@stream-io/video-client 1.57.0 → 1.59.0

package/dist/index.es.js

@@ -7,7 +7,7 @@ import { TwirpFetchTransport, TwirpErrorCode } from '@protobuf-ts/twirp-transpor
 import * as scopedLogger from '@stream-io/logger';
 export { LogLevelEnum } from '@stream-io/logger';
 import { parse, write } from 'sdp-transform';
-import { Subject, Observable, combineLatest, BehaviorSubject, ReplaySubject, shareReplay, map, distinctUntilChanged, startWith, takeWhile, distinctUntilKeyChanged, fromEventPattern, concatMap, merge, from, fromEvent, tap, debounceTime, pairwise, firstValueFrom, of } from 'rxjs';
+import { Subject, Observable, combineLatest, BehaviorSubject, ReplaySubject, shareReplay, map, distinctUntilChanged, startWith, takeWhile, distinctUntilKeyChanged, fromEventPattern, concatMap, merge, from, fromEvent, tap, debounceTime, pairwise, firstValueFrom, of, Subscription } from 'rxjs';
 import { UAParser } from 'ua-parser-js';
 import { WorkerTimer } from '@stream-io/worker-timer';
 import https from 'https';
@@ -68,6 +68,22 @@ const CreateDeviceRequestPushProviderEnum = {
     HUAWEI: 'huawei',
     XIAOMI: 'xiaomi',
 };
+/**
+ * @export
+ */
+const EncryptionSettingsRequestModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
+/**
+ * @export
+ */
+const EncryptionSettingsResponseModeEnum = {
+    AVAILABLE: 'available',
+    DISABLED: 'disabled',
+    AUTO_ON: 'auto-on',
+};
 /**
  * @export
  */
@@ -94,6 +110,21 @@ const FrameRecordingSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const HLSSettingsRequestQualityTracksEnum = {
+    _360P: '360p',
+    _480P: '480p',
+    _720P: '720p',
+    _1080P: '1080p',
+    _1440P: '1440p',
+    PORTRAIT_360X640: 'portrait-360x640',
+    PORTRAIT_480X854: 'portrait-480x854',
+    PORTRAIT_720X1280: 'portrait-720x1280',
+    PORTRAIT_1080X1920: 'portrait-1080x1920',
+    PORTRAIT_1440X2560: 'portrait-1440x2560',
+};
 /**
  * @export
  */
@@ -102,6 +133,17 @@ const IndividualRecordingSettingsRequestModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const IndividualRecordingSettingsRequestOutputTypesEnum = {
+    AUDIO_ONLY: 'audio_only',
+    VIDEO_ONLY: 'video_only',
+    AUDIO_VIDEO: 'audio_video',
+    SCREENSHARE_AUDIO_ONLY: 'screenshare_audio_only',
+    SCREENSHARE_VIDEO_ONLY: 'screenshare_video_only',
+    SCREENSHARE_AUDIO_VIDEO: 'screenshare_audio_video',
+};
 /**
  * @export
  */
@@ -260,6 +302,14 @@ const RecordSettingsRequestQualityEnum = {
     PORTRAIT_1080X1920: 'portrait-1080x1920',
     PORTRAIT_1440X2560: 'portrait-1440x2560',
 };
+/**
+ * @export
+ */
+const RequestPermissionRequestPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -460,6 +510,59 @@ const TranscriptionSettingsResponseModeEnum = {
     DISABLED: 'disabled',
     AUTO_ON: 'auto-on',
 };
+/**
+ * @export
+ */
+const TranslationSettingsLanguagesEnum = {
+    EN: 'en',
+    FR: 'fr',
+    ES: 'es',
+    DE: 'de',
+    IT: 'it',
+    NL: 'nl',
+    PT: 'pt',
+    PL: 'pl',
+    CA: 'ca',
+    CS: 'cs',
+    DA: 'da',
+    EL: 'el',
+    FI: 'fi',
+    ID: 'id',
+    JA: 'ja',
+    RU: 'ru',
+    SV: 'sv',
+    TA: 'ta',
+    TH: 'th',
+    TR: 'tr',
+    HU: 'hu',
+    RO: 'ro',
+    ZH: 'zh',
+    AR: 'ar',
+    TL: 'tl',
+    HE: 'he',
+    HI: 'hi',
+    HR: 'hr',
+    KO: 'ko',
+    MS: 'ms',
+    NO: 'no',
+    UK: 'uk',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestGrantPermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
+/**
+ * @export
+ */
+const UpdateUserPermissionsRequestRevokePermissionsEnum = {
+    SCREENSHARE: 'screenshare',
+    SEND_AUDIO: 'send-audio',
+    SEND_VIDEO: 'send-video',
+};
 /**
  * @export
  */
@@ -476,6 +579,14 @@ const VideoSettingsResponseCameraFacingEnum = {
     BACK: 'back',
     EXTERNAL: 'external',
 };
+/**
+ * @export
+ */
+const WSAuthMessageProductsEnum = {
+    CHAT: 'chat',
+    VIDEO: 'video',
+    FEEDS: 'feeds',
+};
 
 class ErrorFromResponse extends Error {
     code;
@@ -1473,6 +1584,13 @@ class CallState$Type extends MessageType {
                 repeat: 2 /*RepeatType.UNPACKED*/,
                 T: () => Pin,
             },
+            {
+                no: 5,
+                name: 'e2ee_enabled',
+                kind: 'scalar',
+                jsonName: 'e2eeEnabled',
+                T: 8 /*ScalarType.BOOL*/,
+            },
         ]);
     }
 }
@@ -4595,6 +4713,19 @@ const isSvcCodec = (codecOrMimeType) => {
         codecOrMimeType === 'video/av1');
 };
 
+/**
+ * The default engine: a thin, stateless wrapper over the WebRTC globals.
+ */
+const defaultGlobalsEngine = {
+    dispose: () => Promise.resolve(true),
+};
+const defaultGlobalsEngineProvider = () => defaultGlobalsEngine;
+let provider = defaultGlobalsEngineProvider;
+const setCallMediaEngineProvider = (newProvider) => {
+    provider = newProvider;
+};
+const getCallMediaEngineProvider = () => provider;
+
 const sfuEventKinds = {
     subscriberOffer: undefined,
     publisherAnswer: undefined,
@@ -4802,7 +4933,9 @@ const parseUfragFromCandidate = (candidate) => {
 };
 
 const ensureExhausted = (x, message) => {
-    videoLoggerSystem.getLogger('helpers').warn(message, x);
+    if (message) {
+        videoLoggerSystem.getLogger('helpers').warn(message, x);
+    }
 };
 
 /**
@@ -4927,7 +5060,7 @@ const toIceCandidate = (iceTrickle) => {
     }
 };
 
-const version = "1.57.0";
+const version = "1.59.0";
 const [major, minor, patch] = version.split('.');
 let sdkInfo = {
     type: SdkType.PLAIN_JAVASCRIPT,
@@ -5184,6 +5317,27 @@ const withoutConcurrency = createRunner(wrapWithContinuationTracking);
  */
 const withCancellation = createRunner(wrapWithCancellation);
 const pendingPromises = new Map();
+/**
+ * Wraps an async function so concurrent calls share the in-flight promise
+ * instead of queueing another execution.
+ *
+ * @param cb Async function to wrap.
+ * @returns Wrapped async function.
+ */
+function singleFlight(cb) {
+    let pending;
+    return (...args) => {
+        if (pending)
+            return pending;
+        const promise = cb(...args).finally(() => {
+            if (pending === promise) {
+                pending = undefined;
+            }
+        });
+        pending = promise;
+        return promise;
+    };
+}
 function hasPending(tag) {
     return pendingPromises.has(tag);
 }
@@ -5910,6 +6064,7 @@ class CallState {
     settingsSubject = new BehaviorSubject(undefined);
     transcribingSubject = new BehaviorSubject(false);
     captioningSubject = new BehaviorSubject(false);
+    e2eeEnabledSubject = new BehaviorSubject(false);
     endedBySubject = new BehaviorSubject(undefined);
     thumbnailsSubject = new BehaviorSubject(undefined);
     membersSubject = new BehaviorSubject([]);
@@ -6068,6 +6223,11 @@ class CallState {
      * Will provide the closed captioning state of this call.
      */
     captioning$;
+    /**
+     * Whether end-to-end encryption is active for this call, as reported by the
+     * SFU in the join response.
+     */
+    e2eeEnabled$;
     /**
      * Will provide the user who ended this call.
      */
@@ -6169,6 +6329,7 @@ class CallState {
         this.rawRecording$ = duc(this.rawRecordingSubject);
         this.transcribing$ = duc(this.transcribingSubject);
         this.captioning$ = duc(this.captioningSubject);
+        this.e2eeEnabled$ = duc(this.e2eeEnabledSubject);
         this.eventHandlers = {
             // these events are not updating the call state:
             'call.frame_recording_ready': undefined,
@@ -6271,6 +6432,7 @@ class CallState {
             clearTimeout(taskId);
             this.closedCaptionsTasks.delete(ccKey);
         }
+        this.removeAllOrphanedTracks();
     };
     /**
      * Sets the list of criteria that are used to sort the participants.
@@ -6620,6 +6782,12 @@ class CallState {
     get transcribing() {
         return this.getCurrentValue(this.transcribing$);
     }
+    /**
+     * Whether end-to-end encryption is active for this call.
+     */
+    get e2eeEnabled() {
+        return this.getCurrentValue(this.e2eeEnabled$);
+    }
     /**
      * Will provide the user who ended this call.
      */
@@ -6840,6 +7008,18 @@ class CallState {
     removeOrphanedTrack = (id) => {
         this.orphanedTracks = this.orphanedTracks.filter((o) => o.id !== id);
     };
+    /**
+     * Drops every orphaned track. Call this when the peer connections that own
+     * the stored receivers go away (full leave, reconnect, or migration):
+     * `pc.close()` does not raise the track `ended` event, so the per-track
+     * cleanup never fires and the receivers + their closed PCs would otherwise
+     * leak for the call's lifetime.
+     *
+     * @internal
+     */
+    removeAllOrphanedTracks = () => {
+        this.orphanedTracks = [];
+    };
     /**
      * Takes all orphaned tracks with the given track lookup prefix.
      * All orphaned tracks with the given track lookup prefix are removed from the call state.
@@ -6902,7 +7082,7 @@ class CallState {
      * @param reconnectDetails optional reconnect details.
