@stream-io/video-client 1.56.0 → 1.58.0

package/dist/e2ee-worker.browser.es.js

@@ -0,0 +1,1342 @@
+function e2eeWorker() {
+  /**
+   * Codec-specific framing: how many header bytes stay clear, and H.264 RBSP
+   * escaping so ciphertext cannot contain a fake Annex B start code.
+   */
+  const findStartCode = (data, offset) => {
+    for (let i = offset; i < data.length - 2; ++i) {
+      if (data[i] === 0 && data[i + 1] === 0) {
+        if (data[i + 2] === 1) return { pos: i, len: 3 };
+        if (data[i + 2] === 0 && i + 3 < data.length && data[i + 3] === 1) {
+          return { pos: i, len: 4 };
+        }
+      }
+    }
+    return null;
+  };
+  /**
+   * Clear bytes up to the first slice NALU (type 1 or 5) plus 2: start code,
+   * NALU header, one byte of slice header. Ignores frameType, to match
+   * {@link CodecProfile.clearBytes}.
+   */
+  const h264ClearBytes = (_frameType, data) => {
+    let sc = findStartCode(data, 0);
+    while (sc) {
+      const headerPos = sc.pos + sc.len;
+      if (headerPos >= data.length) break;
+      const naluType = data[headerPos] & 0x1f;
+      if (naluType === 1 || naluType === 5) {
+        const clear = sc.pos + sc.len + 2;
+        // A real slice header exceeds 2 bytes, so this clamp should never bite.
+        return clear > data.length ? data.length : clear;
+      }
+      sc = findStartCode(data, headerPos);
+    }
+    return 0;
+  };
+  /**
+   * Escape-state seed for the clear-header boundary: how many 0x00 bytes end the
+   * clear header, capped at 2 (a longer run does not change the escaper's next
+   * decision).
+   *
+   * The clear header itself is never escaped, but its tail and the first escaped
+   * bytes form one contiguous stream on the wire: a header ending in 0x00
+   * followed by ciphertext starting 0x00 0x01 is a fake start code the
+   * packetizer would split on. Seeding the escaper as if the header's zeros were
+   * already scanned closes that gap. Encode and decode both derive the seed from
+   * the same clear bytes, so nothing extra travels in the frame.
+   */
+  const boundarySeedZeros = (clearHeader) => {
+    const n = clearHeader.length;
+    let zeros = 0;
+    while (zeros < 2 && zeros < n && clearHeader[n - 1 - zeros] === 0) zeros++;
+    return zeros;
+  };
+  /**
+   * Escaped length of `segments`, read as one contiguous stream so a 0x00 0x00
+   * run spanning a boundary counts. Sizes the buffer for {@link rbspEscapeInto}.
+   *
+   * @param seedZeros zero-run state entering the stream; see
+   *         {@link boundarySeedZeros}.
+   */
+  const rbspEscapedLength = (segments, seedZeros) => {
+    let total = 0;
+    let zeros = seedZeros;
+    for (const seg of segments) {
+      total += seg.length;
+      for (let i = 0; i < seg.length; ++i) {
+        const byte = seg[i];
+        if (zeros >= 2 && byte <= 3) {
+          total++;
+          zeros = 0;
+        }
+        zeros = byte === 0 ? zeros + 1 : 0;
+      }
+    }
+    return total;
+  };
+  /**
+   * Escape `segments` into `dst` at `offset`, inserting 0x03 after each 0x00 0x00
+   * run followed by 0x00-0x03. `dst` needs {@link rbspEscapedLength} bytes free,
+   * computed with the same `seedZeros`.
+   *
+   * Sizing separately lets the encoder escape straight behind the clear header,
+   * copying the ciphertext once instead of twice.
+   */
+  const rbspEscapeInto = (dst, offset, segments, seedZeros) => {
+    let j = offset;
+    let zeros = seedZeros;
+    for (const seg of segments) {
+      for (let i = 0; i < seg.length; ++i) {
+        const byte = seg[i];
+        if (zeros >= 2 && byte <= 3) {
+          dst[j++] = 3;
+          zeros = 0;
+        }
+        dst[j++] = byte;
+        zeros = byte === 0 ? zeros + 1 : 0;
+      }
+    }
+  };
+  /**
+   * Reverse of {@link rbspEscapeInto}: drop each 0x03 the escaper inserted,
+   * tracked with the same zero-run state so an escape byte right at the
+   * clear-header boundary (possible only with a non-zero `seedZeros`) is
+   * recognized too.
+   */
+  const rbspUnescape = (data, seedZeros) => {
+    const isEscapeByte = (i, zeros) =>
+      zeros >= 2 && data[i] === 3 && i + 1 < data.length && data[i + 1] <= 3;
+    let remove = 0;
+    let zeros = seedZeros;
+    for (let i = 0; i < data.length; ++i) {
+      if (isEscapeByte(i, zeros)) {
+        remove++;
+        zeros = 0;
+        continue;
+      }
+      zeros = data[i] === 0 ? zeros + 1 : 0;
+    }
+    if (remove === 0) return data;
+    const result = new Uint8Array(data.length - remove);
+    let j = 0;
+    zeros = seedZeros;
+    for (let i = 0; i < data.length; ++i) {
+      if (isEscapeByte(i, zeros)) {
+        zeros = 0;
+        continue;
+      }
+      result[j++] = data[i];
+      zeros = data[i] === 0 ? zeros + 1 : 0;
+    }
+    return result;
+  };
+  // Audio has no keyframes, so the absence of a frame type identifies it. Keep
+  // the Opus TOC byte clear. Only reached for audio: `audioOnly` rejects a video
+  // frame before this runs.
+  const defaultClearBytes = (frameType) => (frameType === undefined ? 1 : 0);
+  // Clamped to the frame length. A short frame claiming more would make encode
+  // zero-pad the header and decode build an AAD of a different length.
+  const vpClearBytes = (frameType, data) => {
+    const clear = frameType === 'key' ? 10 : 3;
+    return clear > data.length ? data.length : clear;
+  };
+  // AV1 is absent on purpose: the AV1 RTP packetizer parses the OBU stream, so a
+  // frame trailer does not survive. It needs its own scheme. Without an entry it
+  // falls through to isSupportedCodec and fails closed.
+  const CODEC_PROFILES = {
+    opus: { rbsp: false, audioOnly: true, clearBytes: defaultClearBytes },
+    vp8: { rbsp: false, audioOnly: false, clearBytes: vpClearBytes },
+    vp9: { rbsp: false, audioOnly: false, clearBytes: vpClearBytes },
+    h264: { rbsp: true, audioOnly: false, clearBytes: h264ClearBytes },
+  };
+  // Used when the caller names no codec. Audio is safe to frame unlabeled, since
+  // the TOC byte rule holds for any audio codec. Video is not: the right clear
+  // header and whether to escape both depend on the codec, so it fails closed.
