VideoMeetingJoinResult {
  * private/public token shape for what it's being used against - the caller (`[token].tsx`) shows a single,
  * friendly "this meeting link isn't valid" state for all of those rather than trying to distinguish them, matching
  * `BaseVideoMeetingRoute.requireMeetingByToken()`'s own explicit "never leak which almost-matched" posture. */
-export declare function joinMeeting(token: string): Promise<VideoMeetingJoinResult>;
+export declare function joinMeeting(token: string): Promise<VideoMeetingJoinResponse>;
+/** Submits a password for a meeting `joinMeeting()` reported `requiresPassword` for. On success, returns an
+ * ordinary granted `VideoMeetingJoinResult` - the same shape and same meaning as `joinMeeting()`'s own non-password
+ * case. Rejects with `ApiRequestError` (status `403`) for a wrong or missing password. */
+export declare function verifyMeetingPassword(token: string, password: string): Promise<VideoMeetingJoinResult>;
+/** Sets, replaces, or removes (`password: null`) the meeting's join password - host only, enforced the same way
+ * as every other owner-side video-meeting update. Hashed server-side; the plaintext is never stored or returned. */
+export declare function setMeetingPassword(meetingUid: string, password: string | null): Promise<void>;
+/** Files an admission request for a meeting `joinMeeting()` reported `requiresAdmission` for - `password` only
+ * when `meeting.hasPassword` is also set (both are checked together on this one call, never in two steps). On
+ * success returns `VideoMeetingAdmissionRequiredResult` with a `selfUid` (and, for a guest, `token`) to poll with
+ * via `pollAdmission()` - nothing is granted yet. Rejects with `ApiRequestError` (status `403`) for a wrong
+ * password, or `400` if `meeting.hasPassword` and no password was given. */
+export declare function requestAdmission(token: string, body: {
+    name: string;
+    password?: string;
+}): Promise<VideoMeetingAdmissionRequiredResult>;
+/** Polls whether the host has responded to a pending admission request - authenticated as whichever identity
+ * `requestAdmission()` (or a previous poll) returned: `guestToken`, when given, is sent as an `Authorization`
+ * header (a guest has no session cookie of their own); omitted for an already-authenticated real caller, whose
+ * existing session cookie already identifies them. Resolves to a granted `VideoMeetingJoinResult` once admitted,
+ * or re-resolves to `VideoMeetingAdmissionRequiredResult` while still pending. Rejects with `ApiRequestError`
+ * (status `403`) once denied, or `404` if this identity never requested admission (or already polled past a final
+ * answer). */
+export declare function pollAdmission(token: string, guestToken?: string): Promise<VideoMeetingJoinResult | VideoMeetingAdmissionRequiredResult>;
+/** One pending admission request, as `listWaitingParticipants()` returns it. */
+export interface WaitingParticipant {
+    uid: string;
+    name: string;
+    requestedAt: string;
+}
+/** Lists a meeting's pending admission requests, oldest first - host only. */
+export declare function listWaitingParticipants(meetingUid: string): Promise<WaitingParticipant[]>;
+/** Admits a pending admission request - host only. The requester's own next `pollAdmission()` call completes
+ * their join; this alone does not notify them of anything. A no-op if `uid` has no pending request. */
+export declare function admitParticipant(meetingUid: string, uid: string): Promise<void>;
+/** Denies a pending admission request - host only. The requester's own next `pollAdmission()` call then rejects
+ * with a 403. A no-op if `uid` has no pending request. */
+export declare function denyParticipant(meetingUid: string, uid: string): Promise<void>;
+/** Sets whether the meeting requires the host to admit each participant (`PublicVideoMeeting.waitingRoomEnabled`) -
+ * host only, enforced the same way as every other owner-side video-meeting update. Takes effect for anyone who
+ * joins (or reloads the join link and joins again) after this call resolves. */
+export declare function setWaitingRoomEnabled(meetingUid: string, waitingRoomEnabled: boolean): Promise<void>;
+/** Removes a participant from the meeting - host only, enforced server-side with the caller's own authenticated
+ * session (the same mailbox-ACL check every other owner-side video-meeting route uses), not by anything the
+ * client claims. Revokes `uid`'s grant on the meeting's own push channel, so they can no longer signal or relay
+ * media even if their client ignores the cooperative "kicked" signal a host's UI sends alongside this
+ * (`MeshConnectionManager.sendKick()`). `uid` is the participant's real account uid (`MeshParticipant.uid` minus
+ * its tab-scoped suffix - see `_CallView.tsx`'s `accountUidOf()`), not their tab-scoped peer id. */
+export declare function kickParticipant(meetingUid: string, uid: string): Promise<void>;
+/** Sets whether a newly joining participant starts muted (`PublicVideoMeeting.forceMuteOnJoin`) - host only,
+ * enforced the same way as every other owner-side video-meeting update. Takes effect for anyone who joins (or
+ * reloads the join link and joins again) after this call resolves; it does not retroactively mute anyone already
+ * in the call - the host's own "Mute" button (see `kickParticipant()`) is the tool for that. */
+export declare function setForceMuteOnJoin(meetingUid: string, forceMuteOnJoin: boolean): Promise<void>;