      */
     updateFromSfuCallState = (callState, currentSessionId, reconnectDetails) => {
-        const { participants, participantCount, startedAt, pins } = callState;
+        const { participants, participantCount, startedAt, pins, e2EeEnabled } = callState;
         const localPublishedTracks = reconnectDetails?.announcedTracks.map((t) => t.trackType) ?? [];
         this.setParticipants(() => {
             const participantLookup = this.getParticipantLookupBySessionId();
@@ -6928,6 +7108,7 @@ class CallState {
         this.setAnonymousParticipantCount(participantCount?.anonymous || 0);
         this.setStartedAt(startedAt ? Timestamp.toDate(startedAt) : new Date());
         this.setServerSidePins(pins);
+        this.setCurrentValue(this.e2eeEnabledSubject, e2EeEnabled);
     };
     updateFromMemberRemoved = (event) => {
         this.updateFromCallResponse(event.call);
@@ -7125,6 +7306,37 @@ class CallState {
     };
 }
 
+/**
+ * Detection and selection policy for the two WebRTC Encoded Transform APIs.
+ * Internal: which one the SDK attaches is an RTC-layer detail. Consumers want
+ * `EncryptionManager.isSupported` instead.
+ */
+/**
+ * Chrome only, and the reason an RTCPeerConnection carrying E2EE needs the
+ * non-standard `encodedInsertableStreams` flag.
+ */
+const hasInsertableStreams = () => typeof RTCRtpSender !== 'undefined' &&
+    'createEncodedStreams' in RTCRtpSender.prototype;
+/** Whether the standard `RTCRtpScriptTransform` API exists. */
+const hasScriptTransform = () => typeof RTCRtpScriptTransform !== 'undefined';
+/**
+ * Which Encoded Transform API to attach E2EE with here.
+ *
+ * - `'insertable'`: legacy Insertable Streams. Used on Chrome, where
+ *   `RTCRtpScriptTransform` is still unreliable for E2EE.
+ * - `'script'`: the standard API. Used everywhere else.
+ * - `undefined`: neither exists, so E2EE cannot run.
+ */
+const preferredTransform = () => {
+    const insertable = hasInsertableStreams();
+    // Chrome's RTCRtpScriptTransform is still unreliable for E2EE.
+    if (isChrome() && insertable)
+        return 'insertable';
+    if (hasScriptTransform())
+        return 'script';
+    return insertable ? 'insertable' : undefined;
+};
+
 /**
  * Flatten the stats report into an array of stats objects.
  *
@@ -8233,6 +8445,7 @@ class BasePeerConnection {
     state;
     dispatcher;
     clientPublishOptions;
+    e2ee;
     tag;
     sfuClient;
     onReconnectionNeeded;
@@ -8254,13 +8467,14 @@ class BasePeerConnection {
     /**
      * Constructs a new `BasePeerConnection` instance.
      */
-    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
+    constructor(peerType, { sfuClient, connectionConfig, state, dispatcher, onReconnectionNeeded, onIceConnected, onPeerConnectionStateChange, onRemoteTrackUnmute, tag, enableTracing, clientPublishOptions, e2ee, iceRestartDelay = 2500, statsTimestampDriftThresholdMs = 0, }) {
         this.peerType = peerType;
         this.sfuClient = sfuClient;
         this.state = state;
         this.dispatcher = dispatcher;
         this.iceRestartDelay = iceRestartDelay;
         this.clientPublishOptions = clientPublishOptions;
+        this.e2ee = e2ee;
         this.tag = tag;
         this.onReconnectionNeeded = onReconnectionNeeded;
         this.onIceConnected = onIceConnected;
@@ -8279,7 +8493,13 @@ class BasePeerConnection {
         }
     }
     createPeerConnection = (connectionConfig) => {
-        const pc = new RTCPeerConnection(connectionConfig);
+        const config = { ...connectionConfig };
+        // The legacy Insertable Streams path requires this non-standard flag.
+        if (this.e2ee && hasInsertableStreams()) {
+            // @ts-expect-error not part of the standard lib yet
+            config.encodedInsertableStreams = true;
+        }
+        const pc = new RTCPeerConnection(config);
         pc.addEventListener('icecandidate', this.onIceCandidate);
         pc.addEventListener('icecandidateerror', this.onIceCandidateError);
         pc.addEventListener('iceconnectionstatechange', this.onIceConnectionStateChange);
@@ -9033,6 +9253,10 @@ class Publisher extends BasePeerConnection {
             toRTCDegradationPreference(publishOption.degradationPreference) ??
                 'maintain-framerate';
         await transceiver.sender.setParameters(params);
+        if (this.e2ee) {
+            this.e2ee.encrypt(transceiver.sender, publishOption.codec?.name.toLowerCase(), TrackType[publishOption.trackType]);
+            this.logger.debug('E2EE encryptor attached to sender');
+        }
         await this.negotiate();
     };
     /**
@@ -9602,6 +9826,11 @@ class Subscriber extends BasePeerConnection {
             throw e;
         }
     };
+    /**
+     * Whether the given stream is one the SFU echoed back to us
+     * (`allowOwnTracksLoopback`) rather than a local capture stream.
+     */
+    isSelfSubscribedStream = (stream) => !!stream && !!this.trackedStreams?.has(stream);
     handleOnTrack = (e) => {
         const { streams, track } = e;
         const [primaryStream] = streams;
@@ -9644,9 +9873,15 @@ class Subscriber extends BasePeerConnection {
                 trackLookupPrefix: trackId,
                 track: primaryStream,
                 trackType,
+                receiver: this.e2ee ? e.receiver : undefined,
             });
             return;
         }
+        else if (this.e2ee) {
+            const { userId } = participantToUpdate;
+            this.e2ee.decrypt(e.receiver, userId, TrackType[trackType]);
+            this.logger.debug('E2EE decryptor attached to receiver', userId);
+        }
         const streamKindProp = trackTypeToParticipantStreamKey(trackType);
         if (!streamKindProp) {
             this.logger.error(`Unknown track type: ${rawTrackType}`);
@@ -9685,6 +9920,8 @@ class Subscriber extends BasePeerConnection {
         const target = this.state.participants.find((p) => p.trackLookupPrefix === trackId);
         if (!target)
             return;
+        if (target.isLocalParticipant)
+            return;
         this.state.updateParticipant(target.sessionId, (p) => {
             const current = p.interruptedTracks ?? [];
             const has = current.includes(trackType);
@@ -10427,7 +10664,6 @@ const watchCallRejected = (call) => {
  */
 const watchCallEnded = (call) => {
     return function onCallEnded() {
-        globalThis.streamRNVideoSDK?.callingX?.endCall(call, 'remote');
         const { callingState } = call.state;
         if (callingState !== CallingState.IDLE &&
             callingState !== CallingState.LEFT) {
@@ -10436,9 +10672,13 @@ const watchCallEnded = (call) => {
                 reason: 'call.ended event received',
             });
             call
-                .leave({ message: 'call.ended event received', reject: false })
+                .leave({
+                message: 'call.ended event received',
+                reject: false,
+                reason: 'ended',
+            })
                 .catch((err) => {
-                call.logger.error('Failed to leave call after call.ended ', err);
+                call.logger.error('Failed to leave call after call.ended', err);
             });
         }
     };
@@ -10618,7 +10858,7 @@ const handleRemoteSoftMute = (call) => {
 /**
  * An event responder which handles the `participantJoined` event.
  */
-const watchParticipantJoined = (state) => {
+const watchParticipantJoined = (state, e2ee = undefined) => {
     return function onParticipantJoined(e) {
         const { participant } = e;
         if (!participant)
@@ -10631,7 +10871,7 @@ const watchParticipantJoined = (state) => {
         // The SFU would send participant info as part of the `join`
         // response and then follow up with a `participantJoined` event for
         // already announced participants.
-        const orphanedTracks = reconcileOrphanedTracks(state, participant);
+        const orphanedTracks = reconcileOrphanedTracks(state, participant, e2ee);
         state.updateOrAddParticipant(participant.sessionId, Object.assign(participant, orphanedTracks, {
             ...(e.isPinned && { pin: { isLocalPin: false, pinnedAt: Date.now() } }),
             viewportVisibilityState: {
@@ -10667,7 +10907,7 @@ const watchParticipantUpdated = (state) => {
  * An event responder which handles the `trackPublished` event.
  * The SFU will send this event when a participant publishes a track.
  */
-const watchTrackPublished = (state) => {
+const watchTrackPublished = (state, e2ee = undefined) => {
     return function onTrackPublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls.
@@ -10675,7 +10915,7 @@ const watchTrackPublished = (state) => {
         // events, and instead, it would only provide the participant's information
         // once they start publishing a track.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant);
         }
@@ -10690,12 +10930,12 @@ const watchTrackPublished = (state) => {
  * An event responder which handles the `trackUnpublished` event.
  * The SFU will send this event when a participant unpublishes a track.
  */
-const watchTrackUnpublished = (state) => {
+const watchTrackUnpublished = (state, e2ee = undefined) => {
     return function onTrackUnpublished(e) {
         const { type, sessionId } = e;
         // An optimization for large calls. See `watchTrackPublished`.
         if (e.participant) {
-            const orphanedTracks = reconcileOrphanedTracks(state, e.participant);
+            const orphanedTracks = reconcileOrphanedTracks(state, e.participant, e2ee);
             const participant = Object.assign(e.participant, orphanedTracks);
             state.updateOrAddParticipant(sessionId, participant, (p) => ({
                 pausedTracks: p.pausedTracks?.filter((t) => t !== type),
@@ -10714,17 +10954,22 @@ const watchTrackUnpublished = (state) => {
  *
  * @param state the call state.
  * @param participant the participant.
+ * @param e2ee accessor for the call's encryption manager, if any.
  */
-const reconcileOrphanedTracks = (state, participant) => {
+const reconcileOrphanedTracks = (state, participant, e2ee) => {
     const orphanTracks = state.takeOrphanedTracks(participant.trackLookupPrefix);
     if (!orphanTracks.length)
         return;
+    const manager = e2ee?.();
     const reconciledTracks = {};
     for (const orphan of orphanTracks) {
         const key = trackTypeToParticipantStreamKey(orphan.trackType);
         if (!key)
             continue;
         reconciledTracks[key] = orphan.track;
+        if (manager && orphan.receiver) {
+            manager.decrypt(orphan.receiver, participant.userId, TrackType[orphan.trackType]);
+        }
     }
     return reconciledTracks;
 };
@@ -10780,6 +11025,11 @@ const watchAudioLevelChanged = (dispatcher, state) => {
  */
 const registerEventHandlers = (call, dispatcher) => {
     const state = call.state;
+    // Read lazily on each event: setE2EEManager can run after setup() (an app that
+    // inspects call settings via get()/getOrCreate() before deciding to encrypt has
+    // already triggered it), so a value captured here would be a stale undefined
+    // for the whole call and orphaned tracks would never get a decryptor.