+  const DEFAULT_PROFILE = {
+    rbsp: false,
+    audioOnly: true,
+    clearBytes: defaultClearBytes,
+  };
+  // Object.hasOwn, not `in`: `in` walks the prototype chain, so a codec named
+  // like an Object.prototype member ('toString') would resolve to a function
+  // instead of a profile.
+  const getCodecProfile = (codec) =>
+    codec !== undefined && Object.hasOwn(CODEC_PROFILES, codec)
+      ? CODEC_PROFILES[codec]
+      : DEFAULT_PROFILE;
+  const isSupportedCodec = (codec) =>
+    codec === undefined || Object.hasOwn(CODEC_PROFILES, codec);
+
+  let tail = Promise.resolve();
+  /**
+   * Run tasks FIFO, one at a time, so a `setKey` cannot race transform setup.
+   * `tail` swallows errors so one rejection cannot stall the queue; the returned
+   * promise still carries that task's own outcome.
+   */
+  const enqueue = (fn) => {
+    const run = tail.then(fn);
+    tail = run.catch(() => {});
+    return run;
+  };
+
+  /** Marks an encrypted frame's trailer. */
+  const MAGIC = 0xe2eefeed;
+  /**
+   * Wire format version. Bump it when the trailer layout or IV derivation change.
+   *
+   * v1: [4B frameCounter][8B ivPrefix][1B keyIndex][2B clearBytes|flags]
+   * [1B version][4B magic]. IV = ivPrefix ∥ frameCounter.
+   */
+  const E2EE_VERSION = 1;
+  const IV_PREFIX_LEN = 8;
+  const FRAME_COUNTER_LEN = 4;
+  const IV_LEN = IV_PREFIX_LEN + FRAME_COUNTER_LEN;
+  const KEY_INDEX_LEN = 1;
+  const CLEAR_BYTES_LEN = 2;
+  const VERSION_LEN = 1;
+  const MAGIC_LEN = 4;
+  /** 4 + 8 + 1 + 2 + 1 + 4 */
+  const TRAILER_LEN =
+    FRAME_COUNTER_LEN +
+    IV_PREFIX_LEN +
+    KEY_INDEX_LEN +
+    CLEAR_BYTES_LEN +
+    VERSION_LEN +
+    MAGIC_LEN;
+  /** Bit 15 of the clearBytes field. Signals RBSP escaping. */
+  const RBSP_FLAG = 0x8000;
+  /** Bit 15 belongs to RBSP_FLAG, so clearBytes gets 15 bits. */
+  const MAX_CLEAR_BYTES = 0x7fff;
+  const EMPTY_AAD = new Uint8Array(0);
+  /** Consecutive decrypt failures on one track before `e2ee.decryption_stalled` fires. */
+  const FAILURE_TOLERANCE = 10;
+  /** Replay window in frames. A counter <= highestSeen - this is rejected. */
+  const REPLAY_WINDOW = 1024;
+  /**
+   * One more than this wraps into an (ivPrefix, counter) pair the sender already
+   * used, which is IV reuse under AES-GCM. Encoding throws instead.
+   */
+  const COUNTER_HARD_LIMIT = 0xffffffff; // 2^32 - 1
+
+  /** At most one notification per second per key. */
+  const THROTTLE_INTERVAL_MS = 1000;
+  /**
+   * Rate limiter keyed by an arbitrary string, so one throttle can cover several
+   * independent conditions (a keyIndex, a userId) without them muting each other.
+   *
+   * Lives here because throttling is a delivery rule, not a general utility -
+   * every user of it is in this file.
+   */
+  class Throttle {
+    intervalMs;
+    lastFiredAt = new Map();
+    constructor(intervalMs) {
+      this.intervalMs = intervalMs;
+    }
+    /**
+     * True at most once per `intervalMs` for that key, so a sustained failure
+     * cannot flood the host with notifications.
+     */
+    tryFire = (key) => {
+      const now = Date.now();
+      if (now - (this.lastFiredAt.get(key) ?? 0) > this.intervalMs) {
+        this.lastFiredAt.set(key, now);
+        return true;
+      }
+      return false;
+    };
+  }
+  /**
+   * Internal log-only channel: no `E2EEEventMap` entry, so the manager logs it
+   * rather than emitting it to the host.
+   */
+  const reportError = (message) => {
+    self.postMessage({ type: 'e2ee.error', message });
+  };
+  /**
+   * The encoder holds no key, so every outgoing frame is dropped. Without this
+   * the host just sees black video with nothing to act on. Throttled per user,
+   * and stops on its own once a key arrives.
+   *
+   * Module-scoped rather than per transform: this condition is per user by
+   * definition, so every track sharing one throttle is the point.
+   */
+  const missingKeyThrottle = new Throttle(THROTTLE_INTERVAL_MS);
+  const notifyMissingEncodeKey = (userId) => {
+    if (missingKeyThrottle.tryFire(userId)) {
+      self.postMessage({ type: 'e2ee.missing_key', userId });
+    }
+  };
+  /** Encode-side signals for one track. */
+  class EncodeNotifier {
+    userId;
+    trackType;
+    /** True once a failure was reported, until {@link recovered} re-arms it. */
+    latched = false;
+    constructor(userId, trackType) {
+      this.userId = userId;
+      this.trackType = trackType;
+    }
+    /** First failure of a run; silent until {@link recovered} re-arms it. */
+    failed = (reason) => {
+      if (this.latched) return;
+      this.latched = true;
+      self.postMessage({
+        type: 'e2ee.encryption_failed',
+        userId: this.userId,
+        trackType: this.trackType,
+        reason,
+      });
+    };
+    /**
+     * A frame encrypted again, so the next failure is worth reporting. Re-arming
+     * is deliberate: it stops one early transient error from hiding a later
+     * permanent one, such as the frame-counter hard limit.
+     */
+    recovered = () => {
+      this.latched = false;
+    };
+  }
+  /**
+   * Decode-side signals for one track.
+   *
+   * One notifier is one track, so `userId` is constant: each throttle holds a
+   * single entry and limits that track alone.
+   */
+  class DecodeNotifier {
+    userId;
+    trackType;
+    failureThrottle = new Throttle(THROTTLE_INTERVAL_MS);
+    /**
+     * A key in flight, or a rotation whose keyIndex has not arrived, are both
+     * normal. Keyed by keyIndex: one signal per key epoch.
+     */
+    missingKeyThrottle = new Throttle(THROTTLE_INTERVAL_MS);
+    cleartextThrottle = new Throttle(THROTTLE_INTERVAL_MS);
+    /**
+     * Keyed by user, deliberately not by version. A sender's version is a
+     * compile-time constant, so a track only ever sees one value legitimately -
+     * while the byte is plaintext, so a relay rewriting it per frame would
+     * otherwise get one event per distinct value and multiply the rate by 255.
