@signalwire/js 4.0.0-dev-20260910191529 → 4.0.0-dev-20260911135809

package/dist/index.d.cts

@@ -1166,6 +1166,14 @@ interface CallError {
   readonly error: Error;
   /** ID of the call that produced this error. */
   readonly callId: string;
+  /**
+   * Which peer connection failed. Auxiliary legs are never fatal, so a consumer
+   * can surface "screen share failed, call continues". Absent for call- and
+   * session-level errors.
+   */
+  readonly leg?: RTCPeerConnectionPropose;
+  /** `callId` is always the call's id, never the leg's. Use this for the leg. */
+  readonly legId?: string;
 }
 declare class CallCreateError extends Error {
   message: string;
@@ -1194,6 +1202,15 @@ declare class CollectionFetchError extends Error {
   originalError: unknown;
   constructor(operation: string, originalError: unknown);
 }
+/**
+ * An auxiliary leg did not connect within its budget. Typed rather than a bare
+ * RxJS `TimeoutError` so the leg and cause survive.
+ */
+declare class AuxiliaryLegTimeoutError extends Error {
+  readonly leg: RTCPeerConnectionPropose;
+  readonly originalError?: Error | undefined;
+  constructor(leg: RTCPeerConnectionPropose, originalError?: Error | undefined);
+}
 declare class MediaTrackError extends Error {
   operation: string;
   kind: string;
@@ -1444,7 +1461,7 @@ interface AudioConstraintsEvent {
   /** Timestamp when the event occurred (epoch ms). */
   readonly timestamp: number;
 }
-/** Event emitted when server-pushed media params are applied. */
+/** Event emitted when the server pushes media params. */
 interface MediaParamsEvent {
   /** Audio constraints pushed by the server, if any. */
   readonly audio?: MediaTrackConstraints;
@@ -1452,6 +1469,15 @@ interface MediaParamsEvent {
   readonly video?: MediaTrackConstraints;
   /** Timestamp when the event occurred (epoch ms). */
   readonly timestamp: number;
+  /**
+   * `false` when the constraints did not reach every sender of a pushed kind:
+   * the sender carries media the SDK did not capture, the browser refused the
+   * constraints and re-acquisition failed, or the leg sends no media of that
+   * kind at all. The event is emitted whether or not they were applied, but a
+   * push naming a leg this call does not hold emits nothing at all — the event
+   * carries no leg identity to report it against.
+   */
+  readonly applied: boolean;
 }
 /** Structured diagnostic bundle for a session. */
 interface SessionDiagnostics {
@@ -2081,6 +2107,9 @@ declare class SelfParticipant extends Participant implements CallSelfParticipant
    *
    * The call is unaffected when acquisition fails.
    *
+   * Known issue: stopping the share before its leg connects can leave this
+   * promise pending until the call ends, so do not gate UI on it.
+   *
    * @throws The raw `getDisplayMedia` error. A dismissed picker or a
    * permission denial rejects with a `NotAllowedError` `DOMException` —
    * inspect `error.name` to tell benign cancels apart from real failures.
@@ -2097,8 +2126,12 @@ declare class SelfParticipant extends Participant implements CallSelfParticipant
    *
    * The call is unaffected when acquisition fails.
    *
+   * Known issue: removing the device before its leg connects can leave this
+   * promise pending until the call ends, so do not gate UI on it.
+   *
    * @throws The raw `getUserMedia` error (e.g. `NotAllowedError` on
-   * permission denial) — inspect `error.name` to decide how to react.
+   * permission denial) — inspect `error.name` to decide how to react — or
+   * `AuxiliaryLegTimeoutError` if the leg does not connect in time.
    */
   addAdditionalDevice(options: MediaOptions): Promise<void>;
   /** Removes an additional media input device by ID. */
@@ -2896,56 +2929,6 @@ interface NetworkChangeEvent {
   networkType?: string;
 }
 //#endregion
-//#region src/core/entities/Directory.d.ts
-/**
- * Directory interface for managing addresses
- *
- * This is the public API contract for address directory functionality.
- * It provides access to addresses, loading capabilities, and search functionality.
- *
- * @public
- */
-interface Directory extends AddressProvider<Address> {
-  /**
-   * Observable stream of all addresses in the directory
-   * Emits a new array whenever addresses are added, removed, or updated
-   */
-  readonly addresses$: Observable<Address[]>;
-  /**
-   * Current snapshot of all addresses in the directory
-   */
-  readonly addresses: Address[];
-  /**
-   * Observable indicating whether more addresses can be loaded from the server
-   */
-  readonly hasMore$: Observable<boolean>;
-  /**
-   * Observable indicating the current loading state
-   * Emits `true` when loading, `false` when idle
-   */
-  readonly loading$: Observable<boolean>;
-  readonly loading: boolean;
-  /**
-   * Load more addresses from the server
-   * Only loads if `hasMore` is true
-   */
-  loadMore(): void;
-  /**
-   * Get a specific address by ID
-   *
-   * @param addressId - The address ID to retrieve
-   * @returns The address instance, or undefined if not found
-   */
-  get(addressId: string): Address | undefined;
-  /**
-   * Find an address ID by searching for a name
-   *
-   * @param uri - The address name to search for
-   * @returns Promise resolving to the address ID, or undefined if not found
-   */
-  findAddressIdByURI(uri: string): Promise<string | undefined>;
-}
-//#endregion
 //#region src/interfaces/ClientSession.d.ts
 /**
  * Minimal interface for what Call needs from session management
@@ -2986,2277 +2969,2361 @@ interface ClientSession {
   readonly callControl: 'routed' | 'in-dialog';
 }
 //#endregion
-//#region src/interfaces/SessionState.d.ts
+//#region src/controllers/LocalAudioPipeline.d.ts
 /**
- * Extended session interface that adds call management and authentication
- * state on top of the narrow ClientSession contract.
+ * Options for {@link LocalAudioPipeline}.
+ */
+interface LocalAudioPipelineOptions {
+  /** Factory for AudioContext — override for tests. Defaults to `new AudioContext()`. */
+  audioContextFactory?: () => AudioContext;
+  /** Initial gain (0..2, where 1 is unity). Defaults to 1. */
+  initialGain?: number;
+  /** RMS level [0..1] above which speaking$ emits true. Defaults to {@link VAD_THRESHOLD}. */
+  speakingThreshold?: number;
+  /**
+   * Milliseconds of silence below the threshold before speaking$ flips back to
+   * false. Prevents flicker on normal speech gaps. Defaults to {@link VAD_HOLD_MS}.
+   */
+  speakingHoldMs?: number;
+  /** Polling interval for level$. Defaults to {@link AUDIO_LEVEL_POLL_INTERVAL_MS}. */
+  pollIntervalMs?: number;
+}
+/**
+ * Web Audio pipeline for the local microphone stream.
  *
- * Accessible via `client.session`. Call and CallFactory continue to depend
- * only on the narrow ClientSession interface.
+ * Wraps the raw mic `MediaStreamTrack` in a graph of:
+ *
+ * ```
+ *   MediaStreamAudioSourceNode  →  GainNode  →  AnalyserNode  →  MediaStreamAudioDestinationNode
+ * ```
+ *
+ * The {@link outputTrack} from the destination node is what callers should
+ * attach to the `RTCRtpSender` in place of the raw mic track. The same
+ * destination track is reused across input changes (device switch, mute /
+ * unmute track replacement) so the sender reference stays stable — only the
+ * source end of the graph is rebuilt.
+ *
+ * The pipeline owns a single {@link AudioContext}. Callers must invoke
+ * {@link destroy} to release it when the call ends.
  */
-interface SessionState extends ClientSession {
+declare class LocalAudioPipeline extends Destroyable {
+  private readonly _audioContext;
+  private readonly _gainNode;
+  private readonly _analyser;
+  private readonly _destination;
+  private readonly _analyserBuffer;
+  private readonly _speakingThreshold;
+  private readonly _speakingHoldMs;
+  private readonly _pollIntervalMs;
+  private _inputSource;
+  private _inputStream;
+  private _lastSpokeAt;
+  private _gain$;
+  /** 1 when audio should pass through, 0 when silenced by PTT. */
+  private _pttMultiplier;
+  constructor(options?: LocalAudioPipelineOptions);
+  /** Observable of the current gain value (0..2). */
+  get gain$(): Observable<number>;
+  /** Current gain value (0..2). */
+  get gain(): number;
   /**
-   * Observable stream of currently active inbound calls.
-   * Filters `calls$` to only include calls with `direction === 'inbound'`.
+   * Processed output track to attach to the RTCRtpSender. Stable reference
+   * across input changes, so `sender.replaceTrack(pipeline.outputTrack)` only
+   * needs to be called once.
    */
-  readonly incomingCalls$: Observable<Call[]>;
+  get outputTrack(): MediaStreamTrack;
   /**
-   * Current snapshot of active inbound calls.
+   * Root-mean-square audio level of the input signal, 0..1. Emits on a fixed
+   * interval (~30fps by default).
    */
-  readonly incomingCalls: Call[];
+  get level$(): Observable<number>;
   /**
-   * Observable stream of all currently active calls (both inbound and outbound).
+   * Boolean VAD derived from {@link level$}. True while level ≥ threshold or
+   * during the hold window after the last frame that crossed the threshold.
    */
-  readonly calls$: Observable<Call[]>;
+  get speaking$(): Observable<boolean>;
   /**
-   * Current snapshot of all active calls.
+   * Set gain multiplier applied to the input signal. 0 = silence,
+   * 1 = unity, 2 = 2x. Values are clamped to [0, 2]. The effective gain on
+   * the graph also respects the current PTT state.
    */
-  readonly calls: Call[];
+  setGain(value: number): void;
   /**
-   * Observable that emits `true` once the session has been authenticated,
-   * and `false` after disconnect.
+   * Silence the graph when `active = false`, otherwise restore the configured
+   * gain. Use this from a PTT handler: released → `false`, held → `true`.
+   * Orthogonal to {@link setGain} — once PTT returns to active, the last
+   * configured gain reappears.
    */
-  readonly authenticated$: Observable<boolean>;
+  setPTTActive(active: boolean): void;
+  private applyEffectiveGain;
   /**
-   * Current authentication state.
-   * Returns `true` if the session is currently authenticated.
+   * Wire a new raw mic track as the pipeline's input. Replaces any previous
+   * input source and reconnects the graph so {@link outputTrack} continues
+   * to emit the processed audio. Pass `null` to disconnect the input (the
+   * output track stays alive but emits silence).
+   *
+   * Also resumes the underlying AudioContext on attach — Chrome creates it
+   * in a suspended state and the graph won't process (the destination
+   * track emits silence) until resume() succeeds.
    */
-  readonly authenticated: boolean;
+  setInputTrack(track: MediaStreamTrack | null): void;
+  destroy(): void;
+  private computeLevel;
+  private evaluateSpeaking;
 }
 //#endregion
-//#region src/managers/ClientSessionManager.d.ts
-/**
- * Discriminated union for session authentication state.
- * clientBound is tracked separately via _wasClientBound (sticky flag)
- * to avoid dual sources of truth.
- */
-type SessionAuthState = {
-  kind: 'unauthenticated';
-} | {
-  kind: 'authenticated';
-};
-declare class ClientSessionManager extends Destroyable implements SessionState {
-  private readonly getCredential;
-  private readonly transport;
-  private readonly storage;
-  private readonly authorizationStateKey;
-  private readonly attachManager;
-  private readonly dpopManager?;
-  private callFactory;
-  private callCreateTimeout;
-  private readonly agent;
-  private readonly eventAcks;
-  initialized$: Observable<boolean>;
-  private authorizationState$;
-  private connectVersion;
-  /**
-   * Optional hook called before a fresh connect on reconnect.
-   * Used by SignalWire to refresh expired credentials before re-authenticating.
-   * @internal
-   */
-  onBeforeReconnect?: () => Promise<void>;
+//#region src/controllers/RTCPeerConnectionController.d.ts
+interface RTCPeerConnectionControllerOptions extends MediaOptions {
+  callId?: string;
+  rtcConfiguration?: RTCConfiguration;
+  simulcast?: boolean;
+  sfu?: boolean;
+  msStreamsNumber?: number;
+  propose: RTCPeerConnectionPropose;
+  iceServers?: RTCIceServer[];
+  disableUdpIceServers?: boolean;
+  relayOnly?: boolean;
+  iceCandidateTimeout?: number;
+  iceGatheringTimeout?: number;
+  webRTCApiProvider?: WebRTCApiProvider;
+  /** Per-call preferred video codecs (overrides global preferences). */
+  preferredVideoCodecs?: string[];
+  /** Per-call preferred audio codecs (overrides global preferences). */
+  preferredAudioCodecs?: string[];
+  /** Per-call stereo Opus setting (overrides global preferences). */
+  stereo?: boolean;
+}
+type RTCPeerConnectionControllerOptionsPartial = Partial<RTCPeerConnectionControllerOptions>;
+interface UpdateSDPStatusParams {
+  status: 'received' | 'sent' | 'failed';
+  sdp?: string;
+}
+declare class RTCPeerConnectionController extends Destroyable {
+  protected options: RTCPeerConnectionControllerOptionsPartial;
+  readonly id: string;
+  firstSDPExchangeCompleted: boolean;
+  sdpInit?: RTCSessionDescriptionInit;
+  private negotiationNeeded$;
+  private deviceController;
+  private localStreamController;
+  private transceiverController?;
+  readonly localDescription$: Observable<RTCSessionDescription | null>;
+  peerConnection?: RTCPeerConnection;
+  private initPromise?;
+  private connectionTimeout;
+  private connectionTimer?;
+  private oniceconnectionstatechangeHandler;
+  private onconnectionstatechangeHandler;
+  private onsignalingstatechangeHandler;
+  private onicegatheringstatechangeHandler;
+  private onnegotiationneededHandler;
+  private updateSelectedInputDevice;
+  private _isNegotiating$;
+  private _iceGatheringController?;
+  private _memberId;
+  private _type;
+  private _iceConnectionState$;
+  private _connectionState$;
+  private _signalingState$;
+  private _iceGatheringState$;
+  private _errors$;
+  private _iceCandidates$;
   /**
-   * Session-wide call control transport (see {@link ClientSession.callControl}).
-   * Set from {@link SignalWireOptions.callControl} by SignalWire after construction;
-   * defaults to `'routed'`. Read by every Call, so it needs no per-call persistence.
+   * Emits once local media is settled: acquired, intentionally receive-only, or
+   * failed and degraded. Separates the media and signalling phases of call
+   * creation. Not `localStream$` — the receive-only paths never build a stream,
+   * so that would hang exactly the calls with nothing to acquire.
    */
-  callControl: 'routed' | 'in-dialog';
-  private _authorization$;
-  private _errors$;
-  private _directory?;
-  private _authState$;
-  /** Sticky flag — once true, stays true for the session lifetime. */
-  private _wasClientBound;
-  private _userInfo$;
-  private _calls$;
-  private _iceServers$;
-  constructor(getCredential: () => SDKCredential, transport: TransportManager, storage: StorageManager, authorizationStateKey: string, deviceController: DeviceController, attachManager: AttachManager, webRTCApiProvider: WebRTCApiProvider, dpopManager?: CryptoController | undefined, networkChange$?: Observable<NetworkChangeEvent>);
-  get incomingCalls$(): Observable<Call[]>;
-  get incomingCalls(): Call[];
-  get userInfo$(): Observable<Address | null>;
-  get userInfo(): Address | null;
-  get calls$(): Observable<Call[]>;
-  get calls(): Call[];
-  get iceServers(): RTCIceServer[] | undefined;
-  get authorization$(): Observable<Authorization | undefined>;
-  get authorization(): Authorization | undefined;
+  private _localMediaSettled$;
+  private _initialized$;
+  private _remoteDescription$;
+  private _remoteStream$;
+  private _remoteOfferMediaDirections;
+  private _localAudioPipeline;
+  constructor(options?: RTCPeerConnectionControllerOptionsPartial, remoteSessionDescription?: string, deviceController?: DeviceController);
+  private get iceGatheringController();
+  private get shouldEmitLocalDescription();
+  private removeConnectionTimer;
+  setMemberId(memberId: string | null): void;
+  get memberId(): string | null;
+  stopTrackSender(kind: 'audio' | 'video' | 'both', options?: {
+    updateTransceiverDirection: boolean;
+  }): void;
+  private stopRawAudioInputForPipeline;
+  get isNegotiating$(): Observable<boolean>;
+  get isNegotiating(): boolean;
+  updateMediaDevicesOptions(options: MediaOptions): void;
+  get iceGatheringState$(): Observable<RTCIceGatheringState>;
+  get mediaTrackEnded$(): Observable<MediaStreamTrack>;
   get errors$(): Observable<Error>;
-  get authenticated$(): Observable<boolean>;
-  get authenticated(): boolean;
+  get iceCandidates$(): Observable<RTCIceCandidate[]>;
+  get initialized$(): Observable<boolean>;
+  get remoteDescription$(): Observable<RTCSessionDescription | null>;
+  /** Emits once local media is settled — acquired, or knowingly receive-only. */
+  get localMediaSettled$(): Observable<void>;
+  get localStream$(): Observable<MediaStream | null>;
+  get remoteStream$(): Observable<MediaStream | null>;
+  get localAudioTracks$(): Observable<MediaStreamTrack[]>;
+  get localVideoTracks$(): Observable<MediaStreamTrack[]>;
+  get iceConnectionState$(): Observable<RTCIceConnectionState>;
+  get connectionState$(): Observable<RTCPeerConnectionState>;
+  get signalingState$(): Observable<RTCSignalingState>;
+  get type(): RTCPeerConnectionType;
+  get propose(): RTCPeerConnectionPropose;
+  get isAdditionalDevice(): boolean;
+  get isMainDevice(): boolean;
+  get isScreenShare(): boolean;
+  protected get iceServers(): RTCIceServer[];
+  private get rtcConfiguration();
+  get receiveVideo(): boolean;
+  get receiveAudio(): boolean;
+  get localStream(): MediaStream | null;
+  get remoteStream(): MediaStream | null;
+  private get inputAudioDeviceConstraints();
+  private get inputVideoDeviceConstraints();
+  private get WebRTCPeerConnectionConstructor();
+  private get offerOptions();
+  private get answerOptions();
   /**
-   * Whether this session is client-bound (using a Client Bound SAT).
-   * When client-bound, DPoP proof creation failures are treated as
-   * authentication errors rather than silently degraded.
-   * @internal
+   * Initialize the RTCPeerConnection and setup event listeners.
+   * Called automatically when localDescription$ is subscribed to (deferred pattern).
+   * Uses Promise memoization to ensure initialization only happens once,
+   * even if called concurrently.
    */
-  get clientBound(): boolean;
-  /** @internal Current auth state for debugging/testing. */
-  get authState(): SessionAuthState;
+  private init;
   /**
-   * Set the directory instance
-   * Called by SignalWire after directory is created
-   * @internal
+   * Internal initialization implementation.
+   * Should only be called via init() to ensure single execution.
    */
-  setDirectory(directory: Directory): void;
-  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
-  send(message: JSONSerializable): void;
-  private init;
-  private setupMessageHandlers;
-  private loadAuthorizationStateFromStorage;
-  private updateAuthorizationStateInStorage;
-  private get authStateEvent$();
-  get signalingEvent$(): Observable<(Omit<{
-    event_type: "webrtc.message";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: WebrtcMessagePayload;
-  }, "event_channel" | "project_id" | "node_id"> & {
-    event_channel: string;
-    project_id: string;
-    node_id: string;
-  }) | {
-    event_type: "signalwire.authorization.state";
-    params: SignalwireAuthorizationStatePayload;
-  } | (Omit<{
-    event_type: "call.joined";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallJoinedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.left";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallLeftPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallUpdatedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.state";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallStatePayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.play";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallPlayPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.connect";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallConnectPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "room.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: RoomUpdatedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | Omit<{
-    event_type: "member.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberUpdatedPayload;
-  }, never> | Omit<{
-    event_type: "member.joined";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberJoinedPayload;
-  }, never> | Omit<{
-    event_type: "member.left";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberLeftPayload;
-  }, never> | Omit<{
-    event_type: "member.talking";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberTalkingPayload;
-  }, never> | Omit<{
-    event_type: "layout.changed";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: LayoutChangedPayload;
-  }, never> | (Omit<{
-    event_type: "conversation.message";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: ConversationMessagePayload;
-  }, "event_channel" | "timestamp" | "is_author"> & {
-    event_channel: string;
-    timestamp: string;
-    is_author: boolean;
-  }) | (Omit<{
-    event_type: "conversation.message.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: ConversationMessagePayload;
-  }, "event_channel" | "timestamp" | "is_author"> & {
-    event_channel: string;
-    timestamp: string;
-    is_author: boolean;
-  })>;
-  private get vertoInvite$();
-  private get vertoAttach$();
-  private get contexts();
-  private get eventing();
-  private get topics();
-  private get authentication();
-  connect(): Promise<void>;
-  private handleAuthenticationError;
+  private doInit;
+  private setupPeerConnection;
+  private startNegotiation;
   /**
-   * Clear the resume state (authorization_state + protocol) and ask the
-   * transport to reconnect. The `connected` event re-triggers
-   * `authenticate()`, which now has no stored state and so performs a fresh
-   * connect.
-   *
-   * This is the stale-auth-state recovery helper used by handleAuthError:
-   * the server rejected a reconnect, so the resume state is discarded and a
-   * fresh connect follows. Attach records are deliberately preserved — the
-   * session lives on through the reconnect and reattachCalls() needs the
-   * stored call references afterwards. Do NOT add detachAll() here.
+   * Create an SDP offer and set it as local description.
+   */
+  private createOffer;
+  updateAnswerStatus({
+    status,
+    sdp
+  }: UpdateSDPStatusParams): Promise<void>;
+  updateOfferStatus({
+    status,
+    sdp
+  }: UpdateSDPStatusParams): Promise<void>;
+  /**
+   * Accept an inbound call by creating the SDP answer.
+   * Optionally override media options before the answer is generated.
+   * Must be called after initialization for inbound (answer-type) connections.
+   */
+  acceptInbound(mediaOverrides?: MediaOptions): Promise<void>;
+  private handleOfferReceived;
+  private readyToConnect;
+  private setRemoteDescriptionBefore;
+  protected setLocalDescription(params: RTCSessionDescriptionInit): Promise<void>;
+  setLocalDescriptionBefore(sdp?: string): Promise<string>;
+  /**
+   * Create an SDP answer and set it as local description.
+   */
+  private createAnswer;
+  /**
+   * Setup event listeners on RTCPeerConnection for state changes.
+   */
+  private setupEventListeners;
+  private negotiationEnded;
+  /**
+   * Trigger an ICE restart through the existing negotiation pipeline.
    *
-   * Connect-time recovery only. A *request* refused on an already
-   * authenticated session is never healed here: dropping the resume state
-   * destroys the association between the socket and the previous session,
-   * which is what reattach depends on. That path mints a fresh credential and
-   * reauthenticates instead (see `SignalWire.recoverAndRetry`).
+   * This creates an offer with iceRestart: true and goes through the full
+   * SDP pipeline (setLocalDescription → ICE gathering → localDescription$ emission).
+   * The caller should NOT send the SDP manually — the existing
+   * setupLocalDescriptionHandler in VertoManager will pick up the emission
+   * from localDescription$ and send it as a verto.modify.
