@stream-io/video-client 1.57.0 → 1.58.0

package/dist/index.cjs.js

@@ -87,6 +87,22 @@ const CreateDeviceRequestPushProviderEnum = {
     HUAWEI: 'huawei',
     XIAOMI: 'xiaomi',
 };
+/**
+ * @export
+ */
+const EncryptionSettingsRequestModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
+/**
+ * @export
+ */
+const EncryptionSettingsResponseModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
 /**
  * @export
  */
@@ -113,6 +129,21 @@ const FrameRecordingSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const HLSSettingsRequestQualityTracksEnum = {
+    _360P: '360p',
+    _480P: '480p',
+    _720P: '720p',
+    _1080P: '1080p',
+    _1440P: '1440p',
+    PORTRAIT_360X640: 'portrait-360x640',
+    PORTRAIT_480X854: 'portrait-480x854',
+    PORTRAIT_720X1280: 'portrait-720x1280',
+    PORTRAIT_1080X1920: 'portrait-1080x1920',
+    PORTRAIT_1440X2560: 'portrait-1440x2560',
+};
 /**
  * @export
  */
@@ -121,6 +152,17 @@ const IndividualRecordingSettingsRequestModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const IndividualRecordingSettingsRequestOutputTypesEnum = {
+    AUDIO_ONLY: 'audio_only',
+    VIDEO_ONLY: 'video_only',
+    AUDIO_VIDEO: 'audio_video',
+    SCREENSHARE_AUDIO_ONLY: 'screenshare_audio_only',
+    SCREENSHARE_VIDEO_ONLY: 'screenshare_video_only',
+    SCREENSHARE_AUDIO_VIDEO: 'screenshare_audio_video',
+};
 /**
  * @export
  */
@@ -279,6 +321,14 @@ const RecordSettingsRequestQualityEnum = {
     PORTRAIT_1080X1920: 'portrait-1080x1920',
     PORTRAIT_1440X2560: 'portrait-1440x2560',
 };
+/**
+ * @export
+ */
+const RequestPermissionRequestPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -479,6 +529,59 @@ const TranscriptionSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const TranslationSettingsLanguagesEnum = {
+    EN: 'en',
+    FR: 'fr',
+    ES: 'es',
+    DE: 'de',
+    IT: 'it',
+    NL: 'nl',
+    PT: 'pt',
+    PL: 'pl',
+    CA: 'ca',
+    CS: 'cs',
+    DA: 'da',
+    EL: 'el',
+    FI: 'fi',
+    ID: 'id',
+    JA: 'ja',
+    RU: 'ru',
+    SV: 'sv',
+    TA: 'ta',
+    TH: 'th',
+    TR: 'tr',
+    HU: 'hu',
+    RO: 'ro',
+    ZH: 'zh',
+    AR: 'ar',
+    TL: 'tl',
+    HE: 'he',
+    HI: 'hi',
+    HR: 'hr',
+    KO: 'ko',
+    MS: 'ms',
+    NO: 'no',
+    UK: 'uk',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestGrantPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestRevokePermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -495,6 +598,14 @@ const VideoSettingsResponseCameraFacingEnum = {
     BACK: 'back',
     EXTERNAL: 'external',
 };
+/**
+ * @export
+ */
+const WSAuthMessageProductsEnum = {
+    CHAT: 'chat',
+    VIDEO: 'video',
+    FEEDS: 'feeds',
+};
 
 class ErrorFromResponse extends Error {
     code;
@@ -1492,6 +1603,13 @@ class CallState$Type extends runtime.MessageType {
                 repeat: 2 /*RepeatType.UNPACKED*/,
                 T: () => Pin,
             },
+            {
+                no: 5,
+                name: 'e2ee_enabled',
+                kind: 'scalar',
+                jsonName: 'e2eeEnabled',
+                T: 8 /*ScalarType.BOOL*/,
+            },
         ]);
     }
 }
@@ -4614,6 +4732,19 @@ const isSvcCodec = (codecOrMimeType) => {
         codecOrMimeType === 'video/av1');
 };
 
+/**
+ * The default engine: a thin, stateless wrapper over the WebRTC globals.
+ */
+const defaultGlobalsEngine = {
+    dispose: () => Promise.resolve(true),
+};
+const defaultGlobalsEngineProvider = () => defaultGlobalsEngine;
+let provider = defaultGlobalsEngineProvider;
+const setCallMediaEngineProvider = (newProvider) => {
+    provider = newProvider;
+};
+const getCallMediaEngineProvider = () => provider;
+
 const sfuEventKinds = {
     subscriberOffer: undefined,
     publisherAnswer: undefined,
@@ -4821,7 +4952,9 @@ const parseUfragFromCandidate = (candidate) => {
 };
 
 const ensureExhausted = (x, message) => {
-    videoLoggerSystem.getLogger('helpers').warn(message, x);
+    if (message) {
+        videoLoggerSystem.getLogger('helpers').warn(message, x);
+    }
 };
 
 /**
@@ -4946,7 +5079,7 @@ const toIceCandidate = (iceTrickle) => {
     }
 };
 
-const version = "1.57.0";
+const version = "1.58.0";
 const [major, minor, patch] = version.split('.');
 let sdkInfo = {
     type: SdkType.PLAIN_JAVASCRIPT,
@@ -5929,6 +6062,7 @@ class CallState {
     settingsSubject = new rxjs.BehaviorSubject(undefined);
     transcribingSubject = new rxjs.BehaviorSubject(false);
     captioningSubject = new rxjs.BehaviorSubject(false);
+    e2eeEnabledSubject = new rxjs.BehaviorSubject(false);
     endedBySubject = new rxjs.BehaviorSubject(undefined);
     thumbnailsSubject = new rxjs.BehaviorSubject(undefined);
     membersSubject = new rxjs.BehaviorSubject([]);
@@ -6087,6 +6221,11 @@ class CallState {
      * Will provide the closed captioning state of this call.
      */
     captioning$;
+    /**
+     * Whether end-to-end encryption is active for this call, as reported by the
+     * SFU in the join response.
+     */
+    e2eeEnabled$;
     /**
      * Will provide the user who ended this call.
      */
@@ -6188,6 +6327,7 @@ class CallState {
         this.rawRecording$ = duc(this.rawRecordingSubject);
         this.transcribing$ = duc(this.transcribingSubject);
         this.captioning$ = duc(this.captioningSubject);
+        this.e2eeEnabled$ = duc(this.e2eeEnabledSubject);
         this.eventHandlers = {
             // these events are not updating the call state:
             'call.frame_recording_ready': undefined,
@@ -6290,6 +6430,7 @@ class CallState {
             clearTimeout(taskId);
             this.closedCaptionsTasks.delete(ccKey);
         }
+        this.removeAllOrphanedTracks();
     };
     /**
      * Sets the list of criteria that are used to sort the participants.