package/dist/apps/meet/_meetApi.js

@@ -21,3 +21,85 @@ import { apiFetch } from "@rapidmx/web-client/lib/util/api.js";
 export function joinMeeting(token) {
     return apiFetch(`/mail/video-meetings/join/${encodeURIComponent(token)}`);
 }
+/** Submits a password for a meeting `joinMeeting()` reported `requiresPassword` for. On success, returns an
+ * ordinary granted `VideoMeetingJoinResult` - the same shape and same meaning as `joinMeeting()`'s own non-password
+ * case. Rejects with `ApiRequestError` (status `403`) for a wrong or missing password. */
+export function verifyMeetingPassword(token, password) {
+    return apiFetch(`/mail/video-meetings/join/${encodeURIComponent(token)}/verify`, {
+        method: "POST",
+        body: JSON.stringify({ password }),
+    });
+}
+/** Sets, replaces, or removes (`password: null`) the meeting's join password - host only, enforced the same way
+ * as every other owner-side video-meeting update. Hashed server-side; the plaintext is never stored or returned. */
+export function setMeetingPassword(meetingUid, password) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}`, {
+        method: "PUT",
+        body: JSON.stringify({ password }),
+    });
+}
+/** Files an admission request for a meeting `joinMeeting()` reported `requiresAdmission` for - `password` only
+ * when `meeting.hasPassword` is also set (both are checked together on this one call, never in two steps). On
+ * success returns `VideoMeetingAdmissionRequiredResult` with a `selfUid` (and, for a guest, `token`) to poll with
+ * via `pollAdmission()` - nothing is granted yet. Rejects with `ApiRequestError` (status `403`) for a wrong
+ * password, or `400` if `meeting.hasPassword` and no password was given. */
+export function requestAdmission(token, body) {
+    return apiFetch(`/mail/video-meetings/join/${encodeURIComponent(token)}/verify`, {
+        method: "POST",
+        body: JSON.stringify(body),
+    });
+}
+/** Polls whether the host has responded to a pending admission request - authenticated as whichever identity
+ * `requestAdmission()` (or a previous poll) returned: `guestToken`, when given, is sent as an `Authorization`
+ * header (a guest has no session cookie of their own); omitted for an already-authenticated real caller, whose
+ * existing session cookie already identifies them. Resolves to a granted `VideoMeetingJoinResult` once admitted,
+ * or re-resolves to `VideoMeetingAdmissionRequiredResult` while still pending. Rejects with `ApiRequestError`
+ * (status `403`) once denied, or `404` if this identity never requested admission (or already polled past a final
+ * answer). */
+export function pollAdmission(token, guestToken) {
+    return apiFetch(`/mail/video-meetings/join/${encodeURIComponent(token)}/status`, {
+        headers: guestToken ? { Authorization: `jwt ${guestToken}` } : undefined,
+    });
+}
+/** Lists a meeting's pending admission requests, oldest first - host only. */
+export function listWaitingParticipants(meetingUid) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}/waiting`);
+}
+/** Admits a pending admission request - host only. The requester's own next `pollAdmission()` call completes
+ * their join; this alone does not notify them of anything. A no-op if `uid` has no pending request. */
+export function admitParticipant(meetingUid, uid) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}/admit/${encodeURIComponent(uid)}`, { method: "POST" });
+}
+/** Denies a pending admission request - host only. The requester's own next `pollAdmission()` call then rejects
+ * with a 403. A no-op if `uid` has no pending request. */
+export function denyParticipant(meetingUid, uid) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}/deny/${encodeURIComponent(uid)}`, { method: "POST" });
+}
+/** Sets whether the meeting requires the host to admit each participant (`PublicVideoMeeting.waitingRoomEnabled`) -
+ * host only, enforced the same way as every other owner-side video-meeting update. Takes effect for anyone who
+ * joins (or reloads the join link and joins again) after this call resolves. */
+export function setWaitingRoomEnabled(meetingUid, waitingRoomEnabled) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}`, {
+        method: "PUT",
+        body: JSON.stringify({ waitingRoomEnabled }),
+    });
+}
+/** Removes a participant from the meeting - host only, enforced server-side with the caller's own authenticated
+ * session (the same mailbox-ACL check every other owner-side video-meeting route uses), not by anything the
+ * client claims. Revokes `uid`'s grant on the meeting's own push channel, so they can no longer signal or relay
+ * media even if their client ignores the cooperative "kicked" signal a host's UI sends alongside this
+ * (`MeshConnectionManager.sendKick()`). `uid` is the participant's real account uid (`MeshParticipant.uid` minus
+ * its tab-scoped suffix - see `_CallView.tsx`'s `accountUidOf()`), not their tab-scoped peer id. */
+export function kickParticipant(meetingUid, uid) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}/kick/${encodeURIComponent(uid)}`, { method: "POST" });
+}
+/** Sets whether a newly joining participant starts muted (`PublicVideoMeeting.forceMuteOnJoin`) - host only,
+ * enforced the same way as every other owner-side video-meeting update. Takes effect for anyone who joins (or
+ * reloads the join link and joins again) after this call resolves; it does not retroactively mute anyone already
+ * in the call - the host's own "Mute" button (see `kickParticipant()`) is the tool for that. */
+export function setForceMuteOnJoin(meetingUid, forceMuteOnJoin) {
+    return apiFetch(`/mail/video-meetings/${encodeURIComponent(meetingUid)}`, {
+        method: "PUT",
+        body: JSON.stringify({ forceMuteOnJoin }),
+    });
+}