    *
-   * For public teardown (disconnect/destroy), use {@link teardownSessionState}
-   * instead, which clears the attach records as well.
+   * Unlike calling pc.createOffer/setLocalDescription directly, this method:
+   * - Sets _isNegotiating$ so ICEGatheringController arms its timers
+   * - Waits for ICE gathering to complete before localDescription$ emits
+   * - Goes through setLocalDescriptionBefore() for any SDP munging
    */
-  private discardResumeStateAndReconnect;
-  cleanupStoredConnectionParams(): Promise<void>;
+  triggerIceRestart(relayOnly?: boolean): Promise<void>;
+  private restoreIceTransportPolicy;
   /**
-   * Public-teardown helper for disconnect()/destroy(). Clears the resume
-   * state (authorization_state + protocol) AND the attach records as one
-   * atomic unit.
-   *
-   * The two stores are coupled: the backend only honors attach records
-   * within the session identified by the resume state, so ending the
-   * session must clear both. Clearing one without the other strands records
-   * no future session can honor (disconnect) or revives a session the
-   * developer explicitly ended (destroy).
+   * Setup track handling for remote tracks.
    *
-   * Distinct from {@link cleanupStoredConnectionParams}, which keeps the
-   * attach records for the stale-auth-state recovery path.
+   * @returns `false` when the connection went away while local media was being
+   * acquired — see {@link setupLocalTracks}.
    */
-  teardownSessionState(): Promise<void>;
-  protected updateAuthState(authorization_state: string): Promise<void>;
-  reauthenticate(token: string, dpopToken?: string, options?: {
-    clientBound?: boolean;
-  }): Promise<void>;
-  private authenticate;
-  disconnect(): Promise<void>;
-  private createInboundCall;
+  private setupTrackHandling;
   /**
-   * Handle a server-pushed verto.attach event at the session level.
+   * @returns `false` when the connection was torn down while getUserMedia was
+   * in flight. The acquisition is not cancellable, so the caller must stop
+   * rather than go on to touch a peer connection that is closed or gone.
+   */
+  private setupLocalTracks;
+  /** True for a main connection with no local media to send. */
+  private hasNoLocalMediaToSend;
+  /** The media kinds this connection wants to send: 'audiovideo' | 'video' | 'audio'. */
+  private get requestedMediaKinds();
+  /**
+   * Handle a local media acquisition failure with a typed, semantically
+   * accurate MediaAccessError created at the acquisition site:
+   * - Auxiliary connections (screenshare / additional-device) throw a
+   *   non-fatal error — VertoManager surfaces it and the call is unaffected.
+   * - The main connection degrades to receive-only when allowed (default),
+   *   otherwise fails with a fatal error.
+   */
+  private handleLocalMediaFailure;
+  /**
+   * Negotiate receive-only m-lines when there are no local tracks to send.
+   * Only offer-type connections add transceivers — answer-type connections
+   * reuse the transceivers created from the remote offer.
+   */
+  private setupReceiveOnlyTransceivers;
+  private getUserMedia;
+  private getDisplayMedia;
+  private setupRemoteTracks;
+  restoreTrackSender(kind: 'audio' | 'video' | 'both'): Promise<void>;
+  private restoreRawAudioInputForPipeline;
+  /**
+   * Return the lazily-created {@link LocalAudioPipeline}, constructing it on
+   * first access. On creation the current audio sender's track is routed
+   * through the pipeline (input → gain → analyser → destination) and the
+   * sender is switched to emit the processed track. Returns `null` when no
+   * audio sender exists yet (pre-negotiation).
+   */
+  ensureLocalAudioPipeline(): LocalAudioPipeline | null;
+  /** The active LocalAudioPipeline, or null if it hasn't been created yet. */
+  get localAudioPipeline(): LocalAudioPipeline | null;
+  private applyLocalAudioPipelineToSender;
+  /**
+   * Add a local media track to the peer connection.
+   * @param track - The MediaStreamTrack to add
+   */
+  addLocalTrack(track: MediaStreamTrack): void;
+  /**
+   * Remove a local media track from the peer connection.
+   * @param trackId - The ID of the track to remove
+   */
+  removeLocalTrack(trackId: string): void;
+  /**
+   * Replace all existing media tracks with a new media  track.
+   * Convenience method for single-track scenarios.
+   * @param track - The MediaStreamTrack to set
+   */
+  setLocalTrack(track: MediaStreamTrack): void;
+  /**
+   * @returns whether the constraints reached the media the leg is sending.
    *
-   * On page reload the server detects the reconnected session and pushes
-   * verto.attach for any active calls. If a call object already exists
-   * (network blip, no reload), the per-call handler in VertoManager deals
-   * with it. This method only creates a new call object when no existing
-   * one matches the callID.
+   * With the pipeline engaged the audio sender carries the processed
+   * destination track, so the sender scan would find nothing it may touch and
+   * every audio constraint API would silently no-op. The constraints belong to
+   * the pipeline's device source, which is the capture that sender ultimately
+   * carries.
    */
-  private handleVertoAttach;
-  createOutboundCall(destination: string | Address, options?: CallOptions): Promise<Call>;
-  private createCall;
-  destroy(): void;
-}
-declare class ClientSessionWrapper implements SessionState {
-  private clientSessionManager;
-  constructor(clientSessionManager: ClientSessionManager);
-  get authenticated$(): Observable<boolean>;
-  get authenticated(): boolean;
+  updateSendersConstraints(kind: 'audio' | 'video', constraints?: MediaTrackConstraints): Promise<boolean>;
   /**
-   * Whether the session is using a Client Bound SAT (DPoP). Sticky — set
-   * when the binding is established or restored from a resumed session's
-   * server authorization.
+   * Mirror of the sender path for a piped audio leg: same merge, same fallback
+   * ladder, same device-capture invariant — but the swap target is the pipeline
+   * input, so the sender keeps emitting the pipeline's output track and its
+   * identity survives the change.
    */
-  get clientBound(): boolean;
-  get signalingEvent$(): Observable<(Omit<{
-    event_type: "webrtc.message";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: WebrtcMessagePayload;
-  }, "event_channel" | "project_id" | "node_id"> & {
-    event_channel: string;
-    project_id: string;
-    node_id: string;
-  }) | {
-    event_type: "signalwire.authorization.state";
-    params: SignalwireAuthorizationStatePayload;
-  } | (Omit<{
-    event_type: "call.joined";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallJoinedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.left";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallLeftPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallUpdatedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.state";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallStatePayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.play";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallPlayPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "call.connect";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: CallConnectPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | (Omit<{
-    event_type: "room.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: RoomUpdatedPayload;
-  }, "event_channel"> & {
-    event_channel: string;
-  }) | Omit<{
-    event_type: "member.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberUpdatedPayload;
-  }, never> | Omit<{
-    event_type: "member.joined";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberJoinedPayload;
-  }, never> | Omit<{
-    event_type: "member.left";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberLeftPayload;
-  }, never> | Omit<{
-    event_type: "member.talking";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: MemberTalkingPayload;
-  }, never> | Omit<{
-    event_type: "layout.changed";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: LayoutChangedPayload;
-  }, never> | (Omit<{
-    event_type: "conversation.message";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: ConversationMessagePayload;
-  }, "event_channel" | "timestamp" | "is_author"> & {
-    event_channel: string;
-    timestamp: string;
-    is_author: boolean;
-  }) | (Omit<{
-    event_type: "conversation.message.updated";
-    event_channel: EventChannel;
-    timestamp: number;
-    project_id?: string;
-    node_id?: string;
-    is_author?: boolean;
-    params: ConversationMessagePayload;
-  }, "event_channel" | "timestamp" | "is_author"> & {
-    event_channel: string;
-    timestamp: string;
-    is_author: boolean;
-  })>;
-  get iceServers(): RTCIceServer[] | undefined;
-  get callControl(): 'routed' | 'in-dialog';
-  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
-  get incomingCalls$(): Observable<Call[]>;
-  get incomingCalls(): Call[];
-  get calls$(): Observable<Call[]>;
-  get calls(): Call[];
+  private applyPipelineSourceConstraints;
+  /**
+   * Clean up resources and close the peer connection.
+   * Completes all observables to prevent memory leaks.
+   */
+  destroy(): void;
+  private removeAllListeners;
+  private stopRemoteTracks;
+  get mediaDirections(): {
+    audio: RTCRtpTransceiverDirection;
+    video: RTCRtpTransceiverDirection;
+  };
+  protected _setRemoteDescription(params: RTCSessionDescriptionInit): Promise<void>;
 }
 //#endregion
-//#region src/core/types/warnings.types.d.ts
-/**
- * Non-fatal warning emitted via {@link SignalWire.warnings$ | client.warnings$}.
- *
- * Use to detect SDK behaviors that affect session liveness or developer-facing
- * contracts but do not warrant disconnection. Discriminated by `code`.
- *
- * Existing consumers of `errors$` are NOT notified — `warnings$` is a separate
- * channel so application code can react to warnings without triggering
- * error-handling code paths (e.g., disconnect cascades, user-facing toasts).
- */
-type SDKWarning = CredentialRefreshFallbackWarning | CredentialNoRefreshHandlerWarning;
-/**
- * Diagnostic detail for {@link CredentialRefreshFallbackWarning}. Stable
- * values, but treat unknown strings as "fell back for an unspecified cause" —
- * do not branch on this value for control flow. New values may be added in
- * future releases.
- */
-type CredentialRefreshFallbackReason = 'no-scope' | 'no-dpop-support' | 'endpoint-failed' | 'activation-timeout' | (string & {});
+//#region src/interfaces/WebRTCVerto.d.ts
 /**
- * Emitted when the SDK falls back to the developer-provided
- * {@link CredentialProvider.refresh} because the Client Bound SAT path
- * could not take over.
- *
- * Common causes:
- * - The minted SAT lacks `sat:refresh` scope (`reason: 'no-scope'`).
- * - The `/devices/token` exchange failed transiently (`reason: 'endpoint-failed'`).
- *
- * Subscribe to this warning to detect:
- * - SDKs running with plain SATs that rely on developer-managed refresh
- * - Deployments expected to use bound tokens that silently downgraded to bearer
- *   (a security-relevant signal for fleet observability)
+ * Extended interface for WebRTC Verto Manager
+ * Includes WebRTC-specific state and peer connection management
  */
-interface CredentialRefreshFallbackWarning {
-  code: 'credential_refresh_fallback';
-  source: 'CredentialProvider';
-  reason: CredentialRefreshFallbackReason;
-  message: string;
+interface WebRTCVerto extends VertoManager {
+  readonly selfId$: Observable<string | null>;
+  /** Separates the media phase of call creation from the signalling phase. */
+  readonly localMediaSettled$: Observable<void>;
+  readonly selfId: string | null;
+  readonly nodeId$: Observable<string | null>;
+  readonly nodeId: string | null;
+  readonly localStream$: Observable<MediaStream>;
+  readonly localStream: MediaStream | null;
+  readonly remoteStream$: Observable<MediaStream>;
+  readonly remoteStream: MediaStream | null;
+  readonly mediaDirections$: Observable<MediaDirections>;
+  readonly mediaDirections: MediaDirections;
+  readonly signalingStatus$: Observable<SignalingStatus>;
+  readonly mainPeerConnection: RTCPeerConnectionController;
+  bye(cause?: string): Promise<void>;
+  sendDigits(dtmf: string): Promise<void>;
+  /**
+   * Send a member-control op in-dialog via verto.info (no self/target member
+   * tuple). The payload rides in the verto.info `params.command` body — a
+   * sibling of `dialogParams`, same level as `dtmf` — matched to this call's
+   * channel by `dialogParams.callID`, so control lands on the call's own channel
+   * without relying on the {node_id,call_id,member_id} addressing the routed
+   * transport uses.
+   */
+  sendCallControl(method: string, params: Record<string, unknown>): Promise<unknown>;
+  hold(): Promise<void>;
+  unhold(): Promise<void>;
+  destroy(): void;
+  transfer(options: TransferOptions): Promise<void>;
+  /** Request a video keyframe via verto.modify. */
+  requestKeyframe?: () => void;
+  /** Request an ICE restart via verto.modify with iceRestart offer. */
+  requestIceRestart?: (relayOnly?: boolean) => Promise<void>;
+  /** Request an ICE restart on all active peer connections (multi-leg). */
+  requestIceRestartAll?: (relayOnly?: boolean) => Promise<void>;
+  /** Request keyframes on all video-receiving legs (skips send-only screen share). */
+  requestKeyframeAll?: () => void;
+  /** Lazily create (or return) the local audio pipeline for the main peer connection. */
+  ensureLocalAudioPipeline(): LocalAudioPipeline | null;
+  /** Current local audio pipeline, or null if it has not been created yet. */
+  readonly localAudioPipeline: LocalAudioPipeline | null;
+}
+//#endregion
+//#region src/managers/CallEventsManager.d.ts
+interface WebRTCCallEventManagerOptions {}
+/** @internal */
+declare class CallEventsManager extends Destroyable {
+  protected webRtcCallSession: CallManager;
+  protected options: WebRTCCallEventManagerOptions;
+  private selfId?;
+  private originCallId?;
+  private callIds;
+  private roomSessionIds;
+  private _participants$;
+  private _self$;
+  private _sessionState$;
+  constructor(webRtcCallSession: CallManager, options?: WebRTCCallEventManagerOptions);
+  get participants$(): Observable<CallParticipant[]>;
+  get participants(): CallParticipant[];
+  get self$(): Observable<CallSelfParticipant>;
+  isRoomSessionIdValid(roomSessionId: string): boolean;
+  addCallId(callId: string): void;
+  isCallIdValid(callId: string): boolean;
+  get recording$(): Observable<boolean>;
+  get recordings$(): Observable<Record<string, unknown>[]>;
+  get streaming$(): Observable<boolean>;
+  get streams$(): Observable<Record<string, unknown>[]>;
+  get playbacks$(): Observable<Record<string, unknown>[]>;
+  get raiseHandPriority$(): Observable<boolean>;
+  get locked$(): Observable<boolean>;
+  get meta$(): Observable<Record<string, unknown>>;
+  get capabilities$(): Observable<Capability[]>;
+  get layout$(): Observable<string>;
+  get layouts$(): Observable<string[]>;
+  get layoutLayers$(): Observable<LayoutLayer[]>;
+  get self(): CallSelfParticipant | null;
+  get layoutLayers(): LayoutLayer[];
+  get recording(): boolean;
+  get streaming(): boolean;
+  get raiseHandPriority(): boolean;
+  get locked(): boolean;
+  get meta(): Record<string, unknown>;
+  get layout(): string | undefined;
+  get layouts(): string[];
+  get capabilities(): Capability[];
+  isSessionEvent(id: string): boolean;
+  protected initSubscriptions(): void;
+  private updateParticipantPositions;
+  updateLayouts(): void;
+  private updateParticipants;
+  private upsertParticipant;
+  private get callJoinedEvent$();
+  private get layoutChangedEvent$();
+  private get memberUpdates$();
+  destroy(): void;
+}
+//#endregion
+//#region src/managers/CallRecoveryManager.d.ts
+type RecoveryState$1 = 'idle' | 'debouncing' | 'recovering' | 'cooldown';
+interface RecoveryEvent$1 {
+  action: 'keyframe_requested' | 'reinvite_started' | 'reinvite_succeeded' | 'reinvite_failed' | 'reinvite_timeout' | 'max_attempts_reached' | 'signal_reconnect' | 'full_reconnect' | 'video_disabled' | 'video_restored';
+  reason: string;
+  attempt?: number;
+  maxAttempts?: number;
+  timestamp: number;
 }
+//#endregion
+//#region src/utils/qualityScore.d.ts
 /**
- * Emitted when a credential has an `expiry_at` but the provider supplies no
- * `refresh()` handler. The session will terminate at expiry with no fallback.
+ * MOS (Mean Opinion Score) quality computation based on the simplified
+ * ITU-T G.107 E-model.
  *
- * Implementors who want long-lived sessions must provide a `refresh()` handler
- * or mint tokens with the `sat:refresh` scope (Client Bound SAT path).
+ * Provides a single 1-5 number that applications can use for a
+ * green / yellow / red quality indicator without understanding raw
+ * jitter and packet-loss values.
  */
-interface CredentialNoRefreshHandlerWarning {
-  code: 'credential_no_refresh_handler';
-  source: 'CredentialProvider';
-  message: string;
-  /** Token expiry timestamp (epoch milliseconds). */
-  expiresAt: number;
-}
+type QualityLevel$1 = 'excellent' | 'good' | 'fair' | 'poor' | 'critical';
 //#endregion
-//#region src/utils/logger.d.ts
-/** Log level names supported by the SDK. */
-type LogLevel = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'silent';
+//#region src/core/entities/Call.d.ts
 /**
- * Logger interface that consumers can implement to replace the built-in logger.
- * All methods accept variadic arguments matching the browser console API.
+ * Manager instances returned by initialization callback
  */
-interface SDKLogger {
-  error(...args: unknown[]): void;
-  warn(...args: unknown[]): void;
-  info(...args: unknown[]): void;
-  debug(...args: unknown[]): void;
-  trace(...args: unknown[]): void;
-}
-/** Options for WebSocket traffic logging. */
-interface WsTrafficOptions {
-  type: 'send' | 'recv' | 'http';
-  /** Parsed object or raw string — will be JSON.stringify'd for display if an object. */
-  payload: unknown;
+interface CallManagers {
+  vertoManager: WebRTCVerto;
+  callEventsManager: CallEventsManager;
 }
 /**
- * Options for WebSocket traffic logging using raw strings.
- * The string is only parsed when logging is enabled, avoiding
- * unnecessary JSON.parse on every message.
+ * Initialization callback that creates managers for a Call instance
+ * @param call - The WebRTCCall instance being initialized
+ * @returns Manager instances for the call
  */
-interface WsTrafficRawOptions {
-  type: 'send' | 'recv';
-  raw: string;
-}
-/** Debug options that control verbose SDK logging. */
-interface DebugOptions {
-  /** Log all WebSocket send/recv traffic to the console. */
-  logWsTraffic?: boolean;
-}
-/** Extended logger with SDK-internal helpers (wsTraffic). */
-interface InternalSDKLogger extends SDKLogger {
-  wsTraffic: (options: WsTrafficOptions | WsTrafficRawOptions) => void;
-}
-/** Replace the built-in logger with a custom implementation. Pass `null` to restore defaults. */
-declare const setLogger: (logger: SDKLogger | null) => void;
-/** Configure debug options (e.g., `{ logWsTraffic: true }`). */
-declare const setDebugOptions: (options: DebugOptions | null) => void;
+type ManagerInitializer = (call: WebRTCCall) => CallManagers;
 /**
- * Set the log level for the built-in logger.
- * Has no effect when a custom logger is set via `setLogger()`.
+ * Required initialization configuration for Call constructor.
+ * Calls must be created via {@link CallFactory} which provides these dependencies.
  */
-declare const setLogLevel: (level: LogLevel) => void;
-declare const getLogger: () => InternalSDKLogger;
-//#endregion
-//#region src/clients/SignalWire.d.ts
-/** Options for constructing a {@link SignalWire}. */
-interface SignalWireOptions {
-  /** Skip automatic WebSocket connection on construction. */
-  skipConnection?: boolean;
-  /** Skip automatic user registration on construction. */
-  skipRegister?: boolean;
-  /** Skip monitoring media device changes. */
-  skipDeviceMonitoring?: boolean;
-  /** Whether to reconnect to previously attached calls. */
-  reconnectAttachedCalls?: boolean;
-  /** Whether to save preferences. */
-  savePreferences?: boolean;
-  /**
-   * Persist the session across page reloads.
-   *
-   * When `true`, credential, authorization state, and protocol are stored in
-   * `localStorage` (survives reload). The DPoP key pair is persisted in
-   * IndexedDB. On reload, the SDK restores the session from cache
-   * without calling `credentialProvider.authenticate()`.
-   *
-   * When `false` (default), session data lives in `sessionStorage` and is
-   * lost on reload.
-   *
-   * Both {@link SignalWire.disconnect | disconnect()} and
-   * {@link SignalWire.destroy | destroy()} end the session and clear the
-   * persisted resume state and attach records; credentials and device
-   * preferences survive. Use `resetToDefaults()` for a full wipe, or
-   * `unregister()` to temporarily stop receiving inbound calls while keeping
-   * the session alive.
-   */
-  persistSession?: boolean;
-  /** Custom storage implementation for persistence. */
-  storageImplementation?: Storage;
-  /** Custom WebSocket constructor */
-  webSocketConstructor?: WebSocketAdapter | NodeSocketAdapter;
-  /** Custom WebRTC API provider */
-  webRTCApiProvider?: WebRTCApiProvider;
-  /**
-   * Custom logger implementation. Must implement the {@link SDKLogger} interface.
-   * Pass `null` to restore the built-in logger.
-   *
-   * **Note:** Logger configuration is global — setting it on one instance affects all instances.
-   */
-  logger?: SDKLogger | null;
+interface CallInitialization {
   /**
-   * Log level for the built-in logger.
-   * Default: `'warn'`. Set to `'debug'` for verbose SDK output.
-   * Has no effect when a custom `logger` is provided.
-   *
-   * **Note:** Logger configuration is global — setting it on one instance affects all instances.
+   * Callback function that creates and wires manager instances
    */
-  logLevel?: LogLevel;
-  /** Debug options for verbose SDK diagnostics (e.g., `{ logWsTraffic: true }`). */
-  debug?: DebugOptions;
+  initializeManagers: ManagerInitializer;
   /**
-   * Control transport for `call.*` verbs across ALL calls in this session:
-   * - `'routed'` (default) sends them on the client's session channel.
-   * - `'in-dialog'` carries them on each call's own signaling channel via `verto.info`,
-   *   so control works without the client needing to know how the conference is hosted.
-   *
-   * `'in-dialog'` is opt-in because it does not reach everywhere `'routed'` does: use it
-   * only for calls that join a conference over SWML (e.g. an SWML `join_conference`).
-   *
-   * It is a client-wide setting rather than per-`dial()` because the SDK issues some
-   * control RPCs itself (fetching the layout list on join, for example), and those must
-   * travel the same way as the app's own, or reads and writes land on different transports.
-   *
-   * @experimental A rollout switch, not a long-term part of the API. Expected to
-   * disappear once `'in-dialog'` becomes the only transport, so it carries no semver
-   * promise and application code should not depend on it.
+   * Device controller for media device access
    */
-  callControl?: 'routed' | 'in-dialog';
-}
-/** Options for {@link SignalWire.dial}. Extends {@link MediaOptions} with dial-specific settings. */
-interface DialOptions extends MediaOptions {
-  /** Preferred video codecs for this call (overrides global preferences). */
-  preferredVideoCodecs?: string[];
-  /** Preferred audio codecs for this call (overrides global preferences). */
-  preferredAudioCodecs?: string[];
-  /** Enable stereo Opus for this call (overrides global preferences). */
-  stereo?: boolean;
-  /** Optional node ID for routing the call */
-  nodeId?: string;
+  deviceController: DeviceController;
   /**
-   * Custom variables sent with the Verto invite. Merged with
-   * `client.preferences.userVariables` and any query-string variables on the
-   * destination URI; values here take precedence.
+   * Network change events for feeding recovery pipeline
    */
-  userVariables?: Record<string, unknown>;
+  networkChange$?: Observable<NetworkChangeEvent>;
 }
 /**
- * Main entry point for the SignalWire Browser SDK.
