feat(client): add E2EE support via WebRTC Encoded Transforms

packages/client/index.ts

@@ -24,6 +24,7 @@ export * from './src/helpers/ViewportTracker';
 export * from './src/helpers/sound-detector';
 export * from './src/helpers/participantUtils';
 export * from './src/helpers/RNSpeechDetector';
+export { EncryptionManager } from './src/rtc/e2ee/EncryptionManager';
 export * as Browsers from './src/helpers/browsers';
 
 export * from './src/logger';

packages/client/rollup.config.mjs

@@ -30,9 +30,11 @@ const external = [
 const browserConfig = {
   input: 'index.ts',
   output: {
-    file: 'dist/index.browser.es.js',
+    dir: 'dist',
     format: 'esm',
     sourcemap: true,
+    entryFileNames: 'index.browser.es.js',
+    chunkFileNames: '[name].browser.es.js',
   },
   external: external.filter((dep) => !browserIgnoredModules.includes(dep)),
   plugins: [
@@ -55,6 +57,7 @@ const createNodeConfig = (outputFile, format) => ({
     file: outputFile,
     format: format,
     sourcemap: true,
+    inlineDynamicImports: true,
   },
   external,
   plugins: [

packages/client/src/Call.ts

@@ -13,6 +13,7 @@ import {
   TrackPublishOptions,
   trackTypeToParticipantStreamKey,
 } from './rtc';
+import { EncryptionManager } from './rtc/e2ee/EncryptionManager';
 import {
   registerEventHandlers,
   registerRingingCallEventHandlers,
@@ -251,6 +252,7 @@ export class Call {
   private readonly dispatcher = new Dispatcher();
 
   private clientPublishOptions?: ClientPublishOptions;
+  e2eeManager?: EncryptionManager;
   private currentPublishOptions?: PublishOption[];
   private statsReportingIntervalInMs: number = 2000;
   private statsReporter?: StatsReporter;
@@ -1369,6 +1371,7 @@ export class Call {
       tag: sfuClient.tag,
       enableTracing,
       clientPublishOptions: this.clientPublishOptions,
+      e2ee: this.e2eeManager,
       onReconnectionNeeded: (kind, reason, peerType) => {
         this.reconnect(kind, reason).catch((err) => {
           const message = `[Reconnect] Error reconnecting, after a ${PeerType[peerType]} error: ${reason}`;
@@ -1995,6 +1998,18 @@ export class Call {
     this.clientPublishOptions = { ...this.clientPublishOptions, ...options };
   };
 
+  /**
+   * Set the E2EE (end-to-end encryption) manager for this call.
+   *
+   * Must be called before {@link join} so the RTCPeerConnection is
+   * configured with `encodedInsertableStreams` on Chrome.
+   *
+   * @param e2ee - An EncryptionManager created via `EncryptionManager.create()`.
+   */
+  setE2EEManager = (e2ee: EncryptionManager) => {
+    this.e2eeManager = e2ee;
+  };
+
   /**
    * Notifies the SFU that a noise cancellation process has started.
    *

packages/client/src/rtc/BasePeerConnection.ts

@@ -8,9 +8,11 @@ import {
   TrackType,
   WebsocketReconnectStrategy,
 } from '../gen/video/sfu/models/models';
+import { EncryptionManager } from './e2ee/EncryptionManager';
 import { NegotiationError } from './NegotiationError';
 import { StreamSfuClient } from '../StreamSfuClient';
 import { AllSfuEvents, Dispatcher } from './Dispatcher';
+import { isChrome } from '../helpers/browsers';
 import { withoutConcurrency } from '../helpers/concurrency';
 import { StatsTracer, Tracer, traceRTCPeerConnection } from '../stats';
 import type { BasePeerConnectionOpts, OnReconnectionNeeded } from './types';
@@ -27,6 +29,7 @@ export abstract class BasePeerConnection {
   protected readonly state: CallState;
   protected readonly dispatcher: Dispatcher;
   protected readonly clientPublishOptions?: ClientPublishOptions;
+  protected readonly e2ee?: EncryptionManager;
   protected tag: string;
   protected sfuClient: StreamSfuClient;
 