package/dist/apps/shared/media/deviceMedia.d.ts

@@ -36,10 +36,19 @@ export type MediaResult<T> = {
 export declare function defaultMediaDevices(): MediaDevicesLike | undefined;
 /** Whether `devices.getUserMedia` is actually callable - the one capability every caller here needs at minimum. */
 export declare function isMediaDevicesSupported(devices?: MediaDevicesLike | undefined): boolean;
+/** A "no such device" error naming exactly what was missing: just the microphone, just the camera, or - when
+ * both were asked for (or a caller doesn't say, e.g. `listDevices()`/`requestDisplayMedia()`'s own failures, which
+ * have no single "kind" to name) - both. Exported so `useLocalMedia.ts`'s `acquireBoth()` can build the same
+ * "both missing" message after finding out separately that neither device exists, rather than only being able to
+ * report whichever one it happened to ask about last. */
+export declare function notFoundError(wantsAudio: boolean, wantsVideo: boolean): MediaAccessError;
 /** Maps a `getUserMedia()`/`getDisplayMedia()`/`enumerateDevices()` rejection to a friendly, already-complete
  * message - the handful of `DOMException` names a browser actually raises for these calls, matched by name rather
- * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). */
-export declare function classifyMediaError(err: unknown): MediaAccessError;
+ * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). `requested` is the
+ * constraints the failed call actually asked for, so a "not found" error can name just the camera or just the
+ * microphone rather than always blaming both - omitted (by `listDevices()`/`requestDisplayMedia()`, neither of
+ * which asks for one kind specifically) it's treated as having asked for both. */
+export declare function classifyMediaError(err: unknown, requested?: MediaStreamConstraints): MediaAccessError;
 export interface DeviceLists {
     cameras: MediaDeviceInfo[];
     microphones: MediaDeviceInfo[];

