@signalwire/js 4.0.0-dev-20260326210326 → 4.0.0-dev-20260401154549

package/dist/index.cjs

@@ -1,4 +1,4 @@
-const require_operators = require('./operators-mm21prWr.cjs');
+const require_operators = require('./operators-DuprVgnV.cjs');
 let jwt_decode = require("jwt-decode");
 let rxjs = require("rxjs");
 let uuid = require("uuid");
@@ -134,7 +134,7 @@ const asyncRetry = async ({ asyncCallable, maxRetries: retries = DEFAULT_MAX_RET
 
 //#endregion
 //#region src/controllers/HTTPRequestController.ts
-const logger$20 = require_operators.getLogger();
+const logger$22 = require_operators.getLogger();
 const GET_PARAMS = {
 	method: "GET",
 	headers: { Accept: "application/json" }
@@ -159,9 +159,16 @@ var HTTPRequestController = class HTTPRequestController {
 	static {
 		this.defaultRequestTimeoutMs = 3e4;
 	}
-	constructor(baseURL, credential, options = {}) {
+	static {
+		this.SENSITIVE_BODY_FIELDS = new Set([
+			"dpop_token",
+			"token",
+			"jwt_token"
+		]);
+	}
+	constructor(baseURL, getCredential, options = {}) {
 		this.baseURL = baseURL;
-		this.credential = credential;
+		this.getCredential = getCredential;
 		this._responses$ = new rxjs.Subject();
 		this._errors$ = new rxjs.Subject();
 		this._status$ = new rxjs.BehaviorSubject("idle");
@@ -190,7 +197,7 @@ var HTTPRequestController = class HTTPRequestController {
 			this._responses$.next(response);
 			return response;
 		} catch (error) {
-			logger$20.error("[HTTPRequestController] Request error:", error);
+			logger$22.error("[HTTPRequestController] Request error:", error);
 			this._status$.next("error");
 			const err = error instanceof Error ? error : new Error("HTTP request failed", { cause: error });
 			this._errors$.next(err);
@@ -217,14 +224,14 @@ var HTTPRequestController = class HTTPRequestController {
 		const url = this.buildURL(request.url);
 		const headers = this.buildHeaders(request.headers);
 		const timeout$3 = request.timeout ?? this.requestTimeout;
-		logger$20.debug("[HTTPRequestController] Executing request:", {
+		logger$22.debug("[HTTPRequestController] Executing request:", {
 			method: request.method,
 			url,
 			headers: Object.keys(headers).reduce((acc, key) => {
 				acc[key] = key === "Authorization" ? `${headers[key].substring(0, 20)}...` : headers[key];
 				return acc;
 			}, {}),
-			body: request.body
+			body: this.sanitizeBody(request.body)
 		});
 		const controller = new AbortController();
 		const timeoutId = setTimeout(() => controller.abort(), timeout$3);
@@ -237,7 +244,7 @@ var HTTPRequestController = class HTTPRequestController {
 			});
 			clearTimeout(timeoutId);
 			const httpResponse = await this.convertResponse(response);
-			logger$20.debug("[HTTPRequestController] Response received:", {
+			logger$22.debug("[HTTPRequestController] Response received:", {
 				status: response.status,
 				statusText: response.statusText,
 				headers: [...response.headers.entries()],
@@ -247,7 +254,7 @@ var HTTPRequestController = class HTTPRequestController {
 		} catch (error) {
 			clearTimeout(timeoutId);
 			if (error instanceof Error && error.name === "AbortError") throw new require_operators.RequestTimeoutError(`Request timeout after ${timeout$3}ms`, { cause: error });
-			logger$20.error("[HTTPRequestController] Request failed:", error);
+			logger$22.error("[HTTPRequestController] Request failed:", error);
 			throw error;
 		}
 	}
@@ -258,12 +265,26 @@ var HTTPRequestController = class HTTPRequestController {
 	}
 	buildHeaders(requestHeaders) {
 		const headers = { ...requestHeaders ?? {} };
-		if (this.credential.token) {
-			headers.Authorization = `Bearer ${this.credential.token}`;
-			logger$20.debug("[HTTPRequestController] Using Bearer token auth, token length:", this.credential.token.length);
-		} else logger$20.warn("[HTTPRequestController] No credentials available for authentication");
+		const credential = this.getCredential();
+		if (credential.token) {
+			headers.Authorization = `Bearer ${credential.token}`;
+			logger$22.debug("[HTTPRequestController] Using Bearer token auth, token length:", credential.token.length);
+		} else logger$22.warn("[HTTPRequestController] No credentials available for authentication");
 		return headers;
 	}
+	/**
+	* Sanitizes a request body for debug logging by masking sensitive fields.
+	*/
+	sanitizeBody(body) {
+		if (!body || typeof body !== "string") return body ? "(non-string body)" : void 0;
+		try {
+			const sanitized = { ...JSON.parse(body) };
+			for (const key of Object.keys(sanitized)) if (HTTPRequestController.SENSITIVE_BODY_FIELDS.has(key) && typeof sanitized[key] === "string") sanitized[key] = `${sanitized[key].substring(0, 20)}...[redacted]`;
+			return JSON.stringify(sanitized);
+		} catch {
+			return body.length > 200 ? `${body.substring(0, 200)}...` : body;
+		}
+	}
 	async convertResponse(response) {
 		const headers = {};
 		response.headers.forEach((value, key) => {
@@ -293,6 +314,25 @@ const DEFAULT_RECONNECT_DELAY_MAX_MS = 3e3;
 const DEFAULT_DEVICE_DEBOUNCE_TIME_MS = 1500;
 const DEFAULT_DEVICE_POLLING_INTERVAL_MS = 0;
 const PREFERENCES_STORAGE_KEY = "sw:preferences";
+/** Scope value that enables automatic token refresh. */
+const SAT_REFRESH_SCOPE = "sat:refresh";
+/** API endpoints for device token operations. */
+const DEVICE_TOKEN_ENDPOINT = "/api/fabric/subscriber/devices/token";
+const DEVICE_REFRESH_ENDPOINT = "/api/fabric/subscriber/devices/refresh";
+/** Default device token TTL in seconds (15 minutes). */
+const DEVICE_TOKEN_DEFAULT_EXPIRE_IN = 900;
+/** Buffer time in milliseconds before expiry to trigger refresh. */
+const DEVICE_TOKEN_REFRESH_BUFFER_MS = 3e4;
+/** Maximum retry attempts for device token refresh on transient failure. */
+const DEVICE_TOKEN_REFRESH_MAX_RETRIES = 3;
+/** Base delay in milliseconds for exponential backoff on refresh retry. */
+const DEVICE_TOKEN_REFRESH_RETRY_BASE_MS = 1e3;
+/** JSON-RPC error code for requester validation failure (corrupted auth state). */
+const RPC_ERROR_REQUESTER_VALIDATION_FAILED = -32003;
+/** JSON-RPC error code for invalid params (e.g., missing authentication block). */
+const RPC_ERROR_INVALID_PARAMS = -32602;
+/** JSON-RPC error code for authentication failure (invalid token, missing DPoP, etc.). */
+const RPC_ERROR_AUTHENTICATION_FAILED = -32002;
 
 //#endregion
 //#region src/utils/time.ts
@@ -305,7 +345,7 @@ function fromMsToSec(milliseconds) {
 
 //#endregion
 //#region src/containers/PreferencesContainer.ts
-const logger$19 = require_operators.getLogger();
+const logger$21 = require_operators.getLogger();
 var PreferencesContainer = class PreferencesContainer {
 	static get instance() {
 		this._instance ??= new PreferencesContainer();
@@ -599,7 +639,7 @@ var ClientPreferences = class {
 		if (!this._storage) return;
 		const data = collectStoredPreferences();
 		this._storage.setItem(PREFERENCES_STORAGE_KEY, data, "local").catch((error) => {
-			logger$19.error(`[ClientPreferences] Failed to save preferences: ${String(error)}`);
+			logger$21.error(`[ClientPreferences] Failed to save preferences: ${String(error)}`);
 		});
 	}
 	/** Loads preferences from storage and applies them to the container. */
@@ -608,14 +648,14 @@ var ClientPreferences = class {
 		this._storage.getItem(PREFERENCES_STORAGE_KEY, "local").then((stored) => {
 			if (stored) applyStoredPreferences(stored);
 		}).catch((error) => {
-			logger$19.error(`[ClientPreferences] Failed to load preferences: ${String(error)}`);
+			logger$21.error(`[ClientPreferences] Failed to load preferences: ${String(error)}`);
 		});
 	}
 };
 
 //#endregion
 //#region src/controllers/NavigatorDeviceController.ts
-const logger$18 = require_operators.getLogger();
+const logger$20 = require_operators.getLogger();
 const initialDevicesState = {
 	audioinput: [],
 	audiooutput: [],
@@ -636,7 +676,7 @@ var NavigatorDeviceController = class extends Destroyable {
 		super();
 		this.webRTCApiProvider = webRTCApiProvider;
 		this.deviceChangeHandler = () => {
-			logger$18.debug("[DeviceController] Device change detected");
+			logger$20.debug("[DeviceController] Device change detected");
 			this.enumerateDevices();
 		};
 		this._devicesState$ = this.createBehaviorSubject(initialDevicesState);
@@ -670,13 +710,13 @@ var NavigatorDeviceController = class extends Destroyable {
 		return this.cachedObservable("videoInputDevices$", () => this._devicesState$.pipe((0, rxjs.map)((state) => state.videoinput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$)));
 	}
 	get selectedAudioInputDevice$() {
-		return this.cachedObservable("selectedAudioInputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.audioinput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$18.debug("[DeviceController] Selected audio input device changed:", info))));
+		return this.cachedObservable("selectedAudioInputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.audioinput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$20.debug("[DeviceController] Selected audio input device changed:", info))));
 	}
 	get selectedAudioOutputDevice$() {
-		return this.cachedObservable("selectedAudioOutputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.audiooutput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$18.debug("[DeviceController] Selected audio output device changed:", info))));
+		return this.cachedObservable("selectedAudioOutputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.audiooutput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$20.debug("[DeviceController] Selected audio output device changed:", info))));
 	}
 	get selectedVideoInputDevice$() {
-		return this.cachedObservable("selectedVideoInputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.videoinput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$18.debug("[DeviceController] Selected video input device changed:", info))));
+		return this.cachedObservable("selectedVideoInputDevice$", () => this._selectedDevicesState$.asObservable().pipe((0, rxjs.map)((state) => state.videoinput), (0, rxjs.distinctUntilChanged)(), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.tap)((info) => logger$20.debug("[DeviceController] Selected video input device changed:", info))));
 	}
 	get selectedAudioInputDevice() {
 		return this._selectedDevicesState$.value.audioinput;
@@ -703,7 +743,7 @@ var NavigatorDeviceController = class extends Destroyable {
 		});
 	}
 	selectVideoInputDevice(device) {
-		logger$18.debug("[DeviceController] Setting selected video input device:", device);
+		logger$20.debug("[DeviceController] Setting selected video input device:", device);
 		this._selectedDevicesState$.next({
 			...this._selectedDevicesState$.value,
 			videoinput: device
@@ -733,7 +773,7 @@ var NavigatorDeviceController = class extends Destroyable {
 		this.disableDeviceMonitoring();
 		this.webRTCApiProvider.mediaDevices.addEventListener("devicechange", this.deviceChangeHandler);
 		if (PreferencesContainer.instance.devicePollingInterval > 0) this._devicesPoolingSubscription = (0, rxjs.interval)(PreferencesContainer.instance.devicePollingInterval).subscribe(() => {
-			logger$18.debug("[DeviceController] Polling devices due to interval");
+			logger$20.debug("[DeviceController] Polling devices due to interval");
 			this.enumerateDevices();
 		});
 		this.enumerateDevices();
@@ -756,13 +796,13 @@ var NavigatorDeviceController = class extends Destroyable {
 				videoinput: []
 			});
 			this._devicesState$.next(devicesByKind);
-			logger$18.debug("[DeviceController] Devices enumerated:", {
+			logger$20.debug("[DeviceController] Devices enumerated:", {
 				audioInputs: devicesByKind.audioinput.length,
 				audioOutputs: devicesByKind.audiooutput.length,
 				videoInputs: devicesByKind.videoinput.length
 			});
 		} catch (error) {
-			logger$18.error("[DeviceController] Failed to enumerate devices:", error);
+			logger$20.error("[DeviceController] Failed to enumerate devices:", error);
 			this._errors$.next(error);
 		}
 	}
@@ -778,7 +818,7 @@ var NavigatorDeviceController = class extends Destroyable {
 			stream.getTracks().forEach((t) => t.stop());
 			return capabilities;
 		} catch (error) {
-			logger$18.error("[DeviceController] Failed to get device capabilities:", error);
+			logger$20.error("[DeviceController] Failed to get device capabilities:", error);
 			this._errors$.next(error);
 			throw error;
 		}
@@ -925,7 +965,7 @@ var DependencyContainer = class {
 		return this._storageManager;
 	}
 	get http() {
-		this._httpRequestController ??= new HTTPRequestController(this._baseURL, this._credential);
+		this._httpRequestController ??= new HTTPRequestController(this._baseURL, () => this._credential);
 		return this._httpRequestController;
 	}
 	get conversationManager() {
@@ -981,7 +1021,6 @@ var DependencyContainer = class {
 	}
 	set credential(credential) {
 		this._credential = credential;
-		this._httpRequestController = void 0;
 	}
 	set storageImpl(storageImpl) {
 		this._storageImpl = storageImpl;
@@ -994,12 +1033,194 @@ var DependencyContainer = class {
 			this._host = ch.substring(0, firstDot);
 			this._domain = ch.substring(firstDot + 1);
 		}
+		this._baseURL = this.apiHost;
+		this._httpRequestController = void 0;
 	}
 	get relayHost() {
 		return `wss://${this._host ?? "puc"}.${this._domain ?? "signalwire.com"}`;
 	}
 	get apiHost() {
-		return `https://${this._host ?? "fabric"}.${this._domain ?? "signalwire.com"}`;
+		return `https://fabric.${this._domain ?? "signalwire.com"}`;
+	}
+};
+
+//#endregion
+//#region src/controllers/CryptoController.ts
+const logger$19 = require_operators.getLogger();
+/**
+* Base64url-encodes an ArrayBuffer (no padding, URL-safe).
+*/
+const base64url = (buffer) => {
+	const bytes = new Uint8Array(buffer);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+/**
+* Base64url-encodes a UTF-8 string.
+*/
+const base64urlEncode = (str) => {
+	return base64url(new TextEncoder().encode(str).buffer);
+};
+/**
+* Computes the JWK Thumbprint per RFC 7638.
+*
+* Only supports RSA keys — the canonical JSON uses lexicographic member ordering: { e, kty, n }.
+* The thumbprint is SHA-256 of the canonical JSON, base64url-encoded.
+*
+* @throws {Error} If the JWK is not an RSA key.
+*/
+const computeJwkThumbprint = async (jwk) => {
+	if (jwk.kty !== "RSA") throw new Error(`Unsupported key type for JWK Thumbprint: ${jwk.kty}. Only RSA is supported.`);
+	const canonical = JSON.stringify({
+		e: jwk.e,
+		kty: jwk.kty,
+		n: jwk.n
+	});
+	return base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonical)));
+};
+/**
+* Controls DPoP (Demonstrating Proof-of-Possession) cryptographic operations.
+*
+* Generates an ephemeral RSA-2048 key pair where the private key is
+* non-extractable, computes the JWK Thumbprint (RFC 7638) as the fingerprint,
+* and creates signed DPoP proof JWTs for both HTTP API requests and
+* WebSocket RPC calls.
+*
+* @example
+* ```typescript
+* const crypto = new CryptoController();
+* await crypto.init();
+*
+* // Get fingerprint for SAT issuance
+* const fingerprint = crypto.fingerprint;
+*
+* // Create proof for HTTP endpoint
+* const httpProof = await crypto.createHttpProof({
+*   method: 'POST',
+*   uri: '/api/fabric/subscriber/devices/token'
+* });
+*
+* // Create proof for RPC call
+* const rpcProof = await crypto.createRpcProof({
+*   method: 'signalwire.connect'
+* });
+* ```
+*/
+var CryptoController = class {
+	constructor() {
+		this._keyPair = null;
+		this._publicJwk = null;
+		this._fingerprint = null;
+		this._initialized = false;
+	}
+	/**
+	* Generates the ephemeral RSA key pair and computes the fingerprint.
+	*
+	* Must be called before any other method. The private key is generated
+	* as non-extractable to prevent accidental exposure.
+	*
+	* @returns The JWK Thumbprint (fingerprint) for the generated key.
+	*/
+	async init() {
+		if (this._initialized) return this.fingerprint;
+		logger$19.debug("[DPoP] Generating ephemeral RSA key pair");
+		this._keyPair = await crypto.subtle.generateKey({
+			name: "RSASSA-PKCS1-v1_5",
+			modulusLength: 2048,
+			publicExponent: new Uint8Array([
+				1,
+				0,
+				1
+			]),
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		this._publicJwk = await crypto.subtle.exportKey("jwk", this._keyPair.publicKey);
+		this._fingerprint = await computeJwkThumbprint(this._publicJwk);
+		this._initialized = true;
+		logger$19.debug("[DPoP] Key pair generated, fingerprint computed");
+		return this._fingerprint;
+	}
+	/**
+	* The JWK Thumbprint (RFC 7638) of the public key.
+	* Used as the `fingerprint` parameter when requesting scoped SATs.
+	*
+	* @throws {DPoPInitError} If {@link init} has not been called.
+	*/
+	get fingerprint() {
+		if (!this._fingerprint) throw new require_operators.DPoPInitError("CryptoController not initialized. Call init() first.");
+		return this._fingerprint;
+	}
+	/**
+	* Whether the controller has been initialized with a key pair.
+	*/
+	get initialized() {
+		return this._initialized;
+	}
+	/**
+	* Creates a DPoP proof JWT for an HTTP API request.
+	*
+	* Used for Prime API endpoints like `/api/fabric/subscriber/devices/token`
+	* and `/api/fabric/subscriber/devices/refresh`.
+	*
+	* @param params - HTTP method and URI for the proof.
+	* @returns Signed DPoP proof JWT string.
+	*/
+	async createHttpProof(params) {
+		const payload = {
+			jti: crypto.randomUUID(),
+			htm: params.method,
+			htu: params.uri,
+			iat: Math.floor(Date.now() / 1e3)
+		};
+		if (params.accessToken) payload.ath = base64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(params.accessToken)));
+		return this.signProof(payload);
+	}
+	/**
+	* Creates a DPoP proof JWT for a WebSocket RPC call.
+	*
+	* Used for switchblade RPC methods like `signalwire.connect` and
+	* `signalwire.reauthenticate`.
+	*
+	* @param params - RPC method name for the proof.
+	* @returns Signed DPoP proof JWT string.
+	*/
+	async createRpcProof(params) {
+		const payload = {
+			jti: crypto.randomUUID(),
+			rpc: "request",
+			mth: params.method,
+			iat: Math.floor(Date.now() / 1e3)
+		};
+		return this.signProof(payload);
+	}
+	/**
+	* Releases the key pair references.
+	* After calling destroy, the controller must be re-initialized to be used again.
+	*/
+	destroy() {
+		this._keyPair = null;
+		this._publicJwk = null;
+		this._fingerprint = null;
+		this._initialized = false;
+		logger$19.debug("[DPoP] Controller destroyed");
+	}
+	get publicJwk() {
+		if (!this._publicJwk) throw new require_operators.DPoPInitError("CryptoController not initialized. Call init() first.");
+		return this._publicJwk;
+	}
+	get privateKey() {
+		if (!this._keyPair) throw new require_operators.DPoPInitError("CryptoController not initialized. Call init() first.");
+		return this._keyPair.privateKey;
+	}
+	async signProof(payload) {
+		const header = {
+			typ: "dpop+jwt",
+			alg: "RS256",
+			jwk: this.publicJwk
+		};
+		const signingInput = `${base64urlEncode(JSON.stringify(header))}.${base64urlEncode(JSON.stringify(payload))}`;
+		return `${signingInput}.${base64url(await crypto.subtle.sign("RSASSA-PKCS1-v1_5", this.privateKey, new TextEncoder().encode(signingInput)))}`;
 	}
 };
 