- *
- * Manages authentication, WebSocket transport, call creation, and media devices.
+ * Concrete WebRTC call implementation.
  *
- * @example
- * ```ts
- * const client = new SignalWire(credentialProvider);
- * client.isConnected$.subscribe(connected => console.log('Connected:', connected));
- * const call = await client.dial('/public/my-room');
- * ```
+ * Manages the full lifecycle of a call including signaling, media streams,
+ * participants, layout, and event routing. Created via {@link SignalWire.dial}
+ * or received as an inbound call.
  */
-declare class SignalWire extends Destroyable implements DeviceController {
-  /** Global SDK preferences (timeouts, ICE config, media defaults). */
-  preferences: ClientPreferences;
-  private _user$;
-  private _directory$;
-  private _transport;
-  private _clientSession;
-  private _publicSession;
-  private _deviceController;
-  private _attachManager?;
-  /**
-   * Set once a credential recovery has been *verified* — reauthenticated and
-   * then proven by the operation it was meant to unblock. Read by the attach
-   * path, which may only discard an attach record when a reattach is refused
-   * on a credential the server has already accepted.
-   */
-  private _credentialRecovered;
-  private _isConnected$;
-  private _isRegistered$;
+declare class WebRTCCall extends Destroyable implements CallManager {
+  clientSession: ClientSession;
+  options: CallOptions;
+  address?: Address | undefined;
+  /** Unique identifier for this call. */
+  readonly id: string;
+  /** Destination URI this call was placed to. */
+  to?: string;
+  private vertoManager;
+  private callEventsManager;
+  private participantFactory;
   private _errors$;
-  private _warnings$;
-  private _options;
-  private _dpopManager?;
-  private _refreshCoordinator?;
-  /** The refresh path's own HTTP controller — see resolveCredentials. */
-  private _refreshHttp?;
-  /** Host `_refreshHttp` was built against, so it can be rebuilt when the token's `ch` changes. */
-  private _refreshHttpHost?;
-  private _credentialProvider?;
-  private _deps;
-  private _networkMonitor?;
-  private _visibilityController?;
-  private _diagnosticsCollector?;
-  private _platformCapabilities?;
-  /**
-   * Creates a new SignalWire client and begins connecting.
-   *
-   * @param credentialProvider - Provider that supplies authentication credentials.
-   * @param options - Configuration options (connection, device monitoring, preferences).
-   */
-  constructor(credentialProvider: CredentialProvider | undefined, options?: SignalWireOptions);
-  /**
-   * Build the refresh path's own HTTP controller, against whatever host is current.
-   *
-   * Called on first use rather than up front, so `apiHost` already reflects the
-   * token's `ch` claim. Same credential source as the container's controller — only
-   * the instance, and therefore its observable streams, is separate.
-   */
-  private createRefreshHttpController;
+  private _status$;
+  private _lastMergedStatus;
+  private _answered$;
+  private _answerMediaOptions?;
+  private _holdState;
+  private _userVariables$;
+  private _statsMonitor?;
+  private _recoveryManager?;
+  private _networkChange$?;
+  private _networkIssues$;
+  private _networkMetrics$;
+  private _isNetworkHealthy$;
+  private _qualityScore$;
+  private _qualityLevel$;
+  private _recoveryState$;
+  private _recoveryEvent$;
+  private _bandwidthConstrained$;
+  private _mediaParamsUpdated$;
+  private _customSubscriptions;
+  private _pushToTalkEnabled;
+  private _remoteAudioMeter;
+  constructor(clientSession: ClientSession, options: CallOptions, initialization: CallInitialization, address?: Address | undefined);
+  /** Observable stream of errors from media, signaling, and peer connection layers. */
+  get errors$(): Observable<CallError>;
   /**
-   * Initializes DPoP if not already set up. Returns the fingerprint on success.
+   * @internal Push an error to the call's error stream.
+   * Fatal errors automatically transition the call to `'failed'` and destroy it.
    */
-  private initDPoP;
+  emitError(callError: CallError): void;
+  /** Notify the recovery manager that a verto.modify signaling exchange failed. */
+  notifyModifyFailed(): void;
+  /** Whether this call is `'inbound'` or `'outbound'`. */
+  get direction(): CallDirection;
+  /** Observable of the address associated with this call. */
+  get address$(): Observable<Address | undefined>;
+  /** Display name of the caller. */
+  get fromName(): string | undefined;
+  /** Address URI of the caller. */
+  get from(): string | undefined;
+  /** Display name of the callee. */
+  get toName(): string | undefined;
+  /** Toggles whether incoming video is received. @throws {UnimplementedError} Not yet implemented. */
+  toggleIncomingVideo(): Promise<void>;
+  /** Toggles whether incoming audio is received. @throws {UnimplementedError} Not yet implemented. */
+  toggleIncomingAudio(): Promise<void>;
+  /** @internal Registers an additional call ID for event routing. */
+  addCallId(callId: string): void;
+  /** List of capabilities available in the current call. */
+  get capabilities(): Capability[];
+  /** Current snapshot of all participants in the call. */
+  get participants(): CallParticipant[];
+  /** The local participant, or `null` if not yet joined. */
+  get self(): CallSelfParticipant | null;
+  /** Toggles the call lock state, preventing or allowing new participants from joining. */
+  toggleLock(): Promise<void>;
   /**
-   * Resolves credentials using cache-first strategy when persistSession is enabled.
+   * Toggles the hold state of the call (pauses/resumes local media transmission).
    *
-   * 1. If persistSession → check localStorage for cached credential
-   * 2. If cached and not expired → use it (skip provider.authenticate())
-   * 3. If no cache or expired → call provider.authenticate()
-   * 4. If no provider AND no cache → throw
+   * Distinct from {@link Participant.toggleMute} which mutes individual tracks.
    */
-  private resolveCredentials;
-  private validateCredentials;
+  toggleHold(): Promise<void>;
+  /** @throws {UnimplementedError} Not yet implemented. Status tracked via {@link recording$}. */
+  startRecording(): Promise<void>;
+  /** @throws {UnimplementedError} Not yet implemented. Status tracked via {@link streaming$}. */
+  startStreaming(): Promise<void>;
   /**
-   * Reauthenticate the currently-open session with a freshly obtained
-   * credential so the new token takes effect on the live socket immediately —
-   * not just on the next reconnect. No-op when the session is not
-   * connected/authenticated or the credential carries no token (e.g. an
-   * authorization-state-only refresh). Non-fatal: reauth failures surface on
-   * `errors$` without aborting the refresh that triggered this.
+   * Replaces the call's custom metadata.
+   * @param _meta - Metadata object to set.
+   * @throws {UnimplementedError} Not yet implemented.
    */
-  private reauthenticateLiveSession;
+  setMeta(_meta: Record<string, unknown>): Promise<void>;
   /**
-   * Recover a session the server is refusing: mint a fresh credential,
-   * reauthenticate the live session with it, and retry the operation.
-   *
-   * The connection is deliberately kept. A reload authenticates the new socket
-   * against the persisted `authorization_state`, and that handshake is what
-   * associates the socket with the previous session — the association reattach
-   * depends on. `signalwire.reauthenticate` swaps the credential *on that same
-   * session*, so recovery never touches the resume state. Discarding it would
-   * heal the credential by destroying the very thing the caller is trying to
-   * get back to.
-   *
-   * The operation is still the verdict, never the RPC. Reauthenticating with
-   * the in-memory token is accepted by a resume even while requests stay
-   * refused, because the persisted `authorization_state` short-circuits token
-   * validation — and `signalwire.reauthenticate` with a *freshly minted* token
-   * has also been observed accepted while `subscriber.online` keeps being
-   * refused (staging run 33826974634). Both look like success and are not.
-   *
-   * @returns the operation's value, or the reason recovery could not deliver
-   *   one. `error` is undefined when there was no way to mint at all.
+   * Merges values into the call's custom metadata (unlike {@link setMeta} which replaces).
+   * @param _meta - Metadata to merge.
+   * @throws {UnimplementedError} Not yet implemented.
    */
-  private recoverAndRetry;
+  updateMeta(_meta: Record<string, unknown>): Promise<void>;
+  /** Observable of layout layer positions for all participants. */
+  get layoutLayers$(): Observable<LayoutLayer[]>;
+  /** Current snapshot of layout layers. */
+  get layoutLayers(): LayoutLayer[];
   /**
-   * Re-mint a credential and adopt it only if the live session accepts it.
+   * Executes a Verto RPC method targeting a specific participant.
    *
-   * The mechanism follows the binding: a client-bound session re-mints a bound
-   * base SAT through `authenticate()` with the DPoP fingerprint, because the
-   * developer refresh handler would hand back an unbound token and silently
-   * degrade the session. An unbound session uses the refresh handler. Rotation
-   * cost is not a reason to skip this — the only reason is having no mechanism.
+   * Constructs call context (node_id, call_id, member_id) and sends the RPC request.
    *
-   * @returns whether the session is now running on a freshly accepted credential.
-   */
-  private remintAndReauthenticate;
-  /**
-   * Re-mint a credential via `provider.refresh()`, routed through the
-   * coordinator's shared in-flight guard so concurrent re-mint paths (a
-   * scheduled/resume refresh, -32003 recovery, and reconnect) never fire a
-   * second `provider.refresh()` in parallel — which rotating one-time-use
-   * refresh tokens reject. Falls back to a direct call only if the coordinator
-   * has not been constructed yet.
+   * @param target - Target {@link MemberTarget} triple, or the local member's
+   *   ID string for self-operations (any other string is rejected — a bare
+   *   member id cannot carry the remote member's own call context).
+   * @param method - Verto method name (e.g. `'call.mute'`, `'call.member.remove'`).
+   * @param args - Parameters for the RPC method.
+   * @returns The RPC response.
+   * @throws {CallNotReadyError} If the call has no self member context yet.
+   * @throws {InvalidParams} If a string target is not the local member's ID.
+   * @throws {JSONRPCError} If the RPC call returns an error.
    */
-  private remintCredential;
+  executeMethod<T extends JSONRPCResponse = JSONRPCResponse>(target: string | MemberTarget, method: string, args: Record<string, unknown>): Promise<T>;
   /**
-   * Re-mint credentials before a fresh (re)connect (`onBeforeReconnect` hook).
-   * The session invokes this only when it is client-bound OR the in-memory
-   * token is expired. The re-mint mechanism depends on the binding:
-   *   - Client-bound: `authenticate()` with the DPoP fingerprint to obtain a
-   *     fresh base SAT the upcoming reconnect can re-bind (the
-   *     DeviceTokenManager re-activates afterwards).
-   *   - Unbound: the developer's non-interactive `refresh()` handler.
-   *     `authenticate()` is deliberately NOT used here — it may be interactive
-   *     (a login prompt) and must not fire on a background reconnect.
+   * `executeMethod` for a call opened with `callControl: 'in-dialog'`.
    *
-   * Rejects on failure so the session aborts the reconnect rather than
-   * replaying a stale token.
-   */
-  private refreshCredentialForReconnect;
-  /** Persist credential to localStorage when persistSession is enabled. */
-  private persistCredential;
-  /**
-   * Persist whether the session is client-bound, mirroring the credential's
-   * storage scopes so it survives a reload. The preflight recovery reads it
-   * before any session exists to decide whether to re-bind via `authenticate()`
-   * or refresh an unbound token; the marker tracks the latest binding, so an
-   * unbound reconnect clears a stale marker from an earlier client-bound login.
-   */
-  private persistClientBoundMarker;
-  /** Read the persisted client-bound marker (see {@link persistClientBoundMarker}). */
-  private wasClientBound;
-  private init;
-  private handleAttachments;
-  /**
-   * Fetch the authenticated user profile, recovering a stale credential.
+   * Translates the routed transport's calling convention into the in-dialog one. No
+   * `self` tuple is sent, but a `target` is — the same {call_id, member_id} the routed
+   * transport puts in `target` (minus node_id), for self-ops and cross-member ops alike.
    *
-   * On a reload the persisted credential can be expired. Unlike the WS resume —
-   * which the server accepts against the persisted `authorization_state` even
-   * with an expired token — this REST preflight has no such short-circuit and is
-   * refused (401). There is no session yet to reauthenticate, so recovery
-   * re-mints the credential through the provider ({@link refreshCredentialForReconnect})
-   * and retries with a FRESH {@link User}: Fetchable memoizes its result
-   * (shareReplay), so reusing the instance would replay the 401 instead of
-   * re-fetching with the new token. Without the user id the transport/session —
-   * and the reattach a reload is trying to preserve — cannot even be addressed.
+   * Target shapes are per-verb and irregular, so they are centralised here rather
+   * than left to callers: most verbs take a singular `target`, `call.member.remove`
+   * takes a plural `targets` array, and `call.member.position.set` takes a flat
+   * `targets` of `{call_id, position}` — the one verb keyed on call_id rather than
+   * member_id, so the member triple `Participant.setPosition` built is unwrapped.
    */
-  private fetchUserOrRecover;
+  private executeMethodInDialog;
   /**
-   * Establishes the WebSocket connection and authenticates the session.
-   *
-   * ## Reconnection behavior
-   *
-   * After a successful connection the underlying {@link WebSocketController}
-   * automatically attempts to reconnect whenever the socket closes
-   * unexpectedly (e.g. network change, server restart). Reconnection uses an
-   * **exponential back-off** strategy:
-   *
-   * - First retry after `reconnectDelayMin` (default **0.1 s**).
-   * - Each subsequent retry doubles the delay up to `reconnectDelayMax`
-   *   (default **3 s**).
-   * - The delay resets to `reconnectDelayMin` once a connection succeeds.
-   * - A per-attempt `connectionTimeout` (default **10 s**) aborts the
-   *   attempt and schedules the next retry if the server does not respond.
-   *
-   * Calling {@link disconnect} stops the reconnection loop entirely.
-   *
-   * ## Message handling during temporary disconnections
+   * Sends a `call.*` control verb **in-dialog** via `verto.info`, as an alternative
+   * to the routed {@link executeMethod} transport.
    *
-   * While the socket is not in the `connected` state, **outgoing messages
-   * are queued** in an internal buffer. Once the connection is
-   * re-established the queue is flushed in order so no outgoing RPC call is
-   * lost.
+   * Why both exist: `executeMethod` addresses the member with an explicit
+   * `{node_id, call_id, member_id}` tuple, which does not resolve for every conference,
+   * so the op can fail. An in-dialog frame carries the verb on the member's own
+   * signaling channel instead, so control works without the client needing to know how
+   * the conference is hosted.
    *
-   * **Incoming** server-to-client messages that arrive while the socket is
-   * down are *not* buffered by the SDK — they are expected to be
-   * re-delivered by the server after the session is re-authenticated.
-   * Active RPC calls that were awaiting a response will time out
-   * (default **5 s**) and reject with an `RPCTimeoutError`; callers should
-   * handle this and retry if appropriate.
+   * The trade-off is reach: the in-dialog transport is only accepted for calls that
+   * join a conference over SWML (e.g. an SWML `join_conference`); use the routed
+   * default otherwise.
    *
-   * The connection status can be observed via the `status$` observable on
-   * the transport layer, which emits `'connecting'`, `'connected'`,
-   * `'reconnecting'`, `'disconnecting'`, or `'disconnected'`.
-   */
-  connect(): Promise<void>;
-  /**
-   * Observable that emits the {@link User} profile once fetched,
-   * or `undefined` before authentication completes.
+   * `params` are sent verbatim — nothing is built for you, which includes the target.
+   * **A self-directed op still needs one**, or it is refused; name yourself explicitly:
    *
-   * @example
    * ```ts
-   * client.user$.subscribe(u => {
-   *   if (u) console.log('Logged in as', u.email);
-   * });
+   * const { call_id, member_id } = call.self.target;
+   * await call.sendCommand('call.mute', { channels: ['audio'], target: { call_id, member_id } });
    * ```
-   */
-  get user$(): Observable<User | undefined>;
-  /** Current user snapshot, or `undefined` if not yet authenticated. */
-  get user(): User | undefined;
-  /**
-   * Observable that emits the {@link Directory} instance once the client is connected,
-   * or `undefined` while disconnected. Subscribe to this to safely wait for the directory
-   * to become available without risking an error.
    *
-   * @example
-   * ```ts
-   * client.directory$.subscribe(dir => {
-   *   if (dir) dir.addresses$.subscribe(console.log);
-   * });
-   * ```
-   */
-  get directory$(): Observable<Directory | undefined>;
-  /**
-   * Current directory snapshot, or `undefined` if the client is not yet connected.
-   * Prefer {@link directory$} when you need to react to the directory becoming available.
+   * Never include `node_id` — only the two ids. The shapes are per-verb: most take a
+   * singular `target`, `call.member.remove` takes a plural `targets` array, and
+   * `call.member.position.set` takes a flat `targets: [{call_id, position}]` (the one
+   * verb keyed on `call_id` rather than `member_id`). Verbs that act on the call as a
+   * whole, or that the SDK does not wrap at all, take no target.
+   *
+   * For the typed alternative that handles all of this, create the client with
+   * `callControl: 'in-dialog'` and use the ordinary `Call`/`Participant` methods.
+   *
+   * @internal Not part of the supported surface while the in-dialog transport is still
+   * rolling out. `WebRTCCall` is exported from the package entry, so without this tag
+   * TypeDoc publishes the method — and the example above — as public API.
+   *
+   * @param method - A `call.*` method name (e.g. `'call.mute'`).
+   * @param params - Method parameters, sent verbatim.
+   * @returns The method's own reply, unwrapped from the `verto.info` envelope.
+   * @throws {JSONRPCError} If the control op fails.
    */
-  get directory(): Directory | undefined;
-  /** Observable that emits when the user registration state changes. */
-  get isRegistered$(): Observable<boolean>;
-  /** Whether the user is currently registered. */
-  get isRegistered(): boolean;
-  /** Whether the client is currently connected. */
-  get isConnected(): boolean;
-  /** Observable that emits when the connection state changes. */
-  get isConnected$(): Observable<boolean>;
-  /** Observable that emits `true` when the client is both connected and authenticated. */
-  get ready$(): Observable<boolean>;
-  /** Observable stream of errors from transport, authentication, and devices. */
-  get errors$(): Observable<Error>;
+  sendCommand<T extends JSONRPCResponse = JSONRPCResponse>(method: string, params?: Record<string, unknown>): Promise<T>;
   /**
-   * Observable stream of non-fatal SDK warnings.
-   *
-   * Subscribe to detect SDK behaviors that affect session liveness or developer-facing
-   * contracts but do not warrant disconnection — e.g., a fallback from Client Bound SAT
-   * refresh to the developer-provided `refresh()` because the SAT lacks `sat:refresh`
-   * scope. Discriminated by `code`.
+   * The local leg's member triple — sent as `self` in every member RPC
+   * envelope, and as the `target` of call-scoped self-operations (e.g. lock,
+   * layout).
    *
-   * Independent from {@link errors$}: existing error consumers are not notified.
+   * @throws {CallNotReadyError} Before `call.joined` delivers the self member
+   * context (`selfId`/`nodeId`) — an RPC without it cannot be routed, so fail
+   * fast instead of sending a doomed request.
    */
-  get warnings$(): Observable<SDKWarning>;
-  /** Platform WebRTC capabilities detected at construction time. */
-  get platformCapabilities(): PlatformCapabilities;
-  /** Observable that emits when the SDK auto-switches a device. */
-  get deviceRecovered$(): Observable<DeviceRecoveryEvent>;
+  private get callSelf();
+  /** Observable of the current call status (e.g. `'ringing'`, `'connected'`). */
+  get status$(): Observable<CallStatus>;
+  /** Observable of the participants list, emits on join/leave/update. */
+  get participants$(): Observable<CallParticipant[]>;
+  /** Observable of the local (self) participant. */
+  get self$(): Observable<CallSelfParticipant>;
+  /** Observable indicating whether the call is being recorded. */
+  get recording$(): Observable<boolean>;
+  /** Observable indicating whether the call is being streamed. */
+  get streaming$(): Observable<boolean>;
+  /** Observable indicating whether raise-hand priority is active. */
+  get raiseHandPriority$(): Observable<boolean>;
+  /** Observable indicating whether the call room is locked. */
+  get locked$(): Observable<boolean>;
+  /** Observable of custom metadata associated with the call. */
+  get meta$(): Observable<Record<string, unknown>>;
+  /** Observable of the call's capability flags. */
+  get capabilities$(): Observable<Capability[]>;
+  /** Observable of the current layout name. */
+  get layout$(): Observable<string>;
+  /** Current call status. */
+  get status(): CallStatus;
+  /** Whether the call is currently being recorded. */
+  get recording(): boolean;
+  /** Whether the call is currently being streamed. */
+  get streaming(): boolean;
+  /** Whether raise-hand priority is active. */
+  get raiseHandPriority(): boolean;
+  /** Whether the call room is locked. */
+  get locked(): boolean;
+  /** Current custom metadata of the call. */
+  get meta(): Record<string, unknown>;
+  /** Current layout name, or `undefined` if not set. */
+  get layout(): string | undefined;
+  /** Observable of available layout names. */
+  get layouts$(): Observable<string[]>;
+  /** Current snapshot of available layout names. */
+  get layouts(): string[];
+  /** Observable of the local media stream (camera/microphone). */
+  get localStream$(): Observable<MediaStream>;
+  /** Current local media stream, or `null` if not available. */
+  get localStream(): MediaStream | null;
+  /** Observable of the remote media stream from the far end. */
+  get remoteStream$(): Observable<MediaStream>;
+  /** Current remote media stream, or `null` if not available. */
+  get remoteStream(): MediaStream | null;
+  /** Observable of custom user variables associated with the call. */
+  get userVariables$(): Observable<Record<string, unknown>>;
+  /** a copy of the current custom user variables of the call. */
+  get userVariables(): Record<string, unknown>;
+  /** Merge current custom user variables of the call. */
+  set userVariables(variables: Record<string, unknown>);
+  /** Observable of current network health issues (empty array = healthy). */
+  get networkIssues$(): Observable<NetworkIssue[]>;
+  /** Current snapshot of network issues. */
+  get networkIssues(): NetworkIssue[];
+  /** Simple boolean health indicator derived from stats monitor. */
+  get isNetworkHealthy$(): Observable<boolean>;
+  /** Whether the network is currently healthy. */
+  get isNetworkHealthy(): boolean;
+  /** Rolling history of raw network metrics (RTT, jitter, packet loss, bitrate). */
+  get networkMetrics$(): Observable<NetworkMetrics[]>;
+  /** Current snapshot of the metrics rolling window. */
+  get networkMetrics(): NetworkMetrics[];
+  /** Observable of MOS quality score (1-5) computed from stats metrics. */
+  get qualityScore$(): Observable<number>;
+  /** Observable of simplified quality level (excellent/good/fair/poor/critical). */
+  get qualityLevel$(): Observable<QualityLevel$1>;
+  /** Observable of the recovery pipeline state machine. */
+  get recoveryState$(): Observable<RecoveryState$1>;
+  /** Observable of recovery events (keyframe requested, ICE restart, etc.). */
+  get recoveryEvent$(): Observable<RecoveryEvent$1>;
+  /** Observable indicating whether the call is bandwidth-constrained. */
+  get bandwidthConstrained$(): Observable<boolean>;
+  /** Observable that emits when the server pushes media params. */
+  get mediaParamsUpdated$(): Observable<MediaParamsEvent>;
   /**
-   * Export a structured diagnostic bundle for support/debugging.
