[摄像头/麦克风] -> [编码器] -> [RTCRtpSender] 
      ^                                      |
      |                                      v
[解码器] <- [RTCRtpReceiver] <- [TransformStream (Worker)] <- [网络传输]
                ^                    ^
                |                    |
         [自定义处理/加密]      [自定义处理/解密]

// main.js
async function setupE2EECall() {
  const pc = new RTCPeerConnection({ iceServers: [{ urls: 'stun:stun.l.google.com:19302' }] });
  
  // 1. 实例化 Worker (必须使用 Module 类型)
  const worker = new Worker('transform-worker.js', { type: 'module', name: 'E2EE-Transformer' });
  
  // 2. 创建 MessageChannel 用于主线程与 Worker 交换密钥
  const { port1, port2 } = new MessageChannel();
  worker.postMessage({ type: 'INIT_KEY', key: await generateSharedKey() }, [port2]);
  // 假设通过信令通道安全协商密钥后，将 port2 传递给对端 (此处简化演示)
  
  // 3. 获取本地媒体流
  const stream = await navigator.mediaDevices.getUserMedia({ video: true, audio: true });
  
  // 4. 添加轨道并注入 Transform
  for (const track of stream.getTracks()) {
    const sender = pc.addTrack(track, stream);
    
    // 关键：创建 Transform 对
    const senderTransform = new RTCRtpScriptTransform(worker, {
      // 可选：传递给 worker 的初始化参数
      direction: 'send', 
      trackId: track.id
    });
    
    const receiverTransform = new RTCRtpScriptTransform(worker, {
      direction: 'receive',
      trackId: track.id
    });
    
    // 5. 绑定到 Sender/Receiver (需在 track 绑定后、协商前操作)
    // 注意：标准属性为 sender.transform / receiver.transform (Chrome 实现)
    // 部分浏览器可能使用 sender.encodedTransform
    if (sender.transform !== undefined) {
        sender.transform = senderTransform;
    } else if (sender.encodedTransform !== undefined) {
        sender.encodedTransform = senderTransform;
    }
    
    // Receiver 需在 ontrack 回调中设置 (见下文)
  }

  // 6. 处理远端轨道接收
  pc.ontrack = (event) => {
    const receiver = event.receiver;
    // 复用或创建新的 receiverTransform
    // 此处简化：假设单流场景复用逻辑
    if (receiver.transform !== undefined) {
        receiver.transform = receiverTransform;
    } else if (receiver.encodedTransform !== undefined) {
        receiver.encodedTransform = receiverTransform;
    }
    // 渲染远端视频
    remoteVideoElement.srcObject = event.streams[0];
  };

  // 7. 信令交换 (Offer/Answer/ICE) - 省略标准流程代码
  // await doSignaling(pc);
}

// transform-worker.js
import { encryptFrame, decryptFrame, deriveKeyMaterial } from './crypto-utils.js';

// 存储每个轨道的加密上下文
const trackContexts = new Map();

// 监听主线程消息 (密钥分发、控制指令)
self.onmessage = (event) => {
  if (event.data.type === 'INIT_KEY') {
    const { trackId, direction } = event.data.options || {};
    const key = event.data.key; // CryptoKey 对象
    const keyId = `${trackId}-${direction}`;
    
    // 预派生 IV/Nonce 基础材料 (实际生产需更严谨的密钥派生函数 KDF)
    trackContexts.set(keyId, { 
      key, 
      sendCounter: 0, 
      recvCounter: new Map() // 用于防重放
    });
    
    // 将 MessagePort 传递给 TransformStream 内部 (如需动态换键)
    // event.ports[0]...
  }
};

// 核心处理函数：由 RTCRtpScriptTransform 自动管道连接
// readable: 从编码器/网络流入的帧
// writable: 流向网络/解码器的帧
async function transformStream(readable, writable, options) {
  const { direction, trackId } = options;
  const keyId = `${trackId}-${direction}`;
  const ctx = trackContexts.get(keyId);
  
  if (!ctx) {
    console.error(`[Worker] Context not found for ${keyId}, passing through.`);
    return readable.pipeTo(writable); // 直通模式
  }

