@blockcast/mmt-container 0.1.0-main.149f78a4adae

package/node_modules/@blockcast/mmt-fec/src/oti.ts

@@ -0,0 +1,319 @@
+/**
+ * RFC 6330 Object Transmission Information (OTI) utilities.
+ *
+ * Shared OTI encoding/decoding for both moq-lib and moqtail players.
+ * Eliminates duplicated OTI byte manipulation across codebases.
+ */
+
+import { parseMoqRepairFrame } from "@blockcast/mmt-base";
+
+export interface OTIParams {
+	/** Transfer length F (total source block size in bytes) */
+	transferLength: number;
+	/** Symbol size T (bytes per symbol) */
+	symbolSize: number;
+	/** Number of source blocks Z */
+	sourceBlocks: number;
+	/** Number of sub-blocks N */
+	subBlocks: number;
+	/** Symbol alignment Al */
+	alignment: number;
+}
+
+/**
+ * Build a 12-byte RFC 6330 Common + Scheme-Specific OTI from parameters.
+ *
+ * Wire format (per RFC 6330 §4.3.1 + §4.3.3):
+ *   byte 0:    F high byte (bit 32 — transfer length is 40-bit)
+ *   bytes 1-4: F low 32 bits (big-endian)
+ *   byte 5:    reserved (0)
+ *   bytes 6-7: T (symbol size, big-endian)
+ *   byte 8:    Z (source blocks)
+ *   bytes 9-10: N (sub-blocks, big-endian)
+ *   byte 11:   Al (alignment)
+ */
+export function buildOTI(params: OTIParams): Uint8Array {
+	const {
+		transferLength: F,
+		symbolSize: T,
+		sourceBlocks: Z,
+		subBlocks: N,
+		alignment: Al,
+	} = params;
+	validateOTIFields(F, T, Z, N, Al);
+	const oti = new Uint8Array(12);
+	// F: 40-bit big-endian (byte 0 = high, bytes 1-4 = low 32)
+	oti[0] = (F / 0x100000000) & 0xFF;
+	oti[1] = (F >>> 24) & 0xFF;
+	oti[2] = (F >>> 16) & 0xFF;
+	oti[3] = (F >>> 8) & 0xFF;
+	oti[4] = F & 0xFF;
+	// byte 5: reserved
+	oti[6] = (T >>> 8) & 0xFF;
+	oti[7] = T & 0xFF;
+	oti[8] = Z & 0xFF;
+	oti[9] = (N >>> 8) & 0xFF;
+	oti[10] = N & 0xFF;
+	oti[11] = Al & 0xFF;
+	return oti;
+}
+
+/**
+ * Build OTI from catalog FEC config (K and T).
+ * F = K × T (interleaved encoder convention from FFmpeg moqenc_mmt.c).
+ */
+export function buildOTIFromCatalog(K: number, T: number): Uint8Array {
+	if (!Number.isInteger(K) || K <= 0 || K > 56_403) {
+		throw new Error(`K must be an integer in 1..56403 (got ${K})`);
+	}
+	return buildOTI({
+		transferLength: K * T,
+		symbolSize: T,
+		sourceBlocks: 1,
+		subBlocks: 1,
+		alignment: 8,
+	});
+}
+
+/**
+ * Parse a 12-byte OTI into structured parameters.
+ */
+export function parseOTI(oti: Uint8Array): OTIParams & { K: number } {
+	if (oti.length !== 12) throw new Error(`OTI must be exactly 12 bytes (got ${oti.length})`);
+	if (oti[5] !== 0) throw new Error(`OTI reserved byte 5 must be zero (got ${oti[5]})`);
+	const F = ((oti[0] & 0xFF) * 0x100000000) +
+		(((oti[1] << 24) | (oti[2] << 16) | (oti[3] << 8) | oti[4]) >>> 0);
+	const T = (oti[6] << 8) | oti[7];
+	const Z = oti[8];
+	const N = (oti[9] << 8) | oti[10];
+	const Al = oti[11];
+	validateOTIFields(F, T, Z, N, Al);
+	const K = Math.ceil(Math.ceil(F / T) / Z);
+	return { transferLength: F, symbolSize: T, sourceBlocks: Z, subBlocks: N, alignment: Al, K };
+}
+
+function validateOTIFields(F: number, T: number, Z: number, N: number, Al: number): void {
+	if (!Number.isSafeInteger(F) || F <= 0 || F > 0xffffffffff) {
+		throw new Error(`F must be a positive 40-bit integer (got ${F})`);
