@stream-io/video-client 1.57.0 → 1.58.0

package/dist/index.es.js

@@ -68,6 +68,22 @@ const CreateDeviceRequestPushProviderEnum = {
     HUAWEI: 'huawei',
     XIAOMI: 'xiaomi',
 };
+/**
+ * @export
+ */
+const EncryptionSettingsRequestModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
+/**
+ * @export
+ */
+const EncryptionSettingsResponseModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
 /**
  * @export
  */
@@ -94,6 +110,21 @@ const FrameRecordingSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const HLSSettingsRequestQualityTracksEnum = {
+    _360P: '360p',
+    _480P: '480p',
+    _720P: '720p',
+    _1080P: '1080p',
+    _1440P: '1440p',
+    PORTRAIT_360X640: 'portrait-360x640',
+    PORTRAIT_480X854: 'portrait-480x854',
+    PORTRAIT_720X1280: 'portrait-720x1280',
+    PORTRAIT_1080X1920: 'portrait-1080x1920',
+    PORTRAIT_1440X2560: 'portrait-1440x2560',
+};
 /**
  * @export
  */
@@ -102,6 +133,17 @@ const IndividualRecordingSettingsRequestModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const IndividualRecordingSettingsRequestOutputTypesEnum = {
+    AUDIO_ONLY: 'audio_only',
+    VIDEO_ONLY: 'video_only',
+    AUDIO_VIDEO: 'audio_video',
+    SCREENSHARE_AUDIO_ONLY: 'screenshare_audio_only',
+    SCREENSHARE_VIDEO_ONLY: 'screenshare_video_only',
+    SCREENSHARE_AUDIO_VIDEO: 'screenshare_audio_video',
+};
 /**
  * @export
  */
@@ -260,6 +302,14 @@ const RecordSettingsRequestQualityEnum = {
     PORTRAIT_1080X1920: 'portrait-1080x1920',
     PORTRAIT_1440X2560: 'portrait-1440x2560',
 };
+/**
+ * @export
+ */
+const RequestPermissionRequestPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -460,6 +510,59 @@ const TranscriptionSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const TranslationSettingsLanguagesEnum = {
+    EN: 'en',
+    FR: 'fr',
+    ES: 'es',
+    DE: 'de',
+    IT: 'it',
+    NL: 'nl',
+    PT: 'pt',
+    PL: 'pl',
+    CA: 'ca',
+    CS: 'cs',
+    DA: 'da',
+    EL: 'el',
+    FI: 'fi',
+    ID: 'id',
+    JA: 'ja',
+    RU: 'ru',
+    SV: 'sv',
+    TA: 'ta',
+    TH: 'th',
+    TR: 'tr',
+    HU: 'hu',
+    RO: 'ro',
+    ZH: 'zh',
+    AR: 'ar',
+    TL: 'tl',
+    HE: 'he',
+    HI: 'hi',
+    HR: 'hr',
+    KO: 'ko',
+    MS: 'ms',
+    NO: 'no',
+    UK: 'uk',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestGrantPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestRevokePermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -476,6 +579,14 @@ const VideoSettingsResponseCameraFacingEnum = {
     BACK: 'back',
     EXTERNAL: 'external',
 };
+/**
+ * @export
+ */
+const WSAuthMessageProductsEnum = {
+    CHAT: 'chat',
+    VIDEO: 'video',
+    FEEDS: 'feeds',
+};
 
 class ErrorFromResponse extends Error {
     code;
@@ -1473,6 +1584,13 @@ class CallState$Type extends MessageType {
                 repeat: 2 /*RepeatType.UNPACKED*/,
                 T: () => Pin,
             },
+            {
+                no: 5,
+                name: 'e2ee_enabled',
+                kind: 'scalar',
+                jsonName: 'e2eeEnabled',
+                T: 8 /*ScalarType.BOOL*/,
+            },
         ]);
     }
 }
@@ -4595,6 +4713,19 @@ const isSvcCodec = (codecOrMimeType) => {
         codecOrMimeType === 'video/av1');
 };
 
+/**
+ * The default engine: a thin, stateless wrapper over the WebRTC globals.
+ */
+const defaultGlobalsEngine = {
+    dispose: () => Promise.resolve(true),
+};
+const defaultGlobalsEngineProvider = () => defaultGlobalsEngine;
+let provider = defaultGlobalsEngineProvider;
+const setCallMediaEngineProvider = (newProvider) => {
+    provider = newProvider;
+};
+const getCallMediaEngineProvider = () => provider;
+
 const sfuEventKinds = {
     subscriberOffer: undefined,
     publisherAnswer: undefined,
@@ -4802,7 +4933,9 @@ const parseUfragFromCandidate = (candidate) => {
 };
 
 const ensureExhausted = (x, message) => {
-    videoLoggerSystem.getLogger('helpers').warn(message, x);
+    if (message) {
+        videoLoggerSystem.getLogger('helpers').warn(message, x);
+    }
 };
 
 /**
@@ -4927,7 +5060,7 @@ const toIceCandidate = (iceTrickle) => {
     }
 };
 
-const version = "1.57.0";
+const version = "1.58.0";
 const [major, minor, patch] = version.split('.');
 let sdkInfo = {
     type: SdkType.PLAIN_JAVASCRIPT,
@@ -5910,6 +6043,7 @@ class CallState {
     settingsSubject = new BehaviorSubject(undefined);
     transcribingSubject = new BehaviorSubject(false);
     captioningSubject = new BehaviorSubject(false);
+    e2eeEnabledSubject = new BehaviorSubject(false);
     endedBySubject = new BehaviorSubject(undefined);
     thumbnailsSubject = new BehaviorSubject(undefined);
     membersSubject = new BehaviorSubject([]);
@@ -6068,6 +6202,11 @@ class CallState {
      * Will provide the closed captioning state of this call.
      */
     captioning$;
+    /**
+     * Whether end-to-end encryption is active for this call, as reported by the
+     * SFU in the join response.
+     */
+    e2eeEnabled$;
     /**
      * Will provide the user who ended this call.
      */
@@ -6169,6 +6308,7 @@ class CallState {
         this.rawRecording$ = duc(this.rawRecordingSubject);
         this.transcribing$ = duc(this.transcribingSubject);
         this.captioning$ = duc(this.captioningSubject);
+        this.e2eeEnabled$ = duc(this.e2eeEnabledSubject);
         this.eventHandlers = {
             // these events are not updating the call state:
             'call.frame_recording_ready': undefined,
@@ -6271,6 +6411,7 @@ class CallState {
             clearTimeout(taskId);
             this.closedCaptionsTasks.delete(ccKey);
         }
+        this.removeAllOrphanedTracks();
     };
     /**
      * Sets the list of criteria that are used to sort the participants.
@@ -6620,6 +6761,12 @@ class CallState {
     get transcribing() {
         return this.getCurrentValue(this.transcribing$);
     }
+    /**
+     * Whether end-to-end encryption is active for this call.
+     */
+    get e2eeEnabled() {
+        return this.getCurrentValue(this.e2eeEnabled$);
+    }
     /**
      * Will provide the user who ended this call.