@@ -59,6 +62,7 @@ export abstract class BasePeerConnection {
       tag,
       enableTracing,
       clientPublishOptions,
+      e2ee,
       iceRestartDelay = 2500,
     }: BasePeerConnectionOpts,
   ) {
@@ -68,6 +72,7 @@ export abstract class BasePeerConnection {
     this.dispatcher = dispatcher;
     this.iceRestartDelay = iceRestartDelay;
     this.clientPublishOptions = clientPublishOptions;
+    this.e2ee = e2ee;
     this.tag = tag;
     this.onReconnectionNeeded = onReconnectionNeeded;
     this.logger = videoLoggerSystem.getLogger(
@@ -89,7 +94,13 @@ export abstract class BasePeerConnection {
   }
 
   private createPeerConnection = (connectionConfig?: RTCConfiguration) => {
-    const pc = new RTCPeerConnection(connectionConfig);
+    const config: RTCConfiguration = { ...connectionConfig };
+    // Chrome needs encodedInsertableStreams for the Insertable Streams path.
+    if (this.e2ee && isChrome()) {
+      // @ts-expect-error not part of the standard lib yet
+      config.encodedInsertableStreams = true;
+    }
+    const pc = new RTCPeerConnection(config);
     pc.addEventListener('icecandidate', this.onIceCandidate);
     pc.addEventListener('icecandidateerror', this.onIceCandidateError);
     pc.addEventListener(

packages/client/src/rtc/Publisher.ts

@@ -137,6 +137,13 @@ export class Publisher extends BasePeerConnection {
     const params = transceiver.sender.getParameters();
     params.degradationPreference = 'maintain-framerate';
     await transceiver.sender.setParameters(params);
+    if (this.e2ee) {
+      this.e2ee.encrypt(
+        transceiver.sender,
+        publishOption.codec?.name.toLowerCase(),
+      );
+      this.logger.debug('E2EE encryptor attached to sender');
+    }
 
     const trackType = publishOption.trackType;
     this.logger.debug(`Added ${TrackType[trackType]} transceiver`);

packages/client/src/rtc/Subscriber.ts

@@ -93,6 +93,15 @@ export class Subscriber extends BasePeerConnection {
       this.state.removeOrphanedTrack(primaryStream.id);
     });
 
+    if (this.e2ee) {
+      // Use the participant's userId for key lookup when available.
+      // Falls back to trackLookupPrefix for orphaned tracks (frames will
+      // be dropped until the participant is registered and keys are set).
+      const decryptUserId = participantToUpdate?.userId ?? trackId;
+      this.e2ee.decrypt(e.receiver, decryptUserId);
+      this.logger.debug('E2EE decryptor attached to receiver');
+    }
+
     const trackType = toTrackType(rawTrackType);
     if (!trackType) {
       return this.logger.error(`Unknown track type: ${rawTrackType}`);

packages/client/src/rtc/__tests__/Publisher.test.ts

@@ -133,6 +133,50 @@ describe('Publisher', () => {
       expect(negotiateSpy).toHaveBeenCalled();
     });
 
+    it('should attach an encryptor when E2EE manager is provided', async () => {
+      const e2eeMock = {
+        encrypt: vi.fn(),
+        decrypt: vi.fn(),
+      };
+      publisher.dispose();
+      publisher = new Publisher(
+        {
+          sfuClient,
+          dispatcher,
+          state,
+          tag: 'test',
+          enableTracing: false,
+          // @ts-expect-error - partial mock
+          e2ee: e2eeMock,
+        },
+        [
+          {
+            id: 1,
+            trackType: TrackType.VIDEO,
+            bitrate: 1000,
+            // @ts-expect-error - incomplete data
+            codec: { name: 'vp9' },
+            fps: 30,
+            maxTemporalLayers: 3,
+            maxSpatialLayers: 3,
+          },
+        ],
+      );
+
+      const track = new MediaStreamTrack();
+      const clone = new MediaStreamTrack();
+      vi.spyOn(track, 'clone').mockReturnValue(clone);
+      // @ts-expect-error - private method
+      vi.spyOn(publisher, 'negotiate').mockResolvedValue();
+
+      await publisher.publish(track, TrackType.VIDEO);
+
+      expect(e2eeMock.encrypt).toHaveBeenCalledWith(
+        expect.anything(), // sender
+        'vp9',
+      );
+    });
+
     it('should update an existing transceiver for a new track', async () => {
       const track = new MediaStreamTrack();
       const clone = new MediaStreamTrack();

