@stream-io/video-client 1.60.0 → 1.61.0

package/src/__tests__/Call.ringingLifecycle.test.ts

@@ -0,0 +1,242 @@
+/**
+ * @vitest-environment happy-dom
+ */
+
+import '../rtc/__tests__/mocks/webrtc.mocks';
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Call } from '../Call';
+import { CallingState } from '../store';
+import { StreamClient } from '../coordinator/connection/client';
+import { ClientEventReporter } from '../reporting';
+import { generateUUIDv4 } from '../coordinator/connection/utils';
+import { StreamVideoWriteableStateStore } from '../store';
+
+/**
+ * The core's whole part in the React Native ringing lifecycle: await RN's
+ * preparation inside the join, tell RN when a ringing join failed terminally or
+ * the call ended, and stop a join that a `leave()` overtook. What preparation
+ * and release actually do is RN's, and is tested there.
+ */
+
+const createCall = (ringing: boolean) => {
+  const streamClient = new StreamClient('abc');
+  return new Call({
+    type: 'test',
+    id: generateUUIDv4(),
+    ringing,
+    streamClient,
+    clientEventReporter: new ClientEventReporter({
+      streamClient,
+      enabled: false,
+    }),
+    clientStore: new StreamVideoWriteableStateStore(),
+  });
+};
+
+const install = (overrides: Record<string, unknown> = {}) => {
+  const beforeJoin = vi.fn(() => Promise.resolve());
+  const onJoinFailed = vi.fn(() => Promise.resolve());
+  const onLeave = vi.fn();
+  const callingX = { joinCall: vi.fn(), endCall: vi.fn() };
+  globalThis.streamRNVideoSDK = {
+    ringingCallLifecycle: { beforeJoin, onJoinFailed, onLeave },
+    callingX,
+    // `leave()` reaches this unconditionally; the globals object is all-or-nothing
+    callManager: { setup: vi.fn(), start: vi.fn(), stop: vi.fn() },
+    ...overrides,
+  } as any;
+  return { beforeJoin, onJoinFailed, onLeave, callingX };
+};
+
+describe('ringing call lifecycle integration', () => {
+  beforeEach(() => {
+    globalThis.streamRNVideoSDK = undefined;
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      headers: { get: () => 'AMS1-P2' },
+    } as Response);
+  });
+
+  afterEach(() => {
+    globalThis.streamRNVideoSDK = undefined;
+    vi.restoreAllMocks();
+  });
+
+  it('prepares a ringing call before it joins', async () => {
+    const { beforeJoin, callingX } = install();
+    const call = createCall(true);
+    const doJoin = vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    await call.join();
+
+    expect(beforeJoin).toHaveBeenCalledTimes(1);
+    expect(beforeJoin).toHaveBeenCalledBefore(callingX.joinCall);
+    expect(doJoin).toHaveBeenCalledTimes(1);
+  });
+
+  it('leaves ordinary calls to join themselves', async () => {
+    const { beforeJoin, onJoinFailed } = install();
+    const call = createCall(false);
+    vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    await call.join();
+
+    expect(beforeJoin).not.toHaveBeenCalled();
+    expect(onJoinFailed).not.toHaveBeenCalled();
+  });
+
+  it('does not join when preparation fails, and reports the failure', async () => {
+    const { beforeJoin, onJoinFailed } = install();
+    beforeJoin.mockRejectedValue(new Error('no key'));
+    const call = createCall(true);
+    const doJoin = vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    await expect(call.join()).rejects.toThrow('no key');
+
+    expect(doJoin).not.toHaveBeenCalled();
+    expect(onJoinFailed).toHaveBeenCalledWith(call);
+  });
+
+  it('reports a terminal join failure, keeping the original error', async () => {
+    const { onJoinFailed } = install();
+    const call = createCall(true);
+    vi.spyOn(call as any, 'doJoin').mockRejectedValue(new Error('sfu down'));
+
+    await expect(call.join({ maxJoinRetries: 1 })).rejects.toThrow('sfu down');
+
+    expect(onJoinFailed).toHaveBeenCalledWith(call);
+  });
+
+  it('refuses a duplicate join on a live call without tearing it down', async () => {
+    const { beforeJoin, onJoinFailed, onLeave } = install();
+    const call = createCall(true);
+    vi.spyOn(call as any, 'doJoin').mockImplementation(async () => {
+      call.state.setCallingState(CallingState.JOINED);
+    });
+
+    await call.join();
+    await expect(call.join()).rejects.toThrow('Illegal State');
+
+    expect(beforeJoin).toHaveBeenCalledTimes(1);
+    // the guard sits ahead of the failure boundary, so nothing is released
