@blockcast/mmt-container 0.4.1 → 0.5.0-main.34c7b9c2cfa0

package/dist/mmtp-container-parser.no-modules.js

@@ -7,6 +7,7 @@ var BlockcastMmt = (() => {
   var __typeError = (msg) => {
     throw TypeError(msg);
   };
+  var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
   var __export = (target, all) => {
     for (var name in all)
       __defProp(target, name, { get: all[name], enumerable: true });
@@ -19,7 +20,8 @@ var BlockcastMmt = (() => {
     }
     return to;
   };
-  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+  var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: true }), mod2);
+  var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
   var __accessCheck = (obj, member, msg) => member.has(obj) || __typeError("Cannot " + msg);
   var __privateGet = (obj, member, getter) => (__accessCheck(obj, member, "read from private field"), getter ? getter.call(obj) : member.get(obj));
   var __privateAdd = (obj, member, value) => member.has(obj) ? __typeError("Cannot add the same private member more than once") : member instanceof WeakSet ? member.add(obj) : member.set(obj, value);
@@ -37,9 +39,9 @@ var BlockcastMmt = (() => {
   // src/no-modules.ts
   var no_modules_exports = {};
   __export(no_modules_exports, {
+    BcProvenanceV2Receiver: () => BcProvenanceV2Receiver,
     CmsfCatalogValidationError: () => CmsfCatalogValidationError,
     FEC_INACTIVE_REASONS: () => FEC_INACTIVE_REASONS,
-    ManifestVerifier: () => ManifestVerifier,
     MmtpContainerParser: () => MmtpContainerParser,
     MmtpFecSession: () => MmtpFecSession,
     MmtpToCmaf: () => MmtpToCmaf,
@@ -47,14 +49,11 @@ var BlockcastMmt = (() => {
     catalogAtsc3NetworkSource: () => catalogAtsc3NetworkSource,
     catalogDeclaresFec: () => catalogDeclaresFec,
     catalogFecInterleaveMs: () => catalogFecInterleaveMs,
-    createManifestAuthPlan: () => createManifestAuthPlan,
     createWasmMmtpContainerParser: () => createWasmMmtpContainerParser,
-    createWebCryptoEd25519Verifier: () => createWebCryptoEd25519Verifier,
     datagramMfuReassembly: () => datagramMfuReassembly,
     fecBlockBudgetMs: () => fecBlockBudgetMs,
     fecBlockDeadlineMs: () => fecBlockDeadlineMs,
     isFmp4InitSegment: () => isFmp4InitSegment,
-    manifestBindingId: () => manifestBindingId,
     mmtpFrameReorderWindowFrames: () => mmtpFrameReorderWindowFrames,
     reliableMoqMfuReassembly: () => reliableMoqMfuReassembly,
     resolveFecState: () => resolveFecState,
@@ -5658,6 +5657,9 @@ var BlockcastMmt = (() => {
     if (!a || !b || a.mediaTimescale !== b.mediaTimescale) return false;
     return b.decodeTime > a.decodeTime + BigInt(a.durationTicks);
   }
+  function ssIdAfter(a, b) {
+    return (a - b | 0) > 0;
+  }
   var _streams2, _gate, _emit2, _recordStat2, _deferDepth, _deferredStreams, _FecReleaseSequencer_instances, drainUnlessDeferred_fn, streamFor_fn2, drain_fn, release_fn;
   var FecReleaseSequencer = class {
     constructor(gate, emit, recordStat) {
@@ -5717,11 +5719,17 @@ var BlockcastMmt = (() => {
         stream.last = null;
         stream.lastSbn = void 0;
         stream.discontinuity = false;
+        stream.rapSsId = void 0;
       }
       if (stream.last !== null && compareFrameOrder(frame, stream.last) <= 0) {
         __privateGet(this, _recordStat2).call(this, "droppedStale");
         return;
       }
+      const ssId = meta.fecSbn;
+      if (meta.trackType === "video" && ssId !== void 0 && __privateGet(this, _gate).isRap?.(data, meta) === true) {
+        if (stream.rapSsId === void 0 || ssIdAfter(ssId, stream.rapSsId)) stream.rapSsId = ssId;
+        __privateGet(this, _gate).onRap?.(stream.packetId, stream.catalogTrackName, ssId);
+      }
       if (stream.last === null) {
         if (meta.trackType === "video" && !meta.keyframe) {
           __privateGet(this, _recordStat2).call(this, "droppedBeforeStartupKeyframe");
@@ -5757,6 +5765,22 @@ var BlockcastMmt = (() => {
       }
       return earliest;
     }
+    /**
+     * Whether a complete RAP above SS_ID `ssId` entered the gate of a stream of
+     * `packetId` (draft-ramadan-moq-fec 11.4.2: repair of a block below it is
+     * moot). Its SS_ID is the one its frame completed in; a frame's packets
+     * hold consecutive SS_IDs in authored order, so a complete RAP with a
+     * packet above `ssId` has every packet of it at or above the first SS_ID
+     * any loss at or below `ssId` could have taken.
+     */
+    rapAbove(packetId, catalogTrackName, ssId) {
+      for (const stream of __privateGet(this, _streams2).values()) {
+        if (stream.packetId !== packetId) continue;
+        if (catalogTrackName !== void 0 && stream.catalogTrackName !== catalogTrackName) continue;
+        if (stream.rapSsId !== void 0 && ssIdAfter(stream.rapSsId, ssId)) return true;
+      }
+      return false;
+    }
     /** Re-evaluate held gaps after FEC state changed. */
     poke(streamKey) {
       if (streamKey !== void 0) {
@@ -5859,7 +5883,8 @@ var BlockcastMmt = (() => {
         buf: [],
         last: null,
         lastSbn: void 0,
-        discontinuity: false
+        discontinuity: false,
+        rapSsId: void 0
       };
       __privateGet(this, _streams2).set(streamKey, stream);
     }
@@ -6136,6 +6161,10 @@ var BlockcastMmt = (() => {
     fecReleaseEarliestHeldAtMs(packetId, catalogTrackName) {
       return __privateGet(this, _fecSequencer)?.earliestHeldArrivalMs(packetId, catalogTrackName);
     }
+    /** See FecReleaseSequencer.rapAbove; false when no stream is FEC-gated. */
+    fecReleaseRapAbove(packetId, catalogTrackName, ssId) {
+      return __privateGet(this, _fecSequencer)?.rapAbove(packetId, catalogTrackName, ssId) ?? false;
+    }
     /** Re-evaluate held gaps after FEC block state changed. */
     pokeFecRelease(packetId, catalogTrackName) {
       if (!__privateGet(this, _fecSequencer)) return;
@@ -8223,14 +8252,90 @@ var BlockcastMmt = (() => {
     return INACTIVE["reliable-moq"];
   }
 
+  // src/held-layer-admission.ts
+  var HORIZON_CAP = 1073741824;
+  function heldLayerAnchorHorizon(retentionBlocks, k) {
+    return retentionBlocks === void 0 || k <= 0 ? HORIZON_CAP : Math.min(HORIZON_CAP, retentionBlocks * k);
+  }
+  var _layerNames, _states;
+  var HeldLayerAdmission = class {
+    constructor(layers, heldLayers = [0]) {
+      __privateAdd(this, _layerNames);
+      __privateAdd(this, _states);
+      const held = new Set(heldLayers);
+      __privateSet(this, _layerNames, new Set(layers.map((l) => l.repairTrackName)));
+      __privateSet(this, _states, layers.filter((l) => held.has(l.layer)).map((l) => ({ layer: l.layer, repairTrackName: l.repairTrackName, total: l.rsIdOffset + l.repairSymbols })));
+    }
+    /**
+     * Judges one repair packet, after the 4.5 discards and the size check and
+     * before it places a block. `repairTrackName` is the subscribed repair
+     * track, never inferred from RS_ID; without it only (b) runs. A packet on a
+     * repair track the catalog does not list is `'discard'` and anchors nothing.
+     * `sourceFrontier` is the newest source SS_ID, if any: a repair more than
+     * `horizon` past it is judged without moving the anchored state.
+     *
+     * @returns undefined to admit, `'discard'`, or the fail-closed reason.
+     */
+    admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
+      if (repairTrackName !== void 0 && !__privateGet(this, _layerNames).has(repairTrackName)) return "discard";
+      const farAhead = sourceFrontier !== void 0 && serial32Precedes(sourceFrontier, ssStart) && serial32Distance(sourceFrontier, ssStart) > horizon;
+      for (const state of __privateGet(this, _states)) {
+        let code;
+        if (farAhead) {
+          if (rsbLength < state.total) {
+            if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+            else if (state.anchor !== void 0 || state.settled) code = "below_anchored_total";
+          }
+        } else {
+          if (state.newest === void 0 || serial32Precedes(state.newest, ssStart)) state.newest = ssStart;
+          const stale = (s) => serial32Distance(s, state.newest) > horizon;
+          if (state.latestBelow !== void 0 && stale(state.latestBelow)) {
+            delete state.latestBelow;
+            delete state.latestBelowRsb;
+          }
+          if (state.anchor !== void 0 && stale(state.anchor)) state.settled = true;
+          if (rsbLength < state.total) {
+            if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+            else if (stale(ssStart)) continue;
+            else if (state.settled || state.anchor !== void 0 && !serial32Precedes(ssStart, state.anchor)) code = "below_anchored_total";
+            else if (state.latestBelow === void 0 || serial32Precedes(state.latestBelow, ssStart)) {
+              state.latestBelow = ssStart;
+              state.latestBelowRsb = rsbLength;
+            }
+          } else if (!state.settled && !stale(ssStart)) {
+            if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
+            if (state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
+              code = "below_anchored_total";
+              ssStart = state.latestBelow;
+              rsbLength = state.latestBelowRsb;
+            }
+          }
+        }
+        if (code !== void 0) {
+          return {
+            code,
+            layer: state.layer,
+            total: state.total,
+            rsbLength,
+            ssStart,
+            ...state.anchor === void 0 ? {} : { anchor: state.anchor }
+          };
+        }
+      }
+      return void 0;
+    }
+  };
+  _layerNames = new WeakMap();
+  _states = new WeakMap();
+
   // src/mmtp-fec-session.ts
   var PATH_BITS = { moq: 1, multicast: 2 };
   var MIXED_PATHS = PATH_BITS.moq | PATH_BITS.multicast;
-  var _decoder, _blocks, _settled, _have, _newest, _prunedAt, _repairPacketId, _stats3, _MmtpFecSession_instances, drop_fn2, noteNewest_fn, blockStartOf_fn, countHeld_fn, noteMixed_fn, behindHorizon_fn, settle_fn, settleClean_fn, settleDecoded_fn, retireBehindHorizon_fn;
+  var _decoder, _blocks, _settled, _have, _newest, _prunedAt, _repairPacketId, _newestSource, _heldLayers, _anchorHorizon, _stats3, _MmtpFecSession_instances, drop_fn2, noteNewest_fn, blockStartOf_fn, countHeld_fn, noteMixed_fn, behindHorizon_fn, settle_fn, settleClean_fn, settleDecoded_fn, retireBehindHorizon_fn;
   var MmtpFecSession = class {
     /**
      * @throws when the catalog block lacks or misstates a field the session
-     *   needs: the block profile, K, T, `interleaveDepthMs` or
+     *   needs: the block profile, K, P_0 (`repairSymbols`), T, `interleaveDepthMs` or
      *   `reorderToleranceMs`. None is defaulted.
      */
     constructor(config) {
@@ -8249,6 +8354,9 @@ var BlockcastMmt = (() => {
       /** The newest SS_ID when the remembered SS_IDs were last pruned. */
       __privateAdd(this, _prunedAt);
       __privateAdd(this, _repairPacketId);
+      __privateAdd(this, _newestSource);
+      __privateAdd(this, _heldLayers);
+      __privateAdd(this, _anchorHorizon);
       __privateAdd(this, _stats3, {
         sourceSymbols: 0,
         repairSymbols: 0,
@@ -8261,7 +8369,8 @@ var BlockcastMmt = (() => {
         dropped: {},
         sourceSymbolsByPath: { moq: 0, multicast: 0 },
         repairSymbolsByPath: { moq: 0, multicast: 0 },
-        mixedPath: { clean: 0, recovered: 0, failed: 0, released: 0 }
+        mixedPath: { clean: 0, recovered: 0, failed: 0, released: 0 },
+        failClosed: null
       });
       const fec = config?.fec;
       if (!fec || typeof fec !== "object") {
@@ -8273,6 +8382,7 @@ var BlockcastMmt = (() => {
       }
       this.algorithm = fec.algorithm === "reed-solomon" ? "reed-solomon" : "raptorq";
       this.sourceSymbols = requirePositiveInteger(fec.sourceSymbols, "fec.sourceSymbols");
+      this.repairSymbols = requirePositiveInteger(fec.repairSymbols, "fec.repairSymbols");
       this.symbolSize = requirePositiveInteger(fec.symbolSize, "fec.symbolSize");
       const interleaveDepthMs = requireNumber(fec.interleaveDepthMs, "fec.interleaveDepthMs");
       const reorderToleranceMs = requireNumber(fec.reorderToleranceMs, "fec.reorderToleranceMs");
@@ -8280,6 +8390,18 @@ var BlockcastMmt = (() => {
         fecBlockBudgetMs(interleaveDepthMs, reorderToleranceMs),
         interleaveDepthMs
       );
+      __privateSet(this, _heldLayers, new HeldLayerAdmission(
+        config.repairLayers ?? [
+          {
+            layer: 0,
+            repairTrackName: typeof fec.repairTrack === "string" ? fec.repairTrack : "",
+            rsIdOffset: 0,
+            repairSymbols: this.repairSymbols
+          }
+        ],
+        config.heldLayers
+      ));
+      __privateSet(this, _anchorHorizon, heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols));
       if (typeof config.Decoder !== "function") {
         throw new Error("MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required");
       }
@@ -8302,7 +8424,8 @@ var BlockcastMmt = (() => {
         dropped: { ...__privateGet(this, _stats3).dropped },
         sourceSymbolsByPath: { ...__privateGet(this, _stats3).sourceSymbolsByPath },
         repairSymbolsByPath: { ...__privateGet(this, _stats3).repairSymbolsByPath },
-        mixedPath: { ...__privateGet(this, _stats3).mixedPath }
+        mixedPath: { ...__privateGet(this, _stats3).mixedPath },
+        failClosed: __privateGet(this, _stats3).failClosed && { ...__privateGet(this, _stats3).failClosed }
       };
     }
     /**
@@ -8327,6 +8450,7 @@ var BlockcastMmt = (() => {
       __privateGet(this, _stats3).sourceSymbols++;
       __privateGet(this, _stats3).sourceSymbolsByPath[path]++;
       __privateMethod(this, _MmtpFecSession_instances, noteNewest_fn).call(this, ssId);
+      if (__privateGet(this, _newestSource) === void 0 || serial32Precedes(__privateGet(this, _newestSource), ssId)) __privateSet(this, _newestSource, ssId);
       const start = __privateMethod(this, _MmtpFecSession_instances, blockStartOf_fn).call(this, ssId);
       const block = start === void 0 ? void 0 : __privateGet(this, _blocks).get(start);
       if (block) {
@@ -8355,14 +8479,17 @@ var BlockcastMmt = (() => {
      * Feeds one object of the repair track: a whole MMTP repair packet (ISO/IEC
      * 23008-1 C.5.3). A repair track carries one repair flow, so the first
      * repair packet fixes its packet ID and a packet of any other is refused.
-     * `path` is where it was received, as for addSource().
+     * `path` is where it was received, as for addSource(). `repairTrackName`
+     * is the repair track it was received on, for the 6.3.9 own-track rule; a
+     * track the layers do not list is refused as `repair:unlisted-track`.
      *
      * @returns the protected packets this repair symbol recovered, as for
      *   addSource().