+	}
+	if (!Number.isInteger(T) || T <= 0 || T > 0xffff) {
+		throw new Error(`T must be an integer in 1..65535 (got ${T})`);
+	}
+	if (!Number.isInteger(Z) || Z <= 0 || Z > 0xff) {
+		throw new Error(`Z must be an integer in 1..255 (got ${Z})`);
+	}
+	if (!Number.isInteger(N) || N <= 0 || N > 0xffff) {
+		throw new Error(`N must be an integer in 1..65535 (got ${N})`);
+	}
+	if (!Number.isInteger(Al) || Al <= 0 || Al > 0xff || T % Al !== 0) {
+		throw new Error(`Al must be an integer in 1..255 that divides T (got Al=${Al}, T=${T})`);
+	}
+	const K = Math.ceil(Math.ceil(F / T) / Z);
+	if (K > 56_403) {
+		throw new Error(`OTI requires K=${K}, above the RFC 6330 systematic limit 56403`);
+	}
+}
+
+/**
+ * Resolve a catalog FEC block's interleave window in milliseconds.
+ *
+ * The catalog carries exactly ONE interleave field: `interleaveDepthMs`, the
+ * full FEC block span in MILLISECONDS (draft-ramadan-moq-fec §5.1). Receivers
+ * derive the block count D with `deriveFecInterleaveDepth`.
+ *
+ * Absent or non-positive → undefined; callers treat that as unconfigured and
+ * error rather than guess. The legacy `interleaveDepth` frame-count key and
+ * the `interleaveMs` alias were removed in the BLO-14526 clean cut — producers
+ * emit milliseconds only, and there is deliberately NO fallback read.
+ */
+export type FecInterleaveCatalog = {
+	interleaveDepthMs?: number;
+};
+
+export function catalogFecInterleaveMs(
+	fec: FecInterleaveCatalog | undefined,
+): number | undefined {
+	const ms = fec?.interleaveDepthMs;
+	return typeof ms === "number" && ms > 0 ? ms : undefined;
+}
+
+/**
+ * Derive the integer FEC interleave depth D from a catalog block span and the
+ * duration of one media unit.
+ *
+ * `interleaveDepthMs` is nearest-millisecond catalog signaling while media
+ * unit durations are commonly fractional. Invert that quantization with
+ * positive-value round-half-up semantics:
+ *
+ *   D = max(1, floor(interleaveDepthMs / mediaUnitDurationMs + 0.5))
+ *
+ * `Math.ceil` is not equivalent: 4000 / 33.333 is slightly greater than 120,
+ * but represents D=120 rather than D=121.
+ */
+export function deriveFecInterleaveDepth(
+	interleaveDepthMs: number,
+	mediaUnitDurationMs: number,
+): number {
+	if (!Number.isFinite(interleaveDepthMs) || interleaveDepthMs <= 0) {
+		throw new Error(`[FEC] interleaveDepthMs must be finite and > 0 (got ${interleaveDepthMs})`);
+	}
+	if (!Number.isFinite(mediaUnitDurationMs) || mediaUnitDurationMs <= 0) {
+		throw new Error(`[FEC] mediaUnitDurationMs must be finite and > 0 (got ${mediaUnitDurationMs})`);
+	}
+	return Math.max(1, Math.floor(interleaveDepthMs / mediaUnitDurationMs + 0.5));
+}
+
+/**
+ * Compute the full FEC block completion timeout from the interleave window.
+ *
+ * The catalog's `interleaveDepthMs` IS the full FEC block span in
+ * milliseconds (draft-ramadan-moq-fec §5.1): producers emit
+ * D × unit-duration, and every symbol of a block — source and repair —
+ * arrives within that span. The full-block timeout is therefore
+ * K-INDEPENDENT:
+ *
+ *   timeout = interleaveDepthMs * safetyFactor
+ *
+ * The retired per-symbol-window model multiplied the interleave value by