package/dist/apps/shared/media/deviceMedia.js

@@ -29,10 +29,26 @@ const UNSUPPORTED_ERROR = {
     kind: "unsupported",
     message: "This browser (or this page's connection) doesn't support camera/microphone access. Try a modern browser over HTTPS.",
 };
+/** A "no such device" error naming exactly what was missing: just the microphone, just the camera, or - when
+ * both were asked for (or a caller doesn't say, e.g. `listDevices()`/`requestDisplayMedia()`'s own failures, which
+ * have no single "kind" to name) - both. Exported so `useLocalMedia.ts`'s `acquireBoth()` can build the same
+ * "both missing" message after finding out separately that neither device exists, rather than only being able to
+ * report whichever one it happened to ask about last. */
+export function notFoundError(wantsAudio, wantsVideo) {
+    const message = wantsAudio && !wantsVideo
+        ? "No microphone was found on this device."
+        : wantsVideo && !wantsAudio
+            ? "No camera was found on this device."
+            : "No camera or microphone was found on this device.";
+    return { kind: "not-found", message };
+}
 /** Maps a `getUserMedia()`/`getDisplayMedia()`/`enumerateDevices()` rejection to a friendly, already-complete
  * message - the handful of `DOMException` names a browser actually raises for these calls, matched by name rather
- * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). */
-export function classifyMediaError(err) {
+ * than `instanceof DOMException` (a test's fake rejection need not be a real `DOMException`). `requested` is the
+ * constraints the failed call actually asked for, so a "not found" error can name just the camera or just the
+ * microphone rather than always blaming both - omitted (by `listDevices()`/`requestDisplayMedia()`, neither of
+ * which asks for one kind specifically) it's treated as having asked for both. */
+export function classifyMediaError(err, requested) {
     const name = err instanceof Error ? err.name : "";
     switch (name) {
         case "NotAllowedError":
@@ -40,7 +56,7 @@ export function classifyMediaError(err) {
             return { kind: "permission-denied", message: "Camera/microphone access was denied. Allow access in your browser and try again." };
         case "NotFoundError":
         case "OverconstrainedError":
-            return { kind: "not-found", message: "No camera or microphone was found on this device." };
+            return notFoundError(requested ? !!requested.audio : true, requested ? !!requested.video : true);
         default:
             return { kind: "unknown", message: "Could not access your camera or microphone. Please try again." };
     }
@@ -78,7 +94,7 @@ export async function requestUserMedia(constraints, devices = defaultMediaDevice
         return { ok: true, value: await devices.getUserMedia(constraints) };
     }
     catch (err) {
-        return { ok: false, error: classifyMediaError(err) };
+        return { ok: false, error: classifyMediaError(err, constraints) };
     }
 }
 /** Requests a screen/window/tab share via the browser's own picker. Audio is never requested (this design shares

package/dist/apps/shared/media/filters/ScreenTransform.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Rotates and/or flips a screen-share track before it's sent, so everyone - the presenter included, since their own
+ * preview is this same processor's output - sees it the right way round, rather than however the browser's own
+ * window/screen capture happened to hand it back. Window capture in particular has a known, driver/compositor-
+ * dependent history of occasionally returning upside-down or sideways frames for a specific captured window; this
+ * is the presenter's own manual correction for that, not an automatic fix (there's no reliable way to detect it
+ * from pixels alone).
+ *
+ * Reuses `VideoFilterProcessor.ts`'s own shape (a hidden `<video>` playing the source track, a canvas redrawn on a
+ * timer, `captureStream()` exposing the result) but far simpler: no models to load, no per-frame throttling to
+ * worry about, just a transform applied on each draw. Entirely independent of the camera pipeline - `useLocalMedia`'s
+ * filters never see the screen-share track, and this never touches the camera's.
+ */
+/** A rotation in degrees clockwise. */
+export type ScreenRotation = 0 | 90 | 180 | 270;
+export interface ScreenTransformState {
+    rotation: ScreenRotation;
+    /** Mirrored left-right, applied before the rotation (so "flip, then turn" - the usual photo-editing order). */
+    flipped: boolean;
+}
+export declare const NO_SCREEN_TRANSFORM: ScreenTransformState;
+/** The next rotation clockwise, wrapping back to 0 after 270. */
+export declare function rotateClockwise(state: ScreenTransformState): ScreenTransformState;
+export interface ScreenTransformDeps {
+    createCanvas(): HTMLCanvasElement;
+    createVideo(): HTMLVideoElement;
+    now(): number;
+}
+export interface ScreenTransformOptions {
+    /** The screen-share track. Only ever read - stopping it stays with whoever owns it (`_CallView.tsx`). */
+    source: MediaStreamTrack;
+    state?: ScreenTransformState;
+    frameRate?: number;
+    deps?: Partial<ScreenTransformDeps>;
+}
+export declare class ScreenTransformProcessor {
+    /** The transformed video - what to send in place of the screen track's own. */
+    readonly track: MediaStreamTrack;
+    private readonly deps;
+    private readonly interval;
+    private readonly video;
+    private readonly canvas;
+    private readonly ctx;
+    private state;
+    private stopped;
+    private timer;
+    constructor(options: ScreenTransformOptions);
+    /** Changes the rotation/flip without interrupting the video. */
+    setState(state: ScreenTransformState): void;
+    stop(): void;
+    private tick;
+    private render;
+}