+     */
+    versionThrottle = new Throttle(THROTTLE_INTERVAL_MS);
+    /**
+     * True once a `decryption_failed` reached the host. Pairs the two signals:
+     * only a delivered failure needs clearing, and clearing it re-arms this.
+     */
+    failureReported = false;
+    constructor(userId, trackType) {
+      this.userId = userId;
+      this.trackType = trackType;
+    }
+    /** GCM tag failure. Throttled; records that a failure reached the host. */
+    failed = () => {
+      if (!this.failureThrottle.tryFire(this.userId)) return;
+      this.failureReported = true;
+      self.postMessage({
+        type: 'e2ee.decryption_failed',
+        userId: this.userId,
+        trackType: this.trackType,
+      });
+    };
+    /** Paired with {@link failed}: no-op unless a failure was delivered. */
+    resumed = () => {
+      if (!this.failureReported) return;
+      this.failureReported = false;
+      self.postMessage({
+        type: 'e2ee.decryption_resumed',
+        userId: this.userId,
+        trackType: this.trackType,
+      });
+    };
+    /** A frame named a key this peer does not hold. Throttled per keyIndex. */
+    missingKey = (keyIndex) => {
+      if (!this.missingKeyThrottle.tryFire(String(keyIndex))) return;
+      self.postMessage({
+        type: 'e2ee.missing_key',
+        userId: this.userId,
+        trackType: this.trackType,
+        keyIndex,
+      });
+    };
+    /**
+     * A frame carried this format but a version this build cannot decrypt, so it
+     * was dropped. Throttled per track.
+     */
+    unsupportedVersion = (version) => {
+      if (!this.versionThrottle.tryFire(this.userId)) return;
+      self.postMessage({
+        type: 'e2ee.unsupported_version',
+        userId: this.userId,
+        trackType: this.trackType,
+        version,
+      });
+    };
+    /** A frame carried no E2EE framing and was forwarded as-is. Throttled. */
+    unencrypted = () => {
+      if (!this.cleartextThrottle.tryFire(this.userId)) return;
+      self.postMessage({
+        type: 'e2ee.unencrypted_frame',
+        userId: this.userId,
+        trackType: this.trackType,
+      });
+    };
+    /** Consecutive failures crossed the tolerance. Already once-per-run. */
+    stalled = (keyIndex) => {
+      self.postMessage({
+        type: 'e2ee.decryption_stalled',
+        userId: this.userId,
+        trackType: this.trackType,
+        keyIndex,
+      });
+    };
+  }
+
+  const getOrCreate = (map, userId) => {
+    let inner = map.get(userId);
+    if (!inner) {
+      inner = new Map();
+      map.set(userId, inner);
+    }
+    return inner;
+  };
+  const randomBytes = (n) => {
+    const bytes = new Uint8Array(n);
+    crypto.getRandomValues(bytes);
+    return bytes;
+  };
+  const fingerprint = async (rawKey) => {
+    const hash = await crypto.subtle.digest('SHA-256', rawKey);
+    return new Uint8Array(hash, 0, 8);
+  };
+  /**
+   * The buffer length picks the variant; EncryptionManager already validated it
+   * as 16 or 32 bytes. Passing `length` keeps WebCrypto unambiguous across
+   * browsers.
+   */
+  const aesGcmParams = (rawKey) => ({
+    name: 'AES-GCM',
+    length: rawKey.byteLength * 8,
+  });
+  /**
+   * Import into a non-extractable CryptoKey, with a fresh random IV prefix and
+   * the fingerprint. The fresh prefix is what lets the same raw key be imported
+   * again without IV reuse.
+   */
+  const importKeyMaterial = async (rawKey) => {
+    const [key, fp] = await Promise.all([
+      crypto.subtle.importKey('raw', rawKey, aesGcmParams(rawKey), false, [
+        'encrypt',
+        'decrypt',
+      ]),
+      fingerprint(rawKey),
+    ]);
+    return { key, ivPrefix: randomBytes(IV_PREFIX_LEN), fingerprint: fp };
+  };
+  const toHex = (bytes) =>
+    Array.from(bytes)
+      .map((b) => b.toString(16).padStart(2, '0'))
+      .join('');
+  class KeyStore {
+    perUserKeys = new Map();
+    latestKeyIndex = new Map();
+    /** Shared receive keys retained by epoch so in-flight frames survive rotation. */
+    sharedKeys = new Map();
+    /** The shared epoch used for encode fallback. Older retained epochs never win. */
+    activeSharedKeyIndex;
+    /**
+     * Decryption key for (userId, keyIndex): per-user entry, else the shared key
+     * at that index. The keyIndex comes from the frame trailer.
+     */
+    getKey = (userId, keyIndex) => {
+      const perUser = this.perUserKeys.get(userId)?.get(keyIndex);
+      if (perUser) return perUser.key;
+      return this.sharedKeys.get(keyIndex)?.key;
+    };
+    /**
+     * The encode path's only lookup: latest per-user key, else the explicitly
+     * active shared key. Retained shared epochs are receive-only. The `ivPrefix`
+     * rides along so the encoder never resolves the same material twice.
+     */
+    getLatestKey = (userId) => {
+      const idx = this.latestKeyIndex.get(userId);
+      if (idx !== undefined) {
+        const km = this.perUserKeys.get(userId)?.get(idx);
+        if (km) return { key: km.key, keyIndex: idx, ivPrefix: km.ivPrefix };
+      }
+      if (this.activeSharedKeyIndex === undefined) return null;
+      const shared = this.sharedKeys.get(this.activeSharedKeyIndex);
+      return shared
+        ? {
+            key: shared.key,
+            keyIndex: this.activeSharedKeyIndex,
+            ivPrefix: shared.ivPrefix,
+          }
+        : null;
+    };
+    importKey = async (userId, keyIndex, rawKey) => {
+      try {
+        getOrCreate(this.perUserKeys, userId).set(
+          keyIndex,
+          await importKeyMaterial(rawKey),
+        );
+        this.latestKeyIndex.set(userId, keyIndex);
+      } catch (e) {
+        reportError(
+          `Failed to import key for user ${userId}: ${e?.message || e}`,
+        );
+      }
+    };
+    importSharedKey = async (keyIndex, rawKey) => {
+      try {
+        const material = await importKeyMaterial(rawKey);
+        this.sharedKeys.set(keyIndex, material);
+        this.activeSharedKeyIndex = keyIndex;
+      } catch (e) {
+        reportError(`Failed to import shared key: ${e?.message || e}`);
+      }
+    };
+    /**
+     * Retire exactly one of a user's epochs, leaving the rest usable.