+ * (K-1); under §5.1 semantics that overshoots ~(K-1)× (K=32 @ 133ms →
+ * ~12.4s instead of ~0.4s). A caller that genuinely needs a per-sub-block
+ * deadline scales the block span by K_sub / K instead — do NOT reintroduce
+ * (K-1) here.
+ *
+ * @param interleaveDepthMs - Full FEC block span in ms (catalog fec.interleaveDepthMs)
+ * @param safetyFactor - Jitter margin (default 3.0)
+ * @returns Timeout in milliseconds
+ */
+export function computeFecTimeout(
+	interleaveDepthMs: number,
+	safetyFactor: number = 3.0,
+): number {
+	if (interleaveDepthMs <= 0) {
+		throw new Error(`[FEC] interleaveDepthMs must be > 0 (got ${interleaveDepthMs}ms). Fix encoder config.`);
+	}
+	// interleaveDepthMs IS the block span. K=4, D=4 at 30fps:
+	// interleaveDepthMs = 133ms → timeout = ceil(133 * 3) = 399ms.
+	return Math.ceil(interleaveDepthMs * safetyFactor);
+}
+
+/**
+ * Absolute deadline for one FEC block.
+ *
+ *   deadline = firstAcceptedAtMs + interleaveDepthMs + reorderToleranceMs
+ *
+ * Two properties matter, and both are contract, not preference:
+ *
+ * 1. The anchor is an ABSOLUTE receiver-local timestamp of the first accepted
+ *    packet of the block -- not "now when we noticed", and not a duration a
+ *    caller starts counting at an unspecified moment. A relative timeout
+ *    cannot say WHEN a block was due, so it cannot yield playback latency and
+ *    it cannot be compared across two consumers that started their timers at
+ *    different instants.
+ *
+ * 2. The reorder/jitter allowance is ADDITIVE and SIGNALED, never a multiplier
+ *    on the span. Jitter is a property of the network path; the FEC block span
+ *    is a property of the encoder. Multiplying them couples two independent
+ *    quantities: at a 133ms video span a x3 factor grants 266ms of slack, and
+ *    at a 43ms audio span only 86ms -- for the same network. The tolerance
+ *    therefore arrives as its own catalog value and is added once.
+ *
+ * Both arguments are required. There is no default tolerance: a missing value
+ * is an encoder/catalog bug and must surface at the boundary, not be papered
+ * over with a constant here.
+ *
+ * @param firstAcceptedAtMs - Receiver-local ms timestamp of the block's first accepted packet
+ * @param interleaveDepthMs - Full FEC block span in ms (catalog fec.interleaveDepthMs)
+ * @param reorderToleranceMs - Declared jitter/reorder allowance in ms (catalog fec.reorderToleranceMs)
+ * @returns Absolute receiver-local deadline in milliseconds
+ */
+export function fecBlockDeadlineMs(params: {
+	firstAcceptedAtMs: number;
+	interleaveDepthMs: number;
+	reorderToleranceMs: number;
+}): number {
+	const { firstAcceptedAtMs, interleaveDepthMs, reorderToleranceMs } = params;
+	if (!Number.isFinite(firstAcceptedAtMs)) {
+		throw new Error(`[FEC] firstAcceptedAtMs must be finite (got ${firstAcceptedAtMs}).`);
+	}
+	return firstAcceptedAtMs + fecBlockBudgetMs(interleaveDepthMs, reorderToleranceMs);
+}
+
+/**
+ * Relative budget for one FEC block: span + declared tolerance.
+ *
+ * Only for consumers whose interface genuinely takes a duration (the WASM
+ * reassembler's `timeoutMs`). Anything that can hold a timestamp should use
+ * `fecBlockDeadlineMs` instead, so the anchor stays explicit and latency stays