@@ -6639,6 +6780,12 @@ class CallState {
     get transcribing() {
         return this.getCurrentValue(this.transcribing$);
     }
+    /**
+     * Whether end-to-end encryption is active for this call.
+     */
+    get e2eeEnabled() {
+        return this.getCurrentValue(this.e2eeEnabled$);
+    }
     /**
      * Will provide the user who ended this call.
      */
@@ -6859,6 +7006,18 @@ class CallState {
     removeOrphanedTrack = (id) => {
         this.orphanedTracks = this.orphanedTracks.filter((o) => o.id !== id);
     };
+    /**
+     * Drops every orphaned track. Call this when the peer connections that own
+     * the stored receivers go away (full leave, reconnect, or migration):
+     * `pc.close()` does not raise the track `ended` event, so the per-track
+     * cleanup never fires and the receivers + their closed PCs would otherwise
+     * leak for the call's lifetime.
+     *
+     * @internal
+     */
+    removeAllOrphanedTracks = () => {
+        this.orphanedTracks = [];
+    };
     /**
      * Takes all orphaned tracks with the given track lookup prefix.
      * All orphaned tracks with the given track lookup prefix are removed from the call state.
@@ -6921,7 +7080,7 @@ class CallState {
      * @param reconnectDetails optional reconnect details.
      */
     updateFromSfuCallState = (callState, currentSessionId, reconnectDetails) => {
-        const { participants, participantCount, startedAt, pins } = callState;
+        const { participants, participantCount, startedAt, pins, e2EeEnabled } = callState;
         const localPublishedTracks = reconnectDetails?.announcedTracks.map((t) => t.trackType) ?? [];
         this.setParticipants(() => {
             const participantLookup = this.getParticipantLookupBySessionId();
@@ -6947,6 +7106,7 @@ class CallState {
         this.setAnonymousParticipantCount(participantCount?.anonymous || 0);
         this.setStartedAt(startedAt ? Timestamp.toDate(startedAt) : new Date());
         this.setServerSidePins(pins);
+        this.setCurrentValue(this.e2eeEnabledSubject, e2EeEnabled);
     };
     updateFromMemberRemoved = (event) => {
         this.updateFromCallResponse(event.call);
@@ -7144,6 +7304,37 @@ class CallState {
     };
 }
 
+/**
+ * Detection and selection policy for the two WebRTC Encoded Transform APIs.
+ * Internal: which one the SDK attaches is an RTC-layer detail. Consumers want
+ * `EncryptionManager.isSupported` instead.
+ */
+/**
+ * Chrome only, and the reason an RTCPeerConnection carrying E2EE needs the
+ * non-standard `encodedInsertableStreams` flag.
+ */
+const hasInsertableStreams = () => typeof RTCRtpSender !== 'undefined' &&
+    'createEncodedStreams' in RTCRtpSender.prototype;
+/** Whether the standard `RTCRtpScriptTransform` API exists. */
+const hasScriptTransform = () => typeof RTCRtpScriptTransform !== 'undefined';
+/**
+ * Which Encoded Transform API to attach E2EE with here.
+ *
+ * - `'insertable'`: legacy Insertable Streams. Used on Chrome, where
+ *   `RTCRtpScriptTransform` is still unreliable for E2EE.
+ * - `'script'`: the standard API. Used everywhere else.
+ * - `undefined`: neither exists, so E2EE cannot run.
+ */
+const preferredTransform = () => {
+    const insertable = hasInsertableStreams();
+    // Chrome's RTCRtpScriptTransform is still unreliable for E2EE.
+    if (isChrome() && insertable)
+        return 'insertable';
+    if (hasScriptTransform())
+        return 'script';
+    return insertable ? 'insertable' : undefined;
+};
+
 /**
  * Flatten the stats report into an array of stats objects.
  *
@@ -8252,6 +8443,7 @@ class BasePeerConnection {
     state;
     dispatcher;
     clientPublishOptions;
+    e2ee;
     tag;
     sfuClient;
     onReconnectionNeeded;
@@ -8273,13 +8465,14 @@ class BasePeerConnection {
     /**
      * Constructs a new `BasePeerConnection` instance.
      */
-    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
+    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, e2ee, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
         this.peerType = peerType;
         this.sfuClient = sfuClient;
         this.state = state;
         this.dispatcher = dispatcher;
         this.iceRestartDelay = iceRestartDelay;
         this.clientPublishOptions = clientPublishOptions;
+        this.e2ee = e2ee;
         this.tag = tag;
         this.onReconnectionNeeded = onReconnectionNeeded;
         this.onIceConnected = onIceConnected;
@@ -8298,7 +8491,13 @@ class BasePeerConnection {
         }
     }
     createPeerConnection = (connectionConfig) => {
-        const pc = new RTCPeerConnection(connectionConfig);
+        const config = { ...connectionConfig };
+        // The legacy Insertable Streams path requires this non-standard flag.
+        if (this.e2ee && hasInsertableStreams()) {
+            // @ts-expect-error not part of the standard lib yet
+            config.encodedInsertableStreams = true;
+        }
+        const pc = new RTCPeerConnection(config);
         pc.addEventListener('icecandidate', this.onIceCandidate);
         pc.addEventListener('icecandidateerror', this.onIceCandidateError);
         pc.addEventListener('iceconnectionstatechange', this.onIceConnectionStateChange);
@@ -9052,6 +9251,10 @@ class Publisher extends BasePeerConnection {
             toRTCDegradationPreference(publishOption.degradationPreference) ??
                 'maintain-framerate';
         await transceiver.sender.setParameters(params);
+        if (this.e2ee) {
+            this.e2ee.encrypt(transceiver.sender, publishOption.codec?.name.toLowerCase(), TrackType[publishOption.trackType]);
+            this.logger.debug('E2EE encryptor attached to sender');
+        }
         await this.negotiate();
     };
     /**
@@ -9663,9 +9866,15 @@ class Subscriber extends BasePeerConnection {
                 trackLookupPrefix: trackId,
                 track: primaryStream,
                 trackType,
+                receiver: this.e2ee ? e.receiver : undefined,
             });
             return;
         }
+        else if (this.e2ee) {
+            const { userId } = participantToUpdate;
+            this.e2ee.decrypt(e.receiver, userId, TrackType[trackType]);
+            this.logger.debug('E2EE decryptor attached to receiver', userId);
+        }
         const streamKindProp = trackTypeToParticipantStreamKey(trackType);
         if (!streamKindProp) {
             this.logger.error(`Unknown track type: ${rawTrackType}`);
@@ -10637,7 +10846,7 @@ const handleRemoteSoftMute = (call) => {
 /**
  * An event responder which handles the `participantJoined` event.
  */
-const watchParticipantJoined = (state) => {
+const watchParticipantJoined = (state, e2ee = undefined) => {
     return function onParticipantJoined(e) {
         const { participant } = e;
         if (!participant)
@@ -10650,7 +10859,7 @@ const watchParticipantJoined = (state) => {
         // The SFU would send participant info as part of the `join`
         // response and then follow up with a `participantJoined` event for
         // already announced participants.