+     *
+     * Clearing `latestKeyIndex` along with the slot is load-bearing. Left on a
+     * removed index, {@link getLatestKey} resolves nothing there and falls
+     * through to the active shared epoch, so the local user's frames would
+     * quietly move from a key only they hold to one every participant holds. No
+     * older epoch is promoted either, matching {@link removeSharedKey}.
+     */
+    removeKey = (userId, keyIndex) => {
+      const perKeyIndex = this.perUserKeys.get(userId);
+      if (!perKeyIndex?.delete(keyIndex)) return;
+      if (perKeyIndex.size === 0) this.perUserKeys.delete(userId);
+      if (this.latestKeyIndex.get(userId) === keyIndex) {
+        this.latestKeyIndex.delete(userId);
+      }
+    };
+    /**
+     * Leaves the frame counters intact on purpose: a reset counter would reuse
+     * IVs if the same raw key is imported again later. They live in
+     * `frameCounter.ts`, so this cannot reach them even by accident.
+     */
+    removeAllKeys = (userId) => {
+      this.perUserKeys.delete(userId);
+      this.latestKeyIndex.delete(userId);
+    };
+    /**
+     * Removes exactly one shared receive epoch. Removing the active epoch also
+     * disables shared-key encode fallback; an older epoch is never reactivated
+     * implicitly because doing so could resume sending with a retired key.
+     */
+    removeSharedKey = (keyIndex) => {
+      this.sharedKeys.delete(keyIndex);
+      if (this.activeSharedKeyIndex === keyIndex) {
+        this.activeSharedKeyIndex = undefined;
+      }
+    };
+    /**
+     * Debug snapshot. Fingerprints only: enough to confirm a sender and receiver
+     * hold matching key material, and it exposes no key.
+     */
+    keyState = () => ({
+      perUserKeys: Array.from(this.perUserKeys).flatMap(
+        ([userId, perKeyIndex]) =>
+          Array.from(perKeyIndex, ([keyIndex, km]) => ({
+            userId,
+            keyIndex,
+            fingerprint: toHex(km.fingerprint),
+          })),
+      ),
+      sharedKeys: Array.from(this.sharedKeys, ([keyIndex, material]) => ({
+        keyIndex,
+        fingerprint: toHex(material.fingerprint),
+        isActive: keyIndex === this.activeSharedKeyIndex,
+      })),
+    });
+    /**
+     * @internal Test-only. Production teardown is `Worker.terminate()`, which
+     * reclaims the whole worker.
+     */
+    clear = () => {
+      this.perUserKeys.clear();
+      this.latestKeyIndex.clear();
+      this.sharedKeys.clear();
+      this.activeSharedKeyIndex = undefined;
+    };
+  }
+  /** The worker has exactly one. */
+  const keyStore = new KeyStore();
+
+  /**
+   * Whether reporting is on. Module-scoped rather than per registry: the worker
+   * has exactly one of each, and a single flag keeps encode and decode from
+   * drifting apart.
+   */
+  let perfEnabled = false;
+  let perfInterval = null;
+  let perfLastTick = 0;
+  /**
+   * Counter handle for one track, held by that track's transform for its
+   * lifetime. Every method no-ops while reporting is off.
+   */
+  class TrackStats {
+    stats;
+    key;
+    labels;
+    constructor(stats, key, labels) {
+      this.stats = stats;
+      this.key = key;
+      this.labels = labels;
+    }
+    /**
+     * This track's accumulator, created on first use. Lazy on purpose: the entry
+     * is what puts a row in the next report, so a track that goes idle after a
+     * flush drops out instead of reporting 0 fps forever.
+     */
+    entry = () => {
+      if (!perfEnabled) return undefined;
+      let stat = this.stats.get(this.key);
+      if (!stat) {
+        stat = { ...this.labels, count: 0, maxCryptoMs: 0 };
+        this.stats.set(this.key, stat);
+      }
+      return stat;
+    };
+    /** Count one frame through the transform. */
+    bump = () => {
+      const stat = this.entry();
+      if (stat) stat.count++;
+    };
+    /** Timestamp to hand back to {@link endCrypto}; 0 while disabled. */
+    startCrypto = () => (perfEnabled ? performance.now() : 0);
+    endCrypto = (startedAt) => {
+      const stat = this.entry();
+      if (!stat) return;
+      stat.maxCryptoMs = Math.max(
+        stat.maxCryptoMs,
+        performance.now() - startedAt,
+      );
+    };
+  }
+  /**
+   * Per-track counters for one direction. The key is unique per track, so a vp8
+   * camera and a vp8 screen share (encode), or a peer's audio and video (decode),
+   * are reported apart instead of summed.
+   */
+  class StatsRegistry {
+    stats = new Map();
+    track = (key, labels) => new TrackStats(this.stats, key, labels);
+    /** Drain all accumulators into per-track rates. */
+    flush = (dtSec) => {
+      const samples = Array.from(
+        this.stats.values(),
+        ({ count, maxCryptoMs, ...labels }) => ({
+          ...labels,
+          fps: count / dtSec,
+          maxCryptoMs,
+        }),
+      );
+      this.stats.clear();
+      return samples;
+    };
+    clear = () => this.stats.clear();
+    removeUser = (userId) => {
+      for (const [key, stat] of this.stats) {
+        if (stat.userId === userId) this.stats.delete(key);
+      }
+    };
+  }
+  const encodeStats = new StatsRegistry();
+  const decodeStats = new StatsRegistry();
+  const startPerfReport = () => {
+    if (perfInterval) return; // a second interval would leak
+    perfEnabled = true;
+    perfLastTick = performance.now();
+    perfInterval = setInterval(() => {
+      const now = performance.now();
+      const dtSec = Math.max(0.001, (now - perfLastTick) / 1000);
+      perfLastTick = now;
+      self.postMessage({
+        type: 'e2ee.perf_report',
+        encode: encodeStats.flush(dtSec),
+        decode: decodeStats.flush(dtSec),
+      });
+    }, 1000);
+  };
+  const stopPerfReport = () => {
+    perfEnabled = false;
+    if (perfInterval) {
+      clearInterval(perfInterval);
+      perfInterval = null;
+    }
+    encodeStats.clear();
+    decodeStats.clear();
+  };
+
+  /**
+   * The on-wire framing: the 20-byte trailer appended to every encrypted frame,
+   * and the 12-byte IV both directions derive.
+   *
+   * Write and read live together on purpose. They are one contract - the encoder
+   * lays out bytes the decoder must find at the same offsets - so the layout is
+   * defined once, here, and a change to it is a wire break: bump
+   * {@link E2EE_VERSION} and regenerate the SPEC section 11 vectors.