@@ -1056,6 +1277,7 @@ var Subscriber = class extends Fetchable {
 			scopes: data.app_settings.scopes
 		} : void 0;
 		this.addresses = data.fabric_addresses;
+		this.satClaims = data.sat_claims;
 	}
 };
 
@@ -1095,10 +1317,14 @@ const RPCConnect = (params) => {
 
 //#endregion
 //#region src/core/RPCMessages/RPCReauthenticate.ts
-const RPCReauthenticate = (authentication) => {
+const RPCReauthenticate = (params) => {
+	const { dpop_token, ...authFields } = params;
 	return buildRPCRequest({
 		method: "signalwire.reauthenticate",
-		params: { authentication }
+		params: {
+			authentication: authFields,
+			...dpop_token ? { dpop_token } : {}
+		}
 	});
 };
 
@@ -1194,7 +1420,7 @@ const RPCEventAckResponse = (id) => makeRPCResponse({
 
 //#endregion
 //#region src/managers/AttachManager.ts
-const logger$17 = require_operators.getLogger();
+const logger$18 = require_operators.getLogger();
 var AttachManager = class {
 	constructor(storage, deviceController, reconnectCallsTimeout, attachKey) {
 		this.storage = storage;
@@ -1216,7 +1442,7 @@ var AttachManager = class {
 		try {
 			return await this.storage.getItem(this.attachKey) ?? {};
 		} catch (error) {
-			logger$17.warn("[AttachManager] Failed to retrieve attached calls from storage", error);
+			logger$18.warn("[AttachManager] Failed to retrieve attached calls from storage", error);
 			return {};
 		}
 	}
@@ -1224,12 +1450,12 @@ var AttachManager = class {
 		try {
 			await this.storage.setItem(this.attachKey, attached);
 		} catch (error) {
-			logger$17.warn("[AttachManager] Failed to write attached calls to storage", error);
+			logger$18.warn("[AttachManager] Failed to write attached calls to storage", error);
 		}
 	}
 	async attach(call) {
 		if (!call.to) {
-			logger$17.warn("[AttachManager] Skip attach for calls with no destination");
+			logger$18.warn("[AttachManager] Skip attach for calls with no destination");
 			return;
 		}
 		const attachment = {
@@ -1549,7 +1775,7 @@ function toggleHandraiseMethod(is) {
 
 //#endregion
 //#region src/core/entities/Participant.ts
-const logger$16 = require_operators.getLogger();
+const logger$17 = require_operators.getLogger();
 const initialState = {};
 /**
 * Represents a participant in a call.
@@ -1892,7 +2118,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await this.vertoManager.addScreenMedia();
 		} catch (error) {
-			logger$16.error("[Participant.startScreenShare] Screen share error:", error);
+			logger$17.error("[Participant.startScreenShare] Screen share error:", error);
 		}
 	}
 	/** Observable of the current screen share status. */
@@ -1912,7 +2138,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await this.vertoManager.addInputDevice(options);
 		} catch (error) {
-			logger$16.error("[Participant.startScreenShare] Screen share error:", error);
+			logger$17.error("[Participant.startScreenShare] Screen share error:", error);
 		}
 	}
 	/** Removes an additional media input device by ID. */
@@ -1973,7 +2199,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await super.mute();
 		} catch (error) {
-			logger$16.warn("[Participant.toggleAudioInput] Server Error while muting audio input, proceeding with local toggle anyway", error);
+			logger$17.warn("[Participant.toggleAudioInput] Server Error while muting audio input, proceeding with local toggle anyway", error);
 		} finally {
 			this.vertoManager.muteMainAudioInputDevice();
 		}
@@ -1983,7 +2209,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await super.unmute();
 		} catch (error) {
-			logger$16.warn("[Participant.toggleAudioInput] Server Error while unmuting audio input, proceeding with local toggle anyway", error);
+			logger$17.warn("[Participant.toggleAudioInput] Server Error while unmuting audio input, proceeding with local toggle anyway", error);
 		} finally {
 			await this.vertoManager.unmuteMainAudioInputDevice();
 		}
@@ -1993,7 +2219,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await super.muteVideo();
 		} catch (error) {
-			logger$16.warn("[Participant.toggleVideoInput] Server Error while muting video input, proceeding with local toggle anyway", error);
+			logger$17.warn("[Participant.toggleVideoInput] Server Error while muting video input, proceeding with local toggle anyway", error);
 		} finally {
 			this.vertoManager.muteMainVideoInputDevice();
 		}
@@ -2003,7 +2229,7 @@ var SelfParticipant = class extends Participant {
 		try {
 			await super.unmuteVideo();
 		} catch (error) {
-			logger$16.warn("[Participant.toggleVideoInput] Server Error while unmuting video input, proceeding with local toggle anyway", error);
+			logger$17.warn("[Participant.toggleVideoInput] Server Error while unmuting video input, proceeding with local toggle anyway", error);
 		} finally {
 			await this.vertoManager.unmuteMainVideoInputDevice();
 		}
@@ -2034,6 +2260,7 @@ function isJSONRPCErrorResponse(value) {
 
 //#endregion
 //#region src/core/RPCMessages/guards/events.guards.ts
+/** @internal @packageDocumentation */
 /**
 * Factory function to create Request-level type guards.
 */
@@ -2057,6 +2284,7 @@ const isCallUpdatedRequest = createEventRequestGuard("call.updated");
 const isCallStateRequest = createEventRequestGuard("call.state");
 const isCallPlayRequest = createEventRequestGuard("call.play");
 const isCallConnectRequest = createEventRequestGuard("call.connect");
+const isRoomUpdatedRequest = createEventRequestGuard("room.updated");
 const isMemberUpdatedRequest = createEventRequestGuard("member.updated");
 const isMemberJoinedRequest = createEventRequestGuard("member.joined");
 const isMemberLeftRequest = createEventRequestGuard("member.left");
@@ -2068,7 +2296,7 @@ function isSignalwireMetadata(value) {
 	return isObject(value) && hasProperty(value, "event_type") && typeof value.event_type === "string" && hasProperty(value, "params");
 }
 function isSignalwireCallMetadata(value) {
-	return isSignalwireMetadata(value) && (isCallJoinedMetadata(value) || isCallLeftMetadata(value) || isCallUpdatedMetadata(value) || isCallStateMetadata(value) || isCallPlayMetadata(value) || isCallConnectMetadata(value) || isMemberUpdatedMetadata(value) || isMemberJoinedMetadata(value) || isMemberLeftMetadata(value) || isMemberTalkingMetadata(value) || isLayoutChangedMetadata(value) || isWebrtcMessageMetadata(value) || isConversationMessageMetadata(value) || isConversationMessageUpdatedMetadata(value));
+	return isSignalwireMetadata(value) && (isCallJoinedMetadata(value) || isCallLeftMetadata(value) || isCallUpdatedMetadata(value) || isCallStateMetadata(value) || isCallPlayMetadata(value) || isCallConnectMetadata(value) || isRoomUpdatedMetadata(value) || isMemberUpdatedMetadata(value) || isMemberJoinedMetadata(value) || isMemberLeftMetadata(value) || isMemberTalkingMetadata(value) || isLayoutChangedMetadata(value) || isWebrtcMessageMetadata(value) || isConversationMessageMetadata(value) || isConversationMessageUpdatedMetadata(value));
 }
 const isSignalwireAuthorizationStateMetadata = createEventMetadataGuard("signalwire.authorization.state");
 const isWebrtcMessageMetadata = createEventMetadataGuard("webrtc.message");
@@ -2078,6 +2306,7 @@ const isCallUpdatedMetadata = createEventMetadataGuard("call.updated");
 const isCallStateMetadata = createEventMetadataGuard("call.state");
 const isCallPlayMetadata = createEventMetadataGuard("call.play");
 const isCallConnectMetadata = createEventMetadataGuard("call.connect");
+const isRoomUpdatedMetadata = createEventMetadataGuard("room.updated");
 const isMemberUpdatedMetadata = createEventMetadataGuard("member.updated");
 const isMemberJoinedMetadata = createEventMetadataGuard("member.joined");
 const isMemberLeftMetadata = createEventMetadataGuard("member.left");
@@ -2094,8 +2323,9 @@ function isLayoutChangedPayload(value) {
 
 //#endregion
 //#region src/managers/CallEventsManager.ts
-const logger$15 = require_operators.getLogger();
+const logger$16 = require_operators.getLogger();
 const initialSessionState = {};
+/** @internal */
 var CallEventsManager = class extends Destroyable {
 	constructor(webRtcCallSession, options = {}) {
 		super();
@@ -2197,7 +2427,7 @@ var CallEventsManager = class extends Destroyable {
 	}
 	initSubscriptions() {
 		this.subscribeTo(this.callJoinedEvent$, (callJoinedEvent) => {
-			logger$15.debug("[CallEventsManager] Handling call.joined event for call/session IDs:", {
+			logger$16.debug("[CallEventsManager] Handling call.joined event for call/session IDs:", {
 				callId: callJoinedEvent.call_id,
 				roomSessionId: callJoinedEvent.room_session_id
 			});
@@ -2224,19 +2454,34 @@ var CallEventsManager = class extends Destroyable {
 			if (this._self$.value?.capabilities.setLayout) this.updateLayouts();
 		});
 		this.subscribeTo(this.memberUpdates$, (member) => {
-			logger$15.debug("[CallEventsManager] Handling member update event for member ID:", member);
+			logger$16.debug("[CallEventsManager] Handling member update event for member ID:", member);
 			this.upsertParticipant(member);
 		});
 		this.subscribeTo(this.webRtcCallSession.memberLeft$, (memberLeftEvent) => {
-			logger$15.debug("[CallEventsManager] Handling member.left event for member ID:", memberLeftEvent.member.member_id);
+			logger$16.debug("[CallEventsManager] Handling member.left event for member ID:", memberLeftEvent.member.member_id);
 			const participants = { ...this._participants$.value };
 			if (memberLeftEvent.member.member_id in participants) {
 				delete participants[memberLeftEvent.member.member_id];
 				this._participants$.next(participants);
-			} else logger$15.warn(`[CallEventsManager] Received member.left event for unknown member ID: ${memberLeftEvent.member.member_id}`);
+			} else logger$16.warn(`[CallEventsManager] Received member.left event for unknown member ID: ${memberLeftEvent.member.member_id}`);
+		});
+		this.subscribeTo(this.webRtcCallSession.callUpdated$, (callUpdatedEvent) => {
+			logger$16.debug("[CallEventsManager] Handling call.updated event:", callUpdatedEvent);
+			const roomSession = callUpdatedEvent.room_session;
+			this._sessionState$.next({
+				...this._sessionState$.value,
+				recording: roomSession.recording,
+				recordings: roomSession.recordings,
+				streaming: roomSession.streaming,
+				streams: roomSession.streams,
+				playbacks: roomSession.playbacks,
+				prioritize_handraise: roomSession.prioritize_handraise,
+				locked: roomSession.locked,
+				meta: roomSession.meta
+			});
 		});
 		this.subscribeTo(this.layoutChangedEvent$, (layoutChangedEvent) => {
-			logger$15.debug("[CallEventsManager] Handling layout.changed event:", layoutChangedEvent);
+			logger$16.debug("[CallEventsManager] Handling layout.changed event:", layoutChangedEvent);
 			this._sessionState$.next({
 				...this._sessionState$.value,
 				layout_name: layoutChangedEvent.id,
@@ -2246,7 +2491,7 @@ var CallEventsManager = class extends Destroyable {
 		});
 	}
 	updateParticipantPositions(layoutChangedEvent) {
-		if (Object.keys(this._participants$.value).length > 0 && !layoutChangedEvent.layers.some((layer) => !!layer.member_id)) logger$15.warn("[CallEventsManager] No layers with member_id found in layout.changed event. Nothing to update.");
+		if (Object.keys(this._participants$.value).length > 0 && !layoutChangedEvent.layers.some((layer) => !!layer.member_id)) logger$16.warn("[CallEventsManager] No layers with member_id found in layout.changed event. Nothing to update.");
 		layoutChangedEvent.layers.filter((layer) => Boolean(layer.member_id)).map((layer) => {
 			if (!layer.member_id) throw new require_operators.DependencyError("Layer member_id is required");
 			this._participants$.value[layer.member_id].upnext({ position: layer });
@@ -2267,7 +2512,7 @@ var CallEventsManager = class extends Destroyable {
 				layouts: response.result.layouts
 			});
 		}).catch((error) => {
-			logger$15.error("[CallEventsManager] Error fetching layouts:", error);
+			logger$16.error("[CallEventsManager] Error fetching layouts:", error);
 		});
 	}
 	updateParticipants(members) {
@@ -2283,7 +2528,7 @@ var CallEventsManager = class extends Destroyable {
 		}
 		const participant = this._participants$.value[member.member_id];
 		const oldValue = participant.value;
-		logger$15.debug("[CallEventsManager] Updating participant:", member.member_id, {
+		logger$16.debug("[CallEventsManager] Updating participant:", member.member_id, {
 			oldValue,
 			newValue: member
 		});
@@ -2296,17 +2541,17 @@ var CallEventsManager = class extends Destroyable {
 	}
 	get callJoinedEvent$() {
 		return this.cachedObservable("callJoinedEvent$", () => this.webRtcCallSession.callEvent$.pipe((0, rxjs.filter)(isCallJoinedPayload), (0, rxjs.tap)((event) => {
-			logger$15.debug("[CallEventsManager] Call joined event:", event);
+			logger$16.debug("[CallEventsManager] Call joined event:", event);
 		})));
 	}
 	get layoutChangedEvent$() {
 		return this.cachedObservable("layoutChangedEvent$", () => this.webRtcCallSession.callEvent$.pipe(require_operators.filterAs(isLayoutChangedPayload, "layout"), (0, rxjs.tap)((event) => {
-			logger$15.debug("[CallEventsManager] Layout changed event:", event);
+			logger$16.debug("[CallEventsManager] Layout changed event:", event);
 		})));
 	}
 	get memberUpdates$() {
 		return this.cachedObservable("memberUpdates$", () => (0, rxjs.merge)(this.webRtcCallSession.memberJoined$, this.webRtcCallSession.memberUpdated$, this.webRtcCallSession.memberTalking$).pipe((0, rxjs.map)((event) => event.member), (0, rxjs.tap)((event) => {
-			logger$15.debug("[CallEventsManager] Member update event:", event);
+			logger$16.debug("[CallEventsManager] Member update event:", event);
 		})));
 	}
 	destroy() {
@@ -2414,7 +2659,7 @@ function isValidLocalDescription(sdp) {
 