      */
@@ -6840,6 +6987,18 @@ class CallState {
     removeOrphanedTrack = (id) => {
         this.orphanedTracks = this.orphanedTracks.filter((o) => o.id !== id);
     };
+    /**
+     * Drops every orphaned track. Call this when the peer connections that own
+     * the stored receivers go away (full leave, reconnect, or migration):
+     * `pc.close()` does not raise the track `ended` event, so the per-track
+     * cleanup never fires and the receivers + their closed PCs would otherwise
+     * leak for the call's lifetime.
+     *
+     * @internal
+     */
+    removeAllOrphanedTracks = () => {
+        this.orphanedTracks = [];
+    };
     /**
      * Takes all orphaned tracks with the given track lookup prefix.
      * All orphaned tracks with the given track lookup prefix are removed from the call state.
@@ -6902,7 +7061,7 @@ class CallState {
      * @param reconnectDetails optional reconnect details.
      */
     updateFromSfuCallState = (callState, currentSessionId, reconnectDetails) => {
-        const { participants, participantCount, startedAt, pins } = callState;
+        const { participants, participantCount, startedAt, pins, e2EeEnabled } = callState;
         const localPublishedTracks = reconnectDetails?.announcedTracks.map((t) => t.trackType) ?? [];
         this.setParticipants(() => {
             const participantLookup = this.getParticipantLookupBySessionId();
@@ -6928,6 +7087,7 @@ class CallState {
         this.setAnonymousParticipantCount(participantCount?.anonymous || 0);
         this.setStartedAt(startedAt ? Timestamp.toDate(startedAt) : new Date());
         this.setServerSidePins(pins);
+        this.setCurrentValue(this.e2eeEnabledSubject, e2EeEnabled);
     };
     updateFromMemberRemoved = (event) => {
         this.updateFromCallResponse(event.call);
@@ -7125,6 +7285,37 @@ class CallState {
     };
 }
 
+/**
+ * Detection and selection policy for the two WebRTC Encoded Transform APIs.
+ * Internal: which one the SDK attaches is an RTC-layer detail. Consumers want
+ * `EncryptionManager.isSupported` instead.
+ */
+/**
+ * Chrome only, and the reason an RTCPeerConnection carrying E2EE needs the
+ * non-standard `encodedInsertableStreams` flag.
+ */
+const hasInsertableStreams = () => typeof RTCRtpSender !== 'undefined' &&
+    'createEncodedStreams' in RTCRtpSender.prototype;
+/** Whether the standard `RTCRtpScriptTransform` API exists. */
+const hasScriptTransform = () => typeof RTCRtpScriptTransform !== 'undefined';
+/**
+ * Which Encoded Transform API to attach E2EE with here.
+ *
+ * - `'insertable'`: legacy Insertable Streams. Used on Chrome, where
+ *   `RTCRtpScriptTransform` is still unreliable for E2EE.
+ * - `'script'`: the standard API. Used everywhere else.
+ * - `undefined`: neither exists, so E2EE cannot run.
+ */
+const preferredTransform = () => {
+    const insertable = hasInsertableStreams();
+    // Chrome's RTCRtpScriptTransform is still unreliable for E2EE.
+    if (isChrome() && insertable)
+        return 'insertable';
+    if (hasScriptTransform())
+        return 'script';
+    return insertable ? 'insertable' : undefined;
+};
+
 /**
  * Flatten the stats report into an array of stats objects.
  *
@@ -8233,6 +8424,7 @@ class BasePeerConnection {
     state;
     dispatcher;
     clientPublishOptions;
+    e2ee;
     tag;
     sfuClient;
     onReconnectionNeeded;
@@ -8254,13 +8446,14 @@ class BasePeerConnection {
     /**
      * Constructs a new `BasePeerConnection` instance.
      */
-    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
+    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, e2ee, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
         this.peerType = peerType;
         this.sfuClient = sfuClient;
         this.state = state;
         this.dispatcher = dispatcher;
         this.iceRestartDelay = iceRestartDelay;
         this.clientPublishOptions = clientPublishOptions;
+        this.e2ee = e2ee;
         this.tag = tag;
         this.onReconnectionNeeded = onReconnectionNeeded;
         this.onIceConnected = onIceConnected;
@@ -8279,7 +8472,13 @@ class BasePeerConnection {
         }
     }
     createPeerConnection = (connectionConfig) => {
-        const pc = new RTCPeerConnection(connectionConfig);
+        const config = { ...connectionConfig };
+        // The legacy Insertable Streams path requires this non-standard flag.
+        if (this.e2ee && hasInsertableStreams()) {
+            // @ts-expect-error not part of the standard lib yet
+            config.encodedInsertableStreams = true;
+        }
+        const pc = new RTCPeerConnection(config);
         pc.addEventListener('icecandidate', this.onIceCandidate);
         pc.addEventListener('icecandidateerror', this.onIceCandidateError);
         pc.addEventListener('iceconnectionstatechange', this.onIceConnectionStateChange);
@@ -9033,6 +9232,10 @@ class Publisher extends BasePeerConnection {
             toRTCDegradationPreference(publishOption.degradationPreference) ??
                 'maintain-framerate';
         await transceiver.sender.setParameters(params);
+        if (this.e2ee) {
+            this.e2ee.encrypt(transceiver.sender, publishOption.codec?.name.toLowerCase(), TrackType[publishOption.trackType]);
+            this.logger.debug('E2EE encryptor attached to sender');
+        }
         await this.negotiate();
     };
     /**
@@ -9644,9 +9847,15 @@ class Subscriber extends BasePeerConnection {
                 trackLookupPrefix: trackId,
                 track: primaryStream,
                 trackType,
+                receiver: this.e2ee ? e.receiver : undefined,
             });
             return;
         }
+        else if (this.e2ee) {
+            const { userId } = participantToUpdate;
+            this.e2ee.decrypt(e.receiver, userId, TrackType[trackType]);
+            this.logger.debug('E2EE decryptor attached to receiver', userId);
+        }
         const streamKindProp = trackTypeToParticipantStreamKey(trackType);
         if (!streamKindProp) {
             this.logger.error(`Unknown track type: ${rawTrackType}`);
@@ -10618,7 +10827,7 @@ const handleRemoteSoftMute = (call) => {
 /**
  * An event responder which handles the `participantJoined` event.
  */
-const watchParticipantJoined = (state) => {
+const watchParticipantJoined = (state, e2ee = undefined) => {
     return function onParticipantJoined(e) {
         const { participant } = e;
         if (!participant)
@@ -10631,7 +10840,7 @@ const watchParticipantJoined = (state) => {
         // The SFU would send participant info as part of the `join`
         // response and then follow up with a `participantJoined` event for
         // already announced participants.
-        const orphanedTracks = reconcileOrphanedTracks(state, participant);
+        const orphanedTracks = reconcileOrphanedTracks(state, participant, e2ee);
         state.updateOrAddParticipant(participant.sessionId, Object.assign(participant, orphanedTracks, {
             ...(e.isPinned && { pin: { isLocalPin: false, pinnedAt: Date.now() } }),
             viewportVisibilityState: {
@@ -10667,7 +10876,7 @@ const watchParticipantUpdated = (state) => {
  * An event responder which handles the `trackPublished` event.