  const transformer = new TransformStream({
    async transform(encodedFrame, controller) {
      try {
        if (direction === 'send') {
          // --- 发送端：加密 ---
          const processedFrame = await encryptFrame(encodedFrame, ctx);
          controller.enqueue(processedFrame);
        } else {
          // --- 接收端：解密 ---
          const processedFrame = await decryptFrame(encodedFrame, ctx);
          controller.enqueue(processedFrame);
        }
      } catch (err) {
        console.error(`[Worker] Transform error (${direction}):`, err);
        // 策略：丢弃错误帧，避免管道卡死；或 controller.error(err) 关闭流
        // 建议：关键帧丢失可请求 PLI/FIR (需主线程配合)
      }
    },
    flush(controller) {
      // 流关闭时清理
      trackContexts.delete(keyId);
    }
  });

  return readable.pipeThrough(transformer).pipeTo(writable);
}

// 注册全局处理器 (Chrome 当前实现机制)
self.onrtctransform = (event) => {
  event.transformer.readable.pipeThrough(
    new TransformStream({
      transform(controller) { /* 此处逻辑同上，或调用 transformStream */ }
    })
  ).pipeTo(event.transformer.writable);
  
  // 更标准的写法 (配合 RTCRtpScriptTransform 构造函数传入 streams):
  // 实际上 RTCRtpScriptTransform 构造函数接收 readable/writable
  // Worker 内部需监听 'rtctransform' 事件或通过 self.onrtctransform
  // 规范演变中，推荐在 Worker 中定义 transform 逻辑并通过 event.transformer 暴露
};

// crypto-utils.js
const IV_LENGTH = 12; // GCM 推荐 12 字节 IV
const TAG_LENGTH = 16; // GCM 认证标签 16 字节 (128 bits)
const KEY_USAGE = ['encrypt', 'decrypt'];

// 生成共享密钥 (实际应通过 DTLS-SRTP 或 SFrame 协商，此处演示原始导入)
export async function generateSharedKey() {
  return window.crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, KEY_USAGE);
}

// 导出密钥用于跨 Worker 传递 (需可提取)
export async function exportKeyForTransfer(key) {
  return window.crypto.subtle.exportKey('raw', key);
}

export async function importKey(rawKey) {
  return window.crypto.subtle.importKey('raw', rawKey, 'AES-GCM', false, KEY_USAGE);
}

// 构造 Nonce: 防重放核心
function buildNonce(counter, trackIdHash) {
  const nonce = new Uint8Array(IV_LENGTH);
  // 高 4 字节: Track ID Hash (简单截取)
  nonce.set(trackIdHash.subarray(0, 4), 0);
  // 中 4 字节: 随机盐 (会话建立时固定)
  // 低 4 字节: 帧计数器 (大端序)
  new DataView(nonce.buffer).setUint32(8, counter, false); 
  return nonce;
}

// 简单 Hash 获取 Track 标识字节
function getTrackIdHash(trackId) {
  const encoder = new TextEncoder();
  const data = encoder.encode(trackId);
  // 简单哈希替代 (生产环境建议 SHA-256 截取)
  const hash = new Uint8Array(8);
  for(let i=0; i<data.length; i++) hash[i % 8] ^= data[i];
  return hash;
}

export async function encryptFrame(frame, ctx) {
  const { key, sendCounter, trackIdHash } = ctx;
  const counter = sendCounter++;
  const nonce = buildNonce(counter, trackIdHash);
  
  // 1. 准备明文: 帧数据 + 元数据 (类型、时间戳等需加密保护)
  // 注意：RTCEncodedVideoFrame.data 为 ArrayBuffer
  const metadata = {
    type: frame.type, // 'key' | 'delta'
    timestamp: frame.timestamp,
    // 可选：加密帧头部信息 (如 VP9/H264 Profile Level ID 等)
  };
  
  // 序列化元数据 (简化: JSON + 长度前缀)
  const metaBytes = new TextEncoder().encode(JSON.stringify(metadata));
  const plaintext = new Uint8Array(metaBytes.length + 2 + frame.data.byteLength);
  new DataView(plaintext.buffer).setUint16(0, metaBytes.length, false);
  plaintext.set(metaBytes, 2);
  plaintext.set(new Uint8Array(frame.data), 2 + metaBytes.length);

  // 2. 加密
  const ciphertext = await window.crypto.subtle.encrypt(
    { name: 'AES-GCM', iv: nonce, tagLength: TAG_LENGTH * 8 },
    key,
    plaintext
  );