+    const e2ee = () => call.e2eeManager;
     const eventHandlers = [
         call.on('call.ended', watchCallEnded(call)),
         watchSfuCallEnded(call),
@@ -10787,11 +11037,11 @@ const registerEventHandlers = (call, dispatcher) => {
         watchSfuErrorReports(dispatcher),
         watchConnectionQualityChanged(dispatcher, state),
         watchParticipantCountChanged(dispatcher, state),
-        call.on('participantJoined', watchParticipantJoined(state)),
+        call.on('participantJoined', watchParticipantJoined(state, e2ee)),
         call.on('participantLeft', watchParticipantLeft(state)),
         call.on('participantUpdated', watchParticipantUpdated(state)),
-        call.on('trackPublished', watchTrackPublished(state)),
-        call.on('trackUnpublished', watchTrackUnpublished(state)),
+        call.on('trackPublished', watchTrackPublished(state, e2ee)),
+        call.on('trackUnpublished', watchTrackUnpublished(state, e2ee)),
         watchAudioLevelChanged(dispatcher, state),
         watchDominantSpeakerChanged(dispatcher, state),
         call.on('callGrantsUpdated', watchCallGrantsUpdated(state)),
@@ -11919,13 +12169,14 @@ class PermissionsContext {
             return false;
         const { audio, video, screensharing } = settings;
         switch (permission) {
-            case OwnCapability.SEND_AUDIO:
+            case RequestPermissionRequestPermissionsEnum.SEND_AUDIO:
                 return audio.access_request_enabled;
-            case OwnCapability.SEND_VIDEO:
+            case RequestPermissionRequestPermissionsEnum.SEND_VIDEO:
                 return video.access_request_enabled;
-            case OwnCapability.SCREENSHARE:
+            case RequestPermissionRequestPermissionsEnum.SCREENSHARE:
                 return screensharing.access_request_enabled;
             default:
+                ensureExhausted(permission);
                 return false;
         }
     };
@@ -12932,6 +13183,27 @@ class DeviceManager {
             this.filters.forEach((entry) => entry.stop?.());
         }
     }
+    reconcileOptimisticStatus = async () => {
+        const target = this.state.optimisticStatus;
+        await withCancellation(this.statusChangeConcurrencyTag, async (signal) => {
+            try {
+                if (target === 'enabled' && this.state.status !== 'enabled') {
+                    await this.unmuteStream();
+                    if (!signal.aborted)
+                        this.state.setStatus('enabled');
+                }
+                else if (target === 'disabled' && this.state.status === 'enabled') {
+                    // mirror whatever disable() does to stop/pause the track per disableMode
+                    if (!signal.aborted)
+                        this.state.setStatus('disabled');
+                }
+            }
+            finally {
+                if (!signal.aborted)
+                    this.state.setPendingStatus(this.state.status);
+            }
+        });
+    };
     disableTracks() {
         this.getTracks().forEach((track) => {
             if (track.enabled)
@@ -13212,7 +13484,7 @@ class DeviceManager {
             createSyntheticDevice(selectedDevice, deviceKind);
         writePreferences(currentDevice, deviceKey, muted, storageKey);
     }
-    async applyPersistedPreferences(enabledInCallType) {
+    async applyPersistedPreferences(enabledInCallType, forceDisabled = false) {
         const deviceKey = this.trackType === TrackType.AUDIO ? 'microphone' : 'camera';
         const preferences = readPreferences(this.devicePersistence.storageKey);
         const preferenceList = toPreferenceList(preferences[deviceKey]);
@@ -13239,13 +13511,13 @@ class DeviceManager {
         }
         const canPublish = this.call.permissionsContext.canPublish(this.trackType);
         if (typeof muted === 'boolean' && enabledInCallType && canPublish) {
-            await this.applyMutedState(muted);
+            await this.applyMutedState(muted, forceDisabled);
             appliedMute = true;
         }
         return appliedDevice || appliedMute;
     }
-    async applyMutedState(muted) {
-        if (this.state.status !== undefined)
+    async applyMutedState(muted, forceDisabled) {
+        if (forceDisabled || this.state.status !== undefined)
             return;
         if (muted) {
             await this.disable();
@@ -13565,13 +13837,41 @@ class CameraManager extends DeviceManager {
             }
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Applies the video settings to the camera.
      *
      * @param settings the video settings to apply.
      * @param publish whether to publish the stream after applying the settings.
+     * @param forceDisabled whether to keep the camera disabled, regardless of server-side or local preferences.
      */
-    async apply(settings, publish) {
+    async apply(settings, publish, forceDisabled = false) {
         // Wait for any in progress camera operation
         await this.statusChangeSettled();
         await this.selectTargetResolution(settings.target_resolution);
@@ -13583,8 +13883,7 @@ class CameraManager extends DeviceManager {
         if (shouldApplyDefaults &&
             this.devicePersistence.enabled &&
             permissionState === 'granted') {
-            persistedPreferencesApplied =
-                await this.applyPersistedPreferences(enabledInCallType);
+            persistedPreferencesApplied = await this.applyPersistedPreferences(enabledInCallType, forceDisabled);
         }
         // apply a direction and enable the camera only if in "pristine" state,
         // and there are no persisted preferences
@@ -13594,13 +13893,23 @@ class CameraManager extends DeviceManager {
                 const direction = settings.camera_facing === 'front' ? 'front' : 'back';
                 await this.selectDirection(direction, { enableCamera: false });
             }
-            if (canPublish && settings.camera_default_on && enabledInCallType) {
+            if (!forceDisabled &&
+                canPublish &&
+                settings.camera_default_on &&
+                enabledInCallType) {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the camera is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
@@ -13619,7 +13928,10 @@ class CameraManager extends DeviceManager {
         }
         return constraints;
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getVideoStream(constraints, this.call.tracer);
     }
 }
@@ -13635,6 +13947,9 @@ class AudioDeviceManager extends DeviceManager {
         if (!this.call.state.settings?.audio.hifi_audio_enabled) {
             throw new Error('High Fidelity audio is not enabled for this call');
         }
+        if (isReactNative() && this.call.hasMediaEngine) {
+            throw new Error('setAudioBitrateProfile must be called before joining the call.');
+        }
         this.doSetAudioBitrateProfile(profile);
         this.state.setAudioBitrateProfile(profile);
         if (this.enabled) {
@@ -13907,7 +14222,10 @@ class MicrophoneManager extends AudioDeviceManager {
         ]), async ([callingState, ownCapabilities, deviceId, status, permissionState,]) => {
             try {
                 if (callingState === CallingState.LEFT) {
-                    this.setMutedRecordingPrepared(false);
+                    // The muted-recording-prepared mode is reset in `callManager.stop()`
+                    // (during leave, while the call factory is still alive), not here —
+                    // this subscription fires asynchronously and could land after the
+                    // factory is disposed, forcing a default-ADM rebuild.
                     await this.stopSpeakingWhileMutedDetection();
                 }
                 if (callingState !== CallingState.JOINED)
@@ -14007,6 +14325,33 @@ class MicrophoneManager extends AudioDeviceManager {
             this.subscriptions.push(unsubscribe);
         }
     }
+    enable() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('enabled');
+            return Promise.resolve();
+        }
+        return super.enable();
+    }
+    async disable(forceStopOrOptions) {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus('disabled');
+            return;
+        }
+        // forward verbatim to the base, narrowing so the right overload is selected
+        if (forceStopOrOptions === undefined)
+            return super.disable();
+        if (typeof forceStopOrOptions === 'boolean') {
+            return super.disable(forceStopOrOptions);
+        }
+        return super.disable(forceStopOrOptions);
+    }
+    toggle() {
+        if (isReactNative() && !this.call.hasMediaEngine) {
+            this.state.setPendingStatus(this.state.optimisticStatus === 'enabled' ? 'disabled' : 'enabled');
+            return Promise.resolve();
+        }
+        return super.toggle();
+    }
     /**
      * Enables noise cancellation for the microphone.
      *
@@ -14146,8 +14491,9 @@ class MicrophoneManager extends AudioDeviceManager {
      * Applies the audio settings to the microphone.
      * @param settings the audio settings to apply.
      * @param publish whether to publish the stream after applying the settings.
+     * @param forceDisabled whether to keep the mic disabled, regardless of server-side or local preferences.
      */
-    async apply(settings, publish) {
+    async apply(settings, publish, forceDisabled = false) {
         // Wait for any in progress mic operation
         await this.statusChangeSettled();
         // apply server-side settings only when the device state is pristine
@@ -14159,23 +14505,33 @@ class MicrophoneManager extends AudioDeviceManager {
         if (shouldApplyDefaults &&
             this.devicePersistence.enabled &&
             permissionState === 'granted') {
-            persistedPreferencesApplied = await this.applyPersistedPreferences(true);
+            persistedPreferencesApplied = await this.applyPersistedPreferences(true, forceDisabled);
         }
         const canPublish = this.call.permissionsContext.canPublish(this.trackType);
         if (shouldApplyDefaults && !persistedPreferencesApplied) {
-            if (canPublish && settings.mic_default_on) {
+            if (!forceDisabled && canPublish && settings.mic_default_on) {
                 await this.enable();
             }
         }
-        const { mediaStream } = this.state;
-        if (canPublish && publish && this.enabled && mediaStream) {
-            await this.publishStream(mediaStream);
+        if (isReactNative() && publish && canPublish) {
+            // On RN the microphone is enabled/disabled optimistically before JOINED. Reconcile now
+            // acquires the track and publishes it, so it fully owns the publish.
+            await this.reconcileOptimisticStatus();
+        }
+        else {
+            const { mediaStream } = this.state;
+            if (canPublish && publish && this.enabled && mediaStream) {
+                await this.publishStream(mediaStream);
+            }
         }
     }
     getDevices() {
         return getAudioDevices(this.call.tracer);
     }
-    getStream(constraints) {
+    async getStream(constraints) {
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         return getAudioStream(constraints, this.call.tracer);
     }
     doSetAudioBitrateProfile(profile) {
@@ -14384,6 +14740,9 @@ class ScreenShareManager extends AudioDeviceManager {
         if (!this.state.audioEnabled) {
             constraints.audio = false;
         }
+        // Ensure the call's media factory exists before capture so the resulting
+        // track is owned by it (the WebRTC globals resolve to the live factory).
+        await this.call.ensureMediaFactory();
         const stream = await getScreenShareStream(constraints, this.call.tracer);
         const [track] = stream.getVideoTracks();
         const { contentHint } = this.state.settings || {};
@@ -14488,10 +14847,14 @@ class SpeakerManager {
         this.devicePersistence = devicePreferences;
         this.setup();
     }
-    apply(settings) {
-        return isReactNative() ? this.applyRN(settings) : this.applyWeb();
+    async apply(settings) {
+        if (isReactNative()) {
+            this.applyRN(settings);
+            return;
+        }
+        await this.applyWeb();
     }
-    applyWeb() {
+    async applyWeb() {
         const { enabled, storageKey } = this.devicePersistence;
         if (!enabled)
             return;
@@ -14503,8 +14866,22 @@ class SpeakerManager {
         const nextDeviceId = preference.selectedDeviceId === defaultDeviceId
             ? ''
             : preference.selectedDeviceId;
-        if (this.state.selectedDevice !== nextDeviceId) {
-            this.select(nextDeviceId);
+        if (!nextDeviceId) {
+            if (this.state.selectedDevice !== nextDeviceId) {
+                this.select(nextDeviceId);
+            }
+            return;
+        }
+        const permissionState = await firstValueFrom(getAudioBrowserPermission(this.call.tracer).asStateObservable());
+        if (permissionState !== 'granted')
+            return;
+        const devices = await firstValueFrom(this.listDevices());
+        const device = this.findDevice(devices, nextDeviceId) ??