+    expect(onJoinFailed).not.toHaveBeenCalled();
+    expect(onLeave).not.toHaveBeenCalled();
+  });
+
+  it('tells the owner when a ringing call ends', async () => {
+    const { onLeave } = install();
+    const call = createCall(true);
+
+    await call.leave();
+
+    expect(onLeave).toHaveBeenCalledWith(call);
+    expect(call.state.callingState).toBe(CallingState.LEFT);
+  });
+
+  it('does not tell the owner about an ordinary call', async () => {
+    const { onLeave } = install();
+
+    await createCall(false).leave();
+
+    expect(onLeave).not.toHaveBeenCalled();
+  });
+
+  it('keeps an app-owned manager across leave, as setE2EEManager promises', async () => {
+    install();
+    const call = createCall(true);
+    const manager = { encrypt: vi.fn(), decrypt: vi.fn() } as any;
+    call.setE2EEManager(manager);
+
+    await call.leave();
+
+    expect(call.e2eeManager).toBe(manager);
+  });
+
+  it('abandons a join that a leave overtook during native registration', async () => {
+    let finishRegistration: () => void = () => {};
+    const { callingX, onLeave, onJoinFailed } = install();
+    callingX.joinCall.mockImplementation(
+      () => new Promise<void>((resolve) => (finishRegistration = resolve)),
+    );
+    const call = createCall(true);
+    const doJoin = vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    const joining = call.join();
+    await vi.waitFor(() => expect(callingX.joinCall).toHaveBeenCalled());
+    await call.leave({ reject: false });
+    finishRegistration();
+
+    // A superseding leave is not a join failure: the join settles quietly rather
+    // than rejecting, and the error path stays shut.
+    await expect(joining).resolves.toBeUndefined();
+    expect(onJoinFailed).not.toHaveBeenCalled();
+    expect(callingX.endCall).not.toHaveBeenCalledWith(call, 'error');
+    // Release still happens - `leave()` itself fires it, which is why the join
+    // does not need to.
+    expect(onLeave).toHaveBeenCalledTimes(1);
+    // `doJoin` captures the generation itself, so this check has to be here
+    expect(doJoin).not.toHaveBeenCalled();
+  });
+
+  it('does not resume the retry loop after a leave during backoff', async () => {
+    vi.useFakeTimers();
+    try {
+      install();
+      const call = createCall(true);
+      const doJoin = vi
+        .spyOn(call as any, 'doJoin')
+        .mockRejectedValue(new Error('recoverable'));
+
+      const joining = call.join().catch(() => {});
+      await vi.waitFor(() => expect(doJoin).toHaveBeenCalledTimes(1));
+      await call.leave({ reject: false });
+      await vi.advanceTimersByTimeAsync(30_000);
+      await joining;
+
+      expect(doJoin).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('prepares an outgoing call that this join makes ringing', async () => {
+    const { beforeJoin } = install();
+    // a fresh instance, not ringing until its first join says so
+    const call = createCall(false);
+    vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    await call.join({ ring: true });
+
+    // reading `call.ringing` before applying `options.ring` would skip
+    // preparation entirely on this path
+    expect(beforeJoin).toHaveBeenCalledTimes(1);
+  });
+
+  it('stops a join that a leave overtook during preparation', async () => {
+    let releaseHook: () => void = () => {};
+    const { beforeJoin, onLeave, onJoinFailed } = install();
+    beforeJoin.mockImplementation(
+      () => new Promise<void>((resolve) => (releaseHook = resolve)),
+    );
+    const call = createCall(true);
+    const doJoin = vi.spyOn(call as any, 'doJoin').mockResolvedValue(undefined);
+
+    const joining = call.join();
+    await vi.waitFor(() => expect(beforeJoin).toHaveBeenCalled());
+    await call.leave({ reject: false });
+    releaseHook();
+
+    await expect(joining).resolves.toBeUndefined();
+    expect(onJoinFailed).not.toHaveBeenCalled();
+    // Whatever `beforeJoin` installed is released exactly once, by the `leave()`
+    // that overtook the join rather than by the join itself.
+    expect(onLeave).toHaveBeenCalledTimes(1);
+    expect(doJoin).not.toHaveBeenCalled();
+    expect(call.state.callingState).toBe(CallingState.LEFT);
+  });
+
+  it('is inert when no React Native globals are registered', async () => {
+    const call = createCall(true);
+    await expect(call.leave()).resolves.not.toThrow();
+  });
+});