      */
-    addRepair(packet, path = "moq") {
+    addRepair(packet, path = "moq", repairTrackName) {
       const decoder = __privateGet(this, _decoder);
       if (!decoder) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:released");
+      if (__privateGet(this, _stats3).failClosed) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:fail-closed");
       const pathBit = PATH_BITS[path];
       if (!pathBit) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:unknown-path");
       let header;
@@ -8383,6 +8510,18 @@ var BlockcastMmt = (() => {
       if (this.algorithm === "reed-solomon" && frame.ssbLength + frame.rsbLength > 255) {
         return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:rs-block-length");
       }
+      const verdict = __privateGet(this, _heldLayers).admit(
+        repairTrackName,
+        frame.ssStart,
+        frame.rsbLength,
+        __privateGet(this, _anchorHorizon),
+        __privateGet(this, _newestSource)
+      );
+      if (verdict === "discard") return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:unlisted-track");
+      if (verdict !== void 0) {
+        __privateGet(this, _stats3).failClosed = verdict;
+        return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:fail-closed");
+      }
       const start = frame.ssStart;
       let block = __privateGet(this, _blocks).get(start);
       if (block && block.ssbLength !== frame.ssbLength) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:conflicting-ssb-length");
@@ -8439,6 +8578,9 @@ var BlockcastMmt = (() => {
   _newest = new WeakMap();
   _prunedAt = new WeakMap();
   _repairPacketId = new WeakMap();
+  _newestSource = new WeakMap();
+  _heldLayers = new WeakMap();
+  _anchorHorizon = new WeakMap();
   _stats3 = new WeakMap();
   _MmtpFecSession_instances = new WeakSet();
   drop_fn2 = function(reason) {
@@ -9297,6 +9439,9 @@ var BlockcastMmt = (() => {
   _audioSampleCount = new WeakMap();
   _aacFrameSamples = new WeakMap();
 
+  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/crypto.js
+  var crypto = typeof globalThis === "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+
   // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/utils.js
   function isBytes(a) {
     return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
@@ -9324,32 +9469,63 @@ var BlockcastMmt = (() => {
       throw new Error("digestInto() expects output buffer of length at least " + min);
     }
   }
-  function u8(arr) {
-    return new Uint8Array(arr.buffer, arr.byteOffset, arr.byteLength);
-  }
-  function u322(arr) {
-    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
-  }
   function clean(...arrays) {
     for (let i = 0; i < arrays.length; i++) {
       arrays[i].fill(0);
     }
   }
+  function createView(arr) {
+    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+  }
   function rotr(word, shift) {
     return word << 32 - shift | word >>> shift;
   }
-  var isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([287454020]).buffer)[0] === 68)();
-  function byteSwap(word) {
-    return word << 24 & 4278190080 | word << 8 & 16711680 | word >>> 8 & 65280 | word >>> 24 & 255;
-  }
-  var swap8IfBE = isLE ? (n) => n : (n) => byteSwap(n);
-  function byteSwap32(arr) {
-    for (let i = 0; i < arr.length; i++) {
-      arr[i] = byteSwap(arr[i]);
-    }
-    return arr;
+  var hasHexBuiltin = /* @__PURE__ */ (() => (
+    // @ts-ignore
+    typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+  ))();
+  var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+  function bytesToHex(bytes) {
+    abytes(bytes);
+    if (hasHexBuiltin)
+      return bytes.toHex();
+    let hex2 = "";
+    for (let i = 0; i < bytes.length; i++) {
+      hex2 += hexes[bytes[i]];
+    }
+    return hex2;
+  }
+  var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+  function asciiToBase16(ch) {
+    if (ch >= asciis._0 && ch <= asciis._9)
+      return ch - asciis._0;
+    if (ch >= asciis.A && ch <= asciis.F)
+      return ch - (asciis.A - 10);
+    if (ch >= asciis.a && ch <= asciis.f)
+      return ch - (asciis.a - 10);
+    return;
+  }
+  function hexToBytes(hex2) {
+    if (typeof hex2 !== "string")
+      throw new Error("hex string expected, got " + typeof hex2);
+    if (hasHexBuiltin)
+      return Uint8Array.fromHex(hex2);
+    const hl = hex2.length;
+    const al = hl / 2;
+    if (hl % 2)
+      throw new Error("hex string expected, got unpadded hex of length " + hl);
+    const array = new Uint8Array(al);
+    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+      const n1 = asciiToBase16(hex2.charCodeAt(hi));
+      const n2 = asciiToBase16(hex2.charCodeAt(hi + 1));
+      if (n1 === void 0 || n2 === void 0) {
+        const char = hex2[hi] + hex2[hi + 1];
+        throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+      }
+      array[ai] = n1 * 16 + n2;
+    }
+    return array;
   }
-  var swap32IfBE = isLE ? (u) => u : byteSwap32;
   function utf8ToBytes(str) {
     if (typeof str !== "string")
       throw new Error("string expected");
@@ -9361,114 +9537,126 @@ var BlockcastMmt = (() => {
     abytes(data);
     return data;
   }
+  function concatBytes(...arrays) {
+    let sum = 0;
+    for (let i = 0; i < arrays.length; i++) {
+      const a = arrays[i];
+      abytes(a);
+      sum += a.length;
+    }
+    const res = new Uint8Array(sum);
+    for (let i = 0, pad = 0; i < arrays.length; i++) {
+      const a = arrays[i];
+      res.set(a, pad);
+      pad += a.length;
+    }
+    return res;
+  }
   var Hash = class {
   };
-  function createXOFer(hashCons) {
-    const hashC = (msg, opts) => hashCons(opts).update(toBytes(msg)).digest();
-    const tmp = hashCons({});
+  function createHasher(hashCons) {
+    const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+    const tmp = hashCons();
     hashC.outputLen = tmp.outputLen;
     hashC.blockLen = tmp.blockLen;
-    hashC.create = (opts) => hashCons(opts);
+    hashC.create = () => hashCons();
     return hashC;
   }
-
-  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_md.js
-  var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
-    1779033703,
-    3144134277,
-    1013904242,
-    2773480762,
-    1359893119,
-    2600822924,
-    528734635,
-    1541459225
-  ]);
-
-  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_u64.js
-  var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-  var _32n = /* @__PURE__ */ BigInt(32);
-  function fromBig(n, le = false) {
-    if (le)
-      return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
-    return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-  }
-
-  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_blake.js
-  function G1s(a, b, c, d, x) {
-    a = a + b + x | 0;
-    d = rotr(d ^ a, 16);
-    c = c + d | 0;
-    b = rotr(b ^ c, 12);
-    return { a, b, c, d };
-  }
-  function G2s(a, b, c, d, x) {
-    a = a + b + x | 0;
-    d = rotr(d ^ a, 8);
-    c = c + d | 0;
-    b = rotr(b ^ c, 7);
-    return { a, b, c, d };
+  function randomBytes(bytesLength = 32) {
+    if (crypto && typeof crypto.getRandomValues === "function") {
+      return crypto.getRandomValues(new Uint8Array(bytesLength));
+    }
+    if (crypto && typeof crypto.randomBytes === "function") {
+      return Uint8Array.from(crypto.randomBytes(bytesLength));
+    }
+    throw new Error("crypto.getRandomValues must be defined");
   }
 
-  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/blake2.js
-  var BLAKE2 = class extends Hash {
-    constructor(blockLen, outputLen) {
+  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_md.js
+  function setBigUint64(view2, byteOffset, value, isLE) {
+    if (typeof view2.setBigUint64 === "function")
+      return view2.setBigUint64(byteOffset, value, isLE);
+    const _32n2 = BigInt(32);
+    const _u32_max = BigInt(4294967295);
+    const wh = Number(value >> _32n2 & _u32_max);
+    const wl = Number(value & _u32_max);
+    const h = isLE ? 4 : 0;
+    const l = isLE ? 0 : 4;
+    view2.setUint32(byteOffset + h, wh, isLE);
+    view2.setUint32(byteOffset + l, wl, isLE);
+  }
+  function Chi(a, b, c) {
+    return a & b ^ ~a & c;
+  }
+  function Maj(a, b, c) {
+    return a & b ^ a & c ^ b & c;
+  }
+  var HashMD = class extends Hash {
+    constructor(blockLen, outputLen, padOffset, isLE) {
       super();
       this.finished = false;
-      this.destroyed = false;
       this.length = 0;
       this.pos = 0;
-      anumber(blockLen);
-      anumber(outputLen);
+      this.destroyed = false;
       this.blockLen = blockLen;
       this.outputLen = outputLen;
+      this.padOffset = padOffset;
+      this.isLE = isLE;
       this.buffer = new Uint8Array(blockLen);
-      this.buffer32 = u322(this.buffer);
+      this.view = createView(this.buffer);
     }
     update(data) {
       aexists(this);
       data = toBytes(data);
       abytes(data);
-      const { blockLen, buffer, buffer32 } = this;
+      const { view: view2, buffer, blockLen } = this;
       const len = data.length;
-      const offset = data.byteOffset;
-      const buf = data.buffer;
       for (let pos = 0; pos < len; ) {
-        if (this.pos === blockLen) {
-          swap32IfBE(buffer32);
-          this.compress(buffer32, 0, false);
-          swap32IfBE(buffer32);
-          this.pos = 0;
-        }
         const take = Math.min(blockLen - this.pos, len - pos);
-        const dataOffset = offset + pos;
-        if (take === blockLen && !(dataOffset % 4) && pos + take < len) {
-          const data32 = new Uint32Array(buf, dataOffset, Math.floor((len - pos) / 4));
-          swap32IfBE(data32);
-          for (let pos32 = 0; pos + blockLen < len; pos32 += buffer32.length, pos += blockLen) {
-            this.length += blockLen;
-            this.compress(data32, pos32, false);
-          }
-          swap32IfBE(data32);
+        if (take === blockLen) {
+          const dataView = createView(data);
+          for (; blockLen <= len - pos; pos += blockLen)
+            this.process(dataView, pos);
           continue;
         }
         buffer.set(data.subarray(pos, pos + take), this.pos);
         this.pos += take;
-        this.length += take;
         pos += take;
+        if (this.pos === blockLen) {
+          this.process(view2, 0);
+          this.pos = 0;
+        }
       }
+      this.length += data.length;
+      this.roundClean();
       return this;
     }
     digestInto(out) {
       aexists(this);
       aoutput(out, this);
-      const { pos, buffer32 } = this;
       this.finished = true;
+      const { buffer, view: view2, blockLen, isLE } = this;
+      let { pos } = this;
+      buffer[pos++] = 128;
       clean(this.buffer.subarray(pos));
-      swap32IfBE(buffer32);
-      this.compress(buffer32, 0, true);
-      swap32IfBE(buffer32);
-      const out32 = u322(out);
-      this.get().forEach((v, i) => out32[i] = swap8IfBE(v));
+      if (this.padOffset > blockLen - pos) {
+        this.process(view2, 0);
+        pos = 0;
+      }
+      for (let i = pos; i < blockLen; i++)
+        buffer[i] = 0;
+      setBigUint64(view2, blockLen - 8, BigInt(this.length * 8), isLE);
+      this.process(view2, 0);
+      const oview = createView(out);
+      const len = this.outputLen;
+      if (len % 4)
+        throw new Error("_sha2: outputLen should be aligned to 32bit");
+      const outLen = len / 4;
+      const state = this.get();
+      if (outLen > state.length)
+        throw new Error("_sha2: outputLen bigger than state");
+      for (let i = 0; i < outLen; i++)
+        oview.setUint32(4 * i, state[i], isLE);
     }
     digest() {
       const { buffer, outputLen } = this;
@@ -9478,1012 +9666,2513 @@ var BlockcastMmt = (() => {
       return res;
     }
     _cloneInto(to) {
-      const { buffer, length, finished, destroyed, outputLen, pos } = this;
-      to || (to = new this.constructor({ dkLen: outputLen }));
+      to || (to = new this.constructor());
       to.set(...this.get());
-      to.buffer.set(buffer);
+      const { blockLen, buffer, length, finished, destroyed, pos } = this;
       to.destroyed = destroyed;
       to.finished = finished;
       to.length = length;
       to.pos = pos;
-      to.outputLen = outputLen;
+      if (length % blockLen)
+        to.buffer.set(buffer);
       return to;
     }
     clone() {
       return this._cloneInto();
     }
   };
-  function compress(s, offset, msg, rounds, v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15) {
-    let j = 0;
-    for (let i = 0; i < rounds; i++) {
-      ({ a: v0, b: v4, c: v8, d: v12 } = G1s(v0, v4, v8, v12, msg[offset + s[j++]]));
-      ({ a: v0, b: v4, c: v8, d: v12 } = G2s(v0, v4, v8, v12, msg[offset + s[j++]]));
-      ({ a: v1, b: v5, c: v9, d: v13 } = G1s(v1, v5, v9, v13, msg[offset + s[j++]]));
-      ({ a: v1, b: v5, c: v9, d: v13 } = G2s(v1, v5, v9, v13, msg[offset + s[j++]]));
-      ({ a: v2, b: v6, c: v10, d: v14 } = G1s(v2, v6, v10, v14, msg[offset + s[j++]]));
-      ({ a: v2, b: v6, c: v10, d: v14 } = G2s(v2, v6, v10, v14, msg[offset + s[j++]]));
-      ({ a: v3, b: v7, c: v11, d: v15 } = G1s(v3, v7, v11, v15, msg[offset + s[j++]]));
-      ({ a: v3, b: v7, c: v11, d: v15 } = G2s(v3, v7, v11, v15, msg[offset + s[j++]]));
-      ({ a: v0, b: v5, c: v10, d: v15 } = G1s(v0, v5, v10, v15, msg[offset + s[j++]]));
-      ({ a: v0, b: v5, c: v10, d: v15 } = G2s(v0, v5, v10, v15, msg[offset + s[j++]]));
-      ({ a: v1, b: v6, c: v11, d: v12 } = G1s(v1, v6, v11, v12, msg[offset + s[j++]]));
-      ({ a: v1, b: v6, c: v11, d: v12 } = G2s(v1, v6, v11, v12, msg[offset + s[j++]]));
-      ({ a: v2, b: v7, c: v8, d: v13 } = G1s(v2, v7, v8, v13, msg[offset + s[j++]]));
-      ({ a: v2, b: v7, c: v8, d: v13 } = G2s(v2, v7, v8, v13, msg[offset + s[j++]]));
-      ({ a: v3, b: v4, c: v9, d: v14 } = G1s(v3, v4, v9, v14, msg[offset + s[j++]]));
-      ({ a: v3, b: v4, c: v9, d: v14 } = G2s(v3, v4, v9, v14, msg[offset + s[j++]]));
-    }
-    return { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 };
+  var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+    1779033703,
+    4089235720,
+    3144134277,
+    2227873595,
+    1013904242,
+    4271175723,
+    2773480762,
+    1595750129,
+    1359893119,
+    2917565137,
+    2600822924,
+    725511199,
+    528734635,
+    4215389547,
+    1541459225,
+    327033209
+  ]);
+
+  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_u64.js
+  var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+  var _32n = /* @__PURE__ */ BigInt(32);
+  function fromBig(n, le = false) {
+    if (le)
+      return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+    return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
   }
+  function split(lst, le = false) {
+    const len = lst.length;
+    let Ah = new Uint32Array(len);
+    let Al = new Uint32Array(len);
+    for (let i = 0; i < len; i++) {
+      const { h, l } = fromBig(lst[i], le);
+      [Ah[i], Al[i]] = [h, l];
+    }
+    return [Ah, Al];
+  }
+  var shrSH = (h, _l, s) => h >>> s;
+  var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+  var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+  var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+  var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+  var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+  function add(Ah, Al, Bh, Bl) {
+    const l = (Al >>> 0) + (Bl >>> 0);
+    return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+  }
+  var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+  var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+  var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+  var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+  var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+  var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
 
-  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/blake3.js
-  var B3_Flags = {
-    CHUNK_START: 1,
-    CHUNK_END: 2,
-    PARENT: 4,
-    ROOT: 8,
-    KEYED_HASH: 16,
-    DERIVE_KEY_CONTEXT: 32,
-    DERIVE_KEY_MATERIAL: 64
-  };
-  var B3_IV = SHA256_IV.slice();
-  var B3_SIGMA = /* @__PURE__ */ (() => {
-    const Id = Array.from({ length: 16 }, (_, i) => i);
-    const permute = (arr) => [2, 6, 3, 10, 7, 0, 4, 13, 1, 11, 12, 5, 9, 14, 15, 8].map((i) => arr[i]);
-    const res = [];
-    for (let i = 0, v = Id; i < 7; i++, v = permute(v))
-      res.push(...v);
-    return Uint8Array.from(res);
-  })();
-  var BLAKE3 = class _BLAKE3 extends BLAKE2 {
-    constructor(opts = {}, flags = 0) {
-      super(64, opts.dkLen === void 0 ? 32 : opts.dkLen);
-      this.chunkPos = 0;
-      this.chunksDone = 0;
-      this.flags = 0 | 0;
-      this.stack = [];
-      this.posOut = 0;
-      this.bufferOut32 = new Uint32Array(16);
-      this.chunkOut = 0;
-      this.enableXOF = true;
-      const { key, context } = opts;
-      const hasContext = context !== void 0;
-      if (key !== void 0) {
-        if (hasContext)
-          throw new Error('Only "key" or "context" can be specified at same time');
-        const k = toBytes(key).slice();
-        abytes(k, 32);
-        this.IV = u322(k);
-        swap32IfBE(this.IV);