-        const orphanedTracks = reconcileOrphanedTracks(state, participant);
+        const orphanedTracks = reconcileOrphanedTracks(state, participant, e2ee);
         state.updateOrAddParticipant(participant.sessionId, Object.assign(participant, orphanedTracks, {
             ...(e.isPinned && { pin: { isLocalPin: false, pinnedAt: Date.now() } }),
             viewportVisibilityState: {
@@ -10686,7 +10895,7 @@ const watchParticipantUpdated = (state) => {
  * An event responder which handles the `trackPublished` event.
  * The SFU will send this event when a participant publishes a track.
  */
-const watchTrackPublished = (state) => {
+const watchTrackPublished = (state, e2ee = undefined) => {
     return function onTrackPublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls.
@@ -10694,7 +10903,7 @@ const watchTrackPublished = (state) => {
         // events, and instead, it would only provide the participant's information
         // once they start publishing a track.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant);
         }
@@ -10709,12 +10918,12 @@ const watchTrackPublished = (state) => {
  * An event responder which handles the `trackUnpublished` event.
  * The SFU will send this event when a participant unpublishes a track.
  */
-const watchTrackUnpublished = (state) => {
+const watchTrackUnpublished = (state, e2ee = undefined) => {
     return function onTrackUnpublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls. See `watchTrackPublished`.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant, (p) => ({
                 pausedTracks: p.pausedTracks?.filter((t) => t !== type),
@@ -10733,17 +10942,22 @@ const watchTrackUnpublished = (state) => {
  *
  * @param state the call state.
  * @param participant the participant.
+ * @param e2ee accessor for the call's encryption manager, if any.
  */
-const reconcileOrphanedTracks = (state, participant) => {
+const reconcileOrphanedTracks = (state, participant, e2ee) => {
     const orphanTracks = state.takeOrphanedTracks(participant.trackLookupPrefix);
     if (!orphanTracks.length)
         return;
+    const manager = e2ee?.();
     const reconciledTracks = {};
     for (const orphan of orphanTracks) {
         const key = trackTypeToParticipantStreamKey(orphan.trackType);
         if (!key)
             continue;
         reconciledTracks[key] = orphan.track;
+        if (manager && orphan.receiver) {
+            manager.decrypt(orphan.receiver, participant.userId, TrackType[orphan.trackType]);
+        }
     }
     return reconciledTracks;
 };
@@ -10799,6 +11013,11 @@ const watchAudioLevelChanged = (dispatcher, state) => {
  */
 const registerEventHandlers = (call, dispatcher) => {
     const state = call.state;
+    // Read lazily on each event: setE2EEManager can run after setup() (an app that
+    // inspects call settings via get()/getOrCreate() before deciding to encrypt has
+    // already triggered it), so a value captured here would be a stale undefined
+    // for the whole call and orphaned tracks would never get a decryptor.
+    const e2ee = () => call.e2eeManager;
     const eventHandlers = [
         call.on('call.ended', watchCallEnded(call)),
         watchSfuCallEnded(call),
@@ -10806,11 +11025,11 @@ const registerEventHandlers = (call, dispatcher) => {
         watchSfuErrorReports(dispatcher),
         watchConnectionQualityChanged(dispatcher, state),
         watchParticipantCountChanged(dispatcher, state),
-        call.on('participantJoined', watchParticipantJoined(state)),
+        call.on('participantJoined', watchParticipantJoined(state, e2ee)),
         call.on('participantLeft', watchParticipantLeft(state)),
         call.on('participantUpdated', watchParticipantUpdated(state)),
-        call.on('trackPublished', watchTrackPublished(state)),
-        call.on('trackUnpublished', watchTrackUnpublished(state)),
+        call.on('trackPublished', watchTrackPublished(state, e2ee)),
+        call.on('trackUnpublished', watchTrackUnpublished(state, e2ee)),
         watchAudioLevelChanged(dispatcher, state),
         watchDominantSpeakerChanged(dispatcher, state),
         call.on('callGrantsUpdated', watchCallGrantsUpdated(state)),
@@ -11938,13 +12157,14 @@ class PermissionsContext {
             return false;
         const { audio, video, screensharing } = settings;
         switch (permission) {
-            case OwnCapability.SEND_AUDIO:
+            case RequestPermissionRequestPermissionsEnum.SEND_AUDIO:
                 return audio.access_request_enabled;
-            case OwnCapability.SEND_VIDEO:
+            case RequestPermissionRequestPermissionsEnum.SEND_VIDEO:
                 return video.access_request_enabled;
-            case OwnCapability.SCREENSHARE:
+            case RequestPermissionRequestPermissionsEnum.SCREENSHARE:
                 return screensharing.access_request_enabled;
             default:
+                ensureExhausted(permission);
                 return false;
         }
     };
@@ -12951,6 +13171,27 @@ class DeviceManager {
             this.filters.forEach((entry) => entry.stop?.());
         }
     }
+    reconcileOptimisticStatus = async () => {
+        const target = this.state.optimisticStatus;
+        await withCancellation(this.statusChangeConcurrencyTag, async (signal) => {
+            try {
+                if (target === 'enabled' && this.state.status !== 'enabled') {
+                    await this.unmuteStream();
+                    if (!signal.aborted)
+                        this.state.setStatus('enabled');
+                }
+                else if (target === 'disabled' && this.state.status === 'enabled') {
+                    // mirror whatever disable() does to stop/pause the track per disableMode
+                    if (!signal.aborted)
+                        this.state.setStatus('disabled');
+                }
+            }
+            finally {
+                if (!signal.aborted)
+                    this.state.setPendingStatus(this.state.status);
+            }
+        });
+    };
     disableTracks() {
         this.getTracks().forEach((track) => {
             if (track.enabled)
@@ -13584,6 +13825,33 @@ class CameraManager extends DeviceManager {
             }
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Applies the video settings to the camera.
      *
@@ -13617,9 +13885,16 @@ class CameraManager extends DeviceManager {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the camera is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
@@ -13638,7 +13913,10 @@ class CameraManager extends DeviceManager {
         }
         return constraints;
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getVideoStream(constraints, this.call.tracer);
     }
 }
@@ -13654,6 +13932,9 @@ class AudioDeviceManager extends DeviceManager {
         if (!this.call.state.settings?.audio.hifi_audio_enabled) {
             throw new Error('High Fidelity audio is not enabled for this call');
         }
+        if (isReactNative() && this.call.hasMediaEngine) {
+            throw new Error('setAudioBitrateProfile must be called before joining the call.');
+        }
         this.doSetAudioBitrateProfile(profile);
         this.state.setAudioBitrateProfile(profile);
         if (this.enabled) {
@@ -13926,7 +14207,10 @@ class MicrophoneManager extends AudioDeviceManager {
         ]), async ([callingState, ownCapabilities, deviceId, status, permissionState,]) => {
             try {
                 if (callingState === exports.CallingState.LEFT) {
-                    this.setMutedRecordingPrepared(false);
+                    // The muted-recording-prepared mode is reset in `callManager.stop()`
+                    // (during leave, while the call factory is still alive), not here —
+                    // this subscription fires asynchronously and could land after the
+                    // factory is disposed, forcing a default-ADM rebuild.
                     await this.stopSpeakingWhileMutedDetection();
                 }
                 if (callingState !== exports.CallingState.JOINED)
@@ -14026,6 +14310,33 @@ class MicrophoneManager extends AudioDeviceManager {
             this.subscriptions.push(unsubscribe);
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Enables noise cancellation for the microphone.