+ * extractable. This is deliberately NOT `span * factor` -- see the note on
+ * `fecBlockDeadlineMs` for why the tolerance is additive.
+ */
+export function fecBlockBudgetMs(interleaveDepthMs: number, reorderToleranceMs: number): number {
+	// Finite, not merely > 0: Infinity satisfies `> 0` and would yield an
+	// infinite budget, which fecBlockDeadlineMs then turns into a deadline no
+	// block can ever miss -- the eviction bound silently stops bounding. The
+	// tolerance check below already required finiteness; this is the same bar
+	// for the encoder's span.
+	if (!Number.isFinite(interleaveDepthMs) || !(interleaveDepthMs > 0)) {
+		throw new Error(
+			`[FEC] interleaveDepthMs must be a finite value > 0 (got ${interleaveDepthMs}ms). Fix encoder config.`,
+		);
+	}
+	if (!(reorderToleranceMs >= 0) || !Number.isFinite(reorderToleranceMs)) {
+		throw new Error(
+			`[FEC] reorderToleranceMs must be a finite value >= 0 (got ${reorderToleranceMs}ms). ` +
+				`It is a catalog value (fec.reorderToleranceMs), not a local default.`,
+		);
+	}
+	return Math.ceil(interleaveDepthMs + reorderToleranceMs);
+}
+
+/**
+ * Playback latency for a block, from the same anchor the deadline uses.
+ *
+ *   latency = presentedAtMs - firstAcceptedAtMs
+ *
+ * Both timestamps are receiver-local, so this needs NO publisher/receiver
+ * clock agreement. That is the point of anchoring the deadline absolutely:
+ * publisher-stamped media time and receiver BCTM disagree by roughly the
+ * quantity we are trying to measure, which makes any cross-host subtraction
+ * unusable at a 33ms target. This subtraction is immune to that skew.
+ *
+ * It measures first-accepted-packet to presentation. It is NOT glass-to-glass
+ * and must not be reported as such -- capture and encode sit outside both
+ * timestamps.
+ */
+export function playbackLatencyMs(params: { presentedAtMs: number; firstAcceptedAtMs: number }): number {
+	const { presentedAtMs, firstAcceptedAtMs } = params;
+	if (!Number.isFinite(presentedAtMs) || !Number.isFinite(firstAcceptedAtMs)) {
+		throw new Error(`[FEC] playback latency needs two finite timestamps (got ${presentedAtMs}, ${firstAcceptedAtMs}).`);
+	}
+	if (presentedAtMs < firstAcceptedAtMs) {
+		throw new Error(
+			`[FEC] presentedAtMs ${presentedAtMs} precedes firstAcceptedAtMs ${firstAcceptedAtMs}; ` +
+				`the two timestamps must come from one receiver-local clock.`,
+		);
+	}
+	return presentedAtMs - firstAcceptedAtMs;
+}
+
+/**
+ * Extract FEC parameters from an MMTP repair packet.
+ *
+ * Per ISO/IEC 23008-1 Section C.5.3, the 13-byte Repair FEC Payload ID
+ * follows the complete MMTP header, including optional C/X fields.
+ *
+ * Returns raw fields — caller passes directly to WASM add_repair(ss_start, ssb_length, rs_id, data).
+ * No SBN/ESI derivation — the WASM decoder handles block assignment.
+ */
+export function parseRepairPacket(packet: Uint8Array): {
+	ssStart: number; ssbLength: number; rsId: number; repairData: Uint8Array;
+} | null {
+	const parsed = parseMoqRepairFrame(packet);
+	if (!parsed) return null;
+	return {
+		ssStart: parsed.ssStart,
+		ssbLength: parsed.ssbLength,
+		rsId: parsed.rsId,
+		repairData: parsed.symbolData,
+	};
+}

