[应用层]  会议业务逻辑 (分组创建、成员拖拽、UI状态)
    ↓
[信令层]  WebSocket / DataChannel -> MLS 协议消息封装
    ↓
[密钥层]  MLS Library (OpenMLS / mlspp / Cisco MLS) -> 导出 SFrame/ SRTP 密钥
    ↓
[媒体层]  WebRTC Insertable Streams / SFrame Encoder -> 加密 RTP 包

// 初始化客户端身份 (仅首次/换设备执行)
async function initializeIdentity(userId: string): Promise<IdentityContext> {
  // 1. 生成签名密钥对
  const signatureKeyPair = await crypto.generateSigningKeyPair(); // Ed25519
  
  // 2. 生成 KeyPackage (含 HPKE 密钥对、能力集、生命周期)
  // capabilities: 支持的 CipherSuite (MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519), 扩展等
  const keyPackage = await mlsClient.generateKeyPackage({
    credentials: { type: 'basic', identity: new TextEncoder().encode(userId) },
    signatureKey: signatureKeyPair.privateKey,
    lifetime: 7 * 24 * 3600 // 7天有效期
  });

  // 3. 上传 KeyPackage 至信令服务器 KeyPackage 目录服务
  await signalingClient.publishKeyPackage(userId, keyPackage);
  
  return { userId, signatureKeyPair, keyPackage };
}

// 后端/主持人端：创建子房间 Group
async function createBreakoutRoom(roomId: string, creator: IdentityContext, initialMembers: string[]): Promise<GroupState> {
  // 1. 创建 Group Context
  const groupId = new TextEncoder().encode(`breakout-${roomId}-${Date.now()}`);
  
  // 2. 创建 Group (Creator 成为首个成员)
  const group = await mlsClient.createGroup({
    groupId,
    identity: creator.signatureKeyPair,
    capabilities: DEFAULT_CAPABILITIES,
    cipherSuite: CIPHER_SUITE
  });

  // 3. 批量添加初始成员
  for (const memberId of initialMembers) {
    // 从目录服务拉取 KeyPackage
    const kp = await signalingClient.fetchKeyPackage(memberId);
    if (kp) {
      // 生成 Add Proposal
      group.addMember(kp);
    }
  }

  // 4. 提交 Commit (包含 Add Proposals)
  const commit = await group.commit();
  
  // 5. 处理 Welcome 消息 & 分发
  // Welcome 消息包含加密后的 Group Secrets，仅对应成员可解密
  const welcomeMessages = commit.welcomeMessages; // Map<MemberId, Welcome>
  
  // 通过信令下发 Welcome 给各成员
  for (const [memberId, welcome] of welcomeMessages) {
    await signalingClient.sendToUser(memberId, { type: 'MLS_WELCOME', roomId, payload: welcome });
  }

  // 6. 持久化 Group State (Epoch 0)
  await db.saveGroupState(roomId, group.exportState());
  
  return group.exportState();
}

// 客户端：处理 Welcome 加入子房间
async function handleWelcome(welcomeBytes: Uint8Array, roomId: string): Promise<void> {
  // 1. 解析 Welcome，加入 Group
  const group = await mlsClient.joinGroup(welcomeBytes, {
    // 验证签名、树哈希一致性
    verificationCallback: verifyServerSignature 
  });

  // 2. 导出 SFrame 密钥材料 (用于媒体层加密)
  // MLS 导出接口通常提供 exportSecret(label, context, length)
  const sframeSecret = await group.exportSecret(
    new TextEncoder().encode("sframe 1.0 secret"), 
    new Uint8Array(), // context 可为空或绑定会话信息
    32 // AES-GCM 128 key length
  );

  // 3. 初始化 SFrame 发送/接收上下文
  const sframeCtx = new SFrameContext(sframeSecret);
  
  // 4. 注入 WebRTC 加密流程
  setupWebRTCEncryption(roomId, sframeCtx);

  // 5. 保存 Group 状态用于后续 Commit 处理
  await db.saveGroupState(roomId, group.exportState());
}

// 后端/主持人端：原子化跨房间移动
async function moveUserAcrossRooms(userId: string, fromRoomId: string, toRoomId: string): Promise<void> {
  // 加载两个房间的 Group State
  const groupA = await loadGroup(fromRoomId);
  const groupB = await loadGroup(toRoomId);

  // --- 步骤 1: 从 Room A 移除 ---
  const removeProposalA = groupA.proposeRemove(userId);
  const commitA = await groupA.commit([removeProposalA]);
  // 广播 CommitA 给 Room A 剩余成员 (触发 Epoch 密钥更新，实现后向安全)
  await broadcastCommit(fromRoomId, commitA);

  // --- 步骤 2: 加入 Room B ---
  const keyPackage = await fetchKeyPackage(userId);
  const addProposalB = groupB.proposeAdd(keyPackage);
  const commitB = await groupB.commit([addProposalB]);
  
  // 发送 Welcome 给用户 U
  await sendWelcome(userId, commitB.welcomeMessages.get(userId));
  // 广播 CommitB 给 Room B 原成员 (触发 Epoch 密钥更新)
  await broadcastCommit(toRoomId, commitB);
}