      *
@@ -14186,15 +14497,25 @@ class MicrophoneManager extends AudioDeviceManager {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the microphone is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
         return getAudioDevices(this.call.tracer);
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getAudioStream(constraints, this.call.tracer);
     }
     doSetAudioBitrateProfile(profile) {
@@ -14403,6 +14724,9 @@ class ScreenShareManager extends AudioDeviceManager {
         if (!this.state.audioEnabled) {
             constraints.audio = false;
         }
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         const stream = await getScreenShareStream(constraints, this.call.tracer);
         const [track] = stream.getVideoTracks();
         const { contentHint } = this.state.settings || {};
@@ -14507,10 +14831,14 @@ class SpeakerManager {
         this.devicePersistence = devicePreferences;
         this.setup();
     }
-    apply(settings) {
-        return isReactNative() ? this.applyRN(settings) : this.applyWeb();
+    async apply(settings) {
+        if (isReactNative()) {
+            this.applyRN(settings);
+            return;
+        }
+        await this.applyWeb();
     }
-    applyWeb() {
+    async applyWeb() {
         const { enabled, storageKey } = this.devicePersistence;
         if (!enabled)
             return;
@@ -14522,8 +14850,22 @@ class SpeakerManager {
         const nextDeviceId = preference.selectedDeviceId === defaultDeviceId
             ? ''
             : preference.selectedDeviceId;
-        if (this.state.selectedDevice !== nextDeviceId) {
-            this.select(nextDeviceId);
+        if (!nextDeviceId) {
+            if (this.state.selectedDevice !== nextDeviceId) {
+                this.select(nextDeviceId);
+            }
+            return;
+        }
+        const permissionState = await rxjs.firstValueFrom(getAudioBrowserPermission(this.call.tracer).asStateObservable());
+        if (permissionState !== 'granted')
+            return;
+        const devices = await rxjs.firstValueFrom(this.listDevices());
+        const device = this.findDevice(devices, nextDeviceId) ??
+            (preference.selectedDeviceLabel
+                ? devices.find((d) => d.label === preference.selectedDeviceLabel)
+                : undefined);
+        if (device && this.state.selectedDevice !== device.deviceId) {
+            this.select(device.deviceId);
         }
     }
     applyRN(settings) {
@@ -14552,6 +14894,7 @@ class SpeakerManager {
             globalThis.streamRNVideoSDK?.callManager.setup({
                 defaultDevice,
                 isRingingTypeCall: this.call.ringing,
+                cid: this.call.cid,
             });
         }
     }
@@ -14560,11 +14903,15 @@ class SpeakerManager {
             return;
         this.areSubscriptionsSetUp = true;
         if (deviceIds$ && !isReactNative()) {
-            this.subscriptions.push(createSubscription(rxjs.combineLatest([deviceIds$, this.state.selectedDevice$]), ([devices, deviceId]) => {
+            this.subscriptions.push(createSubscription(rxjs.combineLatest([
+                deviceIds$.pipe(rxjs.pairwise()),
+                this.state.selectedDevice$,
+            ]), ([[prevDevices, currentDevices], deviceId]) => {
                 if (!deviceId)
                     return;
-                const device = devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
-                if (!device)
+                const isDisconnected = this.findDevice(prevDevices, deviceId) &&
+                    !this.findDevice(currentDevices, deviceId);
+                if (isDisconnected)
                     this.select('');
             }));
         }
@@ -14611,6 +14958,7 @@ class SpeakerManager {
         this.subscriptions.forEach((unsubscribe) => unsubscribe());
         this.subscriptions = [];
         this.areSubscriptionsSetUp = false;
+        this.defaultDevice = undefined;
     };
     /**
      * Set the volume of the audio elements
@@ -14645,6 +14993,7 @@ class SpeakerManager {
             return { audioVolume: volume };
         });
     }
+    findDevice = (devices, deviceId) => devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
     persistSpeakerDevicePreference(selectedDevice) {
         const { storageKey } = this.devicePersistence;
         const devices = getCurrentValue(this.listDevices()) || [];
@@ -14727,6 +15076,7 @@ class Call {
     blockedAudioTracker;
     subscriber;
     publisher;
+    e2eeManager;
     /**
      * Flag telling whether this call is a "ringing" call.
      */
@@ -14782,6 +15132,8 @@ class Call {
     allowOwnTracksLoopback = false;
     hasJoinedOnce = false;
     deviceSettingsAppliedOnce = false;
+    callManagerStarted = false;
+    leaveGeneration = 0;
     credentials;
     initialized = false;
     acceptRejectConcurrencyTag = Symbol('acceptRejectTag');
@@ -14800,6 +15152,13 @@ class Call {
     clientCapabilities = new Set([
         ClientCapability.SUBSCRIBER_VIDEO_PAUSE,
     ]);
+    /**
+     * The in-flight per-call media engine. On web/React this resolves to a thin
+     * globals-backed engine (no provider registered); React Native registers a
+     * provider that owns a per-call native factory.
+     * @internal
+     */
+    mediaEnginePromise;
     /**
      * Constructs a new `Call` instance.
      *
@@ -15069,6 +15428,7 @@ class Call {
             if (callingState === exports.CallingState.LEFT) {
                 return;
             }
+            this.leaveGeneration += 1;
             if (callingState === exports.CallingState.JOINING) {
                 const waitUntilCallJoined = () => {
                     return new Promise((resolve) => {
@@ -15155,12 +15515,14 @@ class Call {
             this.clientStore.unregisterCall(this);
             globalThis.streamRNVideoSDK?.callManager.stop({
                 isRingingTypeCall: this.ringing,
+                shouldStopCallManager: this.callManagerStarted,
             });
             this.camera.dispose();
             this.microphone.dispose();
             this.screenShare.dispose();
             this.speaker.dispose();
             this.deviceSettingsAppliedOnce = false;
+            this.callManagerStarted = false;
             const stopOnLeavePromises = [];
             if (this.camera.stopOnLeave) {
                 stopOnLeavePromises.push(this.camera.disable(true));
@@ -15172,6 +15534,22 @@ class Call {
                 stopOnLeavePromises.push(this.screenShare.disable(true));
             }
             await Promise.all(stopOnLeavePromises);
+            // Dispose the per-call media engine last — after peer connections and
+            // local tracks are gone — so the backing factory tears down with no
+            // owned PCs/tracks. A fresh `join()` builds a new engine.