+   *
+   * Layout, from the trailer's first byte:
+   *   [4B frameCounter][8B ivPrefix][1B keyIndex][2B clearBytes|flags]
+   *   [1B version][4B magic]
+   */
+  const OFF_IV_PREFIX = FRAME_COUNTER_LEN; // 4
+  const OFF_KEY_INDEX = OFF_IV_PREFIX + IV_PREFIX_LEN; // 12
+  const OFF_CLEAR_BYTES = OFF_KEY_INDEX + 1; // 13
+  const OFF_VERSION = OFF_CLEAR_BYTES + 2; // 15
+  const OFF_MAGIC = OFF_VERSION + 1; // 16
+  /**
+   * Fill a pre-allocated 12-byte IV: `[8B ivPrefix][4B frameCounter, BE]`.
+   *
+   * The encoder builds it from its own prefix and counter; the decoder rebuilds
+   * the identical bytes from the trailer. The buffer is reused across frames
+   * rather than allocated per frame - this runs once per frame on every track.
+   */
+  const fillIV = (iv, ivView, prefix, frameCounter) => {
+    iv.set(prefix, 0);
+    ivView.setUint32(IV_PREFIX_LEN, frameCounter);
+  };
+  const writeTrailer = (
+    dst,
+    offset,
+    frameCounter,
+    ivPrefix,
+    keyIndex,
+    clearBytes,
+    isRbsp,
+  ) => {
+    if (clearBytes > MAX_CLEAR_BYTES) {
+      throw new Error(
+        `clearBytes ${clearBytes} exceeds 15-bit max ${MAX_CLEAR_BYTES}`,
+      );
+    }
+    if (ivPrefix.length !== IV_PREFIX_LEN) {
+      throw new Error(
+        `ivPrefix must be ${IV_PREFIX_LEN} bytes, got ${ivPrefix.length}`,
+      );
+    }
+    const view = new DataView(dst.buffer, dst.byteOffset, dst.byteLength);
+    view.setUint32(offset, frameCounter);
+    dst.set(ivPrefix, offset + OFF_IV_PREFIX);
+    dst[offset + OFF_KEY_INDEX] = keyIndex;
+    view.setUint16(
+      offset + OFF_CLEAR_BYTES,
+      isRbsp ? clearBytes | RBSP_FLAG : clearBytes,
+    );
+    dst[offset + OFF_VERSION] = E2EE_VERSION;
+    view.setUint32(offset + OFF_MAGIC, MAGIC);
+  };
+  /**
+   * IV fields only, from an already-recognized trailer. An H264 RBSP frame
+   * escapes these three with the ciphertext, so un-escape the unit before
+   * calling this.
+   */
+  const readTrailerIv = (buf) => {
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    const start = buf.length - TRAILER_LEN;
+    return {
+      frameCounter: view.getUint32(start),
+      ivPrefix: buf.subarray(start + OFF_IV_PREFIX, start + OFF_KEY_INDEX),
+      keyIndex: buf[start + OFF_KEY_INDEX],
+    };
+  };
+  /**
+   * The frozen identification suffix: `version (1) || magic (4)`. A literal, not
+   * `TRAILER_LEN - OFF_VERSION`, because this length is frozen at 5 for every
+   * version present and future while those two constants describe v1 only - a
+   * later layout change must break the round-trip test, not silently move the
+   * suffix older receivers depend on. `trailer.test.ts` pins it to the bytes
+   * `writeTrailer` actually emits.
+   *
+   * Read from the end rather than from a trailer start, because a future version
+   * may not use a 20-byte trailer, and a receiver that cannot decrypt such a
+   * frame still has to recognize it.
+   */
+  const IDENT_SUFFIX_LEN = 5;
+  /** Within the suffix: the magic follows the single version byte. */
+  const OFF_SUFFIX_MAGIC = 1;
+  /**
+   * The framing version of a frame carrying this format, or `null` if the frame
+   * is not ours at all.
+   *
+   * This is what separates the two reasons {@link readTrailer} returns `null`:
+   * an unrelated cleartext frame, versus an encrypted frame from a peer on a
+   * version this build cannot decrypt.
+   *
+   * @param view - An existing view over exactly `src`, to avoid a second
+   * allocation on the per-frame decode path. Built here when omitted.
+   */
+  const readFramingVersion = (src, view) => {
+    if (src.length < IDENT_SUFFIX_LEN) return null;
+    const bytes =
+      view ?? new DataView(src.buffer, src.byteOffset, src.byteLength);
+    const start = src.length - IDENT_SUFFIX_LEN;
+    if (bytes.getUint32(start + OFF_SUFFIX_MAGIC) !== MAGIC) return null;
+    return src[start];
+  };
+  const readTrailer = (src) => {
+    if (src.length < TRAILER_LEN) return null;
+    const view = new DataView(src.buffer, src.byteOffset, src.byteLength);
+    if (readFramingVersion(src, view) !== E2EE_VERSION) return null;
+    const start = src.length - TRAILER_LEN;
+    const raw = view.getUint16(start + OFF_CLEAR_BYTES);
+    const clearBytes = raw & MAX_CLEAR_BYTES;
+    // Bail out before allocating; the decrypt would fail anyway.
+    if (clearBytes > src.length - TRAILER_LEN) return null;
+    // The last 7 bytes survive escaping untouched: the RBSP flag holds the
+    // clearBytes high byte >= 0x80 and breaks any zero run. The three below are
+    // valid only on a non-RBSP frame; see {@link readTrailerIv}.
+    return {
+      frameCounter: view.getUint32(start),
+      ivPrefix: src.subarray(start + OFF_IV_PREFIX, start + OFF_KEY_INDEX),
+      keyIndex: src[start + OFF_KEY_INDEX],
+      clearBytes,
+      isRbsp: (raw & RBSP_FLAG) !== 0,
+    };
+  };
+
+  /**
+   * Monotonic, and deliberately shared across every track and codec this sender
+   * publishes: the IV is `ivPrefix ∥ counter`, so two tracks drawing from
+   * separate counters would encrypt different frames under the same IV.
+   *
+   * Survives `removeAllKeys` on purpose - if the same raw key is imported again the
+   * counter keeps climbing, so no (ivPrefix, counter) pair repeats. Second guard
+   * against IV reuse, after the per-import random prefix.
+   */
+  let counter = 0;
+  const nextFrameCounter = () => {
+    const next = counter + 1;
+    if (next > COUNTER_HARD_LIMIT) {
+      throw new Error(
+        'frame counter exhausted, create a new EncryptionManager',
+      );
+    }
+    counter = next;
+    return next;
+  };
+
+  const encodeTransform = (userId, codec, trackType) => {
+    const profile = getCodecProfile(codec);
+    const isNalu = profile.rbsp;
+    // trackType is unique per sender; fall back to codec when it is unlabeled.