package/src/rtc/Publisher.ts

@@ -150,7 +150,9 @@ export class Publisher extends BasePeerConnection {
     const sendEncodings = isSvcCodec(publishOption.codec?.name)
       ? toSvcEncodings(encodings)
       : encodings;
-    const transceiver = this.pc.addTransceiver(track, {
+    // An E2EE sender must never have media before its transform is attached,
+    // including when another track or an ICE restart negotiates this PC.
+    const transceiver = this.pc.addTransceiver(this.e2ee ? track.kind : track, {
       direction: 'sendonly',
       sendEncodings,
     });
@@ -161,23 +163,75 @@ export class Publisher extends BasePeerConnection {
     this.trackIdToTrackType.set(track.id, trackType);
     this.logger.debug(`Added ${TrackType[trackType]} transceiver`);
 
-    const params = transceiver.sender.getParameters();
-    params.degradationPreference =
-      toRTCDegradationPreference(publishOption.degradationPreference) ??
-      'maintain-framerate';
-    await transceiver.sender.setParameters(params);
     if (this.e2ee) {
-      this.e2ee.encrypt(
-        transceiver.sender,
-        publishOption.codec?.name.toLowerCase(),
-        TrackType[publishOption.trackType],
-      );
-      this.logger.debug('E2EE encryptor attached to sender');
+      await this.initEncryptedSender(transceiver, track, publishOption);
+    } else {
+      await this.setDegradationPreference(transceiver.sender, publishOption);
     }
 
     await this.negotiate();
   };
 
+  /**
+   * Attaches the encryptor, applies sender parameters, then attaches the track.
+   *
+   * `encrypt` must run before the first await: Chrome short-circuits a sender
+   * whose encoded streams aren't created in the task that created it, and the
+   * track goes on last so the sender has no media until both steps succeed.
+   */
+  private initEncryptedSender = async (
+    transceiver: RTCRtpTransceiver,
+    track: MediaStreamTrack,
+    publishOption: PublishOption,
+  ) => {
+    try {
+      const { sender } = transceiver;
+      const codec = publishOption.codec?.name.toLowerCase();
+      this.e2ee!.encrypt(sender, codec, TrackType[publishOption.trackType]);
+      this.logger.debug('E2EE encryptor attached to sender');
+      await this.setDegradationPreference(sender, publishOption);
+      await sender.replaceTrack(track);
+    } catch (err) {
+      this.retireTransceiver(transceiver, track);
+      throw err;
+    }
+  };
+
+  private setDegradationPreference = async (
+    sender: RTCRtpSender,
+    publishOption: PublishOption,
+  ) => {
+    const params = sender.getParameters();
+    params.degradationPreference =
+      toRTCDegradationPreference(publishOption.degradationPreference) ??
+      'maintain-framerate';
+    await sender.setParameters(params);
+  };
+
+  /**
+   * Discards a sender whose E2EE initialization failed.
+   *
+   * A partially initialized sender may carry no transform, so publish() must
+   * not reuse it: retiring it from the cache is what keeps a later publish or
+   * ICE restart from putting cleartext on the wire. Cleanup cannot throw, so
+   * the initialization failure is what reaches the caller.
+   */
+  private retireTransceiver = (
+    transceiver: RTCRtpTransceiver,
+    track: MediaStreamTrack,
+  ) => {
+    this.transceiverCache.remove(transceiver);
+    this.trackIdToTrackType.delete(track.id);
+    // on React Native a clone shares its native source, so stopping it here
+    // would stop the track the caller passed in. dispose() releases it.
+    if (!isReactNative()) this.stopTrack(track);
+    try {
+      transceiver.stop();
+    } catch (err) {
+      this.logger.debug('Failed to stop a retired transceiver', err);
+    }
+  };
+
   /**
    * Updates the transceiver with the given track and track type.
    */

package/src/rtc/TransceiverCache.ts

@@ -21,6 +21,23 @@ export class TransceiverCache {
     this.transceiverOrder.push(bundle.transceiver);
   };
 