 //#endregion
 //#region src/controllers/ICEGatheringController.ts
-const logger$14 = require_operators.getLogger();
+const logger$15 = require_operators.getLogger();
 var ICEGatheringController = class extends Destroyable {
 	constructor(peerConnection, peerConnectionControllerNegotiating$, options = {}) {
 		super();
@@ -2422,23 +2667,23 @@ var ICEGatheringController = class extends Destroyable {
 		this.peerConnectionControllerNegotiating$ = peerConnectionControllerNegotiating$;
 		this.onicegatheringstatechangeHandler = () => {
 			const { iceGatheringState } = this.peerConnection;
-			logger$14.debug(`[ICEGatheringController] ICE gathering state changed to: ${iceGatheringState}`);
+			logger$15.debug(`[ICEGatheringController] ICE gathering state changed to: ${iceGatheringState}`);
 			if (iceGatheringState === "gathering") this._iceCandidatesState.next({
 				state: "gathering",
 				validSDP: false
 			});
 		};
 		this.onicecandidateHandler = (event) => {
-			logger$14.debug("[ICEGatheringController] ICE candidate event received:", event.candidate);
+			logger$15.debug("[ICEGatheringController] ICE candidate event received:", event.candidate);
 			this.removeTimer("iceCandidateTimer");
 			if (event.candidate) this.iceCandidateTimer = setTimeout(() => {
 				if (this.peerConnection.iceGatheringState !== "complete") {
-					logger$14.warn("[ICEGatheringController] ICE candidate timeout, using current SDP");
+					logger$15.warn("[ICEGatheringController] ICE candidate timeout, using current SDP");
 					this.handleICECandidateTimeout();
 				}
 			}, this.iceCandidateTimeout);
 			else {
-				logger$14.debug("[ICEGatheringController] ICE gathering completed: null candidate received");
+				logger$15.debug("[ICEGatheringController] ICE gathering completed: null candidate received");
 				this.removeTimer("iceGatheringTimer");
 				this.handleICEGatheringComplete();
 			}
@@ -2456,7 +2701,7 @@ var ICEGatheringController = class extends Destroyable {
 				this.setupEventListeners();
 				this.iceGatheringTimer = setTimeout(() => {
 					if (this.peerConnection.iceGatheringState !== "complete") {
-						logger$14.warn("[ICEGatheringController] ICE gathering timeout, using current SDP");
+						logger$15.warn("[ICEGatheringController] ICE gathering timeout, using current SDP");
 						this.handleICEGatheringTimeout();
 					}
 				}, this.iceGatheringTimeout);
@@ -2483,9 +2728,9 @@ var ICEGatheringController = class extends Destroyable {
 		this.relayOnly = value;
 	}
 	handleICEGatheringComplete() {
-		logger$14.debug("[ICEGatheringController] Handling ICE gathering complete");
-		logger$14.debug(`[ICEGatheringController] Checking ICE gathering state: ${this.peerConnection.iceGatheringState}`);
-		logger$14.debug("[ICEGatheringController] ICE gathering complete");
+		logger$15.debug("[ICEGatheringController] Handling ICE gathering complete");
+		logger$15.debug(`[ICEGatheringController] Checking ICE gathering state: ${this.peerConnection.iceGatheringState}`);
+		logger$15.debug("[ICEGatheringController] ICE gathering complete");
 		this._iceCandidatesState.next({
 			state: "complete",
 			validSDP: this.hasValidLocalDescriptionSDP
@@ -2501,21 +2746,21 @@ var ICEGatheringController = class extends Destroyable {
 		this.removeTimer("iceGatheringTimer");
 		const validSDP = this.hasValidLocalDescriptionSDP;
 		if (validSDP) {
-			logger$14.debug("[ICEGatheringController] Local SDP is valid");
+			logger$15.debug("[ICEGatheringController] Local SDP is valid");
 			this._iceCandidatesState.next({
 				state: "timeout",
 				validSDP
 			});
 			this.stopGathering();
-		} else logger$14.debug("### ICE gathering timeout\n", this.peerConnection.localDescription?.sdp);
+		} else logger$15.debug("### ICE gathering timeout\n", this.peerConnection.localDescription?.sdp);
 	}
 	handleICECandidateTimeout() {
 		if (this.iceCandidateTimer) this.removeTimer("iceCandidateTimer");
-		logger$14.warn("[ICEGatheringController] ICE candidate timeout");
+		logger$15.warn("[ICEGatheringController] ICE candidate timeout");
 		const validSDP = this.hasValidLocalDescriptionSDP;
 		if (!validSDP && !this.relayOnly) this.restartICEGatheringWithRelayOnly();
 		else {
-			logger$14.debug("[ICEGatheringController] Using current SDP due to ICE candidate timeout");
+			logger$15.debug("[ICEGatheringController] Using current SDP due to ICE candidate timeout");
 			this._iceCandidatesState.next({
 				state: "timeout",
 				validSDP
@@ -2524,7 +2769,7 @@ var ICEGatheringController = class extends Destroyable {
 		}
 	}
 	restartICEGatheringWithRelayOnly() {
-		logger$14.debug("[ICEGatheringController] Restarting ICE gathering with relay-only candidates");
+		logger$15.debug("[ICEGatheringController] Restarting ICE gathering with relay-only candidates");
 		this.relayOnly = true;
 		this.peerConnection.setConfiguration({
 			...this.peerConnection.getConfiguration(),
@@ -2532,14 +2777,14 @@ var ICEGatheringController = class extends Destroyable {
 		});
 		if (!(this.peerConnection.connectionState === "connected")) this.peerConnection.restartIce();
 	}
-	removeTimer(timer) {
-		if (this[timer]) {
-			clearTimeout(this[timer]);
-			this[timer] = void 0;
+	removeTimer(timer$1) {
+		if (this[timer$1]) {
+			clearTimeout(this[timer$1]);
+			this[timer$1] = void 0;
 		}
 	}
 	clearAllTimers() {
-		logger$14.debug("[ICEGatheringController] Clearing all timers");
+		logger$15.debug("[ICEGatheringController] Clearing all timers");
 		this.removeTimer("iceGatheringTimer");
 		this.removeTimer("iceCandidateTimer");
 	}
@@ -2548,7 +2793,7 @@ var ICEGatheringController = class extends Destroyable {
 		this.peerConnection.removeEventListener("icecandidate", this.onicecandidateHandler);
 	}
 	destroy() {
-		logger$14.debug("[ICEGatheringController] Destroying ICEGatheringController");
+		logger$15.debug("[ICEGatheringController] Destroying ICEGatheringController");
 		this.clearAllTimers();
 		this.removeEventListeners();
 		super.destroy();
@@ -2557,7 +2802,7 @@ var ICEGatheringController = class extends Destroyable {
 
 //#endregion
 //#region src/controllers/LocalStreamController.ts
-const logger$13 = require_operators.getLogger();
+const logger$14 = require_operators.getLogger();
 var LocalStreamController = class extends Destroyable {
 	constructor(options) {
 		super();
@@ -2595,26 +2840,26 @@ var LocalStreamController = class extends Destroyable {
 	* Build the local media stream based on the provided options.
 	*/
 	async buildLocalStream() {
-		logger$13.debug("[LocalStreamController] Building local media stream.");
+		logger$14.debug("[LocalStreamController] Building local media stream.");
 		let stream;
 		if (this.options.inputAudioStream ?? this.options.inputVideoStream) {
 			const tracks = [...this.options.inputAudioStream?.getTracks() ?? [], ...this.options.inputVideoStream?.getTracks() ?? []];
 			stream = new MediaStream(tracks);
 		} else if (this.options.propose === "screenshare") {
-			logger$13.debug("[LocalStreamController] Requesting display media for screen sharing with audio:", Boolean(this.options.inputAudioDeviceConstraints));
+			logger$14.debug("[LocalStreamController] Requesting display media for screen sharing with audio:", Boolean(this.options.inputAudioDeviceConstraints));
 			stream = await this.options.getDisplayMedia({
 				video: true,
 				audio: Boolean(this.options.inputAudioDeviceConstraints)
 			});
-			logger$13.debug("[LocalStreamController] Screen share media obtained:", stream);
+			logger$14.debug("[LocalStreamController] Screen share media obtained:", stream);
 		} else {
 			const constraints = {
 				audio: this.options.inputAudioDeviceConstraints,
 				video: this.options.inputVideoDeviceConstraints
 			};
-			logger$13.debug("[LocalStreamController] Requesting user media with constraints:", constraints);
+			logger$14.debug("[LocalStreamController] Requesting user media with constraints:", constraints);
 			stream = await this.options.getUserMedia(constraints);
-			logger$13.debug("[LocalStreamController] User media obtained:", stream);
+			logger$14.debug("[LocalStreamController] User media obtained:", stream);
 		}
 		this._localStream$.next(stream);
 		return stream;
@@ -2631,7 +2876,7 @@ var LocalStreamController = class extends Destroyable {
 		this._localStream$.next(localStream);
 		if (track.kind === "video") this._localVideoTracks$.next(localStream.getVideoTracks());
 		else this._localAudioTracks$.next(localStream.getAudioTracks());
-		logger$13.debug(`[LocalStreamController] ${track.kind} track added:`, track.id);
+		logger$14.debug(`[LocalStreamController] ${track.kind} track added:`, track.id);
 		return localStream;
 	}
 	/**
@@ -2643,7 +2888,7 @@ var LocalStreamController = class extends Destroyable {
 		const stream = this._localStream$.value;
 		const track = stream?.getTracks().find((t) => t.id === trackId);
 		if (!track) {
-			logger$13.debug(`[LocalStreamController] track not found: ${trackId}`);
+			logger$14.debug(`[LocalStreamController] track not found: ${trackId}`);
 			return;
 		}
 		track.removeEventListener("ended", this.mediaTrackEndedHandler);
@@ -2652,7 +2897,7 @@ var LocalStreamController = class extends Destroyable {
 		this._localStream$.next(stream);
 		if (track.kind === "video") this._localVideoTracks$.next(stream?.getVideoTracks() ?? []);
 		else this._localAudioTracks$.next(stream?.getAudioTracks() ?? []);
-		logger$13.debug(`[LocalStreamController] ${track.kind} track removed:`, trackId);
+		logger$14.debug(`[LocalStreamController] ${track.kind} track removed:`, trackId);
 		return track;
 	}
 	/**
@@ -2687,7 +2932,7 @@ var LocalStreamController = class extends Destroyable {
 	*/
 	stopAllTracks() {
 		this._localStream$.value?.getTracks().forEach((track) => {
-			logger$13.debug(`[LocalStreamController] Stopping local track: ${track.kind}`);
+			logger$14.debug(`[LocalStreamController] Stopping local track: ${track.kind}`);
 			track.removeEventListener("ended", this.mediaTrackEndedHandler);
 			track.stop();
 		});
@@ -2703,7 +2948,7 @@ var LocalStreamController = class extends Destroyable {
 
 //#endregion
 //#region src/controllers/TransceiverController.ts
-const logger$12 = require_operators.getLogger();
+const logger$13 = require_operators.getLogger();
 const getDirection = (send, recv) => {
 	if (send && recv) return "sendrecv";
 	else if (send && !recv) return "sendonly";
@@ -2805,7 +3050,7 @@ var TransceiverController = class extends Destroyable {
 			sendEncodings: isAudio ? void 0 : this.sendEncodings,
 			streams: direction === "recvonly" ? void 0 : [localStream]
 		};
-		logger$12.debug(`[TransceiverController] Setting up transceiver sender for local ${track.kind} track:`, {
+		logger$13.debug(`[TransceiverController] Setting up transceiver sender for local ${track.kind} track:`, {
 			transceiver,
 			transceiverParams
 		});
@@ -2813,11 +3058,11 @@ var TransceiverController = class extends Destroyable {
 			await transceiver.sender.replaceTrack(track);
 			transceiver.direction = transceiverParams.direction;
 			if (transceiverParams.streams?.some((stream) => Boolean(stream))) {
-				logger$12.debug(`[TransceiverController] Setting streams for transceiver sender for local ${track.kind} track:`, transceiverParams.streams);
+				logger$13.debug(`[TransceiverController] Setting streams for transceiver sender for local ${track.kind} track:`, transceiverParams.streams);
 				transceiver.sender.setStreams(...transceiverParams.streams);
 			}
 		} else {
-			logger$12.debug(`[TransceiverController] Adding new transceiver for local ${track.kind} track:`, track.id);
+			logger$13.debug(`[TransceiverController] Adding new transceiver for local ${track.kind} track:`, track.id);
 			this.peerConnection.addTransceiver(track, transceiverParams);
 		}
 	}
@@ -2831,13 +3076,13 @@ var TransceiverController = class extends Destroyable {
 				if (options.updateTransceiverDirection) transceiver.direction = "inactive";
 			}
 		} catch (error) {
-			logger$12.error("[TransceiverController] stopTrackSender error", kind, error);
+			logger$13.error("[TransceiverController] stopTrackSender error", kind, error);
 			this.options.onError?.(new require_operators.MediaTrackError("stopTrackSender", kind, error));
 		}
 	}
 	async restoreTrackSender(kind) {
 		try {
-			logger$12.debug("[TransceiverController] restoreTrackSender called", kind);
+			logger$13.debug("[TransceiverController] restoreTrackSender called", kind);
 			const constraints = {};
 			const transceivers = this.transceiverByKind(kind);
 			for (const transceiver of transceivers) {
@@ -2847,23 +3092,23 @@ var TransceiverController = class extends Destroyable {
 					if (trackKind === "audio" || trackKind === "video") constraints[trackKind] = this.getConstraintsFor(trackKind);
 				}
 			}
-			logger$12.debug("[TransceiverController] restoreTrackSender constraints:", constraints);
+			logger$13.debug("[TransceiverController] restoreTrackSender constraints:", constraints);
 			if (Object.keys(constraints).length === 0) {
-				logger$12.warn("[TransceiverController] restoreTrackSender: no tracks need restoration", kind);
+				logger$13.warn("[TransceiverController] restoreTrackSender: no tracks need restoration", kind);
 				return;
 			}
 			const newTracks = (await this.options.getUserMedia(constraints)).getTracks();
-			logger$12.debug("[TransceiverController] restoreTrackSender new tracks:", newTracks);
+			logger$13.debug("[TransceiverController] restoreTrackSender new tracks:", newTracks);
 			for (const newTrack of newTracks) {
 				this.options.localStreamController.addTrack(newTrack);
 				const trackKind = newTrack.kind;
 				const transceiverOfKind = this.transceiverByKind(trackKind)[0];
 				transceiverOfKind.direction = trackKind === "audio" ? this.audioDirection : this.videoDirection;
-				logger$12.debug("[TransceiverController] restoreTrackSender setting direction for", trackKind, transceiverOfKind.direction);
+				logger$13.debug("[TransceiverController] restoreTrackSender setting direction for", trackKind, transceiverOfKind.direction);
 				await transceiverOfKind.sender.replaceTrack(newTrack);
 			}
 		} catch (error) {
-			logger$12.error("[TransceiverController] restoreTrackSender error", kind, error);
+			logger$13.error("[TransceiverController] restoreTrackSender error", kind, error);
 			this.options.onError?.(new require_operators.MediaTrackError("restoreTrackSender", kind, error));
 		}
 	}
@@ -2904,10 +3149,10 @@ var TransceiverController = class extends Destroyable {
 				};
 				try {
 					await track.applyConstraints(constraintsToApply);
-					logger$12.debug(`[TransceiverController] Updated ${kind} sender constraints:`, constraintsToApply);
-					logger$12.debug(`[TransceiverController] Updated ${kind} sender constraints:`, track.getConstraints());
+					logger$13.debug(`[TransceiverController] Updated ${kind} sender constraints:`, constraintsToApply);
+					logger$13.debug(`[TransceiverController] Updated ${kind} sender constraints:`, track.getConstraints());
 				} catch (error) {
-					logger$12.warn(`[TransceiverController] Failed to apply constraints to ${kind} track ${track.id}:`, error);
+					logger$13.warn(`[TransceiverController] Failed to apply constraints to ${kind} track ${track.id}:`, error);
 					this.options.onError?.(new require_operators.MediaTrackError("updateSendersConstraints", kind, error));
 				}
 			}
@@ -2941,7 +3186,7 @@ var TransceiverController = class extends Destroyable {
 