packages/client/src/rtc/__tests__/Subscriber.test.ts

@@ -214,6 +214,75 @@ describe('Subscriber', () => {
       expect(baseTrack.stop).toHaveBeenCalled();
       expect(baseStream.removeTrack).toHaveBeenCalledWith(baseTrack);
     });
+
+    it('should attach a decryptor when E2EE manager is provided', () => {
+      const e2eeMock = {
+        encrypt: vi.fn(),
+        decrypt: vi.fn(),
+      };
+      subscriber.dispose();
+      subscriber = new Subscriber({
+        sfuClient,
+        dispatcher,
+        state,
+        connectionConfig: { iceServers: [] },
+        tag: 'test',
+        enableTracing: true,
+        // @ts-expect-error - partial mock
+        e2ee: e2eeMock,
+      });
+
+      const mediaStream = new MediaStream();
+      const mediaStreamTrack = new MediaStreamTrack();
+      const receiver = {};
+      // @ts-expect-error - mock
+      mediaStream.id = '123:TRACK_TYPE_VIDEO';
+
+      const onTrack = subscriber['handleOnTrack'];
+      // @ts-expect-error - incomplete mock
+      onTrack({ streams: [mediaStream], track: mediaStreamTrack, receiver });
+
+      // Falls back to trackId when participant is not found (orphaned track)
+      expect(e2eeMock.decrypt).toHaveBeenCalledWith(receiver, '123');
+    });
+
+    it('should decrypt with userId when participant is found', () => {
+      const e2eeMock = {
+        encrypt: vi.fn(),
+        decrypt: vi.fn(),
+      };
+      subscriber.dispose();
+      subscriber = new Subscriber({
+        sfuClient,
+        dispatcher,
+        state,
+        connectionConfig: { iceServers: [] },
+        tag: 'test',
+        enableTracing: true,
+        // @ts-expect-error - partial mock
+        e2ee: e2eeMock,
+      });
+
+      // Register a participant whose trackLookupPrefix matches the stream
+      state.updateOrAddParticipant('session-id', {
+        sessionId: 'session-id',
+        userId: 'real-user-id',
+        trackLookupPrefix: '123',
+      });
+
+      const mediaStream = new MediaStream();
+      const mediaStreamTrack = new MediaStreamTrack();
+      const receiver = {};
+      // @ts-expect-error - mock
+      mediaStream.id = '123:TRACK_TYPE_VIDEO';
+
+      const onTrack = subscriber['handleOnTrack'];
+      // @ts-expect-error - incomplete mock
+      onTrack({ streams: [mediaStream], track: mediaStreamTrack, receiver });
+
+      // Uses the participant's userId (not trackLookupPrefix) for key lookup
+      expect(e2eeMock.decrypt).toHaveBeenCalledWith(receiver, 'real-user-id');
+    });
   });
 
   describe('Negotiation', () => {

packages/client/src/rtc/__tests__/mocks/webrtc.mocks.ts

@@ -57,6 +57,7 @@ const RTCRtpTransceiverMock = vi.fn((): Partial<RTCRtpTransceiver> => {
       replaceTrack: vi.fn(),
       getParameters: vi.fn().mockReturnValue({}),
       setParameters: vi.fn(),
+      transform: null,
     },
     setCodecPreferences: vi.fn(),
     mid: '',
@@ -79,6 +80,7 @@ const RTCRtpReceiverMock = vi.fn((): Partial<typeof RTCRtpReceiver> => {
     getCapabilities: vi.fn(),
   };
 });
+RTCRtpReceiverMock.prototype.transform = null;
 vi.stubGlobal('RTCRtpReceiver', RTCRtpReceiverMock);
 
 const RTCRtpSenderMock = vi.fn((): Partial<typeof RTCRtpSender> => {
@@ -88,8 +90,36 @@ const RTCRtpSenderMock = vi.fn((): Partial<typeof RTCRtpSender> => {
     track: vi.fn(),
   };
 });
+RTCRtpSenderMock.prototype.transform = null;
 vi.stubGlobal('RTCRtpSender', RTCRtpSenderMock);
 
+const WorkerMock = vi.fn((): Partial<Worker> => {
+  return {
+    postMessage: vi.fn(),
+    terminate: vi.fn(),
+    addEventListener: vi.fn(),
+    removeEventListener: vi.fn(),
+  };
+});
+vi.stubGlobal('Worker', WorkerMock);
+
+const RTCRtpScriptTransformMock = vi.fn(
+  (worker: Worker, options?: unknown): Partial<RTCRtpScriptTransform> => {
+    return {
+      worker,
+      options,
+    };
+  },
+);
+vi.stubGlobal('RTCRtpScriptTransform', RTCRtpScriptTransformMock);
+
+if (typeof URL !== 'undefined' && typeof URL.createObjectURL !== 'function') {
+  Object.defineProperty(URL, 'createObjectURL', {
+    configurable: true,
+    value: vi.fn(() => 'blob:stream-video-e2ee'),
+  });
+}
+
 const AudioContextMock = vi.fn((): Partial<AudioContext> => {
   return {
     state: 'suspended',