  * The SFU will send this event when a participant publishes a track.
  */
-const watchTrackPublished = (state) => {
+const watchTrackPublished = (state, e2ee = undefined) => {
     return function onTrackPublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls.
@@ -10675,7 +10884,7 @@ const watchTrackPublished = (state) => {
         // events, and instead, it would only provide the participant's information
         // once they start publishing a track.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant);
         }
@@ -10690,12 +10899,12 @@ const watchTrackPublished = (state) => {
  * An event responder which handles the `trackUnpublished` event.
  * The SFU will send this event when a participant unpublishes a track.
  */
-const watchTrackUnpublished = (state) => {
+const watchTrackUnpublished = (state, e2ee = undefined) => {
     return function onTrackUnpublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls. See `watchTrackPublished`.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant, (p) => ({
                 pausedTracks: p.pausedTracks?.filter((t) => t !== type),
@@ -10714,17 +10923,22 @@ const watchTrackUnpublished = (state) => {
  *
  * @param state the call state.
  * @param participant the participant.
+ * @param e2ee accessor for the call's encryption manager, if any.
  */
-const reconcileOrphanedTracks = (state, participant) => {
+const reconcileOrphanedTracks = (state, participant, e2ee) => {
     const orphanTracks = state.takeOrphanedTracks(participant.trackLookupPrefix);
     if (!orphanTracks.length)
         return;
+    const manager = e2ee?.();
     const reconciledTracks = {};
     for (const orphan of orphanTracks) {
         const key = trackTypeToParticipantStreamKey(orphan.trackType);
         if (!key)
             continue;
         reconciledTracks[key] = orphan.track;
+        if (manager && orphan.receiver) {
+            manager.decrypt(orphan.receiver, participant.userId, TrackType[orphan.trackType]);
+        }
     }
     return reconciledTracks;
 };
@@ -10780,6 +10994,11 @@ const watchAudioLevelChanged = (dispatcher, state) => {
  */
 const registerEventHandlers = (call, dispatcher) => {
     const state = call.state;
+    // Read lazily on each event: setE2EEManager can run after setup() (an app that
+    // inspects call settings via get()/getOrCreate() before deciding to encrypt has
+    // already triggered it), so a value captured here would be a stale undefined
+    // for the whole call and orphaned tracks would never get a decryptor.
+    const e2ee = () => call.e2eeManager;
     const eventHandlers = [
         call.on('call.ended', watchCallEnded(call)),
         watchSfuCallEnded(call),
@@ -10787,11 +11006,11 @@ const registerEventHandlers = (call, dispatcher) => {
         watchSfuErrorReports(dispatcher),
         watchConnectionQualityChanged(dispatcher, state),
         watchParticipantCountChanged(dispatcher, state),
-        call.on('participantJoined', watchParticipantJoined(state)),
+        call.on('participantJoined', watchParticipantJoined(state, e2ee)),
         call.on('participantLeft', watchParticipantLeft(state)),
         call.on('participantUpdated', watchParticipantUpdated(state)),
-        call.on('trackPublished', watchTrackPublished(state)),
-        call.on('trackUnpublished', watchTrackUnpublished(state)),
+        call.on('trackPublished', watchTrackPublished(state, e2ee)),
+        call.on('trackUnpublished', watchTrackUnpublished(state, e2ee)),
         watchAudioLevelChanged(dispatcher, state),
         watchDominantSpeakerChanged(dispatcher, state),
         call.on('callGrantsUpdated', watchCallGrantsUpdated(state)),
@@ -11919,13 +12138,14 @@ class PermissionsContext {
             return false;
         const { audio, video, screensharing } = settings;
         switch (permission) {
-            case OwnCapability.SEND_AUDIO:
+            case RequestPermissionRequestPermissionsEnum.SEND_AUDIO:
                 return audio.access_request_enabled;
-            case OwnCapability.SEND_VIDEO:
+            case RequestPermissionRequestPermissionsEnum.SEND_VIDEO:
                 return video.access_request_enabled;
-            case OwnCapability.SCREENSHARE:
+            case RequestPermissionRequestPermissionsEnum.SCREENSHARE:
                 return screensharing.access_request_enabled;
             default:
+                ensureExhausted(permission);
                 return false;
         }
     };
@@ -12932,6 +13152,27 @@ class DeviceManager {
             this.filters.forEach((entry) => entry.stop?.());
         }
     }
+    reconcileOptimisticStatus = async () => {
+        const target = this.state.optimisticStatus;
+        await withCancellation(this.statusChangeConcurrencyTag, async (signal) => {
+            try {
+                if (target === 'enabled' && this.state.status !== 'enabled') {
+                    await this.unmuteStream();
+                    if (!signal.aborted)
+                        this.state.setStatus('enabled');
+                }
+                else if (target === 'disabled' && this.state.status === 'enabled') {
+                    // mirror whatever disable() does to stop/pause the track per disableMode
+                    if (!signal.aborted)
+                        this.state.setStatus('disabled');
+                }
+            }
+            finally {
+                if (!signal.aborted)
+                    this.state.setPendingStatus(this.state.status);
+            }
+        });
+    };
     disableTracks() {
         this.getTracks().forEach((track) => {
             if (track.enabled)
@@ -13565,6 +13806,33 @@ class CameraManager extends DeviceManager {
             }
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Applies the video settings to the camera.
      *
@@ -13598,9 +13866,16 @@ class CameraManager extends DeviceManager {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the camera is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
@@ -13619,7 +13894,10 @@ class CameraManager extends DeviceManager {
         }
         return constraints;
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getVideoStream(constraints, this.call.tracer);
     }
 }
@@ -13635,6 +13913,9 @@ class AudioDeviceManager extends DeviceManager {
         if (!this.call.state.settings?.audio.hifi_audio_enabled) {
             throw new Error('High Fidelity audio is not enabled for this call');
         }
+        if (isReactNative() && this.call.hasMediaEngine) {
+            throw new Error('setAudioBitrateProfile must be called before joining the call.');
+        }
         this.doSetAudioBitrateProfile(profile);
         this.state.setAudioBitrateProfile(profile);
         if (this.enabled) {
@@ -13907,7 +14188,10 @@ class MicrophoneManager extends AudioDeviceManager {
         ]), async ([callingState, ownCapabilities, deviceId, status, permissionState,]) => {
             try {
                 if (callingState === CallingState.LEFT) {
-                    this.setMutedRecordingPrepared(false);
+                    // The muted-recording-prepared mode is reset in `callManager.stop()`
+                    // (during leave, while the call factory is still alive), not here —
+                    // this subscription fires asynchronously and could land after the
+                    // factory is disposed, forcing a default-ADM rebuild.
                     await this.stopSpeakingWhileMutedDetection();
                 }
                 if (callingState !== CallingState.JOINED)
@@ -14007,6 +14291,33 @@ class MicrophoneManager extends AudioDeviceManager {
             this.subscriptions.push(unsubscribe);
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Enables noise cancellation for the microphone.