 //#endregion
 //#region src/controllers/RTCPeerConnectionController.ts
-const logger$11 = require_operators.getLogger();
+const logger$12 = require_operators.getLogger();
 var RTCPeerConnectionController = class extends Destroyable {
 	constructor(options = {}, remoteSessionDescription, deviceController) {
 		super();
@@ -2957,43 +3202,43 @@ var RTCPeerConnectionController = class extends Destroyable {
 		this.oniceconnectionstatechangeHandler = () => {
 			if (this.peerConnection) {
 				const { iceConnectionState } = this.peerConnection;
-				logger$11.debug(`[RTCPeerConnectionController] ICE connection state changed to: ${iceConnectionState}`);
+				logger$12.debug(`[RTCPeerConnectionController] ICE connection state changed to: ${iceConnectionState}`);
 				this._iceConnectionState$.next(this.peerConnection.iceConnectionState);
 			}
 		};
 		this.onconnectionstatechangeHandler = () => {
 			if (this.peerConnection) {
 				const { connectionState } = this.peerConnection;
-				logger$11.debug(`[RTCPeerConnectionController] Connection state changed to: ${connectionState}`);
+				logger$12.debug(`[RTCPeerConnectionController] Connection state changed to: ${connectionState}`);
 				if (connectionState === "connected") this.removeConnectionTimer();
 				this._connectionState$.next(this.peerConnection.connectionState);
 			}
 		};
 		this.onsignalingstatechangeHandler = () => {
-			logger$11.debug(`[RTCPeerConnectionController] Signaling state changed to: ${this.peerConnection?.signalingState}`);
+			logger$12.debug(`[RTCPeerConnectionController] Signaling state changed to: ${this.peerConnection?.signalingState}`);
 		};
 		this.onicegatheringstatechangeHandler = () => {
 			if (this.peerConnection) this._iceGatheringState$.next(this.peerConnection.iceGatheringState);
 		};
 		this.onnegotiationneededHandler = (event) => {
-			logger$11.debug("[RTCPeerConnectionController] Negotiation needed event received.", event);
+			logger$12.debug("[RTCPeerConnectionController] Negotiation needed event received.", event);
 			this.negotiationNeeded$.next();
 		};
 		this.updateSelectedInputDevice = async (kind, deviceInfo) => {
 			try {
 				const { localStream } = this;
 				if (!localStream) {
-					logger$11.warn("[RTCPeerConnectionController] No local stream available to update input device.");
+					logger$12.warn("[RTCPeerConnectionController] No local stream available to update input device.");
 					return;
 				}
-				logger$11.debug(`[RTCPeerConnectionController] Updating selected ${kind} input device:`, localStream.getTracks());
+				logger$12.debug(`[RTCPeerConnectionController] Updating selected ${kind} input device:`, localStream.getTracks());
 				const track = localStream.getTracks().find((track$1) => track$1.kind === kind);
 				if (track) {
 					this.transceiverController?.stopTrackSender(kind);
 					this.localStream?.removeTrack(track);
-					logger$11.debug(`[RTCPeerConnectionController] Stopped existing ${kind} track: ${track.id}`, localStream.getTracks());
+					logger$12.debug(`[RTCPeerConnectionController] Stopped existing ${kind} track: ${track.id}`, localStream.getTracks());
 					if (!deviceInfo) {
-						logger$11.debug(`[RTCPeerConnectionController] ${kind} input device selected: none`);
+						logger$12.debug(`[RTCPeerConnectionController] ${kind} input device selected: none`);
 						return;
 					}
 					const streamTrack = (await this.getUserMedia({ [kind]: {
@@ -3001,15 +3246,15 @@ var RTCPeerConnectionController = class extends Destroyable {
 						...this.deviceController.deviceInfoToConstraints(deviceInfo)
 					} })).getTracks().find((t) => t.kind === kind);
 					if (streamTrack) {
-						logger$11.debug(`[RTCPeerConnectionController] Adding new ${kind} track: ${streamTrack.id}`);
+						logger$12.debug(`[RTCPeerConnectionController] Adding new ${kind} track: ${streamTrack.id}`);
 						this.localStream?.addTrack(streamTrack);
 						await this.transceiverController?.replaceSenderTrack(kind, streamTrack);
-						logger$11.debug(`[RTCPeerConnectionController] Added new ${kind} track: ${streamTrack.id}`, this.localStream?.getTracks());
+						logger$12.debug(`[RTCPeerConnectionController] Added new ${kind} track: ${streamTrack.id}`, this.localStream?.getTracks());
 					}
 				}
-				logger$11.debug(`[RTCPeerConnectionController] ${kind} input device selected:`, deviceInfo?.label);
+				logger$12.debug(`[RTCPeerConnectionController] ${kind} input device selected:`, deviceInfo?.label);
 			} catch (error) {
-				logger$11.error(`[RTCPeerConnectionController] Failed to select ${kind} input device:`, error);
+				logger$12.error(`[RTCPeerConnectionController] Failed to select ${kind} input device:`, error);
 				this._errors$.next(error);
 				throw error;
 			}
@@ -3238,15 +3483,15 @@ var RTCPeerConnectionController = class extends Destroyable {
 			this.setupPeerConnection();
 			this.subscribeTo(this.negotiationNeeded$.pipe((0, rxjs.auditTime)(0), (0, rxjs.exhaustMap)(async () => this.startNegotiation())), {
 				next: () => {
-					logger$11.debug("[RTCPeerConnectionController] Start Negotiation completed successfully");
+					logger$12.debug("[RTCPeerConnectionController] Start Negotiation completed successfully");
 				},
 				error: (error) => {
-					logger$11.error("[RTCPeerConnectionController] Start Negotiation error:", error);
+					logger$12.error("[RTCPeerConnectionController] Start Negotiation error:", error);
 					this._errors$.next(error);
 				}
 			});
 			this.subscribeTo((0, rxjs.merge)(this.deviceController.selectedAudioInputDevice$.pipe((0, rxjs.map)((deviceInfo) => ["audio", deviceInfo])), this.deviceController.selectedVideoInputDevice$.pipe((0, rxjs.map)((deviceInfo) => ["video", deviceInfo]))).pipe((0, rxjs.skipWhile)(() => !this.localStreamController.localStream)), async ([kind, deviceInfo]) => {
-				logger$11.debug(`[RTCPeerConnectionController] Selected input device changed for:`, {
+				logger$12.debug(`[RTCPeerConnectionController] Selected input device changed for:`, {
 					kind,
 					deviceInfo
 				});
@@ -3263,7 +3508,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 				this._initialized$.next(true);
 			}
 		} catch (error) {
-			logger$11.error("[RTCPeerConnectionController] Initialization error:", error);
+			logger$12.error("[RTCPeerConnectionController] Initialization error:", error);
 			this._errors$.next(error);
 			this.destroy();
 		}
@@ -3295,22 +3540,22 @@ var RTCPeerConnectionController = class extends Destroyable {
 	}
 	async startNegotiation() {
 		if (this.isNegotiating) {
-			logger$11.debug("[RTCPeerConnectionController] Negotiation already in progress, skipping.");
+			logger$12.debug("[RTCPeerConnectionController] Negotiation already in progress, skipping.");
 			return;
 		}
 		this.setupEventListeners();
 		if (this.type === "answer") {
-			logger$11.debug("[RTCPeerConnectionController] This is an answer type still, skipping offer creation.");
+			logger$12.debug("[RTCPeerConnectionController] This is an answer type still, skipping offer creation.");
 			return;
 		}
 		this._isNegotiating$.next(true);
-		logger$11.debug("[RTCPeerConnectionController] Starting negotiation.");
+		logger$12.debug("[RTCPeerConnectionController] Starting negotiation.");
 		try {
 			const { offerOptions } = this;
-			logger$11.debug("[RTCPeerConnectionController] Creating offer with options:", offerOptions);
+			logger$12.debug("[RTCPeerConnectionController] Creating offer with options:", offerOptions);
 			await this.createOffer(offerOptions);
 		} catch (error) {
-			logger$11.error("[RTCPeerConnectionController] Error during negotiation:", error);
+			logger$12.error("[RTCPeerConnectionController] Error during negotiation:", error);
 			this._errors$.next(error);
 		}
 	}
@@ -3326,14 +3571,14 @@ var RTCPeerConnectionController = class extends Destroyable {
 		let readyToConnect = status !== "failed";
 		try {
 			if (status === "received" && sdp) {
-				logger$11.debug("[RTCPeerConnectionController] Received answer SDP:", sdp);
+				logger$12.debug("[RTCPeerConnectionController] Received answer SDP:", sdp);
 				await this._setRemoteDescription({
 					type: "answer",
 					sdp
 				});
 			}
 		} catch (error) {
-			logger$11.error("[RTCPeerConnectionController] Error updating answer status:", error);
+			logger$12.error("[RTCPeerConnectionController] Error updating answer status:", error);
 			this._errors$.next(error);
 			readyToConnect = false;
 		} finally {
@@ -3352,7 +3597,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 				await this.handleOfferReceived();
 				break;
 			case "failed":
-				logger$11.error("[RTCPeerConnectionController] Offer failed to be processed by remote.");
+				logger$12.error("[RTCPeerConnectionController] Offer failed to be processed by remote.");
 				break;
 			case "sent":
 			default:
@@ -3384,7 +3629,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 		}
 		await this.setupLocalTracks();
 		const { answerOptions } = this;
-		logger$11.debug("[RTCPeerConnectionController] Creating inbound answer with options:", answerOptions);
+		logger$12.debug("[RTCPeerConnectionController] Creating inbound answer with options:", answerOptions);
 		await this.createAnswer(answerOptions);
 	}
 	async handleOfferReceived() {
@@ -3392,7 +3637,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 		this._isNegotiating$.next(true);
 		await this._setRemoteDescription(this.sdpInit);
 		const { answerOptions } = this;
-		logger$11.debug("[RTCPeerConnectionController] Creating answer with options:", answerOptions);
+		logger$12.debug("[RTCPeerConnectionController] Creating answer with options:", answerOptions);
 		await this.createAnswer(answerOptions);
 	}
 	readyToConnect() {
@@ -3400,7 +3645,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 		this.connectionTimer = setTimeout(() => {
 			this.removeConnectionTimer();
 			if (this.peerConnection?.connectionState !== "connected") {
-				logger$11.debug("[RTCPeerConnectionController] Connection timeout, restarting ICE gathering with relay only.");
+				logger$12.debug("[RTCPeerConnectionController] Connection timeout, restarting ICE gathering with relay only.");
 				this.iceGatheringController.restartICEGatheringWithRelayOnly();
 			}
 		}, this.connectionTimeout);
@@ -3460,13 +3705,13 @@ var RTCPeerConnectionController = class extends Destroyable {
 		await this.setupRemoteTracks();
 	}
 	async setupLocalTracks() {
-		logger$11.debug("[RTCPeerConnectionController] Setting up local tracks/transceivers.");
+		logger$12.debug("[RTCPeerConnectionController] Setting up local tracks/transceivers.");
 		const localStream = this.localStream ?? await this.localStreamController.buildLocalStream();
 		if (this.transceiverController?.useAddStream ?? false) {
-			logger$11.warn("[RTCPeerConnectionController] Using deprecated addStream API to add local stream.");
+			logger$12.warn("[RTCPeerConnectionController] Using deprecated addStream API to add local stream.");
 			this.peerConnection?.addStream(localStream);
 			if (!this.isNegotiating) {
-				logger$11.debug("[RTCPeerConnectionController] Forcing negotiationneeded after local tracks setup.");
+				logger$12.debug("[RTCPeerConnectionController] Forcing negotiationneeded after local tracks setup.");
 				this.negotiationNeeded$.next();
 			}
 			return;
@@ -3482,7 +3727,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 					const transceivers = (kind === "audio" ? this.transceiverController?.audioTransceivers : this.transceiverController?.videoTransceivers) ?? [];
 					await this.transceiverController?.setupTransceiverSender(track, localStream, transceivers[index]);
 				} else {
-					logger$11.debug(`[RTCPeerConnectionController] Using addTrack for local ${kind} track:`, track.id);
+					logger$12.debug(`[RTCPeerConnectionController] Using addTrack for local ${kind} track:`, track.id);
 					this.peerConnection?.addTrack(track, localStream);
 				}
 			}
@@ -3499,7 +3744,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 	async setupRemoteTracks() {
 		if (!this.peerConnection) throw new require_operators.DependencyError("RTCPeerConnection is not initialized");
 		this.peerConnection.ontrack = (event) => {
-			logger$11.debug("[RTCPeerConnectionController] Remote track received:", event.track.kind);
+			logger$12.debug("[RTCPeerConnectionController] Remote track received:", event.track.kind);
 			if (event.streams[0]) this._remoteStream$.next(event.streams[0]);
 			else {
 				const existingTracks = this._remoteStream$.value?.getTracks() ?? [];
@@ -3525,9 +3770,9 @@ var RTCPeerConnectionController = class extends Destroyable {
 		try {
 			const localStream = this.localStreamController.addTrack(track);
 			this.peerConnection.addTrack(track, localStream);
-			logger$11.debug(`[RTCPeerConnectionController] ${track.kind} track added:`, track.id);
+			logger$12.debug(`[RTCPeerConnectionController] ${track.kind} track added:`, track.id);
 		} catch (error) {
-			logger$11.error(`[RTCPeerConnectionController] Failed to add ${track.kind} track:`, error);
+			logger$12.error(`[RTCPeerConnectionController] Failed to add ${track.kind} track:`, error);
 			this._errors$.next(error);
 			throw error;
 		}
@@ -3544,15 +3789,15 @@ var RTCPeerConnectionController = class extends Destroyable {
 		}
 		const sender = this.peerConnection.getSenders().find((sender$1) => sender$1.track?.id === trackId);
 		if (!sender) {
-			logger$11.debug(`[RTCPeerConnectionController] track not found: ${trackId}`);
+			logger$12.debug(`[RTCPeerConnectionController] track not found: ${trackId}`);
 			return;
 		}
 		try {
 			this.peerConnection.removeTrack(sender);
 			this.localStreamController.removeTrack(trackId);
-			logger$11.debug(`[RTCPeerConnectionController] ${sender.track?.kind} track removed:`, trackId);
+			logger$12.debug(`[RTCPeerConnectionController] ${sender.track?.kind} track removed:`, trackId);
 		} catch (error) {
-			logger$11.error(`[RTCPeerConnectionController] Failed to remove ${sender.track?.kind} track:`, error);
+			logger$12.error(`[RTCPeerConnectionController] Failed to remove ${sender.track?.kind} track:`, error);
 			this._errors$.next(error);
 			throw error;
 		}
@@ -3575,7 +3820,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 	* Completes all observables to prevent memory leaks.
 	*/
 	destroy() {
-		logger$11.debug(`[RTCPeerConnectionController] Destroying RTCPeerConnectionController. ${this.propose}`);
+		logger$12.debug(`[RTCPeerConnectionController] Destroying RTCPeerConnectionController. ${this.propose}`);
 		this.removeConnectionTimer();
 		this._iceGatheringController?.destroy();
 		this.localStreamController.destroy();
@@ -3599,7 +3844,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 	}
 	stopRemoteTracks() {
 		this._remoteStream$.value?.getTracks().forEach((track) => {
-			logger$11.debug(`[RTCPeerConnectionController] Stopping remote track: ${track.kind}`);
+			logger$12.debug(`[RTCPeerConnectionController] Stopping remote track: ${track.kind}`);
 			track.stop();
 		});
 	}
@@ -3616,7 +3861,7 @@ var RTCPeerConnectionController = class extends Destroyable {
 			...params,
 			sdp: finalRemote
 		};
-		logger$11.debug("[RTCPeerConnectionController] Setting remote description:", answer);
+		logger$12.debug("[RTCPeerConnectionController] Setting remote description:", answer);
 		return this.peerConnection.setRemoteDescription(answer);
 	}
 };
@@ -3654,7 +3899,7 @@ function isVertoPingInnerParams(value) {
 