+  /**
+   * Retires a failed sender from the reusable cache.
+   *
+   * A transceiver that never reached an m-section also leaves the creation
+   * history: once stopped, it is left out of every later offer, so counting
+   * it would shift the `mid` index of every transceiver added after it. One
+   * that is already associated keeps its slot, since its m-section survives
+   * as a rejected one.
+   */
+  remove = (transceiver: RTCRtpTransceiver) => {
+    const index = this.cache.findIndex((b) => b.transceiver === transceiver);
+    if (index !== -1) this.cache.splice(index, 1);
+    if (transceiver.mid) return;
+    const orderIndex = this.transceiverOrder.indexOf(transceiver);
+    if (orderIndex !== -1) this.transceiverOrder.splice(orderIndex, 1);
+  };
+
   /**
    * Gets the transceiver for the given publish option.
    */

package/src/rtc/__tests__/Publisher.test.ts

@@ -26,6 +26,7 @@ import { TransceiverCache } from '../TransceiverCache';
 import { promiseWithResolvers } from '../../helpers/promise';
 import { settled } from '../../helpers/concurrency';
 import { isFirefox } from '../../helpers/browsers';
+import { isReactNative } from '../../helpers/platforms';
 
 vi.mock('../../StreamSfuClient', () => {
   console.log('MOCKING StreamSfuClient');
@@ -40,6 +41,12 @@ vi.mock('../../helpers/browsers', async (importOriginal) => {
   return { ...actual, isFirefox: vi.fn().mockReturnValue(false) };
 });
 
+vi.mock('../../helpers/platforms', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('../../helpers/platforms')>();
+  return { ...actual, isReactNative: vi.fn().mockReturnValue(false) };
+});
+
 describe('Publisher', () => {
   const sessionId = 'session-id-test';
   let publisher: Publisher;
@@ -106,6 +113,208 @@ describe('Publisher', () => {
   });
 
