@blockcast/mmt-container 0.1.0 → 0.3.0

package/node_modules/@blockcast/mmt-manifest-verify/src/verifier.ts

@@ -0,0 +1,669 @@
+import {
+  decodeSourceAuthManifestFrame,
+  sourceAuthMerkleRoot,
+  sourceAuthObjectDigest,
+  sourceAuthSignaturePreimage,
+  type SourceAuthGroupClose,
+  type SourceAuthObjectEntry,
+} from './source-auth.js'
+
+export type ManifestAuthMode = 'off' | 'shadow' | 'enforce'
+export type MissingManifestPolicy = 'stall' | 'fallback-shadow'
+export type ManifestFailureReason =
+  | 'sigInvalid'
+  | 'digestMismatch'
+  | 'manifestLate'
+  | 'manifestAbsent'
+  | 'verifierError'
+
+export interface ManifestAuthConfig {
+  mode: ManifestAuthMode
+  onMissingManifest: MissingManifestPolicy
+}
+
+export interface ManifestObjectIdentity {
+  trackName: string
+  /** Stable v2 auth binding. Defaults to trackName for legacy single-format callers. */
+  bindingId?: string
+  /** MoQ group ids are u62; values above 2^53 must be passed as bigint. */
+  groupId: number | bigint
+  objectId: number
+  packetId?: number
+  ssId?: number
+}
+
+export interface ManifestFecBlockMapper {
+  readonly d: number
+  derive(groupId: number, objectId: number): { ssId: number }
+}
+
+export interface ManifestTrackContext {
+  broadcastNamespaceId: string
+  trackName: string
+  /** Stable v2 auth binding. Defaults to trackName for legacy single-format callers. */
+  bindingId?: string
+  sourceSymbolFormat?: string
+  keyEpoch: number
+  codec: string
+  timing: string
+  fecGeometry: string
+  manifestFormatVersion: number
+  /** Authenticated-catalog binding for the namespace, track, epoch, codec,
+   * timing, FEC geometry, and manifest version fields above. */
+  authScope: Uint8Array
+  publicKey: Uint8Array
+  /** Current key first, followed by any catalog-advertised overlap keys. */
+  acceptedPublicKeys?: readonly Uint8Array[]
+  bitrate: number
+  groupDurationMs: number
+  mapper: ManifestFecBlockMapper
+  manifestChannelAuthenticated: boolean
+}
+
+export interface ManifestVerificationStats {
+  verified: number
+  /** Terminal outcomes only: an object counted here will never be verified. */
+  failures: Record<ManifestFailureReason, number>
+  /**
+   * Objects currently held in quarantine awaiting a manifest — pending, NOT
+   * failed, and deliberately disjoint from `failures`. An enforce-mode stall is
+   * accounted here first and moves into `failures` only once the verifier gives
+   * up on it, so a reason breakdown that ignores this gauge under-reports live
+   * stalls by whatever is still in flight (BLO-30007).
+   */
+  quarantined: number
+  quarantinedBytes: number
+}
+
+export interface ManifestFailure {
+  trackName: string
+  bindingId?: string
+  groupId: number | bigint
+  objectId: number
+  reason: ManifestFailureReason
+}
+
+export interface ManifestAdmission {
+  action: 'play' | 'stall' | 'drop'
+  verified: boolean
+  reason?: ManifestFailureReason
+}
+
+export type SignatureVerifier = (
+  publicKey: Uint8Array,
+  message: Uint8Array,
+  signature: Uint8Array,
+) => boolean | Promise<boolean>
+
+export function manifestBindingId(trackName: string, sourceSymbolFormat: string): string {
+  return JSON.stringify([trackName, sourceSymbolFormat])
+}
+
+export function createWebCryptoEd25519Verifier(
+  subtle: SubtleCrypto = globalThis.crypto.subtle,
+): SignatureVerifier {
+  return async (publicKey, message, signature) => {
+    const keyBytes = Uint8Array.from(publicKey)
+    const messageBytes = Uint8Array.from(message)
+    const signatureBytes = Uint8Array.from(signature)
+    const key = await subtle.importKey('raw', keyBytes.buffer, 'Ed25519', false, ['verify'])
+    return subtle.verify('Ed25519', key, signatureBytes.buffer, messageBytes.buffer)
+  }
+}
+
+interface PendingObject {
+  identity: ManifestObjectIdentity
+  data: Uint8Array
+  release: () => void
+  discard?: () => void
+  bytes: number
+}
+
+interface GroupState {
+  entries: Map<number, SourceAuthObjectEntry>
+  pending: Map<number, PendingObject>
+  close?: SourceAuthGroupClose
+  /** Close frame that arrived before all object entries (manifest-channel
+   * reordering); retried once the entry count matches. */
+  pendingClose?: SourceAuthGroupClose
+  rootVerified: boolean
+  signaturePending?: boolean
+  failed?: ManifestFailureReason
+}
+
+interface TrackState {
+  context: ManifestTrackContext
+  groups: Map<bigint, GroupState>
+  quarantine: PendingObject[]
+  quarantinedBytes: number
+  capBytes: number