+    const trackKey = trackType ?? codec ?? 'unknown';
+    const codecKey = codec ?? 'unknown';
+    const stats = encodeStats.track(trackKey, {
+      userId,
+      trackType: trackKey,
+      codec: codecKey,
+    });
+    const notify = new EncodeNotifier(userId, trackType);
+    const iv = new Uint8Array(IV_LEN);
+    const ivView = new DataView(iv.buffer);
+    /**
+     * Times the encryption, emits the frame, reports failures. `produce` returns
+     * the new bytes, or null when it already dropped the frame with its own
+     * reason. Any throw drops the frame; it is never emitted in the clear.
+     */
+    const finishEncode = async (frame, controller, produce) => {
+      try {
+        const t0 = stats.startCrypto();
+        const out = await produce();
+        stats.endCrypto(t0);
+        if (!out) return;
+        frame.data = out.buffer;
+        controller.enqueue(frame);
+        notify.recovered();
+        stats.bump();
+      } catch (err) {
+        notify.failed(err?.message || String(err));
+      }
+    };
+    return new TransformStream({
+      async transform(frame, controller) {
+        // No payload to encrypt.
+        if (frame.data.byteLength === 0) {
+          controller.enqueue(frame);
+          stats.bump();
+          return;
+        }
+        const entry = keyStore.getLatestKey(userId);
+        if (!entry) {
+          notifyMissingEncodeKey(userId);
+          return;
+        }
+        const { key: cryptoKey, keyIndex, ivPrefix: prefix } = entry;
+        return finishEncode(frame, controller, async () => {
+          // A key/delta type marks a video frame. An audio-only profile has no
+          // clear-byte rule for one, so drop it rather than ship a whole-frame,
+          // unescaped encrypt the SFU cannot read and a NALU packetizer would
+          // split. Checked before the counter, so a dropped frame costs no IV.
+          if (profile.audioOnly && frame.type !== undefined) {
+            notify.failed(`no clear-byte rule for video on codec ${codecKey}`);
+            return null;
+          }
+          const src = new Uint8Array(frame.data);
+          const clearBytes = profile.clearBytes(frame.type, src);
+          if (clearBytes > MAX_CLEAR_BYTES) {
+            // Writing this would overflow into the RBSP flag bit.
+            notify.failed('clearBytes exceeds trailer capacity');
+            return null;
+          }
+          // Throws at the 32-bit ceiling; finishEncode catches it, so the track
+          // fails closed instead of reusing an IV.
+          const counter = nextFrameCounter();
+          fillIV(iv, ivView, prefix, counter);
+          const aad = clearBytes > 0 ? src.subarray(0, clearBytes) : EMPTY_AAD;
+          const plaintext = clearBytes > 0 ? src.subarray(clearBytes) : src;
+          const encrypted = await crypto.subtle.encrypt(
+            { name: 'AES-GCM', iv, additionalData: aad },
+            cryptoKey,
+            plaintext,
+          );
+          const ciphertext = new Uint8Array(encrypted);
+          if (isNalu && clearBytes > 0) {
+            // Escape ciphertext and trailer as one unit: random ciphertext or
+            // the counter bytes could otherwise form a fake Annex-B start code
+            // that libwebrtc's H264 packetizer would split on. The escaper is
+            // seeded with the clear header's trailing zeros so a start code
+            // cannot form across the clear/encrypted boundary either.
+            //
+            // The last 7 trailer bytes survive escaping untouched: the RBSP flag
+            // holds the clearBytes high byte at >= 0x80, which breaks any zero
+            // run before it can reach them. The decoder reads them off the raw
+            // frame tail to locate the unit.
+            //
+            // Escaping straight behind the clear header copies the ciphertext
+            // once, instead of staging it through an intermediate unit buffer
+            // and copying it again.
+            const trailer = new Uint8Array(TRAILER_LEN);
+            writeTrailer(
+              trailer,
+              0,
+              counter,
+              prefix,
+              keyIndex,
+              clearBytes,
+              true,
+            );
+            const body = [ciphertext, trailer];
+            const seed = boundarySeedZeros(aad);
+            const dst = new Uint8Array(
+              clearBytes + rbspEscapedLength(body, seed),
+            );
+            dst.set(aad, 0);
+            rbspEscapeInto(dst, clearBytes, body, seed);
+            return dst;
+          }
+          const dst = new Uint8Array(
+            clearBytes + ciphertext.length + TRAILER_LEN,
+          );
+          if (clearBytes > 0) dst.set(aad, 0);
+          dst.set(ciphertext, clearBytes);
+          writeTrailer(
+            dst,
+            clearBytes + ciphertext.length,
+            counter,
+            prefix,
+            keyIndex,
+            clearBytes,
+            false,
+          );
+          return dst;
+        });
+      },
+    });
+  };
+
+  /**
+   * Consecutive decryption failures on one track, keyed by keyIndex so a rotation
+   * starts fresh.
+   */
+  class FailureTracker {
+    counts = new Map();
+    /**
+     * True only on the failure crossing {@link FAILURE_TOLERANCE}, so
+     * `e2ee.decryption_stalled` fires once per run.
+     */
+    recordFailure = (keyIndex) => {
+      const next = (this.counts.get(keyIndex) ?? 0) + 1;
+      this.counts.set(keyIndex, next);
+      return next === FAILURE_TOLERANCE + 1;
+    };
+    /**
+     * True if there was a count to clear. Do NOT gate `e2ee.decryption_resumed`
+     * on it: that event names a track, not a key epoch, so a track recovering on
+     * a new keyIndex must still clear it.
+     */
+    recordSuccess = (keyIndex) => this.counts.delete(keyIndex);
+  }
+
+  /** Length-safe byte comparison, for matching a frame's prefix to an epoch. */
+  const bytesEqual = (a, b) => {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+    return true;
+  };
+  const REPLAY_WINDOW_WORDS = REPLAY_WINDOW >>> 5;
+  /**
+   * One sender IV-prefix epoch: a high-water mark plus a bitmap over the
+   * preceding {@link REPLAY_WINDOW} counters, where bit `counter % REPLAY_WINDOW`
+   * marks a seen counter. O(1) checks and in-order advance, where a `Set` would
+   * need an O(REPLAY_WINDOW) prune per frame.
+   */
+  class ReplayEpoch {
+    /** Copied, since the caller's view points into a frame buffer that is reused. */
+    prefix;
+    highest;
+    bitmap = new Uint32Array(REPLAY_WINDOW_WORDS);
+    constructor(prefix, counter) {
+      this.prefix = prefix.slice();
+      this.highest = counter;
+      this.mark(counter);
+    }
+    /** Above the high-water mark, or inside the window and not yet seen. */
+    accepts = (counter) => {
+      if (counter > this.highest) return true;
+      if (counter <= this.highest - REPLAY_WINDOW) return false;
+      return !this.isMarked(counter);
+    };
+    record = (counter) => {
+      if (counter > this.highest) {
+        // Slots repeat every REPLAY_WINDOW counters, so skipped ones can hold a
+        // stale bit and must be cleared. In-order frames skip none; a large jump
+        // makes the whole bitmap stale.
