livekit-client 2.22.2 → 2.22.4

package/dist/livekit-client.e2ee.worker.mjs

@@ -424,6 +424,13 @@ function wrapWithContext(base, ctxFn) {
   return proxy;
 }
 const workerLogger = loglevelExports.getLogger(LoggerNames.E2EE);
+const workerLogLevelListeners = new Set();
+const originalWorkerSetLevel = workerLogger.setLevel.bind(workerLogger);
+workerLogger.setLevel = (level, persist) => {
+  originalWorkerSetLevel(level, persist);
+  const numeric = workerLogger.getLevel();
+  workerLogLevelListeners.forEach(cb => cb(numeric));
+};
 
 var e = Object.defineProperty;
 var h = (i, s, t) => s in i ? e(i, s, {
@@ -4105,285 +4112,163 @@ var CryptorEvent;
   CryptorEvent["Error"] = "cryptorError";
 })(CryptorEvent || (CryptorEvent = {}));
 
-function isVideoFrame(frame) {
-  return 'type' in frame;
-}
-function importKey(keyBytes_1) {
-  return __awaiter(this, arguments, void 0, function (keyBytes) {
-    let algorithm = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {
-      name: ENCRYPTION_ALGORITHM
-    };
-    let usage = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 'encrypt';
-    return function* () {
-      // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey
-      return crypto.subtle.importKey('raw', keyBytes, algorithm, false, usage === 'derive' ? ['deriveBits', 'deriveKey'] : ['encrypt', 'decrypt']);
-    }();
-  });
-}
-function getAlgoOptions(algorithmName, salt) {
-  const textEncoder = new TextEncoder();
-  const encodedSalt = textEncoder.encode(salt);
-  switch (algorithmName) {
-    case 'HKDF':
-      return {
-        name: 'HKDF',
-        salt: encodedSalt,
-        hash: 'SHA-256',
-        info: new ArrayBuffer(128)
-      };
-    case 'PBKDF2':
-      {
-        return {
-          name: 'PBKDF2',
-          salt: encodedSalt,
-          hash: 'SHA-256',
-          iterations: 100000
-        };
-      }
-    default:
-      throw new Error("algorithm ".concat(algorithmName, " is currently unsupported"));
+var _a, _b;
+class TypedPromise extends (_b = Promise) {
+  // eslint-disable-next-line @typescript-eslint/no-useless-constructor
+  constructor(executor) {
+    super(executor);
+  }
+  catch(onrejected) {
+    return super.catch(onrejected);
+  }
+  static reject(reason) {
+    return super.reject(reason);
+  }
+  static all(values) {
+    return super.all(values);
+  }
+  static race(values) {
+    return super.race(values);
   }
 }
+_a = TypedPromise;
+TypedPromise.resolve = value => {
+  return Reflect.get(_b, "resolve", _a).call(_a, value);
+};
+
+// tiny, simplified version of https://github.com/lancedikson/bowser/blob/master/src/parser-browsers.js
+// reduced to only differentiate Chrome(ium) based browsers / Firefox / Safari
+const commonVersionIdentifier = /version\/(\d+(\.?_?\d+)+)/i;
+let browserDetails;
 /**
- * Derives a set of keys from the master key.
- * See https://tools.ietf.org/html/draft-omara-sframe-00#section-4.3.1
+ * @internal
  */
-function deriveKeys(material, options) {
-  return __awaiter(this, void 0, void 0, function* () {
-    const algorithmOptions = getAlgoOptions(material.algorithm.name, options.ratchetSalt);
-    // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey#HKDF
-    // https://developer.mozilla.org/en-US/docs/Web/API/HkdfParams
-    const encryptionKey = yield crypto.subtle.deriveKey(algorithmOptions, material, {
-      name: ENCRYPTION_ALGORITHM,
-      length: options.keySize
-    }, false, ['encrypt', 'decrypt']);
-    return {
-      material,
-      encryptionKey
+function getBrowser(userAgent) {
+  let force = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : true;
+  if (typeof navigator === 'undefined') {
+    return;
+  }
+  const ua = (navigator.userAgent).toLowerCase();
+  if (browserDetails === undefined || force) {
+    const browser = browsersList.find(_ref => {
+      let test = _ref.test;
+      return test.test(ua);
+    });
+    browserDetails = browser === null || browser === void 0 ? void 0 : browser.describe(ua);
+  }
+  return browserDetails;
+}
+const browsersList = [{
+  test: /firefox|iceweasel|fxios/i,
+  describe(ua) {
+    const browser = {
+      name: 'Firefox',
+      version: getMatch(/(?:firefox|iceweasel|fxios)[\s/](\d+(\.?_?\d+)+)/i, ua),
+      os: ua.toLowerCase().includes('fxios') ? 'iOS' : undefined,
+      osVersion: getOSVersion(ua)
     };
-  });
+    return browser;
+  }
+}, {
+  test: /chrom|crios|crmo/i,