      *
@@ -14167,15 +14478,25 @@ class MicrophoneManager extends AudioDeviceManager {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the microphone is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
         return getAudioDevices(this.call.tracer);
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getAudioStream(constraints, this.call.tracer);
     }
     doSetAudioBitrateProfile(profile) {
@@ -14384,6 +14705,9 @@ class ScreenShareManager extends AudioDeviceManager {
         if (!this.state.audioEnabled) {
             constraints.audio = false;
         }
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         const stream = await getScreenShareStream(constraints, this.call.tracer);
         const [track] = stream.getVideoTracks();
         const { contentHint } = this.state.settings || {};
@@ -14488,10 +14812,14 @@ class SpeakerManager {
         this.devicePersistence = devicePreferences;
         this.setup();
     }
-    apply(settings) {
-        return isReactNative() ? this.applyRN(settings) : this.applyWeb();
+    async apply(settings) {
+        if (isReactNative()) {
+            this.applyRN(settings);
+            return;
+        }
+        await this.applyWeb();
     }
-    applyWeb() {
+    async applyWeb() {
         const { enabled, storageKey } = this.devicePersistence;
         if (!enabled)
             return;
@@ -14503,8 +14831,22 @@ class SpeakerManager {
         const nextDeviceId = preference.selectedDeviceId === defaultDeviceId
             ? ''
             : preference.selectedDeviceId;
-        if (this.state.selectedDevice !== nextDeviceId) {
-            this.select(nextDeviceId);
+        if (!nextDeviceId) {
+            if (this.state.selectedDevice !== nextDeviceId) {
+                this.select(nextDeviceId);
+            }
+            return;
+        }
+        const permissionState = await firstValueFrom(getAudioBrowserPermission(this.call.tracer).asStateObservable());
+        if (permissionState !== 'granted')
+            return;
+        const devices = await firstValueFrom(this.listDevices());
+        const device = this.findDevice(devices, nextDeviceId) ??
+            (preference.selectedDeviceLabel
+                ? devices.find((d) => d.label === preference.selectedDeviceLabel)
+                : undefined);
+        if (device && this.state.selectedDevice !== device.deviceId) {
+            this.select(device.deviceId);
         }
     }
     applyRN(settings) {
@@ -14533,6 +14875,7 @@ class SpeakerManager {
             globalThis.streamRNVideoSDK?.callManager.setup({
                 defaultDevice,
                 isRingingTypeCall: this.call.ringing,
+                cid: this.call.cid,
             });
         }
     }
@@ -14541,11 +14884,15 @@ class SpeakerManager {
             return;
         this.areSubscriptionsSetUp = true;
         if (deviceIds$ && !isReactNative()) {
-            this.subscriptions.push(createSubscription(combineLatest([deviceIds$, this.state.selectedDevice$]), ([devices, deviceId]) => {
+            this.subscriptions.push(createSubscription(combineLatest([
+                deviceIds$.pipe(pairwise()),
+                this.state.selectedDevice$,
+            ]), ([[prevDevices, currentDevices], deviceId]) => {
                 if (!deviceId)
                     return;
-                const device = devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
-                if (!device)
+                const isDisconnected = this.findDevice(prevDevices, deviceId) &&
+                    !this.findDevice(currentDevices, deviceId);
+                if (isDisconnected)
                     this.select('');
             }));
         }
@@ -14592,6 +14939,7 @@ class SpeakerManager {
         this.subscriptions.forEach((unsubscribe) => unsubscribe());
         this.subscriptions = [];
         this.areSubscriptionsSetUp = false;
+        this.defaultDevice = undefined;
     };
     /**
      * Set the volume of the audio elements
@@ -14626,6 +14974,7 @@ class SpeakerManager {
             return { audioVolume: volume };
         });
     }
+    findDevice = (devices, deviceId) => devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
     persistSpeakerDevicePreference(selectedDevice) {
         const { storageKey } = this.devicePersistence;
         const devices = getCurrentValue(this.listDevices()) || [];
@@ -14708,6 +15057,7 @@ class Call {
     blockedAudioTracker;
     subscriber;
     publisher;
+    e2eeManager;
     /**
      * Flag telling whether this call is a "ringing" call.
      */
@@ -14763,6 +15113,8 @@ class Call {
     allowOwnTracksLoopback = false;
     hasJoinedOnce = false;
     deviceSettingsAppliedOnce = false;
+    callManagerStarted = false;
+    leaveGeneration = 0;
     credentials;
     initialized = false;
     acceptRejectConcurrencyTag = Symbol('acceptRejectTag');
@@ -14781,6 +15133,13 @@ class Call {
     clientCapabilities = new Set([
         ClientCapability.SUBSCRIBER_VIDEO_PAUSE,
     ]);
+    /**
+     * The in-flight per-call media engine. On web/React this resolves to a thin
+     * globals-backed engine (no provider registered); React Native registers a
+     * provider that owns a per-call native factory.
+     * @internal
+     */
+    mediaEnginePromise;
     /**
      * Constructs a new `Call` instance.
      *
@@ -15050,6 +15409,7 @@ class Call {
             if (callingState === CallingState.LEFT) {
                 return;
             }
+            this.leaveGeneration += 1;
             if (callingState === CallingState.JOINING) {
                 const waitUntilCallJoined = () => {
                     return new Promise((resolve) => {
@@ -15136,12 +15496,14 @@ class Call {
             this.clientStore.unregisterCall(this);
             globalThis.streamRNVideoSDK?.callManager.stop({
                 isRingingTypeCall: this.ringing,
+                shouldStopCallManager: this.callManagerStarted,
             });
             this.camera.dispose();
             this.microphone.dispose();
             this.screenShare.dispose();
             this.speaker.dispose();
             this.deviceSettingsAppliedOnce = false;
+            this.callManagerStarted = false;
             const stopOnLeavePromises = [];
             if (this.camera.stopOnLeave) {
                 stopOnLeavePromises.push(this.camera.disable(true));
@@ -15153,6 +15515,22 @@ class Call {
                 stopOnLeavePromises.push(this.screenShare.disable(true));
             }
             await Promise.all(stopOnLeavePromises);
+            // Dispose the per-call media engine last — after peer connections and
+            // local tracks are gone — so the backing factory tears down with no
+            // owned PCs/tracks. A fresh `join()` builds a new engine.
+            if (this.mediaEnginePromise) {
+                const enginePromise = this.mediaEnginePromise;
+                this.mediaEnginePromise = undefined;
+                this.logger.debug('Disposing per-call media factory');
+                await enginePromise
+                    .then((engine) => {
+                    globalThis.streamRNVideoSDK?.callingX?.unwireAudioEngineSubscription();
+                    return engine.dispose();
+                })
+                    .catch((err) => {
+                    this.logger.warn('Failed to dispose media engine', err);
+                });
+            }
         });
     };
     /**
@@ -15253,11 +15631,7 @@ class Call {
             this.clientStore.registerOrUpdateCall(this);
         }
         // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? params?.ring === true
-                ? true
-                : this.ringing
-            : false;
+        const skipSpeakerApply = isReactNative();
         await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
         return response;
     };
@@ -15280,11 +15654,7 @@ class Call {
             this.clientStore.registerOrUpdateCall(this);
         }
         // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? data?.ring === true
-                ? true
-                : this.ringing
-            : false;
+        const skipSpeakerApply = isReactNative();
         await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
         return response;
     };
@@ -15433,9 +15803,20 @@ class Call {
     doJoin = async (data) => {
         const connectStartTime = Date.now();
         const callingState = this.state.callingState;
+        const joinLeaveGeneration = this.leaveGeneration;
+        const supersededByLeave = () => this.leaveGeneration !== joinLeaveGeneration;
         this.joinCallData = data;
         this.logger.debug('Starting join flow');
         this.state.setCallingState(CallingState.JOINING);
+        // Ensure the per-call media engine exists before any peer connection
+        // (codec probe, subscriber, publisher) or capture happens, so the WebRTC
+        // globals resolve to the call's factory. Idempotent across
+        // reconnect/migration attempts.