+            (preference.selectedDeviceLabel
+                ? devices.find((d) => d.label === preference.selectedDeviceLabel)
+                : undefined);
+        if (device && this.state.selectedDevice !== device.deviceId) {
+            this.select(device.deviceId);
         }
     }
     applyRN(settings) {
@@ -14533,6 +14910,7 @@ class SpeakerManager {
             globalThis.streamRNVideoSDK?.callManager.setup({
                 defaultDevice,
                 isRingingTypeCall: this.call.ringing,
+                cid: this.call.cid,
             });
         }
     }
@@ -14541,11 +14919,15 @@ class SpeakerManager {
             return;
         this.areSubscriptionsSetUp = true;
         if (deviceIds$ && !isReactNative()) {
-            this.subscriptions.push(createSubscription(combineLatest([deviceIds$, this.state.selectedDevice$]), ([devices, deviceId]) => {
+            this.subscriptions.push(createSubscription(combineLatest([
+                deviceIds$.pipe(pairwise()),
+                this.state.selectedDevice$,
+            ]), ([[prevDevices, currentDevices], deviceId]) => {
                 if (!deviceId)
                     return;
-                const device = devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
-                if (!device)
+                const isDisconnected = this.findDevice(prevDevices, deviceId) &&
+                    !this.findDevice(currentDevices, deviceId);
+                if (isDisconnected)
                     this.select('');
             }));
         }
@@ -14592,6 +14974,7 @@ class SpeakerManager {
         this.subscriptions.forEach((unsubscribe) => unsubscribe());
         this.subscriptions = [];
         this.areSubscriptionsSetUp = false;
+        this.defaultDevice = undefined;
     };
     /**
      * Set the volume of the audio elements
@@ -14626,6 +15009,7 @@ class SpeakerManager {
             return { audioVolume: volume };
         });
     }
+    findDevice = (devices, deviceId) => devices.find((d) => d.deviceId === deviceId && d.kind === 'audiooutput');
     persistSpeakerDevicePreference(selectedDevice) {
         const { storageKey } = this.devicePersistence;
         const devices = getCurrentValue(this.listDevices()) || [];
@@ -14708,6 +15092,7 @@ class Call {
     blockedAudioTracker;
     subscriber;
     publisher;
+    e2eeManager;
     /**
      * Flag telling whether this call is a "ringing" call.
      */
@@ -14763,6 +15148,8 @@ class Call {
     allowOwnTracksLoopback = false;
     hasJoinedOnce = false;
     deviceSettingsAppliedOnce = false;
+    callManagerStarted = false;
+    leaveGeneration = 0;
     credentials;
     initialized = false;
     acceptRejectConcurrencyTag = Symbol('acceptRejectTag');
@@ -14781,6 +15168,13 @@ class Call {
     clientCapabilities = new Set([
         ClientCapability.SUBSCRIBER_VIDEO_PAUSE,
     ]);
+    /**
+     * The in-flight per-call media engine. On web/React this resolves to a thin
+     * globals-backed engine (no provider registered); React Native registers a
+     * provider that owns a per-call native factory.
+     * @internal
+     */
+    mediaEnginePromise;
     /**
      * Constructs a new `Call` instance.
      *
@@ -15050,6 +15444,7 @@ class Call {
             if (callingState === CallingState.LEFT) {
                 return;
             }
+            this.leaveGeneration += 1;
             if (callingState === CallingState.JOINING) {
                 const waitUntilCallJoined = () => {
                     return new Promise((resolve) => {
@@ -15083,7 +15478,7 @@ class Call {
                     }
                 }
             }
-            globalThis.streamRNVideoSDK?.callingX?.endCall(this);
+            globalThis.streamRNVideoSDK?.callingX?.endCall(this, reason === 'ended' ? 'remote' : undefined);
             this.statsReporter?.stop();
             this.statsReporter = undefined;
             const leaveReason = message ?? reason ?? 'user is leaving the call';
@@ -15136,12 +15531,14 @@ class Call {
             this.clientStore.unregisterCall(this);
             globalThis.streamRNVideoSDK?.callManager.stop({
                 isRingingTypeCall: this.ringing,
+                shouldStopCallManager: this.callManagerStarted,
             });
             this.camera.dispose();
             this.microphone.dispose();
             this.screenShare.dispose();
             this.speaker.dispose();
             this.deviceSettingsAppliedOnce = false;
+            this.callManagerStarted = false;
             const stopOnLeavePromises = [];
             if (this.camera.stopOnLeave) {
                 stopOnLeavePromises.push(this.camera.disable(true));
@@ -15153,6 +15550,22 @@ class Call {
                 stopOnLeavePromises.push(this.screenShare.disable(true));
             }
             await Promise.all(stopOnLeavePromises);
+            // Dispose the per-call media engine last — after peer connections and
+            // local tracks are gone — so the backing factory tears down with no
+            // owned PCs/tracks. A fresh `join()` builds a new engine.
+            if (this.mediaEnginePromise) {
+                const enginePromise = this.mediaEnginePromise;
+                this.mediaEnginePromise = undefined;
+                this.logger.debug('Disposing per-call media factory');
+                await enginePromise
+                    .then((engine) => {
+                    globalThis.streamRNVideoSDK?.callingX?.unwireAudioEngineSubscription();
+                    return engine.dispose();
+                })
+                    .catch((err) => {
+                    this.logger.warn('Failed to dispose media engine', err);
+                });
+            }
         });
     };
     /**
@@ -15228,8 +15641,18 @@ class Call {
         // const calls = useCalls().filter((c) => c.ringing);
         const calls = this.clientStore.calls.filter((c) => c.cid !== this.cid);
         this.clientStore.setCalls([this, ...calls]);
-        const skipSpeakerApply = isReactNative();
-        await this.applyDeviceConfig(settings, false, skipSpeakerApply);
+        await this.applyDeviceConfig(settings, { publish: false });
+    };
+    /**
+     * Applies a backend-provided call state snapshot
+     * (call, members, own capabilities) to this instance.
+     *
+     * @internal an internal method and should not be used outside the SDK.
+     */
+    updateFromCallStateResponse = (response) => {
+        this.state.updateFromCallResponse(response.call);
+        this.state.setMembers(response.members);
+        this.state.setOwnCapabilities(response.own_capabilities);
     };
     /**
      * Loads the information about the call.
@@ -15242,9 +15665,7 @@ class Call {
     get = async (params) => {
         await this.setup();
         const response = await this.streamClient.get(this.streamClientBasePath, params);
-        this.state.updateFromCallResponse(response.call);
-        this.state.setMembers(response.members);
-        this.state.setOwnCapabilities(response.own_capabilities);
+        this.updateFromCallStateResponse(response);
         if (params?.ring) {
             this.ringingSubject.next(true);
         }
@@ -15252,13 +15673,7 @@ class Call {
             this.watching = true;
             this.clientStore.registerOrUpdateCall(this);
         }
-        // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? params?.ring === true
-                ? true
-                : this.ringing
-            : false;
-        await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
+        await this.applyDeviceConfig(response.call.settings, { publish: false });
         return response;
     };
     /**
@@ -15269,9 +15684,7 @@ class Call {
     getOrCreate = async (data) => {
         await this.setup();
         const response = await this.streamClient.post(this.streamClientBasePath, data);
-        this.state.updateFromCallResponse(response.call);
-        this.state.setMembers(response.members);
-        this.state.setOwnCapabilities(response.own_capabilities);
+        this.updateFromCallStateResponse(response);
         if (data?.ring) {
             this.ringingSubject.next(true);
         }
@@ -15279,13 +15692,7 @@ class Call {
             this.watching = true;
             this.clientStore.registerOrUpdateCall(this);
         }
-        // Skip speaker setup on RN if ringing was requested or the call is already ringing
-        const skipSpeakerApply = isReactNative()
-            ? data?.ring === true
-                ? true
-                : this.ringing
-            : false;
-        await this.applyDeviceConfig(response.call.settings, false, skipSpeakerApply);
+        await this.applyDeviceConfig(response.call.settings, { publish: false });
         return response;
     };
     /**
@@ -15349,7 +15756,7 @@ class Call {
      *
      * @returns a promise which resolves once the call join-flow has finished.
      */
-    join = async ({ maxJoinRetries = 3, joinResponseTimeout, rpcRequestTimeout, allowOwnTracksLoopback = false, ...data } = {}) => {
+    join = singleFlight(async ({ maxJoinRetries = 3, joinResponseTimeout, rpcRequestTimeout, allowOwnTracksLoopback = false, ...data } = {}) => {
         const callingState = this.state.callingState;
         if ([CallingState.JOINED, CallingState.JOINING].includes(callingState)) {
             throw new Error(`Illegal State: call.join() shall be called only once`);
@@ -15371,7 +15778,6 @@ class Call {
             callId: this.id,
             getCallSessionId: () => this.state.session?.id ?? '',
             getSfuId: () => this.credentials?.server.edge_name ?? '',
-            getUserSessionId: () => this.sfuClient?.sessionId ?? '',
         });
         this.joinResponseTimeout = joinResponseTimeout;
         this.rpcRequestTimeout = rpcRequestTimeout;
@@ -15423,7 +15829,7 @@ class Call {
             callingX?.endCall(this, 'error');
             throw error;
         }
-    };
+    });
     /**
      * Will make a single attempt to watch for call related WebSocket events
      * and initiate a call session with the server.
@@ -15433,9 +15839,20 @@ class Call {
     doJoin = async (data) => {
         const connectStartTime = Date.now();
         const callingState = this.state.callingState;
+        const joinLeaveGeneration = this.leaveGeneration;
+        const supersededByLeave = () => this.leaveGeneration !== joinLeaveGeneration;
         this.joinCallData = data;
         this.logger.debug('Starting join flow');
         this.state.setCallingState(CallingState.JOINING);
+        // Ensure the per-call media engine exists before any peer connection
+        // (codec probe, subscriber, publisher) or capture happens, so the WebRTC
+        // globals resolve to the call's factory. Idempotent across
+        // reconnect/migration attempts.