-        this.flags = flags | B3_Flags.KEYED_HASH;
-      } else if (hasContext) {
-        const ctx = toBytes(context);
-        const contextKey = new _BLAKE3({ dkLen: 32 }, B3_Flags.DERIVE_KEY_CONTEXT).update(ctx).digest();
-        this.IV = u322(contextKey);
-        swap32IfBE(this.IV);
-        this.flags = flags | B3_Flags.DERIVE_KEY_MATERIAL;
-      } else {
-        this.IV = B3_IV.slice();
-        this.flags = flags;
-      }
-      this.state = this.IV.slice();
-      this.bufferOut = u8(this.bufferOut32);
+  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/sha2.js
+  var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+    1116352408,
+    1899447441,
+    3049323471,
+    3921009573,
+    961987163,
+    1508970993,
+    2453635748,
+    2870763221,
+    3624381080,
+    310598401,
+    607225278,
+    1426881987,
+    1925078388,
+    2162078206,
+    2614888103,
+    3248222580,
+    3835390401,
+    4022224774,
+    264347078,
+    604807628,
+    770255983,
+    1249150122,
+    1555081692,
+    1996064986,
+    2554220882,
+    2821834349,
+    2952996808,
+    3210313671,
+    3336571891,
+    3584528711,
+    113926993,
+    338241895,
+    666307205,
+    773529912,
+    1294757372,
+    1396182291,
+    1695183700,
+    1986661051,
+    2177026350,
+    2456956037,
+    2730485921,
+    2820302411,
+    3259730800,
+    3345764771,
+    3516065817,
+    3600352804,
+    4094571909,
+    275423344,
+    430227734,
+    506948616,
+    659060556,
+    883997877,
+    958139571,
+    1322822218,
+    1537002063,
+    1747873779,
+    1955562222,
+    2024104815,
+    2227730452,
+    2361852424,
+    2428436474,
+    2756734187,
+    3204031479,
+    3329325298
+  ]);
+  var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+  var SHA256 = class extends HashMD {
+    constructor(outputLen = 32) {
+      super(64, outputLen, 8, false);
+      this.A = SHA256_IV[0] | 0;
+      this.B = SHA256_IV[1] | 0;
+      this.C = SHA256_IV[2] | 0;
+      this.D = SHA256_IV[3] | 0;
+      this.E = SHA256_IV[4] | 0;
+      this.F = SHA256_IV[5] | 0;
+      this.G = SHA256_IV[6] | 0;
+      this.H = SHA256_IV[7] | 0;
     }
-    // Unused
     get() {
-      return [];
-    }
-    set() {
-    }
-    b2Compress(counter, flags, buf, bufPos = 0) {
-      const { state: s, pos } = this;
-      const { h, l } = fromBig(BigInt(counter), true);
-      const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = compress(B3_SIGMA, bufPos, buf, 7, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], h, l, pos, flags);
-      s[0] = v0 ^ v8;
-      s[1] = v1 ^ v9;
-      s[2] = v2 ^ v10;
-      s[3] = v3 ^ v11;
-      s[4] = v4 ^ v12;
-      s[5] = v5 ^ v13;
-      s[6] = v6 ^ v14;
-      s[7] = v7 ^ v15;
-    }
-    compress(buf, bufPos = 0, isLast = false) {
-      let flags = this.flags;
-      if (!this.chunkPos)
-        flags |= B3_Flags.CHUNK_START;
-      if (this.chunkPos === 15 || isLast)
-        flags |= B3_Flags.CHUNK_END;
-      if (!isLast)
-        this.pos = this.blockLen;
-      this.b2Compress(this.chunksDone, flags, buf, bufPos);
-      this.chunkPos += 1;
-      if (this.chunkPos === 16 || isLast) {
-        let chunk = this.state;
-        this.state = this.IV.slice();
-        for (let last, chunks = this.chunksDone + 1; isLast || !(chunks & 1); chunks >>= 1) {
-          if (!(last = this.stack.pop()))
-            break;
-          this.buffer32.set(last, 0);
-          this.buffer32.set(chunk, 8);
-          this.pos = this.blockLen;
-          this.b2Compress(0, this.flags | B3_Flags.PARENT, this.buffer32, 0);
-          chunk = this.state;
-          this.state = this.IV.slice();
-        }
-        this.chunksDone++;
-        this.chunkPos = 0;
-        this.stack.push(chunk);
-      }
-      this.pos = 0;
-    }
-    _cloneInto(to) {
-      to = super._cloneInto(to);
-      const { IV, flags, state, chunkPos, posOut, chunkOut, stack, chunksDone } = this;
-      to.state.set(state.slice());
-      to.stack = stack.map((i) => Uint32Array.from(i));
-      to.IV.set(IV);
-      to.flags = flags;
-      to.chunkPos = chunkPos;
-      to.chunksDone = chunksDone;
-      to.posOut = posOut;
-      to.chunkOut = chunkOut;
-      to.enableXOF = this.enableXOF;
-      to.bufferOut32.set(this.bufferOut32);
-      return to;
+      const { A, B, C, D, E, F, G, H } = this;
+      return [A, B, C, D, E, F, G, H];
+    }
+    // prettier-ignore
+    set(A, B, C, D, E, F, G, H) {
+      this.A = A | 0;
+      this.B = B | 0;
+      this.C = C | 0;
+      this.D = D | 0;
+      this.E = E | 0;
+      this.F = F | 0;
+      this.G = G | 0;
+      this.H = H | 0;
+    }
+    process(view2, offset) {
+      for (let i = 0; i < 16; i++, offset += 4)
+        SHA256_W[i] = view2.getUint32(offset, false);
+      for (let i = 16; i < 64; i++) {
+        const W15 = SHA256_W[i - 15];
+        const W2 = SHA256_W[i - 2];
+        const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+        const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+        SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+      }
+      let { A, B, C, D, E, F, G, H } = this;
+      for (let i = 0; i < 64; i++) {
+        const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+        const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+        const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+        const T2 = sigma0 + Maj(A, B, C) | 0;
+        H = G;
+        G = F;
+        F = E;
+        E = D + T1 | 0;
+        D = C;
+        C = B;
+        B = A;
+        A = T1 + T2 | 0;
+      }
+      A = A + this.A | 0;
+      B = B + this.B | 0;
+      C = C + this.C | 0;
+      D = D + this.D | 0;
+      E = E + this.E | 0;
+      F = F + this.F | 0;
+      G = G + this.G | 0;
+      H = H + this.H | 0;
+      this.set(A, B, C, D, E, F, G, H);
+    }
+    roundClean() {
+      clean(SHA256_W);
     }
     destroy() {
-      this.destroyed = true;
-      clean(this.state, this.buffer32, this.IV, this.bufferOut32);
-      clean(...this.stack);
-    }
-    // Same as b2Compress, but doesn't modify state and returns 16 u32 array (instead of 8)
-    b2CompressOut() {
-      const { state: s, pos, flags, buffer32, bufferOut32: out32 } = this;
-      const { h, l } = fromBig(BigInt(this.chunkOut++));
-      swap32IfBE(buffer32);
-      const { v0, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12, v13, v14, v15 } = compress(B3_SIGMA, 0, buffer32, 7, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], B3_IV[0], B3_IV[1], B3_IV[2], B3_IV[3], l, h, pos, flags);
-      out32[0] = v0 ^ v8;
-      out32[1] = v1 ^ v9;
-      out32[2] = v2 ^ v10;
-      out32[3] = v3 ^ v11;
-      out32[4] = v4 ^ v12;
-      out32[5] = v5 ^ v13;
-      out32[6] = v6 ^ v14;
-      out32[7] = v7 ^ v15;
-      out32[8] = s[0] ^ v8;
-      out32[9] = s[1] ^ v9;
-      out32[10] = s[2] ^ v10;
-      out32[11] = s[3] ^ v11;
-      out32[12] = s[4] ^ v12;
-      out32[13] = s[5] ^ v13;
-      out32[14] = s[6] ^ v14;
-      out32[15] = s[7] ^ v15;
-      swap32IfBE(buffer32);
-      swap32IfBE(out32);
-      this.posOut = 0;
-    }
-    finish() {
-      if (this.finished)
-        return;
-      this.finished = true;
-      clean(this.buffer.subarray(this.pos));
-      let flags = this.flags | B3_Flags.ROOT;
-      if (this.stack.length) {
-        flags |= B3_Flags.PARENT;
-        swap32IfBE(this.buffer32);
-        this.compress(this.buffer32, 0, true);
-        swap32IfBE(this.buffer32);
-        this.chunksDone = 0;
-        this.pos = this.blockLen;
-      } else {
-        flags |= (!this.chunkPos ? B3_Flags.CHUNK_START : 0) | B3_Flags.CHUNK_END;
-      }
-      this.flags = flags;
-      this.b2CompressOut();
-    }
-    writeInto(out) {
-      aexists(this, false);
-      abytes(out);
-      this.finish();
-      const { blockLen, bufferOut } = this;
-      for (let pos = 0, len = out.length; pos < len; ) {
-        if (this.posOut >= blockLen)
-          this.b2CompressOut();
-        const take = Math.min(blockLen - this.posOut, len - pos);
-        out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
-        this.posOut += take;
-        pos += take;
-      }
-      return out;
-    }
-    xofInto(out) {
-      if (!this.enableXOF)
-        throw new Error("XOF is not possible after digest call");
-      return this.writeInto(out);
+      this.set(0, 0, 0, 0, 0, 0, 0, 0);
+      clean(this.buffer);
     }
-    xof(bytes) {
-      anumber(bytes);
-      return this.xofInto(new Uint8Array(bytes));
-    }
-    digestInto(out) {
-      aoutput(out, this);
-      if (this.finished)
-        throw new Error("digest() was already called");
-      this.enableXOF = false;
-      this.writeInto(out);
-      this.destroy();
-      return out;
+  };
+  var K512 = /* @__PURE__ */ (() => split([
+    "0x428a2f98d728ae22",
+    "0x7137449123ef65cd",
+    "0xb5c0fbcfec4d3b2f",
+    "0xe9b5dba58189dbbc",
+    "0x3956c25bf348b538",
+    "0x59f111f1b605d019",
+    "0x923f82a4af194f9b",
+    "0xab1c5ed5da6d8118",
+    "0xd807aa98a3030242",
+    "0x12835b0145706fbe",
+    "0x243185be4ee4b28c",
+    "0x550c7dc3d5ffb4e2",
+    "0x72be5d74f27b896f",
+    "0x80deb1fe3b1696b1",
+    "0x9bdc06a725c71235",
+    "0xc19bf174cf692694",
+    "0xe49b69c19ef14ad2",
+    "0xefbe4786384f25e3",
+    "0x0fc19dc68b8cd5b5",
+    "0x240ca1cc77ac9c65",
+    "0x2de92c6f592b0275",
+    "0x4a7484aa6ea6e483",
+    "0x5cb0a9dcbd41fbd4",
+    "0x76f988da831153b5",
+    "0x983e5152ee66dfab",
+    "0xa831c66d2db43210",
+    "0xb00327c898fb213f",
+    "0xbf597fc7beef0ee4",
+    "0xc6e00bf33da88fc2",
+    "0xd5a79147930aa725",
+    "0x06ca6351e003826f",
+    "0x142929670a0e6e70",
+    "0x27b70a8546d22ffc",
+    "0x2e1b21385c26c926",
+    "0x4d2c6dfc5ac42aed",
+    "0x53380d139d95b3df",
+    "0x650a73548baf63de",
+    "0x766a0abb3c77b2a8",
+    "0x81c2c92e47edaee6",
+    "0x92722c851482353b",
+    "0xa2bfe8a14cf10364",
+    "0xa81a664bbc423001",
+    "0xc24b8b70d0f89791",
+    "0xc76c51a30654be30",
+    "0xd192e819d6ef5218",
+    "0xd69906245565a910",
+    "0xf40e35855771202a",
+    "0x106aa07032bbd1b8",
+    "0x19a4c116b8d2d0c8",
+    "0x1e376c085141ab53",
+    "0x2748774cdf8eeb99",
+    "0x34b0bcb5e19b48a8",
+    "0x391c0cb3c5c95a63",
+    "0x4ed8aa4ae3418acb",
+    "0x5b9cca4f7763e373",
+    "0x682e6ff3d6b2b8a3",
+    "0x748f82ee5defb2fc",
+    "0x78a5636f43172f60",
+    "0x84c87814a1f0ab72",
+    "0x8cc702081a6439ec",
+    "0x90befffa23631e28",
+    "0xa4506cebde82bde9",
+    "0xbef9a3f7b2c67915",
+    "0xc67178f2e372532b",
+    "0xca273eceea26619c",
+    "0xd186b8c721c0c207",
+    "0xeada7dd6cde0eb1e",
+    "0xf57d4f7fee6ed178",
+    "0x06f067aa72176fba",
+    "0x0a637dc5a2c898a6",
+    "0x113f9804bef90dae",
+    "0x1b710b35131c471b",
+    "0x28db77f523047d84",
+    "0x32caab7b40c72493",
+    "0x3c9ebe0a15c9bebc",
+    "0x431d67c49c100d4c",
+    "0x4cc5d4becb3e42b6",
+    "0x597f299cfc657e2a",
+    "0x5fcb6fab3ad6faec",
+    "0x6c44198c4a475817"
+  ].map((n) => BigInt(n))))();
+  var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+  var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+  var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+  var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+  var SHA512 = class extends HashMD {
+    constructor(outputLen = 64) {
+      super(128, outputLen, 16, false);
+      this.Ah = SHA512_IV[0] | 0;
+      this.Al = SHA512_IV[1] | 0;
+      this.Bh = SHA512_IV[2] | 0;
+      this.Bl = SHA512_IV[3] | 0;
+      this.Ch = SHA512_IV[4] | 0;
+      this.Cl = SHA512_IV[5] | 0;
+      this.Dh = SHA512_IV[6] | 0;
+      this.Dl = SHA512_IV[7] | 0;
+      this.Eh = SHA512_IV[8] | 0;
+      this.El = SHA512_IV[9] | 0;
+      this.Fh = SHA512_IV[10] | 0;
+      this.Fl = SHA512_IV[11] | 0;
+      this.Gh = SHA512_IV[12] | 0;
+      this.Gl = SHA512_IV[13] | 0;
+      this.Hh = SHA512_IV[14] | 0;
+      this.Hl = SHA512_IV[15] | 0;
+    }
+    // prettier-ignore
+    get() {
+      const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+      return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
+    }
+    // prettier-ignore
+    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+      this.Ah = Ah | 0;
+      this.Al = Al | 0;
+      this.Bh = Bh | 0;
+      this.Bl = Bl | 0;
+      this.Ch = Ch | 0;
+      this.Cl = Cl | 0;
+      this.Dh = Dh | 0;
+      this.Dl = Dl | 0;
+      this.Eh = Eh | 0;
+      this.El = El | 0;
+      this.Fh = Fh | 0;
+      this.Fl = Fl | 0;
+      this.Gh = Gh | 0;
+      this.Gl = Gl | 0;
+      this.Hh = Hh | 0;
+      this.Hl = Hl | 0;
+    }
+    process(view2, offset) {
+      for (let i = 0; i < 16; i++, offset += 4) {
+        SHA512_W_H[i] = view2.getUint32(offset);
+        SHA512_W_L[i] = view2.getUint32(offset += 4);
+      }
+      for (let i = 16; i < 80; i++) {
+        const W15h = SHA512_W_H[i - 15] | 0;
+        const W15l = SHA512_W_L[i - 15] | 0;
+        const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+        const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+        const W2h = SHA512_W_H[i - 2] | 0;
+        const W2l = SHA512_W_L[i - 2] | 0;
+        const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+        const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+        const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+        const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
+        SHA512_W_H[i] = SUMh | 0;
+        SHA512_W_L[i] = SUMl | 0;
+      }
+      let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+      for (let i = 0; i < 80; i++) {
+        const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+        const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+        const CHIh = Eh & Fh ^ ~Eh & Gh;
+        const CHIl = El & Fl ^ ~El & Gl;
+        const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+        const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+        const T1l = T1ll | 0;
+        const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+        const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+        const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+        const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+        Hh = Gh | 0;
+        Hl = Gl | 0;
+        Gh = Fh | 0;
+        Gl = Fl | 0;
+        Fh = Eh | 0;
+        Fl = El | 0;
+        ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+        Dh = Ch | 0;
+        Dl = Cl | 0;
+        Ch = Bh | 0;
+        Cl = Bl | 0;
+        Bh = Ah | 0;
+        Bl = Al | 0;
+        const All = add3L(T1l, sigma0l, MAJl);
+        Ah = add3H(All, T1h, sigma0h, MAJh);
+        Al = All | 0;
+      }
+      ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+      ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+      ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+      ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+      ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+      ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+      ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+      ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+      this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+    }
+    roundClean() {
+      clean(SHA512_W_H, SHA512_W_L);
     }
-    digest() {
-      return this.digestInto(new Uint8Array(this.outputLen));
+    destroy() {
+      clean(this.buffer);
+      this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
     }
   };
-  var blake3 = /* @__PURE__ */ createXOFer((opts) => new BLAKE3(opts));
+  var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+  var sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
 
-  // ../mmt-manifest-verify/dist/source-auth.js
-  var SOURCE_AUTH_MANIFEST_VERSION = 1;
-  var SOURCE_AUTH_OBJECT_ENTRY_FRAME = 1;
-  var SOURCE_AUTH_GROUP_CLOSE_FRAME = 2;
-  var SOURCE_AUTH_OBJECT_ENTRY_LENGTH = 52;
-  var SOURCE_AUTH_GROUP_CLOSE_LENGTH = 112;
-  var SOURCE_AUTH_MAX_OBJECTS_PER_GROUP = 4096;
-  var SOURCE_AUTH_MAX_TRUE_LENGTH = 16 * 1024 * 1024;
-  var SOURCE_AUTH_SCOPE_LENGTH = 32;
-  var SIGNATURE_DOMAIN = new TextEncoder().encode("blockcast-mmt-root-v1\0\0\0");
-  function requireBytes(name, value, length) {
-    if (value.byteLength !== length) {
-      throw new Error(`${name} must be ${length} bytes, got ${value.byteLength}`);
-    }
-  }
-  function requireU32(name, value) {
-    if (!Number.isInteger(value) || value < 0 || value > 4294967295) {
-      throw new Error(`${name} must be an unsigned 32-bit integer`);
-    }
-  }
-  function requireU64(name, value) {
-    if (value < 0n || value > 0xffffffffffffffffn) {
-      throw new Error(`${name} must be an unsigned 64-bit integer`);
-    }
-  }
-  function requireTrueLength(value) {
-    requireU32("trueLength", value);
-    if (value > SOURCE_AUTH_MAX_TRUE_LENGTH) {
-      throw new Error(`trueLength exceeds the ${SOURCE_AUTH_MAX_TRUE_LENGTH}-byte profile maximum`);
-    }
-  }
-  function sourceAuthObjectDigest(object) {
-    return blake3(object);
-  }
-  function sourceAuthLeafHash(groupId, objectId, digest, trueLength) {