+  manifestEntries: number
+  maxManifestEntries: number
+  maxGroups: number
+}
+
+const FAILURE_REASONS: readonly ManifestFailureReason[] = [
+  'sigInvalid',
+  'digestMismatch',
+  'manifestLate',
+  'manifestAbsent',
+  'verifierError',
+]
+
+const equalBytes = (left: Uint8Array, right: Uint8Array): boolean => {
+  if (left.byteLength !== right.byteLength) return false
+  let diff = 0
+  for (let index = 0; index < left.byteLength; index++) diff |= left[index]! ^ right[index]!
+  return diff === 0
+}
+
+const isPromiseLike = (value: boolean | Promise<boolean>): value is Promise<boolean> =>
+  typeof value === 'object' && value !== null && typeof value.then === 'function'
+
+export class ManifestVerifier {
+  #config: ManifestAuthConfig
+  readonly #verifySignature: SignatureVerifier
+  readonly #onFailure?: (failure: ManifestFailure) => void
+  readonly #tracks = new Map<string, TrackState>()
+  readonly #stats: Omit<ManifestVerificationStats, 'quarantined'> = {
+    verified: 0,
+    failures: Object.fromEntries(FAILURE_REASONS.map((reason) => [reason, 0])) as Record<ManifestFailureReason, number>,
+    quarantinedBytes: 0,
+  }
+  #disposed = false
+
+  constructor(options: {
+    manifestAuth: ManifestAuthConfig
+    verifySignature: SignatureVerifier
+    onFailure?: (failure: ManifestFailure) => void
+  }) {
+    this.#config = { ...options.manifestAuth }
+    this.#verifySignature = options.verifySignature
+    this.#onFailure = options.onFailure
+  }
+
+  get config(): Readonly<ManifestAuthConfig> {
+    return this.#config
+  }
+
+  get stats(): ManifestVerificationStats {
+    let quarantined = 0
+    for (const track of this.#tracks.values()) quarantined += track.quarantine.length
+    return {
+      verified: this.#stats.verified,
+      failures: { ...this.#stats.failures },
+      quarantined,
+      quarantinedBytes: this.#stats.quarantinedBytes,
+    }
+  }
+
+  setMode(mode: ManifestAuthMode): void {
+    this.#config = { ...this.#config, mode }
+    if (mode !== 'enforce') this.#releaseAllQuarantine(false)
+  }
+
+  registerTrack(context: ManifestTrackContext): void {
+    const bindingId = context.bindingId ?? context.trackName
+    if (this.#tracks.has(bindingId)) {
+      throw new Error(`manifest binding ${bindingId} is already registered`)
+    }
+    if (!Number.isFinite(context.bitrate) || context.bitrate <= 0) {
+      throw new Error('manifest track bitrate must be > 0')
+    }
+    if (!Number.isFinite(context.groupDurationMs) || context.groupDurationMs <= 0) {
+      throw new Error('manifest track groupDurationMs must be > 0')
+    }
+    if (context.authScope.byteLength !== 32) throw new Error('manifest authScope must be 32 bytes')
+    if (context.publicKey.byteLength !== 32) throw new Error('manifest publicKey must be 32 bytes')
+    for (const key of context.acceptedPublicKeys ?? []) {
+      if (key.byteLength !== 32) throw new Error('manifest acceptedPublicKeys must contain 32-byte keys')
+    }
+    for (const [name, value] of Object.entries({
+      broadcastNamespaceId: context.broadcastNamespaceId,
+      trackName: context.trackName,
+      codec: context.codec,
+      timing: context.timing,
+      fecGeometry: context.fecGeometry,
+    })) {
+      if (value.length === 0) throw new Error(`manifest ${name} must not be empty`)
+    }
+    this.#tracks.set(bindingId, {
+      context: { ...context, bindingId },
+      groups: new Map(),
+      quarantine: [],
+      quarantinedBytes: 0,
+      capBytes: Math.ceil((context.bitrate * context.groupDurationMs) / 8000),
+      manifestEntries: 0,
+      maxManifestEntries: Math.ceil((context.bitrate * context.groupDurationMs) / (8000 * 52)),
+      maxGroups: context.mapper.d + 1,
+    })
+  }
+
+  ingestManifestFrame(bindingId: string, frameBytes: Uint8Array): void {
+    const track = this.#requireTrack(bindingId)
+    try {
+      const frame = decodeSourceAuthManifestFrame(frameBytes)
+      const groupId = frame.groupId
+      const group = this.#group(track, groupId)
+      if (frame.kind === 'object') {
+        if (group.close || group.signaturePending || group.failed) {
+          this.#failure({ trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, 'verifierError')
+          return
+        }
+        if (group.entries.has(frame.objectId)) {
+          this.#failure({ trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, 'verifierError')
+          return
+        }