package/dist/apps/shared/media/filters/ScreenTransform.js

@@ -0,0 +1,100 @@
+///////////////////////////////////////////////////////////////////////////////
+// Copyright (C) 2026 Jean-Philippe Steinmetz. All rights reserved.
+// SPDX-License-Identifier: MPL-2.0
+///////////////////////////////////////////////////////////////////////////////
+/**
+ * Rotates and/or flips a screen-share track before it's sent, so everyone - the presenter included, since their own
+ * preview is this same processor's output - sees it the right way round, rather than however the browser's own
+ * window/screen capture happened to hand it back. Window capture in particular has a known, driver/compositor-
+ * dependent history of occasionally returning upside-down or sideways frames for a specific captured window; this
+ * is the presenter's own manual correction for that, not an automatic fix (there's no reliable way to detect it
+ * from pixels alone).
+ *
+ * Reuses `VideoFilterProcessor.ts`'s own shape (a hidden `<video>` playing the source track, a canvas redrawn on a
+ * timer, `captureStream()` exposing the result) but far simpler: no models to load, no per-frame throttling to
+ * worry about, just a transform applied on each draw. Entirely independent of the camera pipeline - `useLocalMedia`'s
+ * filters never see the screen-share track, and this never touches the camera's.
+ */
+export const NO_SCREEN_TRANSFORM = { rotation: 0, flipped: false };
+/** The next rotation clockwise, wrapping back to 0 after 270. */
+export function rotateClockwise(state) {
+    const next = { 0: 90, 90: 180, 180: 270, 270: 0 };
+    return { ...state, rotation: next[state.rotation] };
+}
+/** Screen share doesn't need the camera's 30fps - matches `VIDEO_FPS`, what the relay's own `VideoSender` already
+ * encodes a shared screen at. */
+const DEFAULT_FRAME_RATE = 15;
+const DEFAULT_DEPS = {
+    createCanvas: () => document.createElement("canvas"),
+    createVideo: () => document.createElement("video"),
+    now: () => performance.now(),
+};
+export class ScreenTransformProcessor {
+    constructor(options) {
+        this.stopped = false;
+        this.tick = () => {
+            if (this.stopped) {
+                return;
+            }
+            const started = this.deps.now();
+            if (this.video.readyState >= 2 && this.video.videoWidth > 0) {
+                this.render();
+            }
+            this.timer = setTimeout(this.tick, Math.max(0, this.interval - (this.deps.now() - started)));
+        };
+        this.deps = { ...DEFAULT_DEPS, ...options.deps };
+        this.state = options.state ?? NO_SCREEN_TRANSFORM;
+        const frameRate = options.frameRate ?? DEFAULT_FRAME_RATE;
+        this.interval = 1000 / frameRate;
+        this.canvas = this.deps.createCanvas();
+        const ctx = this.canvas.getContext("2d");
+        if (!ctx) {
+            throw new Error("This browser can't rotate the shared screen.");
+        }
+        this.ctx = ctx;
+        this.track = this.canvas.captureStream(frameRate).getVideoTracks()[0];
+        this.video = this.deps.createVideo();
+        this.video.muted = true;
+        this.video.playsInline = true;
+        this.video.srcObject = new MediaStream([options.source]);
+        void this.video.play().catch(() => undefined);
+        this.tick();
+    }
+    /** Changes the rotation/flip without interrupting the video. */
+    setState(state) {
+        this.state = state;
+    }
+    stop() {
+        this.stopped = true;
+        clearTimeout(this.timer);
+        this.video.pause();
+        this.video.srcObject = null;
+        this.track.stop();
+    }
+    render() {
+        const { video, canvas, ctx, state } = this;
+        const sourceWidth = video.videoWidth;
+        const sourceHeight = video.videoHeight;
+        // A quarter turn swaps which way is "wide" - the canvas (and so the track everyone actually receives) must
+        // match, or the picture is squashed into the untransformed aspect ratio.
+        const swapped = state.rotation === 90 || state.rotation === 270;
+        const width = swapped ? sourceHeight : sourceWidth;
+        const height = swapped ? sourceWidth : sourceHeight;
+        if (canvas.width !== width || canvas.height !== height) {
+            canvas.width = width;
+            canvas.height = height;
+        }
+        if (state.rotation === 0 && !state.flipped) {
+            ctx.drawImage(video, 0, 0, sourceWidth, sourceHeight);
+            return;
+        }
+        ctx.save();
+        ctx.translate(width / 2, height / 2);
+        ctx.rotate((state.rotation * Math.PI) / 180);
+        if (state.flipped) {
+            ctx.scale(-1, 1);
+        }
+        ctx.drawImage(video, -sourceWidth / 2, -sourceHeight / 2, sourceWidth, sourceHeight);
+        ctx.restore();
+    }
+}