-    requireU64("groupId", groupId);
-    requireU32("objectId", objectId);
-    requireBytes("digest", digest, 32);
-    requireTrueLength(trueLength);
-    const preimage = new Uint8Array(49);
-    const view2 = new DataView(preimage.buffer);
-    view2.setBigUint64(1, groupId);
-    view2.setUint32(9, objectId);
-    preimage.set(digest, 13);
-    view2.setUint32(45, trueLength);
-    return blake3(preimage);
-  }
-  function sourceAuthMerkleRoot(entries) {
-    if (entries.length === 0)
-      throw new Error("Merkle tree requires at least one object");
-    if (entries.length > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
-      throw new Error(`group exceeds ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP} objects`);
-    }
-    const groupId = entries[0].groupId;
-    const objectIds = /* @__PURE__ */ new Set();
-    const ordered = [...entries].sort((left, right) => left.objectId - right.objectId);
-    let level = ordered.map((entry) => {
-      if (entry.groupId !== groupId)
-        throw new Error("Merkle entries must belong to one group");
-      if (objectIds.has(entry.objectId))
-        throw new Error(`duplicate objectId ${entry.objectId}`);
-      objectIds.add(entry.objectId);
-      return sourceAuthLeafHash(entry.groupId, entry.objectId, entry.digest, entry.trueLength);
-    });
-    while (level.length > 1) {
-      const parents = [];
-      for (let index = 0; index < level.length; index += 2) {
-        const left = level[index];
-        const right = level[index + 1] ?? left;
-        const preimage = new Uint8Array(65);
-        preimage[0] = 1;
-        preimage.set(left, 1);
-        preimage.set(right, 33);
-        parents.push(blake3(preimage));
-      }
-      level = parents;
-    }
-    return level[0];
-  }
-  function sourceAuthSignaturePreimage(authScope, groupId, objectCount, root) {
-    requireU32("objectCount", objectCount);
-    if (objectCount === 0 || objectCount > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
-      throw new Error(`objectCount must be between 1 and ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP}`);
-    }
-    requireU64("groupId", groupId);
-    requireBytes("authScope", authScope, SOURCE_AUTH_SCOPE_LENGTH);
-    requireBytes("root", root, 32);
-    const preimage = new Uint8Array(100);
-    const view2 = new DataView(preimage.buffer);
-    preimage.set(SIGNATURE_DOMAIN);
-    preimage.set(authScope, 24);
-    view2.setBigUint64(56, groupId);
-    view2.setUint32(64, objectCount);
-    preimage.set(root, 68);
-    return preimage;
-  }
-  function decodeSourceAuthManifestFrame(frame) {
-    const frameType = frame[0];
-    const expectedLength = frameType === SOURCE_AUTH_OBJECT_ENTRY_FRAME ? SOURCE_AUTH_OBJECT_ENTRY_LENGTH : frameType === SOURCE_AUTH_GROUP_CLOSE_FRAME ? SOURCE_AUTH_GROUP_CLOSE_LENGTH : 0;
-    if (expectedLength === 0)
-      throw new Error(`unsupported manifest frame type ${frameType}`);
-    if (frame.byteLength !== expectedLength) {
-      throw new Error(`manifest frame has invalid length ${frame.byteLength} for type ${frameType}`);
-    }
-    if (frame[1] !== SOURCE_AUTH_MANIFEST_VERSION) {
-      throw new Error(`unsupported manifest version ${frame[1]}`);
-    }
-    if (frame[2] !== 0 || frame[3] !== 0)
-      throw new Error("manifest reserved bits must be zero");
-    const view2 = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
-    const groupId = view2.getBigUint64(4);
-    if (frameType === SOURCE_AUTH_OBJECT_ENTRY_FRAME) {
-      const entry = {
-        kind: "object",
-        groupId,
-        objectId: view2.getUint32(12),
-        trueLength: view2.getUint32(16),
-        digest: frame.slice(20, 52)
-      };
-      requireTrueLength(entry.trueLength);
-      return entry;
-    }
-    const close = {
-      kind: "close",
-      groupId,
-      objectCount: view2.getUint32(12),
-      root: frame.slice(16, 48),
-      signature: frame.slice(48, 112)
-    };
-    if (close.objectCount === 0 || close.objectCount > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
-      throw new Error(`objectCount must be between 1 and ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP}`);
-    }
-    return close;
-  }
+  // ../mmt-manifest-verify/node_modules/@noble/hashes/esm/sha256.js
+  var sha2562 = sha256;
 
-  // ../mmt-manifest-verify/dist/verifier.js
-  function manifestKeyFor(keys, epoch, kid) {
-    if (new Set(keys.map((key) => key.kid)).size !== keys.length)
-      return void 0;
-    if (new Set(keys.map((key) => key.firstEpoch)).size !== keys.length)
-      return void 0;
-    let signer;
-    for (const key of keys) {
-      if (key.firstEpoch <= epoch && (signer === void 0 || key.firstEpoch > signer.firstEpoch))
-        signer = key;
-    }
-    if (signer === void 0 || kid !== void 0 && signer.kid !== kid)
-      return void 0;
-    return signer.publicKey;
-  }
-  function manifestBindingId(trackName, sourceSymbolFormat) {
-    return JSON.stringify([trackName, sourceSymbolFormat]);
-  }
-  function createWebCryptoEd25519Verifier(subtle = globalThis.crypto.subtle) {
-    return async (publicKey, message, signature) => {
-      const keyBytes = Uint8Array.from(publicKey);
-      const messageBytes = Uint8Array.from(message);
-      const signatureBytes = Uint8Array.from(signature);
-      const key = await subtle.importKey("raw", keyBytes.buffer, "Ed25519", false, ["verify"]);
-      return subtle.verify("Ed25519", key, signatureBytes.buffer, messageBytes.buffer);
-    };
-  }
-  var FAILURE_REASONS = [
-    "sigInvalid",
-    "digestMismatch",
-    "manifestLate",
-    "manifestAbsent",
-    "verifierError"
-  ];
-  var equalBytes = (left, right) => {
+  // ../mmt-manifest-verify/dist/bc-provenance-v2.js
+  var BCPV2_HEADER_LENGTH = 68;
+  var BCPV2_SIGNATURE_LENGTH = 64;
+  var BCPV2_MIN_RECORD_LENGTH = BCPV2_HEADER_LENGTH + 32 + BCPV2_SIGNATURE_LENGTH;
+  var BCPV2_MAX_RECORD_LENGTH = 1316;
+  var BCPV2_MAX_DIGESTS = 37;
+  var BCPV2_HASH_ALG_SHA256 = 1;
+  var text = new TextEncoder();
+  var MAGIC = Uint8Array.from([77, 72, 77, 50]);
+  var SIGNING_DOMAIN = text.encode("mcast-manifest-v2\0");
+  function equalBytes(left, right) {
     if (left.byteLength !== right.byteLength)
       return false;
-    let diff = 0;
+    let different = 0;
     for (let index = 0; index < left.byteLength; index++)
-      diff |= left[index] ^ right[index];
-    return diff === 0;
-  };
-  var isPromiseLike = (value) => typeof value === "object" && value !== null && typeof value.then === "function";
-  var _config, _verifySignature, _onFailure, _tracks2, _stats4, _disposed2, _ManifestVerifier_instances, requireTrack_fn, group_fn, validateIdentity_fn, admitAgainstEntry_fn, rejectOrShadow_fn, resolvePending_fn, closeGroup_fn, finishGroupSignature_fn, verifyAcceptedSignature_fn, failGroup_fn, removePending_fn, quarantine_fn, enforceCap_fn, giveUpOnPending_fn, failOpenTrack_fn, failOpenGroup_fn, releaseAllQuarantine_fn, failure_fn;
-  var ManifestVerifier = class {
-    constructor(options) {
-      __privateAdd(this, _ManifestVerifier_instances);
-      __privateAdd(this, _config);
-      __privateAdd(this, _verifySignature);
-      __privateAdd(this, _onFailure);
-      __privateAdd(this, _tracks2, /* @__PURE__ */ new Map());
-      __privateAdd(this, _stats4, {
-        verified: 0,
-        failures: Object.fromEntries(FAILURE_REASONS.map((reason) => [reason, 0])),
-        quarantinedBytes: 0
-      });
-      __privateAdd(this, _disposed2, false);
-      __privateSet(this, _config, { ...options.manifestAuth });
-      __privateSet(this, _verifySignature, options.verifySignature);
-      __privateSet(this, _onFailure, options.onFailure);
+      different |= left[index] ^ right[index];
+    return different === 0;
+  }
+  function u16(value) {
+    const result = new Uint8Array(2);
+    new DataView(result.buffer).setUint16(0, value);
+    return result;
+  }
+  function u322(value) {
+    const result = new Uint8Array(4);
+    new DataView(result.buffer).setUint32(0, value);
+    return result;
+  }
+  function validU32(value) {
+    return Number.isInteger(value) && value >= 0 && value <= 4294967295;
+  }
+  function validPort(value) {
+    return Number.isInteger(value) && value >= 0 && value <= 65535;
+  }
+  function parseIpv4(address) {
+    const fields = address.split(".");
+    if (fields.length !== 4 || fields.some((field) => !/^\d+$/.test(field))) {
+      throw new Error(`invalid IPv4 address ${address}`);
+    }
+    const values = fields.map(Number);
+    if (values.some((value, index) => value > 255 || String(value) !== fields[index])) {
+      throw new Error(`invalid IPv4 address ${address}`);
+    }
+    return Uint8Array.from(values);
+  }
+  function parseIpv6(address) {
+    const compressed = address.includes("::");
+    if ((address.match(/::/g) ?? []).length > 1)
+      throw new Error(`invalid IPv6 address ${address}`);
+    const [leftText, rightText = ""] = address.split("::");
+    const left = leftText ? leftText.split(":") : [];
+    const right = rightText ? rightText.split(":") : [];
+    if (left.some((group) => group.includes(".")) || right.some((group) => group.includes("."))) {
+      throw new Error(`invalid IPv6 address ${address}`);
+    }
+    const missing = 8 - left.length - right.length;
+    if (missing < 0 || !compressed && missing !== 0 || compressed && missing < 1) {
+      throw new Error(`invalid IPv6 address ${address}`);
+    }
+    const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+    if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) {
+      throw new Error(`invalid IPv6 address ${address}`);
+    }
+    const result = new Uint8Array(16);
+    const view2 = new DataView(result.buffer);
+    groups.forEach((group, index) => view2.setUint16(index * 2, Number.parseInt(group, 16)));
+    return result;
+  }
+  function parseBcProvenanceV2Address(address) {
+    if (address.includes(":"))
+      return parseIpv6(address);
+    return parseIpv4(address);
+  }
+  function endpointBytes(endpoint) {
+    if (!validPort(endpoint.port) || !validPort(endpoint.manifestPort) || !validU32(endpoint.streamId)) {
+      throw new Error("invalid BCPV2 endpoint");
     }
-    get config() {
-      return __privateGet(this, _config);
+    const source = parseBcProvenanceV2Address(endpoint.sourceAddress);
+    const group = parseBcProvenanceV2Address(endpoint.groupAddress);
+    if (source.byteLength !== group.byteLength)
+      throw new Error("endpoint address families differ");
+    return { source, group };
+  }
+  function readU32(view2, offset) {
+    return view2.getUint32(offset);
+  }
+  function readU642(view2, offset) {
+    return view2.getBigUint64(offset);
+  }
+  function decodeBcProvenanceV2Record(input) {
+    const bytes = Uint8Array.from(input);
+    if (bytes.byteLength < BCPV2_MIN_RECORD_LENGTH || bytes.byteLength > BCPV2_MAX_RECORD_LENGTH || (bytes.byteLength - 132) % 32 !== 0) {
+      throw new Error("invalid BCPV2 record length");
     }
-    get stats() {
-      let quarantined = 0;
-      for (const track of __privateGet(this, _tracks2).values())
-        quarantined += track.quarantine.length;
-      return {
-        verified: __privateGet(this, _stats4).verified,
-        failures: { ...__privateGet(this, _stats4).failures },
-        quarantined,
-        quarantinedBytes: __privateGet(this, _stats4).quarantinedBytes
-      };
+    const view2 = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    if (!equalBytes(bytes.subarray(0, 4), MAGIC))
+      throw new Error("invalid BCPV2 record magic");
+    const count = view2.getUint16(28);
+    if (count < 1 || count > BCPV2_MAX_DIGESTS || bytes.byteLength !== 132 + count * 32) {
+      throw new Error("invalid BCPV2 record count");
     }
-    setMode(mode) {
-      __privateSet(this, _config, { ...__privateGet(this, _config), mode });
-      if (mode !== "enforce")
-        __privateMethod(this, _ManifestVerifier_instances, releaseAllQuarantine_fn).call(this, false);
-    }
-    registerTrack(context) {
-      const bindingId = context.bindingId ?? context.trackName;
-      if (__privateGet(this, _tracks2).has(bindingId)) {
-        throw new Error(`manifest binding ${bindingId} is already registered`);
-      }
-      if (!Number.isFinite(context.bitrate) || context.bitrate <= 0) {
-        throw new Error("manifest track bitrate must be > 0");
-      }
-      if (!Number.isFinite(context.groupDurationMs) || context.groupDurationMs <= 0) {
-        throw new Error("manifest track groupDurationMs must be > 0");
-      }
-      if (context.authScope.byteLength !== 32)
-        throw new Error("manifest authScope must be 32 bytes");
-      for (const key of context.keys) {
-        if (key.publicKey.byteLength !== 32)
-          throw new Error("manifest keys must carry 32-byte public keys");
-      }
-      if (manifestKeyFor(context.keys, context.keyEpoch) === void 0) {
-        throw new Error(`manifest keys hold no key set signing keyEpoch ${context.keyEpoch}`);
-      }
-      for (const [name, value] of Object.entries({
-        broadcastNamespaceId: context.broadcastNamespaceId,
-        trackName: context.trackName,
-        codec: context.codec,
-        timing: context.timing,
-        fecGeometry: context.fecGeometry
-      })) {
-        if (value.length === 0)
-          throw new Error(`manifest ${name} must not be empty`);
-      }
-      __privateGet(this, _tracks2).set(bindingId, {
-        context: { ...context, bindingId },
-        groups: /* @__PURE__ */ new Map(),
-        quarantine: [],
-        quarantinedBytes: 0,
-        capBytes: Math.ceil(context.bitrate * context.groupDurationMs / 8e3),
-        manifestEntries: 0,
-        maxManifestEntries: Math.ceil(context.bitrate * context.groupDurationMs / (8e3 * 52)),
-        maxGroups: context.mapper.d + 1
-      });
+    const body = bytes.slice(0, bytes.byteLength - BCPV2_SIGNATURE_LENGTH);
+    const digests = [];
+    for (let index = 0; index < count; index++) {
+      digests.push(bytes.slice(BCPV2_HEADER_LENGTH + index * 32, BCPV2_HEADER_LENGTH + (index + 1) * 32));
+    }
+    return {
+      kid: readU32(view2, 4),
+      epoch: readU32(view2, 8),
+      mseq: readU642(view2, 12),
+      firstSeq: readU642(view2, 20),
+      count,
+      hashAlg: bytes[30],
+      flags: bytes[31],
+      sent: readU32(view2, 32),
+      ctx: bytes.slice(36, 68),
+      digests,
+      signature: bytes.slice(bytes.byteLength - BCPV2_SIGNATURE_LENGTH),
+      body,
+      raw: bytes
+    };
+  }
+  function bcProvenanceV2SignedMessage(record, endpoint) {
+    const { source, group } = endpointBytes(endpoint);
+    const prefix = new Uint8Array(SIGNING_DOMAIN.byteLength + 4 + source.byteLength + group.byteLength + 2);
+    let offset = 0;
+    prefix.set(SIGNING_DOMAIN, offset);
+    offset += SIGNING_DOMAIN.byteLength;
+    prefix.set(u322(endpoint.streamId), offset);
+    offset += 4;
+    prefix.set(source, offset);
+    offset += source.byteLength;
+    prefix.set(group, offset);
+    offset += group.byteLength;
+    prefix.set(u16(endpoint.manifestPort), offset);
+    const message = new Uint8Array(prefix.byteLength + record.body.byteLength);
+    message.set(prefix);
+    message.set(record.body, prefix.byteLength);
+    return message;
+  }
+  function bcProvenanceV2DatagramDigest(endpoint, payload) {
+    if (payload.byteLength > 65535)
+      throw new Error("datagram payload exceeds u16 length");
+    const { source, group } = endpointBytes(endpoint);
+    const pseudoheader = new Uint8Array(source.byteLength + group.byteLength + 2 + 2 + 2 + 2 + 4);
+    let offset = 0;
+    pseudoheader.set(source, offset);
+    offset += source.byteLength;
+    pseudoheader.set(group, offset);
+    offset += group.byteLength;
+    pseudoheader.set([0, 17], offset);
+    offset += 2;
+    pseudoheader.set(u16(payload.byteLength), offset);
+    offset += 2;
+    pseudoheader.set(u16(endpoint.port), offset);
+    offset += 2;
+    pseudoheader.set(u16(endpoint.port), offset);
+    offset += 2;
+    pseudoheader.set(u322(endpoint.streamId), offset);
+    const input = new Uint8Array(pseudoheader.byteLength + payload.byteLength);
+    input.set(pseudoheader);
+    input.set(payload, pseudoheader.byteLength);
+    return sha2562(input);
+  }
+
+  // ../mmt-manifest-verify/node_modules/@noble/curves/esm/utils.js
+  var _0n = /* @__PURE__ */ BigInt(0);
+  var _1n = /* @__PURE__ */ BigInt(1);
+  function _abool2(value, title = "") {
+    if (typeof value !== "boolean") {
+      const prefix = title && `"${title}"`;
+      throw new Error(prefix + "expected boolean, got type=" + typeof value);
+    }
+    return value;
+  }
+  function _abytes2(value, length, title = "") {
+    const bytes = isBytes(value);
+    const len = value?.length;
+    const needsLen = length !== void 0;
+    if (!bytes || needsLen && len !== length) {
+      const prefix = title && `"${title}" `;
+      const ofLen = needsLen ? ` of length ${length}` : "";
+      const got = bytes ? `length=${len}` : `type=${typeof value}`;
+      throw new Error(prefix + "expected Uint8Array" + ofLen + ", got " + got);
     }