package/node_modules/@blockcast/mmt-fec/src/reorder-buffer.ts

@@ -0,0 +1,101 @@
+/**
+ * ReorderBuffer — container-agnostic frame reorder buffer for FEC-interleaved streams.
+ *
+ * FEC interleaving causes frames to complete out of decode order (e.g., frame N+3
+ * before N+1). H.264 P-frames reference the previous frame, so feeding out-of-order
+ * frames to VideoDecoder produces green artifacts from reference frame mismatch.
+ *
+ * This buffer accumulates frames and flushes them in sequence order.
+ * - In-order frames flush immediately (zero added latency for well-ordered streams).
+ * - Out-of-order frames buffer until the gap is filled or the buffer is full.
+ * - Keyframes flush all pending frames first (random access point).
+ * - Safety timeout force-flushes stalled buffers (missing frame that will never arrive).
+ *
+ * Used by WebCodecs decode path. NOT needed for MSE (browser handles ordering internally).
+ */
+
+export interface ReorderBufferConfig<T> {
+	/** Maximum frames to buffer before force-flushing oldest. */
+	maxSize: number;
+	/** Extract sequence number from a frame. */
+	getSequence: (frame: T) => number;
+	/** Check if a frame is a keyframe (flushes all pending). Optional. */
+	isKeyframe?: (frame: T) => boolean;
+}
+
+export class ReorderBuffer<T> {
+	readonly #config: ReorderBufferConfig<T>;
+	#buffer: T[] = [];
+	#lastFlushedSeq = -1;
+
+	constructor(config: ReorderBufferConfig<T>) {
+		this.#config = config;
+	}
+
+	/**
+	 * Push a frame into the buffer. Returns frames ready to decode (in sequence order).
+	 * May return 0 frames (buffered), 1 frame (in-order), or multiple (gap filled / flush).
+	 */
+	push(frame: T): T[] {
+		const { getSequence, isKeyframe, maxSize } = this.#config;
+
+		// Keyframe: flush all pending in order, then emit keyframe
+		if (isKeyframe?.(frame)) {
+			const flushed = this.flushAll();
+			this.#lastFlushedSeq = getSequence(frame);
+			flushed.push(frame);
+			return flushed;
+		}
+
+		const seq = getSequence(frame);
+
+		// Drop truly stale frames (older than what we've already flushed)
+		if (seq > 0 && seq <= this.#lastFlushedSeq) {
+			return [];
+		}
+
+		// Insert into buffer (maintain sorted order)
+		this.#buffer.push(frame);
+		this.#buffer.sort((a, b) => getSequence(a) - getSequence(b));
+
+		// Flush in-order frames from front
+		const flushed: T[] = [];
+		while (this.#buffer.length > 0) {
+			const frontSeq = getSequence(this.#buffer[0]);
+
+			// Flush if: next expected seq, OR nothing flushed yet (bootstrap), OR buffer full
+			if (frontSeq <= this.#lastFlushedSeq + 1 || this.#lastFlushedSeq < 0 || this.#buffer.length >= maxSize) {
+				const f = this.#buffer.shift()!;
+				this.#lastFlushedSeq = getSequence(f);
+				flushed.push(f);
+			} else {
+				break; // gap — wait for missing frame
+			}
+		}
+
+		return flushed;
+	}
+
+	/**
+	 * Flush all pending frames in sequence order. Call on keyframe or cleanup.
+	 */
+	flushAll(): T[] {
+		this.#buffer.sort((a, b) => this.#config.getSequence(a) - this.#config.getSequence(b));
+		const flushed = this.#buffer.splice(0);
+		if (flushed.length > 0) {
+			this.#lastFlushedSeq = this.#config.getSequence(flushed[flushed.length - 1]);
+		}
+		return flushed;
+	}
+
+	/** Number of frames currently buffered (waiting for gap to fill). */
+	get pending(): number {
+		return this.#buffer.length;
+	}
+
+	/** Reset buffer state. */
+	reset(): void {
+		this.#buffer = [];
+		this.#lastFlushedSeq = -1;
+	}
+}

package/node_modules/@blockcast/mmt-manifest-verify/dist/admission.d.ts

@@ -0,0 +1,28 @@
+import { type SourceAuthGroupClose, type SourceAuthObjectEntry } from './source-auth.js';
+export type SourceAuthAdmissionState = 'pending-entry' | 'pending-object' | 'provisional' | 'authenticated';
+export interface SourceAuthObjectAdmission {
+    groupId: bigint;
+    objectId: number;
+    recovered: boolean;
+    state: Exclude<SourceAuthAdmissionState, 'pending-object'>;
+}
+/**
+ * Bounded media/manifest rendezvous for the browser player receive path.
+ * Object digest admission is synchronous; only the group-close signature is deferred.
+ */
+export declare class SourceAuthAdmission {
+    #private;
+    constructor(options: {
+        manifestAuthenticated: boolean;
+    });
+    admitObject(input: {
+        groupId: bigint;
+        objectId: number;
+        bytes: Uint8Array;
+        recovered?: boolean;
+    }): SourceAuthObjectAdmission;
+    admitEntry(entry: SourceAuthObjectEntry): SourceAuthObjectAdmission | SourceAuthAdmissionState;
+    objectState(objectId: number): SourceAuthAdmissionState | undefined;
+    verifyClose(close: SourceAuthGroupClose, authScope: Uint8Array, publicKey: CryptoKey, subtle?: SubtleCrypto): Promise<void>;
+}
+//# sourceMappingURL=admission.d.ts.map