  // 3. 构造新帧 (类型统一设为 'delta' 隐藏关键帧特征，或保留 type 但加密 payload)
  // 此处演示：保留 type 但替换 data
  const newFrame = new RTCEncodedVideoFrame({
    type: frame.type, // 关键帧标识通常需保留以便解码器同步，但会泄露帧模式
    timestamp: frame.timestamp,
    data: ciphertext
  });
  
  // 复制额外属性 (如 getMetadata() 返回的 width/height 等，视是否需隐藏而定)
  return newFrame;
}

export async function decryptFrame(frame, ctx) {
  const { key, recvCounter, trackIdHash } = ctx;
  // 此处需从帧中解析 Counter (若加密在 Payload 内) 或维护独立计数器
  // 简化假设：接收端按顺序递增计数器 (需处理乱序/丢包 -> 使用 RTP Sequence Number 映射)
  const counter = (recvCounter.get(frame.timestamp) || 0); 
  recvCounter.set(frame.timestamp, counter + 1);
  
  const nonce = buildNonce(counter, trackIdHash);
  
  try {
    const decrypted = await window.crypto.subtle.decrypt(
      { name: 'AES-GCM', iv: nonce, tagLength: TAG_LENGTH * 8 },
      key,
      frame.data
    );
    
    // 解析元数据
    const view = new DataView(decrypted);
    const metaLen = view.getUint16(0, false);
    const metaBytes = new Uint8Array(decrypted, 2, metaLen);
    const metadata = JSON.parse(new TextDecoder().decode(metaBytes));
    const payload = new Uint8Array(decrypted, 2 + metaLen);
    
    // 重建帧
    return new RTCEncodedVideoFrame({
      type: metadata.type,
      timestamp: metadata.timestamp,
      data: payload.buffer
    });
  } catch (e) {
    console.warn('[Decrypt] Auth failed or replay detected', e);
    throw e; // 触发 transform catch 逻辑丢帧
  }
}

// Worker 内部发送端逻辑片段
transform(encodedFrame, controller) {
  if (bandwidthEstimate < TARGET_BITRATE * 0.8 && encodedFrame.type !== 'key') {
    // 策略：丢弃当前非关键帧，触发编码器重新编码 (需主线程配合 sender.sendRtpSender.getParameters())
    // 更优方案：使用 RTCRtpScriptTransform 的 options 或主线程调用 sender.setParameters({ encodings: [{ requestKeyFrame: true }] })
    console.log('Bandwidth low, requesting keyframe via main thread');
    // 通过 postMessage 通知主线程请求关键帧
    self.postMessage({ type: 'REQUEST_KEYFRAME', trackId: options.trackId });
    return; // 丢弃当前帧
  }
  controller.enqueue(encodedFrame);
}

function injectWatermarkSEI(frame, watermarkData) {
  if (frame.type !== 'key') return frame; // 仅在关键帧注入，降低开销
  
  const data = new Uint8Array(frame.data);
  // 简易 NAL 解析查找 SPS/PPS 后插入 SEI (实际需完整 NAL 解析器)
  // NAL Header: forbidden_zero_bit(1) + nal_ref_idc(2) + nal_unit_type(5)
  // SEI NAL Unit Type: 6 (H.264) / 39 (HEVC)
  
  // 此处仅为逻辑示意，生产环境需使用专业码流解析库 (如 mpegts.js 核心解析器或 ffmpeg.wasm)
  const seiPayload = buildSEIPayload(watermarkData); // UUID + 用户ID + 时间戳
  const newData = insertNALUnit(data, 6, seiPayload); // 插入 SEI NAL
  
  return new RTCEncodedVideoFrame({
    type: frame.type,
    timestamp: frame.timestamp,
    data: newData.buffer
  });
}

  0                   1                   2                   3
  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |V=0|  Key ID Len |  CTR Len    |         Key ID (var)         ...
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 |          Frame Counter (var)          |   Auth Tag (var)     ...
 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

// transform-worker.ts (TypeScript + ES Module)
import { SFrameEncryptor, SFrameDecryptor, KeyStore } from '@wireapp/sframe';

// 密钥仓库：模拟从信令服务器获取的密钥分发
class WorkerKeyStore implements KeyStore {
  private store = new Map<string, CryptoKey>(); // key: `${epoch}:${keyId}`

  async getKey(keyId: Uint8Array): Promise<CryptoKey | null> {
    // 实际场景：从 IndexedDB 或主线程 postMessage 获取
    const id = Buffer.from(keyId).toString('hex');
    return this.store.get(id) || null;
  }