+        if (group.entries.size >= 4096 || track.manifestEntries >= track.maxManifestEntries) {
+          this.#failure({ trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, 'verifierError')
+          return
+        }
+        group.entries.set(frame.objectId, frame)
+        track.manifestEntries++
+        const pending = group.pending.get(frame.objectId)
+        if (pending) {
+          this.#failure(pending.identity, 'manifestLate')
+          this.#resolvePending(track, group, pending, frame)
+        }
+        if (group.pendingClose && group.entries.size === group.pendingClose.objectCount) {
+          const close = group.pendingClose
+          group.pendingClose = undefined
+          this.#closeGroup(track, groupId, group, close)
+        }
+        return
+      }
+      this.#closeGroup(track, groupId, group, frame)
+    } catch {
+      this.#failure({ trackName: track.context.trackName, bindingId, groupId: 0, objectId: 0 }, 'verifierError')
+    }
+  }
+
+  admitObject(
+    identity: ManifestObjectIdentity,
+    data: Uint8Array,
+    release: () => void,
+    /**
+     * Called instead of `release` when a stalled object is terminally rejected
+     * rather than played. A caller that drives a sequence off `release` (the FEC
+     * symbol loop in `mmtp-router` does) must pass this, or an enforce-mode
+     * discard leaves the sequence waiting on a callback that will never fire.
+     * A `drop` returned from this call is the synchronous form of the same
+     * outcome and does NOT also invoke `discard`.
+     */
+    discard?: () => void,
+  ): ManifestAdmission {
+    if (this.#config.mode === 'off') {
+      release()
+      return { action: 'play', verified: false }
+    }
+    const track = this.#tracks.get(identity.bindingId ?? identity.trackName)
+    if (!track) {
+      release()
+      this.#failure(identity, 'verifierError')
+      return { action: 'play', verified: false, reason: 'verifierError' }
+    }
+    try {
+      if (!this.#validateIdentity(track, identity)) {
+        return this.#rejectOrShadow(identity, release, 'digestMismatch')
+      }
+      const group = this.#group(track, BigInt(identity.groupId))
+      if (group.failed === 'sigInvalid' || group.failed === 'digestMismatch') {
+        return this.#rejectOrShadow(identity, release, group.failed)
+      }
+      const entry = group.entries.get(identity.objectId)
+      if (entry) return this.#admitAgainstEntry(track, group, identity, data, release, entry, discard)
+      if (this.#config.mode === 'shadow' || this.#config.onMissingManifest === 'fallback-shadow') {
+        release()
+        this.#failure(identity, 'manifestAbsent')
+        return { action: 'play', verified: false, reason: 'manifestAbsent' }
+      }
+      if (!this.#quarantine(track, group, { identity, data, release, discard, bytes: data.byteLength })) {
+        return { action: 'drop', verified: false }
+      }
+      return { action: 'stall', verified: false }
+    } catch {
+      release()
+      this.#failure(identity, 'verifierError')
+      return { action: 'play', verified: false, reason: 'verifierError' }
+    }
+  }
+
+  dispose(): void {
+    if (this.#disposed) return
+    this.#disposed = true
+    this.#releaseAllQuarantine(false)
+    this.#tracks.clear()
+  }
+
+  #requireTrack(bindingId: string): TrackState {
+    const track = this.#tracks.get(bindingId)
+    if (!track) throw new Error(`unknown manifest binding ${bindingId}`)
+    return track
+  }
+
+  #group(track: TrackState, groupId: bigint): GroupState {
+    let group = track.groups.get(groupId)
+    if (!group) {
+      group = { entries: new Map(), pending: new Map(), rootVerified: false }
+      track.groups.set(groupId, group)
+      while (track.groups.size > track.maxGroups) {
+        const oldest = track.groups.entries().next().value as [bigint, GroupState] | undefined
+        if (!oldest) break
+        const [oldestId, oldestGroup] = oldest
+        for (const pending of [...oldestGroup.pending.values()]) {
+          this.#removePending(track, oldestGroup, pending)
+          this.#giveUpOnPending(pending)
+          // The group aged out with objects still waiting on a manifest that
+          // never arrived. That is an absent manifest, not a verifier fault:
+          // `verifierError` is reserved for an exception/crash in the verifier
+          // itself, so mislabelling here reads on the graduation dashboard as a
+          // software bug and hides a benign absent-manifest stall (BLO-30007).