package/node_modules/@blockcast/mmt-manifest-verify/dist/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAA;AAEzB,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,eAAe,CAAA;AAEnB,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAA;CAC3D;AAkBD;;;GAGG;AACH,qBAAa,mBAAmB;;gBASlB,OAAO,EAAE;QAAE,qBAAqB,EAAE,OAAO,CAAA;KAAE;IAIvD,WAAW,CAAC,KAAK,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,UAAU,CAAA;QACjB,SAAS,CAAC,EAAE,OAAO,CAAA;KACpB,GAAG,yBAAyB;IA0B7B,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,yBAAyB,GAAG,wBAAwB;IAmB9F,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IAO7D,WAAW,CACf,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,SAAS,EACpB,MAAM,GAAE,YAAuC,GAC9C,OAAO,CAAC,IAAI,CAAC;CAqDjB"}

package/node_modules/@blockcast/mmt-manifest-verify/dist/admission.js

@@ -0,0 +1,128 @@
+import { sourceAuthMerkleRoot, sourceAuthObjectDigest, sourceAuthSignaturePreimage, trimRecoveredSourceAuthObject, } from './source-auth.js';
+function requireU64(name, value) {
+    if (value < 0n || value > 0xffffffffffffffffn) {
+        throw new Error(`${name} must be an unsigned 64-bit integer`);
+    }
+}
+function equalBytes(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return left.every((value, index) => value === right[index]);
+}
+/**
+ * Bounded media/manifest rendezvous for the browser player receive path.
+ * Object digest admission is synchronous; only the group-close signature is deferred.
+ */
+export class SourceAuthAdmission {
+    #manifestAuthenticated;
+    #entries = new Map();
+    #pendingObjects = new Map();
+    #entriesAwaitingObjects = new Set();
+    #admissions = new Map();
+    #groupId = null;
+    #closed = false;
+    constructor(options) {
+        this.#manifestAuthenticated = options.manifestAuthenticated;
+    }
+    admitObject(input) {
+        this.#requireGroup(input.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#admissions.has(input.objectId) || this.#pendingObjects.has(input.objectId)) {
+            throw new Error(`duplicate source-auth object ${input.objectId}`);
+        }
+        const entry = this.#entries.get(input.objectId);
+        if (entry) {
+            this.#entriesAwaitingObjects.delete(input.objectId);
+            return this.#verifyObject(entry, input.bytes, input.recovered ?? false);
+        }
+        if (this.#pendingObjects.size >= 1) {
+            throw new Error('source-auth media exceeds one-object manifest skew');
+        }
+        this.#pendingObjects.set(input.objectId, {
+            bytes: input.bytes,
+            recovered: input.recovered ?? false,
+        });
+        return {
+            groupId: input.groupId,
+            objectId: input.objectId,
+            recovered: input.recovered ?? false,
+            state: 'pending-entry',
+        };
+    }
+    admitEntry(entry) {
+        this.#requireGroup(entry.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#entries.has(entry.objectId)) {
+            throw new Error(`duplicate source-auth manifest entry ${entry.objectId}`);
+        }
+        const pending = this.#pendingObjects.get(entry.objectId);
+        if (!pending && this.#entriesAwaitingObjects.size >= 1) {
+            throw new Error('source-auth manifest exceeds one-object media skew');
+        }
+        this.#entries.set(entry.objectId, entry);
+        if (!pending) {
+            this.#entriesAwaitingObjects.add(entry.objectId);
+            return 'pending-object';
+        }
+        this.#pendingObjects.delete(entry.objectId);
+        return this.#verifyObject(entry, pending.bytes, pending.recovered);
+    }
+    objectState(objectId) {
+        if (this.#pendingObjects.has(objectId))
+            return 'pending-entry';
+        if (this.#entriesAwaitingObjects.has(objectId))
+            return 'pending-object';
+        if (this.#closed && this.#admissions.has(objectId))
+            return 'authenticated';
+        return this.#admissions.get(objectId)?.state;
+    }
+    async verifyClose(close, authScope, publicKey, subtle = globalThis.crypto.subtle) {
+        this.#requireGroup(close.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#pendingObjects.size !== 0 || this.#entriesAwaitingObjects.size !== 0) {
+            throw new Error('source-auth group closed with unmatched objects or entries');
+        }
+        if (close.objectCount !== this.#entries.size || this.#admissions.size !== this.#entries.size) {
+            throw new Error('source-auth group close object count mismatch');
+        }
+        const root = sourceAuthMerkleRoot([...this.#entries.values()]);
+        if (!equalBytes(root, close.root))
+            throw new Error('source-auth group root mismatch');
+        const verified = await subtle.verify('Ed25519', publicKey, new Uint8Array(close.signature).buffer, new Uint8Array(sourceAuthSignaturePreimage(authScope, close.groupId, close.objectCount, root)).buffer);
+        if (!verified)
+            throw new Error('source-auth group close signature failed');
+        for (const admission of this.#admissions.values())
+            admission.state = 'authenticated';
+        this.#closed = true;
+    }
+    #requireGroup(groupId) {
+        requireU64('groupId', groupId);
+        if (this.#groupId === null)
+            this.#groupId = groupId;
+        else if (this.#groupId !== groupId)
+            throw new Error('source-auth group identity mismatch');
+    }
+    #verifyObject(entry, bytes, recovered) {
+        const authenticated = recovered
+            ? trimRecoveredSourceAuthObject(bytes, entry.trueLength)
+            : bytes;
+        if (!recovered && bytes.byteLength !== entry.trueLength) {
+            throw new Error(`direct source-auth object length mismatch for ${entry.objectId}`);
+        }
+        if (!equalBytes(sourceAuthObjectDigest(authenticated), entry.digest)) {
+            throw new Error(`source-auth object digest mismatch for ${entry.objectId}`);
+        }
+        const admission = {
+            groupId: entry.groupId,
+            objectId: entry.objectId,
+            recovered,
+            state: this.#manifestAuthenticated ? 'authenticated' : 'provisional',
+        };
+        this.#admissions.set(entry.objectId, admission);
+        return admission;
+    }
+}
+//# sourceMappingURL=admission.js.map