  // 主线程下发新密钥时调用
  setKey(epoch: number, keyId: Uint8Array, keyMaterial: CryptoKey) {
    this.store.set(`${epoch}:${Buffer.from(keyId).toString('hex')}`, keyMaterial);
  }
}

const keyStore = new WorkerKeyStore();
const encryptors = new Map<string, SFrameEncryptor>(); // key: trackId
const decryptors = new Map<string, SFrameDecryptor>(); // key: `${trackId}:${senderKeyId}`

self.onmessage = async (e) => {
  if (e.data.type === 'KEY_UPDATE') {
    const { epoch, keyId, keyMaterial, trackId, direction } = e.data;
    // keyMaterial 需为 CryptoKey (AES-GCM 或 ChaCha20-Poly1305)
    keyStore.setKey(epoch, keyId, keyMaterial);
    
    if (direction === 'send') {
      encryptors.set(trackId, new SFrameEncryptor(keyStore, keyId, { cipher: 'AES_GCM' }));
    } else {
      // 接收端需为每个远端发送者维护独立解密器
      decryptors.set(`${trackId}:${Buffer.from(keyId).toString('hex')}`, 
        new SFrameDecryptor(keyStore, { cipher: 'AES_GCM' }));
    }
  }
};

// Transform 核心逻辑
async function handleFrame(frame: RTCEncodedVideoFrame, controller: TransformStreamDefaultController, trackId: string, direction: 'send' | 'recv') {
  const data = new Uint8Array(frame.data);
  
  if (direction === 'send') {
    const encryptor = encryptors.get(trackId);
    if (!encryptor) return controller.enqueue(frame); // 密钥未就绪，直通
    
    // SFrame 加密：输入原始帧数据，输出 SFrame 密文
    // 注意：SFrame 不关心视频编码格式，视 Payload 为不透明字节流
    const encrypted = await encryptor.encrypt(data);
    
    controller.enqueue(new RTCEncodedVideoFrame({
      type: frame.type, timestamp: frame.timestamp, data: encrypted.buffer
    }));
    
  } else { // recv
    // 解析 SFrame Header 获取 Key ID，路由到对应 Decryptor
    // 简化：假设单流单发送者，实际需解析 Header 首字节
    const decryptor = decryptors.get(trackId); 
    if (!decryptor) return controller.enqueue(frame);
    
    try {
      const decrypted = await decryptor.decrypt(data);
      controller.enqueue(new RTCEncodedVideoFrame({
        type: frame.type, timestamp: frame.timestamp, data: decrypted.buffer
      }));
    } catch (err) {
      // 认证失败/重放攻击/密钥不匹配 -> 静默丢帧，触发 PLI 请求
      console.warn('[SFrame] Decrypt failed, frame dropped:', err);
      requestKeyFrame(trackId); // 通知主线程发送 FIR
    }
  }
}

// main.js - PeerConnection 配置阶段
const transceiver = pc.addTransceiver(track, {
  direction: 'sendrecv',
  sendEncodings: [
    { rid: 'h', scaleResolutionDownBy: 1, maxBitrate: 2500000 },
    { rid: 'm', scaleResolutionDownBy: 2, maxBitrate: 1000000 },
    { rid: 'f', scaleResolutionDownBy: 4, maxBitrate: 300000 }
  ]
});

// 关键：声明 Header Extensions (需 SFU 支持)
transceiver.sender.setParameters({
  headerExtensions: [
    { uri: 'urn:ietf:params:rtp-hdr-ext:sdes:mid', id: 1 },           // MID: 标识 Simulcast 层
    { uri: 'urn:ietf:params:rtp-hdr-ext:sdes:rtp-stream-id', id: 2 }, // RID: 标识编码层
    { uri: 'urn:ietf:params:rtp-hdr-ext:framemarking', id: 3 },       // Frame Marking: 关键帧/层依赖
    { uri: 'http://www.webrtc.org/experiments/rtp-hdr-ext/abs-send-time', id: 4 } // ABS Send Time: 带宽估算
  ]
});