+  describe(ua) {
+    const browser = {
+      name: 'Chrome',
+      version: getMatch(/(?:chrome|chromium|crios|crmo)\/(\d+(\.?_?\d+)+)/i, ua),
+      os: ua.toLowerCase().includes('crios') ? 'iOS' : undefined,
+      osVersion: getOSVersion(ua)
+    };
+    return browser;
+  }
+}, /* Safari */
+{
+  test: /safari|applewebkit/i,
+  describe(ua) {
+    const browser = {
+      name: 'Safari',
+      version: getMatch(commonVersionIdentifier, ua),
+      os: ua.includes('mobile/') ? 'iOS' : 'macOS',
+      osVersion: getOSVersion(ua)
+    };
+    return browser;
+  }
+}];
+function getMatch(exp, ua) {
+  let id = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 1;
+  const match = ua.match(exp);
+  return match && match.length >= id && match[id] || '';
 }
-/**
- * Ratchets a key. See
- * https://tools.ietf.org/html/draft-omara-sframe-00#section-4.3.5.1
- */
-function ratchet(material, salt) {
-  return __awaiter(this, void 0, void 0, function* () {
-    const algorithmOptions = getAlgoOptions(material.algorithm.name, salt);
-    // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveBits
-    return crypto.subtle.deriveBits(algorithmOptions, material, 256);
-  });
+function getOSVersion(ua) {
+  return ua.includes('mac os') ? getMatch(/\(.+?(\d+_\d+(:?_\d+)?)/, ua, 1).replace(/_/g, '.') : undefined;
 }
-function needsRbspUnescaping(frameData) {
-  for (var i = 0; i < frameData.length - 3; i++) {
-    if (frameData[i] == 0 && frameData[i + 1] == 0 && frameData[i + 2] == 3) return true;
+
+var events = {exports: {}};
+
+var hasRequiredEvents;
+function requireEvents() {
+  if (hasRequiredEvents) return events.exports;
+  hasRequiredEvents = 1;
+  var R = typeof Reflect === 'object' ? Reflect : null;
+  var ReflectApply = R && typeof R.apply === 'function' ? R.apply : function ReflectApply(target, receiver, args) {
+    return Function.prototype.apply.call(target, receiver, args);
+  };
+  var ReflectOwnKeys;
+  if (R && typeof R.ownKeys === 'function') {
+    ReflectOwnKeys = R.ownKeys;
+  } else if (Object.getOwnPropertySymbols) {
+    ReflectOwnKeys = function ReflectOwnKeys(target) {
+      return Object.getOwnPropertyNames(target).concat(Object.getOwnPropertySymbols(target));
+    };
+  } else {
+    ReflectOwnKeys = function ReflectOwnKeys(target) {
+      return Object.getOwnPropertyNames(target);
+    };
   }
-  return false;
-}
-function parseRbsp(stream) {
-  const dataOut = [];
-  var length = stream.length;
-  for (var i = 0; i < stream.length;) {
-    // Be careful about over/underflow here. byte_length_ - 3 can underflow, and
-    // i + 3 can overflow, but byte_length_ - i can't, because i < byte_length_
-    // above, and that expression will produce the number of bytes left in
-    // the stream including the byte at i.
-    if (length - i >= 3 && !stream[i] && !stream[i + 1] && stream[i + 2] == 3) {
-      // Two rbsp bytes.
-      dataOut.push(stream[i++]);
-      dataOut.push(stream[i++]);
-      // Skip the emulation byte.
-      i++;
-    } else {
-      // Single rbsp byte.
-      dataOut.push(stream[i++]);
+  function ProcessEmitWarning(warning) {
+    if (console && console.warn) console.warn(warning);
+  }
+  var NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {
+    return value !== value;
+  };
+  function EventEmitter() {
+    EventEmitter.init.call(this);
+  }
+  events.exports = EventEmitter;
+  events.exports.once = once;
+
+  // Backwards-compat with node 0.10.x
+  EventEmitter.EventEmitter = EventEmitter;
+  EventEmitter.prototype._events = undefined;
+  EventEmitter.prototype._eventsCount = 0;
+  EventEmitter.prototype._maxListeners = undefined;
+
+  // By default EventEmitters will print a warning if more than 10 listeners are
+  // added to it. This is a useful default which helps finding memory leaks.
+  var defaultMaxListeners = 10;
+  function checkListener(listener) {
+    if (typeof listener !== 'function') {
+      throw new TypeError('The "listener" argument must be of type Function. Received type ' + typeof listener);
     }
   }
-  return new Uint8Array(dataOut);
-}
-const kZerosInStartSequence = 2;
-const kEmulationByte = 3;
-function writeRbsp(data_in) {
-  const dataOut = [];
-  var numConsecutiveZeros = 0;
-  for (var i = 0; i < data_in.length; ++i) {
-    var byte = data_in[i];
-    if (byte <= kEmulationByte && numConsecutiveZeros >= kZerosInStartSequence) {
-      // Need to escape.