package/node_modules/@blockcast/mmt-manifest-verify/dist/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,kBAAkB,CAAA;AAoBzB,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,mBAAsB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACrB,sBAAsB,CAAS;IAC/B,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAA;IACnD,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC5D,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3C,WAAW,GAAG,IAAI,GAAG,EAAqC,CAAA;IACnE,QAAQ,GAAkB,IAAI,CAAA;IAC9B,OAAO,GAAG,KAAK,CAAA;IAEf,YAAY,OAA2C;QACrD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAA;IAC7D,CAAC;IAED,WAAW,CAAC,KAKX;QACC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YACnD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;SACpC,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;YACnC,KAAK,EAAE,eAAe;SACvB,CAAA;IACH,CAAC;IAED,UAAU,CAAC,KAA4B;QACrC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAChD,OAAO,gBAAgB,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IACpE,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,eAAe,CAAA;QAC9D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,gBAAgB,CAAA;QACvE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,eAAe,CAAA;QAC1E,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAA2B,EAC3B,SAAqB,EACrB,SAAoB,EACpB,SAAuB,UAAU,CAAC,MAAM,CAAC,MAAM;QAE/C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAClC,SAAS,EACT,SAAS,EACT,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EACtC,IAAI,UAAU,CACZ,2BAA2B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAC/E,CAAC,MAAM,CACT,CAAA;QACD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC1E,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YAAE,SAAS,CAAC,KAAK,GAAG,eAAe,CAAA;QACpF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;aAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC5F,CAAC;IAED,aAAa,CACX,KAA4B,EAC5B,KAAiB,EACjB,SAAkB;QAElB,MAAM,aAAa,GAAG,SAAS;YAC7B,CAAC,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;YACxD,CAAC,CAAC,KAAK,CAAA;QACT,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,SAAS,GAA8B;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;SACrE,CAAA;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}