// 客户端：定时发起 KeyUpdate Proposal (建议周期 1小时 或 按数据量触发)
setInterval(async () => {
  const group = await loadGroup(currentRoomId);
  // 发起 KeyUpdate 提案，自我更新叶子节点密钥
  const proposal = group.proposeKeyUpdate();
  const commit = await group.commit([proposal]);
  await signalingClient.broadcastCommit(currentRoomId, commit);
}, 3600 * 1000);

// 服务端聚合器：收集 200ms 内的所有 Proposal，打包为单个 Commit
class CommitAggregator {
  private pendingProposals: Map<string, Proposal[]> = new Map();
  private flushTimer: NodeJS.Timeout | null = null;

  enqueue(roomId: string, proposal: Proposal) {
    if (!this.pendingProposals.has(roomId)) this.pendingProposals.set(roomId, []);
    this.pendingProposals.get(roomId)!.push(proposal);
    
    if (!this.flushTimer) {
      this.flushTimer = setTimeout(() => this.flush(roomId), 200); // 可配置窗口
    }
  }

  async flush(roomId: string) {
    const proposals = this.pendingProposals.get(roomId) || [];
    if (proposals.length === 0) return;
    
    const group = await loadGroup(roomId);
    // 关键：去重冲突 Proposal (如同一用户被重复 Add/Remove)
    const deduped = this.deduplicateConflicts(proposals); 
    const commit = await group.commit(deduped);
    
    // 单次广播触发所有客户端仅更新 1 次 Epoch
    await broadcastCommit(roomId, commit); 
    this.pendingProposals.delete(roomId);
    this.flushTimer = null;
  }
}

// 统一常量定义 (所有端共享源码或通过 IDL 同步)
pub const SFRAME_KDF_LABEL: &[u8] = b"sframe 1.0 secret";
pub const SFRAME_KEY_LENGTH: usize = 16; // AES-128-GCM
pub const SFRAME_SALT_LENGTH: usize = 16;

// 导出函数签名强制统一
fn derive_sframe_keys(epoch_secret: &[u8], group_context: &GroupContext) -> (Key, Salt) {
    let secret = mls_export_secret(epoch_secret, SFRAME_KDF_LABEL, group_context.hash(), SFRAME_KEY_LENGTH + SFRAME_SALT_LENGTH);
    (secret[..16].try_into().unwrap(), secret[16..].try_into().unwrap())
}

// Web 侧标准化加密管道
async function setupWebRTCEncryption(pc, sframeKey, sframeSalt, keyId) {
  const encoder = new SFrameEncoder(sframeKey, sframeSalt, keyId);
  
  // 使用 RTCRtpScriptTransform (Insertable Streams)
  const sender = pc.getSenders().find(s => s.track.kind === 'video');
  const transform = new TransformStream({
    async transform(frame, controller) {
      if (frame.type === 'key') { // 强制关键帧携带 KeyID 切换信令
        encoder.setKeyId(frame.keyId); 
      }
      const encrypted = await encoder.encrypt(frame);
      controller.enqueue(encrypted);
    }
  });
  sender.transform = transform;
}

# 伪代码：安全编排平台 (SOAR) 集成示例
def handle_key_compromise(event: CompromiseEvent):
    if event.level == "L3_IdentityKey":
        # 1. 生成吊销凭证 (签名过期时间戳)
        revocation_token = ca.sign_revocation(event.user_id, reason="KEY_COMPROMISE", not_after=now()+24h)
        # 2. 推送至所有在线客户端 (WebSocket 广播 + APNs/FCM 离线推送)
        push_revocation_list([revocation_token])
        
        # 3. 服务端强制清理：删除该用户所有 Group 中的 Leaf Node
        for group_id in db.get_groups_by_user(event.user_id):
            group = load_group(group_id)
            # 以 External Sender 身份发起 Remove (无需该用户私钥签名)
            commit = group.external_remove(event.user_id, revocation_token) 
            broadcast_commit(group_id, commit)
            
        # 4. 触发用户身份重置流程 (发送短信/邮件引导重新注册)
        notify_user_reset_identity(event.user_id)

CipherSuite MLS_128_SM2_SM4_GCM_SM3 = {
    kex: DHKEM(SM2_P256, HKDF-SM3),   // 密钥交换
    aead: AEAD_SM4_GCM_128,           // 认证加密
    hash: SM3,                        // 哈希/树哈希
    sig: SignatureScheme_SM2          // 签名算法
}

[应用层] 统一业务逻辑 (会议控制、UI)
    ↓
[抽象层] MLS Engine Interface (Trait/Interface)
    ↙                    ↘
[标准引擎] OpenMLS (RFC 9420)      [国密引擎] GmSSL/OpenMLS-fork (SM Suite)
    ↓                              ↓
[公网会议/跨企业协作]              [内网专有会议/涉密会议]

// MLS PublicMessage 扩展字段示例
{
  "wire_format": "public_message",
  "tls_presentation": "...",
  "extensions": [
    { "type": "trace_context", "data": "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01" }
  ]
}