-      dataOut.push(kEmulationByte);
-      numConsecutiveZeros = 0;
+  Object.defineProperty(EventEmitter, 'defaultMaxListeners', {
+    enumerable: true,
+    get: function () {
+      return defaultMaxListeners;
+    },
+    set: function (arg) {
+      if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {
+        throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received ' + arg + '.');
+      }
+      defaultMaxListeners = arg;
     }
-    dataOut.push(byte);
-    if (byte == 0) {
-      ++numConsecutiveZeros;
-    } else {
-      numConsecutiveZeros = 0;
+  });
+  EventEmitter.init = function () {
+    if (this._events === undefined || this._events === Object.getPrototypeOf(this)._events) {
+      this._events = Object.create(null);
+      this._eventsCount = 0;
     }
-  }
-  return new Uint8Array(dataOut);
-}
-
-class DataCryptor {
-  static makeIV(timestamp) {
-    const iv = new ArrayBuffer(12);
-    const ivView = new DataView(iv);
-    const randomBytes = crypto.getRandomValues(new Uint32Array(1));
-    ivView.setUint32(0, randomBytes[0]);
-    ivView.setUint32(4, timestamp);
-    ivView.setUint32(8, timestamp - DataCryptor.sendCount % 0xffff);
-    DataCryptor.sendCount++;
-    return iv;
-  }
-  static encrypt(data, keys) {
-    return __awaiter(this, void 0, void 0, function* () {
-      const iv = DataCryptor.makeIV(performance.now());
-      const keySet = yield keys.getKeySet();
-      if (!keySet) {
-        throw new Error('No key set found');
-      }
-      const cipherText = yield crypto.subtle.encrypt({
-        name: ENCRYPTION_ALGORITHM,
-        iv
-      }, keySet.encryptionKey, new Uint8Array(data));
-      return {
-        payload: new Uint8Array(cipherText),
-        iv: new Uint8Array(iv),
-        keyIndex: keys.getCurrentKeyIndex()
-      };
-    });
-  }
-  static decrypt(data_1, iv_1, keys_1) {
-    return __awaiter(this, arguments, void 0, function (data, iv, keys) {
-      let keyIndex = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 0;
-      let initialMaterial = arguments.length > 4 ? arguments[4] : undefined;
-      let ratchetOpts = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : {
-        ratchetCount: 0
-      };
-      return function* () {
-        const keySet = yield keys.getKeySet(keyIndex);
-        if (!keySet) {
-          throw new Error('No key set found');
-        }
-        try {
-          const plainText = yield crypto.subtle.decrypt({
-            name: ENCRYPTION_ALGORITHM,
-            iv
-          }, keySet.encryptionKey, new Uint8Array(data));
-          return {
-            payload: new Uint8Array(plainText)
-          };
-        } catch (error) {
-          if (keys.keyProviderOptions.ratchetWindowSize > 0) {
-            if (ratchetOpts.ratchetCount < keys.keyProviderOptions.ratchetWindowSize) {
-              workerLogger.debug("DataCryptor: ratcheting key attempt ".concat(ratchetOpts.ratchetCount, " of ").concat(keys.keyProviderOptions.ratchetWindowSize, ", for data packet"));
-              let ratchetedKeySet;
-              let ratchetResult;
-              if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === keys.getKeySet(keyIndex)) {
-                // only ratchet if the currently set key is still the same as the one used to decrypt this frame
-                // if not, it might be that a different frame has already ratcheted and we try with that one first
-                ratchetResult = yield keys.ratchetKey(keyIndex, false);
-                ratchetedKeySet = yield deriveKeys(ratchetResult.cryptoKey, keys.keyProviderOptions);
-              }
-              const decryptedData = yield DataCryptor.decrypt(data, iv, keys, keyIndex, initialMaterial, {
-                ratchetCount: ratchetOpts.ratchetCount + 1,
-                encryptionKey: ratchetedKeySet === null || ratchetedKeySet === void 0 ? void 0 : ratchetedKeySet.encryptionKey
-              });
-              if (decryptedData && ratchetedKeySet) {
-                // before updating the keys, make sure that the keySet used for this frame is still the same as the currently set key
-                // if it's not, a new key might have been set already, which we don't want to override
-                if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === keys.getKeySet(keyIndex)) {
-                  keys.setKeySet(ratchetedKeySet, keyIndex, ratchetResult);
-                  // decryption was successful, set the new key index to reflect the ratcheted key set
-                  keys.setCurrentKeyIndex(keyIndex);
-                }
-              }
-              return decryptedData;
-            } else {
-              /**
-               * Because we only set a new key once decryption has been successful,
-               * we can be sure that we don't need to reset the key to the initial material at this point
-               * as the key has not been updated on the keyHandler instance
-               */
-              workerLogger.warn('DataCryptor: maximum ratchet attempts exceeded');
-              throw new CryptorError("DataCryptor: valid key missing for participant ".concat(keys.participantIdentity), CryptorErrorReason.InvalidKey, keys.participantIdentity);
-            }
-          } else {
-            throw new CryptorError("DataCryptor: Decryption failed: ".concat(error.message), CryptorErrorReason.InvalidKey, keys.participantIdentity);
-          }
-        }
-      }();
-    });
-  }
-}
-DataCryptor.sendCount = 0;
-
-var events = {exports: {}};
-
-var hasRequiredEvents;
-function requireEvents() {
-  if (hasRequiredEvents) return events.exports;
-  hasRequiredEvents = 1;
-  var R = typeof Reflect === 'object' ? Reflect : null;
-  var ReflectApply = R && typeof R.apply === 'function' ? R.apply : function ReflectApply(target, receiver, args) {
-    return Function.prototype.apply.call(target, receiver, args);
-  };
-  var ReflectOwnKeys;
-  if (R && typeof R.ownKeys === 'function') {
-    ReflectOwnKeys = R.ownKeys;
-  } else if (Object.getOwnPropertySymbols) {
-    ReflectOwnKeys = function ReflectOwnKeys(target) {
-      return Object.getOwnPropertyNames(target).concat(Object.getOwnPropertySymbols(target));
-    };
-  } else {
-    ReflectOwnKeys = function ReflectOwnKeys(target) {
-      return Object.getOwnPropertyNames(target);
-    };
-  }
-  function ProcessEmitWarning(warning) {
-    if (console && console.warn) console.warn(warning);
-  }
-  var NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {
-    return value !== value;
-  };
-  function EventEmitter() {
-    EventEmitter.init.call(this);
-  }
-  events.exports = EventEmitter;
-  events.exports.once = once;
-
-  // Backwards-compat with node 0.10.x
-  EventEmitter.EventEmitter = EventEmitter;
-  EventEmitter.prototype._events = undefined;
-  EventEmitter.prototype._eventsCount = 0;
-  EventEmitter.prototype._maxListeners = undefined;
-
-  // By default EventEmitters will print a warning if more than 10 listeners are
-  // added to it. This is a useful default which helps finding memory leaks.