 //#endregion
 //#region src/managers/VertoManager.ts
-const logger$10 = require_operators.getLogger();
+const logger$11 = require_operators.getLogger();
 var VertoManager = class extends Destroyable {
 	constructor(callSession) {
 		super();
@@ -3692,7 +3937,7 @@ var WebRTCVertoManager = class extends VertoManager {
 		try {
 			await this.executeVerto(vertoModifyMessage);
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Call might already be disconnected, error sending Verto hold:", error);
+			logger$11.warn("[WebRTCManager] Call might already be disconnected, error sending Verto hold:", error);
 			throw error;
 		}
 	}
@@ -3705,7 +3950,7 @@ var WebRTCVertoManager = class extends VertoManager {
 		try {
 			await this.executeVerto(vertoModifyMessage);
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Call might already be disconnected, error sending Verto unhold:", error);
+			logger$11.warn("[WebRTCManager] Call might already be disconnected, error sending Verto unhold:", error);
 			throw error;
 		}
 	}
@@ -3758,7 +4003,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			if (event.member_id) this.setSelfIdIfNull(event.member_id);
 		});
 		this.subscribeTo(this.vertoMedia$, (event) => {
-			logger$10.debug("[WebRTCManager] Received Verto media event (early media SDP):", event);
+			logger$11.debug("[WebRTCManager] Received Verto media event (early media SDP):", event);
 			this._signalingStatus$.next("ringing");
 			const { sdp, callID } = event;
 			this._rtcPeerConnectionsMap.get(callID)?.updateAnswerStatus({
@@ -3767,7 +4012,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			});
 		});
 		this.subscribeTo(this.vertoAnswer$, (event) => {
-			logger$10.debug("[WebRTCManager] Received Verto answer event:", event);
+			logger$11.debug("[WebRTCManager] Received Verto answer event:", event);
 			this._signalingStatus$.next("connecting");
 			const { sdp, callID } = event;
 			this._rtcPeerConnectionsMap.get(callID)?.updateAnswerStatus({
@@ -3776,7 +4021,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			});
 		});
 		this.subscribeTo(this.vertoMediaParams$, (event) => {
-			logger$10.debug("[WebRTCManager] Received Verto mediaParams event:", event);
+			logger$11.debug("[WebRTCManager] Received Verto mediaParams event:", event);
 			const { mediaParams, callID } = event;
 			const rtcPeerConnController = this._rtcPeerConnectionsMap.get(callID);
 			const { audio, video } = mediaParams;
@@ -3800,13 +4045,13 @@ var WebRTCVertoManager = class extends VertoManager {
 	*/
 	setNodeIdIfNull(nodeId) {
 		if (!this._nodeId$.value && nodeId) {
-			logger$10.debug(`[WebRTCManager] Early node_id set: ${nodeId}`);
+			logger$11.debug(`[WebRTCManager] Early node_id set: ${nodeId}`);
 			this._nodeId$.next(nodeId);
 		}
 	}
 	setSelfIdIfNull(selfId) {
 		if (!this._selfId$.value && selfId) {
-			logger$10.debug(`[WebRTCManager] Early selfId set: ${selfId}`);
+			logger$11.debug(`[WebRTCManager] Early selfId set: ${selfId}`);
 			this._selfId$.next(selfId);
 		}
 	}
@@ -3815,7 +4060,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			const vertoPongMessage = VertoPong({ ...vertoPing });
 			await this.executeVerto(vertoPongMessage);
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Call might disconnect, error sending Verto pong:", error);
+			logger$11.warn("[WebRTCManager] Call might disconnect, error sending Verto pong:", error);
 			this.onError?.(new require_operators.VertoPongError(error));
 		}
 	}
@@ -3825,7 +4070,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			if (audio) await this.mainPeerConnection.updateSendersConstraints("audio", audio);
 			if (video) await this.mainPeerConnection.updateSendersConstraints("video", video);
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Error updating media constraints:", error);
+			logger$11.warn("[WebRTCManager] Error updating media constraints:", error);
 			this.onError?.(error instanceof Error ? error : new Error(String(error), { cause: error }));
 			throw error;
 		}
@@ -3890,7 +4135,7 @@ var WebRTCVertoManager = class extends VertoManager {
 				default:
 			}
 		} catch (error) {
-			logger$10.error(`[WebRTCManager] Error sending Verto ${vertoMethod}:`, error);
+			logger$11.error(`[WebRTCManager] Error sending Verto ${vertoMethod}:`, error);
 			this.onError?.(error instanceof Error ? error : new Error(String(error), { cause: error }));
 		}
 	}
@@ -3904,7 +4149,7 @@ var WebRTCVertoManager = class extends VertoManager {
 					sdp
 				});
 			} catch (error) {
-				logger$10.warn("[WebRTCManager] Error processing modify response:", error);
+				logger$11.warn("[WebRTCManager] Error processing modify response:", error);
 				const modifyError = error instanceof Error ? error : new Error(String(error), { cause: error });
 				this.onError?.(modifyError);
 			}
@@ -3916,7 +4161,7 @@ var WebRTCVertoManager = class extends VertoManager {
 			this._nodeId$.next(require_operators.getValueFrom(response, "result.node_id") ?? null);
 			const memberId = require_operators.getValueFrom(response, "result.result.result.memberID") ?? null;
 			const callId = require_operators.getValueFrom(response, "result.result.result.callID") ?? null;
-			logger$10.debug("[WebRTCManager] Verto invite response:", {
+			logger$11.debug("[WebRTCManager] Verto invite response:", {
 				callId,
 				memberId,
 				response
@@ -3925,10 +4170,10 @@ var WebRTCVertoManager = class extends VertoManager {
 			rtcPeerConnController.setMemberId(memberId);
 			if (callId) this.webRtcCallSession.addCallId(callId);
 			this.attachManager.attach(this.webRtcCallSession);
-			logger$10.info("[WebRTCManager] Verto invite successful");
-			logger$10.debug(`[WebRTCManager] nodeid: ${this._nodeId$.value}, selfId: ${this._selfId$.value}`);
+			logger$11.info("[WebRTCManager] Verto invite successful");
+			logger$11.debug(`[WebRTCManager] nodeid: ${this._nodeId$.value}, selfId: ${this._selfId$.value}`);
 		} else {
-			logger$10.error("[WebRTCManager] Verto invite failed:", response);
+			logger$11.error("[WebRTCManager] Verto invite failed:", response);
 			const inviteError = response.error ? new require_operators.JSONRPCError(response.error.code, response.error.message, response.error.data) : /* @__PURE__ */ new Error("Verto invite failed: unexpected response");
 			this.onError?.(inviteError);
 		}
@@ -3970,17 +4215,17 @@ var WebRTCVertoManager = class extends VertoManager {
 		if (options.initOffer) this.handleInboundAnswer(rtcPeerConnController);
 	}
 	async handleInboundAnswer(rtcPeerConnController) {
-		logger$10.debug("[WebRTCManager] Waiting for inbound call to be accepted or rejected");
+		logger$11.debug("[WebRTCManager] Waiting for inbound call to be accepted or rejected");
 		const vertoByeOrAccepted = await (0, rxjs.firstValueFrom)((0, rxjs.race)(this.vertoBye$, this.webRtcCallSession.answered$).pipe((0, rxjs.takeUntil)(this.destroyed$))).catch(() => null);
 		if (vertoByeOrAccepted === null) {
-			logger$10.debug("[WebRTCManager] Inbound answer handler aborted (destroyed).");
+			logger$11.debug("[WebRTCManager] Inbound answer handler aborted (destroyed).");
 			return;
 		}
 		if (isVertoByeMessage(vertoByeOrAccepted)) {
-			logger$10.info("[WebRTCManager] Inbound call ended by remote before answer.");
+			logger$11.info("[WebRTCManager] Inbound call ended by remote before answer.");
 			this.callSession?.destroy();
 		} else if (!vertoByeOrAccepted) {
-			logger$10.info("[WebRTCManager] Inbound call rejected by user.");
+			logger$11.info("[WebRTCManager] Inbound call rejected by user.");
 			try {
 				await this.bye("USER_BUSY");
 			} finally {
@@ -3988,19 +4233,19 @@ var WebRTCVertoManager = class extends VertoManager {
 				this.callSession?.destroy();
 			}
 		} else {
-			logger$10.debug("[WebRTCManager] Inbound call accepted, creating SDP answer");
+			logger$11.debug("[WebRTCManager] Inbound call accepted, creating SDP answer");
 			const answerOptions = this.webRtcCallSession.answerMediaOptions;
 			try {
 				await rtcPeerConnController.acceptInbound(answerOptions);
 			} catch (error) {
-				logger$10.error("[WebRTCManager] Error creating inbound answer:", error);
+				logger$11.error("[WebRTCManager] Error creating inbound answer:", error);
 				this.onError?.(error instanceof Error ? error : new Error(String(error), { cause: error }));
 			}
 		}
 	}
 	setupVertoAttachHandler() {
 		this.subscribeTo(this.vertoAttach$, async (vertoAttach) => {
-			logger$10.debug("[WebRTCManager] Received Verto attach event:", vertoAttach);
+			logger$11.debug("[WebRTCManager] Received Verto attach event:", vertoAttach);
 			const { callID } = vertoAttach;
 			await this.attachManager.attach({
 				id: callID,
@@ -4068,13 +4313,13 @@ var WebRTCVertoManager = class extends VertoManager {
 		};
 	}
 	async sendLocalDescriptionOnceAccepted(vertoMessageRequest, rtcPeerConnectionController) {
-		logger$10.debug("[WebRTCManager] Waiting for call to be accepted or ended before sending answer");
+		logger$11.debug("[WebRTCManager] Waiting for call to be accepted or ended before sending answer");
 		const vertoByeOrAccepted = await (0, rxjs.firstValueFrom)((0, rxjs.race)(this.vertoBye$, this.webRtcCallSession.answered$));
 		if (isVertoByeMessage(vertoByeOrAccepted)) {
-			logger$10.info("[WebRTCManager] Call ended before answer was sent.");
+			logger$11.info("[WebRTCManager] Call ended before answer was sent.");
 			this.callSession?.destroy();
 		} else if (!vertoByeOrAccepted) {
-			logger$10.info("[WebRTCManager] Call was not accepted, sending verto.bye.");
+			logger$11.info("[WebRTCManager] Call was not accepted, sending verto.bye.");
 			try {
 				await this.bye("USER_BUSY");
 			} finally {
@@ -4082,14 +4327,14 @@ var WebRTCVertoManager = class extends VertoManager {
 				this.callSession?.destroy();
 			}
 		} else {
-			logger$10.debug("[WebRTCManager] Call accepted, sending answer");
+			logger$11.debug("[WebRTCManager] Call accepted, sending answer");
 			try {
 				this._signalingStatus$.next("connecting");
 				await this.sendLocalDescription(vertoMessageRequest, rtcPeerConnectionController);
 				await rtcPeerConnectionController.updateAnswerStatus({ status: "sent" });
 				await this.attachManager.attach(this.webRtcCallSession);
 			} catch (error) {
-				logger$10.error("[WebRTCManager] Error sending Verto answer:", error);
+				logger$11.error("[WebRTCManager] Error sending Verto answer:", error);
 				this.onError?.(error instanceof Error ? error : new Error(String(error), { cause: error }));
 				await rtcPeerConnectionController.updateAnswerStatus({ status: "failed" });
 			}
@@ -4180,10 +4425,10 @@ var WebRTCVertoManager = class extends VertoManager {
 			});
 			await (0, rxjs.firstValueFrom)(rtcPeerConnController.connectionState$.pipe((0, rxjs.filter)((state) => state === "connected"), (0, rxjs.take)(1), (0, rxjs.timeout)(this._screenShareTimeoutMs)));
 			this._screenShareStatus$.next("started");
-			logger$10.info("[WebRTCManager] Screen share started successfully.");
+			logger$11.info("[WebRTCManager] Screen share started successfully.");
 			return rtcPeerConnController.id;
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Error initializing additional peer connection:", error);
+			logger$11.warn("[WebRTCManager] Error initializing additional peer connection:", error);
 			this.onError?.(error instanceof Error ? error : new Error(String(error), { cause: error }));
 			if (rtcPeerConnController) rtcPeerConnController.destroy();
 			this._screenShareStatus$.next("none");
@@ -4202,9 +4447,9 @@ var WebRTCVertoManager = class extends VertoManager {
 		if (removeTrack) return this.mainPeerConnection.stopTrackSender(removeTrack, { updateTransceiverDirection: true });
 	}
 	async removeScreenMedia() {
-		if (!["starting", "started"].includes(this._screenShareStatus$.value)) logger$10.warn("[WebRTCManager] No active screen share to stop.");
+		if (!["starting", "started"].includes(this._screenShareStatus$.value)) logger$11.warn("[WebRTCManager] No active screen share to stop.");
 		if (!this._screenShareId) {
-			logger$10.debug("[WebRTCManager] No screen share peer connection found.");
+			logger$11.debug("[WebRTCManager] No screen share peer connection found.");
 			return;
 		}
 		this._screenShareStatus$.next("stopping");
@@ -4233,7 +4478,7 @@ var WebRTCVertoManager = class extends VertoManager {
 				dialogParams: this.dialogParams(rtcPeerConnController)
 			}));
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Call might already be disconnected, error sending Verto bye:", error);
+			logger$11.warn("[WebRTCManager] Call might already be disconnected, error sending Verto bye:", error);
 			throw error;
 		}
 	}
@@ -4251,7 +4496,7 @@ var WebRTCVertoManager = class extends VertoManager {
 		try {
 			await this.executeVerto(vertoInfoMessage);
 		} catch (error) {
-			logger$10.warn("[WebRTCManager] Error sending DTMF digits:", error);
+			logger$11.warn("[WebRTCManager] Error sending DTMF digits:", error);
 			throw error;
 		}
 	}
@@ -4262,10 +4507,10 @@ var WebRTCVertoManager = class extends VertoManager {
 			action: "transfer"
 		});
 		try {
-			logger$10.debug("[WebRTCManager] Transferring call with options:", options);
+			logger$11.debug("[WebRTCManager] Transferring call with options:", options);
 			await this.executeVerto(message);
 		} catch (error) {
-			logger$10.error("[WebRTCManager] Error transferring call:", error);
+			logger$11.error("[WebRTCManager] Error transferring call:", error);
 			throw error;
 		}
 	}
@@ -4307,7 +4552,7 @@ var ParticipantFactory = class {
 