+            if (this.mediaEnginePromise) {
+                const enginePromise = this.mediaEnginePromise;
+                this.mediaEnginePromise = undefined;
+                this.logger.debug('Disposing per-call media factory');
+                await enginePromise
+                    .then((engine) => {
+                    globalThis.streamRNVideoSDK?.callingX?.unwireAudioEngineSubscription();
+                    return engine.dispose();
+                })
+                    .catch((err) => {
+                    this.logger.warn('Failed to dispose media engine', err);
+                });
+            }
         });
     };
     /**
@@ -15272,11 +15650,7 @@ class Call {
             this.clientStore.registerOrUpdateCall(this);
         }
         // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? params?.ring === true
-                ? true
-                : this.ringing
-            : false;
+        const skipSpeakerApply = isReactNative();
         await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
         return response;
     };
@@ -15299,11 +15673,7 @@ class Call {
             this.clientStore.registerOrUpdateCall(this);
         }
         // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? data?.ring === true
-                ? true
-                : this.ringing
-            : false;
+        const skipSpeakerApply = isReactNative();
         await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
         return response;
     };
@@ -15452,9 +15822,20 @@ class Call {
     doJoin = async (data) => {
         const connectStartTime = Date.now();
         const callingState = this.state.callingState;
+        const joinLeaveGeneration = this.leaveGeneration;
+        const supersededByLeave = () => this.leaveGeneration !== joinLeaveGeneration;
         this.joinCallData = data;
         this.logger.debug('Starting join flow');
         this.state.setCallingState(exports.CallingState.JOINING);
+        // Ensure the per-call media engine exists before any peer connection
+        // (codec probe, subscriber, publisher) or capture happens, so the WebRTC
+        // globals resolve to the call's factory. Idempotent across
+        // reconnect/migration attempts.
+        await this.ensureMediaFactory();
+        const callingX = globalThis.streamRNVideoSDK?.callingX;
+        if (callingX) {
+            callingX.wireAudioEngineSubscription();
+        }
         const performingMigration = this.reconnectStrategy === WebsocketReconnectStrategy.MIGRATE;
         const performingRejoin = this.reconnectStrategy === WebsocketReconnectStrategy.REJOIN;
         const performingFastReconnect = this.reconnectStrategy === WebsocketReconnectStrategy.FAST;
@@ -15509,6 +15890,11 @@ class Call {
             // these are throw-away SDPs that the SFU will use to determine
             // the capabilities of the client (codec support, etc.)
             const { dangerouslyForceCodec, fmtpLine, subscriberFmtpLine } = this.clientPublishOptions || {};
+            // skip if a leave superseded this join so codec detection doesn't resolve to a default factory.
+            if (supersededByLeave()) {
+                this.logger.debug('Join superseded by leave; skipping codec detection');
+                return;
+            }
             const [subscriberSdp, publisherSdp] = await Promise.all([
                 getGenericSdp('recvonly', dangerouslyForceCodec, subscriberFmtpLine),
                 getGenericSdp('sendonly', dangerouslyForceCodec, fmtpLine),
@@ -15552,6 +15938,12 @@ class Call {
                 throw error;
             }
         }
+        // If the user left while this join was in flight, bail before re-setting JOINED and before
+        // peer-connection setup below (both run synchronously after this, so one check covers them).
+        if (supersededByLeave()) {
+            this.logger.debug('Join superseded by leave; aborting join flow');
+            return;
+        }
         if (!performingMigration) {
             // in MIGRATION, `JOINED` state is set in `this.reconnectMigrate()`
             this.state.setCallingState(exports.CallingState.JOINED);
@@ -15589,12 +15981,18 @@ class Call {
         }
         // device settings should be applied only once, we don't have to
         // re-apply them on later reconnections or server-side data fetches
-        if (!this.deviceSettingsAppliedOnce && this.state.settings) {
+        if (!this.deviceSettingsAppliedOnce &&
+            this.state.settings &&
+            !supersededByLeave()) {
             await this.applyDeviceConfig(this.state.settings, true, false);
+            this.deviceSettingsAppliedOnce = true;
+        }
+        if (!this.callManagerStarted && !supersededByLeave()) {
             globalThis.streamRNVideoSDK?.callManager.start({
                 isRingingTypeCall: this.ringing,
+                cid: this.cid,
             });
-            this.deviceSettingsAppliedOnce = true;
+            this.callManagerStarted = true;
         }
         // We shouldn't persist the `ring` and `notify` state after joining the call
         // as it's a one-time event and clashes with the potential reconnection attempts.
@@ -15721,6 +16119,7 @@ class Call {
         this.sfuStatsReporter = undefined;
         if (closePreviousInstances && this.subscriber) {
             await this.subscriber.dispose();
+            this.state.removeAllOrphanedTracks();
         }
         const basePeerConnectionOptions = {
             sfuClient,
@@ -15731,6 +16130,7 @@ class Call {
             enableTracing,
             statsTimestampDriftThresholdMs: reportingIntervalMs / 2,
             clientPublishOptions: this.clientPublishOptions,
+            e2ee: this.e2eeManager,
             onReconnectionNeeded: (kind, reason, peerType) => {
                 this.reconnect(kind, reason).catch((err) => {
                     const message = `[Reconnect] Error reconnecting, after a ${PeerType[peerType]} error: ${reason}`;
@@ -15796,12 +16196,12 @@ class Call {
      * Retrieves credentials for joining the call.
      *
      * @internal
-     *
      * @param data the join call data.
      */
     doJoinRequest = async (data) => {
         const location = await this.streamClient.getLocationHint();
-        const request = { ...data, location };
+        const e2ee = !!this.e2eeManager;
+        const request = { ...data, location, e2ee };
         const joinResponse = await this.streamClient.post(`${this.streamClientBasePath}/join`, request);
         this.state.updateFromCallResponse(joinResponse.call);
         this.state.setMembers(joinResponse.members);
@@ -15820,6 +16220,36 @@ class Call {
         }
         return joinResponse;
     };
+    /**
+     * Whether the per-call media engine currently exists. True from join until leave.
+     *
+     * @internal an internal getter and should not be used outside the SDK.
+     */
+    get hasMediaEngine() {
+        return !!this.mediaEnginePromise;
+    }
+    /**
+     * Ensures a {@link CallMediaEngine} exists for this call's media session and
+     * returns it. Idempotent: the engine is created once via the registered
+     * provider (see `setCallMediaEngineProvider`) and cached until `leave()`
+     * disposes it. Concurrent callers (e.g. camera + microphone enabling in
+     * parallel) share the same engine because the in-flight creation promise is
+     * cached, never the unresolved result.