-    ingestManifestFrame(bindingId, frameBytes) {
-      const track = __privateMethod(this, _ManifestVerifier_instances, requireTrack_fn).call(this, bindingId);
+    return value;
+  }
+  function hexToNumber(hex2) {
+    if (typeof hex2 !== "string")
+      throw new Error("hex string expected, got " + typeof hex2);
+    return hex2 === "" ? _0n : BigInt("0x" + hex2);
+  }
+  function bytesToNumberBE(bytes) {
+    return hexToNumber(bytesToHex(bytes));
+  }
+  function bytesToNumberLE(bytes) {
+    abytes(bytes);
+    return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));
+  }
+  function numberToBytesBE(n, len) {
+    return hexToBytes(n.toString(16).padStart(len * 2, "0"));
+  }
+  function numberToBytesLE(n, len) {
+    return numberToBytesBE(n, len).reverse();
+  }
+  function ensureBytes(title, hex2, expectedLength) {
+    let res;
+    if (typeof hex2 === "string") {
       try {
-        const frame = decodeSourceAuthManifestFrame(frameBytes);
-        const groupId = frame.groupId;
-        const group = __privateMethod(this, _ManifestVerifier_instances, group_fn).call(this, track, groupId);
-        if (frame.kind === "object") {
-          if (group.close || group.signaturePending || group.failed) {
-            __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, "verifierError");
-            return;
-          }
-          if (group.entries.has(frame.objectId)) {
-            __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, "verifierError");
-            return;
-          }
-          if (group.entries.size >= 4096 || track.manifestEntries >= track.maxManifestEntries) {
-            __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, bindingId, groupId, objectId: frame.objectId }, "verifierError");
-            return;
-          }
-          group.entries.set(frame.objectId, frame);
-          track.manifestEntries++;
-          const pending = group.pending.get(frame.objectId);
-          if (pending) {
-            __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestLate");
-            __privateMethod(this, _ManifestVerifier_instances, resolvePending_fn).call(this, track, group, pending, frame);
-          }
-          if (group.pendingClose && group.entries.size === group.pendingClose.objectCount) {
-            const close = group.pendingClose;
-            group.pendingClose = void 0;
-            __privateMethod(this, _ManifestVerifier_instances, closeGroup_fn).call(this, track, groupId, group, close);
-          }
-          return;
-        }
-        __privateMethod(this, _ManifestVerifier_instances, closeGroup_fn).call(this, track, groupId, group, frame);
-      } catch {
-        __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, bindingId, groupId: 0, objectId: 0 }, "verifierError");
+        res = hexToBytes(hex2);
+      } catch (e) {
+        throw new Error(title + " must be hex string or Uint8Array, cause: " + e);
       }
+    } else if (isBytes(hex2)) {
+      res = Uint8Array.from(hex2);
+    } else {
+      throw new Error(title + " must be hex string or Uint8Array");
     }
-    admitObject(identity, data, release, discard) {
-      if (__privateGet(this, _config).mode === "off") {
-        release();
-        return { action: "play", verified: false };
-      }
-      const track = __privateGet(this, _tracks2).get(identity.bindingId ?? identity.trackName);
-      if (!track) {
-        release();
-        __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, identity, "verifierError");
-        return { action: "play", verified: false, reason: "verifierError" };
-      }
-      try {
-        if (!__privateMethod(this, _ManifestVerifier_instances, validateIdentity_fn).call(this, track, identity)) {
-          return __privateMethod(this, _ManifestVerifier_instances, rejectOrShadow_fn).call(this, identity, release, "digestMismatch");
+    const len = res.length;
+    if (typeof expectedLength === "number" && len !== expectedLength)
+      throw new Error(title + " of length " + expectedLength + " expected, got " + len);
+    return res;
+  }
+  function equalBytes2(a, b) {
+    if (a.length !== b.length)
+      return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+      diff |= a[i] ^ b[i];
+    return diff === 0;
+  }
+  function copyBytes(bytes) {
+    return Uint8Array.from(bytes);
+  }
+  var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+  function inRange(n, min, max) {
+    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+  }
+  function aInRange(title, n, min, max) {
+    if (!inRange(n, min, max))
+      throw new Error("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+  }
+  function bitLen(n) {
+    let len;
+    for (len = 0; n > _0n; n >>= _1n, len += 1)
+      ;
+    return len;
+  }
+  var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+  function _validateObject(object, fields, optFields = {}) {
+    if (!object || typeof object !== "object")
+      throw new Error("expected valid options object");
+    function checkField(fieldName, expectedType, isOpt) {
+      const val = object[fieldName];
+      if (isOpt && val === void 0)
+        return;
+      const current = typeof val;
+      if (current !== expectedType || val === null)
+        throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+    }
+    Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));
+    Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));
+  }
+  var notImplemented = () => {
+    throw new Error("not implemented");
+  };
+  function memoized(fn) {
+    const map = /* @__PURE__ */ new WeakMap();
+    return (arg, ...args) => {
+      const val = map.get(arg);
+      if (val !== void 0)
+        return val;
+      const computed = fn(arg, ...args);
+      map.set(arg, computed);
+      return computed;
+    };
+  }
+
+  // ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/modular.js
+  var _0n2 = BigInt(0);
+  var _1n2 = BigInt(1);
+  var _2n = /* @__PURE__ */ BigInt(2);
+  var _3n = /* @__PURE__ */ BigInt(3);
+  var _4n = /* @__PURE__ */ BigInt(4);
+  var _5n = /* @__PURE__ */ BigInt(5);
+  var _7n = /* @__PURE__ */ BigInt(7);
+  var _8n = /* @__PURE__ */ BigInt(8);
+  var _9n = /* @__PURE__ */ BigInt(9);
+  var _16n = /* @__PURE__ */ BigInt(16);
+  function mod(a, b) {
+    const result = a % b;
+    return result >= _0n2 ? result : b + result;
+  }
+  function pow2(x, power, modulo) {
+    let res = x;
+    while (power-- > _0n2) {
+      res *= res;
+      res %= modulo;
+    }
+    return res;
+  }
+  function invert(number, modulo) {
+    if (number === _0n2)
+      throw new Error("invert: expected non-zero number");
+    if (modulo <= _0n2)
+      throw new Error("invert: expected positive modulus, got " + modulo);
+    let a = mod(number, modulo);
+    let b = modulo;
+    let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+    while (a !== _0n2) {
+      const q = b / a;
+      const r = b % a;
+      const m = x - u * q;
+      const n = y - v * q;
+      b = a, a = r, x = u, y = v, u = m, v = n;
+    }
+    const gcd = b;
+    if (gcd !== _1n2)
+      throw new Error("invert: does not exist");
+    return mod(x, modulo);
+  }
+  function assertIsSquare(Fp2, root, n) {
+    if (!Fp2.eql(Fp2.sqr(root), n))
+      throw new Error("Cannot find square root");
+  }
+  function sqrt3mod4(Fp2, n) {
+    const p1div4 = (Fp2.ORDER + _1n2) / _4n;
+    const root = Fp2.pow(n, p1div4);
+    assertIsSquare(Fp2, root, n);
+    return root;
+  }
+  function sqrt5mod8(Fp2, n) {
+    const p5div8 = (Fp2.ORDER - _5n) / _8n;
+    const n2 = Fp2.mul(n, _2n);
+    const v = Fp2.pow(n2, p5div8);
+    const nv = Fp2.mul(n, v);
+    const i = Fp2.mul(Fp2.mul(nv, _2n), v);
+    const root = Fp2.mul(nv, Fp2.sub(i, Fp2.ONE));
+    assertIsSquare(Fp2, root, n);
+    return root;
+  }
+  function sqrt9mod16(P) {
+    const Fp_ = Field(P);
+    const tn = tonelliShanks(P);
+    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+    const c2 = tn(Fp_, c1);
+    const c3 = tn(Fp_, Fp_.neg(c1));
+    const c4 = (P + _7n) / _16n;
+    return (Fp2, n) => {
+      let tv1 = Fp2.pow(n, c4);
+      let tv2 = Fp2.mul(tv1, c1);
+      const tv3 = Fp2.mul(tv1, c2);
+      const tv4 = Fp2.mul(tv1, c3);
+      const e1 = Fp2.eql(Fp2.sqr(tv2), n);
+      const e2 = Fp2.eql(Fp2.sqr(tv3), n);
+      tv1 = Fp2.cmov(tv1, tv2, e1);
+      tv2 = Fp2.cmov(tv4, tv3, e2);
+      const e3 = Fp2.eql(Fp2.sqr(tv2), n);
+      const root = Fp2.cmov(tv1, tv2, e3);
+      assertIsSquare(Fp2, root, n);
+      return root;
+    };
+  }
+  function tonelliShanks(P) {
+    if (P < _3n)
+      throw new Error("sqrt is not defined for small field");
+    let Q = P - _1n2;
+    let S = 0;
+    while (Q % _2n === _0n2) {
+      Q /= _2n;
+      S++;
+    }
+    let Z = _2n;
+    const _Fp = Field(P);
+    while (FpLegendre(_Fp, Z) === 1) {
+      if (Z++ > 1e3)
+        throw new Error("Cannot find square root: probably non-prime P");
+    }
+    if (S === 1)
+      return sqrt3mod4;
+    let cc = _Fp.pow(Z, Q);
+    const Q1div2 = (Q + _1n2) / _2n;
+    return function tonelliSlow(Fp2, n) {
+      if (Fp2.is0(n))
+        return n;
+      if (FpLegendre(Fp2, n) !== 1)
+        throw new Error("Cannot find square root");
+      let M = S;
+      let c = Fp2.mul(Fp2.ONE, cc);
+      let t = Fp2.pow(n, Q);
+      let R = Fp2.pow(n, Q1div2);
+      while (!Fp2.eql(t, Fp2.ONE)) {
+        if (Fp2.is0(t))
+          return Fp2.ZERO;
+        let i = 1;
+        let t_tmp = Fp2.sqr(t);
+        while (!Fp2.eql(t_tmp, Fp2.ONE)) {
+          i++;
+          t_tmp = Fp2.sqr(t_tmp);
+          if (i === M)
+            throw new Error("Cannot find square root");
         }
-        const group = __privateMethod(this, _ManifestVerifier_instances, group_fn).call(this, track, BigInt(identity.groupId));
-        if (group.failed === "sigInvalid" || group.failed === "digestMismatch") {
-          return __privateMethod(this, _ManifestVerifier_instances, rejectOrShadow_fn).call(this, identity, release, group.failed);
+        const exponent = _1n2 << BigInt(M - i - 1);
+        const b = Fp2.pow(c, exponent);
+        M = i;
+        c = Fp2.sqr(b);
+        t = Fp2.mul(t, c);
+        R = Fp2.mul(R, b);
+      }
+      return R;
+    };
+  }
+  function FpSqrt(P) {
+    if (P % _4n === _3n)
+      return sqrt3mod4;
+    if (P % _8n === _5n)
+      return sqrt5mod8;
+    if (P % _16n === _9n)
+      return sqrt9mod16(P);
+    return tonelliShanks(P);
+  }
+  var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n2) === _1n2;
+  var FIELD_FIELDS = [
+    "create",
+    "isValid",
+    "is0",
+    "neg",
+    "inv",
+    "sqrt",
+    "sqr",
+    "eql",
+    "add",
+    "sub",
+    "mul",
+    "pow",
+    "div",
+    "addN",
+    "subN",
+    "mulN",
+    "sqrN"
+  ];
+  function validateField(field) {
+    const initial = {
+      ORDER: "bigint",
+      MASK: "bigint",
+      BYTES: "number",
+      BITS: "number"
+    };
+    const opts = FIELD_FIELDS.reduce((map, val) => {
+      map[val] = "function";
+      return map;
+    }, initial);
+    _validateObject(field, opts);
+    return field;
+  }
+  function FpPow(Fp2, num, power) {
+    if (power < _0n2)
+      throw new Error("invalid exponent, negatives unsupported");
+    if (power === _0n2)
+      return Fp2.ONE;
+    if (power === _1n2)
+      return num;
+    let p = Fp2.ONE;
+    let d = num;
+    while (power > _0n2) {
+      if (power & _1n2)
+        p = Fp2.mul(p, d);
+      d = Fp2.sqr(d);
+      power >>= _1n2;
+    }
+    return p;
+  }
+  function FpInvertBatch(Fp2, nums, passZero = false) {
+    const inverted = new Array(nums.length).fill(passZero ? Fp2.ZERO : void 0);
+    const multipliedAcc = nums.reduce((acc, num, i) => {
+      if (Fp2.is0(num))
+        return acc;
+      inverted[i] = acc;
+      return Fp2.mul(acc, num);
+    }, Fp2.ONE);
+    const invertedAcc = Fp2.inv(multipliedAcc);
+    nums.reduceRight((acc, num, i) => {
+      if (Fp2.is0(num))
+        return acc;
+      inverted[i] = Fp2.mul(acc, inverted[i]);
+      return Fp2.mul(acc, num);
+    }, invertedAcc);
+    return inverted;
+  }
+  function FpLegendre(Fp2, n) {
+    const p1mod2 = (Fp2.ORDER - _1n2) / _2n;
+    const powered = Fp2.pow(n, p1mod2);
+    const yes = Fp2.eql(powered, Fp2.ONE);
+    const zero = Fp2.eql(powered, Fp2.ZERO);
+    const no = Fp2.eql(powered, Fp2.neg(Fp2.ONE));
+    if (!yes && !zero && !no)
+      throw new Error("invalid Legendre symbol result");
+    return yes ? 1 : zero ? 0 : -1;
+  }
+  function nLength(n, nBitLength) {
+    if (nBitLength !== void 0)
+      anumber(nBitLength);
+    const _nBitLength = nBitLength !== void 0 ? nBitLength : n.toString(2).length;
+    const nByteLength = Math.ceil(_nBitLength / 8);
+    return { nBitLength: _nBitLength, nByteLength };
+  }
+  function Field(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
+    if (ORDER <= _0n2)
+      throw new Error("invalid field: expected ORDER > 0, got " + ORDER);
+    let _nbitLength = void 0;
+    let _sqrt = void 0;
+    let modFromBytes = false;
+    let allowedLengths = void 0;
+    if (typeof bitLenOrOpts === "object" && bitLenOrOpts != null) {
+      if (opts.sqrt || isLE)
+        throw new Error("cannot specify opts in two arguments");
+      const _opts = bitLenOrOpts;
+      if (_opts.BITS)
+        _nbitLength = _opts.BITS;
+      if (_opts.sqrt)
+        _sqrt = _opts.sqrt;
+      if (typeof _opts.isLE === "boolean")
+        isLE = _opts.isLE;
+      if (typeof _opts.modFromBytes === "boolean")
+        modFromBytes = _opts.modFromBytes;
+      allowedLengths = _opts.allowedLengths;
+    } else {
+      if (typeof bitLenOrOpts === "number")
+        _nbitLength = bitLenOrOpts;
+      if (opts.sqrt)
+        _sqrt = opts.sqrt;
+    }
+    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);
+    if (BYTES > 2048)
+      throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+    let sqrtP;
+    const f = Object.freeze({
+      ORDER,
+      isLE,
+      BITS,
+      BYTES,
+      MASK: bitMask(BITS),
+      ZERO: _0n2,
+      ONE: _1n2,
+      allowedLengths,
+      create: (num) => mod(num, ORDER),
+      isValid: (num) => {
+        if (typeof num !== "bigint")
+          throw new Error("invalid field element: expected bigint, got " + typeof num);
+        return _0n2 <= num && num < ORDER;
+      },
+      is0: (num) => num === _0n2,
+      // is valid and invertible
+      isValidNot0: (num) => !f.is0(num) && f.isValid(num),
+      isOdd: (num) => (num & _1n2) === _1n2,
+      neg: (num) => mod(-num, ORDER),
+      eql: (lhs, rhs) => lhs === rhs,
+      sqr: (num) => mod(num * num, ORDER),
+      add: (lhs, rhs) => mod(lhs + rhs, ORDER),
+      sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
+      mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
+      pow: (num, power) => FpPow(f, num, power),
+      div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
+      // Same as above, but doesn't normalize
+      sqrN: (num) => num * num,
+      addN: (lhs, rhs) => lhs + rhs,
+      subN: (lhs, rhs) => lhs - rhs,
+      mulN: (lhs, rhs) => lhs * rhs,
+      inv: (num) => invert(num, ORDER),
+      sqrt: _sqrt || ((n) => {
+        if (!sqrtP)
+          sqrtP = FpSqrt(ORDER);
+        return sqrtP(f, n);
+      }),
+      toBytes: (num) => isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES),
+      fromBytes: (bytes, skipValidation = true) => {
+        if (allowedLengths) {
+          if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+            throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+          }
+          const padded = new Uint8Array(BYTES);
+          padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+          bytes = padded;
         }
-        const entry = group.entries.get(identity.objectId);
-        if (entry)
-          return __privateMethod(this, _ManifestVerifier_instances, admitAgainstEntry_fn).call(this, track, group, identity, data, release, entry, discard);
-        if (__privateGet(this, _config).mode === "shadow" || __privateGet(this, _config).onMissingManifest === "fallback-shadow") {
-          release();
-          __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, identity, "manifestAbsent");
-          return { action: "play", verified: false, reason: "manifestAbsent" };
+        if (bytes.length !== BYTES)
+          throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+        if (modFromBytes)
+          scalar = mod(scalar, ORDER);
+        if (!skipValidation) {
+          if (!f.isValid(scalar))
+            throw new Error("invalid field element: outside of range 0..ORDER");
         }
-        if (!__privateMethod(this, _ManifestVerifier_instances, quarantine_fn).call(this, track, group, { identity, data, release, discard, bytes: data.byteLength })) {
-          return { action: "drop", verified: false };
+        return scalar;
+      },
+      // TODO: we don't need it here, move out to separate fn
+      invertBatch: (lst) => FpInvertBatch(f, lst),
+      // We can't move this out because Fp6, Fp12 implement it
+      // and it's unclear what to return in there.