// SFU 转发逻辑 (Go/Rust/Node.js)
func (s *SFU) ForwardPacket(pkt *rtp.Packet, downTrack *DownTrack) {
    // 1. 读取 MID/RID Header Extension -> 决定转发给哪个下行轨道
    mid, _ := pkt.HeaderExtensionMid()
    rid, _ := pkt.HeaderExtensionRID()
    
    if !downTrack.WantsLayer(mid, rid) {
        return // 丢弃：订阅者不需要该分辨率/帧率
    }

    // 2. 读取 Frame Marking -> 判断是否为关键帧 (I-frame) 或 Layer Sync
    //    即使 Payload 加密，Header Extension 明文可见
    fm, _ := pkt.HeaderExtensionFrameMarking()
    if fm != nil && fm.FrameType == FrameMarkingKeyFrame {
        downTrack.MarkKeyFrameReceived()
    }

    // 3. 直接转发 RTP 包 (Payload 仍为 SFrame 密文)
    //    SFU 无需解密，无需修改 Payload，仅修改 SSRC/Seq/Timestamp (如需)
    downTrack.WriteRTP(pkt)
}

// Worker (接收端) - 解密失败处理
catch (err) {
  if (err.name === 'OperationError' || err.message.includes('Authentication')) {
    // 1. 通知主线程请求关键帧
    self.postMessage({ type: 'REQUEST_KEYFRAME', trackId, reason: 'DECRYPT_FAIL' });
    
    // 2. 可选：触发密钥同步检查 (防止密钥不同步)
    self.postMessage({ type: 'CHECK_KEY_SYNC', trackId });
  }
}

// Main Thread
worker.onmessage = (e) => {
  if (e.data.type === 'REQUEST_KEYFRAME') {
    const sender = pc.getSenders().find(s => s.track?.id === e.data.trackId);
    if (sender) {
      // 标准 API 请求关键帧 (浏览器会生成新的 Key Frame 并经 Transform 加密)
      const params = sender.getParameters();
      params.encodings.forEach(enc => enc.requestKeyFrame = true);
      sender.setParameters(params);
    }
  }
};

// Cargo.toml 依赖: wasm-bindgen, sframe, web-sys, js-sys, webrtc-encoded-transform (假设绑定)
use wasm_bindgen::prelude::*;
use sframe::{SFrameEncryptor, SFrameDecryptor, CipherSuite};
use web_sys::{RtcEncodedVideoFrame, TransformStreamDefaultController};

// 导出给 JS 的上下文对象
#[wasm_bindgen]
pub struct WasmTransformContext {
    encryptor: Option<SFrameEncryptor>,
    decryptor: Option<SFrameDecryptor>,
    key_id: Vec<u8>,
}

#[wasm_bindgen]
impl WasmTransformContext {
    #[wasm_bindgen(constructor)]
    pub fn new(key_id: Vec<u8>, key_material: &[u8], cipher: u8) -> Result<WasmTransformContext, JsValue> {
        let suite = match cipher {
            1 => CipherSuite::AES_GCM_128,
            2 => CipherSuite::AES_GCM_256,
            3 => CipherSuite::CHACHA20_POLY1305,
            _ => return Err(JsValue::from_str("Unsupported cipher")),
        };
        
        // 此处简化：实际需实现 KeyStore trait 从外部获取密钥
        // 演示用固定密钥初始化
        let encryptor = SFrameEncryptor::new(key_id.clone(), key_material, suite)
            .map_err(|e| JsValue::from_str(&format!("Encryptor init failed: {:?}", e)))?;
        
        let decryptor = SFrameDecryptor::new(suite)
            .map_err(|e| JsValue::from_str(&format!("Decryptor init failed: {:?}", e)))?;

        Ok(WasmTransformContext { 
            encryptor: Some(encryptor), 
            decryptor: Some(decryptor),
            key_id 
        })
    }

    // 核心处理函数：零拷贝操作内存
    #[wasm_bindgen]
    pub fn process_frame(
        &mut self, 
        frame_ptr: *mut u8, // 指向 RTCEncodedVideoFrame.data 的指针 (需 JS 侧配合)
        len: usize,
        is_encrypt: bool,
    ) -> Result<Vec<u8>, JsValue> {
        // 安全：从线性内存读取帧数据
        let input = unsafe { std::slice::from_raw_parts(frame_ptr, len) };
        
        if is_encrypt {
            let enc = self.encryptor.as_mut().ok_or("Encryptor not init")?;
            enc.encrypt(input).map_err(|e| JsValue::from_str(&format!("Enc failed: {:?}", e)))
        } else {
            let dec = self.decryptor.as_mut().ok_or("Decryptor not init")?;
            dec.decrypt(input).map_err(|e| JsValue::from_str(&format!("Dec failed: {:?}", e)))
        }
    }
}