+        await this.ensureMediaFactory();
+        const callingX = globalThis.streamRNVideoSDK?.callingX;
+        if (callingX) {
+            callingX.wireAudioEngineSubscription();
+        }
         const performingMigration = this.reconnectStrategy === WebsocketReconnectStrategy.MIGRATE;
         const performingRejoin = this.reconnectStrategy === WebsocketReconnectStrategy.REJOIN;
         const performingFastReconnect = this.reconnectStrategy === WebsocketReconnectStrategy.FAST;
@@ -15490,6 +15871,11 @@ class Call {
             // these are throw-away SDPs that the SFU will use to determine
             // the capabilities of the client (codec support, etc.)
             const { dangerouslyForceCodec, fmtpLine, subscriberFmtpLine } = this.clientPublishOptions || {};
+            // skip if a leave superseded this join so codec detection doesn't resolve to a default factory.
+            if (supersededByLeave()) {
+                this.logger.debug('Join superseded by leave; skipping codec detection');
+                return;
+            }
             const [subscriberSdp, publisherSdp] = await Promise.all([
                 getGenericSdp('recvonly', dangerouslyForceCodec, subscriberFmtpLine),
                 getGenericSdp('sendonly', dangerouslyForceCodec, fmtpLine),
@@ -15533,6 +15919,12 @@ class Call {
                 throw error;
             }
         }
+        // If the user left while this join was in flight, bail before re-setting JOINED and before
+        // peer-connection setup below (both run synchronously after this, so one check covers them).
+        if (supersededByLeave()) {
+            this.logger.debug('Join superseded by leave; aborting join flow');
+            return;
+        }
         if (!performingMigration) {
             // in MIGRATION, `JOINED` state is set in `this.reconnectMigrate()`
             this.state.setCallingState(CallingState.JOINED);
@@ -15570,12 +15962,18 @@ class Call {
         }
         // device settings should be applied only once, we don't have to
         // re-apply them on later reconnections or server-side data fetches
-        if (!this.deviceSettingsAppliedOnce && this.state.settings) {
+        if (!this.deviceSettingsAppliedOnce &&
+            this.state.settings &&
+            !supersededByLeave()) {
             await this.applyDeviceConfig(this.state.settings, true, false);
+            this.deviceSettingsAppliedOnce = true;
+        }
+        if (!this.callManagerStarted && !supersededByLeave()) {
             globalThis.streamRNVideoSDK?.callManager.start({
                 isRingingTypeCall: this.ringing,
+                cid: this.cid,
             });
-            this.deviceSettingsAppliedOnce = true;
+            this.callManagerStarted = true;
         }
         // We shouldn't persist the `ring` and `notify` state after joining the call
         // as it's a one-time event and clashes with the potential reconnection attempts.
@@ -15702,6 +16100,7 @@ class Call {
         this.sfuStatsReporter = undefined;
         if (closePreviousInstances && this.subscriber) {
             await this.subscriber.dispose();
+            this.state.removeAllOrphanedTracks();
         }
         const basePeerConnectionOptions = {
             sfuClient,
@@ -15712,6 +16111,7 @@ class Call {
             enableTracing,
             statsTimestampDriftThresholdMs: reportingIntervalMs / 2,
             clientPublishOptions: this.clientPublishOptions,
+            e2ee: this.e2eeManager,
             onReconnectionNeeded: (kind, reason, peerType) => {
                 this.reconnect(kind, reason).catch((err) => {
                     const message = `[Reconnect] Error reconnecting, after a ${PeerType[peerType]} error: ${reason}`;
@@ -15777,12 +16177,12 @@ class Call {
      * Retrieves credentials for joining the call.
      *
      * @internal
-     *
      * @param data the join call data.
      */
     doJoinRequest = async (data) => {
         const location = await this.streamClient.getLocationHint();
-        const request = { ...data, location };
+        const e2ee = !!this.e2eeManager;
+        const request = { ...data, location, e2ee };
         const joinResponse = await this.streamClient.post(`${this.streamClientBasePath}/join`, request);
         this.state.updateFromCallResponse(joinResponse.call);
         this.state.setMembers(joinResponse.members);
@@ -15801,6 +16201,36 @@ class Call {
         }
         return joinResponse;
     };
+    /**
+     * Whether the per-call media engine currently exists. True from join until leave.
+     *
+     * @internal an internal getter and should not be used outside the SDK.
+     */
+    get hasMediaEngine() {
+        return !!this.mediaEnginePromise;
+    }
+    /**
+     * Ensures a {@link CallMediaEngine} exists for this call's media session and
+     * returns it. Idempotent: the engine is created once via the registered
+     * provider (see `setCallMediaEngineProvider`) and cached until `leave()`
+     * disposes it. Concurrent callers (e.g. camera + microphone enabling in
+     * parallel) share the same engine because the in-flight creation promise is
+     * cached, never the unresolved result.
+     *
+     * @internal
+     */
+    ensureMediaFactory = async () => {
+        if (!this.mediaEnginePromise) {
+            const provider = getCallMediaEngineProvider();
+            this.logger.debug(`Requesting per-call media factory creation`);
+            this.mediaEnginePromise = Promise.resolve(provider()).catch((err) => {
+                // Drop the cached rejection so a retried join() can rebuild the engine
+                this.mediaEnginePromise = undefined;
+                throw err;
+            });
+        }
+        return this.mediaEnginePromise;
+    };
     /**
      * Handles the closing of the SFU signal connection.
      *
@@ -16362,6 +16792,30 @@ class Call {
         this.tracer.trace('updatePublishOptions', options);
         this.clientPublishOptions = { ...this.clientPublishOptions, ...options };
     };
+    /**
+     * Set the E2EE (end-to-end encryption) manager for this call.
+     *
+     * Must be called before {@link join} so the RTCPeerConnection can be
+     * configured for E2EE.
+     *
+     * The manager is kept across {@link leave} so a rejoin of this same instance
+     * stays encrypted: do not dispose it while this call may be joined again.
+     * A disposed manager throws from `encrypt`/`decrypt` rather than silently
+     * publishing nothing, so re-attach a fresh one instead of reusing it.
+     *
+     * @param e2ee - Any `E2EEManager`. Use `EncryptionManager.create()` for the
+     *         built-in AES-GCM scheme, or pass your own implementation.