package/dist/apps/shared/media/useLocalMedia.d.ts

@@ -49,5 +49,9 @@ export interface LocalMedia {
 export interface LocalMediaOptions {
     /** Where the filters' models are hosted, when not on the default CDN - see `filters/mlModels.ts`. */
     effectsAssetsUrl?: string;
+    /** The host's `VideoMeeting.forceMuteOnJoin` setting - when `true`, this call's microphone starts muted
+     * regardless of what was remembered from a previous call, overriding (but never overwriting) that preference -
+     * see `ensurePrefs()`. `undefined`/`false` changes nothing. */
+    forceMuteOnJoin?: boolean;
 }
-export declare function useLocalMedia({ effectsAssetsUrl }?: LocalMediaOptions): LocalMedia;
+export declare function useLocalMedia({ effectsAssetsUrl, forceMuteOnJoin }?: LocalMediaOptions): LocalMedia;

package/dist/apps/shared/media/useLocalMedia.js

@@ -32,7 +32,7 @@
  * Nothing here runs during SSR: browser APIs are only touched from effects and event handlers.
  */
 import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
-import { defaultMediaDevices, isMediaDevicesSupported, listDevices, requestUserMedia, } from "./deviceMedia.js";
+import { defaultMediaDevices, isMediaDevicesSupported, listDevices, notFoundError, requestUserMedia, } from "./deviceMedia.js";
 import { startLevelMeter } from "./levelMeter.js";
 import { loadPicture, prepareBackgroundImage } from "./filters/backgroundImage.js";
 import { NO_FILTERS, filtersActive } from "./filters/filterTypes.js";
@@ -55,11 +55,29 @@ function statusFor(error) {
             return "error";
     }
 }
+/** After asking for the camera and the microphone separately (`acquireBoth()`'s fallback, one at a time rather
+ * than together), the one error to show for both attempts together - naming both devices when both are actually
+ * missing, rather than just whichever of the two happened to be asked about last (which would otherwise say "no
+ * camera" even when the microphone is *also* missing, or say nothing at all when only the microphone is missing,
+ * since the camera's own success would otherwise clear the error the microphone's failure had just set). `null`
+ * when both succeeded. */
+function combineErrors(audio, video) {
+    if (!audio || !video) {
+        return audio ?? video;
+    }
+    if (audio.kind === "not-found" && video.kind === "not-found") {
+        return notFoundError(true, true);
+    }
+    // Different reasons - unusual (e.g. permission denied for one, missing hardware for the other). Permission is
+    // the more actionable of the two, so it's what's shown; otherwise there's no single message that honestly
+    // describes both, so this just picks one.
+    return audio.kind === "permission-denied" ? audio : video;
+}
 /** `base`, asking for `preferredId` (the device used last time) when there is one - as a preference, not a demand. */
 function preferring(base, preferredId) {
     return preferredId ? { ...base, deviceId: { ideal: preferredId } } : base;
 }
-export function useLocalMedia({ effectsAssetsUrl } = {}) {
+export function useLocalMedia({ effectsAssetsUrl, forceMuteOnJoin } = {}) {
     const [supported, setSupported] = useState(true);
     const [requesting, setRequesting] = useState(false);
     const [error, setError] = useState(null);
@@ -96,7 +114,7 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
         }
         const prefs = loadPreferences();
         prefsRef.current = prefs;
-        if (prefs.micEnabled === false) {
+        if (prefs.micEnabled === false || forceMuteOnJoin) {
             micEnabledRef.current = false;
             setMicEnabled(false);
         }
@@ -111,7 +129,7 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
             }, () => undefined);
         }
         return prefs;
-    }, [applyBackground, applyFilters]);
+    }, [applyBackground, applyFilters, forceMuteOnJoin]);
     /** Saves a change to the remembered settings. */
     const remember = useCallback((patch) => {
         prefsRef.current = { ...ensurePrefs(), ...patch };
@@ -172,13 +190,13 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
                 setError(result.error);