+          this.#failure(pending.identity, 'manifestAbsent')
+        }
+        track.manifestEntries -= oldestGroup.entries.size
+        track.groups.delete(oldestId)
+      }
+    }
+    return group
+  }
+
+  #validateIdentity(track: TrackState, identity: ManifestObjectIdentity): boolean {
+    const coordinates = track.context.mapper.derive(Number(identity.groupId), identity.objectId)
+    return identity.ssId === undefined || coordinates.ssId === identity.ssId
+  }
+
+  #admitAgainstEntry(
+    track: TrackState,
+    group: GroupState,
+    identity: ManifestObjectIdentity,
+    data: Uint8Array,
+    release: () => void,
+    entry: SourceAuthObjectEntry,
+    discard?: () => void,
+  ): ManifestAdmission {
+    if (entry.trueLength !== data.byteLength) {
+      return this.#rejectOrShadow(identity, release, 'digestMismatch')
+    }
+    const digestMatches = equalBytes(sourceAuthObjectDigest(data.subarray(0, entry.trueLength)), entry.digest)
+    if (!digestMatches) return this.#rejectOrShadow(identity, release, 'digestMismatch')
+    if (!track.context.manifestChannelAuthenticated && !group.rootVerified) {
+      if (this.#config.mode === 'shadow') {
+        release()
+        return { action: 'play', verified: false }
+      }
+      if (!this.#quarantine(track, group, { identity, data, release, discard, bytes: data.byteLength })) {
+        return { action: 'drop', verified: false }
+      }
+      return { action: 'stall', verified: false }
+    }
+    release()
+    this.#stats.verified++
+    return { action: 'play', verified: true }
+  }
+
+  #rejectOrShadow(
+    identity: ManifestObjectIdentity,
+    release: () => void,
+    reason: 'digestMismatch' | 'sigInvalid',
+  ): ManifestAdmission {
+    this.#failure(identity, reason)
+    if (this.#config.mode === 'enforce') {
+      console.warn(JSON.stringify({ event: 'manifest-enforce-drop', track: identity.trackName, group: String(identity.groupId), object: identity.objectId, reason }))
+      return { action: 'drop', verified: false, reason }
+    }
+    release()
+    return { action: 'play', verified: false, reason }
+  }
+
+  #resolvePending(
+    track: TrackState,
+    group: GroupState,
+    pending: PendingObject,
+    entry: SourceAuthObjectEntry,
+  ): void {
+    this.#removePending(track, group, pending)
+    this.#admitAgainstEntry(track, group, pending.identity, pending.data, pending.release, entry, pending.discard)
+  }
+
+  #closeGroup(
+    track: TrackState,
+    groupId: bigint,
+    group: GroupState,
+    close: SourceAuthGroupClose,
+  ): void {
+    if (group.close || group.signaturePending) return
+    const entries = [...group.entries.values()]
+    if (entries.length !== close.objectCount) {
+      // Manifest-channel reordering: the close frame beat some object entries.
+      // Stash it (latest-wins on duplicates) so the object-entry path can
+      // re-attempt the close once the count matches; quarantined objects stay
+      // quarantined, and manifestAbsent below is a signal, not an eviction.