+     *
+     * @internal
+     */
+    ensureMediaFactory = async () => {
+        if (!this.mediaEnginePromise) {
+            const provider = getCallMediaEngineProvider();
+            this.logger.debug(`Requesting per-call media factory creation`);
+            this.mediaEnginePromise = Promise.resolve(provider()).catch((err) => {
+                // Drop the cached rejection so a retried join() can rebuild the engine
+                this.mediaEnginePromise = undefined;
+                throw err;
+            });
+        }
+        return this.mediaEnginePromise;
+    };
     /**
      * Handles the closing of the SFU signal connection.
      *
@@ -16381,6 +16811,30 @@ class Call {
         this.tracer.trace('updatePublishOptions', options);
         this.clientPublishOptions = { ...this.clientPublishOptions, ...options };
     };
+    /**
+     * Set the E2EE (end-to-end encryption) manager for this call.
+     *
+     * Must be called before {@link join} so the RTCPeerConnection can be
+     * configured for E2EE.
+     *
+     * The manager is kept across {@link leave} so a rejoin of this same instance
+     * stays encrypted: do not dispose it while this call may be joined again.
+     * A disposed manager throws from `encrypt`/`decrypt` rather than silently
+     * publishing nothing, so re-attach a fresh one instead of reusing it.
+     *
+     * @param e2ee - Any `E2EEManager`. Use `EncryptionManager.create()` for the
+     *         built-in AES-GCM scheme, or pass your own implementation.
+     * @throws if called after the peer connections have been built (i.e. after
+     *         `join`): those PCs were already configured without an encryptor, so
+     *         adopting a manager now would silently publish/receive cleartext for
+     *         the live session.
+     */
+    setE2EEManager = (e2ee) => {
+        if (this.publisher || this.subscriber) {
+            throw new Error('setE2EEManager must be called before join()');
+        }
+        this.e2eeManager = e2ee;
+    };
     /**
      * Notifies the SFU that a noise cancellation process has started.
      *
@@ -17017,7 +17471,9 @@ class Call {
      */
     applyDeviceConfig = async (settings, publish, skipSpeakerApply) => {
         if (!skipSpeakerApply) {
-            this.speaker.apply(settings);
+            await this.speaker.apply(settings).catch((err) => {
+                this.logger.warn('Speaker init failed', err);
+            });
         }
         await this.camera.apply(settings.video, publish).catch((err) => {
             this.logger.warn('Camera init failed', err);
@@ -17696,15 +18152,17 @@ class StableWSConnection {
             this.client.logger.error(`Token not set, can't connect authenticate`);
             return;
         }
-        const authMessage = JSON.stringify({
+        const wsAuthMessage = {
             token,
+            products: [WSAuthMessageProductsEnum.VIDEO],
             user_details: {
                 id: user.id,
                 name: user.name,
                 image: user.image,
                 custom: user.custom,
             },
-        });
+        };
+        const authMessage = JSON.stringify(wsAuthMessage);
         this._log(`onopen() - Sending auth message ${authMessage}`, {}, 'trace');
         this.ws?.send(authMessage);
         this._log('onopen() - onopen callback', { wsID });
@@ -18530,11 +18988,11 @@ class StreamClient {
         return await this.wsConnection.connect(this.defaultWSTimeout);
     };
     getSdkVersion = () => this.options.clientAppIdentifier?.sdkVersion ||
-        "1.57.0";
+        "1.58.0";
     getUserAgent = () => {
         if (!this.cachedUserAgent) {
             const { clientAppIdentifier = {} } = this.options;
-            const { sdkName = 'js', sdkVersion = "1.57.0", ...extras } = clientAppIdentifier;
+            const { sdkName = 'js', sdkVersion = "1.58.0", ...extras } = clientAppIdentifier;
             this.cachedUserAgent = [
                 `stream-video-${sdkName}-v${sdkVersion}`,
                 ...Object.entries(extras).map(([key, value]) => `${key}=${value}`),
@@ -19767,6 +20225,357 @@ const humanize = (n) => {
     return String(n);
 };
 
+/**
+ * Tiny, type-safe event emitter.
+ *
+ * Usage styles:
+ * - compose: `private readonly events = new TypedEventEmitter<MyMap>()`
+ * - extend:  `class Foo extends TypedEventEmitter<MyMap> {}`
+ *
+ * Listener exceptions (sync throw or rejected promise) are caught and logged,
+ * so one bad listener cannot break dispatch for the rest.
+ */
+class TypedEventEmitter {
+    logger;
+    byEvent = new Map();
+    constructor(logger = 'TypedEventEmitter') {
+        this.logger =
+            typeof logger === 'string' ? videoLoggerSystem.getLogger(logger) : logger;
+    }
+    on = (event, fn) => {
+        let listeners = this.byEvent.get(event);
+        if (!listeners) {
+            listeners = new Set();
+            this.byEvent.set(event, listeners);
+        }
+        listeners.add(fn);
+        return () => this.off(event, fn);
+    };
+    off = (event, fn) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners)
+            return;
+        listeners.delete(fn);
+        if (listeners.size === 0)
+            this.byEvent.delete(event);
+    };
+    emit = (event, payload) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners || listeners.size === 0)
+            return;
+        for (const listener of [...listeners]) {
+            this.invoke(() => listener(payload), event);
+        }
+    };
+    removeAllListeners = (event) => {
+        if (event === undefined) {
+            this.byEvent.clear();
+        }
+        else {
+            this.byEvent.delete(event);
+        }
+    };
+    invoke = (run, event) => {
+        try {
+            const result = run();
+            if (result && typeof result.then === 'function') {
+                result.catch((err) => {
+                    this.logger.warn(`Listener for '${String(event)}' rejected`, err);
+                });
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Listener for '${String(event)}' threw`, err);
+        }
+    };
+}
+
+/**
+ * Distributes keys to the E2EE Web Worker and attaches encrypt/decrypt
+ * transforms to RTCRtpSenders and RTCRtpReceivers.
+ */
+class EncryptionManager extends TypedEventEmitter {
+    algorithm;
+    transform;
+    disposed = false;
+    piped;
+    userId;
+    worker;
+    workerUrl;
+    constructor(userId, worker, workerUrl, algorithm, transform) {
+        super('EncryptionManager');
+        this.userId = userId;
+        this.worker = worker;
+        this.workerUrl = workerUrl;
+        this.algorithm = algorithm;
+        this.transform = transform;
+        this.worker.addEventListener('message', this.handleWorkerMessage);
+        this.worker.addEventListener('error', this.handleWorkerError);
+    }
+    /**
+     * Whether this browser has WebRTC Encoded Transforms, which E2EE requires.
+     * Use it to guard UI, or to avoid calling {@link create} where it would throw.