+        await this.ensureMediaFactory();
+        const callingX = globalThis.streamRNVideoSDK?.callingX;
+        if (callingX) {
+            callingX.wireAudioEngineSubscription();
+        }
         const performingMigration = this.reconnectStrategy === WebsocketReconnectStrategy.MIGRATE;
         const performingRejoin = this.reconnectStrategy === WebsocketReconnectStrategy.REJOIN;
         const performingFastReconnect = this.reconnectStrategy === WebsocketReconnectStrategy.FAST;
@@ -15490,6 +15907,11 @@ class Call {
             // these are throw-away SDPs that the SFU will use to determine
             // the capabilities of the client (codec support, etc.)
             const { dangerouslyForceCodec, fmtpLine, subscriberFmtpLine } = this.clientPublishOptions || {};
+            // skip if a leave superseded this join so codec detection doesn't resolve to a default factory.
+            if (supersededByLeave()) {
+                this.logger.debug('Join superseded by leave; skipping codec detection');
+                return;
+            }
             const [subscriberSdp, publisherSdp] = await Promise.all([
                 getGenericSdp('recvonly', dangerouslyForceCodec, subscriberFmtpLine),
                 getGenericSdp('sendonly', dangerouslyForceCodec, fmtpLine),
@@ -15533,6 +15955,12 @@ class Call {
                 throw error;
             }
         }
+        // If the user left while this join was in flight, bail before re-setting JOINED and before
+        // peer-connection setup below (both run synchronously after this, so one check covers them).
+        if (supersededByLeave()) {
+            this.logger.debug('Join superseded by leave; aborting join flow');
+            return;
+        }
         if (!performingMigration) {
             // in MIGRATION, `JOINED` state is set in `this.reconnectMigrate()`
             this.state.setCallingState(CallingState.JOINED);
@@ -15570,12 +15998,21 @@ class Call {
         }
         // device settings should be applied only once, we don't have to
         // re-apply them on later reconnections or server-side data fetches
-        if (!this.deviceSettingsAppliedOnce && this.state.settings) {
-            await this.applyDeviceConfig(this.state.settings, true, false);
+        if (!this.deviceSettingsAppliedOnce &&
+            this.state.settings &&
+            !supersededByLeave()) {
+            await this.applyDeviceConfig(this.state.settings, {
+                publish: true,
+                skipSpeakerApply: false,
+            });
+            this.deviceSettingsAppliedOnce = true;
+        }
+        if (!this.callManagerStarted && !supersededByLeave()) {
             globalThis.streamRNVideoSDK?.callManager.start({
                 isRingingTypeCall: this.ringing,
+                cid: this.cid,
             });
-            this.deviceSettingsAppliedOnce = true;
+            this.callManagerStarted = true;
         }
         // We shouldn't persist the `ring` and `notify` state after joining the call
         // as it's a one-time event and clashes with the potential reconnection attempts.
@@ -15702,6 +16139,7 @@ class Call {
         this.sfuStatsReporter = undefined;
         if (closePreviousInstances && this.subscriber) {
             await this.subscriber.dispose();
+            this.state.removeAllOrphanedTracks();
         }
         const basePeerConnectionOptions = {
             sfuClient,
@@ -15712,6 +16150,7 @@ class Call {
             enableTracing,
             statsTimestampDriftThresholdMs: reportingIntervalMs / 2,
             clientPublishOptions: this.clientPublishOptions,
+            e2ee: this.e2eeManager,
             onReconnectionNeeded: (kind, reason, peerType) => {
                 this.reconnect(kind, reason).catch((err) => {
                     const message = `[Reconnect] Error reconnecting, after a ${PeerType[peerType]} error: ${reason}`;
@@ -15777,12 +16216,12 @@ class Call {
      * Retrieves credentials for joining the call.
      *
      * @internal
-     *
      * @param data the join call data.
      */
     doJoinRequest = async (data) => {
         const location = await this.streamClient.getLocationHint();
-        const request = { ...data, location };
+        const e2ee = !!this.e2eeManager;
+        const request = { ...data, location, e2ee };
         const joinResponse = await this.streamClient.post(`${this.streamClientBasePath}/join`, request);
         this.state.updateFromCallResponse(joinResponse.call);
         this.state.setMembers(joinResponse.members);
@@ -15801,6 +16240,36 @@ class Call {
         }
         return joinResponse;
     };
+    /**
+     * Whether the per-call media engine currently exists. True from join until leave.
+     *
+     * @internal an internal getter and should not be used outside the SDK.
+     */
+    get hasMediaEngine() {
+        return !!this.mediaEnginePromise;
+    }
+    /**
+     * Ensures a {@link CallMediaEngine} exists for this call's media session and
+     * returns it. Idempotent: the engine is created once via the registered
+     * provider (see `setCallMediaEngineProvider`) and cached until `leave()`
+     * disposes it. Concurrent callers (e.g. camera + microphone enabling in
+     * parallel) share the same engine because the in-flight creation promise is
+     * cached, never the unresolved result.
+     *
+     * @internal
+     */
+    ensureMediaFactory = async () => {
+        if (!this.mediaEnginePromise) {
+            const provider = getCallMediaEngineProvider();
+            this.logger.debug(`Requesting per-call media factory creation`);
+            this.mediaEnginePromise = Promise.resolve(provider()).catch((err) => {
+                // Drop the cached rejection so a retried join() can rebuild the engine
+                this.mediaEnginePromise = undefined;
+                throw err;
+            });
+        }
+        return this.mediaEnginePromise;
+    };
     /**
      * Handles the closing of the SFU signal connection.
      *
@@ -16325,12 +16794,16 @@ class Call {
             const streamStateProp = trackTypeToParticipantStreamKey(trackType);
             if (!streamStateProp)
                 continue;
-            this.state.updateParticipant(sessionId, (p) => ({
-                publishedTracks: mediaStream
-                    ? pushToIfMissing([...p.publishedTracks], trackType)
-                    : p.publishedTracks.filter((t) => t !== trackType),
-                [streamStateProp]: mediaStream,
-            }));
+            this.state.updateParticipant(sessionId, (p) => {
+                const currentStream = p[streamStateProp];
+                const isEchoedStream = this.subscriber?.isSelfSubscribedStream(currentStream);
+                return {
+                    publishedTracks: mediaStream
+                        ? pushToIfMissing([...p.publishedTracks], trackType)
+                        : p.publishedTracks.filter((t) => t !== trackType),
+                    [streamStateProp]: isEchoedStream ? currentStream : mediaStream,
+                };
+            });
         }
     };
     /**
@@ -16362,6 +16835,30 @@ class Call {
         this.tracer.trace('updatePublishOptions', options);
         this.clientPublishOptions = { ...this.clientPublishOptions, ...options };
     };
+    /**
+     * Set the E2EE (end-to-end encryption) manager for this call.
+     *
+     * Must be called before {@link join} so the RTCPeerConnection can be
+     * configured for E2EE.
+     *
+     * The manager is kept across {@link leave} so a rejoin of this same instance
+     * stays encrypted: do not dispose it while this call may be joined again.
+     * A disposed manager throws from `encrypt`/`decrypt` rather than silently
+     * publishing nothing, so re-attach a fresh one instead of reusing it.
+     *
+     * @param e2ee - Any `E2EEManager`. Use `EncryptionManager.create()` for the
+     *         built-in AES-GCM scheme, or pass your own implementation.
+     * @throws if called after the peer connections have been built (i.e. after
+     *         `join`): those PCs were already configured without an encryptor, so
+     *         adopting a manager now would silently publish/receive cleartext for
+     *         the live session.
+     */
+    setE2EEManager = (e2ee) => {
+        if (this.publisher || this.subscriber) {
+            throw new Error('setE2EEManager must be called before join()');
+        }
+        this.e2eeManager = e2ee;
+    };
     /**
      * Notifies the SFU that a noise cancellation process has started.
      *
@@ -16996,16 +17493,21 @@ class Call {
      *
      * @internal
      */
-    applyDeviceConfig = async (settings, publish, skipSpeakerApply) => {
+    applyDeviceConfig = async (settings, opts) => {
+        const { publish, 
+        // Skip speaker setup on RN until joining (explicitly passed as false during join())
+        skipSpeakerApply = isReactNative(), withDisabledDevices, } = opts;
         if (!skipSpeakerApply) {
-            this.speaker.apply(settings);
+            await this.speaker
+                .apply(settings)
+                .catch((err) => this.logger.warn('Speaker init failed', err));
         }
-        await this.camera.apply(settings.video, publish).catch((err) => {
-            this.logger.warn('Camera init failed', err);
-        });
-        await this.microphone.apply(settings.audio, publish).catch((err) => {
-            this.logger.warn('Mic init failed', err);
-        });
+        await this.camera
+            .apply(settings.video, publish, withDisabledDevices)
+            .catch((err) => this.logger.warn('Camera init failed', err));
+        await this.microphone
+            .apply(settings.audio, publish, withDisabledDevices)
+            .catch((err) => this.logger.warn('Mic init failed', err));
     };
     /**
      * Will begin tracking the given element for visibility changes within the
@@ -17677,15 +18179,17 @@ class StableWSConnection {
             this.client.logger.error(`Token not set, can't connect authenticate`);
             return;
         }
-        const authMessage = JSON.stringify({
+        const wsAuthMessage = {
             token,
+            products: [WSAuthMessageProductsEnum.VIDEO],
             user_details: {
                 id: user.id,
                 name: user.name,
                 image: user.image,
                 custom: user.custom,
             },
-        });
+        };
+        const authMessage = JSON.stringify(wsAuthMessage);
         this._log(`onopen() - Sending auth message ${authMessage}`, {}, 'trace');
         this.ws?.send(authMessage);
         this._log('onopen() - onopen callback', { wsID });
@@ -18511,11 +19015,11 @@ class StreamClient {
         return await this.wsConnection.connect(this.defaultWSTimeout);
     };
     getSdkVersion = () => this.options.clientAppIdentifier?.sdkVersion ||
-        "1.57.0";
+        "1.59.0";
     getUserAgent = () => {
         if (!this.cachedUserAgent) {
             const { clientAppIdentifier = {} } = this.options;
-            const { sdkName = 'js', sdkVersion = "1.57.0", ...extras } = clientAppIdentifier;
+            const { sdkName = 'js', sdkVersion = "1.59.0", ...extras } = clientAppIdentifier;
             this.cachedUserAgent = [
                 `stream-video-${sdkName}-v${sdkVersion}`,
                 ...Object.entries(extras).map(([key, value]) => `${key}=${value}`),
@@ -18878,7 +19382,6 @@ class ClientEventReporter {
             user_id: this.streamClient.userID || this.coordinatorConnectUserId,
             type: ctx?.callType,
             id: ctx?.callId,
-            call_cid: cid,
             stage: 'JoinInitiated',
             join_attempt_id: joinAttemptId,
             ...(coordinatorConnectId && {
@@ -19060,7 +19563,6 @@ class ClientEventReporter {
             startedAt: Date.now(),
             joinAttemptIdSnapshot: this.joinAttemptIds.get(cid),
             sfuId: this.getSfuId(cid),
-            userSessionId: this.getUserSessionId(cid),
             wasPreviouslyConnected: this.pcEverConnected.get(key) === true,
             lastIceState: iceConnectionState,
         };
@@ -19071,9 +19573,6 @@ class ClientEventReporter {
             peer_connection: role,
             was_previously_connected: pair.wasPreviouslyConnected,
             ...(pair.sfuId && { sfu_id: pair.sfuId }),
-            ...(pair.userSessionId && {
-                user_session_id: pair.userSessionId,
-            }),
             event_type: 'initiated',
         });
     };
@@ -19088,9 +19587,6 @@ class ClientEventReporter {
             peer_connection: role,
             was_previously_connected: pair.wasPreviouslyConnected,
             ...(pair.sfuId && { sfu_id: pair.sfuId }),
-            ...(pair.userSessionId && {
-                user_session_id: pair.userSessionId,
-            }),
             event_type: 'completed',
             outcome: 'success',
             retry_count_attempt: 0,
@@ -19108,9 +19604,6 @@ class ClientEventReporter {
             ...this.sessionIdField(cid),
             peer_connection: role,
             was_previously_connected: pair.wasPreviouslyConnected,
-            ...(pair.userSessionId && {
-                user_session_id: pair.userSessionId,
-            }),
             ...(pair.sfuId && { sfu_id: pair.sfuId }),
             event_type: 'completed',
             outcome: 'failure',
@@ -19123,7 +19616,6 @@ class ClientEventReporter {
         this.peerConnectionPairs.delete(key);
     };
     getSfuId = (cid) => this.callContexts.get(cid)?.getSfuId() ?? '';
-    getUserSessionId = (cid) => this.callContexts.get(cid)?.getUserSessionId() ?? '';
     sessionIdField = (cid) => {
         const callSessionId = this.callContexts.get(cid)?.getCallSessionId() ?? '';
         return callSessionId ? { call_session_id: callSessionId } : {};
@@ -19135,7 +19627,6 @@ class ClientEventReporter {
             user_id: this.streamClient.userID || this.coordinatorConnectUserId,
             type: ctx?.callType ?? '',
             id: ctx?.callId ?? '',
-            call_cid: cid,
             stage,
             stage_id: pair.sid,
             ...(pair.joinAttemptIdSnapshot && {
@@ -19386,6 +19877,7 @@ class StreamVideoClient {
                         }
                         else {
                             await call.updateFromRingingEvent(e);
+                            await call.get();
                         }
                     }
                     else {
@@ -19424,6 +19916,13 @@ class StreamVideoClient {
             this.logger.error(`Failed to init call from event ${e.type}`, err);
         }
     };
+    /**
+     * Queries the API for calls matching the given filters.