-  var defaultMaxListeners = 10;
-  function checkListener(listener) {
-    if (typeof listener !== 'function') {
-      throw new TypeError('The "listener" argument must be of type Function. Received type ' + typeof listener);
-    }
-  }
-  Object.defineProperty(EventEmitter, 'defaultMaxListeners', {
-    enumerable: true,
-    get: function () {
-      return defaultMaxListeners;
-    },
-    set: function (arg) {
-      if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {
-        throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received ' + arg + '.');
-      }
-      defaultMaxListeners = arg;
-    }
-  });
-  EventEmitter.init = function () {
-    if (this._events === undefined || this._events === Object.getPrototypeOf(this)._events) {
-      this._events = Object.create(null);
-      this._eventsCount = 0;
-    }
-    this._maxListeners = this._maxListeners || undefined;
-  };
+    this._maxListeners = this._maxListeners || undefined;
+  };
 
   // Obviously not all Emitters should be limited to 10. This function allows
   // that to be increased. Set to zero for unlimited.
@@ -4704,96 +4589,6 @@ function requireEvents() {
 
 var eventsExports = requireEvents();
 
-var _a, _b;
-class TypedPromise extends (_b = Promise) {
-  // eslint-disable-next-line @typescript-eslint/no-useless-constructor
-  constructor(executor) {
-    super(executor);
-  }
-  catch(onrejected) {
-    return super.catch(onrejected);
-  }
-  static reject(reason) {
-    return super.reject(reason);
-  }
-  static all(values) {
-    return super.all(values);
-  }
-  static race(values) {
-    return super.race(values);
-  }
-}
-_a = TypedPromise;
-TypedPromise.resolve = value => {
-  return Reflect.get(_b, "resolve", _a).call(_a, value);
-};
-
-// tiny, simplified version of https://github.com/lancedikson/bowser/blob/master/src/parser-browsers.js
-// reduced to only differentiate Chrome(ium) based browsers / Firefox / Safari
-const commonVersionIdentifier = /version\/(\d+(\.?_?\d+)+)/i;
-let browserDetails;
-/**
- * @internal
- */
-function getBrowser(userAgent) {
-  let force = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : true;
-  if (typeof navigator === 'undefined') {
-    return;
-  }
-  const ua = (navigator.userAgent).toLowerCase();
-  if (browserDetails === undefined || force) {
-    const browser = browsersList.find(_ref => {
-      let test = _ref.test;
-      return test.test(ua);
-    });
-    browserDetails = browser === null || browser === void 0 ? void 0 : browser.describe(ua);
-  }
-  return browserDetails;
-}
-const browsersList = [{
-  test: /firefox|iceweasel|fxios/i,
-  describe(ua) {
-    const browser = {
-      name: 'Firefox',
-      version: getMatch(/(?:firefox|iceweasel|fxios)[\s/](\d+(\.?_?\d+)+)/i, ua),
-      os: ua.toLowerCase().includes('fxios') ? 'iOS' : undefined,
-      osVersion: getOSVersion(ua)
-    };
-    return browser;
-  }
-}, {
-  test: /chrom|crios|crmo/i,
-  describe(ua) {
-    const browser = {
-      name: 'Chrome',
-      version: getMatch(/(?:chrome|chromium|crios|crmo)\/(\d+(\.?_?\d+)+)/i, ua),
-      os: ua.toLowerCase().includes('crios') ? 'iOS' : undefined,
-      osVersion: getOSVersion(ua)
-    };
-    return browser;
-  }
-}, /* Safari */
-{
-  test: /safari|applewebkit/i,
-  describe(ua) {
-    const browser = {
-      name: 'Safari',
-      version: getMatch(commonVersionIdentifier, ua),
-      os: ua.includes('mobile/') ? 'iOS' : 'macOS',
-      osVersion: getOSVersion(ua)
-    };
-    return browser;
-  }
-}];
-function getMatch(exp, ua) {
-  let id = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 1;
-  const match = ua.match(exp);
-  return match && match.length >= id && match[id] || '';
-}
-function getOSVersion(ua) {
-  return ua.includes('mac os') ? getMatch(/\(.+?(\d+_\d+(:?_\d+)?)/, ua, 1).replace(/_/g, '.') : undefined;
-}
-
 /**
  * Events are the primary way LiveKit notifies your application of changes.
  *
@@ -4995,7 +4790,7 @@ var RoomEvent;
    * Data packets provides the ability to use LiveKit to send/receive arbitrary payloads.
    * All participants in the room will receive the messages sent to the room.