-   * Includes connection events, call summaries, and device changes.
+   * @internal Emit a media params update event.
+   * Called by the VertoManager when the server pushes media params.
    */
-  exportDiagnostics(): SessionDiagnostics;
+  emitMediaParamsUpdated(event: MediaParamsEvent): void;
+  /** Request a video keyframe via RTCP PLI/FIR. */
+  requestKeyframe(): void;
+  /** Force an ICE restart / re-INVITE. */
+  requestIceRestart(): Promise<void>;
   /**
-   * Initialize resilience subsystems. Non-fatal: any failure is logged and
-   * the SDK continues working without the failing subsystem.
+   * @internal Initialize resilience subsystems when the call reaches 'connected'.
+   * Called from within the status subscription to wire stats and recovery.
    */
   private initResilienceSubsystems;
   /**
-   * Disconnects the WebSocket and tears down the current session.
-   *
-   * Ends the session identified by the protocol and clears its persisted
-   * resume state (`authorization_state` + protocol) and attach records
-   * together — a later {@link connect} with the same credentials starts a
-   * fresh session and cannot reattach to the ended session's calls.
-   * Credentials and device preferences are preserved. To temporarily stop
-   * receiving inbound calls while keeping the session alive, use
-   * `unregister()` instead.
+   * Wait for the underlying RTCPeerConnection to reach 'connected' after
+   * triggering an ICE restart. Resolves true on success, false on failure
+   * or if the state doesn't transition within the configured timeout.
    *
-   * The client can be reconnected by calling {@link connect} again,
-   * which creates a fresh transport and session.
+   * Polls connectionState directly because the recovery manager already
+   * wraps this call in its own withTimeout(); a separate listener-based
+   * implementation would race the outer timeout in subtle ways.
    */
-  disconnect(): Promise<void>;
+  private waitForPeerConnectionConnected;
   /**
-   * Tear down the current transport / session / attach manager. Safe to call
-   * when nothing has been initialized yet (e.g. first connect()).
+   * @internal Stop and destroy resilience subsystems (on disconnect/destroy).
+   * Clears references so they can be re-created on reconnect.
    */
-  private teardownTransportAndSession;
-  private waitAuthentication;
+  private stopResilienceSubsystems;
+  /** @internal */
+  createParticipant(memberId: string, selfId?: string | null): Participant | SelfParticipant;
+  /** Observable of the current audio/video send/receive directions. */
+  get mediaDirections$(): Observable<MediaDirections>;
+  /** Current audio/video send/receive directions. */
+  get mediaDirections(): MediaDirections;
+  protected get participantsId$(): Observable<string[]>;
   /**
-   * Registers the user as online to receive inbound calls and events.
+   * Executes a raw JSON-RPC request on the client session.
    *
-   * Waits for authentication to complete before sending the registration.
-   * If the initial attempt fails, reauthentication is attempted automatically.
+   * Lower-level than {@link executeMethod} — allows full control over the RPC request structure.
    *
-   * @throws {InvalidCredentialsError} If registration and reauthentication both fail.
+   * @param request - Complete JSON-RPC request object.
+   * @param options - Optional RPC execution options (timeout, etc.).
+   * @returns The RPC response.
+   * @throws {JSONRPCError} If the RPC call returns an error response.
    */
-  register(): Promise<void>;
+  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
+  /** Observable of the local participant's member ID. */
+  get selfId$(): Observable<string | null>;
+  /** @internal Lets call creation bound the media and signalling phases apart. */
+  get localMediaSettled$(): Observable<void>;
+  /** Local participant's member ID, or `null` if not joined. */
+  get selfId(): string | null;
+  /** Observable of the server node ID handling this call. */
+  get nodeId$(): Observable<string | null>;
+  /** Server node ID handling this call, or `null`. */
+  get nodeId(): string | null;
+  private isCallSessionEvent;
+  private get callSessionEvents$();
+  /** Observable of call-updated events. */
+  get callUpdated$(): Observable<CallUpdatedPayload>;
+  /** Observable of member-joined events, emitted when a remote participant joins the call. */
+  get memberJoined$(): Observable<MemberJoinedPayload>;
+  /** Observable of member-left events, emitted when a participant leaves the call. */
+  get memberLeft$(): Observable<MemberLeftPayload>;
+  /** Observable of member-updated events (mute, volume, etc.). */
+  get memberUpdated$(): Observable<MemberUpdatedPayload>;
+  /** Observable of member-talking events (speech start/stop). */
+  get memberTalking$(): Observable<MemberTalkingPayload>;
+  /** Observable of call state-change events. */
+  get callStates$(): Observable<CallStatePayload>;
+  /** Observable of layout-changed events. */
+  get layoutUpdates$(): Observable<LayoutChangedPayload>;
+  /** Underlying `RTCPeerConnection`, for advanced use cases. */
+  get rtcPeerConnection(): RTCPeerConnection | undefined;
+  /** Observable of raw signaling events as plain objects. */
+  get signalingEvent$(): Observable<Record<string, unknown>>;
   /**
-   * Unregisters the user, going offline for inbound calls.
+   * Subscribe to a custom signaling event type on this call.
    *
-   * The WebSocket connection remains open; use {@link disconnect} to fully close it.
-   */
-  unregister(): Promise<void>;
-  /**
-   * Places an outbound call to the given destination.
+   * Returns a cached observable that filters `callSessionEvents$` for events
+   * whose `event_type` matches the given string. The observable completes
+   * when the call is destroyed.
    *
-   * Waits for authentication before dialing. Media options are merged from
-   * saved preferences, destination query parameters (e.g. `?channel=video`),
-   * and the provided `options` (highest priority).
+   * Unlike `signalingEvent$` (which only emits known call-level event types),
+   * this method also matches custom/user-defined event types.
    *
-   * Returns a {@link Call} in `'ringing'` state. Subscribe to {@link Call.status$}
-   * to track progression through `'connected'` → `'disconnected'`.
+   * The SDK does not validate event type strings --- the server decides
+   * whether a given type is valid.
    *
-   * @param destination - Address URI string (e.g. `'/public/my-room'`) or {@link Address} instance.
-   * @param options - Media and dial options (audio/video, device constraints). Overrides defaults.
-   * @returns The created {@link Call} instance.
-   * @throws {Error} If authentication is not complete or call creation fails.
+   * @param eventType - The event type to subscribe to (e.g. `'my.custom.event'`).
+   * @returns An observable that emits matching signaling events.
    *
    * @example
    * ```ts
-   * const call = await client.dial('/public/conference', {
-   *   audio: true,
-   *   video: true,
+   * call.subscribe('my.custom.event').subscribe(event => {
+   *   console.log('Custom event:', event);
    * });
-   * call.status$.subscribe(status => console.log('Call:', status));
    * ```
    */
-  dial(destination: string | Address, options?: DialOptions): Promise<Call>;
+  subscribe(eventType: string): Observable<Record<string, unknown>>;
+  get webrtcMessages$(): Observable<WebrtcMessagePayload>;
+  get callEvent$(): Observable<WebrtcMessagePayload | CallJoinedPayload | CallLeftPayload | CallUpdatedPayload | CallStatePayload | CallPlayPayload | CallConnectPayload | RoomUpdatedPayload | MemberUpdatedPayload | MemberJoinedPayload | MemberLeftPayload | MemberTalkingPayload | LayoutChangedPayload | ConversationMessagePayload>;
+  get layoutEvent$(): Observable<LayoutChangedPayload>;
   /**
-   * Runs a multi-phase connectivity test against the given destination.
+   * Hangs up the call and releases all resources.
    *
-   * The test checks:
-   *   1. **Signaling** -- WebSocket connected, RTT measurement
-   *   2. **Devices** -- getUserMedia succeeds with selected (or specified) devices
-   *   3. **ICE/TURN** -- gathers ICE candidates to verify STUN/TURN reachability
-   *   4. **Media/bandwidth** (unless `skipMediaTest`) -- dials the destination,
-   *      collects getStats() for `duration` seconds, computes bandwidth estimates
+   * Sends a Verto `bye` to the server, transitions status to `'disconnecting'`,
+   * then destroys the call. After this, the call instance is no longer usable.
+   *
+   * @example
+   * ```ts
+   * await call.hangup();
+   * ```
+   */
+  hangup(): Promise<void>;
+  /**
+   * Sends DTMF digits on the call.
    *
-   * @param destination - A destination to dial for the media test (e.g. `'/private/network-test'`).
-   * @param options - Preflight options (duration, skipMediaTest, device overrides).
-   * @returns A {@link PreflightResult} describing connectivity health.
+   * @param dtmf - The digit string to send (e.g. `'1234#'`).
    *
    * @example
    * ```ts
-   * const result = await client.preflight('/private/network-test', { duration: 5 });
-   * if (!result.ok) console.warn('Connectivity issues:', result.warnings);
+   * await call.sendDigits('1234#');
    * ```
    */
-  preflight(destination: string, options?: PreflightOptions): Promise<PreflightResult>;
-  /** The underlying client session for advanced RPC operations. */
-  get session(): ClientSessionWrapper;
-  /** Observable list of available audio input (microphone) devices. */
-  get audioInputDevices$(): Observable<MediaDeviceInfo[]>;
-  /** Current snapshot of available audio input devices. */
-  get audioInputDevices(): MediaDeviceInfo[];
-  /** Observable list of available audio output (speaker) devices. */
-  get audioOutputDevices$(): Observable<MediaDeviceInfo[]>;
-  /** Current snapshot of available audio output devices. */
-  get audioOutputDevices(): MediaDeviceInfo[];
-  /** Observable list of available video input (camera) devices. */
-  get videoInputDevices$(): Observable<MediaDeviceInfo[]>;
-  /** Current snapshot of available video input devices. */
-  get videoInputDevices(): MediaDeviceInfo[];
-  /** Observable of the currently selected audio input device. */
-  get selectedAudioInputDevice$(): Observable<MediaDeviceInfo | null>;
-  /** Observable of the currently selected audio output device. */
-  get selectedAudioOutputDevice$(): Observable<MediaDeviceInfo | null>;
-  /** Observable of the currently selected video input device. */
-  get selectedVideoInputDevice$(): Observable<MediaDeviceInfo | null>;
-  /** Currently selected audio input device, or `null` if none. */
-  get selectedAudioInputDevice(): MediaDeviceInfo | null;
-  /** Currently selected audio output device, or `null` if none. */
-  get selectedAudioOutputDevice(): MediaDeviceInfo | null;
-  /** Currently selected video input device, or `null` if none. */
-  get selectedVideoInputDevice(): MediaDeviceInfo | null;
-  /** Media track constraints for the selected audio input device. Returns `false` when disabled. */
-  get selectedAudioInputDeviceConstraints(): MediaTrackConstraints | boolean;
-  /** Media track constraints for the selected video input device. Returns `false` when disabled. */
-  get selectedVideoInputDeviceConstraints(): MediaTrackConstraints | boolean;
-  /** Converts a `MediaDeviceInfo` to track constraints suitable for `getUserMedia`. */
-  deviceInfoToConstraints(deviceInfo: MediaDeviceInfo | null): MediaTrackConstraints;
-  /** Sets the preferred audio input device. */
-  selectAudioInputDevice(device: MediaDeviceInfo | null): void;
-  /** Sets the preferred video input device. */
-  selectVideoInputDevice(device: MediaDeviceInfo | null): void;
-  /** Sets the preferred audio output device. */
-  selectAudioOutputDevice(device: MediaDeviceInfo | null): void;
+  sendDigits(dtmf: string): Promise<void>;
+  /** Observable of WebRTC-specific signaling messages. */
+  /** Observable of call-level signaling events. */
+  /** Observable of layout-changed signaling events. */
   /**
-   * Apply the currently selected audio output device to an HTMLMediaElement
-   * (e.g. the `<audio>` or `<video>` element the consumer attached the
-   * remote stream to). Uses `HTMLMediaElement.setSinkId` under the hood.
-   * Returns a `Promise<boolean>`: `true` if the sink was applied,
-   * `false` if the browser doesn't support `setSinkId` or no device is
-   * selected.
+   * Accepts an inbound call, optionally overriding media options for the answer.
+   *
+   * @param options - Optional media constraints for the answer (audio/video).
    *
    * @example
    * ```ts
-   * audioEl.srcObject = call.remoteStream;
-   * await client.applySelectedAudioOutputDevice(audioEl);
+   * // Accept with defaults
+   * call.answer();
+   *
+   * // Accept audio-only
+   * call.answer({ audio: true, video: false });
    * ```
+   * @see {@link reject} to decline the call instead.
+   * @see {@link answered$} to observe the acceptance state.
    */
-  applySelectedAudioOutputDevice(element: HTMLMediaElement): Promise<boolean>;
-  /** Starts monitoring for media device changes (connect/disconnect). */
-  enableDeviceMonitoring(): void;
-  /** Stops monitoring for media device changes. */
-  disableDeviceMonitoring(): void;
-  /**
-   * Returns the capabilities of a media device.
-   * @param deviceInfo - The device to query.
-   * @returns The device capabilities, or `null` if unavailable.
-   */
-  getDeviceCapabilities(deviceInfo: MediaDeviceInfo): Promise<MediaTrackCapabilities | null>;
+  answer(options?: MediaOptions): void;
+  /** Media options provided when answering. Used internally by the VertoManager. */
+  get answerMediaOptions(): MediaOptions | undefined;
   /**
-   * Checks whether a device is still available and usable.
-   * @param deviceInfo - The device to validate, or `null`.
-   * @returns `true` if the device is valid and available. Returns `false` for `null`, audio output devices, or unavailable devices.
+   * Rejects an inbound call, preventing media negotiation.
+   *
+   * @see {@link answer} to accept the call instead.
+   * @see {@link answered$} to observe the rejection state.
    */
-  isValidDevice(deviceInfo: MediaDeviceInfo | null): Promise<boolean>;
-  /** Injects a storage manager into the device controller for persistence. */
-  setStorageManager(storageManager: StorageManager): void;
-  /** Clears all device state and re-enumerates. */
-  clearDeviceState(): Promise<void>;
-  /** Forces a device re-enumeration. */
-  enumerateDevices(): Promise<void>;
-  /** Disables audio input (receive-only mode). No audio track will be acquired. */
-  disableAudioInput(): void;
-  /** Re-enables audio input, restoring the last selection or auto-selecting. */
-  enableAudioInput(): void;
-  /** Disables video input (receive-only mode). No video track will be acquired. */
-  disableVideoInput(): void;
-  /** Re-enables video input, restoring the last selection or auto-selecting. */
-  enableVideoInput(): void;
-  /** Observable that emits `true` when video input is disabled (receive-only). */
-  get videoInputDisabled$(): Observable<boolean>;
-  /** Observable that emits `true` when audio input is disabled (receive-only). */
-  get audioInputDisabled$(): Observable<boolean>;
-  /** Whether video input is currently disabled. */
-  get videoInputDisabled(): boolean;
-  /** Whether audio input is currently disabled. */
-  get audioInputDisabled(): boolean;
+  reject(): void;
+  /** Observable that emits `true` when answered, `false` when rejected. */
+  get answered$(): Observable<boolean>;
   /**
-   * Triggers the browser's media permission dialog and captures the user's device selections.
+   * Sets the call layout and, optionally, individual participant positions.
    *
-   * @param options - Which permissions to request.
-   * @param options.audio - Whether to request audio permission.
-   * @param options.video - Whether to request video permission.
-   * @returns The permission result with selected devices.
+   * The gateway `call.layout.set` DTO has **no** `positions` member, so when
+   * `positions` is provided this method issues a `call.member.position.set`
+   * request per member (via {@link Participant.setPosition}, which keys each
+   * position by that member's own call context) alongside `call.layout.set`
+   * (issue #19400, Flag #6).
+   *
+   * **These operations are NOT atomic.** The layout is applied first, then each
+   * member position sequentially, so members may briefly flash into their
+   * default slots before being moved to the requested positions. Targeted
+   * members are validated upfront, though: when any of them has no
+   * {@link Participant.target | member call context} yet, the whole call
+   * rejects before any request is sent and the layout is left unchanged.
+   *
+   * @param layout - Layout name (must be one of {@link layouts}).
+   * @param positions - Optional map of member IDs to {@link VideoPosition} values.
+   *   When omitted or empty, only the layout is changed.
+   * @throws {InvalidParams} If the layout is not in the available {@link layouts}.
+   * @throws {ParticipantNotReadyError} If a targeted member's call context has
+   *   not been received yet — thrown before any request is sent.
+   *
+   * @example
+   * ```ts
+   * await call.setLayout('grid-responsive', {
+   *   [participantId]: 'reserved-0',
+   * });
+   * ```
    */
-  requestMediaPermissions(options?: {
-    audio?: boolean;
-    video?: boolean;
-  }): Promise<PermissionResult>;
+  setLayout(layout: string, positions?: Record<string, VideoPosition>): Promise<void>;
   /**
-   * Clears all SDK-persisted state and resets to defaults.
+   * Transfers the call to another destination.
    *
-   * This clears device preferences, device history, authorization state,
-   * attached call IDs, and all SDK storage keys, then re-enumerates devices.
+   * @param options - Transfer configuration including the target destination.
+   * @see {@link status$} to observe the transfer progress.
    */
-  resetToDefaults(): Promise<void>;
+  transfer(options: TransferOptions): Promise<void>;
   /**
-   * Destroys the client, clearing timers and releasing all resources.
+   * Set the local microphone gain as a percentage applied before transmission.
    *
-   * Intentionally destroying the client ends its session: the resume state
-   * (`authorization_state` + protocol) and the attach records are both
-   * cleared. Credentials and device preferences are preserved — use
-   * {@link resetToDefaults} for a full wipe. To temporarily stop receiving
-   * inbound calls while keeping the session alive, use `unregister()`.
+   *   - `0`   = silent
+   *   - `100` = unity (no change, default)
+   *   - `200` = 2× digital boost (max; expect clipping / noise amplification)
+   *
+   * Values are clamped to [0, 200]. Engages the local audio pipeline on
+   * first use (one-time cost).
+   *
+   * Note: this is a **digital** multiplier applied in a Web Audio GainNode
+   * between your mic track and the RTCRtpSender — it does not change the
+   * physical mic's hardware sensitivity. Browsers' autoGainControl can
+   * fight the setting; call {@link setAutoGainControl}(false) for
+   * predictable behaviour.
+   *
+   * @param value - Gain percentage (0..200; 100 = unity).
    */
-  destroy(): void;
-}
-//#endregion
-//#region src/utils/embeddableCall.d.ts
-/** Options for {@link embeddableCall}. */
-interface EmbeddableCallOptions {
-  /** Destination URI to call. */
-  to: string;
-  /** Embed token for authentication. */
-  embedToken: string;
-  /** SignalWire host URL. */
-  host: string;
-}
-/**
- * Creates a call using an embed token for simple, embeddable integrations.
- *
- * Handles client creation, authentication, and dialing in a single call.
- *
- * @param options - Embed token, host, and destination.
- * @returns The created {@link Call} instance.
- */
-declare function embeddableCall(options: EmbeddableCallOptions): Promise<Call>;
-//#endregion
-//#region src/dependencies/StaticCredentialProvider.d.ts
-/**
- * Credential provider that returns a fixed set of credentials.
- *
- * Use when the token is already available (e.g. from a backend endpoint).
- *
- * @example
- * ```ts
- * const provider = new StaticCredentialProvider({ token: 'my-sat-token' });
- * const client = new SignalWire(provider);
- * ```
- */
-declare class StaticCredentialProvider implements CredentialProvider {
-  private credentials;
-  constructor(credentials: SDKCredential);
-  /** Returns the static credentials. */
-  authenticate(): Promise<SDKCredential>;
-}
-//#endregion
-//#region src/dependencies/EmbedTokenCredentialProvider.d.ts
-/** Credential provider that exchanges an embed token for a SAT via the host's token endpoint. */
-declare class EmbedTokenCredentialProvider implements CredentialProvider {
-  private host;
-  private embedToken;
-  constructor(host: string, embedToken: string);
-  private fetchSAT;
-  authenticate(): Promise<{
-    token: string;
-    expiry_at: number;
-  }>;
-  refresh(): Promise<{
-    token: string;
-    expiry_at: number;
-  }>;
-}
-//#endregion
-//#region src/controllers/LocalAudioPipeline.d.ts
-/**
- * Options for {@link LocalAudioPipeline}.
- */
-interface LocalAudioPipelineOptions {
-  /** Factory for AudioContext — override for tests. Defaults to `new AudioContext()`. */
-  audioContextFactory?: () => AudioContext;
-  /** Initial gain (0..2, where 1 is unity). Defaults to 1. */
-  initialGain?: number;
-  /** RMS level [0..1] above which speaking$ emits true. Defaults to {@link VAD_THRESHOLD}. */
-  speakingThreshold?: number;
+  setLocalMicrophoneGain(value: number): void;
+  /** Observable of the current local microphone gain (0..200, where 100 = unity). */
+  get localMicrophoneGain$(): Observable<number>;
+  /**
+   * Observable of the RMS audio level of the local microphone, 0..1.
+   * Emits at ~30fps while a mic track is active. Engages the local audio
+   * pipeline on first subscription.
+   */
+  get localAudioLevel$(): Observable<number>;
   /**
-   * Milliseconds of silence below the threshold before speaking$ flips back to
-   * false. Prevents flicker on normal speech gaps. Defaults to {@link VAD_HOLD_MS}.
+   * Observable that is `true` while the local participant is speaking
+   * (RMS level above the VAD threshold, with hold time to avoid flicker).
    */
-  speakingHoldMs?: number;
-  /** Polling interval for level$. Defaults to {@link AUDIO_LEVEL_POLL_INTERVAL_MS}. */
-  pollIntervalMs?: number;
+  get localSpeaking$(): Observable<boolean>;
+  /**
+   * Enable push-to-talk: while {@link setPushToTalkActive} has been called
+   * with `false`, the microphone gain is forced to 0; calling
+   * {@link setPushToTalkActive} with `true` restores the configured gain.
+   * Use this instead of mute/unmute for instant talk/silence transitions
+   * because it doesn't rebuild the track.
+   *
+   * This method installs the pipeline but does not attach any keyboard
+   * listener — consumers bind the key themselves and call
+   * {@link setPushToTalkActive} on keydown/keyup.
+   */
+  enablePushToTalk(): void;
+  /** Disable push-to-talk; mic gain returns to the configured value. */
+  disablePushToTalk(): void;
+  /**
+   * While push-to-talk is enabled, sets the talk state. `true` = transmitting,
+   * `false` = silent. No-op if push-to-talk has not been enabled.
+   */
+  setPushToTalkActive(active: boolean): void;
+  /**
+   * Toggle echo cancellation on the local mic at runtime. Applied via
+   * `track.applyConstraints`; browsers that don't honour runtime constraints
+   * (notably iOS Safari) fall back to re-acquiring the track with the new
+   * constraint set and plumbing the replacement through the local audio
+   * pipeline if one is active.