+     * @throws if called after the peer connections have been built (i.e. after
+     *         `join`): those PCs were already configured without an encryptor, so
+     *         adopting a manager now would silently publish/receive cleartext for
+     *         the live session.
+     */
+    setE2EEManager = (e2ee) => {
+        if (this.publisher || this.subscriber) {
+            throw new Error('setE2EEManager must be called before join()');
+        }
+        this.e2eeManager = e2ee;
+    };
     /**
      * Notifies the SFU that a noise cancellation process has started.
      *
@@ -16998,7 +17452,9 @@ class Call {
      */
     applyDeviceConfig = async (settings, publish, skipSpeakerApply) => {
         if (!skipSpeakerApply) {
-            this.speaker.apply(settings);
+            await this.speaker.apply(settings).catch((err) => {
+                this.logger.warn('Speaker init failed', err);
+            });
         }
         await this.camera.apply(settings.video, publish).catch((err) => {
             this.logger.warn('Camera init failed', err);
@@ -17677,15 +18133,17 @@ class StableWSConnection {
             this.client.logger.error(`Token not set, can't connect authenticate`);
             return;
         }
-        const authMessage = JSON.stringify({
+        const wsAuthMessage = {
             token,
+            products: [WSAuthMessageProductsEnum.VIDEO],
             user_details: {
                 id: user.id,
                 name: user.name,
                 image: user.image,
                 custom: user.custom,
             },
-        });
+        };
+        const authMessage = JSON.stringify(wsAuthMessage);
         this._log(`onopen() - Sending auth message ${authMessage}`, {}, 'trace');
         this.ws?.send(authMessage);
         this._log('onopen() - onopen callback', { wsID });
@@ -18511,11 +18969,11 @@ class StreamClient {
         return await this.wsConnection.connect(this.defaultWSTimeout);
     };
     getSdkVersion = () => this.options.clientAppIdentifier?.sdkVersion ||
-        "1.57.0";
+        "1.58.0";
     getUserAgent = () => {
         if (!this.cachedUserAgent) {
             const { clientAppIdentifier = {} } = this.options;
-            const { sdkName = 'js', sdkVersion = "1.57.0", ...extras } = clientAppIdentifier;
+            const { sdkName = 'js', sdkVersion = "1.58.0", ...extras } = clientAppIdentifier;
             this.cachedUserAgent = [
                 `stream-video-${sdkName}-v${sdkVersion}`,
                 ...Object.entries(extras).map(([key, value]) => `${key}=${value}`),
@@ -19748,5 +20206,356 @@ const humanize = (n) => {
     return String(n);
 };
 
-export { AudioSettingsRequestDefaultDeviceEnum, AudioSettingsResponseDefaultDeviceEnum, browsers as Browsers, Call, CallRecordingFailedEventRecordingTypeEnum, CallRecordingReadyEventRecordingTypeEnum, CallRecordingStartedEventRecordingTypeEnum, CallRecordingStoppedEventRecordingTypeEnum, CallState, CallType, CallTypes, CallingState, CameraManager, CameraManagerState, CreateDeviceRequestPushProviderEnum, DebounceType, DeviceManager, DeviceManagerState, DynascaleManager, ErrorFromResponse, FrameRecordingSettingsRequestModeEnum, FrameRecordingSettingsRequestQualityEnum, FrameRecordingSettingsResponseModeEnum, IndividualRecordingSettingsRequestModeEnum, IndividualRecordingSettingsResponseModeEnum, IngressAudioEncodingOptionsRequestChannelsEnum, IngressSourceRequestFpsEnum, IngressVideoLayerRequestCodecEnum, LayoutSettingsRequestNameEnum, MicrophoneManager, MicrophoneManagerState, NoiseCancellationSettingsModeEnum, OwnCapability, RTMPBroadcastRequestQualityEnum, RTMPSettingsRequestQualityEnum, RawRecordingSettingsRequestModeEnum, RawRecordingSettingsResponseModeEnum, RecordSettingsRequestModeEnum, RecordSettingsRequestQualityEnum, rxUtils as RxUtils, ScreenShareManager, ScreenShareState, events as SfuEvents, SfuJoinError, models as SfuModels, SfuTimeoutError, SpeakerManager, SpeakerState, StartClosedCaptionsRequestLanguageEnum, StartTranscriptionRequestLanguageEnum, StreamSfuClient, StreamVideoClient, StreamVideoReadOnlyStateStore, StreamVideoWriteableStateStore, TranscriptionSettingsRequestClosedCaptionModeEnum, TranscriptionSettingsRequestLanguageEnum, TranscriptionSettingsRequestModeEnum, TranscriptionSettingsResponseClosedCaptionModeEnum, TranscriptionSettingsResponseLanguageEnum, TranscriptionSettingsResponseModeEnum, VideoSettingsRequestCameraFacingEnum, VideoSettingsResponseCameraFacingEnum, ViewportTracker, VisibilityState, checkIfAudioOutputChangeSupported, combineComparators, conditional, createSoundDetector, defaultSortPreset, descending, deviceIds$, disposeOfMediaStream, dominantSpeaker, getAudioBrowserPermission, getAudioDevices, getAudioOutputDevices, getAudioStream, getClientDetails, getDeviceState, getScreenShareStream, getSdkInfo, getVideoBrowserPermission, getVideoDevices, getVideoStream, getWebRTCInfo, hasAudio$1 as hasAudio, hasInterruptedTrack, hasPausedTrack, hasScreenShare, hasScreenShareAudio, hasVideo, humanize, isPinned, livestreamOrAudioRoomSortPreset, logToConsole, name, noopComparator, paginatedLayoutSortPreset, pinned, publishingAudio, publishingVideo, reactionType, resolveDeviceId, role, screenSharing, setDeviceInfo, setOSInfo, setPowerState, setSdkInfo, setThermalState, setWebRTCInfo, speakerLayoutSortPreset, speaking, videoLoggerSystem, withParticipantSource };
+/**
+ * Tiny, type-safe event emitter.
+ *
+ * Usage styles:
+ * - compose: `private readonly events = new TypedEventEmitter<MyMap>()`
+ * - extend:  `class Foo extends TypedEventEmitter<MyMap> {}`
+ *
+ * Listener exceptions (sync throw or rejected promise) are caught and logged,
+ * so one bad listener cannot break dispatch for the rest.
+ */
+class TypedEventEmitter {
+    logger;
+    byEvent = new Map();
+    constructor(logger = 'TypedEventEmitter') {
+        this.logger =
+            typeof logger === 'string' ? videoLoggerSystem.getLogger(logger) : logger;
+    }
+    on = (event, fn) => {
+        let listeners = this.byEvent.get(event);
+        if (!listeners) {
+            listeners = new Set();
+            this.byEvent.set(event, listeners);
+        }
+        listeners.add(fn);
+        return () => this.off(event, fn);
+    };
+    off = (event, fn) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners)
+            return;
+        listeners.delete(fn);
+        if (listeners.size === 0)
+            this.byEvent.delete(event);
+    };
+    emit = (event, payload) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners || listeners.size === 0)
+            return;
+        for (const listener of [...listeners]) {
+            this.invoke(() => listener(payload), event);
+        }
+    };
+    removeAllListeners = (event) => {
+        if (event === undefined) {
+            this.byEvent.clear();
+        }
+        else {
+            this.byEvent.delete(event);
+        }
+    };
+    invoke = (run, event) => {
+        try {
+            const result = run();
+            if (result && typeof result.then === 'function') {
+                result.catch((err) => {
+                    this.logger.warn(`Listener for '${String(event)}' rejected`, err);
+                });
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Listener for '${String(event)}' threw`, err);
+        }
+    };
+}
+
+/**
+ * Distributes keys to the E2EE Web Worker and attaches encrypt/decrypt
+ * transforms to RTCRtpSenders and RTCRtpReceivers.