    *
-   * args: (payload: NonSharedUint8Array, participant: [[Participant]], kind: [[DataPacket_Kind]], topic?: string)
+   * args: (payload: NonSharedUint8Array, participant: [[Participant]] | undefined, kind: [[DataPacket_Kind]], topic?: string, encryptionType?: Encryption_Type, participantIdentity?: string)
    */
   RoomEvent["DataReceived"] = "dataReceived";
   /**
@@ -5353,6 +5148,7 @@ var EngineEvent;
   EngineEvent["Joined"] = "joined";
   EngineEvent["TokenRefreshed"] = "tokenRefreshed";
   EngineEvent["ServerRegionsReported"] = "serverRegionsReported";
+  EngineEvent["RequestSubscribedCodecRefresh"] = "requestSubscribedCodecRefresh";
 })(EngineEvent || (EngineEvent = {}));
 var TrackEvent;
 (function (TrackEvent) {
@@ -6156,16 +5952,290 @@ function isWeb() {
   return typeof document !== 'undefined';
 }
 
-function hasFrameMetadataPublishOptions(options) {
-  return !!((options === null || options === void 0 ? void 0 : options.timestamp) || (options === null || options === void 0 ? void 0 : options.frameId));
+function getErrorDescription(error, errorCategory) {
+  if (error instanceof Error) {
+    if (error.name && error.message) {
+      return "".concat(error.name, ": ").concat(error.message);
+    }
+    return error.name;
+  }
+  return "Encountered unknown ".concat(errorCategory, " error: ").concat(String(error));
 }
 
-const PACKET_TRAILER_MAGIC = Uint8Array.from(['L'.charCodeAt(0), 'K'.charCodeAt(0), 'T'.charCodeAt(0), 'S'.charCodeAt(0)]);
-const PACKET_TRAILER_TIMESTAMP_TAG = 0x01;
-const PACKET_TRAILER_FRAME_ID_TAG = 0x02;
-const PACKET_TRAILER_USER_DATA_TAG = 0x03;
-const PACKET_TRAILER_ENVELOPE_SIZE = 5;
-const TIMESTAMP_TLV_SIZE = 10;
+function isVideoFrame(frame) {
+  return 'type' in frame;
+}
+function importKey(keyBytes_1) {
+  return __awaiter(this, arguments, void 0, function (keyBytes) {
+    let algorithm = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {
+      name: ENCRYPTION_ALGORITHM
+    };
+    let usage = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 'encrypt';
+    return function* () {
+      // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey
+      return crypto.subtle.importKey('raw', keyBytes, algorithm, false, usage === 'derive' ? ['deriveBits', 'deriveKey'] : ['encrypt', 'decrypt']);
+    }();
+  });
+}
+function getAlgoOptions(algorithmName, salt) {
+  const textEncoder = new TextEncoder();
+  const encodedSalt = textEncoder.encode(salt);
+  switch (algorithmName) {
+    case 'HKDF':
+      return {
+        name: 'HKDF',
+        salt: encodedSalt,
+        hash: 'SHA-256',
+        info: new ArrayBuffer(128)
+      };
+    case 'PBKDF2':
+      {
+        return {
+          name: 'PBKDF2',
+          salt: encodedSalt,
+          hash: 'SHA-256',
+          iterations: 100000
+        };
+      }
+    default:
+      throw new Error("algorithm ".concat(algorithmName, " is currently unsupported"));
+  }
+}
+/**
+ * Derives a set of keys from the master key.
+ * See https://tools.ietf.org/html/draft-omara-sframe-00#section-4.3.1
+ */
+function deriveKeys(material, options) {
+  return __awaiter(this, void 0, void 0, function* () {
+    const algorithmOptions = getAlgoOptions(material.algorithm.name, options.ratchetSalt);
+    // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveKey#HKDF
+    // https://developer.mozilla.org/en-US/docs/Web/API/HkdfParams
+    const encryptionKey = yield crypto.subtle.deriveKey(algorithmOptions, material, {
+      name: ENCRYPTION_ALGORITHM,
+      length: options.keySize
+    }, false, ['encrypt', 'decrypt']);
+    return {
+      material,
+      encryptionKey
+    };
+  });
+}
+/**
+ * Ratchets a key. See
+ * https://tools.ietf.org/html/draft-omara-sframe-00#section-4.3.5.1
+ */
+function ratchet(material, salt) {
+  return __awaiter(this, void 0, void 0, function* () {
+    const algorithmOptions = getAlgoOptions(material.algorithm.name, salt);
+    // https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/deriveBits
+    return crypto.subtle.deriveBits(algorithmOptions, material, 256);
+  });
+}
+function needsRbspUnescaping(frameData) {
+  for (var i = 0; i < frameData.length - 3; i++) {
+    if (frameData[i] == 0 && frameData[i + 1] == 0 && frameData[i + 2] == 3) return true;
+  }
+  return false;
+}
+function parseRbsp(stream) {
+  const dataOut = [];
+  var length = stream.length;
+  for (var i = 0; i < stream.length;) {
+    // Be careful about over/underflow here. byte_length_ - 3 can underflow, and
+    // i + 3 can overflow, but byte_length_ - i can't, because i < byte_length_
+    // above, and that expression will produce the number of bytes left in
+    // the stream including the byte at i.
+    if (length - i >= 3 && !stream[i] && !stream[i + 1] && stream[i + 2] == 3) {
+      // Two rbsp bytes.
+      dataOut.push(stream[i++]);
+      dataOut.push(stream[i++]);
+      // Skip the emulation byte.
+      i++;
+    } else {
+      // Single rbsp byte.
+      dataOut.push(stream[i++]);
+    }
+  }
+  return new Uint8Array(dataOut);
+}
+const kZerosInStartSequence = 2;
+const kEmulationByte = 3;
+function writeRbsp(data_in) {
+  const dataOut = [];
+  var numConsecutiveZeros = 0;
+  for (var i = 0; i < data_in.length; ++i) {
+    var byte = data_in[i];
+    if (byte <= kEmulationByte && numConsecutiveZeros >= kZerosInStartSequence) {
+      // Need to escape.