 //#endregion
 //#region src/core/entities/Call.ts
-const logger$9 = require_operators.getLogger();
+const logger$10 = require_operators.getLogger();
 const fromDestinationParams = (destination) => {
 	if (!destination) return {};
 	try {
@@ -4318,7 +4563,7 @@ const fromDestinationParams = (destination) => {
 		});
 		return params;
 	} catch (error) {
-		logger$9.warn(`Failed to parse destination URI: ${destination}`, error);
+		logger$10.warn(`Failed to parse destination URI: ${destination}`, error);
 		return {};
 	}
 };
@@ -4493,7 +4738,7 @@ var WebRTCCall = class extends Destroyable {
 			if (isJSONRPCErrorResponse(response)) throw new require_operators.JSONRPCError(parseInt(response.result?.code ?? "0"), `Error response from method ${method}: ${response.result?.code} ${response.result?.message}`, void 0, void 0, request.id);
 			return response;
 		} catch (error) {
-			logger$9.error(`[Call] Error executing method ${method} with params`, params, error);
+			logger$10.error(`[Call] Error executing method ${method} with params`, params, error);
 			throw error;
 		}
 	}
@@ -4674,18 +4919,20 @@ var WebRTCCall = class extends Destroyable {
 	}
 	isCallSessionEvent(event) {
 		try {
-			logger$9.debug("[Call] Checking if event is for this call session:", event);
+			logger$10.debug("[Call] Checking if event is for this call session:", event);
 			const callId = require_operators.getValueFrom(event, "params.params.callID") ?? require_operators.getValueFrom(event, "params.call_id");
 			const roomSessionId = require_operators.getValueFrom(event, "params.room_session_id");
-			logger$9.debug(`[Call] Extracted session identifiers callID: ${callId} and roomSessionID: ${roomSessionId} from event:`);
+			logger$10.debug(`[Call] Extracted session identifiers callID: ${callId} and roomSessionID: ${roomSessionId} from event:`);
 			return callId === this.id || !!callId && this.callEventsManager.isCallIdValid(callId) || !!roomSessionId && this.callEventsManager.isRoomSessionIdValid(roomSessionId);
 		} catch (error) {
-			logger$9.error("[Call] Error checking if event is for this call session:", error);
+			logger$10.error("[Call] Error checking if event is for this call session:", error);
 			return false;
 		}
 	}
 	get callSessionEvents$() {
-		return this.cachedObservable("callSessionEvents$", () => this.clientSession.signalingEvent$.pipe((0, rxjs.filter)((event) => this.isCallSessionEvent(event)), (0, rxjs.tap)((event) => logger$9.debug("[Call] Received call session event:", event)), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
+		return this.cachedObservable("callSessionEvents$", () => this.clientSession.signalingEvent$.pipe((0, rxjs.filter)((event) => this.isCallSessionEvent(event)), (0, rxjs.tap)((event) => {
+			logger$10.debug("[Call] Received call session event:", event);
+		}), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
 	}
 	/** Observable of call-updated events. */
 	get callUpdated$() {
@@ -4725,11 +4972,11 @@ var WebRTCCall = class extends Destroyable {
 	}
 	/** Observable of WebRTC-specific signaling messages. */
 	get webrtcMessages$() {
-		return this.cachedObservable("webrtcMessages$", () => this.callSessionEvents$.pipe(require_operators.filterAs(isWebrtcMessageMetadata, "params"), (0, rxjs.tap)((event) => logger$9.debug("[Call] Event is a WebRTC message event:", event)), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
+		return this.cachedObservable("webrtcMessages$", () => this.callSessionEvents$.pipe(require_operators.filterAs(isWebrtcMessageMetadata, "params"), (0, rxjs.tap)((event) => logger$10.debug("[Call] Event is a WebRTC message event:", event)), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
 	}
 	/** Observable of call-level signaling events. */
 	get callEvent$() {
-		return this.cachedObservable("callEvent$", () => this.callSessionEvents$.pipe(require_operators.filterAs(isSignalwireCallMetadata, "params"), (0, rxjs.tap)((event) => logger$9.debug("[Call] Event is a call event:", event)), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
+		return this.cachedObservable("callEvent$", () => this.callSessionEvents$.pipe(require_operators.filterAs(isSignalwireCallMetadata, "params"), (0, rxjs.tap)((event) => logger$10.debug("[Call] Event is a call event:", event)), (0, rxjs.takeUntil)(this.destroyed$), (0, rxjs.share)()));
 	}
 	/** Observable of layout-changed signaling events. */
 	get layoutEvent$() {
@@ -4904,7 +5151,7 @@ var CallFactory = class {
 
 //#endregion
 //#region src/behaviors/Collection.ts
-const logger$8 = require_operators.getLogger();
+const logger$9 = require_operators.getLogger();
 var Fetcher = class {
 	constructor(endpoint, params, http) {
 		this.endpoint = endpoint;
@@ -4928,7 +5175,7 @@ var Fetcher = class {
 			this.hasMore = !!this.nextUrl;
 			return result.data.filter(this.filter).map(this.mapper);
 		}
-		logger$8.error("Failed to fetch entity");
+		logger$9.error("Failed to fetch entity");
 		return [];
 	}
 	async id(v) {
@@ -4991,7 +5238,7 @@ var EntityCollection = class extends Destroyable {
 			this._hasMore$.next(this.fetchController.hasMore ?? false);
 			this.loading$.next(false);
 		} catch (error) {
-			logger$8.error(`Failed to fetch initial collection data`, error);
+			logger$9.error(`Failed to fetch initial collection data`, error);
 			this._hasMore$.next(this.fetchController.hasMore ?? false);
 			this.loading$.next(false);
 			this.onError?.(new require_operators.CollectionFetchError("fetchMore", error));
@@ -5005,7 +5252,7 @@ var EntityCollection = class extends Destroyable {
 			if (data) this.upsertData(data);
 			return data;
 		} catch (error) {
-			logger$8.error(`Failed to fetch data for (${String(key)}:${String(value)}) :`, error);
+			logger$9.error(`Failed to fetch data for (${String(key)}:${String(value)}) :`, error);
 			this.loading$.next(false);
 			this.onError?.(new require_operators.CollectionFetchError(`tryFetch(${String(key)})`, error));
 		}
@@ -5035,9 +5282,9 @@ var EntityCollection = class extends Destroyable {
 	}
 };
 var EntityCollectionTransformed = class {
-	constructor(originalCollection, filter$10 = (i) => !!i, mapper = (item) => item) {
+	constructor(originalCollection, filter$11 = (i) => !!i, mapper = (item) => item) {
 		this.originalCollection = originalCollection;
-		this.filter = filter$10;
+		this.filter = filter$11;
 		this.mapper = mapper;
 	}
 	get loading$() {
@@ -5254,13 +5501,13 @@ var Address = class extends Destroyable {
 
 //#endregion
 //#region src/core/utils.ts
-const logger$7 = require_operators.getLogger();
+const logger$8 = require_operators.getLogger();
 const isRPCConnectResult = (e) => {
-	logger$7.debug("isRPCConnectResult check:", e);
+	logger$8.debug("isRPCConnectResult check:", e);
 	if (!e || typeof e !== "object") return false;
 	const result = e;
 	const is = typeof result.identity === "string" && typeof result.protocol === "string" && typeof result.authorization === "object" && typeof result.authorization.jti === "string" && typeof result.authorization.project_id === "string" && typeof result.authorization.fabric_subscriber === "object";
-	logger$7.debug("isRPCConnectResult check result:", is);
+	logger$8.debug("isRPCConnectResult check result:", is);
 	return is;
 };
 var PendingRPC = class PendingRPC {
@@ -5269,7 +5516,7 @@ var PendingRPC = class PendingRPC {
 	}
 	constructor(request, responses$, options) {
 		this.id = (0, uuid.v4)();
-		logger$7.debug(`[PendingRPC(${this.id}) request:${request.id}: method:${request.method}] Creating PendingRPC`);
+		logger$8.debug(`[PendingRPC(${this.id}) request:${request.id}: method:${request.method}] Creating PendingRPC`);
 		this.request = request;
 		const timeoutMs = options?.timeoutMs ?? PendingRPC.defaultTimeoutMs;
 		const signal = options?.signal;
@@ -5280,10 +5527,10 @@ var PendingRPC = class PendingRPC {
 			}
 			let isSettled = false;
 			const subscription = (0, rxjs.race)(responses$.pipe((0, rxjs.filter)((result) => result.id === request.id), (0, rxjs.take)(1)), new rxjs.Observable((subscriber) => {
-				const timer = setTimeout(() => {
+				const timer$1 = setTimeout(() => {
 					subscriber.error(new require_operators.RPCTimeoutError(request.id, timeoutMs));
 				}, timeoutMs);
-				return () => clearTimeout(timer);
+				return () => clearTimeout(timer$1);
 			}), signal ? new rxjs.Observable((subscriber) => {
 				const abortHandler = () => {
 					subscriber.error(new DOMException("The operation was aborted", "AbortError"));
@@ -5295,22 +5542,22 @@ var PendingRPC = class PendingRPC {
 					isSettled = true;
 					if (response.error) {
 						const rpcError = new require_operators.JSONRPCError(response.error.code, response.error.message, response.error.data, void 0, request.id);
-						logger$7.debug(`[PendingRPC(${this.id}) request:${request.id}] Rejecting promise with RPC error:`, rpcError);
+						logger$8.debug(`[PendingRPC(${this.id}) request:${request.id}] Rejecting promise with RPC error:`, rpcError);
 						reject(rpcError);
 					} else {
-						logger$7.debug(`[PendingRPC(${this.id}) request:${request.id}] Resolving promise with response:`, response);
+						logger$8.debug(`[PendingRPC(${this.id}) request:${request.id}] Resolving promise with response:`, response);
 						resolve(response);
 					}
 					subscription.unsubscribe();
 				},
 				error: (error) => {
-					logger$7.debug(`[PendingRPC(${this.id}) request:${request.id}] Rejecting promise with error:`, error);
+					logger$8.debug(`[PendingRPC(${this.id}) request:${request.id}] Rejecting promise with error:`, error);
 					isSettled = true;
 					reject(error);
 					subscription.unsubscribe();
 				},
 				complete: () => {
-					logger$7.debug(`[PendingRPC(${this.id}) request:${request.id}] Observable completed`);
+					logger$8.debug(`[PendingRPC(${this.id}) request:${request.id}] Observable completed`);
 					if (!isSettled) reject(new require_operators.RPCTimeoutError(request.id, timeoutMs));
 					subscription.unsubscribe();
 				}
@@ -5330,7 +5577,7 @@ var PendingRPC = class PendingRPC {
 