+      cmov: (a, b, c) => c ? b : a
+    });
+    return Object.freeze(f);
+  }
+
+  // ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/curve.js
+  var _0n3 = BigInt(0);
+  var _1n3 = BigInt(1);
+  function negateCt(condition, item) {
+    const neg = item.negate();
+    return condition ? neg : item;
+  }
+  function normalizeZ(c, points) {
+    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+  }
+  function validateW(W, bits) {
+    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+      throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+  }
+  function calcWOpts(W, scalarBits) {
+    validateW(W, scalarBits);
+    const windows = Math.ceil(scalarBits / W) + 1;
+    const windowSize = 2 ** (W - 1);
+    const maxNumber = 2 ** W;
+    const mask = bitMask(W);
+    const shiftBy = BigInt(W);
+    return { windows, windowSize, mask, maxNumber, shiftBy };
+  }
+  function calcOffsets(n, window, wOpts) {
+    const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+    let wbits = Number(n & mask);
+    let nextN = n >> shiftBy;
+    if (wbits > windowSize) {
+      wbits -= maxNumber;
+      nextN += _1n3;
+    }
+    const offsetStart = window * windowSize;
+    const offset = offsetStart + Math.abs(wbits) - 1;
+    const isZero = wbits === 0;
+    const isNeg = wbits < 0;
+    const isNegF = window % 2 !== 0;
+    const offsetF = offsetStart;
+    return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+  }
+  function validateMSMPoints(points, c) {
+    if (!Array.isArray(points))
+      throw new Error("array expected");
+    points.forEach((p, i) => {
+      if (!(p instanceof c))
+        throw new Error("invalid point at index " + i);
+    });
+  }
+  function validateMSMScalars(scalars, field) {
+    if (!Array.isArray(scalars))
+      throw new Error("array of scalars expected");
+    scalars.forEach((s, i) => {
+      if (!field.isValid(s))
+        throw new Error("invalid scalar at index " + i);
+    });
+  }
+  var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+  var pointWindowSizes = /* @__PURE__ */ new WeakMap();
+  function getW(P) {
+    return pointWindowSizes.get(P) || 1;
+  }
+  function assert0(n) {
+    if (n !== _0n3)
+      throw new Error("invalid wNAF");
+  }
+  var wNAF = class {
+    // Parametrized with a given Point class (not individual point)
+    constructor(Point, bits) {
+      this.BASE = Point.BASE;
+      this.ZERO = Point.ZERO;
+      this.Fn = Point.Fn;
+      this.bits = bits;
+    }
+    // non-const time multiplication ladder
+    _unsafeLadder(elm, n, p = this.ZERO) {
+      let d = elm;
+      while (n > _0n3) {
+        if (n & _1n3)
+          p = p.add(d);
+        d = d.double();
+        n >>= _1n3;
+      }
+      return p;
+    }
+    /**
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @param point Point instance
+     * @param W window size
+     * @returns precomputed point tables flattened to a single array
+     */
+    precomputeWindow(point, W) {
+      const { windows, windowSize } = calcWOpts(W, this.bits);
+      const points = [];
+      let p = point;
+      let base = p;
+      for (let window = 0; window < windows; window++) {
+        base = p;
+        points.push(base);
+        for (let i = 1; i < windowSize; i++) {
+          base = base.add(p);
+          points.push(base);
         }
-        return { action: "stall", verified: false };
-      } catch {
-        release();
-        __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, identity, "verifierError");
-        return { action: "play", verified: false, reason: "verifierError" };
+        p = base.double();
       }
+      return points;
     }
-    dispose() {
-      if (__privateGet(this, _disposed2))
-        return;
-      __privateSet(this, _disposed2, true);
-      __privateMethod(this, _ManifestVerifier_instances, releaseAllQuarantine_fn).call(this, false);
-      __privateGet(this, _tracks2).clear();
-    }
-  };
-  _config = new WeakMap();
-  _verifySignature = new WeakMap();
-  _onFailure = new WeakMap();
-  _tracks2 = new WeakMap();
-  _stats4 = new WeakMap();
-  _disposed2 = new WeakMap();
-  _ManifestVerifier_instances = new WeakSet();
-  requireTrack_fn = function(bindingId) {
-    const track = __privateGet(this, _tracks2).get(bindingId);
-    if (!track)
-      throw new Error(`unknown manifest binding ${bindingId}`);
-    return track;
-  };
-  group_fn = function(track, groupId) {
-    let group = track.groups.get(groupId);
-    if (!group) {
-      group = { entries: /* @__PURE__ */ new Map(), pending: /* @__PURE__ */ new Map(), rootVerified: false };
-      track.groups.set(groupId, group);
-      while (track.groups.size > track.maxGroups) {
-        const oldest = track.groups.entries().next().value;
-        if (!oldest)
-          break;
-        const [oldestId, oldestGroup] = oldest;
-        for (const pending of [...oldestGroup.pending.values()]) {
-          __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, oldestGroup, pending);
-          __privateMethod(this, _ManifestVerifier_instances, giveUpOnPending_fn).call(this, pending);
-          __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestAbsent");
+    /**
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+     * More compact implementation:
+     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+     * @returns real and fake (for const-time) points
+     */
+    wNAF(W, precomputes, n) {
+      if (!this.Fn.isValid(n))
+        throw new Error("invalid scalar");
+      let p = this.ZERO;
+      let f = this.BASE;
+      const wo = calcWOpts(W, this.bits);
+      for (let window = 0; window < wo.windows; window++) {
+        const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+        n = nextN;
+        if (isZero) {
+          f = f.add(negateCt(isNegF, precomputes[offsetF]));
+        } else {
+          p = p.add(negateCt(isNeg, precomputes[offset]));
         }
-        track.manifestEntries -= oldestGroup.entries.size;
-        track.groups.delete(oldestId);
       }
+      assert0(n);
+      return { p, f };
     }
-    return group;
-  };
-  validateIdentity_fn = function(track, identity) {
-    const coordinates = track.context.mapper.derive(Number(identity.groupId), identity.objectId);
-    return identity.ssId === void 0 || coordinates.ssId === identity.ssId;
-  };
-  admitAgainstEntry_fn = function(track, group, identity, data, release, entry, discard) {
-    if (entry.trueLength !== data.byteLength) {
-      return __privateMethod(this, _ManifestVerifier_instances, rejectOrShadow_fn).call(this, identity, release, "digestMismatch");
-    }
-    const digestMatches = equalBytes(sourceAuthObjectDigest(data.subarray(0, entry.trueLength)), entry.digest);
-    if (!digestMatches)
-      return __privateMethod(this, _ManifestVerifier_instances, rejectOrShadow_fn).call(this, identity, release, "digestMismatch");
-    if (!track.context.manifestChannelAuthenticated && !group.rootVerified) {
-      if (__privateGet(this, _config).mode === "shadow") {
-        release();
-        return { action: "play", verified: false };
-      }
-      if (!__privateMethod(this, _ManifestVerifier_instances, quarantine_fn).call(this, track, group, { identity, data, release, discard, bytes: data.byteLength })) {
-        return { action: "drop", verified: false };
-      }
-      return { action: "stall", verified: false };
-    }
-    release();
-    __privateGet(this, _stats4).verified++;
-    return { action: "play", verified: true };
-  };
-  rejectOrShadow_fn = function(identity, release, reason) {
-    __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, identity, reason);
-    if (__privateGet(this, _config).mode === "enforce") {
-      console.warn(JSON.stringify({ event: "manifest-enforce-drop", track: identity.trackName, group: String(identity.groupId), object: identity.objectId, reason }));
-      return { action: "drop", verified: false, reason };
-    }
-    release();
-    return { action: "play", verified: false, reason };
-  };
-  resolvePending_fn = function(track, group, pending, entry) {
-    __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-    __privateMethod(this, _ManifestVerifier_instances, admitAgainstEntry_fn).call(this, track, group, pending.identity, pending.data, pending.release, entry, pending.discard);
-  };
-  closeGroup_fn = function(track, groupId, group, close) {
-    if (group.close || group.signaturePending)
-      return;
-    const entries = [...group.entries.values()];
-    if (entries.length !== close.objectCount) {
-      group.pendingClose = close;
-      const hadPending = group.pending.size > 0;
-      if (__privateGet(this, _config).onMissingManifest === "fallback-shadow" || __privateGet(this, _config).mode === "shadow") {
-        for (const pending of [...group.pending.values()]) {
-          __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-          pending.release();
-          __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestAbsent");
-        }
-      } else {
-        for (const pending of group.pending.values()) {
-          __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestAbsent");
+    /**
+     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param acc accumulator point to add result of multiplication
+     * @returns point
+     */
+    wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+      const wo = calcWOpts(W, this.bits);
+      for (let window = 0; window < wo.windows; window++) {
+        if (n === _0n3)
+          break;
+        const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+        n = nextN;
+        if (isZero) {
+          continue;
+        } else {
+          const item = precomputes[offset];
+          acc = acc.add(isNeg ? item.negate() : item);
         }
       }
-      if (!hadPending) {
-        __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, groupId, objectId: 0 }, "manifestAbsent");
+      assert0(n);
+      return acc;
+    }
+    getPrecomputes(W, point, transform) {
+      let comp = pointPrecomputes.get(point);
+      if (!comp) {
+        comp = this.precomputeWindow(point, W);
+        if (W !== 1) {
+          if (typeof transform === "function")
+            comp = transform(comp);
+          pointPrecomputes.set(point, comp);
+        }
       }
-      return;
-    }
-    if (!equalBytes(sourceAuthMerkleRoot(entries), close.root)) {
-      group.failed = "digestMismatch";
-      __privateMethod(this, _ManifestVerifier_instances, failGroup_fn).call(this, track, groupId, group, "digestMismatch");
-      return;
+      return comp;
     }
-    const preimage = sourceAuthSignaturePreimage(track.context.authScope, close.groupId, close.objectCount, close.root);
-    let signatureValid;
-    try {
-      signatureValid = __privateMethod(this, _ManifestVerifier_instances, verifyAcceptedSignature_fn).call(this, track, preimage, close.signature);
-    } catch {
-      __privateMethod(this, _ManifestVerifier_instances, failOpenGroup_fn).call(this, track, groupId, group);
-      return;
+    cached(point, scalar, transform) {
+      const W = getW(point);
+      return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
     }
-    if (isPromiseLike(signatureValid)) {
-      group.signaturePending = true;
-      void signatureValid.then((valid) => {
-        if (__privateGet(this, _disposed2))
-          return;
-        group.signaturePending = false;
-        __privateMethod(this, _ManifestVerifier_instances, finishGroupSignature_fn).call(this, track, groupId, group, close, valid);
-      }, () => {
-        if (__privateGet(this, _disposed2))
-          return;
-        group.signaturePending = false;
-        __privateMethod(this, _ManifestVerifier_instances, failOpenGroup_fn).call(this, track, groupId, group);
-      });
-      return;
+    unsafe(point, scalar, transform, prev) {
+      const W = getW(point);
+      if (W === 1)
+        return this._unsafeLadder(point, scalar, prev);
+      return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
     }
-    __privateMethod(this, _ManifestVerifier_instances, finishGroupSignature_fn).call(this, track, groupId, group, close, signatureValid);
-  };
-  finishGroupSignature_fn = function(track, groupId, group, close, signatureValid) {
-    if (!signatureValid) {
-      group.failed = "sigInvalid";
-      __privateMethod(this, _ManifestVerifier_instances, failGroup_fn).call(this, track, groupId, group, "sigInvalid");
-      return;
+    // We calculate precomputes for elliptic curve point multiplication
+    // using windowed method. This specifies window size and
+    // stores precomputed values. Usually only base point would be precomputed.