+     * @param data the query data.
+     */
+    doQueryCalls = (data) => {
+        return this.streamClient.post('/calls', data);
+    };
     /**
      * Rewatches the given calls with retry logic.
      * @param callsToReWatch array of call IDs to rewatch
@@ -19434,10 +19933,16 @@ class StreamVideoClient {
         for (let attempt = 0; attempt < maxRetries; attempt++) {
             try {
                 this.logger.info(`Rewatching calls ${callsToReWatch.join(', ')} attempt ${attempt + 1}`);
-                await this.queryCalls({
+                const response = await this.doQueryCalls({
                     watch: true,
                     filter_conditions: { cid: { $in: callsToReWatch } },
                 });
+                for (const c of response.calls) {
+                    const call = this.writeableStateStore.findCall(c.call.type, c.call.id);
+                    if (call) {
+                        call.updateFromCallStateResponse(c);
+                    }
+                }
                 return;
             }
             catch (err) {
@@ -19580,9 +20085,11 @@ class StreamVideoClient {
      * Will query the API for calls matching the given filters.
      *
      * @param data the query data.
+     * @param opts additional options, for tweaking the API behavior.
      */
-    queryCalls = async (data = {}) => {
-        const response = await this.streamClient.post('/calls', data);
+    queryCalls = async (data = {}, opts = {}) => {
+        const { withDisabledDevices = true } = opts;
+        const response = await this.doQueryCalls(data);
         const calls = [];
         for (const c of response.calls) {
             const call = new Call({
@@ -19596,7 +20103,10 @@ class StreamVideoClient {
                 clientStore: this.writeableStateStore,
             });
             call.state.updateFromCallResponse(c.call);
-            await call.applyDeviceConfig(c.call.settings, false, isReactNative());
+            await call.applyDeviceConfig(c.call.settings, {
+                publish: false,
+                withDisabledDevices,
+            });
             if (data.watch) {
                 await call.setup();
                 this.writeableStateStore.registerCall(call);
@@ -19748,5 +20258,552 @@ const humanize = (n) => {
     return String(n);
 };
 
-export { AudioSettingsRequestDefaultDeviceEnum, AudioSettingsResponseDefaultDeviceEnum, browsers as Browsers, Call, CallRecordingFailedEventRecordingTypeEnum, CallRecordingReadyEventRecordingTypeEnum, CallRecordingStartedEventRecordingTypeEnum, CallRecordingStoppedEventRecordingTypeEnum, CallState, CallType, CallTypes, CallingState, CameraManager, CameraManagerState, CreateDeviceRequestPushProviderEnum, DebounceType, DeviceManager, DeviceManagerState, DynascaleManager, ErrorFromResponse, FrameRecordingSettingsRequestModeEnum, FrameRecordingSettingsRequestQualityEnum, FrameRecordingSettingsResponseModeEnum, IndividualRecordingSettingsRequestModeEnum, IndividualRecordingSettingsResponseModeEnum, IngressAudioEncodingOptionsRequestChannelsEnum, IngressSourceRequestFpsEnum, IngressVideoLayerRequestCodecEnum, LayoutSettingsRequestNameEnum, MicrophoneManager, MicrophoneManagerState, NoiseCancellationSettingsModeEnum, OwnCapability, RTMPBroadcastRequestQualityEnum, RTMPSettingsRequestQualityEnum, RawRecordingSettingsRequestModeEnum, RawRecordingSettingsResponseModeEnum, RecordSettingsRequestModeEnum, RecordSettingsRequestQualityEnum, rxUtils as RxUtils, ScreenShareManager, ScreenShareState, events as SfuEvents, SfuJoinError, models as SfuModels, SfuTimeoutError, SpeakerManager, SpeakerState, StartClosedCaptionsRequestLanguageEnum, StartTranscriptionRequestLanguageEnum, StreamSfuClient, StreamVideoClient, StreamVideoReadOnlyStateStore, StreamVideoWriteableStateStore, TranscriptionSettingsRequestClosedCaptionModeEnum, TranscriptionSettingsRequestLanguageEnum, TranscriptionSettingsRequestModeEnum, TranscriptionSettingsResponseClosedCaptionModeEnum, TranscriptionSettingsResponseLanguageEnum, TranscriptionSettingsResponseModeEnum, VideoSettingsRequestCameraFacingEnum, VideoSettingsResponseCameraFacingEnum, ViewportTracker, VisibilityState, checkIfAudioOutputChangeSupported, combineComparators, conditional, createSoundDetector, defaultSortPreset, descending, deviceIds$, disposeOfMediaStream, dominantSpeaker, getAudioBrowserPermission, getAudioDevices, getAudioOutputDevices, getAudioStream, getClientDetails, getDeviceState, getScreenShareStream, getSdkInfo, getVideoBrowserPermission, getVideoDevices, getVideoStream, getWebRTCInfo, hasAudio$1 as hasAudio, hasInterruptedTrack, hasPausedTrack, hasScreenShare, hasScreenShareAudio, hasVideo, humanize, isPinned, livestreamOrAudioRoomSortPreset, logToConsole, name, noopComparator, paginatedLayoutSortPreset, pinned, publishingAudio, publishingVideo, reactionType, resolveDeviceId, role, screenSharing, setDeviceInfo, setOSInfo, setPowerState, setSdkInfo, setThermalState, setWebRTCInfo, speakerLayoutSortPreset, speaking, videoLoggerSystem, withParticipantSource };
+/** Default loopback stream wait timeout. */
+const LOOPBACK_STREAMS_WAIT_TIMEOUT_MS = 10 * 1000;
+/** Default loopback recording duration. */
+const DEFAULT_LOOPBACK_RECORDING_DURATION_MS = 10 * 1000;
+/** Shortest permitted loopback recording duration. */
+const MIN_LOOPBACK_RECORDING_DURATION_MS = 5 * 1000;
+/** Longest permitted loopback recording duration. */
+const MAX_LOOPBACK_RECORDING_DURATION_MS = 2 * 60 * 1000;
+/** Thrown when loopback tracks do not arrive in time. */
+class LoopbackStreamsTimeoutError extends Error {
+    constructor() {
+        super('Timed out waiting for loopback streams. Ensure the call was joined ' +
+            'with `allowOwnTracksLoopback: true` and that the SFU is configured ' +
+            'to echo self-sub tracks.');
+        this.name = 'LoopbackStreamsTimeoutError';
+    }
+}
+/**
+ * Returns the streams on the given participant that the SFU echoed back to us,
+ * ignoring the local capture streams the publishing path writes to the same
+ * fields.
+ */
+const getLoopbackStreams = (call, participant) => {
+    const { subscriber } = call ?? {};
+    const { audioStream, videoStream } = participant ?? {};
+    return {
+        loopbackVideoStream: subscriber?.isSelfSubscribedStream(videoStream)
+            ? videoStream
+            : undefined,
+        loopbackAudioStream: subscriber?.isSelfSubscribedStream(audioStream)
+            ? audioStream
+            : undefined,
+    };
+};
+/**
+ * Returns loopback tracks when all required tracks are present.
+ *
+ * Prefer {@link waitForLoopbackStreams}, which observes call state until the
+ * tracks arrive. This is the synchronous snapshot it is built from.