+   */
+  setEchoCancellation(enabled: boolean): Promise<void>;
+  /** Toggle browser noise suppression on the local mic at runtime. */
+  setNoiseSuppression(enabled: boolean): Promise<void>;
+  /** Toggle browser automatic gain control on the local mic at runtime. */
+  setAutoGainControl(enabled: boolean): Promise<void>;
+  /**
+   * Observable of the aggregate remote audio level, 0..1 RMS. The server
+   * delivers a single mixed audio stream for all remote participants — this
+   * meter reports that mix. Per-participant audio is not available client-side.
+   *
+   * Engages a shared AudioContext on first subscription (cheap — one
+   * AnalyserNode, no GainNode, no destination) so it does not affect the
+   * caller's audio element playback.
+   */
+  get remoteAudioLevel$(): Observable<number>;
+  /** Destroys the call, releasing all resources and subscriptions. */
+  destroy(): void;
+  /**
+   * @internal Send a verto.subscribe message to add an event type to the
+   * server's subscription list for this call. Returns the underlying RPC
+   * promise so callers can decide whether to cache the observable on success
+   * or retry on failure.
+   */
+  private _sendVertoSubscribe;
 }
+//#endregion
+//#region src/core/entities/Directory.d.ts
 /**
- * Web Audio pipeline for the local microphone stream.
- *
- * Wraps the raw mic `MediaStreamTrack` in a graph of:
- *
- * ```
- *   MediaStreamAudioSourceNode  →  GainNode  →  AnalyserNode  →  MediaStreamAudioDestinationNode
- * ```
+ * Directory interface for managing addresses
  *
- * The {@link outputTrack} from the destination node is what callers should
- * attach to the `RTCRtpSender` in place of the raw mic track. The same
- * destination track is reused across input changes (device switch, mute /
- * unmute track replacement) so the sender reference stays stable — only the
- * source end of the graph is rebuilt.
+ * This is the public API contract for address directory functionality.
+ * It provides access to addresses, loading capabilities, and search functionality.
  *
- * The pipeline owns a single {@link AudioContext}. Callers must invoke
- * {@link destroy} to release it when the call ends.
+ * @public
  */
-declare class LocalAudioPipeline extends Destroyable {
-  private readonly _audioContext;
-  private readonly _gainNode;
-  private readonly _analyser;
-  private readonly _destination;
-  private readonly _analyserBuffer;
-  private readonly _speakingThreshold;
-  private readonly _speakingHoldMs;
-  private readonly _pollIntervalMs;
-  private _inputSource;
-  private _inputStream;
-  private _lastSpokeAt;
-  private _gain$;
-  /** 1 when audio should pass through, 0 when silenced by PTT. */
-  private _pttMultiplier;
-  constructor(options?: LocalAudioPipelineOptions);
-  /** Observable of the current gain value (0..2). */
-  get gain$(): Observable<number>;
-  /** Current gain value (0..2). */
-  get gain(): number;
+interface Directory extends AddressProvider<Address> {
   /**
-   * Processed output track to attach to the RTCRtpSender. Stable reference
-   * across input changes, so `sender.replaceTrack(pipeline.outputTrack)` only
-   * needs to be called once.
+   * Observable stream of all addresses in the directory
+   * Emits a new array whenever addresses are added, removed, or updated
    */
-  get outputTrack(): MediaStreamTrack;
+  readonly addresses$: Observable<Address[]>;
   /**
-   * Root-mean-square audio level of the input signal, 0..1. Emits on a fixed
-   * interval (~30fps by default).
+   * Current snapshot of all addresses in the directory
    */
-  get level$(): Observable<number>;
+  readonly addresses: Address[];
   /**
-   * Boolean VAD derived from {@link level$}. True while level ≥ threshold or
-   * during the hold window after the last frame that crossed the threshold.
+   * Observable indicating whether more addresses can be loaded from the server
    */
-  get speaking$(): Observable<boolean>;
+  readonly hasMore$: Observable<boolean>;
   /**
-   * Set gain multiplier applied to the input signal. 0 = silence,
-   * 1 = unity, 2 = 2x. Values are clamped to [0, 2]. The effective gain on
-   * the graph also respects the current PTT state.
+   * Observable indicating the current loading state
+   * Emits `true` when loading, `false` when idle
    */
-  setGain(value: number): void;
+  readonly loading$: Observable<boolean>;
+  readonly loading: boolean;
   /**
-   * Silence the graph when `active = false`, otherwise restore the configured
-   * gain. Use this from a PTT handler: released → `false`, held → `true`.
-   * Orthogonal to {@link setGain} — once PTT returns to active, the last
-   * configured gain reappears.
+   * Load more addresses from the server
+   * Only loads if `hasMore` is true
    */
-  setPTTActive(active: boolean): void;
-  private applyEffectiveGain;
+  loadMore(): void;
   /**
-   * Wire a new raw mic track as the pipeline's input. Replaces any previous
-   * input source and reconnects the graph so {@link outputTrack} continues
-   * to emit the processed audio. Pass `null` to disconnect the input (the
-   * output track stays alive but emits silence).
+   * Get a specific address by ID
    *
-   * Also resumes the underlying AudioContext on attach — Chrome creates it
-   * in a suspended state and the graph won't process (the destination
-   * track emits silence) until resume() succeeds.
-   */
-  setInputTrack(track: MediaStreamTrack | null): void;
-  destroy(): void;
-  private computeLevel;
-  private evaluateSpeaking;
-}
-//#endregion
-//#region src/controllers/RTCPeerConnectionController.d.ts
-interface RTCPeerConnectionControllerOptions extends MediaOptions {
-  callId?: string;
-  rtcConfiguration?: RTCConfiguration;
-  simulcast?: boolean;
-  sfu?: boolean;
-  msStreamsNumber?: number;
-  propose: RTCPeerConnectionPropose;
-  iceServers?: RTCIceServer[];
-  disableUdpIceServers?: boolean;
-  relayOnly?: boolean;
-  iceCandidateTimeout?: number;
-  iceGatheringTimeout?: number;
-  webRTCApiProvider?: WebRTCApiProvider;
-  /** Per-call preferred video codecs (overrides global preferences). */
-  preferredVideoCodecs?: string[];
-  /** Per-call preferred audio codecs (overrides global preferences). */
-  preferredAudioCodecs?: string[];
-  /** Per-call stereo Opus setting (overrides global preferences). */
-  stereo?: boolean;
-}
-type RTCPeerConnectionControllerOptionsPartial = Partial<RTCPeerConnectionControllerOptions>;
-interface UpdateSDPStatusParams {
-  status: 'received' | 'sent' | 'failed';
-  sdp?: string;
-}
-declare class RTCPeerConnectionController extends Destroyable {
-  protected options: RTCPeerConnectionControllerOptionsPartial;
-  readonly id: string;
-  firstSDPExchangeCompleted: boolean;
-  sdpInit?: RTCSessionDescriptionInit;
-  private negotiationNeeded$;
-  private deviceController;
-  private localStreamController;
-  private transceiverController?;
-  readonly localDescription$: Observable<RTCSessionDescription | null>;
-  peerConnection?: RTCPeerConnection;
-  private initPromise?;
-  private connectionTimeout;
-  private connectionTimer?;
-  private oniceconnectionstatechangeHandler;
-  private onconnectionstatechangeHandler;
-  private onsignalingstatechangeHandler;
-  private onicegatheringstatechangeHandler;
-  private onnegotiationneededHandler;
-  private updateSelectedInputDevice;
-  private _isNegotiating$;
-  private _iceGatheringController?;
-  private _memberId;
-  private _type;
-  private _iceConnectionState$;
-  private _connectionState$;
-  private _signalingState$;
-  private _iceGatheringState$;
-  private _errors$;
-  private _iceCandidates$;
-  private _initialized$;
-  private _remoteDescription$;
-  private _remoteStream$;
-  private _remoteOfferMediaDirections;
-  private _localAudioPipeline;
-  constructor(options?: RTCPeerConnectionControllerOptionsPartial, remoteSessionDescription?: string, deviceController?: DeviceController);
-  private get iceGatheringController();
-  private get shouldEmitLocalDescription();
-  private removeConnectionTimer;
-  setMemberId(memberId: string | null): void;
-  get memberId(): string | null;
-  stopTrackSender(kind: 'audio' | 'video' | 'both', options?: {
-    updateTransceiverDirection: boolean;
-  }): void;
-  private stopRawAudioInputForPipeline;
-  get isNegotiating$(): Observable<boolean>;
-  get isNegotiating(): boolean;
-  updateMediaDevicesOptions(options: MediaOptions): void;
-  get iceGatheringState$(): Observable<RTCIceGatheringState>;
-  get mediaTrackEnded$(): Observable<MediaStreamTrack>;
-  get errors$(): Observable<Error>;
-  get iceCandidates$(): Observable<RTCIceCandidate[]>;
-  get initialized$(): Observable<boolean>;
-  get remoteDescription$(): Observable<RTCSessionDescription | null>;
-  get localStream$(): Observable<MediaStream | null>;
-  get remoteStream$(): Observable<MediaStream | null>;
-  get localAudioTracks$(): Observable<MediaStreamTrack[]>;
-  get localVideoTracks$(): Observable<MediaStreamTrack[]>;
-  get iceConnectionState$(): Observable<RTCIceConnectionState>;
-  get connectionState$(): Observable<RTCPeerConnectionState>;
-  get signalingState$(): Observable<RTCSignalingState>;
-  get type(): RTCPeerConnectionType;
-  get propose(): RTCPeerConnectionPropose;
-  get isAdditionalDevice(): boolean;
-  get isMainDevice(): boolean;
-  get isScreenShare(): boolean;
-  protected get iceServers(): RTCIceServer[];
-  private get rtcConfiguration();
-  get receiveVideo(): boolean;
-  get receiveAudio(): boolean;
-  get localStream(): MediaStream | null;
-  get remoteStream(): MediaStream | null;
-  private get inputAudioDeviceConstraints();
-  private get inputVideoDeviceConstraints();
-  private get WebRTCPeerConnectionConstructor();
-  private get offerOptions();
-  private get answerOptions();
+   * @param addressId - The address ID to retrieve
+   * @returns The address instance, or undefined if not found
+   */
+  get(addressId: string): Address | undefined;
   /**
-   * Initialize the RTCPeerConnection and setup event listeners.
-   * Called automatically when localDescription$ is subscribed to (deferred pattern).
-   * Uses Promise memoization to ensure initialization only happens once,
-   * even if called concurrently.
+   * Find an address ID by searching for a name
+   *
+   * @param uri - The address name to search for
+   * @returns Promise resolving to the address ID, or undefined if not found
    */
-  private init;
+  findAddressIdByURI(uri: string): Promise<string | undefined>;
+}
+//#endregion
+//#region src/interfaces/SessionState.d.ts
+/**
+ * Extended session interface that adds call management and authentication
+ * state on top of the narrow ClientSession contract.
+ *
+ * Accessible via `client.session`. Call and CallFactory continue to depend
+ * only on the narrow ClientSession interface.
+ */
+interface SessionState extends ClientSession {
   /**
-   * Internal initialization implementation.
-   * Should only be called via init() to ensure single execution.
+   * Observable stream of currently active inbound calls.
+   * Filters `calls$` to only include calls with `direction === 'inbound'`.
    */
-  private doInit;
-  private setupPeerConnection;
-  private startNegotiation;
+  readonly incomingCalls$: Observable<Call[]>;
   /**
-   * Create an SDP offer and set it as local description.
+   * Current snapshot of active inbound calls.
    */
-  private createOffer;
-  updateAnswerStatus({
-    status,
-    sdp
-  }: UpdateSDPStatusParams): Promise<void>;
-  updateOfferStatus({
-    status,
-    sdp
-  }: UpdateSDPStatusParams): Promise<void>;
+  readonly incomingCalls: Call[];
   /**
-   * Accept an inbound call by creating the SDP answer.
-   * Optionally override media options before the answer is generated.
-   * Must be called after initialization for inbound (answer-type) connections.
+   * Observable stream of all currently active calls (both inbound and outbound).
    */
-  acceptInbound(mediaOverrides?: MediaOptions): Promise<void>;
-  private handleOfferReceived;
-  private readyToConnect;
-  private setRemoteDescriptionBefore;
-  protected setLocalDescription(params: RTCSessionDescriptionInit): Promise<void>;
-  setLocalDescriptionBefore(sdp?: string): Promise<string>;
+  readonly calls$: Observable<Call[]>;
   /**
-   * Create an SDP answer and set it as local description.
+   * Current snapshot of all active calls.
    */
-  private createAnswer;
+  readonly calls: Call[];
   /**
-   * Setup event listeners on RTCPeerConnection for state changes.
+   * Observable that emits `true` once the session has been authenticated,
+   * and `false` after disconnect.
    */
-  private setupEventListeners;
-  private negotiationEnded;
+  readonly authenticated$: Observable<boolean>;
+  /**
+   * Current authentication state.
+   * Returns `true` if the session is currently authenticated.
+   */
+  readonly authenticated: boolean;
+}
+//#endregion
+//#region src/managers/ClientSessionManager.d.ts
+/**
+ * Discriminated union for session authentication state.
+ * clientBound is tracked separately via _wasClientBound (sticky flag)
+ * to avoid dual sources of truth.
+ */
+type SessionAuthState = {
+  kind: 'unauthenticated';
+} | {
+  kind: 'authenticated';
+};
+declare class ClientSessionManager extends Destroyable implements SessionState {
+  private readonly getCredential;
+  private readonly transport;
+  private readonly storage;
+  private readonly authorizationStateKey;
+  private readonly attachManager;
+  private readonly dpopManager?;
+  private callFactory;
+  private readonly agent;
+  private readonly eventAcks;
+  initialized$: Observable<boolean>;
+  private authorizationState$;
+  private connectVersion;
+  /**
+   * Optional hook called before a fresh connect on reconnect.
+   * Used by SignalWire to refresh expired credentials before re-authenticating.
+   * @internal
+   */
+  onBeforeReconnect?: () => Promise<void>;
+  /**
+   * Session-wide call control transport (see {@link ClientSession.callControl}).
+   * Set from {@link SignalWireOptions.callControl} by SignalWire after construction;
+   * defaults to `'routed'`. Read by every Call, so it needs no per-call persistence.
+   */
+  callControl: 'routed' | 'in-dialog';
+  private _authorization$;
+  private _errors$;
+  private _directory?;
+  private _authState$;
+  /** Sticky flag — once true, stays true for the session lifetime. */
+  private _wasClientBound;
+  private _userInfo$;
+  private _calls$;
+  private _iceServers$;
+  constructor(getCredential: () => SDKCredential, transport: TransportManager, storage: StorageManager, authorizationStateKey: string, deviceController: DeviceController, attachManager: AttachManager, webRTCApiProvider: WebRTCApiProvider, dpopManager?: CryptoController | undefined, networkChange$?: Observable<NetworkChangeEvent>);
+  get incomingCalls$(): Observable<Call[]>;
+  get incomingCalls(): Call[];
+  get userInfo$(): Observable<Address | null>;
+  get userInfo(): Address | null;
+  get calls$(): Observable<Call[]>;
+  get calls(): Call[];
+  get iceServers(): RTCIceServer[] | undefined;
+  get authorization$(): Observable<Authorization | undefined>;
+  get authorization(): Authorization | undefined;
+  get errors$(): Observable<Error>;
+  get authenticated$(): Observable<boolean>;
+  get authenticated(): boolean;
+  /**
+   * Whether this session is client-bound (using a Client Bound SAT).
+   * When client-bound, DPoP proof creation failures are treated as
+   * authentication errors rather than silently degraded.
+   * @internal
+   */
+  get clientBound(): boolean;
+  /** @internal Current auth state for debugging/testing. */
+  get authState(): SessionAuthState;
+  /**
+   * Set the directory instance
+   * Called by SignalWire after directory is created
+   * @internal
+   */
+  setDirectory(directory: Directory): void;
+  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
+  send(message: JSONSerializable): void;
+  private init;
+  private setupMessageHandlers;
+  private loadAuthorizationStateFromStorage;
+  private updateAuthorizationStateInStorage;
+  private get authStateEvent$();
+  get signalingEvent$(): Observable<(Omit<{
+    event_type: "webrtc.message";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: WebrtcMessagePayload;
+  }, "event_channel" | "project_id" | "node_id"> & {
+    event_channel: string;
+    project_id: string;
+    node_id: string;
+  }) | {
+    event_type: "signalwire.authorization.state";
+    params: SignalwireAuthorizationStatePayload;
+  } | (Omit<{
+    event_type: "call.joined";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallJoinedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.left";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallLeftPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallUpdatedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.state";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallStatePayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.play";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallPlayPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.connect";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallConnectPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "room.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: RoomUpdatedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | Omit<{
+    event_type: "member.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberUpdatedPayload;
+  }, never> | Omit<{
+    event_type: "member.joined";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberJoinedPayload;
+  }, never> | Omit<{
+    event_type: "member.left";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberLeftPayload;
+  }, never> | Omit<{
+    event_type: "member.talking";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberTalkingPayload;
+  }, never> | Omit<{
+    event_type: "layout.changed";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: LayoutChangedPayload;
+  }, never> | (Omit<{
+    event_type: "conversation.message";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: ConversationMessagePayload;
+  }, "event_channel" | "timestamp" | "is_author"> & {
+    event_channel: string;
+    timestamp: string;
+    is_author: boolean;
+  }) | (Omit<{
+    event_type: "conversation.message.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: ConversationMessagePayload;
+  }, "event_channel" | "timestamp" | "is_author"> & {
+    event_channel: string;
+    timestamp: string;
+    is_author: boolean;
+  })>;
+  private get vertoInvite$();
+  private get vertoAttach$();
+  private get contexts();
+  private get eventing();
+  private get topics();
+  private get authentication();
+  connect(): Promise<void>;
+  private handleAuthenticationError;
   /**
-   * Trigger an ICE restart through the existing negotiation pipeline.
+   * Clear the resume state (authorization_state + protocol) and ask the
+   * transport to reconnect. The `connected` event re-triggers
+   * `authenticate()`, which now has no stored state and so performs a fresh
+   * connect.
    *
-   * This creates an offer with iceRestart: true and goes through the full
-   * SDP pipeline (setLocalDescription → ICE gathering → localDescription$ emission).
-   * The caller should NOT send the SDP manually — the existing
-   * setupLocalDescriptionHandler in VertoManager will pick up the emission
-   * from localDescription$ and send it as a verto.modify.
+   * This is the stale-auth-state recovery helper used by handleAuthError:
+   * the server rejected a reconnect, so the resume state is discarded and a
+   * fresh connect follows. Attach records are deliberately preserved — the
+   * session lives on through the reconnect and reattachCalls() needs the
+   * stored call references afterwards. Do NOT add detachAll() here.
    *
-   * Unlike calling pc.createOffer/setLocalDescription directly, this method:
-   * - Sets _isNegotiating$ so ICEGatheringController arms its timers
-   * - Waits for ICE gathering to complete before localDescription$ emits
-   * - Goes through setLocalDescriptionBefore() for any SDP munging
-   */
-  triggerIceRestart(relayOnly?: boolean): Promise<void>;
-  private restoreIceTransportPolicy;
-  /**
-   * Setup track handling for remote tracks.
-   */
-  private setupTrackHandling;
-  private setupLocalTracks;
-  /** True for a main connection with no local media to send. */
-  private hasNoLocalMediaToSend;
-  /** The media kinds this connection wants to send: 'audiovideo' | 'video' | 'audio'. */
-  private get requestedMediaKinds();
-  /**
-   * Handle a local media acquisition failure with a typed, semantically
-   * accurate MediaAccessError created at the acquisition site:
-   * - Auxiliary connections (screenshare / additional-device) throw a
-   *   non-fatal error — VertoManager surfaces it and the call is unaffected.
-   * - The main connection degrades to receive-only when allowed (default),
-   *   otherwise fails with a fatal error.
-   */
-  private handleLocalMediaFailure;
-  /**
-   * Negotiate receive-only m-lines when there are no local tracks to send.
-   * Only offer-type connections add transceivers — answer-type connections
-   * reuse the transceivers created from the remote offer.
-   */
-  private setupReceiveOnlyTransceivers;
-  private getUserMedia;
-  private getDisplayMedia;
-  private setupRemoteTracks;
-  restoreTrackSender(kind: 'audio' | 'video' | 'both'): Promise<void>;
-  private restoreRawAudioInputForPipeline;
-  /**
-   * Return the lazily-created {@link LocalAudioPipeline}, constructing it on
-   * first access. On creation the current audio sender's track is routed
-   * through the pipeline (input → gain → analyser → destination) and the
-   * sender is switched to emit the processed track. Returns `null` when no
-   * audio sender exists yet (pre-negotiation).
-   */
-  ensureLocalAudioPipeline(): LocalAudioPipeline | null;
-  /** The active LocalAudioPipeline, or null if it hasn't been created yet. */
-  get localAudioPipeline(): LocalAudioPipeline | null;
-  private applyLocalAudioPipelineToSender;
-  /**
-   * Add a local media track to the peer connection.
-   * @param track - The MediaStreamTrack to add
-   */
-  addLocalTrack(track: MediaStreamTrack): void;
-  /**
-   * Remove a local media track from the peer connection.
-   * @param trackId - The ID of the track to remove
+   * Connect-time recovery only. A *request* refused on an already
+   * authenticated session is never healed here: dropping the resume state
+   * destroys the association between the socket and the previous session,
+   * which is what reattach depends on. That path mints a fresh credential and
+   * reauthenticates instead (see `SignalWire.recoverAndRetry`).
+   *
+   * For public teardown (disconnect/destroy), use {@link teardownSessionState}
+   * instead, which clears the attach records as well.
    */
-  removeLocalTrack(trackId: string): void;
+  private discardResumeStateAndReconnect;
+  cleanupStoredConnectionParams(): Promise<void>;
   /**
-   * Replace all existing media tracks with a new media  track.
-   * Convenience method for single-track scenarios.
-   * @param track - The MediaStreamTrack to set
+   * Public-teardown helper for disconnect()/destroy(). Clears the resume
+   * state (authorization_state + protocol) AND the attach records as one
+   * atomic unit.
+   *
+   * The two stores are coupled: the backend only honors attach records
+   * within the session identified by the resume state, so ending the
+   * session must clear both. Clearing one without the other strands records
+   * no future session can honor (disconnect) or revives a session the
+   * developer explicitly ended (destroy).
+   *
+   * Distinct from {@link cleanupStoredConnectionParams}, which keeps the
+   * attach records for the stale-auth-state recovery path.
    */
-  setLocalTrack(track: MediaStreamTrack): void;
-  updateSendersConstraints(kind: 'audio' | 'video', constraints?: MediaTrackConstraints): Promise<void>;
+  teardownSessionState(): Promise<void>;
+  protected updateAuthState(authorization_state: string): Promise<void>;
+  reauthenticate(token: string, dpopToken?: string, options?: {
+    clientBound?: boolean;
+  }): Promise<void>;
+  private authenticate;
+  disconnect(): Promise<void>;
+  private createInboundCall;
   /**
-   * Replace the current audio track with a new one using the given constraints.
-   * Used for server-pushed audio constraint changes where applyConstraints
-   * fails on iOS Safari. Stops the current track, acquires a new one via
-   * getUserMedia, and replaces the sender track.
+   * Handle a server-pushed verto.attach event at the session level.
+   *
+   * On page reload the server detects the reconnected session and pushes
+   * verto.attach for any active calls. If a call object already exists
+   * (network blip, no reload), the per-call handler in VertoManager deals
+   * with it. This method only creates a new call object when no existing
+   * one matches the callID.