+    createCache(P, W) {
+      validateW(W, this.bits);
+      pointWindowSizes.set(P, W);
+      pointPrecomputes.delete(P);
     }
-    group.failed = void 0;
-    group.close = close;
-    group.pendingClose = void 0;
-    group.rootVerified = true;
-    for (const pending of [...group.pending.values()]) {
-      const entry = group.entries.get(pending.identity.objectId);
-      if (entry)
-        __privateMethod(this, _ManifestVerifier_instances, resolvePending_fn).call(this, track, group, pending, entry);
-      else if (__privateGet(this, _config).onMissingManifest === "fallback-shadow") {
-        __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-        pending.release();
-        __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestAbsent");
-      }
+    hasCache(elm) {
+      return getW(elm) !== 1;
     }
   };
-  verifyAcceptedSignature_fn = function(track, message, signature) {
-    const keys = [manifestKeyFor(track.context.keys, track.context.keyEpoch)];
-    const pending = [];
-    let hadSynchronousError = false;
-    for (const key of keys) {
+  function pippenger(c, fieldN, points, scalars) {
+    validateMSMPoints(points, c);
+    validateMSMScalars(scalars, fieldN);
+    const plength = points.length;
+    const slength = scalars.length;
+    if (plength !== slength)
+      throw new Error("arrays of points and scalars must have equal length");
+    const zero = c.ZERO;
+    const wbits = bitLen(BigInt(plength));
+    let windowSize = 1;
+    if (wbits > 12)
+      windowSize = wbits - 3;
+    else if (wbits > 4)
+      windowSize = wbits - 2;
+    else if (wbits > 0)
+      windowSize = 2;
+    const MASK = bitMask(windowSize);
+    const buckets = new Array(Number(MASK) + 1).fill(zero);
+    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+    let sum = zero;
+    for (let i = lastBits; i >= 0; i -= windowSize) {
+      buckets.fill(zero);
+      for (let j = 0; j < slength; j++) {
+        const scalar = scalars[j];
+        const wbits2 = Number(scalar >> BigInt(i) & MASK);
+        buckets[wbits2] = buckets[wbits2].add(points[j]);
+      }
+      let resI = zero;
+      for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+        sumI = sumI.add(buckets[j]);
+        resI = resI.add(sumI);
+      }
+      sum = sum.add(resI);
+      if (i !== 0)
+        for (let j = 0; j < windowSize; j++)
+          sum = sum.double();
+    }
+    return sum;
+  }
+  function createField(order, field, isLE) {
+    if (field) {
+      if (field.ORDER !== order)
+        throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+      validateField(field);
+      return field;
+    } else {
+      return Field(order, { isLE });
+    }
+  }
+  function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+    if (FpFnLE === void 0)
+      FpFnLE = type === "edwards";
+    if (!CURVE || typeof CURVE !== "object")
+      throw new Error(`expected valid ${type} CURVE object`);
+    for (const p of ["p", "n", "h"]) {
+      const val = CURVE[p];
+      if (!(typeof val === "bigint" && val > _0n3))
+        throw new Error(`CURVE.${p} must be positive bigint`);
+    }
+    const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+    const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+    const _b = type === "weierstrass" ? "b" : "d";
+    const params = ["Gx", "Gy", "a", _b];
+    for (const p of params) {
+      if (!Fp2.isValid(CURVE[p]))
+        throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+    }
+    CURVE = Object.freeze(Object.assign({}, CURVE));
+    return { CURVE, Fp: Fp2, Fn: Fn2 };
+  }
+
+  // ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/edwards.js
+  var _0n4 = BigInt(0);
+  var _1n4 = BigInt(1);
+  var _2n2 = BigInt(2);
+  var _8n2 = BigInt(8);
+  function isEdValidXY(Fp2, CURVE, x, y) {
+    const x2 = Fp2.sqr(x);
+    const y2 = Fp2.sqr(y);
+    const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+    const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+    return Fp2.eql(left, right);
+  }
+  function edwards(params, extraOpts = {}) {
+    const validated = _createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
+    const { Fp: Fp2, Fn: Fn2 } = validated;
+    let CURVE = validated.CURVE;
+    const { h: cofactor } = CURVE;
+    _validateObject(extraOpts, {}, { uvRatio: "function" });
+    const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
+    const modP = (n) => Fp2.create(n);
+    const uvRatio2 = extraOpts.uvRatio || ((u, v) => {
       try {
-        const result = __privateGet(this, _verifySignature).call(this, key, message, signature);
-        if (isPromiseLike(result)) {
-          pending.push(Promise.resolve(result).then((valid) => valid, () => "error"));
-        } else if (result) {
-          return true;
-        }
-      } catch {
-        hadSynchronousError = true;
+        return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
+      } catch (e) {
+        return { isValid: false, value: _0n4 };
       }
+    });
+    if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
+      throw new Error("bad curve params: generator point");
+    function acoord(title, n, banZero = false) {
+      const min = banZero ? _1n4 : _0n4;
+      aInRange("coordinate " + title, n, min, MASK);
+      return n;
+    }
+    function aextpoint(other) {
+      if (!(other instanceof Point))
+        throw new Error("ExtendedPoint expected");
+    }
+    const toAffineMemo = memoized((p, iz) => {
+      const { X, Y, Z } = p;
+      const is0 = p.is0();
+      if (iz == null)
+        iz = is0 ? _8n2 : Fp2.inv(Z);
+      const x = modP(X * iz);
+      const y = modP(Y * iz);
+      const zz = Fp2.mul(Z, iz);
+      if (is0)
+        return { x: _0n4, y: _1n4 };
+      if (zz !== _1n4)
+        throw new Error("invZ was invalid");
+      return { x, y };
+    });
+    const assertValidMemo = memoized((p) => {
+      const { a, d } = CURVE;
+      if (p.is0())
+        throw new Error("bad point: ZERO");
+      const { X, Y, Z, T } = p;
+      const X2 = modP(X * X);
+      const Y2 = modP(Y * Y);
+      const Z2 = modP(Z * Z);
+      const Z4 = modP(Z2 * Z2);
+      const aX2 = modP(X2 * a);
+      const left = modP(Z2 * modP(aX2 + Y2));
+      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+      if (left !== right)
+        throw new Error("bad point: equation left != right (1)");
+      const XY = modP(X * Y);
+      const ZT = modP(Z * T);
+      if (XY !== ZT)
+        throw new Error("bad point: equation left != right (2)");
+      return true;
+    });
+    class Point {
+      constructor(X, Y, Z, T) {
+        this.X = acoord("x", X);
+        this.Y = acoord("y", Y);
+        this.Z = acoord("z", Z, true);
+        this.T = acoord("t", T);
+        Object.freeze(this);
+      }
+      static CURVE() {
+        return CURVE;
+      }
+      static fromAffine(p) {
+        if (p instanceof Point)
+          throw new Error("extended point not allowed");
+        const { x, y } = p || {};
+        acoord("x", x);
+        acoord("y", y);
+        return new Point(x, y, _1n4, modP(x * y));
+      }
+      // Uses algo from RFC8032 5.1.3.
+      static fromBytes(bytes, zip215 = false) {
+        const len = Fp2.BYTES;
+        const { a, d } = CURVE;
+        bytes = copyBytes(_abytes2(bytes, len, "point"));
+        _abool2(zip215, "zip215");
+        const normed = copyBytes(bytes);
+        const lastByte = bytes[len - 1];
+        normed[len - 1] = lastByte & ~128;
+        const y = bytesToNumberLE(normed);
+        const max = zip215 ? MASK : Fp2.ORDER;
+        aInRange("point.y", y, _0n4, max);
+        const y2 = modP(y * y);
+        const u = modP(y2 - _1n4);
+        const v = modP(d * y2 - a);
+        let { isValid, value: x } = uvRatio2(u, v);
+        if (!isValid)
+          throw new Error("bad point: invalid y coordinate");
+        const isXOdd = (x & _1n4) === _1n4;
+        const isLastByteOdd = (lastByte & 128) !== 0;
+        if (!zip215 && x === _0n4 && isLastByteOdd)
+          throw new Error("bad point: x=0 and x_0=1");
+        if (isLastByteOdd !== isXOdd)
+          x = modP(-x);
+        return Point.fromAffine({ x, y });
+      }
+      static fromHex(bytes, zip215 = false) {
+        return Point.fromBytes(ensureBytes("point", bytes), zip215);
+      }
+      get x() {
+        return this.toAffine().x;
+      }
+      get y() {
+        return this.toAffine().y;
+      }
+      precompute(windowSize = 8, isLazy = true) {
+        wnaf.createCache(this, windowSize);
+        if (!isLazy)
+          this.multiply(_2n2);
+        return this;
+      }
+      // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+      assertValidity() {
+        assertValidMemo(this);
+      }
+      // Compare one point to another.
+      equals(other) {
+        aextpoint(other);
+        const { X: X1, Y: Y1, Z: Z1 } = this;
+        const { X: X2, Y: Y2, Z: Z2 } = other;
+        const X1Z2 = modP(X1 * Z2);
+        const X2Z1 = modP(X2 * Z1);
+        const Y1Z2 = modP(Y1 * Z2);
+        const Y2Z1 = modP(Y2 * Z1);
+        return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+      }
+      is0() {
+        return this.equals(Point.ZERO);
+      }
+      negate() {
+        return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+      }
+      // Fast algo for doubling Extended Point.
+      // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+      // Cost: 4M + 4S + 1*a + 6add + 1*2.
+      double() {
+        const { a } = CURVE;
+        const { X: X1, Y: Y1, Z: Z1 } = this;
+        const A = modP(X1 * X1);
+        const B = modP(Y1 * Y1);
+        const C = modP(_2n2 * modP(Z1 * Z1));
+        const D = modP(a * A);
+        const x1y1 = X1 + Y1;
+        const E = modP(modP(x1y1 * x1y1) - A - B);
+        const G = D + B;
+        const F = G - C;
+        const H = D - B;
+        const X3 = modP(E * F);
+        const Y3 = modP(G * H);
+        const T3 = modP(E * H);
+        const Z3 = modP(F * G);
+        return new Point(X3, Y3, Z3, T3);
+      }
+      // Fast algo for adding 2 Extended Points.
+      // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+      // Cost: 9M + 1*a + 1*d + 7add.
+      add(other) {
+        aextpoint(other);
+        const { a, d } = CURVE;
+        const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+        const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+        const A = modP(X1 * X2);
+        const B = modP(Y1 * Y2);
+        const C = modP(T1 * d * T2);
+        const D = modP(Z1 * Z2);
+        const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+        const F = D - C;
+        const G = D + C;
+        const H = modP(B - a * A);
+        const X3 = modP(E * F);
+        const Y3 = modP(G * H);
+        const T3 = modP(E * H);
+        const Z3 = modP(F * G);
+        return new Point(X3, Y3, Z3, T3);
+      }
+      subtract(other) {
+        return this.add(other.negate());
+      }
+      // Constant-time multiplication.
+      multiply(scalar) {
+        if (!Fn2.isValidNot0(scalar))
+          throw new Error("invalid scalar: expected 1 <= sc < curve.n");
+        const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
+        return normalizeZ(Point, [p, f])[0];
+      }
+      // Non-constant-time multiplication. Uses double-and-add algorithm.
+      // It's faster, but should only be used when you don't care about
+      // an exposed private key e.g. sig verification.
+      // Does NOT allow scalars higher than CURVE.n.
+      // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+      multiplyUnsafe(scalar, acc = Point.ZERO) {
+        if (!Fn2.isValid(scalar))
+          throw new Error("invalid scalar: expected 0 <= sc < curve.n");
+        if (scalar === _0n4)
+          return Point.ZERO;
+        if (this.is0() || scalar === _1n4)
+          return this;
+        return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);
+      }
+      // Checks if point is of small order.
+      // If you add something to small order point, you will have "dirty"
+      // point with torsion component.
+      // Multiplies point by cofactor and checks if the result is 0.
+      isSmallOrder() {
+        return this.multiplyUnsafe(cofactor).is0();
+      }
+      // Multiplies point by curve order and checks if the result is 0.
+      // Returns `false` is the point is dirty.
+      isTorsionFree() {
+        return wnaf.unsafe(this, CURVE.n).is0();
+      }
+      // Converts Extended point to default (x, y) coordinates.
+      // Can accept precomputed Z^-1 - for example, from invertBatch.
+      toAffine(invertedZ) {
+        return toAffineMemo(this, invertedZ);
+      }
+      clearCofactor() {
+        if (cofactor === _1n4)
+          return this;
+        return this.multiplyUnsafe(cofactor);
+      }
+      toBytes() {
+        const { x, y } = this.toAffine();
+        const bytes = Fp2.toBytes(y);
+        bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
+        return bytes;
+      }
+      toHex() {
+        return bytesToHex(this.toBytes());
+      }
+      toString() {
+        return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+      }
+      // TODO: remove
+      get ex() {
+        return this.X;
+      }
+      get ey() {
+        return this.Y;
+      }
+      get ez() {
+        return this.Z;
+      }
+      get et() {
+        return this.T;
+      }
+      static normalizeZ(points) {
+        return normalizeZ(Point, points);
+      }
+      static msm(points, scalars) {
+        return pippenger(Point, Fn2, points, scalars);
+      }
+      _setWindowSize(windowSize) {
+        this.precompute(windowSize);
+      }
+      toRawBytes() {
+        return this.toBytes();
+      }
+    }
+    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
+    Point.ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
+    Point.Fp = Fp2;
+    Point.Fn = Fn2;
+    const wnaf = new wNAF(Point, Fn2.BITS);
+    Point.BASE.precompute(8);
+    return Point;
+  }
+  var PrimeEdwardsPoint = class {
+    constructor(ep) {
+      this.ep = ep;
+    }
+    // Static methods that must be implemented by subclasses
+    static fromBytes(_bytes) {
+      notImplemented();
+    }
+    static fromHex(_hex) {
+      notImplemented();
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    // Common implementations
+    clearCofactor() {
+      return this;
     }
-    if (pending.length === 0) {
-      if (hadSynchronousError)
-        throw new Error("manifest signature verifier unavailable");
-      return false;
+    assertValidity() {
+      this.ep.assertValidity();
     }
-    return Promise.all(pending).then((results) => {
-      if (results.some((valid) => valid === true))
-        return true;
-      if (hadSynchronousError || results.some((valid) => valid === "error")) {
-        throw new Error("manifest signature verifier unavailable");
-      }
-      return false;
-    });
-  };
-  failGroup_fn = function(track, groupId, group, reason) {
-    if (group.pending.size === 0) {
-      __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, groupId, objectId: 0 }, reason);
-      return;
+    toAffine(invertedZ) {
+      return this.ep.toAffine(invertedZ);
     }
-    for (const pending of [...group.pending.values()]) {
-      __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-      if (__privateMethod(this, _ManifestVerifier_instances, rejectOrShadow_fn).call(this, pending.identity, pending.release, reason).action === "drop") {
-        pending.discard?.();
-      }
+    toHex() {
+      return bytesToHex(this.toBytes());
     }
-  };
-  removePending_fn = function(track, group, pending) {
-    if (group.pending.get(pending.identity.objectId) === pending) {
-      group.pending.delete(pending.identity.objectId);
-    }
-    const index = track.quarantine.indexOf(pending);
-    if (index >= 0)
-      track.quarantine.splice(index, 1);
-    track.quarantinedBytes -= pending.bytes;
-    __privateGet(this, _stats4).quarantinedBytes -= pending.bytes;
-  };
-  quarantine_fn = function(track, group, pending) {
-    if (group.pending.has(pending.identity.objectId))
+    toString() {
+      return this.toHex();
+    }
+    isTorsionFree() {
+      return true;
+    }
+    isSmallOrder() {
       return false;
-    group.pending.set(pending.identity.objectId, pending);
-    track.quarantine.push(pending);
-    track.quarantinedBytes += pending.bytes;
-    __privateGet(this, _stats4).quarantinedBytes += pending.bytes;
-    __privateMethod(this, _ManifestVerifier_instances, enforceCap_fn).call(this, track);
-    return true;
-  };
-  enforceCap_fn = function(track) {
-    while (track.quarantinedBytes > track.capBytes && track.quarantine.length > 0) {
-      const pending = track.quarantine.shift();
-      const group = track.groups.get(BigInt(pending.identity.groupId));
-      if (group)
-        group.pending.delete(pending.identity.objectId);
-      track.quarantinedBytes -= pending.bytes;
-      __privateGet(this, _stats4).quarantinedBytes -= pending.bytes;
-      __privateMethod(this, _ManifestVerifier_instances, giveUpOnPending_fn).call(this, pending);
-      __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "manifestAbsent");
-      console.warn(`[ManifestVerifier] quarantine cap eviction track=${pending.identity.trackName} group=${pending.identity.groupId} object=${pending.identity.objectId} disposition=${__privateGet(this, _config).mode === "enforce" ? "drop" : "fail-open"}`);
     }
-  };
-  /**
-   * Stop waiting for a manifest that never arrived. In `enforce` the object is
-   * discarded: an eviction is a rejection, not a deferred play, so unverified
-   * media never reaches the player two groups after the stall was recorded
-   * (BLO-30095, CTO disposition on the issue thread).
-   *
-   * Deliberately NOT used by `#failOpenGroup`/`#failOpenTrack` — failing open on
-   * a genuine verifier fault is correct and stays untouched.