+ *
+ * @internal
+ */
+const getLoopbackTracks = (call, participant, includeVideo) => {
+    if (!participant)
+        return undefined;
+    const { loopbackAudioStream, loopbackVideoStream } = getLoopbackStreams(call, participant);
+    const audioTrack = loopbackAudioStream?.getAudioTracks()[0];
+    const videoTrack = includeVideo
+        ? loopbackVideoStream?.getVideoTracks()[0]
+        : undefined;
+    if (!audioTrack || (includeVideo && !videoTrack)) {
+        return undefined;
+    }
+    return { audioTrack, videoTrack };
+};
+/** Waits for the requested loopback tracks. */
+const waitForLoopbackStreams = (call, opts) => {
+    const callState = call.state;
+    const { includeVideo, signal, timeoutMs = LOOPBACK_STREAMS_WAIT_TIMEOUT_MS, } = opts;
+    return new Promise((resolve, reject) => {
+        const initial = getLoopbackTracks(call, callState.localParticipant, includeVideo);
+        if (initial) {
+            resolve(initial);
+            return;
+        }
+        if (signal.aborted) {
+            resolve(null);
+            return;
+        }
+        let settled = false;
+        const subscriptions = new Subscription();
+        const cleanup = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutId);
+            signal.removeEventListener('abort', onAbort);
+            subscriptions.unsubscribe();
+        };
+        const onAbort = () => {
+            cleanup();
+            resolve(null);
+        };
+        const timeoutId = setTimeout(() => {
+            cleanup();
+            reject(new LoopbackStreamsTimeoutError());
+        }, timeoutMs);
+        signal.addEventListener('abort', onAbort);
+        subscriptions.add(callState.localParticipant$.subscribe((participant) => {
+            const ready = getLoopbackTracks(call, participant, includeVideo);
+            if (ready) {
+                cleanup();
+                resolve(ready);
+            }
+        }));
+    });
+};
+/** Enables loopback audio while `fn` runs, then restores it. */
+const withLoopbackAudioEnabled = async (tracks, fn) => {
+    const restore = enableLoopbackAudio(tracks);
+    try {
+        return await fn();
+    }
+    finally {
+        restore();
+    }
+};
+/** Enables loopback audio and returns a restore function. */
+const enableLoopbackAudio = (tracks) => {
+    const { audioTrack } = tracks;
+    const previous = audioTrack?.enabled ?? false;
+    if (audioTrack) {
+        audioTrack.enabled = true;
+    }
+    return () => {
+        if (audioTrack) {
+            audioTrack.enabled = previous;
+        }
+    };
+};
+/** Clamps and rounds a loopback recording duration. */
+const clampLoopbackRecordingDuration = (durationMs) => Math.round(Math.min(MAX_LOOPBACK_RECORDING_DURATION_MS, Math.max(MIN_LOOPBACK_RECORDING_DURATION_MS, durationMs)));
+
+/** Single-use `MediaRecorder` wrapper that returns an in-memory blob. */
+class MediaStreamRecorder {
+    recording = promiseWithResolvers();
+    logger = videoLoggerSystem.getLogger('MediaStreamRecorder');
+    chunks = [];
+    timeoutId;
+    recorder;
+    tracks;
+    maxDurationMs;
+    constructor(stream, options = {}) {
+        if (typeof MediaRecorder === 'undefined') {
+            throw new Error('MediaRecorder is not available in this environment');
+        }
+        this.tracks = stream.getTracks();
+        if (this.tracks.length === 0) {
+            throw new Error('cannot record a MediaStream that has no tracks');
+        }
+        this.maxDurationMs = options.maxDurationMs;
+        this.recorder = new MediaRecorder(new MediaStream(this.tracks));
+        this.recorder.ondataavailable = (event) => {
+            if (event.data?.size)
+                this.chunks.push(event.data);
+        };
+        this.recorder.onstop = this.handleStop;
+        this.recorder.onerror = this.handleError;
+    }
+    /** Starts recording and resolves when recording stops. */
+    start = () => {
+        if (this.isSettled()) {
+            throw new Error('MediaStreamRecorder is single-use: this instance has already ' +
+                'recorded. Construct a new one.');
+        }
+        if (this.recorder.state === 'inactive') {
+            this.tracks.forEach((track) => track.addEventListener('ended', this.stop));
+            if (this.maxDurationMs !== undefined) {
+                this.timeoutId = setTimeout(this.stop, this.maxDurationMs);
+            }
+            this.recorder.start();
+        }
+        return this.recording.promise;
+    };
+    /** Stops recording early. */
+    stop = () => {
+        if (this.recorder.state !== 'inactive')
+            this.recorder.stop();
+    };
+    isSettled = () => this.recording.isResolved() || this.recording.isRejected();
+    detach = () => {
+        clearTimeout(this.timeoutId);
+        this.tracks.forEach((track) => track.removeEventListener('ended', this.stop));
+    };
+    handleStop = () => {
+        this.detach();
+        if (this.chunks.length === 0) {
+            this.logger.warn('MediaRecorder recording produced no data');
+            this.recording.resolve(null);
+            return;
+        }
+        const mimeType = this.chunks[0].type || this.recorder.mimeType;
+        this.recording.resolve({
+            blob: new Blob(this.chunks, { type: mimeType }),
+        });
+    };
+    handleError = (event) => {
+        if (this.isSettled())
+            return;
+        this.detach();
+        const error = event.error;
+        this.logger.error('MediaRecorder error', error);
+        this.recording.reject(error ?? new Error('MediaRecorder failed'));
+    };
+}
+
+/**
+ * Tiny, type-safe event emitter.
+ *
+ * Usage styles:
+ * - compose: `private readonly events = new TypedEventEmitter<MyMap>()`
+ * - extend:  `class Foo extends TypedEventEmitter<MyMap> {}`
+ *
+ * Listener exceptions (sync throw or rejected promise) are caught and logged,
+ * so one bad listener cannot break dispatch for the rest.
+ */
+class TypedEventEmitter {
+    logger;
+    byEvent = new Map();
+    constructor(logger = 'TypedEventEmitter') {
+        this.logger =
+            typeof logger === 'string' ? videoLoggerSystem.getLogger(logger) : logger;
+    }
+    on = (event, fn) => {
+        let listeners = this.byEvent.get(event);
+        if (!listeners) {
+            listeners = new Set();
+            this.byEvent.set(event, listeners);
+        }
+        listeners.add(fn);
+        return () => this.off(event, fn);
+    };
+    off = (event, fn) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners)
+            return;
+        listeners.delete(fn);
+        if (listeners.size === 0)
+            this.byEvent.delete(event);
+    };
+    emit = (event, payload) => {
+        const listeners = this.byEvent.get(event);
+        if (!listeners || listeners.size === 0)
+            return;
+        for (const listener of [...listeners]) {
+            this.invoke(() => listener(payload), event);
+        }
+    };
+    removeAllListeners = (event) => {
+        if (event === undefined) {
+            this.byEvent.clear();
+        }
+        else {
+            this.byEvent.delete(event);
+        }
+    };
+    invoke = (run, event) => {
+        try {
+            const result = run();
+            if (result && typeof result.then === 'function') {
+                result.catch((err) => {
+                    this.logger.warn(`Listener for '${String(event)}' rejected`, err);
+                });
+            }
+        }
+        catch (err) {
+            this.logger.warn(`Listener for '${String(event)}' threw`, err);
+        }
+    };
+}
+
+/**
+ * Distributes keys to the E2EE Web Worker and attaches encrypt/decrypt
+ * transforms to RTCRtpSenders and RTCRtpReceivers.
+ */
+class EncryptionManager extends TypedEventEmitter {
+    algorithm;
+    transform;
+    disposed = false;
+    piped;
+    userId;
+    worker;
+    workerUrl;
+    constructor(userId, worker, workerUrl, algorithm, transform) {
+        super('EncryptionManager');
+        this.userId = userId;
+        this.worker = worker;
+        this.workerUrl = workerUrl;
+        this.algorithm = algorithm;
+        this.transform = transform;
+        this.worker.addEventListener('message', this.handleWorkerMessage);
+        this.worker.addEventListener('error', this.handleWorkerError);
+    }
+    /**
+     * Whether this browser has WebRTC Encoded Transforms, which E2EE requires.
+     * Use it to guard UI, or to avoid calling {@link create} where it would throw.
+     */
+    static isSupported = () => {
+        return preferredTransform() !== undefined;
+    };
+    /**
+     * Create an EncryptionManager instance and initialize the E2EE Web Worker.
+     *
+     * @param userId - The local user's ID, normally `call.currentUserId`.
+     * @param options - the create options.
+     * @throws {Error} If the browser lacks Encoded Transforms.
+     *
+     * @example
+     * ```ts
+     * if (EncryptionManager.isSupported()) {
+     *   const e2ee = await EncryptionManager.create(call.currentUserId);
+     *   call.setE2EEManager(e2ee);
+     *   e2ee.setSharedKey(0, keyBytes);
+     * }
+     */
+    static create = async (userId, options) => {
+        const transform = preferredTransform();
+        if (!transform) {
+            throw new Error(`E2EE is not supported in this browser`);
+        }
+        const { e2eeWorker } = await Promise.resolve().then(function () { return e2eeWorker$1; });
+        const blob = new Blob([`(${e2eeWorker.toString()})()`], {
+            type: 'application/javascript',
+        });
+        const url = URL.createObjectURL(blob);
+        let worker;
+        try {
+            worker = new Worker(url, { name: 'stream-video-e2ee' });
+        }
+        catch (err) {
+            // e.g. a CSP `worker-src` without `blob:`. Don't leak the object URL.
+            URL.revokeObjectURL(url);
+            throw err;
+        }
+        const algorithm = options?.algorithm ?? 'AES-128-GCM';
+        return new EncryptionManager(userId, worker, url, algorithm, transform);
+    };
+    /**
+     * {@link dispose} terminates the worker, so `postMessage` becomes a silent
+     * no-op and an attached transform points at a dead worker: frames would stall
+     * forever with no error and no event. Throwing is also fail-closed, since a
+     * caller that swallows it still publishes nothing rather than cleartext.
+     */
+    assertUsable = () => {
+        if (this.disposed)
+            throw new Error(`EncryptionManager is disposed`);
+    };
+    /**
+     * Terminate the worker and release all resources.
+     *
+     * The manager is unusable afterwards and every other method throws. Call
+     * {@link create} for a new one. Safe to call more than once.
+     */
+    dispose = () => {
+        if (this.disposed)
+            return;
+        this.disposed = true;
+        this.piped = undefined;
+        this.worker.removeEventListener('message', this.handleWorkerMessage);
+        this.worker.removeEventListener('error', this.handleWorkerError);
+        this.worker.terminate();
+        URL.revokeObjectURL(this.workerUrl);
+        this.removeAllListeners();
+    };
+    /**
+     * Set a per-user AES-GCM encryption key in the worker's key store.
+     *
+     * Use it when each participant has their own key from a central authority.
+     * The receiver picks the right one by the `keyIndex` in the frame trailer.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - Increases with each rotation.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setKey = (userId, keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_key', userId, keyIndex, rawKey });
+    };
+    /**
+     * Fallback key for any user without a per-user key. The simplest E2EE mode:
+     * one key for everyone, usually passphrase-derived, no distribution needed.
+     * Setting an epoch makes it active for encryption while older epochs remain
+     * available to decrypt in-flight frames until {@link removeSharedKey}.
+     *
+     * @param keyIndex - An integer 0-255, since one trailer byte carries it.