    */
-  replaceAudioTrackWithConstraints(constraints: MediaTrackConstraints): Promise<void>;
+  private handleVertoAttach;
+  createOutboundCall(destination: string | Address, options?: CallOptions): Promise<Call>;
+  private createCall;
+  destroy(): void;
+}
+declare class ClientSessionWrapper implements SessionState {
+  private clientSessionManager;
+  constructor(clientSessionManager: ClientSessionManager);
+  get authenticated$(): Observable<boolean>;
+  get authenticated(): boolean;
   /**
-   * Clean up resources and close the peer connection.
-   * Completes all observables to prevent memory leaks.
+   * Whether the session is using a Client Bound SAT (DPoP). Sticky — set
+   * when the binding is established or restored from a resumed session's
+   * server authorization.
    */
-  destroy(): void;
-  private removeAllListeners;
-  private stopRemoteTracks;
-  get mediaDirections(): {
-    audio: RTCRtpTransceiverDirection;
-    video: RTCRtpTransceiverDirection;
-  };
-  protected _setRemoteDescription(params: RTCSessionDescriptionInit): Promise<void>;
+  get clientBound(): boolean;
+  get signalingEvent$(): Observable<(Omit<{
+    event_type: "webrtc.message";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: WebrtcMessagePayload;
+  }, "event_channel" | "project_id" | "node_id"> & {
+    event_channel: string;
+    project_id: string;
+    node_id: string;
+  }) | {
+    event_type: "signalwire.authorization.state";
+    params: SignalwireAuthorizationStatePayload;
+  } | (Omit<{
+    event_type: "call.joined";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallJoinedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.left";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallLeftPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallUpdatedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.state";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallStatePayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.play";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallPlayPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "call.connect";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: CallConnectPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | (Omit<{
+    event_type: "room.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: RoomUpdatedPayload;
+  }, "event_channel"> & {
+    event_channel: string;
+  }) | Omit<{
+    event_type: "member.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberUpdatedPayload;
+  }, never> | Omit<{
+    event_type: "member.joined";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberJoinedPayload;
+  }, never> | Omit<{
+    event_type: "member.left";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberLeftPayload;
+  }, never> | Omit<{
+    event_type: "member.talking";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: MemberTalkingPayload;
+  }, never> | Omit<{
+    event_type: "layout.changed";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: LayoutChangedPayload;
+  }, never> | (Omit<{
+    event_type: "conversation.message";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: ConversationMessagePayload;
+  }, "event_channel" | "timestamp" | "is_author"> & {
+    event_channel: string;
+    timestamp: string;
+    is_author: boolean;
+  }) | (Omit<{
+    event_type: "conversation.message.updated";
+    event_channel: EventChannel;
+    timestamp: number;
+    project_id?: string;
+    node_id?: string;
+    is_author?: boolean;
+    params: ConversationMessagePayload;
+  }, "event_channel" | "timestamp" | "is_author"> & {
+    event_channel: string;
+    timestamp: string;
+    is_author: boolean;
+  })>;
+  get iceServers(): RTCIceServer[] | undefined;
+  get callControl(): 'routed' | 'in-dialog';
+  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
+  get incomingCalls$(): Observable<Call[]>;
+  get incomingCalls(): Call[];
+  get calls$(): Observable<Call[]>;
+  get calls(): Call[];
 }
 //#endregion
-//#region src/interfaces/WebRTCVerto.d.ts
+//#region src/core/types/warnings.types.d.ts
 /**
- * Extended interface for WebRTC Verto Manager
- * Includes WebRTC-specific state and peer connection management
+ * Non-fatal warning emitted via {@link SignalWire.warnings$ | client.warnings$}.
+ *
+ * Use to detect SDK behaviors that affect session liveness or developer-facing
+ * contracts but do not warrant disconnection. Discriminated by `code`.
+ *
+ * Existing consumers of `errors$` are NOT notified — `warnings$` is a separate
+ * channel so application code can react to warnings without triggering
+ * error-handling code paths (e.g., disconnect cascades, user-facing toasts).
  */
-interface WebRTCVerto extends VertoManager {
-  readonly selfId$: Observable<string | null>;
-  readonly selfId: string | null;
-  readonly nodeId$: Observable<string | null>;
-  readonly nodeId: string | null;
-  readonly localStream$: Observable<MediaStream>;
-  readonly localStream: MediaStream | null;
-  readonly remoteStream$: Observable<MediaStream>;
-  readonly remoteStream: MediaStream | null;
-  readonly mediaDirections$: Observable<MediaDirections>;
-  readonly mediaDirections: MediaDirections;
-  readonly signalingStatus$: Observable<SignalingStatus>;
-  readonly mainPeerConnection: RTCPeerConnectionController;
-  bye(cause?: string): Promise<void>;
-  sendDigits(dtmf: string): Promise<void>;
-  /**
-   * Send a member-control op in-dialog via verto.info (no self/target member
-   * tuple). The payload rides in the verto.info `params.command` body — a
-   * sibling of `dialogParams`, same level as `dtmf` — matched to this call's
-   * channel by `dialogParams.callID`, so control lands on the call's own channel
-   * without relying on the {node_id,call_id,member_id} addressing the routed
-   * transport uses.
-   */
-  sendCallControl(method: string, params: Record<string, unknown>): Promise<unknown>;
-  hold(): Promise<void>;
-  unhold(): Promise<void>;
-  destroy(): void;
-  transfer(options: TransferOptions): Promise<void>;
-  /** Request a video keyframe via verto.modify. */
-  requestKeyframe?: () => void;
-  /** Request an ICE restart via verto.modify with iceRestart offer. */
-  requestIceRestart?: (relayOnly?: boolean) => Promise<void>;
-  /** Request an ICE restart on all active peer connections (multi-leg). */
-  requestIceRestartAll?: (relayOnly?: boolean) => Promise<void>;
-  /** Request keyframes on all video-receiving legs (skips send-only screen share). */
-  requestKeyframeAll?: () => void;
-  /** Lazily create (or return) the local audio pipeline for the main peer connection. */
-  ensureLocalAudioPipeline(): LocalAudioPipeline | null;
-  /** Current local audio pipeline, or null if it has not been created yet. */
-  readonly localAudioPipeline: LocalAudioPipeline | null;
-}
-//#endregion
-//#region src/managers/CallEventsManager.d.ts
-interface WebRTCCallEventManagerOptions {}
-/** @internal */
-declare class CallEventsManager extends Destroyable {
-  protected webRtcCallSession: CallManager;
-  protected options: WebRTCCallEventManagerOptions;
-  private selfId?;
-  private originCallId?;
-  private callIds;
-  private roomSessionIds;
-  private _participants$;
-  private _self$;
-  private _sessionState$;
-  constructor(webRtcCallSession: CallManager, options?: WebRTCCallEventManagerOptions);
-  get participants$(): Observable<CallParticipant[]>;
-  get participants(): CallParticipant[];
-  get self$(): Observable<CallSelfParticipant>;
-  isRoomSessionIdValid(roomSessionId: string): boolean;
-  addCallId(callId: string): void;
-  isCallIdValid(callId: string): boolean;
-  get recording$(): Observable<boolean>;
-  get recordings$(): Observable<Record<string, unknown>[]>;
-  get streaming$(): Observable<boolean>;
-  get streams$(): Observable<Record<string, unknown>[]>;
-  get playbacks$(): Observable<Record<string, unknown>[]>;
-  get raiseHandPriority$(): Observable<boolean>;
-  get locked$(): Observable<boolean>;
-  get meta$(): Observable<Record<string, unknown>>;
-  get capabilities$(): Observable<Capability[]>;
-  get layout$(): Observable<string>;
-  get layouts$(): Observable<string[]>;
-  get layoutLayers$(): Observable<LayoutLayer[]>;
-  get self(): CallSelfParticipant | null;
-  get layoutLayers(): LayoutLayer[];
-  get recording(): boolean;
-  get streaming(): boolean;
-  get raiseHandPriority(): boolean;
-  get locked(): boolean;
-  get meta(): Record<string, unknown>;
-  get layout(): string | undefined;
-  get layouts(): string[];
-  get capabilities(): Capability[];
-  isSessionEvent(id: string): boolean;
-  protected initSubscriptions(): void;
-  private updateParticipantPositions;
-  updateLayouts(): void;
-  private updateParticipants;
-  private upsertParticipant;
-  private get callJoinedEvent$();
-  private get layoutChangedEvent$();
-  private get memberUpdates$();
-  destroy(): void;
-}
-//#endregion
-//#region src/managers/CallRecoveryManager.d.ts
-type RecoveryState$1 = 'idle' | 'debouncing' | 'recovering' | 'cooldown';
-interface RecoveryEvent$1 {
-  action: 'keyframe_requested' | 'reinvite_started' | 'reinvite_succeeded' | 'reinvite_failed' | 'reinvite_timeout' | 'max_attempts_reached' | 'signal_reconnect' | 'full_reconnect' | 'video_disabled' | 'video_restored';
-  reason: string;
-  attempt?: number;
-  maxAttempts?: number;
-  timestamp: number;
+type SDKWarning = CredentialRefreshFallbackWarning | CredentialNoRefreshHandlerWarning;
+/**
+ * Diagnostic detail for {@link CredentialRefreshFallbackWarning}. Stable
+ * values, but treat unknown strings as "fell back for an unspecified cause" —
+ * do not branch on this value for control flow. New values may be added in
+ * future releases.
+ */
+type CredentialRefreshFallbackReason = 'no-scope' | 'no-dpop-support' | 'endpoint-failed' | 'activation-timeout' | (string & {});
+/**
+ * Emitted when the SDK falls back to the developer-provided
+ * {@link CredentialProvider.refresh} because the Client Bound SAT path
+ * could not take over.
+ *
+ * Common causes:
+ * - The minted SAT lacks `sat:refresh` scope (`reason: 'no-scope'`).
+ * - The `/devices/token` exchange failed transiently (`reason: 'endpoint-failed'`).
+ *
+ * Subscribe to this warning to detect:
+ * - SDKs running with plain SATs that rely on developer-managed refresh
+ * - Deployments expected to use bound tokens that silently downgraded to bearer
+ *   (a security-relevant signal for fleet observability)
+ */
+interface CredentialRefreshFallbackWarning {
+  code: 'credential_refresh_fallback';
+  source: 'CredentialProvider';
+  reason: CredentialRefreshFallbackReason;
+  message: string;
 }
-//#endregion
-//#region src/utils/qualityScore.d.ts
 /**
- * MOS (Mean Opinion Score) quality computation based on the simplified
- * ITU-T G.107 E-model.
+ * Emitted when a credential has an `expiry_at` but the provider supplies no
+ * `refresh()` handler. The session will terminate at expiry with no fallback.
  *
- * Provides a single 1-5 number that applications can use for a
- * green / yellow / red quality indicator without understanding raw
- * jitter and packet-loss values.
+ * Implementors who want long-lived sessions must provide a `refresh()` handler
+ * or mint tokens with the `sat:refresh` scope (Client Bound SAT path).
  */
-type QualityLevel$1 = 'excellent' | 'good' | 'fair' | 'poor' | 'critical';
+interface CredentialNoRefreshHandlerWarning {
+  code: 'credential_no_refresh_handler';
+  source: 'CredentialProvider';
+  message: string;
+  /** Token expiry timestamp (epoch milliseconds). */
+  expiresAt: number;
+}
 //#endregion
-//#region src/core/entities/Call.d.ts
+//#region src/utils/logger.d.ts
+/** Log level names supported by the SDK. */
+type LogLevel = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'silent';
 /**
- * Manager instances returned by initialization callback
+ * Logger interface that consumers can implement to replace the built-in logger.
+ * All methods accept variadic arguments matching the browser console API.
  */
-interface CallManagers {
-  vertoManager: WebRTCVerto;
-  callEventsManager: CallEventsManager;
+interface SDKLogger {
+  error(...args: unknown[]): void;
+  warn(...args: unknown[]): void;
+  info(...args: unknown[]): void;
+  debug(...args: unknown[]): void;
+  trace(...args: unknown[]): void;
+}
+/** Options for WebSocket traffic logging. */
+interface WsTrafficOptions {
+  type: 'send' | 'recv' | 'http';
+  /** Parsed object or raw string — will be JSON.stringify'd for display if an object. */
+  payload: unknown;
 }
 /**
- * Initialization callback that creates managers for a Call instance
- * @param call - The WebRTCCall instance being initialized
- * @returns Manager instances for the call
+ * Options for WebSocket traffic logging using raw strings.
+ * The string is only parsed when logging is enabled, avoiding
+ * unnecessary JSON.parse on every message.
  */
-type ManagerInitializer = (call: WebRTCCall) => CallManagers;
+interface WsTrafficRawOptions {
+  type: 'send' | 'recv';
+  raw: string;
+}
+/** Debug options that control verbose SDK logging. */
+interface DebugOptions {
+  /** Log all WebSocket send/recv traffic to the console. */
+  logWsTraffic?: boolean;
+}
+/** Extended logger with SDK-internal helpers (wsTraffic). */
+interface InternalSDKLogger extends SDKLogger {
+  wsTraffic: (options: WsTrafficOptions | WsTrafficRawOptions) => void;
+}
+/** Replace the built-in logger with a custom implementation. Pass `null` to restore defaults. */
+declare const setLogger: (logger: SDKLogger | null) => void;
+/** Configure debug options (e.g., `{ logWsTraffic: true }`). */
+declare const setDebugOptions: (options: DebugOptions | null) => void;
 /**
- * Required initialization configuration for Call constructor.
- * Calls must be created via {@link CallFactory} which provides these dependencies.
+ * Set the log level for the built-in logger.
+ * Has no effect when a custom logger is set via `setLogger()`.
  */
-interface CallInitialization {
+declare const setLogLevel: (level: LogLevel) => void;
+declare const getLogger: () => InternalSDKLogger;
+//#endregion
+//#region src/clients/SignalWire.d.ts
+/** Options for constructing a {@link SignalWire}. */
+interface SignalWireOptions {
+  /** Skip automatic WebSocket connection on construction. */
+  skipConnection?: boolean;
+  /** Skip automatic user registration on construction. */
+  skipRegister?: boolean;
+  /** Skip monitoring media device changes. */
+  skipDeviceMonitoring?: boolean;
+  /** Whether to reconnect to previously attached calls. */
+  reconnectAttachedCalls?: boolean;
+  /** Whether to save preferences. */
+  savePreferences?: boolean;
   /**
-   * Callback function that creates and wires manager instances
+   * Persist the session across page reloads.
+   *
+   * When `true`, credential, authorization state, and protocol are stored in
+   * `localStorage` (survives reload). The DPoP key pair is persisted in
+   * IndexedDB. On reload, the SDK restores the session from cache
+   * without calling `credentialProvider.authenticate()`.
+   *
+   * When `false` (default), session data lives in `sessionStorage` and is
+   * lost on reload.
+   *
+   * Both {@link SignalWire.disconnect | disconnect()} and
+   * {@link SignalWire.destroy | destroy()} end the session and clear the
+   * persisted resume state and attach records; credentials and device
+   * preferences survive. Use `resetToDefaults()` for a full wipe, or
+   * `unregister()` to temporarily stop receiving inbound calls while keeping
+   * the session alive.
    */
-  initializeManagers: ManagerInitializer;
+  persistSession?: boolean;
+  /** Custom storage implementation for persistence. */
+  storageImplementation?: Storage;
+  /** Custom WebSocket constructor */
+  webSocketConstructor?: WebSocketAdapter | NodeSocketAdapter;
+  /** Custom WebRTC API provider */
+  webRTCApiProvider?: WebRTCApiProvider;
   /**
-   * Device controller for media device access
+   * Custom logger implementation. Must implement the {@link SDKLogger} interface.
+   * Pass `null` to restore the built-in logger.
+   *
+   * **Note:** Logger configuration is global — setting it on one instance affects all instances.
    */
-  deviceController: DeviceController;
+  logger?: SDKLogger | null;
   /**
-   * Network change events for feeding recovery pipeline
+   * Log level for the built-in logger.
+   * Default: `'warn'`. Set to `'debug'` for verbose SDK output.
+   * Has no effect when a custom `logger` is provided.
+   *
+   * **Note:** Logger configuration is global — setting it on one instance affects all instances.
    */
-  networkChange$?: Observable<NetworkChangeEvent>;
+  logLevel?: LogLevel;
+  /** Debug options for verbose SDK diagnostics (e.g., `{ logWsTraffic: true }`). */
+  debug?: DebugOptions;
+  /**
+   * Control transport for `call.*` verbs across ALL calls in this session:
+   * - `'routed'` (default) sends them on the client's session channel.
+   * - `'in-dialog'` carries them on each call's own signaling channel via `verto.info`,
+   *   so control works without the client needing to know how the conference is hosted.
+   *
+   * `'in-dialog'` is opt-in because it does not reach everywhere `'routed'` does: use it
+   * only for calls that join a conference over SWML (e.g. an SWML `join_conference`).
+   *
+   * It is a client-wide setting rather than per-`dial()` because the SDK issues some
+   * control RPCs itself (fetching the layout list on join, for example), and those must
+   * travel the same way as the app's own, or reads and writes land on different transports.
+   *
+   * @experimental A rollout switch, not a long-term part of the API. Expected to
+   * disappear once `'in-dialog'` becomes the only transport, so it carries no semver
+   * promise and application code should not depend on it.
+   */
+  callControl?: 'routed' | 'in-dialog';
+}
+/** Options for {@link SignalWire.dial}. Extends {@link MediaOptions} with dial-specific settings. */
+interface DialOptions extends MediaOptions {
+  /** Preferred video codecs for this call (overrides global preferences). */
+  preferredVideoCodecs?: string[];
+  /** Preferred audio codecs for this call (overrides global preferences). */
+  preferredAudioCodecs?: string[];
+  /** Enable stereo Opus for this call (overrides global preferences). */
+  stereo?: boolean;
+  /** Optional node ID for routing the call */
+  nodeId?: string;
+  /**
+   * Custom variables sent with the Verto invite. Merged with
+   * `client.preferences.userVariables` and any query-string variables on the
+   * destination URI; values here take precedence.
+   */
+  userVariables?: Record<string, unknown>;
 }
 /**
- * Concrete WebRTC call implementation.
+ * Main entry point for the SignalWire Browser SDK.
  *
- * Manages the full lifecycle of a call including signaling, media streams,
- * participants, layout, and event routing. Created via {@link SignalWire.dial}
- * or received as an inbound call.
+ * Manages authentication, WebSocket transport, call creation, and media devices.
+ *
+ * @example
+ * ```ts
+ * const client = new SignalWire(credentialProvider);
+ * client.isConnected$.subscribe(connected => console.log('Connected:', connected));
+ * const call = await client.dial('/public/my-room');
+ * ```
  */
-declare class WebRTCCall extends Destroyable implements CallManager {
-  clientSession: ClientSession;
-  options: CallOptions;
-  address?: Address | undefined;
-  /** Unique identifier for this call. */
-  readonly id: string;
-  /** Destination URI this call was placed to. */
-  to?: string;
-  private vertoManager;
-  private callEventsManager;
-  private participantFactory;
-  private _errors$;
-  private _status$;
-  private _lastMergedStatus;
-  private _answered$;
-  private _answerMediaOptions?;
-  private _holdState;
-  private _userVariables$;
-  private _statsMonitor?;
-  private _recoveryManager?;
-  private _networkChange$?;
-  private _networkIssues$;
-  private _networkMetrics$;
-  private _isNetworkHealthy$;
-  private _qualityScore$;
-  private _qualityLevel$;
-  private _recoveryState$;
-  private _recoveryEvent$;
-  private _bandwidthConstrained$;
-  private _mediaParamsUpdated$;
-  private _customSubscriptions;
-  private _pushToTalkEnabled;
-  private _remoteAudioMeter;
-  constructor(clientSession: ClientSession, options: CallOptions, initialization: CallInitialization, address?: Address | undefined);
-  /** Observable stream of errors from media, signaling, and peer connection layers. */
-  get errors$(): Observable<CallError>;
+declare class SignalWire extends Destroyable implements DeviceController {
+  /** Global SDK preferences (timeouts, ICE config, media defaults). */
+  preferences: ClientPreferences;
+  private _user$;
+  private _directory$;
+  private _transport;
+  private _clientSession;
+  private _publicSession;
+  private _deviceController;
+  private _attachManager?;
   /**
-   * @internal Push an error to the call's error stream.
-   * Fatal errors automatically transition the call to `'failed'` and destroy it.
+   * Set once a credential recovery has been *verified* — reauthenticated and
+   * then proven by the operation it was meant to unblock. Read by the attach
+   * path, which may only discard an attach record when a reattach is refused
+   * on a credential the server has already accepted.
    */
-  emitError(callError: CallError): void;
-  /** Notify the recovery manager that a verto.modify signaling exchange failed. */
-  notifyModifyFailed(): void;
-  /** Whether this call is `'inbound'` or `'outbound'`. */
-  get direction(): CallDirection;
-  /** Observable of the address associated with this call. */
-  get address$(): Observable<Address | undefined>;
-  /** Display name of the caller. */
-  get fromName(): string | undefined;
-  /** Address URI of the caller. */
-  get from(): string | undefined;
-  /** Display name of the callee. */
-  get toName(): string | undefined;
-  /** Toggles whether incoming video is received. @throws {UnimplementedError} Not yet implemented. */
-  toggleIncomingVideo(): Promise<void>;
-  /** Toggles whether incoming audio is received. @throws {UnimplementedError} Not yet implemented. */
-  toggleIncomingAudio(): Promise<void>;
-  /** @internal Registers an additional call ID for event routing. */
-  addCallId(callId: string): void;
-  /** List of capabilities available in the current call. */
-  get capabilities(): Capability[];
-  /** Current snapshot of all participants in the call. */
-  get participants(): CallParticipant[];
-  /** The local participant, or `null` if not yet joined. */
-  get self(): CallSelfParticipant | null;
-  /** Toggles the call lock state, preventing or allowing new participants from joining. */
-  toggleLock(): Promise<void>;
+  private _credentialRecovered;
+  private _isConnected$;
+  private _isRegistered$;
+  private _errors$;
+  private _warnings$;
+  private _options;
+  private _dpopManager?;
+  private _refreshCoordinator?;
+  /** The refresh path's own HTTP controller — see resolveCredentials. */
+  private _refreshHttp?;
+  /** Host `_refreshHttp` was built against, so it can be rebuilt when the token's `ch` changes. */
+  private _refreshHttpHost?;
+  private _credentialProvider?;
+  private _deps;
+  private _networkMonitor?;
+  private _visibilityController?;
+  private _diagnosticsCollector?;
+  private _platformCapabilities?;
   /**
-   * Toggles the hold state of the call (pauses/resumes local media transmission).
+   * Creates a new SignalWire client and begins connecting.
    *
-   * Distinct from {@link Participant.toggleMute} which mutes individual tracks.
+   * @param credentialProvider - Provider that supplies authentication credentials.
+   * @param options - Configuration options (connection, device monitoring, preferences).
    */
-  toggleHold(): Promise<void>;
-  /** @throws {UnimplementedError} Not yet implemented. Status tracked via {@link recording$}. */
-  startRecording(): Promise<void>;
-  /** @throws {UnimplementedError} Not yet implemented. Status tracked via {@link streaming$}. */
-  startStreaming(): Promise<void>;
+  constructor(credentialProvider: CredentialProvider | undefined, options?: SignalWireOptions);
   /**
-   * Replaces the call's custom metadata.