+        if (counter - this.highest >= REPLAY_WINDOW) {
+          this.bitmap.fill(0);
+        } else {
+          for (let c = this.highest + 1; c < counter; c++) this.clear(c);
+        }
+        this.highest = counter;
+      }
+      this.mark(counter);
+    };
+    slot = (counter) => {
+      const idx = counter % REPLAY_WINDOW;
+      return { word: idx >>> 5, mask: 1 << (idx & 31) };
+    };
+    isMarked = (counter) => {
+      const { word, mask } = this.slot(counter);
+      return (this.bitmap[word] & mask) !== 0;
+    };
+    mark = (counter) => {
+      const { word, mask } = this.slot(counter);
+      this.bitmap[word] |= mask;
+    };
+    clear = (counter) => {
+      const { word, mask } = this.slot(counter);
+      this.bitmap[word] &= ~mask;
+    };
+  }
+  /**
+   * Sender IV-prefix "epochs" one track's guard keeps. One is normal; a second or
+   * third appears briefly around a key re-import or sender restart, while old and
+   * new prefixes interleave in the jitter buffer.
+   *
+   * Eviction is safe because the sender never reuses an (ivPrefix, counter) pair.
+   * Only `commit` creates and evicts epochs, and only authenticated frames reach
+   * it, so a relay cannot forge new-prefix frames to evict a genuine epoch.
+   */
+  const REPLAY_EPOCHS = 3;
+  /**
+   * Replay guard for one remote track.
+   *
+   * Shared across tracks it would couple them: independent SSRCs and jitter
+   * buffers mean delivery skew could advance the high-water mark far enough to
+   * reject a lagging track's frames, dropping media and reporting false failures.
+   *
+   * Inside a track the sender's IV prefix partitions the window further, so a
+   * sender restart (fresh prefix, counter near 0) opens a clean window instead of
+   * losing its low counters to a stale mark.
+   *
+   * Only receive-side bookkeeping is per track. The sender's counter stays global
+   * per user (see `frameCounter.ts`), which is what keeps IVs unique across a
+   * user's tracks and the wire format identical for other SDKs.
+   */
+  class ReplayWindow {
+    epochs = [];
+    find = (ivPrefix) =>
+      this.epochs.find((e) => bytesEqual(e.prefix, ivPrefix));
+    /**
+     * True when this prefix can accept `counter`: new prefix, above the
+     * high-water mark, or inside the window and not yet committed.
+     *
+     * Changes no state. A relay can forge the trailer fields this reads, so only
+     * an authenticated frame advances the window. See {@link commit}.
+     */
+    peek = (counter, ivPrefix) => {
+      // A prefix with no committed frame yet opens a clean window.
+      return this.find(ivPrefix)?.accepts(counter) ?? true;
+    };
+    /**
+     * Record `counter` as seen, advancing the high-water mark. Call it only after
+     * AES-GCM authenticates, so unauthenticated bytes cannot wedge the window or
+     * evict a genuine epoch.
+     */
+    commit = (counter, ivPrefix) => {
+      const epoch = this.find(ivPrefix);
+      if (epoch) {
+        epoch.record(counter);
+        return;
+      }
+      this.epochs.unshift(new ReplayEpoch(ivPrefix, counter));
+      if (this.epochs.length > REPLAY_EPOCHS) this.epochs.pop();
+    };
+  }
+
+  const decodeTransform = (userId, trackType) => {
+    // Counts a peer's audio and video apart.
+    const trackKey = trackType ?? 'unknown';
+    const stats = decodeStats.track(`${userId}/${trackKey}`, {
+      userId,
+      trackType: trackKey,
+    });
+    const notify = new DecodeNotifier(userId, trackType);
+    const iv = new Uint8Array(IV_LEN);
+    const ivView = new DataView(iv.buffer);
+    // Per track, so a user's audio, video and screen share never share a window
+    // or a failure count. The separate count is what lets
+    // e2ee.decryption_stalled fire.
+    const replay = new ReplayWindow();
+    const failures = new FailureTracker();
+    /**
+     * Gates on key and replay, decrypts, emits, then records failure or recovery.
+     * `decrypt` throws on a GCM tag failure, dropping the frame. Separate from
+     * the framing parse so the trust ordering lives in one place.
+     *
+     * Trust ordering (the SFrame/SRTP rule): a relay can forge `frameCounter`,
+     * `ivPrefix` and `keyIndex`, which are plaintext in the trailer, so nothing
+     * changes trust state until GCM authenticates. Hence peek before, commit
+     * after. The failure counter is diagnostic only - it gates `e2ee.decryption_stalled`,
+     * never the decrypt attempt - so forged frames cannot mark a key invalid.
+     */
+    const finishDecode = async (
+      frame,
+      controller,
+      keyIndex,
+      ivPrefix,
+      frameCounter,
+      decrypt,
+    ) => {
+      const cryptoKey = keyStore.getKey(userId, keyIndex);
+      if (!cryptoKey) {
+        notify.missingKey(keyIndex);
+        return;
+      }
+      // No state change. A replay or an out-of-window frame is dropped silently;
+      // neither is a decryption failure.
+      if (!replay.peek(frameCounter, ivPrefix)) return;
+      try {
+        const t0 = stats.startCrypto();
+        const data = await decrypt(cryptoKey);
+        stats.endCrypto(t0);
+        // Authenticated: only now is it safe to advance the replay window.
+        replay.commit(frameCounter, ivPrefix);
+        // Independent on purpose: the count is per keyIndex, but
+        // `decryption_failed` is per track, so a track recovering on a NEW
+        // keyIndex must still clear it. Gating on recordSuccess would latch the
+        // host on failed forever.
+        failures.recordSuccess(keyIndex);
+        notify.resumed();
+        frame.data = data;
+        controller.enqueue(frame);
+        stats.bump();
+      } catch {
+        // True only on the failure crossing the tolerance, so
+        // `e2ee.decryption_stalled` fires once per run, not once per frame.
+        const stalled = failures.recordFailure(keyIndex);
+        notify.failed();
+        if (stalled) notify.stalled(keyIndex);
+      }
+    };
+    return new TransformStream({
+      async transform(frame, controller) {
+        if (frame.data.byteLength === 0) {
+          controller.enqueue(frame);
+          stats.bump();
+          return;
+        }
+        const src = new Uint8Array(frame.data);
+        const trailer = readTrailer(src);
+        if (!trailer) {
+          // Ours but unreadable: drop rather than forward. Handing ciphertext to
+          // the decoder renders corruption and reads to the host as a downgrade,
+          // when the actual condition is that this build is the older one.