+      dataOut.push(kEmulationByte);
+      numConsecutiveZeros = 0;
+    }
+    dataOut.push(byte);
+    if (byte == 0) {
+      ++numConsecutiveZeros;
+    } else {
+      numConsecutiveZeros = 0;
+    }
+  }
+  return new Uint8Array(dataOut);
+}
+
+class DataCryptor {
+  static makeIV(timestamp) {
+    const iv = new ArrayBuffer(12);
+    const ivView = new DataView(iv);
+    const randomBytes = crypto.getRandomValues(new Uint32Array(1));
+    ivView.setUint32(0, randomBytes[0]);
+    ivView.setUint32(4, timestamp);
+    ivView.setUint32(8, timestamp - DataCryptor.sendCount % 0xffff);
+    DataCryptor.sendCount++;
+    return iv;
+  }
+  static encrypt(data, keys) {
+    return __awaiter(this, void 0, void 0, function* () {
+      const iv = DataCryptor.makeIV(performance.now());
+      const keySet = yield keys.getKeySet();
+      if (!keySet) {
+        throw new Error('No key set found');
+      }
+      const cipherText = yield crypto.subtle.encrypt({
+        name: ENCRYPTION_ALGORITHM,
+        iv
+      }, keySet.encryptionKey, new Uint8Array(data));
+      return {
+        payload: new Uint8Array(cipherText),
+        iv: new Uint8Array(iv),
+        keyIndex: keys.getCurrentKeyIndex()
+      };
+    });
+  }
+  static decrypt(data_1, iv_1, keys_1) {
+    return __awaiter(this, arguments, void 0, function (data, iv, keys) {
+      let keyIndex = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : 0;
+      let initialMaterial = arguments.length > 4 ? arguments[4] : undefined;
+      let ratchetOpts = arguments.length > 5 && arguments[5] !== undefined ? arguments[5] : {
+        ratchetCount: 0
+      };
+      return function* () {
+        const keySet = yield keys.getKeySet(keyIndex);
+        if (!keySet) {
+          throw new Error('No key set found');
+        }
+        try {
+          const plainText = yield crypto.subtle.decrypt({
+            name: ENCRYPTION_ALGORITHM,
+            iv
+          }, keySet.encryptionKey, new Uint8Array(data));
+          return {
+            payload: new Uint8Array(plainText)
+          };
+        } catch (error) {
+          if (keys.keyProviderOptions.ratchetWindowSize > 0) {
+            if (ratchetOpts.ratchetCount < keys.keyProviderOptions.ratchetWindowSize) {
+              workerLogger.debug("DataCryptor: ratcheting key attempt ".concat(ratchetOpts.ratchetCount, " of ").concat(keys.keyProviderOptions.ratchetWindowSize, ", for data packet"));
+              let ratchetedKeySet;
+              let ratchetResult;
+              if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === keys.getKeySet(keyIndex)) {
+                // only ratchet if the currently set key is still the same as the one used to decrypt this frame
+                // if not, it might be that a different frame has already ratcheted and we try with that one first
+                ratchetResult = yield keys.ratchetKey(keyIndex, false);
+                ratchetedKeySet = yield deriveKeys(ratchetResult.cryptoKey, keys.keyProviderOptions);
+              }
+              const decryptedData = yield DataCryptor.decrypt(data, iv, keys, keyIndex, initialMaterial, {
+                ratchetCount: ratchetOpts.ratchetCount + 1,
+                encryptionKey: ratchetedKeySet === null || ratchetedKeySet === void 0 ? void 0 : ratchetedKeySet.encryptionKey
+              });
+              if (decryptedData && ratchetedKeySet) {
+                // before updating the keys, make sure that the keySet used for this frame is still the same as the currently set key
+                // if it's not, a new key might have been set already, which we don't want to override
+                if ((initialMaterial !== null && initialMaterial !== void 0 ? initialMaterial : keySet) === keys.getKeySet(keyIndex)) {
+                  keys.setKeySet(ratchetedKeySet, keyIndex, ratchetResult);
+                  // decryption was successful, set the new key index to reflect the ratcheted key set
+                  keys.setCurrentKeyIndex(keyIndex);
+                }
+              }
+              return decryptedData;
+            } else {
+              /**
+               * Because we only set a new key once decryption has been successful,
+               * we can be sure that we don't need to reset the key to the initial material at this point
+               * as the key has not been updated on the keyHandler instance
+               */
+              workerLogger.warn('DataCryptor: maximum ratchet attempts exceeded');
+              throw new CryptorError("DataCryptor: valid key missing for participant ".concat(keys.participantIdentity), CryptorErrorReason.InvalidKey, keys.participantIdentity);
+            }
+          } else {
+            throw new CryptorError("DataCryptor: Decryption failed: ".concat(getErrorDescription(error, 'decryption')), CryptorErrorReason.InvalidKey, keys.participantIdentity);
+          }
+        }
+      }();
+    });
+  }
+}
+DataCryptor.sendCount = 0;
+
+/**
+ * Per-key rate limiter for repeated errors. Prevents log/emit floods and the
+ * unbounded map growth that a per-event log would cause when a broken key
+ * keeps producing failures.
+ */
+class ErrorRateLimiter {
+  constructor() {
+    let throttleMs = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : 1000;
+    let windowMs = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : 60000;
+    let maxPerWindow = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : 5;
+    this.throttleMs = throttleMs;
+    this.windowMs = windowMs;
+    this.maxPerWindow = maxPerWindow;
+    this.lastAt = new Map();
+    this.counts = new Map();
+  }
+  reset() {
+    this.lastAt.clear();
+    this.counts.clear();
+  }
+  countFor(key) {
+    var _a;
+    return (_a = this.counts.get(key)) !== null && _a !== void 0 ? _a : 0;
+  }
+  /**
+   * Returns true if the caller should emit for this key. Invokes `onSuppress`
+   * exactly once per window when the per-window limit is first crossed.