 //#endregion
 //#region src/managers/ClientSessionManager.ts
-const logger$6 = require_operators.getLogger();
+const logger$7 = require_operators.getLogger();
 const getAddressSearchURI = (options) => {
 	const to = options.to?.split("?")[0];
 	const from$6 = options.from?.startsWith("subscriber://") ? options.from.replace("subscriber://", "") : options.from;
@@ -5339,13 +5586,14 @@ const getAddressSearchURI = (options) => {
 	return name;
 };
 var ClientSessionManager = class extends Destroyable {
-	constructor(credential, transport, storage, authorizationStateKey, deviceController, attachManager, webRTCApiProvider) {
+	constructor(getCredential, transport, storage, authorizationStateKey, deviceController, attachManager, webRTCApiProvider, dpopManager) {
 		super();
-		this.credential = credential;
+		this.getCredential = getCredential;
 		this.transport = transport;
 		this.storage = storage;
 		this.authorizationStateKey = authorizationStateKey;
 		this.attachManager = attachManager;
+		this.dpopManager = dpopManager;
 		this.callCreateTimeout = 6e3;
 		this.agent = `signalwire-typescript-sdk/1.0.0`;
 		this.eventAcks = true;
@@ -5358,6 +5606,7 @@ var ClientSessionManager = class extends Destroyable {
 		this._authorization$ = this.createBehaviorSubject(void 0);
 		this._errors$ = this.createReplaySubject(1);
 		this._authenticated$ = this.createBehaviorSubject(false);
+		this._clientBound = false;
 		this._subscriberInfo$ = this.createBehaviorSubject(null);
 		this._calls$ = this.createBehaviorSubject({});
 		this._iceServers$ = this.createBehaviorSubject([]);
@@ -5402,6 +5651,15 @@ var ClientSessionManager = class extends Destroyable {
 		return this._authenticated$.value;
 	}
 	/**
+	* Whether this session is client-bound (using a Client Bound SAT).
+	* When client-bound, DPoP proof creation failures are treated as
+	* authentication errors rather than silently degraded.
+	* @internal
+	*/
+	get clientBound() {
+		return this._clientBound;
+	}
+	/**
 	* Set the directory instance
 	* Called by SignalWire after directory is created
 	* @internal
@@ -5413,7 +5671,7 @@ var ClientSessionManager = class extends Destroyable {
 		try {
 			return await this.transport.execute(request, options);
 		} catch (error) {
-			logger$6.debug("[Session] Execute Error", error);
+			logger$7.debug("[Session] Execute Error", error);
 			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
 			throw error;
 		}
@@ -5427,32 +5685,31 @@ var ClientSessionManager = class extends Destroyable {
 		return true;
 	}
 	setupMessageHandlers() {
-		logger$6.debug("[Session] Setting up message handlers");
+		logger$7.debug("[Session] Setting up message handlers");
 		this.subscribeTo(this.authStateEvent$, async (authStateEvent) => {
-			logger$6.debug("[Session] Authorization state event received:", authStateEvent);
+			logger$7.debug("[Session] Authorization state event received:", authStateEvent);
 			try {
 				await this.updateAuthorizationStateInStorage(authStateEvent.authorization_state);
 			} catch (error) {
-				logger$6.error("[Session] Failed to handle authorization state update:", error);
+				logger$7.error("[Session] Failed to handle authorization state update:", error);
 				this._errors$.next(new require_operators.AuthStateHandlerError(error));
 			}
 		});
-		this.subscribeTo(this.transport.connectionStatus$.pipe((0, rxjs.filter)((status) => status === "connected")), async () => {
-			try {
-				logger$6.debug("[Session] Connection established, initiating authentication");
-				await this.authenticate();
-			} catch (error) {
+		this.subscribeTo(this.transport.connectionStatus$.pipe((0, rxjs.filter)((status) => status === "connected"), (0, rxjs.exhaustMap)(() => {
+			logger$7.debug("[Session] Connection established, initiating authentication");
+			return (0, rxjs.from)(this.authenticate()).pipe((0, rxjs.catchError)((error) => {
 				this.handleAuthenticationError(error).catch((err) => {
-					logger$6.error("[Session] Error handling authentication failure:", err);
+					logger$7.error("[Session] Error handling authentication failure:", err);
 				});
-			}
-		});
+				return rxjs.EMPTY;
+			}));
+		})), void 0);
 		this.subscribeTo(this.vertoInvite$, async (invite) => {
-			logger$6.debug("[Session] Verto invite received:", invite);
+			logger$7.debug("[Session] Verto invite received:", invite);
 			try {
 				await this.createInboundCall(invite);
 			} catch (error) {
-				logger$6.error("[Session] Error handling Verto invite:", error);
+				logger$7.error("[Session] Error handling Verto invite:", error);
 				this._errors$.next(new require_operators.VertoInviteHandlerError(error));
 			}
 		});
@@ -5462,35 +5719,35 @@ var ClientSessionManager = class extends Destroyable {
 			const storedState = await this.storage.getItem(this.authorizationStateKey);
 			this.authorizationState$.next(storedState ?? void 0);
 		} catch (error) {
-			logger$6.error("Failed to retrieve authorization state from storage:", error);
+			logger$7.error("Failed to retrieve authorization state from storage:", error);
 			this.authorizationState$.next(void 0);
 		}
 	}
 	async updateAuthorizationStateInStorage(authorizationState) {
 		if (!authorizationState) {
-			logger$6.debug("[Session] Removing authorization state from storage");
+			logger$7.debug("[Session] Removing authorization state from storage");
 			try {
 				await this.storage.removeItem(this.authorizationStateKey);
 			} catch (error) {
-				logger$6.error("Failed to remove authorization state from storage:", error);
+				logger$7.error("Failed to remove authorization state from storage:", error);
 				throw error;
 			}
 			return;
 		}
 		try {
-			logger$6.debug("[Session] Updating authorization state in storage");
+			logger$7.debug("[Session] Updating authorization state in storage");
 			await this.storage.setItem(this.authorizationStateKey, authorizationState);
 			this.authorizationState$.next(authorizationState);
 		} catch (error) {
-			logger$6.error("Failed to retrieve authorization state from storage:", error);
+			logger$7.error("Failed to retrieve authorization state from storage:", error);
 			throw error;
 		}
 	}
 	get authStateEvent$() {
 		return this.cachedObservable("authStateEvent$", () => this.signalingEvent$.pipe((0, rxjs.tap)((msg) => {
-			logger$6.debug("[Session] Received incoming message:", msg);
+			logger$7.debug("[Session] Received incoming message:", msg);
 		}), require_operators.filterAs(isSignalwireAuthorizationStateMetadata, "params"), (0, rxjs.tap)((event) => {
-			logger$6.debug("[Session] Authorization state event received:", event.authorization_state);
+			logger$7.debug("[Session] Authorization state event received:", event.authorization_state);
 		})));
 	}
 	get signalingEvent$() {
@@ -5512,86 +5769,118 @@ var ClientSessionManager = class extends Destroyable {
 		return [];
 	}
 	get authentication() {
-		if (!this.credential.token) throw new require_operators.DependencyError("Credential token is undefined");
-		return { jwt_token: this.credential.token };
+		const credential = this.getCredential();
+		if (!credential.token) throw new require_operators.DependencyError("Credential token is undefined");
+		return { jwt_token: credential.token };
 	}
 	async connect() {
 		await (0, rxjs.firstValueFrom)(this.initialized$);
 		await this.transport.connect();
 	}
 	async handleAuthenticationError(error) {
-		logger$6.error("Authentication error:", error);
+		logger$7.error("Authentication error:", error);
 		this._errors$.next(error);
-		if (error.message === "Requester validation failed") try {
-			await this.cleanupStoredConnectionParams();
-		} catch (error$1) {
-			logger$6.error("Failed to cleanup stored connection params:", error$1);
-		} finally {
-			this.transport.reconnect();
+		const isRecoverableAuthError = error instanceof require_operators.JSONRPCError && (error.code === RPC_ERROR_REQUESTER_VALIDATION_FAILED || error.code === RPC_ERROR_INVALID_PARAMS || error.code === RPC_ERROR_AUTHENTICATION_FAILED);
+		const hasStoredState = this._authorization$.value !== void 0;
+		if (isRecoverableAuthError && hasStoredState) {
+			logger$7.debug("[Session] Recoverable auth error — cleaning up stored state and reconnecting fresh");
+			try {
+				await this.cleanupStoredConnectionParams();
+			} catch (cleanupError) {
+				logger$7.error("Failed to cleanup stored connection params:", cleanupError);
+			} finally {
+				this.transport.reconnect();
+			}
 		}
 	}
 	async cleanupStoredConnectionParams() {
 		await this.transport.setProtocol(void 0);
 		await this.updateAuthorizationStateInStorage(void 0);
+		this._authorization$.next(void 0);
 		await this.attachManager.detachAll();
 	}
 	async updateAuthState(authorization_state) {
 		try {
 			await this.storage.setItem(this.authorizationStateKey, authorization_state);
 		} catch (error) {
-			logger$6.error("Failed to update authorization state in storage:", error);
+			logger$7.error("Failed to update authorization state in storage:", error);
 			this._errors$.next(new require_operators.AuthStateHandlerError(error));
 		}
 	}
-	async reauthenticate(token) {
-		logger$6.debug("[Session] Re-authenticating session");
+	async reauthenticate(token, dpopToken, options) {
+		logger$7.debug("[Session] Re-authenticating session");
 		try {
+			let resolvedDpopToken = dpopToken;
+			if (!resolvedDpopToken && this.dpopManager?.initialized) try {
+				resolvedDpopToken = await this.dpopManager.createRpcProof({ method: "signalwire.reauthenticate" });
+			} catch (error) {
+				if (this._clientBound) throw error;
+				logger$7.warn("[Session] Failed to create DPoP proof for reauthenticate:", error);
+			}
 			const request = RPCReauthenticate({
 				project: this._authorization$.value?.project_id ?? "",
-				jwt_token: token
+				jwt_token: token,
+				...resolvedDpopToken ? { dpop_token: resolvedDpopToken } : {}
 			});
 			await (0, rxjs.lastValueFrom)((0, rxjs.from)(this.transport.execute(request)).pipe(require_operators.throwOnRPCError(), (0, rxjs.take)(1), (0, rxjs.catchError)((err) => {
-				logger$6.error("[Session] Re-authentication RPC failed:", err);
+				logger$7.error("[Session] Re-authentication RPC failed:", err);
 				throw err;
 			})));
-			logger$6.debug("[Session] Re-authentication successful, updating stored auth state");
+			if (options?.clientBound) this._clientBound = true;
+			logger$7.debug("[Session] Re-authentication successful, updating stored auth state");
 		} catch (error) {
-			logger$6.error("[Session] Re-authentication failed:", error);
+			logger$7.error("[Session] Re-authentication failed:", error);
 			this._errors$.next(new require_operators.AuthStateHandlerError(error));
 			throw error;
 		}
 	}
 	async authenticate() {
-		logger$6.debug("[Session] Starting authentication process");
-		const params = {
-			authentication: this.authentication,
-			version: this.connectVersion,
-			agent: this.agent,
-			contexts: this.contexts,
-			eventing: this.eventing,
-			topics: this.topics,
-			event_acks: this.eventAcks
-		};
+		logger$7.debug("[Session] Starting authentication process");
 		const persistedParams = await (0, rxjs.firstValueFrom)((0, rxjs.combineLatest)({
 			protocol: this.transport.protocol$,
 			authorization_state: this.authorizationState$
 		}).pipe((0, rxjs.take)(1)));
-		logger$6.debug("[Session] Persisted params:\n", {
+		logger$7.debug("[Session] Persisted params:\n", {
 			protocol: persistedParams.protocol,
 			authStateLength: persistedParams.authorization_state?.length
 		});
+		this.transport.resetSessionEpoch();
+		const hasReconnectState = persistedParams.authorization_state && persistedParams.protocol;
+		const storedToken = this.getCredential().token;
+		const isReconnect = hasReconnectState && storedToken;
+		let dpopToken;
+		if (isReconnect) logger$7.debug("[Session] Reconnecting with stored jwt_token + authorization_state");
+		else if (this.onBeforeReconnect && this._clientBound) {
+			logger$7.debug("[Session] Refreshing credentials before fresh connect");
+			await this.onBeforeReconnect();
+		}
+		if (this.dpopManager?.initialized) try {
+			dpopToken = await this.dpopManager.createRpcProof({ method: "signalwire.connect" });
+		} catch (error) {
+			if (this._clientBound) throw error;
+			logger$7.warn("[Session] Failed to create DPoP proof for connect, proceeding without:", error);
+		}
 		const rpcConnectRequest = RPCConnect({
-			...params,
-			...persistedParams
+			authentication: isReconnect ? { jwt_token: storedToken } : this.authentication,
+			version: this.connectVersion,
+			agent: this.agent,
+			contexts: this.contexts,
+			eventing: this.eventing,
+			topics: this.topics,
+			event_acks: this.eventAcks,
+			...dpopToken ? { dpop_token: dpopToken } : {},
+			...isReconnect ? {
+				authorization_state: persistedParams.authorization_state,
+				protocol: persistedParams.protocol
+			} : {}
 		});
-		this.transport.resetSessionEpoch();
 		const response = await (0, rxjs.lastValueFrom)((0, rxjs.from)(this.transport.execute(rpcConnectRequest)).pipe(require_operators.throwOnRPCError(), (0, rxjs.map)((res) => res.result), (0, rxjs.filter)(isRPCConnectResult), (0, rxjs.tap)(() => {
-			logger$6.debug("[Session] Response passed filter, processing authentication result");
+			logger$7.debug("[Session] Response passed filter, processing authentication result");
 		}), (0, rxjs.take)(1), (0, rxjs.catchError)((err) => {
-			logger$6.error("[Session] Authentication RPC failed:", err);
+			logger$7.error("[Session] Authentication RPC failed:", err);
 			throw err;
 		})));
-		logger$6.debug("[Session] Processing authentication result:", {
+		logger$7.debug("[Session] Processing authentication result:", {
 			hasProtocol: !!response.protocol,
 			hasAuthorization: !!response.authorization,
 			hasIceServers: !!response.ice_servers
@@ -5600,7 +5889,7 @@ var ClientSessionManager = class extends Destroyable {
 		this._authorization$.next(response.authorization);
 		this._iceServers$.next(response.ice_servers ?? []);
 		this._authenticated$.next(true);
-		logger$6.debug("[Session] Authentication completed successfully");
+		logger$7.debug("[Session] Authentication completed successfully");
 	}
 	async disconnect() {
 		this.transport.disconnect();
@@ -5640,7 +5929,7 @@ var ClientSessionManager = class extends Destroyable {
 			});
 			return callSession;
 		} catch (error) {
-			logger$6.error("[Session] Error creating outbound call:", error);
+			logger$7.error("[Session] Error creating outbound call:", error);
 			callSession?.destroy();
 			const callError = new require_operators.CallCreateError(error instanceof rxjs.TimeoutError ? "Call create timeout" : "Call creation failed", error, "outbound");
 			this._errors$.next(callError);
@@ -5657,8 +5946,8 @@ var ClientSessionManager = class extends Destroyable {
 				if (!addressId) throw new require_operators.DependencyError(`Address name: ${addressURI} not found`);
 				address = this._directory.get(addressId);
 				if (!address) throw new require_operators.DependencyError(`Address ID: ${addressId} not found`);
-			} catch (error) {
-				logger$6.warn(`[Session] Directory lookup failed for ${addressURI}, proceeding with raw URI`);
+			} catch {
+				logger$7.warn(`[Session] Directory lookup failed for ${addressURI}, proceeding with raw URI`);
 			}
 			const callSession = this.callFactory.createCall(address, { ...options });
 			callSession.status$.pipe((0, rxjs.filter)((status) => status === "destroyed"), (0, rxjs.take)(1)).subscribe(() => {
@@ -5667,7 +5956,7 @@ var ClientSessionManager = class extends Destroyable {
 			});
 			return callSession;
 		} catch (error) {
-			logger$6.error("[Session] Error creating call session:", error);
+			logger$7.error("[Session] Error creating call session:", error);
 			throw new require_operators.CallCreateError("Call create error", error, options.initOffer ? "inbound" : "outbound");
 		}
 	}
@@ -5715,7 +6004,7 @@ const isString = (obj) => typeof obj === "string";
 