// wasm-bridge.ts
import init, { WasmTransformContext } from './pkg/wasm_transform.js';

let wasmMemory: WebAssembly.Memory;
let contexts = new Map<string, WasmTransformContext>();

export async function initWasm() {
  const { memory } = await init(); // 初始化 WASM 模块
  wasmMemory = memory;
}

export function getContext(trackId: string, keyId: Uint8Array, key: Uint8Array, cipher: number) {
  if (!contexts.has(trackId)) {
    contexts.set(trackId, new WasmTransformContext(keyId, key, cipher));
  }
  return contexts.get(trackId)!;
}

// Worker Transform 回调中调用
export function processFrameWasm(
  frame: RTCEncodedVideoFrame, 
  ctx: WasmTransformContext, 
  isEncrypt: boolean
): ArrayBuffer {
  const inputData = new Uint8Array(frame.data);
  
  // 1. 将输入数据拷贝到 WASM 线性内存 (或直接操作指针，需 frame.data 为 WASM 导出的内存视图)
  // 策略 A: 简单拷贝 (小帧开销可接受)
  const ptr = ctx.process_frame(inputData.byteOffset, inputData.length, isEncrypt); 
  // 实际上 process_frame 返回 Vec<u8> 会触发拷贝回 JS
  
  // 策略 B: 零拷贝 (高级)
  // 要求 frame.data 本身就是 WASM Memory 的一部分 (需主线程创建帧时分配)
  // 此处演示策略 A 返回新 ArrayBuffer
  return new Uint8Array(wasmMemory.buffer, ptr, len).slice(); // slice 触发拷贝，或直接构造新帧
}

// main.js - 在 setLocalDescription 前修改 SDP (Hack 方案，标准应用 transceiver.setCodecPreferences)
function forceAnnexB(sdp: string): string {
  // 修改 fmtp 行: packetization-mode=1; profile-level-id=42e01f
  // 确保不包含 sprop-parameter-sets (即不发送 AVCC 头)
  return sdp.replace(/a=fmtp:(d+) H264(.*)/g, (m, pt, fmtp) => {
    if (fmtp.includes('packetization-mode=1')) {
      // 移除 sprop-parameter-sets，强制浏览器在流内发送 SPS/PPS (Annex B)
      return `a=fmtp:${pt} H264${fmtp.replace(/;sprop-parameter-sets=[^;]*/, '')}`;
    }
    return m;
  });
}

// Worker 内部指标收集
const metrics = {
  encryptLatencyMs: new Histogram('e2ee_encrypt_latency_ms', { buckets: [0.1, 0.5, 1, 2, 5, 10] }),
  decryptLatencyMs: new Histogram('e2ee_decrypt_latency_ms', { buckets: [0.1, 0.5, 1, 2, 5, 10] }),
  decryptFailTotal: new Counter('e2ee_decrypt_fail_total', { reason: ['auth_fail', 'replay', 'key_mismatch', 'parse_err'] }),
  keyRotationEvents: new Counter('e2ee_key_rotation_total', { direction: ['send', 'recv'] }),
  frameDropTotal: new Counter('e2ee_frame_drop_total', { cause: ['encrypt_err', 'decrypt_err', 'backpressure'] })
};

// Transform 中记录
const start = performance.now();
try {
  const encrypted = await encryptor.encrypt(data);
  metrics.encryptLatencyMs.observe(performance.now() - start);
} catch (e) {
  metrics.decryptFailTotal.inc({ reason: classifyError(e) });
}

// test/e2ee.security.test.ts
describe('E2EE Security & Reliability', () => {
  it('should recover from key rotation without video freeze', async () => {
    const { pageAlice, pageBob } = await setupCall();
    
    // 1. 正常通话 5s
    await waitForVideoPlay(pageBob, 5000);
    
    // 2. 触发服务端下发新 Epoch Key (模拟成员加入)
    await signalingServer.triggerKeyRotation('epoch_2');
    
    // 3. 验证：无黑屏 > 500ms，关键帧请求次数 < 2
    const freezeDuration = await measureFreezeDuration(pageBob);
    expect(freezeDuration).toBeLessThan(500);
    
    const firCount = await pageBob.evaluate(() => window.__testHooks__.firCount);
    expect(firCount).toBeLessThan(2);
  });

  it('should drop frames on ciphertext tampering (MITM simulation)', async () => {
    // 在 SFU 层或网络层注入错误字节
    await networkEmulator.corruptPackets(0.01, (pkt) => {
      if (pkt.payload.length > 10) pkt.payload[5] ^= 0xFF; // 翻转 1 bit
    });
    