                 setStatus((prev) => ({ ...prev, [kind]: statusFor(result.error) }));
             }
-            return false;
+            return result.error;
         }
         adoptStream(result.value);
         if (mountedRef.current) {
             setError(null);
         }
-        return true;
+        return null;
     }, [adoptStream, ensurePrefs]);
     /** Asks for the camera and the microphone in a single prompt. */
     const acquireBoth = useCallback(async () => {
@@ -206,9 +224,13 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
         }
         else {
             // No camera, no microphone, or the two together couldn't be satisfied: ask for each on its own, so one
-            // missing device doesn't cost the participant the other.
-            await acquire("audio");
-            await acquire("video");
+            // missing device doesn't cost the participant the other - then combine what each found into one
+            // message (see `combineErrors()`) rather than showing whichever of the two ran last.
+            const audioError = await acquire("audio");
+            const videoError = await acquire("video");
+            if (mountedRef.current) {
+                setError(combineErrors(audioError, videoError));
+            }
         }
     }, [acquire, adoptStream, ensurePrefs]);
     const requestAccess = useCallback(async (kind) => {
@@ -265,7 +287,7 @@ export function useLocalMedia({ effectsAssetsUrl } = {}) {
                 setTracks(tracksRef.current);
             }
         }
-        if (await acquire(kind, deviceId)) {
+        if ((await acquire(kind, deviceId)) === null) {
             remember(kind === "audio" ? { microphoneId: deviceId } : { cameraId: deviceId });
         }
         await refreshDevices();

package/dist/apps/shared/relay/AudioPlayer.d.ts

@@ -10,14 +10,26 @@ export declare const JITTER_BUFFER_SECONDS = 0.08;
 export declare const MAX_AHEAD_SECONDS = 0.4;
 /** Skip a packet instead of queueing it when the decoder is this far behind. */
 export declare const AUDIO_MAX_DECODE_QUEUE = 16;
+/** The length of the fade-in `play()` gives a block that doesn't pick up exactly where the last one left off (the
+ * first block, or the one after a gap) - long enough to mask the click such a discontinuity would otherwise
+ * produce, short enough that it is never heard as an actual fade. */
+export declare const DISCONTINUITY_FADE_SECONDS = 0.004;
 /**
  * Decodes one sender's Opus packets and schedules them for playback into a `MediaStreamAudioDestinationNode`.
  *
  * Each decoded block is copied into an `AudioBuffer` and started on its own `AudioBufferSourceNode` at
  * `max(currentTime + jitter, nextTime)`, where `nextTime` is when the previous block ends - so consecutive blocks
  * join seamlessly, and after a gap in the stream playback restarts with the jitter buffer's worth of headroom.
- * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step;
- * the decoder is created lazily and discarded on any error, and replaced by the next packet.
+ * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step
+ * *in terms of content* - but the shared decoder (reused across packets so it keeps its normal state between them,
+ * not recreated per packet) is never told a packet was skipped, so its internal prediction state no longer matches
+ * what it decodes next. Audibly this can be a click right at that seam, not just silence where the lost packet
+ * would have been - the same is true of the very first block (nothing at all came before it) and of the block
+ * after a stall long enough to need the jitter buffer's full headroom again. `play()` gives exactly those blocks a
+ * few milliseconds' fade-in (`DISCONTINUITY_FADE_SECONDS`) through a `GainNode` to mask it; an ordinary block that
+ * picks up exactly where the last one ended gets none - fading *every* block would itself be audible, a faint
+ * tremolo at the packet rate. The decoder is created lazily and discarded on any error, and replaced by the next
+ * packet.
  */
 export declare class AudioPlayer {
     private readonly env;