 //#endregion
 //#region src/managers/ConversationsManager.ts
-const logger$5 = require_operators.getLogger();
+const logger$6 = require_operators.getLogger();
 var ConversationMessagesFetcher = class extends Fetcher {
 	constructor(groupId, http) {
 		super(`/api/fabric/conversations/${groupId}/messages`, "page_size=100", http);
@@ -5755,13 +6044,13 @@ var ConversationsManager = class {
 			}
 			throw new require_operators.ConversationError("Join Failed - Unexpected response");
 		} catch (error) {
-			logger$5.error("[ConversationsManager] Failed to join conversation:", error);
+			logger$6.error("[ConversationsManager] Failed to join conversation:", error);
 			throw error;
 		}
 	}
 	async getConversationMessageCollection(addressId) {
 		const groupId = this.groupIds.get(addressId) ?? await this.join(addressId);
-		return Promise.resolve(new ConversationMessageCollection(groupId, this.clientSession.signalingEvent$.pipe(require_operators.filterAs(isConversationMessageMetadata, "params"), (0, rxjs.tap)((event) => logger$5.debug("[ConversationsManager ] Conversation Event:", event)), (0, rxjs.map)((params) => ({ ...params }))), this.http, this.onError));
+		return Promise.resolve(new ConversationMessageCollection(groupId, this.clientSession.signalingEvent$.pipe(require_operators.filterAs(isConversationMessageMetadata, "params"), (0, rxjs.tap)((event) => logger$6.debug("[ConversationsManager ] Conversation Event:", event)), (0, rxjs.map)((params) => ({ ...params }))), this.http, this.onError));
 	}
 	async sendText(text, destinationAddressId) {
 		const groupId = this.groupIds.get(destinationAddressId) ?? await this.join(destinationAddressId);
@@ -5778,8 +6067,207 @@ var ConversationsManager = class {
 			})).ok) return;
 			throw new require_operators.ConversationError("Send Text Failed - Unexpected response");
 		} catch (error) {
-			logger$5.error("[ConversationsManager] Failed to send text message:", error);
+			logger$6.error("[ConversationsManager] Failed to send text message:", error);
+		}
+	}
+};
+
+//#endregion
+//#region src/managers/DeviceTokenManager.ts
+const logger$5 = require_operators.getLogger();
+/**
+* Resolves the token expiry timestamp (epoch seconds) using a 3-tier priority chain:
+* 1. `data.expires_at` — server-provided absolute timestamp
+* 2. `data.expires_in` — server-provided relative lifetime
+* 3. Fallback to `DEVICE_TOKEN_DEFAULT_EXPIRE_IN` with a warning
+*/
+function resolveExpiresAt(data) {
+	if (data.expires_at) return data.expires_at;
+	if (data.expires_in) return Math.floor(Date.now() / 1e3) + data.expires_in;
+	logger$5.warn("[DeviceToken] Could not determine token expiry, using default");
+	return Math.floor(Date.now() / 1e3) + DEVICE_TOKEN_DEFAULT_EXPIRE_IN;
+}
+/**
+* Resolves the token TTL in seconds from a fresh response.
+* Called at token receive time so `expires_at - now` reflects the original lifetime.
+*
+* 1. `data.expires_in` — server-provided TTL directly
+* 2. `data.expires_at - now` — derive TTL from absolute timestamp
+* 3. Fallback to `DEVICE_TOKEN_DEFAULT_EXPIRE_IN`
+*/
+function resolveExpireIn(data) {
+	if (data.expires_in) return data.expires_in;
+	if (data.expires_at) return Math.max(data.expires_at - Math.floor(Date.now() / 1e3), 1);
+	return DEVICE_TOKEN_DEFAULT_EXPIRE_IN;
+}
+/**
+* Manages the Client Bound SAT lifecycle: activation, token exchange,
+* reauthentication, and automatic refresh scheduling.
+*
+* Extends {@link Destroyable} for automatic RxJS subscription and subject cleanup.
+* Uses a reactive pipeline (`BehaviorSubject` + `switchMap(timer())`) instead of
+* raw `setTimeout` for refresh scheduling.
+*/
+var DeviceTokenManager = class extends Destroyable {
+	constructor(dpopManager, http, errorHandler, getCredential) {
+		super();
+		this.dpopManager = dpopManager;
+		this.http = http;
+		this.errorHandler = errorHandler;
+		this.getCredential = getCredential;
+		this._currentToken$ = this.createBehaviorSubject(null);
+		this._refreshInProgress = false;
+		this._effectiveExpireIn = DEVICE_TOKEN_DEFAULT_EXPIRE_IN;
+		this.subscribeTo(this._currentToken$.pipe((0, rxjs.filter)(Boolean), (0, rxjs.switchMap)((tokenData) => {
+			const expiresAt = resolveExpiresAt(tokenData);
+			const refreshIn = Math.max(expiresAt * 1e3 - Date.now() - DEVICE_TOKEN_REFRESH_BUFFER_MS, 1e3);
+			logger$5.debug(`[DeviceToken] Scheduling Client Bound SAT refresh in ${refreshIn}ms`);
+			return (0, rxjs.timer)(refreshIn);
+		})), () => {
+			this.executeRefresh();
+		});
+	}
+	/**
+	* Activates the Client Bound SAT flow when the subscriber's token has
+	* `sat:refresh` scope.
+	*
+	* Steps:
+	* 1. Check subscriber's `sat_claims` for `sat:refresh` scope
+	* 2. Call `/api/fabric/subscriber/devices/token` with a DPoP proof
+	* 3. Reauthenticate the session with the Client Bound SAT + DPoP proof
+	* 4. Emit token to trigger the reactive refresh pipeline
+	*/
+	async activate(subscriber, session, updateCredential) {
+		const { satClaims } = subscriber;
+		if (!satClaims?.scope?.includes(SAT_REFRESH_SCOPE)) {
+			logger$5.debug("[DeviceToken] No sat:refresh scope, skipping Client Bound SAT activation");
+			return;
+		}
+		this._session = session;
+		this._updateCredential = updateCredential;
+		try {
+			const tokenData = await this.obtainToken();
+			if (!tokenData.expires_at && !tokenData.expires_in && satClaims.expires_at) tokenData.expires_at = satClaims.expires_at;
+			this._effectiveExpireIn = resolveExpireIn(tokenData);
+			const rpcProof = await this.dpopManager.createRpcProof({ method: "signalwire.reauthenticate" });
+			await session.reauthenticate(tokenData.token, rpcProof, { clientBound: true });
+			updateCredential({ token: tokenData.token });
+			logger$5.info("[DeviceToken] Client Bound SAT activated successfully");
+			this._currentToken$.next(tokenData);
+		} catch (error) {
+			logger$5.error("[DeviceToken] Failed to activate Client Bound SAT:", error);
+			this.errorHandler(new require_operators.DPoPInitError(error, "Failed to activate Client Bound SAT"));
+		}
+	}
+	/**
+	* Obtains a Client Bound SAT from `/api/fabric/subscriber/devices/token`.
+	* Returns the full {@link DeviceTokenResponse} including expiry metadata.
+	*/
+	async obtainToken() {
+		const dpopProof = await this.dpopManager.createHttpProof({
+			method: "POST",
+			uri: DEVICE_TOKEN_ENDPOINT
+		});
+		const response = await this.http.request({
+			url: DEVICE_TOKEN_ENDPOINT,
+			...POST_PARAMS,
+			body: JSON.stringify({
+				dpop_token: dpopProof,
+				expire_in: DEVICE_TOKEN_DEFAULT_EXPIRE_IN
+			})
+		});
+		if (!response.ok || !response.body) throw new require_operators.DeviceTokenError(`Failed to obtain device token: ${response.status} ${response.statusText}`);
+		const data = JSON.parse(response.body);
+		if (!data.token) throw new require_operators.DeviceTokenError("Device token response missing token field");
+		return data;
+	}
+	/**
+	* Refreshes the Client Bound SAT via `/api/fabric/subscriber/devices/refresh`.
+	*
+	* Creates a fresh DPoP proof, calls the refresh endpoint, reauthenticates
+	* the WebSocket session, and returns the new token data (scheduling is
+	* handled by the reactive pipeline).
+	*/
+	async refreshToken(session, currentToken, updateCredential) {
+		logger$5.debug("[DeviceToken] Refreshing Client Bound SAT");
+		const dpopProof = await this.dpopManager.createHttpProof({
+			method: "POST",
+			uri: DEVICE_REFRESH_ENDPOINT,
+			accessToken: currentToken
+		});
+		const response = await this.http.request({
+			url: DEVICE_REFRESH_ENDPOINT,
+			...POST_PARAMS,
+			body: JSON.stringify({
+				dpop_token: dpopProof,
+				expire_in: this._effectiveExpireIn
+			})
+		});
+		if (!response.ok || !response.body) throw new require_operators.TokenRefreshError(`Failed to refresh device token: ${response.status} ${response.statusText}`);
+		const data = JSON.parse(response.body);
+		if (!data.token) throw new require_operators.TokenRefreshError("Device token refresh response missing token field");
+		if (!data.expires_at && !data.expires_in) data.expires_in = this._effectiveExpireIn;
+		this._effectiveExpireIn = resolveExpireIn(data);
+		const rpcProof = await this.dpopManager.createRpcProof({ method: "signalwire.reauthenticate" });
+		await session.reauthenticate(data.token, rpcProof);
+		updateCredential({ token: data.token });
+		logger$5.info("[DeviceToken] Client Bound SAT refreshed successfully");
+		return data;
+	}
+	/**
+	* Executes a refresh with retry and exponential backoff.
+	* On success, emits to `_currentToken$` to schedule the next refresh.
+	* On all retries exhausted, emits to `errorHandler`.
+	*/
+	async executeRefresh() {
+		if (this._refreshInProgress) {
+			logger$5.debug("[DeviceToken] Refresh already in progress, skipping");
+			return;
+		}
+		const session = this._session;
+		const updateCredential = this._updateCredential;
+		if (!session || !updateCredential) {
+			logger$5.warn("[DeviceToken] Cannot refresh: session or updateCredential not set");
+			return;
+		}
+		if (!session.authenticated) {
+			logger$5.debug("[DeviceToken] Session not authenticated, deferring refresh");
+			return;
+		}
+		this._refreshInProgress = true;
+		try {
+			const currentToken = this.getCredential().token;
+			if (!currentToken) throw new require_operators.TokenRefreshError("No current token available for refresh");
+			const newTokenData = await this.retryRefresh(session, currentToken, updateCredential);
+			this._currentToken$.next(newTokenData);
+		} catch (error) {
+			logger$5.error("[DeviceToken] Automatic Client Bound SAT refresh failed:", error);
+			this.errorHandler(error instanceof require_operators.TokenRefreshError ? error : new require_operators.TokenRefreshError("Automatic token refresh failed", error));
+		} finally {
+			this._refreshInProgress = false;
+		}
+	}
+	/**
+	* Retries `refreshToken()` up to `DEVICE_TOKEN_REFRESH_MAX_RETRIES` times
+	* with exponential backoff (1s, 2s, 4s).
+	*/
+	async retryRefresh(session, currentToken, updateCredential) {
+		let lastError;
+		for (let attempt = 0; attempt < DEVICE_TOKEN_REFRESH_MAX_RETRIES; attempt++) try {
+			return await this.refreshToken(session, currentToken, updateCredential);
+		} catch (error) {
+			lastError = error;
+			if (attempt < DEVICE_TOKEN_REFRESH_MAX_RETRIES - 1) {
+				const delay = DEVICE_TOKEN_REFRESH_RETRY_BASE_MS * Math.pow(2, attempt);
+				logger$5.warn(`[DeviceToken] Refresh attempt ${attempt + 1} failed, retrying in ${delay}ms`);
+				await new Promise((resolve) => setTimeout(resolve, delay));
+			}
 		}
+		throw lastError instanceof Error ? lastError : new require_operators.TokenRefreshError("All refresh retries exhausted", lastError);
+	}
+	/** Cleans up the manager, cancelling the reactive pipeline and all subscriptions. */
+	destroy() {
+		super.destroy();
 	}
 };
 
@@ -5949,6 +6437,10 @@ var WebSocketController = class WebSocketController extends Destroyable {
 		this.outgoingMessages$ = outgoingMessages$;
 		this.messageQueue = [];
 		this.shouldReconnect = false;
+		this.boundHandleOpen = () => this.handleOpen();
+		this.boundHandleClose = (event) => this.handleClose(event);
+		this.boundHandleError = () => this.handleError();
+		this.boundHandleMessage = (event) => this.handleMessage(event);
 		this._status$ = this.createBehaviorSubject("disconnected");
 		this._incomingMessages$ = this.createSubject();
 		this._errors$ = this.createReplaySubject(1);
@@ -6004,6 +6496,7 @@ var WebSocketController = class WebSocketController extends Destroyable {
 	}
 	createWebSocket() {
 		try {
+			this.closeExistingSocket();
 			this.socket = new this.WebSocketConstructor(this.endpoint);
 			this.setupWebSocketListeners();
 			this.startConnectionTimeout();
@@ -6013,12 +6506,33 @@ var WebSocketController = class WebSocketController extends Destroyable {
 			this.handleConnectionError();
 		}
 	}
+	/**
+	* Closes the existing socket and removes its event listeners to prevent
+	* phantom 'open'/'close' events from firing on the orphaned socket.
+	*/
+	closeExistingSocket() {
+		if (!this.socket) return;
+		const oldSocket = this.socket;
+		this.socket = void 0;
+		this.removeWebSocketListeners(oldSocket);
+		try {
+			oldSocket.close();
+		} catch {}
+	}
 	setupWebSocketListeners() {
 		if (!this.socket) return;
-		this.socket.addEventListener("open", () => this.handleOpen());
-		this.socket.addEventListener("close", (event) => this.handleClose(event));
-		this.socket.addEventListener("error", () => this.handleError());
-		this.socket.addEventListener("message", (event) => this.handleMessage(event));
+		this.socket.addEventListener("open", this.boundHandleOpen);
+		this.socket.addEventListener("close", this.boundHandleClose);
+		this.socket.addEventListener("error", this.boundHandleError);
+		this.socket.addEventListener("message", this.boundHandleMessage);
+	}
+	removeWebSocketListeners(socket) {
+		try {
+			socket.removeEventListener("open", this.boundHandleOpen);
+			socket.removeEventListener("close", this.boundHandleClose);
+			socket.removeEventListener("error", this.boundHandleError);
+			socket.removeEventListener("message", this.boundHandleMessage);
+		} catch {}
 	}
 	handleOpen() {
 		this.clearConnectionTimeout();
@@ -6363,6 +6877,7 @@ var SignalWire = class extends Destroyable {
 		this._errors$ = this.createReplaySubject(1);
 		this._options = {};
 		this._deps = new DependencyContainer();
+		this._credentialProvider = credentialProvider;
 		this._options = {
 			...PreferencesContainer.instance.defaultSignalWireOptions,
 			...options
@@ -6386,8 +6901,25 @@ var SignalWire = class extends Destroyable {
 			this._errors$.next(error instanceof Error ? error : new Error(String(error), { cause: error }));
 		});
 	}
+	/**
+	* Initializes DPoP if not already set up. Returns the fingerprint on success.
+	*/
+	async initDPoP() {
+		if (this._dpopManager?.initialized) return this._dpopManager.fingerprint;
+		try {
+			this._dpopManager = new CryptoController();
+			const fingerprint = await this._dpopManager.init();
+			logger$1.debug("[SignalWire] DPoP initialized, fingerprint available");
+			return fingerprint;
+		} catch (error) {
+			logger$1.warn("[SignalWire] DPoP initialization failed, proceeding without DPoP:", error);
+			this._dpopManager = void 0;
+			return;
+		}
+	}
 	async validateCredentials(credentialProvider, credentials) {
-		const _credentials = credentials ?? await credentialProvider.authenticate();
+		const fingerprint = await this.initDPoP();
+		const _credentials = credentials ?? await credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
 		if (_credentials.token) try {
 			const decodeHeader = (0, jwt_decode.jwtDecode)(_credentials.token, { header: true });
 			this._deps.ch = decodeHeader.ch;
@@ -6510,12 +7042,53 @@ var SignalWire = class extends Destroyable {
 		};
 		this._transport = new TransportManager(this._deps.storage, this._deps.protocolKey, this._deps.WebSocket, PreferencesContainer.instance.relayHost ?? this._deps.relayHost, errorHandler);
 		this._attachManager = new AttachManager(this._deps.storage, this._deps.deviceController, PreferencesContainer.instance.reconnectCallsTimeout, this._deps.attachedCallsKey);
-		this._clientSession = new ClientSessionManager(this._deps.credential, this._transport, this._deps.storage, this._deps.authorizationStateKey, this._deps.deviceController, this._attachManager, this._deps.webRTCApiProvider);
+		this._clientSession = new ClientSessionManager(() => this._deps.credential, this._transport, this._deps.storage, this._deps.authorizationStateKey, this._deps.deviceController, this._attachManager, this._deps.webRTCApiProvider, this._dpopManager);
 		this._publicSession = new ClientSessionWrapper(this._clientSession);
+		this._clientSession.onBeforeReconnect = async () => {
+			if (!this._credentialProvider) return;
+			try {
+				const fingerprint = this._dpopManager?.initialized ? this._dpopManager.fingerprint : void 0;
+				logger$1.debug("[SignalWire] Credential expired, refreshing before reconnect");
+				const newCredentials = await this._credentialProvider.authenticate(fingerprint ? { fingerprint } : void 0);
+				this._deps.credential = newCredentials;
+				logger$1.debug("[SignalWire] Credential refreshed successfully for reconnect");
+			} catch (error) {
+				logger$1.error("[SignalWire] Failed to refresh credentials for reconnect:", error);
+			}
+		};
 		this.subscribeTo(this._clientSession.errors$, (error) => {
 			this._errors$.next(error);
 		});
 		await this._clientSession.connect();
+		if (this._dpopManager?.initialized) {
+			if (this._refreshTimerId) {
+				clearTimeout(this._refreshTimerId);
+				this._refreshTimerId = void 0;
+				logger$1.debug("[SignalWire] Developer refresh disabled — Client Bound SAT activation starting");
+			}
+			this._deviceTokenManager = new DeviceTokenManager(this._dpopManager, this._deps.http, (error) => this._errors$.next(error), () => this._deps.credential);
+			await this._deviceTokenManager.activate(this._deps.subscriber, this._clientSession, (cred) => {
+				this._deps.credential = {
+					...this._deps.credential,
+					...cred
+				};
+			});
+			this.subscribeTo(this._clientSession.authenticated$.pipe((0, rxjs.skip)(1), (0, rxjs.filter)(Boolean)), () => {
+				logger$1.debug("[SignalWire] Re-activating Client Bound SAT after reconnect");
+				this._deviceTokenManager?.activate(this._deps.subscriber, this._clientSession, (cred) => {
+					this._deps.credential = {
+						...this._deps.credential,
+						...cred
+					};
+				});
+				logger$1.debug("[SignalWire] Re-registering subscriber after reconnect");
+				this.register().then(() => {
+					logger$1.debug("[SignalWire] Subscriber re-registered successfully after reconnect");
+				}).catch((error) => {
+					logger$1.error("[SignalWire] Re-registration failed after reconnect:", error);
+				});
+			});
+		}
 		const conversationManager = new ConversationsManager(this._clientSession, this._deps.http, () => this._deps.getSubscriberFromAddressId(), errorHandler);
 		const directory = new DirectoryManager(this._deps.http, this._clientSession, conversationManager, errorHandler);
 		this._directory$.next(directory);
@@ -6793,6 +7366,8 @@ var SignalWire = class extends Destroyable {
 			clearTimeout(this._refreshTimerId);
 			this._refreshTimerId = void 0;
 		}
+		this._deviceTokenManager?.destroy();
+		this._dpopManager?.destroy();
 		super.destroy();
 	}
 };
@@ -6919,6 +7494,8 @@ exports.Address = Address;
 exports.CallCreateError = require_operators.CallCreateError;
 exports.ClientPreferences = ClientPreferences;
 exports.CollectionFetchError = require_operators.CollectionFetchError;
+exports.DPoPInitError = require_operators.DPoPInitError;
+exports.DeviceTokenError = require_operators.DeviceTokenError;
 exports.InvalidCredentialsError = require_operators.InvalidCredentialsError;
 exports.MediaTrackError = require_operators.MediaTrackError;
 exports.MessageParseError = require_operators.MessageParseError;
@@ -6928,6 +7505,7 @@ exports.SelfParticipant = SelfParticipant;
 exports.SignalWire = SignalWire;
 exports.StaticCredentialProvider = StaticCredentialProvider;
 exports.Subscriber = Subscriber;
+exports.TokenRefreshError = require_operators.TokenRefreshError;
 exports.UnexpectedError = require_operators.UnexpectedError;
 exports.VertoPongError = require_operators.VertoPongError;
 exports.WebRTCCall = WebRTCCall;