+      group.pendingClose = close
+      const hadPending = group.pending.size > 0
+      if (this.#config.onMissingManifest === 'fallback-shadow' || this.#config.mode === 'shadow') {
+        for (const pending of [...group.pending.values()]) {
+          this.#removePending(track, group, pending)
+          pending.release()
+          this.#failure(pending.identity, 'manifestAbsent')
+        }
+      } else {
+        for (const pending of group.pending.values()) {
+          this.#failure(pending.identity, 'manifestAbsent')
+        }
+      }
+      if (!hadPending) {
+        this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, 'manifestAbsent')
+      }
+      return
+    }
+    if (!equalBytes(sourceAuthMerkleRoot(entries), close.root)) {
+      group.failed = 'digestMismatch'
+      this.#failGroup(track, groupId, group, 'digestMismatch')
+      return
+    }
+    const preimage = sourceAuthSignaturePreimage(track.context.authScope, close.groupId, close.objectCount, close.root)
+    let signatureValid: boolean | Promise<boolean>
+    try {
+      signatureValid = this.#verifyAcceptedSignature(track, preimage, close.signature)
+    } catch {
+      this.#failOpenGroup(track, groupId, group)
+      return
+    }
+    if (isPromiseLike(signatureValid)) {
+      group.signaturePending = true
+      void signatureValid.then(
+        (valid) => {
+          if (this.#disposed) return
+          group.signaturePending = false
+          this.#finishGroupSignature(track, groupId, group, close, valid)
+        },
+        () => {
+          if (this.#disposed) return
+          group.signaturePending = false
+          this.#failOpenGroup(track, groupId, group)
+        },
+      )
+      return
+    }
+    this.#finishGroupSignature(track, groupId, group, close, signatureValid)
+  }
+
+  #finishGroupSignature(
+    track: TrackState,
+    groupId: bigint,
+    group: GroupState,
+    close: SourceAuthGroupClose,
+    signatureValid: boolean,
+  ): void {
+    if (!signatureValid) {
+      group.failed = 'sigInvalid'
+      this.#failGroup(track, groupId, group, 'sigInvalid')
+      return
+    }
+    group.failed = undefined
+    group.close = close
+    group.pendingClose = undefined
+    group.rootVerified = true
+    for (const pending of [...group.pending.values()]) {
+      const entry = group.entries.get(pending.identity.objectId)
+      if (entry) this.#resolvePending(track, group, pending, entry)
+      else if (this.#config.onMissingManifest === 'fallback-shadow') {
+        this.#removePending(track, group, pending)
+        pending.release()
+        this.#failure(pending.identity, 'manifestAbsent')
+      }
+    }
+  }
+
+  #verifyAcceptedSignature(
+    track: TrackState,
+    message: Uint8Array,
+    signature: Uint8Array,
+  ): boolean | Promise<boolean> {
+    const keys = track.context.acceptedPublicKeys ?? [track.context.publicKey]
+    const pending: Promise<boolean | 'error'>[] = []
+    let hadSynchronousError = false
+    for (const key of keys) {
+      try {
+        const result = this.#verifySignature(key, message, signature)
+        if (isPromiseLike(result)) {
+          pending.push(Promise.resolve(result).then((valid) => valid, () => 'error' as const))
+        } else if (result) {
+          return true
+        }
+      } catch {
+        hadSynchronousError = true
+      }
+    }
+    if (pending.length === 0) {
+      if (hadSynchronousError) throw new Error('manifest signature verifier unavailable')
+      return false
+    }
+    return Promise.all(pending).then((results) => {
+      if (results.some((valid) => valid === true)) return true
+      if (hadSynchronousError || results.some((valid) => valid === 'error')) {
+        throw new Error('manifest signature verifier unavailable')
+      }
+      return false
+    })
+  }
+
+  #failGroup(
+    track: TrackState,
+    groupId: bigint,
+    group: GroupState,
+    reason: 'digestMismatch' | 'sigInvalid',
+  ): void {
+    if (group.pending.size === 0) {
+      this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, reason)
+      return
+    }
+    for (const pending of [...group.pending.values()]) {
+      this.#removePending(track, group, pending)
+      // Same contract as an eviction: a quarantined object that is rejected
+      // rather than played must still tell the caller it is finished, or a
+      // caller sequencing off `release` waits forever (BLO-30095).