+     * @param rawKey - 16 bytes for AES-128-GCM, 32 for AES-256-GCM.
+     */
+    setSharedKey = (keyIndex, rawKey) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.validateKeyLength(rawKey);
+        this.worker.postMessage({ type: 'cmd.set_shared_key', keyIndex, rawKey });
+    };
+    /**
+     * Remove one shared-key epoch from the worker's receive key ring.
+     *
+     * If this is the active epoch, shared-key encryption stops until
+     * {@link setSharedKey} succeeds again. An older epoch is not reactivated.
+     *
+     * @param keyIndex - The exact shared-key epoch to remove.
+     */
+    removeSharedKey = (keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_shared_key', keyIndex });
+    };
+    /**
+     * Retire one of a user's key epochs, leaving their other epochs usable.
+     *
+     * @param userId - The key owner.
+     * @param keyIndex - The exact epoch to remove. Absent epochs are a no-op.
+     */
+    removeKey = (userId, keyIndex) => {
+        this.assertUsable();
+        this.validateKeyIndex(keyIndex);
+        this.worker.postMessage({ type: 'cmd.remove_key', userId, keyIndex });
+    };
+    /**
+     * Drop every key a user holds, revoking their ability to decrypt later
+     * frames. Call it when a participant leaves.
+     *
+     * To retire one rotated epoch instead, use {@link removeKey}.
+     */
+    removeAllKeys = (userId) => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.remove_all_keys', userId });
+    };
+    /**
+     * Called by the Publisher when it adds a transceiver.
+     *
+     * @param sender - The sender to encrypt.
+     * @param codec - Codec name, e.g. 'vp8', selecting the clear-byte rules.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    encrypt = (sender, codec, trackType) => {
+        this.assertUsable();
+        this.pipe(sender, {
+            operation: 'encode',
+            userId: this.userId,
+            codec,
+            trackType,
+        });
+    };
+    /**
+     * Called by the Subscriber when a remote track arrives.
+     *
+     * @param receiver - The receiver to decrypt.
+     * @param userId - The remote user, for key lookup in the worker.
+     * @param trackType - Optional label; only groups perf stats.
+     * @internal
+     */
+    decrypt = (receiver, userId, trackType) => {
+        this.assertUsable();
+        this.pipe(receiver, { operation: 'decode', userId, trackType });
+    };
+    /** Pipe through the worker's transform, tracking targets to avoid double-piping. */
+    pipe = (target, options) => {
+        if (this.transform === 'script') {
+            target.transform = new RTCRtpScriptTransform(this.worker, options);
+            return;
+        }
+        if ((this.piped ??= new WeakSet()).has(target))
+            return;
+        this.piped.add(target);
+        // @ts-expect-error createEncodedStreams is not in the standard typedefs
+        const { readable, writable } = target.createEncodedStreams();
+        this.worker.postMessage({ type: 'cmd.setup_transform', ...options, readable, writable }, [readable, writable]);
+    };
+    /**
+     * Toggle periodic performance reporting from the E2EE worker.
+     *
+     * While on, the worker emits `e2ee.perf_report` once per second with per-track
+     * FPS and crypto timings. Useful for debugging throughput.
+     */
+    enablePerformanceReporting = (enabled) => {
+        this.assertUsable();
+        this.worker.postMessage({
+            type: 'cmd.enable_performance_reporting',
+            enabled,
+        });
+    };
+    /**
+     * Request a snapshot of the worker's keys. It arrives later as the
+     * `e2ee.key_state` event, listing fingerprints only, never key material.
+     */
+    requestKeyState = () => {
+        this.assertUsable();
+        this.worker.postMessage({ type: 'cmd.request_key_state' });
+    };
+    handleWorkerMessage = (e) => {
+        const { type, ...payload } = e.data ?? {};
+        if (type === 'e2ee.error') {
+            this.logger.error(e.data.message);
+            return;
+        }
+        const event = type;
+        this.logger.debug('Dispatching', event, payload);
+        this.emit(event, payload);
+    };
+    handleWorkerError = (e) => {
+        this.logger.error('Unhandled worker error:', e.message);
+    };
+    validateKeyLength = (rawKey) => {
+        const is256 = this.algorithm === 'AES-256-GCM';
+        const expected = is256 ? 32 : 16;
+        if (rawKey.byteLength !== expected) {
+            throw new Error(`Key must be exactly ${expected} bytes (${is256 ? 'AES-256' : 'AES-128'})`);
+        }
+    };
+    /**
+     * One trailer byte carries the keyIndex. A larger value would truncate to
+     * `keyIndex & 0xFF`, so the receiver would look up the wrong key and fail
+     * every decrypt. Reject it rather than ship a silently broken key epoch.
+     */
+    validateKeyIndex = (keyIndex) => {
+        if (!Number.isInteger(keyIndex) || keyIndex < 0 || keyIndex > 255) {
+            throw new Error(`keyIndex must be an integer between 0 and 255, got ${keyIndex}`);
+        }
+    };
+}
+
+/**
+ * E2EE worker. The build populates it.
+ *
+ * The actual implementation lives in `e2ee-worker/e2ee-worker-impl.ts` and its
+ * sibling modules (`constants.ts`, `codec.ts`, `crypto.ts`, `utils.ts`,
+ * `types.ts`), all written as real TypeScript with full type checking
+ * and import support.
+ *
+ * ## How it works
+ *
+ * 1. You edit files in `e2ee-worker/` as normal TypeScript
+ * 2. `yarn build` runs Rollup, which invokes `rollup-plugin-inline-worker`
+ * 3. The plugin bundles `e2ee-worker/e2ee-worker-impl.ts` (and its imports)
+ *    into a single function via a nested Rollup + TypeScript build
+ * 4. The function replaces this file's export at build time
+ * 5. `EncryptionManager.create()` creates a Worker from `e2eeWorker.toString()`
+ *
+ * In tests, this module is mocked (see `__tests__/EncryptionManager.test.ts`),
+ * so the placeholder is never evaluated.
+ *
+ * @see e2ee-worker/e2ee-worker-impl.ts - the entry point
+ * @see ../../plugins/rollup-plugin-inline-worker.ts - the Rollup plugin
+ * @see EncryptionManager.ts - consumes e2eeWorker
+ */
+function e2eeWorker() {
+    // will be populated at build time
+}
+
+var e2eeWorker$1 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    e2eeWorker: e2eeWorker
+});
+
+export { AudioSettingsRequestDefaultDeviceEnum, AudioSettingsResponseDefaultDeviceEnum, browsers as Browsers, Call, CallRecordingFailedEventRecordingTypeEnum, CallRecordingReadyEventRecordingTypeEnum, CallRecordingStartedEventRecordingTypeEnum, CallRecordingStoppedEventRecordingTypeEnum, CallState, CallType, CallTypes, CallingState, CameraManager, CameraManagerState, CreateDeviceRequestPushProviderEnum, DEFAULT_LOOPBACK_RECORDING_DURATION_MS, DebounceType, DeviceManager, DeviceManagerState, DynascaleManager, EncryptionManager, EncryptionSettingsRequestModeEnum, EncryptionSettingsResponseModeEnum, ErrorFromResponse, FrameRecordingSettingsRequestModeEnum, FrameRecordingSettingsRequestQualityEnum, FrameRecordingSettingsResponseModeEnum, HLSSettingsRequestQualityTracksEnum, IndividualRecordingSettingsRequestModeEnum, IndividualRecordingSettingsRequestOutputTypesEnum, IndividualRecordingSettingsResponseModeEnum, IngressAudioEncodingOptionsRequestChannelsEnum, IngressSourceRequestFpsEnum, IngressVideoLayerRequestCodecEnum, LOOPBACK_STREAMS_WAIT_TIMEOUT_MS, LayoutSettingsRequestNameEnum, LoopbackStreamsTimeoutError, MAX_LOOPBACK_RECORDING_DURATION_MS, MIN_LOOPBACK_RECORDING_DURATION_MS, MediaStreamRecorder, MicrophoneManager, MicrophoneManagerState, NoiseCancellationSettingsModeEnum, OwnCapability, RTMPBroadcastRequestQualityEnum, RTMPSettingsRequestQualityEnum, RawRecordingSettingsRequestModeEnum, RawRecordingSettingsResponseModeEnum, RecordSettingsRequestModeEnum, RecordSettingsRequestQualityEnum, RequestPermissionRequestPermissionsEnum, rxUtils as RxUtils, ScreenShareManager, ScreenShareState, events as SfuEvents, SfuJoinError, models as SfuModels, SfuTimeoutError, SpeakerManager, SpeakerState, StartClosedCaptionsRequestLanguageEnum, StartTranscriptionRequestLanguageEnum, StreamSfuClient, StreamVideoClient, StreamVideoReadOnlyStateStore, StreamVideoWriteableStateStore, TranscriptionSettingsRequestClosedCaptionModeEnum, TranscriptionSettingsRequestLanguageEnum, TranscriptionSettingsRequestModeEnum, TranscriptionSettingsResponseClosedCaptionModeEnum, TranscriptionSettingsResponseLanguageEnum, TranscriptionSettingsResponseModeEnum, TranslationSettingsLanguagesEnum, UpdateUserPermissionsRequestGrantPermissionsEnum, UpdateUserPermissionsRequestRevokePermissionsEnum, VideoSettingsRequestCameraFacingEnum, VideoSettingsResponseCameraFacingEnum, ViewportTracker, VisibilityState, WSAuthMessageProductsEnum, checkIfAudioOutputChangeSupported, clampLoopbackRecordingDuration, combineComparators, conditional, createSoundDetector, defaultSortPreset, descending, deviceIds$, disposeOfMediaStream, dominantSpeaker, enableLoopbackAudio, getAudioBrowserPermission, getAudioDevices, getAudioOutputDevices, getAudioStream, getCallMediaEngineProvider, getClientDetails, getDeviceState, getLoopbackStreams, getLoopbackTracks, getScreenShareStream, getSdkInfo, getVideoBrowserPermission, getVideoDevices, getVideoStream, getWebRTCInfo, hasAudio$1 as hasAudio, hasInterruptedTrack, hasPausedTrack, hasScreenShare, hasScreenShareAudio, hasVideo, humanize, isPinned, livestreamOrAudioRoomSortPreset, logToConsole, name, noopComparator, paginatedLayoutSortPreset, pinned, publishingAudio, publishingVideo, reactionType, resolveDeviceId, role, screenSharing, setCallMediaEngineProvider, setDeviceInfo, setOSInfo, setPowerState, setSdkInfo, setThermalState, setWebRTCInfo, speakerLayoutSortPreset, speaking, videoLoggerSystem, waitForLoopbackStreams, withLoopbackAudioEnabled, withParticipantSource };
 //# sourceMappingURL=index.es.js.map