-   * @param _meta - Metadata object to set.
-   * @throws {UnimplementedError} Not yet implemented.
+   * Build the refresh path's own HTTP controller, against whatever host is current.
+   *
+   * Called on first use rather than up front, so `apiHost` already reflects the
+   * token's `ch` claim. Same credential source as the container's controller — only
+   * the instance, and therefore its observable streams, is separate.
    */
-  setMeta(_meta: Record<string, unknown>): Promise<void>;
+  private createRefreshHttpController;
   /**
-   * Merges values into the call's custom metadata (unlike {@link setMeta} which replaces).
-   * @param _meta - Metadata to merge.
-   * @throws {UnimplementedError} Not yet implemented.
+   * Initializes DPoP if not already set up. Returns the fingerprint on success.
    */
-  updateMeta(_meta: Record<string, unknown>): Promise<void>;
-  /** Observable of layout layer positions for all participants. */
-  get layoutLayers$(): Observable<LayoutLayer[]>;
-  /** Current snapshot of layout layers. */
-  get layoutLayers(): LayoutLayer[];
+  private initDPoP;
   /**
-   * Executes a Verto RPC method targeting a specific participant.
-   *
-   * Constructs call context (node_id, call_id, member_id) and sends the RPC request.
+   * Resolves credentials using cache-first strategy when persistSession is enabled.
    *
-   * @param target - Target {@link MemberTarget} triple, or the local member's
-   *   ID string for self-operations (any other string is rejected — a bare
-   *   member id cannot carry the remote member's own call context).
-   * @param method - Verto method name (e.g. `'call.mute'`, `'call.member.remove'`).
-   * @param args - Parameters for the RPC method.
-   * @returns The RPC response.
-   * @throws {CallNotReadyError} If the call has no self member context yet.
-   * @throws {InvalidParams} If a string target is not the local member's ID.
-   * @throws {JSONRPCError} If the RPC call returns an error.
+   * 1. If persistSession → check localStorage for cached credential
+   * 2. If cached and not expired → use it (skip provider.authenticate())
+   * 3. If no cache or expired → call provider.authenticate()
+   * 4. If no provider AND no cache → throw
    */
-  executeMethod<T extends JSONRPCResponse = JSONRPCResponse>(target: string | MemberTarget, method: string, args: Record<string, unknown>): Promise<T>;
+  private resolveCredentials;
+  private validateCredentials;
   /**
-   * `executeMethod` for a call opened with `callControl: 'in-dialog'`.
-   *
-   * Translates the routed transport's calling convention into the in-dialog one. No
-   * `self` tuple is sent, but a `target` is — the same {call_id, member_id} the routed
-   * transport puts in `target` (minus node_id), for self-ops and cross-member ops alike.
-   *
-   * Target shapes are per-verb and irregular, so they are centralised here rather
-   * than left to callers: most verbs take a singular `target`, `call.member.remove`
-   * takes a plural `targets` array, and `call.member.position.set` takes a flat
-   * `targets` of `{call_id, position}` — the one verb keyed on call_id rather than
-   * member_id, so the member triple `Participant.setPosition` built is unwrapped.
+   * Reauthenticate the currently-open session with a freshly obtained
+   * credential so the new token takes effect on the live socket immediately —
+   * not just on the next reconnect. No-op when the session is not
+   * connected/authenticated or the credential carries no token (e.g. an
+   * authorization-state-only refresh). Non-fatal: reauth failures surface on
+   * `errors$` without aborting the refresh that triggered this.
    */
-  private executeMethodInDialog;
+  private reauthenticateLiveSession;
   /**
-   * Sends a `call.*` control verb **in-dialog** via `verto.info`, as an alternative
-   * to the routed {@link executeMethod} transport.
-   *
-   * Why both exist: `executeMethod` addresses the member with an explicit
-   * `{node_id, call_id, member_id}` tuple, which does not resolve for every conference,
-   * so the op can fail. An in-dialog frame carries the verb on the member's own
-   * signaling channel instead, so control works without the client needing to know how
-   * the conference is hosted.
-   *
-   * The trade-off is reach: the in-dialog transport is only accepted for calls that
-   * join a conference over SWML (e.g. an SWML `join_conference`); use the routed
-   * default otherwise.
-   *
-   * `params` are sent verbatim — nothing is built for you, which includes the target.
-   * **A self-directed op still needs one**, or it is refused; name yourself explicitly:
-   *
-   * ```ts
-   * const { call_id, member_id } = call.self.target;
-   * await call.sendCommand('call.mute', { channels: ['audio'], target: { call_id, member_id } });
-   * ```
-   *
-   * Never include `node_id` — only the two ids. The shapes are per-verb: most take a
-   * singular `target`, `call.member.remove` takes a plural `targets` array, and
-   * `call.member.position.set` takes a flat `targets: [{call_id, position}]` (the one
-   * verb keyed on `call_id` rather than `member_id`). Verbs that act on the call as a
-   * whole, or that the SDK does not wrap at all, take no target.
+   * Recover a session the server is refusing: mint a fresh credential,
+   * reauthenticate the live session with it, and retry the operation.
    *
-   * For the typed alternative that handles all of this, create the client with
-   * `callControl: 'in-dialog'` and use the ordinary `Call`/`Participant` methods.
+   * The connection is deliberately kept. A reload authenticates the new socket
+   * against the persisted `authorization_state`, and that handshake is what
+   * associates the socket with the previous session — the association reattach
+   * depends on. `signalwire.reauthenticate` swaps the credential *on that same
+   * session*, so recovery never touches the resume state. Discarding it would
+   * heal the credential by destroying the very thing the caller is trying to
+   * get back to.
    *
-   * @internal Not part of the supported surface while the in-dialog transport is still
-   * rolling out. `WebRTCCall` is exported from the package entry, so without this tag
-   * TypeDoc publishes the method — and the example above — as public API.
+   * The operation is still the verdict, never the RPC. Reauthenticating with
+   * the in-memory token is accepted by a resume even while requests stay
+   * refused, because the persisted `authorization_state` short-circuits token
+   * validation — and `signalwire.reauthenticate` with a *freshly minted* token
+   * has also been observed accepted while `subscriber.online` keeps being
+   * refused (staging run 33826974634). Both look like success and are not.
    *
-   * @param method - A `call.*` method name (e.g. `'call.mute'`).
-   * @param params - Method parameters, sent verbatim.
-   * @returns The method's own reply, unwrapped from the `verto.info` envelope.
-   * @throws {JSONRPCError} If the control op fails.
+   * @returns the operation's value, or the reason recovery could not deliver
+   *   one. `error` is undefined when there was no way to mint at all.
    */
-  sendCommand<T extends JSONRPCResponse = JSONRPCResponse>(method: string, params?: Record<string, unknown>): Promise<T>;
+  private recoverAndRetry;
   /**
-   * The local leg's member triple — sent as `self` in every member RPC
-   * envelope, and as the `target` of call-scoped self-operations (e.g. lock,
-   * layout).
+   * Re-mint a credential and adopt it only if the live session accepts it.
    *
-   * @throws {CallNotReadyError} Before `call.joined` delivers the self member
-   * context (`selfId`/`nodeId`) — an RPC without it cannot be routed, so fail
-   * fast instead of sending a doomed request.
-   */
-  private get callSelf();
-  /** Observable of the current call status (e.g. `'ringing'`, `'connected'`). */
-  get status$(): Observable<CallStatus>;
-  /** Observable of the participants list, emits on join/leave/update. */
-  get participants$(): Observable<CallParticipant[]>;
-  /** Observable of the local (self) participant. */
-  get self$(): Observable<CallSelfParticipant>;
-  /** Observable indicating whether the call is being recorded. */
-  get recording$(): Observable<boolean>;
-  /** Observable indicating whether the call is being streamed. */
-  get streaming$(): Observable<boolean>;
-  /** Observable indicating whether raise-hand priority is active. */
-  get raiseHandPriority$(): Observable<boolean>;
-  /** Observable indicating whether the call room is locked. */
-  get locked$(): Observable<boolean>;
-  /** Observable of custom metadata associated with the call. */
-  get meta$(): Observable<Record<string, unknown>>;
-  /** Observable of the call's capability flags. */
-  get capabilities$(): Observable<Capability[]>;
-  /** Observable of the current layout name. */
-  get layout$(): Observable<string>;
-  /** Current call status. */
-  get status(): CallStatus;
-  /** Whether the call is currently being recorded. */
-  get recording(): boolean;
-  /** Whether the call is currently being streamed. */
-  get streaming(): boolean;
-  /** Whether raise-hand priority is active. */
-  get raiseHandPriority(): boolean;
-  /** Whether the call room is locked. */
-  get locked(): boolean;
-  /** Current custom metadata of the call. */
-  get meta(): Record<string, unknown>;
-  /** Current layout name, or `undefined` if not set. */
-  get layout(): string | undefined;
-  /** Observable of available layout names. */
-  get layouts$(): Observable<string[]>;
-  /** Current snapshot of available layout names. */
-  get layouts(): string[];
-  /** Observable of the local media stream (camera/microphone). */
-  get localStream$(): Observable<MediaStream>;
-  /** Current local media stream, or `null` if not available. */
-  get localStream(): MediaStream | null;
-  /** Observable of the remote media stream from the far end. */
-  get remoteStream$(): Observable<MediaStream>;
-  /** Current remote media stream, or `null` if not available. */
-  get remoteStream(): MediaStream | null;
-  /** Observable of custom user variables associated with the call. */
-  get userVariables$(): Observable<Record<string, unknown>>;
-  /** a copy of the current custom user variables of the call. */
-  get userVariables(): Record<string, unknown>;
-  /** Merge current custom user variables of the call. */
-  set userVariables(variables: Record<string, unknown>);
-  /** Observable of current network health issues (empty array = healthy). */
-  get networkIssues$(): Observable<NetworkIssue[]>;
-  /** Current snapshot of network issues. */
-  get networkIssues(): NetworkIssue[];
-  /** Simple boolean health indicator derived from stats monitor. */
-  get isNetworkHealthy$(): Observable<boolean>;
-  /** Whether the network is currently healthy. */
-  get isNetworkHealthy(): boolean;
-  /** Rolling history of raw network metrics (RTT, jitter, packet loss, bitrate). */
-  get networkMetrics$(): Observable<NetworkMetrics[]>;
-  /** Current snapshot of the metrics rolling window. */
-  get networkMetrics(): NetworkMetrics[];
-  /** Observable of MOS quality score (1-5) computed from stats metrics. */
-  get qualityScore$(): Observable<number>;
-  /** Observable of simplified quality level (excellent/good/fair/poor/critical). */
-  get qualityLevel$(): Observable<QualityLevel$1>;
-  /** Observable of the recovery pipeline state machine. */
-  get recoveryState$(): Observable<RecoveryState$1>;
-  /** Observable of recovery events (keyframe requested, ICE restart, etc.). */
-  get recoveryEvent$(): Observable<RecoveryEvent$1>;
-  /** Observable indicating whether the call is bandwidth-constrained. */
-  get bandwidthConstrained$(): Observable<boolean>;
-  /** Observable that emits when server-pushed media params are applied. */
-  get mediaParamsUpdated$(): Observable<MediaParamsEvent>;
-  /**
-   * @internal Emit a media params update event.
-   * Called by the VertoManager when server-pushed media params are applied.
+   * The mechanism follows the binding: a client-bound session re-mints a bound
+   * base SAT through `authenticate()` with the DPoP fingerprint, because the
+   * developer refresh handler would hand back an unbound token and silently
+   * degrade the session. An unbound session uses the refresh handler. Rotation
+   * cost is not a reason to skip this — the only reason is having no mechanism.
+   *
+   * @returns whether the session is now running on a freshly accepted credential.
    */
-  emitMediaParamsUpdated(event: MediaParamsEvent): void;
-  /** Request a video keyframe via RTCP PLI/FIR. */
-  requestKeyframe(): void;
-  /** Force an ICE restart / re-INVITE. */
-  requestIceRestart(): Promise<void>;
+  private remintAndReauthenticate;
   /**
-   * @internal Initialize resilience subsystems when the call reaches 'connected'.
-   * Called from within the status subscription to wire stats and recovery.
+   * Re-mint a credential via `provider.refresh()`, routed through the
+   * coordinator's shared in-flight guard so concurrent re-mint paths (a
+   * scheduled/resume refresh, -32003 recovery, and reconnect) never fire a
+   * second `provider.refresh()` in parallel — which rotating one-time-use
+   * refresh tokens reject. Falls back to a direct call only if the coordinator
+   * has not been constructed yet.
    */
-  private initResilienceSubsystems;
+  private remintCredential;
   /**
-   * Wait for the underlying RTCPeerConnection to reach 'connected' after
-   * triggering an ICE restart. Resolves true on success, false on failure
-   * or if the state doesn't transition within the configured timeout.
+   * Re-mint credentials before a fresh (re)connect (`onBeforeReconnect` hook).
+   * The session invokes this only when it is client-bound OR the in-memory
+   * token is expired. The re-mint mechanism depends on the binding:
+   *   - Client-bound: `authenticate()` with the DPoP fingerprint to obtain a
+   *     fresh base SAT the upcoming reconnect can re-bind (the
+   *     DeviceTokenManager re-activates afterwards).
+   *   - Unbound: the developer's non-interactive `refresh()` handler.
+   *     `authenticate()` is deliberately NOT used here — it may be interactive
+   *     (a login prompt) and must not fire on a background reconnect.
    *
-   * Polls connectionState directly because the recovery manager already
-   * wraps this call in its own withTimeout(); a separate listener-based
-   * implementation would race the outer timeout in subtle ways.
+   * Rejects on failure so the session aborts the reconnect rather than
+   * replaying a stale token.
    */
-  private waitForPeerConnectionConnected;
+  private refreshCredentialForReconnect;
+  /** Persist credential to localStorage when persistSession is enabled. */
+  private persistCredential;
   /**
-   * @internal Stop and destroy resilience subsystems (on disconnect/destroy).
-   * Clears references so they can be re-created on reconnect.
+   * Persist whether the session is client-bound, mirroring the credential's
+   * storage scopes so it survives a reload. The preflight recovery reads it
+   * before any session exists to decide whether to re-bind via `authenticate()`
+   * or refresh an unbound token; the marker tracks the latest binding, so an
+   * unbound reconnect clears a stale marker from an earlier client-bound login.
    */
-  private stopResilienceSubsystems;
-  /** @internal */
-  createParticipant(memberId: string, selfId?: string | null): Participant | SelfParticipant;
-  /** Observable of the current audio/video send/receive directions. */
-  get mediaDirections$(): Observable<MediaDirections>;
-  /** Current audio/video send/receive directions. */
-  get mediaDirections(): MediaDirections;
-  protected get participantsId$(): Observable<string[]>;
+  private persistClientBoundMarker;
+  /** Read the persisted client-bound marker (see {@link persistClientBoundMarker}). */
+  private wasClientBound;
+  private init;
+  private handleAttachments;
   /**
-   * Executes a raw JSON-RPC request on the client session.
-   *
-   * Lower-level than {@link executeMethod} — allows full control over the RPC request structure.
+   * Fetch the authenticated user profile, recovering a stale credential.
    *
-   * @param request - Complete JSON-RPC request object.
-   * @param options - Optional RPC execution options (timeout, etc.).
-   * @returns The RPC response.
-   * @throws {JSONRPCError} If the RPC call returns an error response.
+   * On a reload the persisted credential can be expired. Unlike the WS resume —
+   * which the server accepts against the persisted `authorization_state` even
+   * with an expired token — this REST preflight has no such short-circuit and is
+   * refused (401). There is no session yet to reauthenticate, so recovery
+   * re-mints the credential through the provider ({@link refreshCredentialForReconnect})
+   * and retries with a FRESH {@link User}: Fetchable memoizes its result
+   * (shareReplay), so reusing the instance would replay the 401 instead of
+   * re-fetching with the new token. Without the user id the transport/session —
+   * and the reattach a reload is trying to preserve — cannot even be addressed.
    */
-  execute<T extends JSONRPCResponse = JSONRPCResponse>(request: JSONRPCRequest, options?: PendingRPCOptions): Promise<T>;
-  /** Observable of the local participant's member ID. */
-  get selfId$(): Observable<string | null>;
-  /** Local participant's member ID, or `null` if not joined. */
-  get selfId(): string | null;
-  /** Observable of the server node ID handling this call. */
-  get nodeId$(): Observable<string | null>;
-  /** Server node ID handling this call, or `null`. */
-  get nodeId(): string | null;
-  private isCallSessionEvent;
-  private get callSessionEvents$();
-  /** Observable of call-updated events. */
-  get callUpdated$(): Observable<CallUpdatedPayload>;
-  /** Observable of member-joined events, emitted when a remote participant joins the call. */
-  get memberJoined$(): Observable<MemberJoinedPayload>;
-  /** Observable of member-left events, emitted when a participant leaves the call. */
-  get memberLeft$(): Observable<MemberLeftPayload>;
-  /** Observable of member-updated events (mute, volume, etc.). */
-  get memberUpdated$(): Observable<MemberUpdatedPayload>;
-  /** Observable of member-talking events (speech start/stop). */
-  get memberTalking$(): Observable<MemberTalkingPayload>;
-  /** Observable of call state-change events. */
-  get callStates$(): Observable<CallStatePayload>;
-  /** Observable of layout-changed events. */
-  get layoutUpdates$(): Observable<LayoutChangedPayload>;
-  /** Underlying `RTCPeerConnection`, for advanced use cases. */
-  get rtcPeerConnection(): RTCPeerConnection | undefined;
-  /** Observable of raw signaling events as plain objects. */
-  get signalingEvent$(): Observable<Record<string, unknown>>;
+  private fetchUserOrRecover;
   /**
-   * Subscribe to a custom signaling event type on this call.
+   * Establishes the WebSocket connection and authenticates the session.
    *
-   * Returns a cached observable that filters `callSessionEvents$` for events
-   * whose `event_type` matches the given string. The observable completes
-   * when the call is destroyed.
+   * ## Reconnection behavior
    *
-   * Unlike `signalingEvent$` (which only emits known call-level event types),
-   * this method also matches custom/user-defined event types.
+   * After a successful connection the underlying {@link WebSocketController}
+   * automatically attempts to reconnect whenever the socket closes
+   * unexpectedly (e.g. network change, server restart). Reconnection uses an
+   * **exponential back-off** strategy:
    *
-   * The SDK does not validate event type strings --- the server decides
-   * whether a given type is valid.
+   * - First retry after `reconnectDelayMin` (default **0.1 s**).
+   * - Each subsequent retry doubles the delay up to `reconnectDelayMax`
+   *   (default **3 s**).
+   * - The delay resets to `reconnectDelayMin` once a connection succeeds.
+   * - A per-attempt `connectionTimeout` (default **10 s**) aborts the
+   *   attempt and schedules the next retry if the server does not respond.
    *
-   * @param eventType - The event type to subscribe to (e.g. `'my.custom.event'`).
-   * @returns An observable that emits matching signaling events.
+   * Calling {@link disconnect} stops the reconnection loop entirely.
+   *
+   * ## Message handling during temporary disconnections
+   *
+   * While the socket is not in the `connected` state, **outgoing messages
+   * are queued** in an internal buffer. Once the connection is
+   * re-established the queue is flushed in order so no outgoing RPC call is
+   * lost.
+   *
+   * **Incoming** server-to-client messages that arrive while the socket is
+   * down are *not* buffered by the SDK — they are expected to be
+   * re-delivered by the server after the session is re-authenticated.
+   * Active RPC calls that were awaiting a response will time out
+   * (default **5 s**) and reject with an `RPCTimeoutError`; callers should
+   * handle this and retry if appropriate.
+   *
+   * The connection status can be observed via the `status$` observable on
+   * the transport layer, which emits `'connecting'`, `'connected'`,
+   * `'reconnecting'`, `'disconnecting'`, or `'disconnected'`.
+   */
+  connect(): Promise<void>;
+  /**
+   * Observable that emits the {@link User} profile once fetched,
+   * or `undefined` before authentication completes.
    *
    * @example
    * ```ts
-   * call.subscribe('my.custom.event').subscribe(event => {
-   *   console.log('Custom event:', event);
+   * client.user$.subscribe(u => {
+   *   if (u) console.log('Logged in as', u.email);
    * });
    * ```
    */
-  subscribe(eventType: string): Observable<Record<string, unknown>>;
-  get webrtcMessages$(): Observable<WebrtcMessagePayload>;
-  get callEvent$(): Observable<WebrtcMessagePayload | CallJoinedPayload | CallLeftPayload | CallUpdatedPayload | CallStatePayload | CallPlayPayload | CallConnectPayload | RoomUpdatedPayload | MemberUpdatedPayload | MemberJoinedPayload | MemberLeftPayload | MemberTalkingPayload | LayoutChangedPayload | ConversationMessagePayload>;
-  get layoutEvent$(): Observable<LayoutChangedPayload>;
+  get user$(): Observable<User | undefined>;
+  /** Current user snapshot, or `undefined` if not yet authenticated. */
+  get user(): User | undefined;
   /**
-   * Hangs up the call and releases all resources.
-   *
-   * Sends a Verto `bye` to the server, transitions status to `'disconnecting'`,
-   * then destroys the call. After this, the call instance is no longer usable.
+   * Observable that emits the {@link Directory} instance once the client is connected,
+   * or `undefined` while disconnected. Subscribe to this to safely wait for the directory
+   * to become available without risking an error.
    *
    * @example
    * ```ts
-   * await call.hangup();
+   * client.directory$.subscribe(dir => {
+   *   if (dir) dir.addresses$.subscribe(console.log);
+   * });
    * ```
    */
-  hangup(): Promise<void>;
+  get directory$(): Observable<Directory | undefined>;
   /**
-   * Sends DTMF digits on the call.
+   * Current directory snapshot, or `undefined` if the client is not yet connected.
+   * Prefer {@link directory$} when you need to react to the directory becoming available.
+   */
+  get directory(): Directory | undefined;
+  /** Observable that emits when the user registration state changes. */
+  get isRegistered$(): Observable<boolean>;
+  /** Whether the user is currently registered. */
+  get isRegistered(): boolean;
+  /** Whether the client is currently connected. */
+  get isConnected(): boolean;
+  /** Observable that emits when the connection state changes. */
+  get isConnected$(): Observable<boolean>;
+  /** Observable that emits `true` when the client is both connected and authenticated. */
+  get ready$(): Observable<boolean>;
+  /** Observable stream of errors from transport, authentication, and devices. */
+  get errors$(): Observable<Error>;
+  /**
+   * Observable stream of non-fatal SDK warnings.
    *
-   * @param dtmf - The digit string to send (e.g. `'1234#'`).
+   * Subscribe to detect SDK behaviors that affect session liveness or developer-facing
+   * contracts but do not warrant disconnection — e.g., a fallback from Client Bound SAT
+   * refresh to the developer-provided `refresh()` because the SAT lacks `sat:refresh`
+   * scope. Discriminated by `code`.
    *
-   * @example
-   * ```ts
-   * await call.sendDigits('1234#');
-   * ```
+   * Independent from {@link errors$}: existing error consumers are not notified.