+   */
+  shouldEmit(key, onSuppress) {
+    var _a, _b;
+    const now = Date.now();
+    const last = (_a = this.lastAt.get(key)) !== null && _a !== void 0 ? _a : 0;
+    const count = (_b = this.counts.get(key)) !== null && _b !== void 0 ? _b : 0;
+    if (now - last > this.windowMs) {
+      this.counts.set(key, 0);
+      this.lastAt.set(key, now);
+      return true;
+    }
+    if (now - last < this.throttleMs) return false;
+    if (count >= this.maxPerWindow) {
+      if (count === this.maxPerWindow) {
+        onSuppress === null || onSuppress === void 0 ? void 0 : onSuppress();
+        this.counts.set(key, count + 1);
+      }
+      return false;
+    }
+    this.lastAt.set(key, now);
+    this.counts.set(key, count + 1);
+    return true;
+  }
+}
+
+function hasFrameMetadataPublishOptions(options) {
+  return !!((options === null || options === void 0 ? void 0 : options.timestamp) || (options === null || options === void 0 ? void 0 : options.frameId));
+}
+
+const PACKET_TRAILER_MAGIC = Uint8Array.from(['L'.charCodeAt(0), 'K'.charCodeAt(0), 'T'.charCodeAt(0), 'S'.charCodeAt(0)]);
+const PACKET_TRAILER_TIMESTAMP_TAG = 0x01;
+const PACKET_TRAILER_FRAME_ID_TAG = 0x02;
+const PACKET_TRAILER_USER_DATA_TAG = 0x03;
+const PACKET_TRAILER_ENVELOPE_SIZE = 5;
+const TIMESTAMP_TLV_SIZE = 10;
 const FRAME_ID_TLV_SIZE = 6;
 function appendPacketTrailer(data, userTimestamp, frameId) {
   const hasTimestamp = userTimestamp !== BigInt(0);
@@ -6686,14 +6756,7 @@ class FrameCryptor extends BaseFrameCryptor {
      */
     this.hasFrameMetadata = false;
     this.frameMetadataFrameId = 0;
-    /**
-     * Throttling mechanism for decryption errors to prevent memory leaks
-     */
-    this.lastErrorTimestamp = new Map();
-    this.errorCounts = new Map();
-    this.ERROR_THROTTLE_MS = 1000; // Emit error at most once per second
-    this.MAX_ERRORS_PER_MINUTE = 5; // Maximum errors to emit per minute per key
-    this.ERROR_WINDOW_MS = 60000; // 1 minute window
+    this.errorLimiter = new ErrorRateLimiter();
     /** grace period for a teardown or a resubscribe to land before we report a stalled track */
     this.UNDECRYPTED_TRACK_GRACE_MS = 2000;
     /**
@@ -6748,8 +6811,7 @@ class FrameCryptor extends BaseFrameCryptor {
     clearTimeout(this.undecryptedTrackTimeout);
     this.undecryptedTrackTimeout = undefined;
     this.participantIdentity = undefined;
-    this.lastErrorTimestamp = new Map();
-    this.errorCounts = new Map();
+    this.errorLimiter.reset();
   }
   isEnabled() {
     if (this.participantIdentity) {
@@ -6939,58 +7001,21 @@ class FrameCryptor extends BaseFrameCryptor {
     }));
     this.sifTrailer = trailer;
   }
-  /**
-   * Checks if we should emit an error based on throttling rules to prevent memory leaks
-   * @param errorKey - unique key identifying the error context
-   * @returns true if the error should be emitted, false otherwise
-   */
-  shouldEmitError(errorKey) {
-    var _a, _b;
-    const now = Date.now();
-    const lastErrorTime = (_a = this.lastErrorTimestamp.get(errorKey)) !== null && _a !== void 0 ? _a : 0;
-    const errorCount = (_b = this.errorCounts.get(errorKey)) !== null && _b !== void 0 ? _b : 0;
-    // Reset count if we're in a new time window
-    if (now - lastErrorTime > this.ERROR_WINDOW_MS) {
-      this.errorCounts.set(errorKey, 0);
-      this.lastErrorTimestamp.set(errorKey, now);
-      return true;
-    }
-    // Check if we've exceeded the throttle time
-    if (now - lastErrorTime < this.ERROR_THROTTLE_MS) {
-      return false;
-    }
-    // Check if we've exceeded the max errors per window
-    if (errorCount >= this.MAX_ERRORS_PER_MINUTE) {
-      // Only log a warning once when hitting the limit
-      if (errorCount === this.MAX_ERRORS_PER_MINUTE) {
-        workerLogger.warn("Suppressing further decryption errors for ".concat(this.participantIdentity), Object.assign(Object.assign({}, this.logContext), {
-          errorKey
-        }));
-        this.errorCounts.set(errorKey, errorCount + 1);
-      }
-      return false;
-    }
-    // Update tracking
-    this.lastErrorTimestamp.set(errorKey, now);
-    this.errorCounts.set(errorKey, errorCount + 1);
-    return true;
-  }
-  /**
-   * Emits a throttled error to prevent memory leaks from repeated decryption failures
-   * @param error - the CryptorError to emit
-   */
   emitThrottledError(error) {
-    var _a;
     const errorKey = "".concat(this.participantIdentity, "-").concat(error.reason, "-decrypt");
-    if (this.shouldEmitError(errorKey)) {
-      const errorCount = (_a = this.errorCounts.get(errorKey)) !== null && _a !== void 0 ? _a : 0;
-      if (errorCount > 1) {
-        workerLogger.debug("Decryption error (".concat(errorCount, " occurrences in window)"), Object.assign(Object.assign({}, this.logContext), {
-          reason: CryptorErrorReason[error.reason]
-        }));
-      }
-      this.emit(CryptorEvent.Error, error);
+    const emit = this.errorLimiter.shouldEmit(errorKey, () => {
+      workerLogger.warn("Suppressing further decryption errors for ".concat(this.participantIdentity), Object.assign(Object.assign({}, this.logContext), {
+        errorKey
+      }));
+    });
+    if (!emit) return;
+    const count = this.errorLimiter.countFor(errorKey);
+    if (count > 1) {
+      workerLogger.debug("Decryption error (".concat(count, " occurrences in window)"), Object.assign(Object.assign({}, this.logContext), {
+        reason: CryptorErrorReason[error.reason]
+      }));
     }
+    this.emit(CryptorEvent.Error, error);
   }
   /**
    * Function that will be injected in a stream and will encrypt the given encoded frames.