    // 验证：解密失败计数上升，画面无绿屏/花屏 (仅丢帧)
    const decryptFails = await pageBob.evaluate(() => window.__metrics__.decryptFailTotal);
    expect(decryptFails).toBeGreaterThan(0);
    
    // 验证无解码器崩溃
    const decoderErrors = await pageBob.evaluate(() => window.__testHooks__.decoderErrors);
    expect(decoderErrors).toBe(0);
  });
});

// 调试面板代码片段 (注入到页面或 Worker)
function parseSFrameHeader(data: Uint8Array) {
  let offset = 0;
  const firstByte = data[offset++];
  const version = firstByte >> 6; // Must be 0
  const keyIdLen = (firstByte >> 4) & 0x3;
  const ctrLen = firstByte & 0xF;
  
  const keyId = data.slice(offset, offset + keyIdLen + 1); offset += keyIdLen + 1;
  const counter = data.slice(offset, offset + ctrLen + 1); offset += ctrLen + 1;
  
  return { version, keyId: Buffer.from(keyId).toString('hex'), counter: bytesToInt(counter), payloadStart: offset };
}

// 在 Worker 中开启调试模式
if (DEBUG) {
  const parsed = parseSFrameHeader(new Uint8Array(frame.data));
  console.log('[SFrame Debug]', { trackId, direction, ...parsed, payloadLen: frame.data.byteLength - parsed.payloadStart });
}

// capabilities.ts
export enum E2EELevel {
  NONE = 0,           // 无加密 / 服务端加密 (SDES/DTLS-SRTP)
  INSERTABLE_STREAMS = 1, // 旧标准 (Chrome 86-106)
  ENCODED_TRANSFORM = 2,  // 新标准 (Chrome 107+, FF 113+, Safari 16.4+)
  ENCODED_TRANSFORM_WASM = 3 // WASM 加速版
}

export function detectE2EECapability(): E2EELevel {
  if (typeof RTCRtpScriptTransform === 'undefined') {
    // 检测旧标准 Insertable Streams
    if (RTCRtpSender.prototype.createEncodedStreams) return E2EELevel.INSERTABLE_STREAMS;
    return E2EELevel.NONE;
  }
  
  // 检测 WASM 支持 (SharedArrayBuffer 需 COOP/COEP 头)
  const hasWasm = typeof WebAssembly === 'object' && 
                  typeof SharedArrayBuffer !== 'undefined' &&
                  crossOriginIsolated; // 需服务端配置响应头
                  
  return hasWasm ? E2EELevel.ENCODED_TRANSFORM_WASM : E2EELevel.ENCODED_TRANSFORM;
}

// e2ee-adapter.ts
interface IE2EEProvider {
  init(config: E2EEConfig): Promise<void>;
  createSenderTransform(trackId: string): RTCRtpScriptTransform | ReadableStream | null;
  createReceiverTransform(trackId: string): RTCRtpScriptTransform | WritableStream | null;
  onKeyUpdate(keyData: KeyData): void;
  destroy(): void;
}

class ModernTransformProvider implements IE2EEProvider { /* 封装上文 Transform API 逻辑 */ }
class LegacyInsertableStreamsProvider implements IE2EEProvider { /* 封装 createEncodedStreams 逻辑 */ }
class NoOpProvider implements IE2EEProvider { /* 直通，仅用于不支持环境 */ }

// 工厂函数
export function createE2EEProvider(level: E2EELevel): IE2EEProvider {
  switch(level) {
    case E2EELevel.ENCODED_TRANSFORM_WASM:
    case E2EELevel.ENCODED_TRANSFORM:
      return new ModernTransformProvider();
    case E2EELevel.INSERTABLE_STREAMS:
      console.warn('[E2EE] Using deprecated Insertable Streams API');
      return new LegacyInsertableStreamsProvider();
    default:
      console.warn('[E2EE] E2EE not supported, falling back to DTLS-SRTP only');
      return new NoOpProvider();
  }
}

// 信令消息扩展
{
  "type": "e2ee-capabilities",
  "supportedLevels": [3, 2, 1], // 客户端支持的等级列表
  "preferredCiphers": ["AES_GCM_128", "CHACHA20_POLY1305"],
  "sframeVersion": 1
}