   describe('Publishing', () => {
+    describe('E2EE initialization failures', () => {
+      afterEach(() => {
+        vi.mocked(isReactNative).mockReturnValue(false);
+      });
+
+      const setup = async () => {
+        await publisher.dispose();
+        const e2ee = { encrypt: vi.fn(), decrypt: vi.fn() };
+        publisher = new Publisher(
+          {
+            sfuClient,
+            dispatcher,
+            state,
+            tag: 'test',
+            enableTracing: false,
+            e2ee,
+          },
+          [
+            fromPartial<PublishOption>({
+              id: 1,
+              trackType: TrackType.VIDEO,
+              codec: { name: 'vp9' },
+            }),
+          ],
+        );
+        const transceivers: RTCRtpTransceiver[] = [];
+        vi.mocked(publisher['pc'].addTransceiver).mockImplementation((kind) => {
+          expect(kind).toBe('video');
+          const transceiver = new RTCRtpTransceiver();
+          vi.mocked(transceiver.sender.replaceTrack).mockImplementation(
+            async (track) => {
+              expect(e2ee.encrypt).toHaveBeenCalledWith(
+                transceiver.sender,
+                'vp9',
+                'VIDEO',
+              );
+              Object.assign(transceiver.sender, { track });
+            },
+          );
+          transceivers.push(transceiver);
+          return transceiver;
+        });
+        const track = new MediaStreamTrack();
+        vi.mocked(track.clone).mockImplementation(() => new MediaStreamTrack());
+        const realNegotiate = publisher['negotiate'];
+        const negotiate = vi.fn<Publisher['negotiate']>().mockResolvedValue();
+        publisher['negotiate'] = negotiate;
+        return { e2ee, transceivers, track, negotiate, realNegotiate };
+      };
+
+      it.each([
+        'encrypt',
+        'getParameters',
+        'setParameters',
+        'replaceTrack',
+      ] as const)(
+        'retires the sender after %s fails and attaches encryption on retry',
+        async (failurePoint) => {
+          const { e2ee, transceivers, track, negotiate } = await setup();
+          const error = new Error('initialization failed');
+          e2ee.encrypt.mockImplementationOnce((sender: RTCRtpSender) => {
+            expect(sender.track).toBeNull();
+            if (failurePoint === 'encrypt') throw error;
+            if (failurePoint === 'getParameters') {
+              vi.mocked(sender.getParameters).mockImplementationOnce(() => {
+                throw error;
+              });
+            } else {
+              vi.mocked(sender[failurePoint]).mockRejectedValueOnce(error);
+            }
+          });
+          await expect(publisher.publish(track, TrackType.VIDEO)).rejects.toBe(
+            error,
+          );
+          const failed = transceivers[0];
+          expect(failed.sender.track).toBeNull();
+          expect(failed.stop).toHaveBeenCalledOnce();
+          expect(publisher['transceiverCache'].items()).toHaveLength(0);
+          expect(publisher['clonedTracks'].size).toBe(0);
+          expect(negotiate).not.toHaveBeenCalled();
+
+          await publisher.publish(track, TrackType.VIDEO);
+          expect(transceivers).toHaveLength(2);
+          expect(e2ee.encrypt).toHaveBeenLastCalledWith(
+            transceivers[1].sender,
+            'vp9',
+            'VIDEO',
+          );
+          expect(transceivers[1].sender.track).not.toBeNull();
+          expect(publisher['transceiverCache'].indexOf(failed)).toBe(-1);
+          expect(publisher['transceiverCache'].indexOf(transceivers[1])).toBe(
+            0,
+          );
+          expect(negotiate).toHaveBeenCalledOnce();
+        },
+      );
+
+      it('keeps the mid index of a retired sender that reached an m-section', async () => {
+        const { e2ee, transceivers, track } = await setup();
+        const error = new Error('initialization failed');
+        e2ee.encrypt.mockImplementationOnce((sender: RTCRtpSender) => {
+          Object.assign(transceivers[0], { mid: '0' });
+          vi.mocked(sender.replaceTrack).mockRejectedValueOnce(error);
+        });
+        await expect(publisher.publish(track, TrackType.VIDEO)).rejects.toBe(
+          error,
+        );
+        expect(publisher['transceiverCache'].items()).toHaveLength(0);
+        expect(publisher['transceiverCache'].indexOf(transceivers[0])).toBe(0);
+
+        await publisher.publish(track, TrackType.VIDEO);
+        expect(publisher['transceiverCache'].indexOf(transceivers[1])).toBe(1);
+      });
+
+      it('reports the initialization failure even when cleanup throws', async () => {
+        const { e2ee, transceivers, track } = await setup();
+        const error = new Error('initialization failed');
+        e2ee.encrypt.mockImplementationOnce(() => {
+          vi.mocked(transceivers[0].stop).mockImplementationOnce(() => {
+            throw new Error('peer connection is closed');
+          });
+          throw error;
+        });
+        await expect(publisher.publish(track, TrackType.VIDEO)).rejects.toBe(
+          error,
+        );
+        expect(publisher['transceiverCache'].items()).toHaveLength(0);
+        expect(publisher['clonedTracks'].size).toBe(0);
+      });
+
+      it('leaves the cloned track alone on React Native', async () => {
+        vi.mocked(isReactNative).mockReturnValue(true);
+        const { e2ee, transceivers, track } = await setup();
+        const error = new Error('initialization failed');
+        e2ee.encrypt.mockImplementationOnce(() => {
+          throw error;
+        });
+        await expect(publisher.publish(track, TrackType.VIDEO)).rejects.toBe(
+          error,
+        );
+        const [clone] = publisher['clonedTracks'];
+        expect(clone.stop).not.toHaveBeenCalled();
+        expect(transceivers[0].stop).toHaveBeenCalledOnce();
+        expect(publisher['transceiverCache'].items()).toHaveLength(0);
+      });
+
+      it('reuses an encrypted sender when only negotiation failed', async () => {
+        const { e2ee, transceivers, track, negotiate } = await setup();
+        const error = new Error('negotiation failed');
+        negotiate.mockRejectedValueOnce(error);
+        await expect(publisher.publish(track, TrackType.VIDEO)).rejects.toBe(
+          error,
+        );
+        expect(transceivers[0].sender.track).not.toBeNull();
+        expect(transceivers[0].stop).not.toHaveBeenCalled();
+        await publisher.publish(track, TrackType.VIDEO);
+        expect(transceivers).toHaveLength(1);
+        expect(e2ee.encrypt).toHaveBeenCalledOnce();
+        expect(negotiate).toHaveBeenCalledTimes(2);
+      });
+
+      it('has no media to expose if ICE restart negotiates during parameter setup', async () => {
+        const { e2ee, transceivers, track, negotiate, realNegotiate } =
+          await setup();
+        negotiate.mockImplementation(realNegotiate);
+        publisher['publishOptions'].push(
+          fromPartial<PublishOption>({
+            id: 2,
+            trackType: TrackType.VIDEO,
+            codec: { name: 'vp9' },
+          }),
+        );
+        sfuClient.setPublisher = vi
+          .fn()
+          .mockResolvedValue({ response: { sdp: 'answer-sdp' } });
+        const parameters = promiseWithResolvers<void>();
+        e2ee.encrypt
+          .mockImplementationOnce(() => {})
+          .mockImplementationOnce((sender: RTCRtpSender) => {
+            vi.mocked(sender.setParameters).mockReturnValueOnce(
+              parameters.promise,
+            );
+          });
+        const publish = publisher.publish(track, TrackType.VIDEO);
+        await vi.waitFor(() => expect(e2ee.encrypt).toHaveBeenCalledTimes(2));
+        const [published, pending] = transceivers;
+        expect(pending.sender.track).toBeNull();
+        expect(pending.sender.replaceTrack).not.toHaveBeenCalled();
+
+        await publisher.restartIce();
+        const restart = vi.mocked(sfuClient.setPublisher).mock.calls[1][0];
+        expect(restart.tracks.map((t) => t.trackId)).toEqual([
+          published.sender.track!.id,
+        ]);
+
+        parameters.resolve();
+        await publish;
+        expect(pending.sender.track).not.toBeNull();
+        expect(sfuClient.setPublisher).toHaveBeenCalledTimes(3);
+      });
+    });
+
     it('should throw when publishing ended tracks', async () => {
       const track = new MediaStreamTrack();
       // @ts-expect-error readonly field