@@ -7069,7 +7094,9 @@ class FrameCryptor extends BaseFrameCryptor {
           return controller.enqueue(encodedFrame);
         } catch (e) {
           // TODO: surface this to the app.
-          workerLogger.error(e);
+          workerLogger.error("error while encrypting", Object.assign(Object.assign({}, this.logContext), {
+            error: e
+          }));
         }
       } else {
         workerLogger.debug('failed to encrypt, emitting error', this.logContext);
@@ -7268,7 +7295,7 @@ class FrameCryptor extends BaseFrameCryptor {
               throw new CryptorError("valid key missing for participant ".concat(_this.participantIdentity), CryptorErrorReason.InvalidKey, _this.participantIdentity);
             }
           } else {
-            throw new CryptorError("Decryption failed: ".concat(error.message), CryptorErrorReason.InvalidKey, _this.participantIdentity);
+            throw new CryptorError("Decryption failed: ".concat(getErrorDescription(error, 'decryption')), CryptorErrorReason.InvalidKey, _this.participantIdentity);
           }
         }
       }();
@@ -7606,7 +7633,22 @@ let useSharedKey = false;
 let sifTrailer;
 let keyProviderOptions = KEY_PROVIDER_DEFAULTS;
 let rtpMap = new Map();
+const dataDecryptErrorLimiter = new ErrorRateLimiter();
 workerLogger.setDefaultLevel('info');
+// Forward worker log calls to the main thread so they reach any
+// setLogExtension consumer installed there. The main-thread workerLogger
+// re-emits them, which invokes both the console and the extension.
+workerLogger.methodFactory = methodName => (msg, context) => {
+  postMessage({
+    kind: 'log',
+    data: {
+      level: methodName,
+      msg,
+      context
+    }
+  });
+};
+workerLogger.setLevel(workerLogger.getLevel());
 onmessage = ev => {
   messageQueue.run(() => __awaiter(void 0, void 0, void 0, function* () {
     const _ev$data = ev.data,
@@ -7615,7 +7657,7 @@ onmessage = ev => {
     switch (kind) {
       case 'init':
         workerLogger.setLevel(data.loglevel);
-        workerLogger.info('worker initialized');
+        workerLogger.info('e2ee worker initialized');
         keyProviderOptions = data.keyProviderOptions;
         useSharedKey = !!data.keyProviderOptions.sharedKey;
         // acknowledge init successful
@@ -7627,6 +7669,9 @@ onmessage = ev => {
         };
         postMessage(ackMsg);
         break;
+      case 'setLogLevel':
+        workerLogger.setLevel(data.level);
+        break;
       case 'enable':
         setEncryptionEnabled(data.enabled, data.participantIdentity);
         workerLogger.info("updated e2ee enabled status for ".concat(data.participantIdentity, " to ").concat(data.enabled));
@@ -7648,11 +7693,6 @@ onmessage = ev => {
           encryptedPayload = _yield$DataCryptor$en.payload,
           iv = _yield$DataCryptor$en.iv,
           keyIndex = _yield$DataCryptor$en.keyIndex;
-        console.log('encrypted payload', {
-          original: data.payload,
-          encrypted: encryptedPayload,
-          iv
-        });
         postMessage({
           kind: 'encryptDataResponse',
           data: {
@@ -7675,12 +7715,22 @@ onmessage = ev => {
             }
           });
         } catch (error) {
-          // Send error back to main thread with uuid so it can reject the corresponding promise
-          workerLogger.error('DataCryptor decryption failed', {
-            error,
-            participantIdentity: data.participantIdentity,
-            uuid: data.uuid
+          // Send error back to main thread with uuid so it can reject the corresponding promise.
+          // The error response must always be posted so the awaiting future resolves; only the
+          // log is throttled to avoid flooding when a broken key keeps producing failures.
+          const errorKey = "".concat(data.participantIdentity, "-datadecrypt");
+          const shouldLog = dataDecryptErrorLimiter.shouldEmit(errorKey, () => {
+            workerLogger.warn("Suppressing further data decryption errors for ".concat(data.participantIdentity), {
+              errorKey
+            });
           });
+          if (shouldLog) {
+            workerLogger.error('DataCryptor decryption failed', {
+              error,
+              participantIdentity: data.participantIdentity,
+              uuid: data.uuid
+            });
+          }
           postMessage({
             kind: 'error',
             data: {