+     */
+    static isSupported = () => {
+        return preferredTransform() !== undefined;
+    };
+    /**
+     * Create an EncryptionManager instance and initialize the E2EE Web Worker.
+     *
+     * @param userId - The local user's ID, normally `call.currentUserId`.
+     * @param options - the create options.
+     * @throws {Error} If the browser lacks Encoded Transforms.
+     *
+     * @example
+     * ```ts
+     * if (EncryptionManager.isSupported()) {
+     *   const e2ee = await EncryptionManager.create(call.currentUserId);
+     *   call.setE2EEManager(e2ee);
+     *   e2ee.setSharedKey(0, keyBytes);
+     * }
+     */
+    static create = async (userId, options) => {
+        const transform = preferredTransform();
+        if (!transform) {
+            throw new Error(`E2EE is not supported in this browser`);
+        }
+        const { e2eeWorker } = await Promise.resolve().then(function () { return e2eeWorker$1; });
+        const blob = new Blob([`(${e2eeWorker.toString()})()`], {
+            type: 'application/javascript',
+        });
+        const url = URL.createObjectURL(blob);
+        let worker;
+        try {
+            worker = new Worker(url, { name: 'stream-video-e2ee' });
+        }
+        catch (err) {
+            // e.g. a CSP `worker-src` without `blob:`. Don't leak the object URL.
+            URL.revokeObjectURL(url);
+            throw err;
+        }
+        const algorithm = options?.algorithm ?? 'AES-128-GCM';
+        return new EncryptionManager(userId, worker, url, algorithm, transform);
+    };
+    /**
+     * {@link dispose} terminates the worker, so `postMessage` becomes a silent
+     * no-op and an attached transform points at a dead worker: frames would stall
+     * forever with no error and no event. Throwing is also fail-closed, since a
+     * caller that swallows it still publishes nothing rather than cleartext.
+     */
+    assertUsable = () => {
+        if (this.disposed)
+            throw new Error(`EncryptionManager is disposed`);
+    };
+    /**
+     * Terminate the worker and release all resources.
+     *
+     * The manager is unusable afterwards and every other method throws. Call
+     * {@link create} for a new one. Safe to call more than once.
+     */
+    dispose = () => {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        this.piped = undefined;
+        this.worker.removeEventListener('message', this.handleWorkerMessage);
+        this.worker.removeEventListener('error', this.handleWorkerError);
+        this.worker.terminate();
+        URL.revokeObjectURL(this.workerUrl);
+        this.removeAllListeners();
+    };
+    /**
+     * Set a per-user AES-GCM encryption key in the worker's key store.
+     *
+     * Use it when each participant has their own key from a central authority.
+     * The receiver picks the right one by the `keyIndex` in the frame trailer.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - Increases with each rotation.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setKey = (userId, keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_key', userId, keyIndex, rawKey });
+    };
+    /**
+     * Fallback key for any user without a per-user key. The simplest E2EE mode:
+     * one key for everyone, usually passphrase-derived, no distribution needed.
+     * Setting an epoch makes it active for encryption while older epochs remain
+     * available to decrypt in-flight frames until {@link removeSharedKey}.
+     *
+     * @param keyIndex - An integer 0-255, since one trailer byte carries it.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setSharedKey = (keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_shared_key', keyIndex, rawKey });
+    };
+    /**
+     * Remove one shared-key epoch from the worker's receive key ring.
+     *
+     * If this is the active epoch, shared-key encryption stops until
+     * {@link setSharedKey} succeeds again. An older epoch is not reactivated.
+     *
+     * @param keyIndex - The exact shared-key epoch to remove.
+     */
+    removeSharedKey = (keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_shared_key', keyIndex });
+    };
+    /**
+     * Retire one of a user's key epochs, leaving their other epochs usable.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - The exact epoch to remove. Absent epochs are a no-op.
+     */
+    removeKey = (userId, keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_key', userId, keyIndex });
+    };
+    /**
+     * Drop every key a user holds, revoking their ability to decrypt later
+     * frames. Call it when a participant leaves.
+     *
+     * To retire one rotated epoch instead, use {@link removeKey}.
+     */
+    removeAllKeys = (userId) => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.remove_all_keys', userId });
+    };
+    /**
+     * Called by the Publisher when it adds a transceiver.
+     *
+     * @param sender - The sender to encrypt.
+     * @param codec - Codec name, e.g. 'vp8', selecting the clear-byte rules.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    encrypt = (sender, codec, trackType) => {
+        this.assertUsable();
+        this.pipe(sender, {
+            operation: 'encode',
+            userId: this.userId,
+            codec,
+            trackType,
+        });
+    };
+    /**
+     * Called by the Subscriber when a remote track arrives.
+     *
+     * @param receiver - The receiver to decrypt.
+     * @param userId - The remote user, for key lookup in the worker.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    decrypt = (receiver, userId, trackType) => {
+        this.assertUsable();
+        this.pipe(receiver, { operation: 'decode', userId, trackType });
+    };
+    /** Pipe through the worker's transform, tracking targets to avoid double-piping. */
+    pipe = (target, options) => {
+        if (this.transform === 'script') {
+            target.transform = new RTCRtpScriptTransform(this.worker, options);
+            return;
+        }
+        if ((this.piped ??= new WeakSet()).has(target))
+            return;
+        this.piped.add(target);
+        // @ts-expect-error createEncodedStreams is not in the standard typedefs
+        const { readable, writable } = target.createEncodedStreams();
+        this.worker.postMessage({ type: 'cmd.setup_transform', ...options, readable, writable }, [readable, writable]);
+    };
+    /**
+     * Toggle periodic performance reporting from the E2EE worker.
+     *
+     * While on, the worker emits `e2ee.perf_report` once per second with per-track
+     * FPS and crypto timings. Useful for debugging throughput.
+     */
+    enablePerformanceReporting = (enabled) => {
+        this.assertUsable();
+        this.worker.postMessage({
+            type: 'cmd.enable_performance_reporting',
+            enabled,
+        });
+    };
+    /**
+     * Request a snapshot of the worker's keys. It arrives later as the
+     * `e2ee.key_state` event, listing fingerprints only, never key material.
+     */
+    requestKeyState = () => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.request_key_state' });
+    };
+    handleWorkerMessage = (e) => {
+        const { type, ...payload } = e.data ?? {};
+        if (type === 'e2ee.error') {
+            this.logger.error(e.data.message);
+            return;
+        }
+        const event = type;
+        this.logger.debug('Dispatching', event, payload);
+        this.emit(event, payload);
+    };
+    handleWorkerError = (e) => {
+        this.logger.error('Unhandled worker error:', e.message);
+    };
+    validateKeyLength = (rawKey) => {
+        const is256 = this.algorithm === 'AES-256-GCM';
+        const expected = is256 ? 32 : 16;
+        if (rawKey.byteLength !== expected) {
+            throw new Error(`Key must be exactly ${expected} bytes (${is256 ? 'AES-256' : 'AES-128'})`);
+        }
+    };
+    /**
+     * One trailer byte carries the keyIndex. A larger value would truncate to
+     * `keyIndex & 0xFF`, so the receiver would look up the wrong key and fail
+     * every decrypt. Reject it rather than ship a silently broken key epoch.