package/src/rtc/__tests__/mocks/webrtc.mocks.ts

@@ -60,6 +60,7 @@ const RTCRtpTransceiverMock = vi.fn(function (): Partial<RTCRtpTransceiver> {
       transform: null,
     },
     setCodecPreferences: vi.fn(),
+    stop: vi.fn(),
     mid: '',
   };
 });

package/src/rtc/e2ee/E2EEManager.ts

@@ -5,7 +5,16 @@
  * attaching their own encoded transform in these two methods.
  */
 export interface E2EEManager {
-  /** `trackType` only groups perf stats, keeping a camera and screen share apart. */
+  /**
+   * Synchronously attach a transform that encrypts the sender's outgoing frames.
+   * Must support a sender without a track, and throw if attachment fails.
+   *
+   * `sender.track` is always null here: the track is attached only after this
+   * returns, so implementations must not read it. Use `codec` and `trackType`
+   * instead.
+   *
+   * `trackType` only groups perf stats, keeping a camera and screen share apart.
+   */
   encrypt(sender: RTCRtpSender, codec?: string, trackType?: string): void;
   /** `trackType` only groups perf stats, keeping a peer's audio and video apart. */
   decrypt(receiver: RTCRtpReceiver, userId: string, trackType?: string): void;

package/src/rtc/e2ee/EncryptionManager.ts

@@ -263,9 +263,9 @@ export class EncryptionManager
     }
 
     if ((this.piped ??= new WeakSet()).has(target)) return;
-    this.piped.add(target);
     // @ts-expect-error createEncodedStreams is not in the standard typedefs
     const { readable, writable } = target.createEncodedStreams();
+    this.piped.add(target);
     this.worker.postMessage(
       { type: 'cmd.setup_transform', ...options, readable, writable },
       [readable, writable],

package/src/rtc/e2ee/SPEC.md

@@ -79,7 +79,7 @@ await call.join();
 - **Removal comes in per-epoch and per-user forms, and the names must stay distinct.** `removeKey(userId, keyIndex)` retires one epoch; `removeAllKeys(userId)` revokes the participant entirely. Do not render these as overloads of one name: dropping the index argument would then silently mean "revoke everything", which is the opposite of the caller's intent and impossible to catch in review.
 - **Every key operation's outcome is tabulated in Appendix B.** Implement the edge cases (removing the latest or active epoch, a failed import, an absent index) from that table rather than from prose.
 - **Join request carries `e2ee: true`** so the backend knows the call is encrypted.
-- The internal attach points (`encrypt(sender, codec, trackType)` / `decrypt(receiver, userId, trackType)`) are called by the RTC layer, not by apps. Keeping them behind a small interface lets an integrator plug in a different scheme (e.g. SFrame).
+- The internal attach points (`encrypt(sender, codec, trackType)` / `decrypt(receiver, userId, trackType)`) are called by the RTC layer, not by apps. The publisher creates an E2EE sender without a track and attaches media only after `encrypt` returns and sender parameters succeed. `encrypt` must synchronously attach the transform or throw, and must support a sender whose `track` is null. A failed initialization retires that transceiver so retries cannot bypass attachment. Keeping these points behind a small interface lets an integrator plug in a different scheme (e.g. SFrame).
 
 ---