+          const version = readFramingVersion(src);
+          if (version !== null && version !== E2EE_VERSION) {
+            notify.unsupportedVersion(version);
+            return;
+          }
+          notify.unencrypted();
+          controller.enqueue(frame);
+          stats.bump();
+          return;
+        }
+        const { clearBytes, isRbsp } = trailer;
+        // An RBSP (H264) frame escaped the ciphertext together with the counter,
+        // ivPrefix and keyIndex, so un-escape to recover them; only the trailer
+        // tail read above stayed clear. A non-RBSP frame keeps the trailer raw.
+        let { frameCounter, ivPrefix, keyIndex } = trailer;
+        let ciphertext;
+        if (isRbsp) {
+          // Same boundary seed as the encoder, derived from the same clear bytes.
+          const seed = boundarySeedZeros(src.subarray(0, clearBytes));
+          const unit = rbspUnescape(src.subarray(clearBytes), seed);
+          // Un-escaping can leave less than a trailer, since readTrailer sized
+          // clearBytes against the raw frame. A negative offset would throw out
+          // of transform() and kill this track's pipeline for the session, and a
+          // relay can forge the shape: clearBytes and the flag are plaintext.
+          if (unit.length < TRAILER_LEN) return;
+          ({ frameCounter, ivPrefix, keyIndex } = readTrailerIv(unit));
+          ciphertext = unit.subarray(0, unit.length - TRAILER_LEN);
+        } else {
+          ciphertext = src.subarray(clearBytes, src.length - TRAILER_LEN);
+        }
+        return finishDecode(
+          frame,
+          controller,
+          keyIndex,
+          ivPrefix,
+          frameCounter,
+          async (key) => {
+            fillIV(iv, ivView, ivPrefix, frameCounter);
+            const aad =
+              clearBytes > 0 ? src.subarray(0, clearBytes) : EMPTY_AAD;
+            const decrypted = await crypto.subtle.decrypt(
+              { name: 'AES-GCM', iv, additionalData: aad },
+              key,
+              ciphertext,
+            );
+            if (clearBytes === 0) return decrypted;
+            const plaintext = new Uint8Array(decrypted);
+            const dst = new Uint8Array(clearBytes + plaintext.length);
+            dst.set(src.subarray(0, clearBytes), 0);
+            dst.set(plaintext, clearBytes);
+            return dst.buffer;
+          },
+        );
+      },
+    });
+  };
+
+  /**
+   * E2EE Web Worker entry point. Owns the worker's message interface and wires
+   * the encrypt/decrypt transforms into WebRTC Encoded Transforms. The main
+   * thread distributes keys by postMessage, and transforms look one up per frame
+   * by (userId, keyIndex).
+   *
+   * ## Wire format
+   *
+   * Frame layout is [clear header][ciphertext + GCM tag][20B trailer], so 36
+   * bytes of overhead. The trailer holds:
+   *   [4B frameCounter][8B ivPrefix][1B keyIndex][2B clearBytes|flags]
+   *   [1B version][4B 0xE2EEFEED]
+   *
+   * The clear header keeps codec headers readable so the SFU can detect keyframes
+   * and select layers: 1 byte for Opus, 10/3 for VP8 and VP9 (key/delta), and for
+   * H264 everything up to the first slice NALU + 2, with the encrypted tail
+   * RBSP-escaped against fake start codes. It doubles as the AAD, so the SFU can
+   * read it but decrypt still detects tampering.
+   *
+   * The 12-byte IV is [ivPrefix][frameCounter]. `ivPrefix` is random per key
+   * import and travels in the trailer, so IVs stay unique even when the host
+   * imports the same raw key twice.
+   *
+   * rollup-plugin-inline-worker bundles this into the function
+   * `../e2ee-worker.ts` exports.
+   *
+   * @see https://developer.mozilla.org/en-US/docs/Web/API/WebRTC_API/Using_Encoded_Transforms
+   * @see https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt#aes-gcm
+   */
+  /**
+   * Decode always runs. An encode whose codec the worker cannot split fails
+   * closed: it still installs a transform, but one that drops every frame, since
+   * returning without one leaves the encoder buffering forever with no signal.
+   */
+  const selectTransform = (operation, userId, codec, trackType) => {
+    if (operation !== 'encode') return decodeTransform(userId, trackType);
+    if (isSupportedCodec(codec))
+      return encodeTransform(userId, codec, trackType);
+    new EncodeNotifier(userId, trackType).failed(
+      `unsupported codec for E2EE: ${codec}`,
+    );
+    // Enqueues nothing: every frame is dropped.
+    return new TransformStream({ transform() {} });
+  };
+  const setupTransform = ({
+    readable,
+    writable,
+    operation,
+    userId,
+    codec,
+    trackType,
+  }) => {
+    const transform = selectTransform(operation, userId, codec, trackType);
+    readable
+      .pipeThrough(transform)
+      .pipeTo(writable)
+      .catch((err) => {
+        reportError(
+          `Transform pipeline error (${operation}, ${userId}): ${err?.message || err}`,
+        );
+      });
+  };
+  addEventListener('rtctransform', (event) => {
+    const { readable, writable, options } = event.transformer;
+    // Same queue as message-based setup, so an in-flight key import completes
+    // before the transform is wired up.
+    enqueue(async () => {
+      setupTransform({ readable, writable, ...options });
+    }).catch((err) => {
+      reportError(`Transform setup failed: ${err?.message || err}`);
+    });
+  });
+  addEventListener('message', ({ data }) => {
+    enqueue(async () => {
+      switch (data.type) {
+        case 'cmd.set_key':
+          await keyStore.importKey(data.userId, data.keyIndex, data.rawKey);
+          break;
+        case 'cmd.set_shared_key':
+          await keyStore.importSharedKey(data.keyIndex, data.rawKey);
+          break;
+        case 'cmd.remove_shared_key':
+          keyStore.removeSharedKey(data.keyIndex);
+          break;
+        case 'cmd.remove_key':
+          // Deliberately keeps this user's decode stats: they are still
+          // publishing, one epoch was retired.
+          keyStore.removeKey(data.userId, data.keyIndex);
+          break;
+        case 'cmd.remove_all_keys':
+          keyStore.removeAllKeys(data.userId);
+          decodeStats.removeUser(data.userId);
+          break;
+        case 'cmd.enable_performance_reporting':
+          if (data.enabled) startPerfReport();
+          else stopPerfReport();
+          break;
+        case 'cmd.request_key_state':
+          self.postMessage({ type: 'e2ee.key_state', ...keyStore.keyState() });
+          break;
+        case 'cmd.setup_transform':
+          setupTransform(data);
+          break;
+        default:
+          reportError(`Unknown command type: ${data.type}`);
+          break;
+      }
+    }).catch((err) => {
+      reportError(`Message handler error: ${err?.message || err}`);
+    });
+  });
+}
+
+export { e2eeWorker };
+//# sourceMappingURL=e2ee-worker.browser.es.js.map