package/node_modules/@blockcast/mmt-manifest-verify/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './source-auth.js';
+export * from './admission.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@blockcast/mmt-manifest-verify/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA"}

package/node_modules/@blockcast/mmt-manifest-verify/dist/index.js

@@ -0,0 +1,4 @@
+export * from './source-auth.js';
+export * from './admission.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.js.map

package/node_modules/@blockcast/mmt-manifest-verify/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA"}

package/node_modules/@blockcast/mmt-manifest-verify/dist/source-auth.d.ts

@@ -0,0 +1,37 @@
+export declare const SOURCE_AUTH_MANIFEST_VERSION = 1;
+export declare const SOURCE_AUTH_OBJECT_ENTRY_FRAME = 1;
+export declare const SOURCE_AUTH_GROUP_CLOSE_FRAME = 2;
+export declare const SOURCE_AUTH_OBJECT_ENTRY_LENGTH = 52;
+export declare const SOURCE_AUTH_GROUP_CLOSE_LENGTH = 112;
+export declare const SOURCE_AUTH_MAX_OBJECTS_PER_GROUP = 4096;
+export declare const SOURCE_AUTH_MAX_TRUE_LENGTH: number;
+export declare const SOURCE_AUTH_SCOPE_LENGTH = 32;
+export interface SourceAuthObjectEntry {
+    kind: 'object';
+    groupId: bigint;
+    objectId: number;
+    trueLength: number;
+    digest: Uint8Array;
+}
+export interface SourceAuthGroupClose {
+    kind: 'close';
+    groupId: bigint;
+    objectCount: number;
+    root: Uint8Array;
+    signature: Uint8Array;
+}
+export type SourceAuthManifestFrame = SourceAuthObjectEntry | SourceAuthGroupClose;
+export declare function sourceAuthObjectDigest(object: Uint8Array): Uint8Array;
+export declare function sourceAuthLeafHash(groupId: bigint, objectId: number, digest: Uint8Array, trueLength: number): Uint8Array;
+export declare function sourceAuthMerkleRoot(entries: readonly {
+    groupId: bigint;
+    objectId: number;
+    digest: Uint8Array;
+    trueLength: number;
+}[]): Uint8Array;
+export declare function trimRecoveredSourceAuthObject(recoveredSymbol: Uint8Array, trueLength: number): Uint8Array;
+export declare function encodeSourceAuthObjectEntry(entry: Omit<SourceAuthObjectEntry, 'kind'>): Uint8Array;
+export declare function encodeSourceAuthGroupClose(close: Omit<SourceAuthGroupClose, 'kind'>): Uint8Array;
+export declare function sourceAuthSignaturePreimage(authScope: Uint8Array, groupId: bigint, objectCount: number, root: Uint8Array): Uint8Array;
+export declare function decodeSourceAuthManifestFrame(frame: Uint8Array): SourceAuthManifestFrame;
+//# sourceMappingURL=source-auth.d.ts.map

package/node_modules/@blockcast/mmt-manifest-verify/dist/source-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-auth.d.ts","sourceRoot":"","sources":["../src/source-auth.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAC7C,eAAO,MAAM,8BAA8B,IAAI,CAAA;AAC/C,eAAO,MAAM,6BAA6B,IAAI,CAAA;AAC9C,eAAO,MAAM,+BAA+B,KAAK,CAAA;AACjD,eAAO,MAAM,8BAA8B,MAAM,CAAA;AACjD,eAAO,MAAM,iCAAiC,OAAO,CAAA;AACrD,eAAO,MAAM,2BAA2B,QAAmB,CAAA;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAI1C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;AA2BlF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAErE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,GACjB,UAAU,CAYZ;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB,EAAE,GACF,UAAU,CA4BZ;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,UAAU,EAC3B,UAAU,EAAE,MAAM,GACjB,UAAU,CAMZ;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GACzC,UAAU,CAcZ;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GACxC,UAAU,CAiBZ;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,UAAU,GACf,UAAU,CAgBZ;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,UAAU,GAAG,uBAAuB,CAwCxF"}