    */
-  sendDigits(dtmf: string): Promise<void>;
-  /** Observable of WebRTC-specific signaling messages. */
-  /** Observable of call-level signaling events. */
-  /** Observable of layout-changed signaling events. */
+  get warnings$(): Observable<SDKWarning>;
+  /** Platform WebRTC capabilities detected at construction time. */
+  get platformCapabilities(): PlatformCapabilities;
+  /** Observable that emits when the SDK auto-switches a device. */
+  get deviceRecovered$(): Observable<DeviceRecoveryEvent>;
   /**
-   * Accepts an inbound call, optionally overriding media options for the answer.
+   * Export a structured diagnostic bundle for support/debugging.
+   * Includes connection events, call summaries, and device changes.
+   */
+  exportDiagnostics(): SessionDiagnostics;
+  /**
+   * Initialize resilience subsystems. Non-fatal: any failure is logged and
+   * the SDK continues working without the failing subsystem.
+   */
+  private initResilienceSubsystems;
+  /**
+   * Disconnects the WebSocket and tears down the current session.
    *
-   * @param options - Optional media constraints for the answer (audio/video).
+   * Ends the session identified by the protocol and clears its persisted
+   * resume state (`authorization_state` + protocol) and attach records
+   * together — a later {@link connect} with the same credentials starts a
+   * fresh session and cannot reattach to the ended session's calls.
+   * Credentials and device preferences are preserved. To temporarily stop
+   * receiving inbound calls while keeping the session alive, use
+   * `unregister()` instead.
    *
-   * @example
-   * ```ts
-   * // Accept with defaults
-   * call.answer();
+   * The client can be reconnected by calling {@link connect} again,
+   * which creates a fresh transport and session.
+   */
+  disconnect(): Promise<void>;
+  /**
+   * Tear down the current transport / session / attach manager. Safe to call
+   * when nothing has been initialized yet (e.g. first connect()).
+   */
+  private teardownTransportAndSession;
+  private waitAuthentication;
+  /**
+   * Registers the user as online to receive inbound calls and events.
    *
-   * // Accept audio-only
-   * call.answer({ audio: true, video: false });
-   * ```
-   * @see {@link reject} to decline the call instead.
-   * @see {@link answered$} to observe the acceptance state.
+   * Waits for authentication to complete before sending the registration.
+   * If the initial attempt fails, reauthentication is attempted automatically.
+   *
+   * @throws {InvalidCredentialsError} If registration and reauthentication both fail.
    */
-  answer(options?: MediaOptions): void;
-  /** Media options provided when answering. Used internally by the VertoManager. */
-  get answerMediaOptions(): MediaOptions | undefined;
+  register(): Promise<void>;
   /**
-   * Rejects an inbound call, preventing media negotiation.
+   * Unregisters the user, going offline for inbound calls.
    *
-   * @see {@link answer} to accept the call instead.
-   * @see {@link answered$} to observe the rejection state.
+   * The WebSocket connection remains open; use {@link disconnect} to fully close it.
    */
-  reject(): void;
-  /** Observable that emits `true` when answered, `false` when rejected. */
-  get answered$(): Observable<boolean>;
+  unregister(): Promise<void>;
   /**
-   * Sets the call layout and, optionally, individual participant positions.
+   * Places an outbound call to the given destination.
    *
-   * The gateway `call.layout.set` DTO has **no** `positions` member, so when
-   * `positions` is provided this method issues a `call.member.position.set`
-   * request per member (via {@link Participant.setPosition}, which keys each
-   * position by that member's own call context) alongside `call.layout.set`
-   * (issue #19400, Flag #6).
+   * Waits for authentication before dialing. Media options are merged from
+   * saved preferences, destination query parameters (e.g. `?channel=video`),
+   * and the provided `options` (highest priority).
    *
-   * **These operations are NOT atomic.** The layout is applied first, then each
-   * member position sequentially, so members may briefly flash into their
-   * default slots before being moved to the requested positions. Targeted
-   * members are validated upfront, though: when any of them has no
-   * {@link Participant.target | member call context} yet, the whole call
-   * rejects before any request is sent and the layout is left unchanged.
+   * Returns a {@link Call} in `'ringing'` state. Subscribe to {@link Call.status$}
+   * to track progression through `'connected'` → `'disconnected'`.
    *
-   * @param layout - Layout name (must be one of {@link layouts}).
-   * @param positions - Optional map of member IDs to {@link VideoPosition} values.
-   *   When omitted or empty, only the layout is changed.
-   * @throws {InvalidParams} If the layout is not in the available {@link layouts}.
-   * @throws {ParticipantNotReadyError} If a targeted member's call context has
-   *   not been received yet — thrown before any request is sent.
+   * Local media acquisition is deliberately unbounded: an unanswered permission
+   * prompt leaves this promise pending indefinitely, so apply your own bound if
+   * your UI needs one. The 12 s signaling budget starts only once acquisition
+   * settles.
+   *
+   * @param destination - Address URI string (e.g. `'/public/my-room'`) or {@link Address} instance.
+   * @param options - Media and dial options (audio/video, device constraints). Overrides defaults.
+   * @returns The created {@link Call} instance.
+   * @throws {Error} If authentication is not complete or call creation fails.
    *
    * @example
    * ```ts
-   * await call.setLayout('grid-responsive', {
-   *   [participantId]: 'reserved-0',
+   * const call = await client.dial('/public/conference', {
+   *   audio: true,
+   *   video: true,
    * });
+   * call.status$.subscribe(status => console.log('Call:', status));
    * ```
    */
-  setLayout(layout: string, positions?: Record<string, VideoPosition>): Promise<void>;
-  /**
-   * Transfers the call to another destination.
-   *
-   * @param options - Transfer configuration including the target destination.
-   * @see {@link status$} to observe the transfer progress.
-   */
-  transfer(options: TransferOptions): Promise<void>;
+  dial(destination: string | Address, options?: DialOptions): Promise<Call>;
   /**
-   * Set the local microphone gain as a percentage applied before transmission.
-   *
-   *   - `0`   = silent
-   *   - `100` = unity (no change, default)
-   *   - `200` = 2× digital boost (max; expect clipping / noise amplification)
+   * Runs a multi-phase connectivity test against the given destination.
    *
-   * Values are clamped to [0, 200]. Engages the local audio pipeline on
-   * first use (one-time cost).
+   * The test checks:
+   *   1. **Signaling** -- WebSocket connected, RTT measurement
+   *   2. **Devices** -- getUserMedia succeeds with selected (or specified) devices
+   *   3. **ICE/TURN** -- gathers ICE candidates to verify STUN/TURN reachability
+   *   4. **Media/bandwidth** (unless `skipMediaTest`) -- dials the destination,
+   *      collects getStats() for `duration` seconds, computes bandwidth estimates
    *
-   * Note: this is a **digital** multiplier applied in a Web Audio GainNode
-   * between your mic track and the RTCRtpSender — it does not change the
-   * physical mic's hardware sensitivity. Browsers' autoGainControl can
-   * fight the setting; call {@link setAutoGainControl}(false) for
-   * predictable behaviour.
+   * @param destination - A destination to dial for the media test (e.g. `'/private/network-test'`).
+   * @param options - Preflight options (duration, skipMediaTest, device overrides).
+   * @returns A {@link PreflightResult} describing connectivity health.
    *
-   * @param value - Gain percentage (0..200; 100 = unity).
+   * @example
+   * ```ts
+   * const result = await client.preflight('/private/network-test', { duration: 5 });
+   * if (!result.ok) console.warn('Connectivity issues:', result.warnings);
+   * ```
    */
-  setLocalMicrophoneGain(value: number): void;
-  /** Observable of the current local microphone gain (0..200, where 100 = unity). */
-  get localMicrophoneGain$(): Observable<number>;
+  preflight(destination: string, options?: PreflightOptions): Promise<PreflightResult>;
+  /** The underlying client session for advanced RPC operations. */
+  get session(): ClientSessionWrapper;
+  /** Observable list of available audio input (microphone) devices. */
+  get audioInputDevices$(): Observable<MediaDeviceInfo[]>;
+  /** Current snapshot of available audio input devices. */
+  get audioInputDevices(): MediaDeviceInfo[];
+  /** Observable list of available audio output (speaker) devices. */
+  get audioOutputDevices$(): Observable<MediaDeviceInfo[]>;
+  /** Current snapshot of available audio output devices. */
+  get audioOutputDevices(): MediaDeviceInfo[];
+  /** Observable list of available video input (camera) devices. */
+  get videoInputDevices$(): Observable<MediaDeviceInfo[]>;
+  /** Current snapshot of available video input devices. */
+  get videoInputDevices(): MediaDeviceInfo[];
+  /** Observable of the currently selected audio input device. */
+  get selectedAudioInputDevice$(): Observable<MediaDeviceInfo | null>;
+  /** Observable of the currently selected audio output device. */
+  get selectedAudioOutputDevice$(): Observable<MediaDeviceInfo | null>;
+  /** Observable of the currently selected video input device. */
+  get selectedVideoInputDevice$(): Observable<MediaDeviceInfo | null>;
+  /** Currently selected audio input device, or `null` if none. */
+  get selectedAudioInputDevice(): MediaDeviceInfo | null;
+  /** Currently selected audio output device, or `null` if none. */
+  get selectedAudioOutputDevice(): MediaDeviceInfo | null;
+  /** Currently selected video input device, or `null` if none. */
+  get selectedVideoInputDevice(): MediaDeviceInfo | null;
+  /** Media track constraints for the selected audio input device. Returns `false` when disabled. */
+  get selectedAudioInputDeviceConstraints(): MediaTrackConstraints | boolean;
+  /** Media track constraints for the selected video input device. Returns `false` when disabled. */
+  get selectedVideoInputDeviceConstraints(): MediaTrackConstraints | boolean;
+  /** Converts a `MediaDeviceInfo` to track constraints suitable for `getUserMedia`. */
+  deviceInfoToConstraints(deviceInfo: MediaDeviceInfo | null): MediaTrackConstraints;
+  /** Sets the preferred audio input device. */
+  selectAudioInputDevice(device: MediaDeviceInfo | null): void;
+  /** Sets the preferred video input device. */
+  selectVideoInputDevice(device: MediaDeviceInfo | null): void;
+  /** Sets the preferred audio output device. */
+  selectAudioOutputDevice(device: MediaDeviceInfo | null): void;
   /**
-   * Observable of the RMS audio level of the local microphone, 0..1.
-   * Emits at ~30fps while a mic track is active. Engages the local audio
-   * pipeline on first subscription.
+   * Apply the currently selected audio output device to an HTMLMediaElement
+   * (e.g. the `<audio>` or `<video>` element the consumer attached the
+   * remote stream to). Uses `HTMLMediaElement.setSinkId` under the hood.
+   * Returns a `Promise<boolean>`: `true` if the sink was applied,
+   * `false` if the browser doesn't support `setSinkId` or no device is
+   * selected.
+   *
+   * @example
+   * ```ts
+   * audioEl.srcObject = call.remoteStream;
+   * await client.applySelectedAudioOutputDevice(audioEl);
+   * ```
    */
-  get localAudioLevel$(): Observable<number>;
+  applySelectedAudioOutputDevice(element: HTMLMediaElement): Promise<boolean>;
+  /** Starts monitoring for media device changes (connect/disconnect). */
+  enableDeviceMonitoring(): void;
+  /** Stops monitoring for media device changes. */
+  disableDeviceMonitoring(): void;
   /**
-   * Observable that is `true` while the local participant is speaking
-   * (RMS level above the VAD threshold, with hold time to avoid flicker).
+   * Returns the capabilities of a media device.
+   * @param deviceInfo - The device to query.
+   * @returns The device capabilities, or `null` if unavailable.
    */
-  get localSpeaking$(): Observable<boolean>;
+  getDeviceCapabilities(deviceInfo: MediaDeviceInfo): Promise<MediaTrackCapabilities | null>;
   /**
-   * Enable push-to-talk: while {@link setPushToTalkActive} has been called
-   * with `false`, the microphone gain is forced to 0; calling
-   * {@link setPushToTalkActive} with `true` restores the configured gain.
-   * Use this instead of mute/unmute for instant talk/silence transitions
-   * because it doesn't rebuild the track.
-   *
-   * This method installs the pipeline but does not attach any keyboard
-   * listener — consumers bind the key themselves and call
-   * {@link setPushToTalkActive} on keydown/keyup.
+   * Checks whether a device is still available and usable.
+   * @param deviceInfo - The device to validate, or `null`.
+   * @returns `true` if the device is valid and available. Returns `false` for `null`, audio output devices, or unavailable devices.
    */
-  enablePushToTalk(): void;
-  /** Disable push-to-talk; mic gain returns to the configured value. */
-  disablePushToTalk(): void;
+  isValidDevice(deviceInfo: MediaDeviceInfo | null): Promise<boolean>;
+  /** Injects a storage manager into the device controller for persistence. */
+  setStorageManager(storageManager: StorageManager): void;
+  /** Clears all device state and re-enumerates. */
+  clearDeviceState(): Promise<void>;
+  /** Forces a device re-enumeration. */
+  enumerateDevices(): Promise<void>;
+  /** Disables audio input (receive-only mode). No audio track will be acquired. */
+  disableAudioInput(): void;
+  /** Re-enables audio input, restoring the last selection or auto-selecting. */
+  enableAudioInput(): void;
+  /** Disables video input (receive-only mode). No video track will be acquired. */
+  disableVideoInput(): void;
+  /** Re-enables video input, restoring the last selection or auto-selecting. */
+  enableVideoInput(): void;
+  /** Observable that emits `true` when video input is disabled (receive-only). */
+  get videoInputDisabled$(): Observable<boolean>;
+  /** Observable that emits `true` when audio input is disabled (receive-only). */
+  get audioInputDisabled$(): Observable<boolean>;
+  /** Whether video input is currently disabled. */
+  get videoInputDisabled(): boolean;
+  /** Whether audio input is currently disabled. */
+  get audioInputDisabled(): boolean;
   /**
-   * While push-to-talk is enabled, sets the talk state. `true` = transmitting,
-   * `false` = silent. No-op if push-to-talk has not been enabled.
+   * Triggers the browser's media permission dialog and captures the user's device selections.
+   *
+   * @param options - Which permissions to request.
+   * @param options.audio - Whether to request audio permission.
+   * @param options.video - Whether to request video permission.
+   * @returns The permission result with selected devices.
    */
-  setPushToTalkActive(active: boolean): void;
+  requestMediaPermissions(options?: {
+    audio?: boolean;
+    video?: boolean;
+  }): Promise<PermissionResult>;
   /**
-   * Toggle echo cancellation on the local mic at runtime. Applied via
-   * `track.applyConstraints`; browsers that don't honour runtime constraints
-   * (notably iOS Safari) fall back to re-acquiring the track with the new
-   * constraint set and plumbing the replacement through the local audio
-   * pipeline if one is active.
+   * Clears all SDK-persisted state and resets to defaults.
+   *
+   * This clears device preferences, device history, authorization state,
+   * attached call IDs, and all SDK storage keys, then re-enumerates devices.
    */
-  setEchoCancellation(enabled: boolean): Promise<void>;
-  /** Toggle browser noise suppression on the local mic at runtime. */
-  setNoiseSuppression(enabled: boolean): Promise<void>;
-  /** Toggle browser automatic gain control on the local mic at runtime. */
-  setAutoGainControl(enabled: boolean): Promise<void>;
+  resetToDefaults(): Promise<void>;
   /**
-   * Observable of the aggregate remote audio level, 0..1 RMS. The server
-   * delivers a single mixed audio stream for all remote participants — this
-   * meter reports that mix. Per-participant audio is not available client-side.
+   * Destroys the client, clearing timers and releasing all resources.
    *
-   * Engages a shared AudioContext on first subscription (cheap — one
-   * AnalyserNode, no GainNode, no destination) so it does not affect the
-   * caller's audio element playback.
+   * Intentionally destroying the client ends its session: the resume state
+   * (`authorization_state` + protocol) and the attach records are both
+   * cleared. Credentials and device preferences are preserved — use
+   * {@link resetToDefaults} for a full wipe. To temporarily stop receiving
+   * inbound calls while keeping the session alive, use `unregister()`.
    */
-  get remoteAudioLevel$(): Observable<number>;
-  /** Destroys the call, releasing all resources and subscriptions. */
   destroy(): void;
-  /**
-   * @internal Send a verto.subscribe message to add an event type to the
-   * server's subscription list for this call. Returns the underlying RPC
-   * promise so callers can decide whether to cache the observable on success
-   * or retry on failure.
-   */
-  private _sendVertoSubscribe;
+}
+//#endregion
+//#region src/utils/embeddableCall.d.ts
+/** Options for {@link embeddableCall}. */
+interface EmbeddableCallOptions {
+  /** Destination URI to call. */
+  to: string;
+  /** Embed token for authentication. */
+  embedToken: string;
+  /** SignalWire host URL. */
+  host: string;
+}
+/**
+ * Creates a call using an embed token for simple, embeddable integrations.
+ *
+ * Handles client creation, authentication, and dialing in a single call.
+ *
+ * @param options - Embed token, host, and destination.
+ * @returns The created {@link Call} instance.
+ */
+declare function embeddableCall(options: EmbeddableCallOptions): Promise<Call>;
+//#endregion
+//#region src/dependencies/StaticCredentialProvider.d.ts
+/**
+ * Credential provider that returns a fixed set of credentials.
+ *
+ * Use when the token is already available (e.g. from a backend endpoint).
+ *
+ * @example
+ * ```ts
+ * const provider = new StaticCredentialProvider({ token: 'my-sat-token' });
+ * const client = new SignalWire(provider);
+ * ```
+ */
+declare class StaticCredentialProvider implements CredentialProvider {
+  private credentials;
+  constructor(credentials: SDKCredential);
+  /** Returns the static credentials. */
+  authenticate(): Promise<SDKCredential>;
+}
+//#endregion
+//#region src/dependencies/EmbedTokenCredentialProvider.d.ts
+/** Credential provider that exchanges an embed token for a SAT via the host's token endpoint. */
+declare class EmbedTokenCredentialProvider implements CredentialProvider {
+  private host;
+  private embedToken;
+  constructor(host: string, embedToken: string);
+  private fetchSAT;
+  authenticate(): Promise<{
+    token: string;
+    expiry_at: number;
+  }>;
+  refresh(): Promise<{
+    token: string;
+    expiry_at: number;
+  }>;
 }
 //#endregion
 //#region src/index.d.ts
@@ -5271,5 +5338,5 @@ declare const version: string;
  */
 declare const ready: boolean;
 //#endregion
-export { Address, type AddressHistory, type AudioConstraintsEvent, type AuthenticateContext, type Call, type CallAddress, type CallCapabilitiesState, CallCreateError, type CallDiagnosticSummary, type CallDirection, type CallError, type CallErrorKind, type NetworkIssue as CallNetworkIssue, type NetworkIssue, type NetworkMetrics as CallNetworkMetrics, type NetworkMetrics, CallNotReadyError, type CallOptions, type CallParticipant, type CallSelfParticipant, type CallState, type CallStatus, type Capability, ClientPreferences, CollectionFetchError, type ConstraintFallbackEvent, type CredentialNoRefreshHandlerWarning, type CredentialProvider, type CredentialRefreshFallbackReason, type CredentialRefreshFallbackWarning, DPoPInitError, type DebugOptions, type DeviceController, type DeviceRecoveryEvent, DeviceTokenError, type DiagnosticEvent, type DialOptions, type Directory, EmbedTokenCredentialProvider, type ExecuteMethod, InvalidCredentialsError, type JSONRPCErrorResponse, type JSONRPCRequest, type JSONRPCResponse, type JSONRPCSuccessResponse, type LayoutLayer, type LogLevel, MediaAccessError, type MediaDirection, type MediaDirections, type MediaOptions, type MediaParamsEvent, MediaTrackError, type MemberCapabilities, MessageParseError, type NodeSocketAdapter, type OnOffCapability, OverconstrainedFallbackError, Participant, ParticipantNotReadyError, type PendingRPCOptions, type PermissionResult, type PlatformCapabilities, PreflightError, type PreflightOptions, type PreflightResult, type QualityLevel, RecoveryError, type RecoveryEvent, type RecoveryState, type ResilienceCallStatus, type SATClaims, type SDKCredential, type SDKLogger, type SDKWarning, type ScreenShareStatus, type SelectDeviceOptions, SelfCapabilities, SelfParticipant, type SessionDiagnostics, type SessionState, SignalWire, type SignalWireOptions, StaticCredentialProvider, type Storage, type StoredDevicePreference, type TextMessage, TokenRefreshError, type TransferOptions, UnexpectedError, User, type UserPresence, VertoPongError, type VideoPosition, type WebRTCApiProvider, WebRTCCall, type WebRTCMediaDevices, type WebSocketAdapter, embeddableCall, getLogger, isSelfParticipant, ready, setDebugOptions, setLogLevel, setLogger, version };
+export { Address, type AddressHistory, type AudioConstraintsEvent, type AuthenticateContext, AuxiliaryLegTimeoutError, type Call, type CallAddress, type CallCapabilitiesState, CallCreateError, type CallDiagnosticSummary, type CallDirection, type CallError, type CallErrorKind, type NetworkIssue as CallNetworkIssue, type NetworkIssue, type NetworkMetrics as CallNetworkMetrics, type NetworkMetrics, CallNotReadyError, type CallOptions, type CallParticipant, type CallSelfParticipant, type CallState, type CallStatus, type Capability, ClientPreferences, CollectionFetchError, type ConstraintFallbackEvent, type CredentialNoRefreshHandlerWarning, type CredentialProvider, type CredentialRefreshFallbackReason, type CredentialRefreshFallbackWarning, DPoPInitError, type DebugOptions, type DeviceController, type DeviceRecoveryEvent, DeviceTokenError, type DiagnosticEvent, type DialOptions, type Directory, EmbedTokenCredentialProvider, type ExecuteMethod, InvalidCredentialsError, type JSONRPCErrorResponse, type JSONRPCRequest, type JSONRPCResponse, type JSONRPCSuccessResponse, type LayoutLayer, type LogLevel, MediaAccessError, type MediaDirection, type MediaDirections, type MediaOptions, type MediaParamsEvent, MediaTrackError, type MemberCapabilities, MessageParseError, type NodeSocketAdapter, type OnOffCapability, OverconstrainedFallbackError, Participant, ParticipantNotReadyError, type PendingRPCOptions, type PermissionResult, type PlatformCapabilities, PreflightError, type PreflightOptions, type PreflightResult, type QualityLevel, RecoveryError, type RecoveryEvent, type RecoveryState, type ResilienceCallStatus, type SATClaims, type SDKCredential, type SDKLogger, type SDKWarning, type ScreenShareStatus, type SelectDeviceOptions, SelfCapabilities, SelfParticipant, type SessionDiagnostics, type SessionState, SignalWire, type SignalWireOptions, StaticCredentialProvider, type Storage, type StoredDevicePreference, type TextMessage, TokenRefreshError, type TransferOptions, UnexpectedError, User, type UserPresence, VertoPongError, type VideoPosition, type WebRTCApiProvider, WebRTCCall, type WebRTCMediaDevices, type WebSocketAdapter, embeddableCall, getLogger, isSelfParticipant, ready, setDebugOptions, setLogLevel, setLogger, version };
 //# sourceMappingURL=index.d.cts.map