+ */
+class EncryptionManager extends TypedEventEmitter {
+    algorithm;
+    transform;
+    disposed = false;
+    piped;
+    userId;
+    worker;
+    workerUrl;
+    constructor(userId, worker, workerUrl, algorithm, transform) {
+        super('EncryptionManager');
+        this.userId = userId;
+        this.worker = worker;
+        this.workerUrl = workerUrl;
+        this.algorithm = algorithm;
+        this.transform = transform;
+        this.worker.addEventListener('message', this.handleWorkerMessage);
+        this.worker.addEventListener('error', this.handleWorkerError);
+    }
+    /**
+     * Whether this browser has WebRTC Encoded Transforms, which E2EE requires.
+     * Use it to guard UI, or to avoid calling {@link create} where it would throw.
+     */
+    static isSupported = () => {
+        return preferredTransform() !== undefined;
+    };
+    /**
+     * Create an EncryptionManager instance and initialize the E2EE Web Worker.
+     *
+     * @param userId - The local user's ID, normally `call.currentUserId`.
+     * @param options - the create options.
+     * @throws {Error} If the browser lacks Encoded Transforms.
+     *
+     * @example
+     * ```ts
+     * if (EncryptionManager.isSupported()) {
+     *   const e2ee = await EncryptionManager.create(call.currentUserId);
+     *   call.setE2EEManager(e2ee);
+     *   e2ee.setSharedKey(0, keyBytes);
+     * }
+     */
+    static create = async (userId, options) => {
+        const transform = preferredTransform();
+        if (!transform) {
+            throw new Error(`E2EE is not supported in this browser`);
+        }
+        const { e2eeWorker } = await Promise.resolve().then(function () { return e2eeWorker$1; });
+        const blob = new Blob([`(${e2eeWorker.toString()})()`], {
+            type: 'application/javascript',
+        });
+        const url = URL.createObjectURL(blob);
+        let worker;
+        try {
+            worker = new Worker(url, { name: 'stream-video-e2ee' });
+        }
+        catch (err) {
+            // e.g. a CSP `worker-src` without `blob:`. Don't leak the object URL.
+            URL.revokeObjectURL(url);
+            throw err;
+        }
+        const algorithm = options?.algorithm ?? 'AES-128-GCM';
+        return new EncryptionManager(userId, worker, url, algorithm, transform);
+    };
+    /**
+     * {@link dispose} terminates the worker, so `postMessage` becomes a silent
+     * no-op and an attached transform points at a dead worker: frames would stall
+     * forever with no error and no event. Throwing is also fail-closed, since a
+     * caller that swallows it still publishes nothing rather than cleartext.
+     */
+    assertUsable = () => {
+        if (this.disposed)
+            throw new Error(`EncryptionManager is disposed`);
+    };
+    /**
+     * Terminate the worker and release all resources.
+     *
+     * The manager is unusable afterwards and every other method throws. Call
+     * {@link create} for a new one. Safe to call more than once.
+     */
+    dispose = () => {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        this.piped = undefined;
+        this.worker.removeEventListener('message', this.handleWorkerMessage);
+        this.worker.removeEventListener('error', this.handleWorkerError);
+        this.worker.terminate();
+        URL.revokeObjectURL(this.workerUrl);
+        this.removeAllListeners();
+    };
+    /**
+     * Set a per-user AES-GCM encryption key in the worker's key store.
+     *
+     * Use it when each participant has their own key from a central authority.
+     * The receiver picks the right one by the `keyIndex` in the frame trailer.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - Increases with each rotation.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setKey = (userId, keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_key', userId, keyIndex, rawKey });
+    };
+    /**
+     * Fallback key for any user without a per-user key. The simplest E2EE mode:
+     * one key for everyone, usually passphrase-derived, no distribution needed.
+     * Setting an epoch makes it active for encryption while older epochs remain
+     * available to decrypt in-flight frames until {@link removeSharedKey}.
+     *
+     * @param keyIndex - An integer 0-255, since one trailer byte carries it.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setSharedKey = (keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_shared_key', keyIndex, rawKey });
+    };
+    /**
+     * Remove one shared-key epoch from the worker's receive key ring.
+     *
+     * If this is the active epoch, shared-key encryption stops until
+     * {@link setSharedKey} succeeds again. An older epoch is not reactivated.
+     *
+     * @param keyIndex - The exact shared-key epoch to remove.
+     */
+    removeSharedKey = (keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_shared_key', keyIndex });
+    };
+    /**
+     * Retire one of a user's key epochs, leaving their other epochs usable.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - The exact epoch to remove. Absent epochs are a no-op.
+     */
+    removeKey = (userId, keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_key', userId, keyIndex });
+    };
+    /**
+     * Drop every key a user holds, revoking their ability to decrypt later
+     * frames. Call it when a participant leaves.
+     *
+     * To retire one rotated epoch instead, use {@link removeKey}.
+     */
+    removeAllKeys = (userId) => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.remove_all_keys', userId });
+    };
+    /**
+     * Called by the Publisher when it adds a transceiver.
+     *
+     * @param sender - The sender to encrypt.
+     * @param codec - Codec name, e.g. 'vp8', selecting the clear-byte rules.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    encrypt = (sender, codec, trackType) => {
+        this.assertUsable();
+        this.pipe(sender, {
+            operation: 'encode',
+            userId: this.userId,
+            codec,
+            trackType,
+        });
+    };
+    /**
+     * Called by the Subscriber when a remote track arrives.
+     *
+     * @param receiver - The receiver to decrypt.
+     * @param userId - The remote user, for key lookup in the worker.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    decrypt = (receiver, userId, trackType) => {
+        this.assertUsable();
+        this.pipe(receiver, { operation: 'decode', userId, trackType });
+    };
+    /** Pipe through the worker's transform, tracking targets to avoid double-piping. */
+    pipe = (target, options) => {
+        if (this.transform === 'script') {
+            target.transform = new RTCRtpScriptTransform(this.worker, options);
+            return;
+        }
+        if ((this.piped ??= new WeakSet()).has(target))
+            return;
+        this.piped.add(target);
+        // @ts-expect-error createEncodedStreams is not in the standard typedefs
+        const { readable, writable } = target.createEncodedStreams();
+        this.worker.postMessage({ type: 'cmd.setup_transform', ...options, readable, writable }, [readable, writable]);
+    };
+    /**
+     * Toggle periodic performance reporting from the E2EE worker.
+     *
+     * While on, the worker emits `e2ee.perf_report` once per second with per-track
+     * FPS and crypto timings. Useful for debugging throughput.