+     */
+    validateKeyIndex = (keyIndex) => {
+        if (!Number.isInteger(keyIndex) || keyIndex < 0 || keyIndex > 255) {
+            throw new Error(`keyIndex must be an integer between 0 and 255, got ${keyIndex}`);
+        }
+    };
+}
+
+/**
+ * E2EE worker. The build populates it.
+ *
+ * The actual implementation lives in `e2ee-worker/e2ee-worker-impl.ts` and its
+ * sibling modules (`constants.ts`, `codec.ts`, `crypto.ts`, `utils.ts`,
+ * `types.ts`), all written as real TypeScript with full type checking
+ * and import support.
+ *
+ * ## How it works
+ *
+ * 1. You edit files in `e2ee-worker/` as normal TypeScript
+ * 2. `yarn build` runs Rollup, which invokes `rollup-plugin-inline-worker`
+ * 3. The plugin bundles `e2ee-worker/e2ee-worker-impl.ts` (and its imports)
+ *    into a single function via a nested Rollup + TypeScript build
+ * 4. The function replaces this file's export at build time
+ * 5. `EncryptionManager.create()` creates a Worker from `e2eeWorker.toString()`
+ *
+ * In tests, this module is mocked (see `__tests__/EncryptionManager.test.ts`),
+ * so the placeholder is never evaluated.
+ *
+ * @see e2ee-worker/e2ee-worker-impl.ts - the entry point
+ * @see ../../plugins/rollup-plugin-inline-worker.ts - the Rollup plugin
+ * @see EncryptionManager.ts - consumes e2eeWorker
+ */
+function e2eeWorker() {
+    // will be populated at build time
+}
+
+var e2eeWorker$1 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    e2eeWorker: e2eeWorker
+});
+
 Object.defineProperty(exports, "AxiosError", {
     enumerable: true,
     get: function () { return axios.AxiosError; }
@@ -19792,11 +20601,16 @@ exports.CreateDeviceRequestPushProviderEnum = CreateDeviceRequestPushProviderEnu
 exports.DeviceManager = DeviceManager;
 exports.DeviceManagerState = DeviceManagerState;
 exports.DynascaleManager = DynascaleManager;
+exports.EncryptionManager = EncryptionManager;
+exports.EncryptionSettingsRequestModeEnum = EncryptionSettingsRequestModeEnum;
+exports.EncryptionSettingsResponseModeEnum = EncryptionSettingsResponseModeEnum;
 exports.ErrorFromResponse = ErrorFromResponse;
 exports.FrameRecordingSettingsRequestModeEnum = FrameRecordingSettingsRequestModeEnum;
 exports.FrameRecordingSettingsRequestQualityEnum = FrameRecordingSettingsRequestQualityEnum;
 exports.FrameRecordingSettingsResponseModeEnum = FrameRecordingSettingsResponseModeEnum;
+exports.HLSSettingsRequestQualityTracksEnum = HLSSettingsRequestQualityTracksEnum;
 exports.IndividualRecordingSettingsRequestModeEnum = IndividualRecordingSettingsRequestModeEnum;
+exports.IndividualRecordingSettingsRequestOutputTypesEnum = IndividualRecordingSettingsRequestOutputTypesEnum;
 exports.IndividualRecordingSettingsResponseModeEnum = IndividualRecordingSettingsResponseModeEnum;
 exports.IngressAudioEncodingOptionsRequestChannelsEnum = IngressAudioEncodingOptionsRequestChannelsEnum;
 exports.IngressSourceRequestFpsEnum = IngressSourceRequestFpsEnum;
@@ -19812,6 +20626,7 @@ exports.RawRecordingSettingsRequestModeEnum = RawRecordingSettingsRequestModeEnu
 exports.RawRecordingSettingsResponseModeEnum = RawRecordingSettingsResponseModeEnum;
 exports.RecordSettingsRequestModeEnum = RecordSettingsRequestModeEnum;
 exports.RecordSettingsRequestQualityEnum = RecordSettingsRequestQualityEnum;
+exports.RequestPermissionRequestPermissionsEnum = RequestPermissionRequestPermissionsEnum;
 exports.RxUtils = rxUtils;
 exports.ScreenShareManager = ScreenShareManager;
 exports.ScreenShareState = ScreenShareState;
@@ -19833,9 +20648,13 @@ exports.TranscriptionSettingsRequestModeEnum = TranscriptionSettingsRequestModeE
 exports.TranscriptionSettingsResponseClosedCaptionModeEnum = TranscriptionSettingsResponseClosedCaptionModeEnum;
 exports.TranscriptionSettingsResponseLanguageEnum = TranscriptionSettingsResponseLanguageEnum;
 exports.TranscriptionSettingsResponseModeEnum = TranscriptionSettingsResponseModeEnum;
+exports.TranslationSettingsLanguagesEnum = TranslationSettingsLanguagesEnum;
+exports.UpdateUserPermissionsRequestGrantPermissionsEnum = UpdateUserPermissionsRequestGrantPermissionsEnum;
+exports.UpdateUserPermissionsRequestRevokePermissionsEnum = UpdateUserPermissionsRequestRevokePermissionsEnum;
 exports.VideoSettingsRequestCameraFacingEnum = VideoSettingsRequestCameraFacingEnum;
 exports.VideoSettingsResponseCameraFacingEnum = VideoSettingsResponseCameraFacingEnum;
 exports.ViewportTracker = ViewportTracker;
+exports.WSAuthMessageProductsEnum = WSAuthMessageProductsEnum;
 exports.checkIfAudioOutputChangeSupported = checkIfAudioOutputChangeSupported;
 exports.combineComparators = combineComparators;
 exports.conditional = conditional;
@@ -19849,6 +20668,7 @@ exports.getAudioBrowserPermission = getAudioBrowserPermission;
 exports.getAudioDevices = getAudioDevices;
 exports.getAudioOutputDevices = getAudioOutputDevices;
 exports.getAudioStream = getAudioStream;
+exports.getCallMediaEngineProvider = getCallMediaEngineProvider;
 exports.getClientDetails = getClientDetails;
 exports.getDeviceState = getDeviceState;
 exports.getScreenShareStream = getScreenShareStream;
@@ -19877,6 +20697,7 @@ exports.reactionType = reactionType;
 exports.resolveDeviceId = resolveDeviceId;
 exports.role = role;
 exports.screenSharing = screenSharing;
+exports.setCallMediaEngineProvider = setCallMediaEngineProvider;
 exports.setDeviceInfo = setDeviceInfo;
 exports.setOSInfo = setOSInfo;
 exports.setPowerState = setPowerState;