+      if (this.#rejectOrShadow(pending.identity, pending.release, reason).action === 'drop') {
+        pending.discard?.()
+      }
+    }
+  }
+
+  #removePending(track: TrackState, group: GroupState, pending: PendingObject): void {
+    if (group.pending.get(pending.identity.objectId) === pending) {
+      group.pending.delete(pending.identity.objectId)
+    }
+    const index = track.quarantine.indexOf(pending)
+    if (index >= 0) track.quarantine.splice(index, 1)
+    track.quarantinedBytes -= pending.bytes
+    this.#stats.quarantinedBytes -= pending.bytes
+  }
+
+  #quarantine(track: TrackState, group: GroupState, pending: PendingObject): boolean {
+    if (group.pending.has(pending.identity.objectId)) return false
+    group.pending.set(pending.identity.objectId, pending)
+    track.quarantine.push(pending)
+    track.quarantinedBytes += pending.bytes
+    this.#stats.quarantinedBytes += pending.bytes
+    this.#enforceCap(track)
+    return true
+  }
+
+  #enforceCap(track: TrackState): void {
+    while (track.quarantinedBytes > track.capBytes && track.quarantine.length > 0) {
+      const pending = track.quarantine.shift()!
+      const group = track.groups.get(BigInt(pending.identity.groupId))
+      if (group) group.pending.delete(pending.identity.objectId)
+      track.quarantinedBytes -= pending.bytes
+      this.#stats.quarantinedBytes -= pending.bytes
+      this.#giveUpOnPending(pending)
+      // Quarantine budget ran out while the object was still waiting on a
+      // manifest. The manifest was absent when we gave up; the verifier did not
+      // fault. Same reason in shadow and enforce so the dashboard reads one
+      // taxonomy across modes (BLO-30007).
+      this.#failure(pending.identity, 'manifestAbsent')
+      console.warn(`[ManifestVerifier] quarantine cap eviction track=${pending.identity.trackName} group=${pending.identity.groupId} object=${pending.identity.objectId} disposition=${this.#config.mode === 'enforce' ? 'drop' : 'fail-open'}`)
+    }
+  }
+
+  /**
+   * Stop waiting for a manifest that never arrived. In `enforce` the object is
+   * discarded: an eviction is a rejection, not a deferred play, so unverified
+   * media never reaches the player two groups after the stall was recorded
+   * (BLO-30095, CTO disposition on the issue thread).
+   *
+   * Deliberately NOT used by `#failOpenGroup`/`#failOpenTrack` — failing open on
+   * a genuine verifier fault is correct and stays untouched.
+   */
+  #giveUpOnPending(pending: PendingObject): void {
+    if (this.#config.mode !== 'enforce') {
+      pending.release()
+      return
+    }
+    pending.discard?.()
+  }
+
+  #failOpenTrack(track: TrackState, reason: 'verifierError'): void {
+    for (const pending of [...track.quarantine]) {
+      const group = track.groups.get(BigInt(pending.identity.groupId))
+      if (group) this.#removePending(track, group, pending)
+      pending.release()
+      this.#failure(pending.identity, reason)
+    }
+  }
+
+  #failOpenGroup(track: TrackState, groupId: bigint, group: GroupState): void {
+    const pending = [...group.pending.values()]
+    if (pending.length === 0) {
+      this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, 'verifierError')
+      return
+    }
+    for (const object of pending) {
+      this.#removePending(track, group, object)
+      object.release()
+      this.#failure(object.identity, 'verifierError')
+    }
+  }
+
+  #releaseAllQuarantine(countFailure: boolean): void {
+    for (const track of this.#tracks.values()) {
+      for (const pending of [...track.quarantine]) {
+        const group = track.groups.get(BigInt(pending.identity.groupId))
+        if (group) this.#removePending(track, group, pending)
+        pending.release()
+        if (countFailure) this.#failure(pending.identity, 'verifierError')
+      }
+    }
+  }
+
+  #failure(identity: ManifestObjectIdentity, reason: ManifestFailureReason): void {
+    this.#stats.failures[reason]++
+    this.#onFailure?.({
+      trackName: identity.trackName,
+      ...(identity.bindingId === undefined ? {} : { bindingId: identity.bindingId }),
+      groupId: identity.groupId,
+      objectId: identity.objectId,
+      reason,
+    })
+  }
+}

package/node_modules/@noble/hashes/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the “Software”), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.