package/dist/apps/shared/relay/AudioPlayer.js

@@ -14,14 +14,26 @@ export const JITTER_BUFFER_SECONDS = 0.08;
 export const MAX_AHEAD_SECONDS = 0.4;
 /** Skip a packet instead of queueing it when the decoder is this far behind. */
 export const AUDIO_MAX_DECODE_QUEUE = 16;
+/** The length of the fade-in `play()` gives a block that doesn't pick up exactly where the last one left off (the
+ * first block, or the one after a gap) - long enough to mask the click such a discontinuity would otherwise
+ * produce, short enough that it is never heard as an actual fade. */
+export const DISCONTINUITY_FADE_SECONDS = 0.004;
 /**
  * Decodes one sender's Opus packets and schedules them for playback into a `MediaStreamAudioDestinationNode`.
  *
  * Each decoded block is copied into an `AudioBuffer` and started on its own `AudioBufferSourceNode` at
  * `max(currentTime + jitter, nextTime)`, where `nextTime` is when the previous block ends - so consecutive blocks
  * join seamlessly, and after a gap in the stream playback restarts with the jitter buffer's worth of headroom.
- * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step;
- * the decoder is created lazily and discarded on any error, and replaced by the next packet.
+ * Opus packets are independently decodable, so a lost packet costs only its own 20 ms and needs no recovery step
+ * *in terms of content* - but the shared decoder (reused across packets so it keeps its normal state between them,
+ * not recreated per packet) is never told a packet was skipped, so its internal prediction state no longer matches
+ * what it decodes next. Audibly this can be a click right at that seam, not just silence where the lost packet
+ * would have been - the same is true of the very first block (nothing at all came before it) and of the block
+ * after a stall long enough to need the jitter buffer's full headroom again. `play()` gives exactly those blocks a
+ * few milliseconds' fade-in (`DISCONTINUITY_FADE_SECONDS`) through a `GainNode` to mask it; an ordinary block that
+ * picks up exactly where the last one ended gets none - fading *every* block would itself be audible, a faint
+ * tremolo at the packet rate. The decoder is created lazily and discarded on any error, and replaced by the next
+ * packet.
  */
 export class AudioPlayer {
     /** `destination` is the node whose stream the peer's `MediaStream` carries. */
@@ -87,9 +99,24 @@ export class AudioPlayer {
             buffer.copyToChannel(pcm, 0);
             const source = this.ctx.createBufferSource();
             source.buffer = buffer;
-            source.connect(this.destination);
-            source.onended = () => source.disconnect();
             const start = Math.max(now + JITTER_BUFFER_SECONDS, this.nextTime);
+            if (start > this.nextTime) {
+                // A gap, not a continuation - the decoder's state no longer matches what it's about to decode (see
+                // this class's doc comment), so fade this block in rather than let it start abruptly.
+                const gain = this.ctx.createGain();
+                gain.gain.setValueAtTime(0, start);
+                gain.gain.linearRampToValueAtTime(1, start + DISCONTINUITY_FADE_SECONDS);
+                source.connect(gain);
+                gain.connect(this.destination);
+                source.onended = () => {
+                    source.disconnect();
+                    gain.disconnect();
+                };
+            }
+            else {
+                source.connect(this.destination);
+                source.onended = () => source.disconnect();
+            }
             source.start(start);
             this.nextTime = start + buffer.duration;
         }

package/dist/apps/shared/relay/relayEnv.d.ts

@@ -69,6 +69,11 @@ export interface ScriptProcessorLike extends AudioNodeLike {
 export interface GainLike extends AudioNodeLike {
     gain: {
         value: number;
+        /** `AudioParam.setValueAtTime()` - used to schedule a fade (`AudioPlayer`'s discontinuity fade-in), not
+         * needed for `AudioSender`'s own static, unscheduled mute (a plain `.value = 0` assignment). */
+        setValueAtTime(value: number, startTime: number): unknown;
+        /** `AudioParam.linearRampToValueAtTime()`. */
+        linearRampToValueAtTime(value: number, endTime: number): unknown;
     };
 }
 export interface AudioBufferLike {