+     */
+    enablePerformanceReporting = (enabled) => {
+        this.assertUsable();
+        this.worker.postMessage({
+            type: 'cmd.enable_performance_reporting',
+            enabled,
+        });
+    };
+    /**
+     * Request a snapshot of the worker's keys. It arrives later as the
+     * `e2ee.key_state` event, listing fingerprints only, never key material.
+     */
+    requestKeyState = () => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.request_key_state' });
+    };
+    handleWorkerMessage = (e) => {
+        const { type, ...payload } = e.data ?? {};
+        if (type === 'e2ee.error') {
+            this.logger.error(e.data.message);
+            return;
+        }
+        const event = type;
+        this.logger.debug('Dispatching', event, payload);
+        this.emit(event, payload);
+    };
+    handleWorkerError = (e) => {
+        this.logger.error('Unhandled worker error:', e.message);
+    };
+    validateKeyLength = (rawKey) => {
+        const is256 = this.algorithm === 'AES-256-GCM';
+        const expected = is256 ? 32 : 16;
+        if (rawKey.byteLength !== expected) {
+            throw new Error(`Key must be exactly ${expected} bytes (${is256 ? 'AES-256' : 'AES-128'})`);
+        }
+    };
+    /**
+     * One trailer byte carries the keyIndex. A larger value would truncate to
+     * `keyIndex & 0xFF`, so the receiver would look up the wrong key and fail
+     * every decrypt. Reject it rather than ship a silently broken key epoch.
+     */
+    validateKeyIndex = (keyIndex) => {
+        if (!Number.isInteger(keyIndex) || keyIndex < 0 || keyIndex > 255) {
+            throw new Error(`keyIndex must be an integer between 0 and 255, got ${keyIndex}`);
+        }
+    };
+}
+
+/**
+ * E2EE worker. The build populates it.
+ *
+ * The actual implementation lives in `e2ee-worker/e2ee-worker-impl.ts` and its
+ * sibling modules (`constants.ts`, `codec.ts`, `crypto.ts`, `utils.ts`,
+ * `types.ts`), all written as real TypeScript with full type checking
+ * and import support.
+ *
+ * ## How it works
+ *
+ * 1. You edit files in `e2ee-worker/` as normal TypeScript
+ * 2. `yarn build` runs Rollup, which invokes `rollup-plugin-inline-worker`
+ * 3. The plugin bundles `e2ee-worker/e2ee-worker-impl.ts` (and its imports)
+ *    into a single function via a nested Rollup + TypeScript build
+ * 4. The function replaces this file's export at build time
+ * 5. `EncryptionManager.create()` creates a Worker from `e2eeWorker.toString()`
+ *
+ * In tests, this module is mocked (see `__tests__/EncryptionManager.test.ts`),
+ * so the placeholder is never evaluated.
+ *
+ * @see e2ee-worker/e2ee-worker-impl.ts - the entry point
+ * @see ../../plugins/rollup-plugin-inline-worker.ts - the Rollup plugin
+ * @see EncryptionManager.ts - consumes e2eeWorker
+ */
+function e2eeWorker() {
+    // will be populated at build time
+}
+
+var e2eeWorker$1 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    e2eeWorker: e2eeWorker
+});
+
+export { AudioSettingsRequestDefaultDeviceEnum, AudioSettingsResponseDefaultDeviceEnum, browsers as Browsers, Call, CallRecordingFailedEventRecordingTypeEnum, CallRecordingReadyEventRecordingTypeEnum, CallRecordingStartedEventRecordingTypeEnum, CallRecordingStoppedEventRecordingTypeEnum, CallState, CallType, CallTypes, CallingState, CameraManager, CameraManagerState, CreateDeviceRequestPushProviderEnum, DebounceType, DeviceManager, DeviceManagerState, DynascaleManager, EncryptionManager, EncryptionSettingsRequestModeEnum, EncryptionSettingsResponseModeEnum, ErrorFromResponse, FrameRecordingSettingsRequestModeEnum, FrameRecordingSettingsRequestQualityEnum, FrameRecordingSettingsResponseModeEnum, HLSSettingsRequestQualityTracksEnum, IndividualRecordingSettingsRequestModeEnum, IndividualRecordingSettingsRequestOutputTypesEnum, IndividualRecordingSettingsResponseModeEnum, IngressAudioEncodingOptionsRequestChannelsEnum, IngressSourceRequestFpsEnum, IngressVideoLayerRequestCodecEnum, LayoutSettingsRequestNameEnum, MicrophoneManager, MicrophoneManagerState, NoiseCancellationSettingsModeEnum, OwnCapability, RTMPBroadcastRequestQualityEnum, RTMPSettingsRequestQualityEnum, RawRecordingSettingsRequestModeEnum, RawRecordingSettingsResponseModeEnum, RecordSettingsRequestModeEnum, RecordSettingsRequestQualityEnum, RequestPermissionRequestPermissionsEnum, rxUtils as RxUtils, ScreenShareManager, ScreenShareState, events as SfuEvents, SfuJoinError, models as SfuModels, SfuTimeoutError, SpeakerManager, SpeakerState, StartClosedCaptionsRequestLanguageEnum, StartTranscriptionRequestLanguageEnum, StreamSfuClient, StreamVideoClient, StreamVideoReadOnlyStateStore, StreamVideoWriteableStateStore, TranscriptionSettingsRequestClosedCaptionModeEnum, TranscriptionSettingsRequestLanguageEnum, TranscriptionSettingsRequestModeEnum, TranscriptionSettingsResponseClosedCaptionModeEnum, TranscriptionSettingsResponseLanguageEnum, TranscriptionSettingsResponseModeEnum, TranslationSettingsLanguagesEnum, UpdateUserPermissionsRequestGrantPermissionsEnum, UpdateUserPermissionsRequestRevokePermissionsEnum, VideoSettingsRequestCameraFacingEnum, VideoSettingsResponseCameraFacingEnum, ViewportTracker, VisibilityState, WSAuthMessageProductsEnum, checkIfAudioOutputChangeSupported, combineComparators, conditional, createSoundDetector, defaultSortPreset, descending, deviceIds$, disposeOfMediaStream, dominantSpeaker, getAudioBrowserPermission, getAudioDevices, getAudioOutputDevices, getAudioStream, getCallMediaEngineProvider, getClientDetails, getDeviceState, getScreenShareStream, getSdkInfo, getVideoBrowserPermission, getVideoDevices, getVideoStream, getWebRTCInfo, hasAudio$1 as hasAudio, hasInterruptedTrack, hasPausedTrack, hasScreenShare, hasScreenShareAudio, hasVideo, humanize, isPinned, livestreamOrAudioRoomSortPreset, logToConsole, name, noopComparator, paginatedLayoutSortPreset, pinned, publishingAudio, publishingVideo, reactionType, resolveDeviceId, role, screenSharing, setCallMediaEngineProvider, setDeviceInfo, setOSInfo, setPowerState, setSdkInfo, setThermalState, setWebRTCInfo, speakerLayoutSortPreset, speaking, videoLoggerSystem, withParticipantSource };
 //# sourceMappingURL=index.es.js.map