-   */
-  giveUpOnPending_fn = function(pending) {
-    if (__privateGet(this, _config).mode !== "enforce") {
-      pending.release();
-      return;
+    add(other) {
+      this.assertSame(other);
+      return this.init(this.ep.add(other.ep));
     }
-    pending.discard?.();
-  };
-  failOpenTrack_fn = function(track, reason) {
-    for (const pending of [...track.quarantine]) {
-      const group = track.groups.get(BigInt(pending.identity.groupId));
-      if (group)
-        __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-      pending.release();
-      __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, reason);
+    subtract(other) {
+      this.assertSame(other);
+      return this.init(this.ep.subtract(other.ep));
     }
-  };
-  failOpenGroup_fn = function(track, groupId, group) {
-    const pending = [...group.pending.values()];
-    if (pending.length === 0) {
-      __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, { trackName: track.context.trackName, groupId, objectId: 0 }, "verifierError");
-      return;
+    multiply(scalar) {
+      return this.init(this.ep.multiply(scalar));
     }
-    for (const object of pending) {
-      __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, object);
-      object.release();
-      __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, object.identity, "verifierError");
+    multiplyUnsafe(scalar) {
+      return this.init(this.ep.multiplyUnsafe(scalar));
     }
-  };
-  releaseAllQuarantine_fn = function(countFailure) {
-    for (const track of __privateGet(this, _tracks2).values()) {
-      for (const pending of [...track.quarantine]) {
-        const group = track.groups.get(BigInt(pending.identity.groupId));
-        if (group)
-          __privateMethod(this, _ManifestVerifier_instances, removePending_fn).call(this, track, group, pending);
-        pending.release();
-        if (countFailure)
-          __privateMethod(this, _ManifestVerifier_instances, failure_fn).call(this, pending.identity, "verifierError");
-      }
+    double() {
+      return this.init(this.ep.double());
+    }
+    negate() {
+      return this.init(this.ep.negate());
+    }
+    precompute(windowSize, isLazy) {
+      return this.init(this.ep.precompute(windowSize, isLazy));
+    }
+    /** @deprecated use `toBytes` */
+    toRawBytes() {
+      return this.toBytes();
     }
   };
-  failure_fn = function(identity, reason) {
-    var _a;
-    __privateGet(this, _stats4).failures[reason]++;
-    (_a = __privateGet(this, _onFailure)) == null ? void 0 : _a.call(this, {
-      trackName: identity.trackName,
-      ...identity.bindingId === void 0 ? {} : { bindingId: identity.bindingId },
-      groupId: identity.groupId,
-      objectId: identity.objectId,
-      reason
+  function eddsa(Point, cHash, eddsaOpts = {}) {
+    if (typeof cHash !== "function")
+      throw new Error('"hash" function param is required');
+    _validateObject(eddsaOpts, {}, {
+      adjustScalarBytes: "function",
+      randomBytes: "function",
+      domain: "function",
+      prehash: "function",
+      mapToCurve: "function"
     });
-  };
-
-  // ../mmt-manifest-verify/dist/bc-provenance-v2.js
-  var BCPV2_HEADER_LENGTH = 68;
-  var BCPV2_SIGNATURE_LENGTH = 64;
-  var BCPV2_MIN_RECORD_LENGTH = BCPV2_HEADER_LENGTH + 32 + BCPV2_SIGNATURE_LENGTH;
-  var text = new TextEncoder();
-  var MAGIC = Uint8Array.from([77, 72, 77, 50]);
-  var SIGNING_DOMAIN = text.encode("mcast-manifest-v2\0");
-
-  // src/multicast-auth-catalog.ts
-  var RAW_ED25519_KEY_LENGTH = 32;
-  var DEFAULT_MAX_AUTH_DELAY_MS = 200;
-  var DEFAULT_MANIFEST_TIMER_MS = 20;
-  var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-  function encodeBase64Url(bytes) {
-    let output = "";
-    for (let i = 0; i < bytes.length; i += 3) {
-      const b0 = bytes[i];
-      const b1 = bytes[i + 1];
-      const b2 = bytes[i + 2];
-      output += BASE64URL_ALPHABET[b0 >> 2];
-      output += BASE64URL_ALPHABET[(b0 & 3) << 4 | (b1 === void 0 ? 0 : b1 >> 4)];
-      if (b1 === void 0) break;
-      output += BASE64URL_ALPHABET[(b1 & 15) << 2 | (b2 === void 0 ? 0 : b2 >> 6)];
-      if (b2 === void 0) break;
-      output += BASE64URL_ALPHABET[b2 & 63];
-    }
-    return output;
-  }
-  var BASE64URL_DECODE_TABLE = (() => {
-    const table = new Int8Array(128).fill(-1);
-    for (let i = 0; i < BASE64URL_ALPHABET.length; i++) {
-      table[BASE64URL_ALPHABET.charCodeAt(i)] = i;
-    }
-    return table;
-  })();
-  function decodeBase64Url(text2) {
-    if (text2.length % 4 === 1) {
-      throw new Error(`[multicast-auth-catalog] invalid unpadded base64url length for "${text2}"`);
-    }
-    const bytes = [];
-    let buffer = 0;
-    let bits = 0;
-    for (let i = 0; i < text2.length; i++) {
-      const code = text2.charCodeAt(i);
-      const value = code < 128 ? BASE64URL_DECODE_TABLE[code] : -1;
-      if (value === void 0 || value < 0) {
-        throw new Error(`[multicast-auth-catalog] invalid base64url character in "${text2}"`);
-      }
-      buffer = buffer << 6 | value;
-      bits += 6;
-      if (bits >= 8) {
-        bits -= 8;
-        bytes.push(buffer >> bits & 255);
-      }
-    }
-    const decoded = Uint8Array.from(bytes);
-    if (encodeBase64Url(decoded) !== text2) {
-      throw new Error(`[multicast-auth-catalog] non-canonical base64url encoding "${text2}"`);
-    }
-    return decoded;
-  }
-  function decodeEd25519PublicKey(publicKey) {
-    const bytes = decodeBase64Url(publicKey);
-    if (bytes.byteLength !== RAW_ED25519_KEY_LENGTH) {
-      throw new Error(
-        `[multicast-auth-catalog] public key must decode to ${RAW_ED25519_KEY_LENGTH} raw bytes, got ${bytes.byteLength}`
-      );
+    const { prehash } = eddsaOpts;
+    const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
+    const randomBytes2 = eddsaOpts.randomBytes || randomBytes;
+    const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
+    const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
+      _abool2(phflag, "phflag");
+      if (ctx.length || phflag)
+        throw new Error("Contexts/pre-hash are not supported");
+      return data;
+    });
+    function modN_LE(hash) {
+      return Fn2.create(bytesToNumberLE(hash));
+    }
+    function getPrivateScalar(key) {
+      const len = lengths.secretKey;
+      key = ensureBytes("private key", key, len);
+      const hashed = ensureBytes("hashed private key", cHash(key), 2 * len);
+      const head = adjustScalarBytes2(hashed.slice(0, len));
+      const prefix = hashed.slice(len, 2 * len);
+      const scalar = modN_LE(head);
+      return { head, prefix, scalar };
+    }
+    function getExtendedPublicKey(secretKey) {
+      const { head, prefix, scalar } = getPrivateScalar(secretKey);
+      const point = BASE.multiply(scalar);
+      const pointBytes = point.toBytes();
+      return { head, prefix, scalar, point, pointBytes };
+    }
+    function getPublicKey(secretKey) {
+      return getExtendedPublicKey(secretKey).pointBytes;
+    }
+    function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
+      const msg = concatBytes(...msgs);
+      return modN_LE(cHash(domain(msg, ensureBytes("context", context), !!prehash)));
+    }
+    function sign(msg, secretKey, options = {}) {
+      msg = ensureBytes("message", msg);
+      if (prehash)
+        msg = prehash(msg);
+      const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
+      const r = hashDomainToScalar(options.context, prefix, msg);
+      const R = BASE.multiply(r).toBytes();
+      const k = hashDomainToScalar(options.context, R, pointBytes, msg);
+      const s = Fn2.create(r + k * scalar);
+      if (!Fn2.isValid(s))
+        throw new Error("sign failed: invalid s");
+      const rs = concatBytes(R, Fn2.toBytes(s));
+      return _abytes2(rs, lengths.signature, "result");
+    }
+    const verifyOpts = { zip215: true };
+    function verify(sig, msg, publicKey, options = verifyOpts) {
+      const { context, zip215 } = options;
+      const len = lengths.signature;
+      sig = ensureBytes("signature", sig, len);
+      msg = ensureBytes("message", msg);
+      publicKey = ensureBytes("publicKey", publicKey, lengths.publicKey);
+      if (zip215 !== void 0)
+        _abool2(zip215, "zip215");
+      if (prehash)
+        msg = prehash(msg);
+      const mid = len / 2;
+      const r = sig.subarray(0, mid);
+      const s = bytesToNumberLE(sig.subarray(mid, len));
+      let A, R, SB;
+      try {
+        A = Point.fromBytes(publicKey, zip215);
+        R = Point.fromBytes(r, zip215);
+        SB = BASE.multiplyUnsafe(s);
+      } catch (error) {
+        return false;
+      }
+      if (!zip215 && A.isSmallOrder())
+        return false;
+      const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);
+      const RkA = R.add(A.multiplyUnsafe(k));
+      return RkA.subtract(SB).clearCofactor().is0();
+    }
+    const _size = Fp2.BYTES;
+    const lengths = {
+      secretKey: _size,
+      publicKey: _size,
+      signature: 2 * _size,
+      seed: _size
+    };
+    function randomSecretKey(seed = randomBytes2(lengths.seed)) {
+      return _abytes2(seed, lengths.seed, "seed");
     }
-    return bytes;
-  }
-  function resolveMulticastAuthCatalog(catalog, options = {}) {
-    if (typeof catalog !== "object" || catalog === null || Array.isArray(catalog)) {
-      throw new Error("[multicast-auth-catalog] catalog must be an object");
+    function keygen(seed) {
+      const secretKey = utils.randomSecretKey(seed);
+      return { secretKey, publicKey: getPublicKey(secretKey) };
     }
-    const issues = multicastCatalogIssues(catalog, options);
-    const fatal = issues.find((issue) => issue.endpointIndex === void 0);
-    if (fatal) throw new Error(`[multicast-auth-catalog] ${fatal.path}: ${fatal.message}`);
-    const multicast = catalog["multicast"];
-    const auth = multicast?.["auth"];
-    if (auth === void 0) {
-      if (options.requireAuth) {
-        throw new Error("[multicast-auth-catalog] authentication is pinned but the catalog declares no multicast.auth");
+    function isValidSecretKey(key) {
+      return isBytes(key) && key.length === Fn2.BYTES;
+    }
+    function isValidPublicKey(key, zip215) {
+      try {
+        return !!Point.fromBytes(key, zip215);
+      } catch (error) {
+        return false;
       }
-      return void 0;
     }
-    const ignored = new Set(issues.map((issue) => issue.endpointIndex));
-    const endpoints = multicast["endpoints"] ?? [];
-    const flows = [];
-    endpoints.forEach((endpoint, endpointIndex) => {
-      if (ignored.has(endpointIndex)) return;
-      const flowAuth = endpoint["auth"];
-      flows.push({
-        endpointIndex,
-        source: endpoint["sourceAddress"] ?? flowAuth.senderAddress,
-        groupAddress: endpoint["groupAddress"],
-        port: endpoint["port"],
-        bandwidth: endpoint["bandwidth"],
-        manifestPort: flowAuth.manifestPort,
-        streamId: flowAuth.streamId,
-        maxAuthDelayMs: flowAuth.maxAuthDelayMs ?? DEFAULT_MAX_AUTH_DELAY_MS,
-        manifestTimerMs: flowAuth.manifestTimerMs ?? DEFAULT_MANIFEST_TIMER_MS,
-        ...flowAuth.manifestTrack === void 0 ? {} : { manifestTrack: flowAuth.manifestTrack },
-        tracks: (endpoint["tracks"] ?? []).map(({ name, packetId }) => ({
-          name,
-          packetId
-        }))
-      });
+    const utils = {
+      getExtendedPublicKey,
+      randomSecretKey,
+      isValidSecretKey,
+      isValidPublicKey,
+      /**
+       * Converts ed public key to x public key. Uses formula:
+       * - ed25519:
+       *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
+       *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
+       * - ed448:
+       *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
+       *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
+       */
+      toMontgomery(publicKey) {
+        const { y } = Point.fromBytes(publicKey);
+        const size = lengths.publicKey;
+        const is25519 = size === 32;
+        if (!is25519 && size !== 57)
+          throw new Error("only defined for 25519 and 448");
+        const u = is25519 ? Fp2.div(_1n4 + y, _1n4 - y) : Fp2.div(y - _1n4, y + _1n4);
+        return Fp2.toBytes(u);
+      },
+      toMontgomerySecret(secretKey) {
+        const size = lengths.secretKey;
+        _abytes2(secretKey, size);
+        const hashed = cHash(secretKey.subarray(0, size));
+        return adjustScalarBytes2(hashed).subarray(0, size);
+      },
+      /** @deprecated */
+      randomPrivateKey: randomSecretKey,
+      /** @deprecated */
+      precompute(windowSize = 8, point = Point.BASE) {
+        return point.precompute(windowSize, false);
+      }
+    };
+    return Object.freeze({
+      keygen,
+      getPublicKey,
+      sign,
+      verify,
+      utils,
+      Point,
+      lengths
     });
-    return {
-      keys: auth.keys.map((key) => ({ kid: key.kid, publicKey: decodeEd25519PublicKey(key.publicKey), firstEpoch: key.firstEpoch })).sort((a, b) => a.firstEpoch - b.firstEpoch),
-      minEpoch: auth.minEpoch,
-      flows
+  }
+  function _eddsa_legacy_opts_to_new(c) {
+    const CURVE = {
+      a: c.a,
+      d: c.d,
+      p: c.Fp.ORDER,
+      n: c.n,
+      h: c.h,
+      Gx: c.Gx,
+      Gy: c.Gy
     };
+    const Fp2 = c.Fp;
+    const Fn2 = Field(CURVE.n, c.nBitLength, true);
+    const curveOpts = { Fp: Fp2, Fn: Fn2, uvRatio: c.uvRatio };
+    const eddsaOpts = {
+      randomBytes: c.randomBytes,
+      adjustScalarBytes: c.adjustScalarBytes,
+      domain: c.domain,
+      prehash: c.prehash,
+      mapToCurve: c.mapToCurve
+    };
+    return { CURVE, curveOpts, hash: c.hash, eddsaOpts };
+  }
+  function _eddsa_new_output_to_legacy(c, eddsa2) {
+    const Point = eddsa2.Point;
+    const legacy = Object.assign({}, eddsa2, {
+      ExtendedPoint: Point,
+      CURVE: c,
+      nBitLength: Point.Fn.BITS,
+      nByteLength: Point.Fn.BYTES
+    });
+    return legacy;
   }
-  function multicastAuthKeyFor(resolved, kid, epoch) {
-    return manifestKeyFor(resolved.keys, epoch, kid);
+  function twistedEdwards(c) {
+    const { CURVE, curveOpts, hash, eddsaOpts } = _eddsa_legacy_opts_to_new(c);
+    const Point = edwards(CURVE, curveOpts);
+    const EDDSA = eddsa(Point, hash, eddsaOpts);
+    return _eddsa_new_output_to_legacy(c, EDDSA);
   }
 
-  // src/manifest-auth-plan.ts
-  function createManifestAuthPlan(catalog, options = {}) {
-    const resolved = resolveMulticastAuthCatalog(catalog, options);
-    if (!resolved) return void 0;
-    const byManifestTrack = /* @__PURE__ */ new Map();
-    for (const flow of resolved.flows) {
-      if (flow.manifestTrack !== void 0) byManifestTrack.set(flow.manifestTrack, flow);
+  // ../mmt-manifest-verify/node_modules/@noble/curves/esm/ed25519.js
+  var _0n5 = /* @__PURE__ */ BigInt(0);
+  var _1n5 = BigInt(1);
+  var _2n3 = BigInt(2);
+  var _3n2 = BigInt(3);
+  var _5n2 = BigInt(5);
+  var _8n3 = BigInt(8);
+  var ed25519_CURVE_p = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+  var ed25519_CURVE = /* @__PURE__ */ (() => ({
+    p: ed25519_CURVE_p,
+    n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+    h: _8n3,
+    a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+    d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+    Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+    Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+  }))();
+  function ed25519_pow_2_252_3(x) {
+    const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+    const P = ed25519_CURVE_p;
+    const x2 = x * x % P;
+    const b2 = x2 * x % P;
+    const b4 = pow2(b2, _2n3, P) * b2 % P;
+    const b5 = pow2(b4, _1n5, P) * x % P;
+    const b10 = pow2(b5, _5n2, P) * b5 % P;
+    const b20 = pow2(b10, _10n, P) * b10 % P;
+    const b40 = pow2(b20, _20n, P) * b20 % P;
+    const b80 = pow2(b40, _40n, P) * b40 % P;
+    const b160 = pow2(b80, _80n, P) * b80 % P;
+    const b240 = pow2(b160, _80n, P) * b80 % P;
+    const b250 = pow2(b240, _10n, P) * b10 % P;
+    const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
+    return { pow_p_5_8, b2 };
+  }
+  function adjustScalarBytes(bytes) {
+    bytes[0] &= 248;
+    bytes[31] &= 127;
+    bytes[31] |= 64;
+    return bytes;
+  }
+  var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+  function uvRatio(u, v) {
+    const P = ed25519_CURVE_p;
+    const v3 = mod(v * v * v, P);
+    const v7 = mod(v3 * v3 * v, P);
+    const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+    let x = mod(u * v3 * pow, P);
+    const vx2 = mod(v * x * x, P);
+    const root1 = x;
+    const root2 = mod(x * ED25519_SQRT_M1, P);
+    const useRoot1 = vx2 === u;
+    const useRoot2 = vx2 === mod(-u, P);
+    const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+    if (useRoot1)
+      x = root1;
+    if (useRoot2 || noRoot)
+      x = root2;
+    if (isNegativeLE(x, P))
+      x = mod(-x, P);
+    return { isValid: useRoot1 || useRoot2, value: x };
+  }
+  var Fp = /* @__PURE__ */ (() => Field(ed25519_CURVE.p, { isLE: true }))();
+  var Fn = /* @__PURE__ */ (() => Field(ed25519_CURVE.n, { isLE: true }))();
+  var ed25519Defaults = /* @__PURE__ */ (() => ({
+    ...ed25519_CURVE,
+    Fp,
+    hash: sha512,
+    adjustScalarBytes,
+    // dom2
+    // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+    // Constant-time, u/√v
+    uvRatio
+  }))();
+  var ed25519 = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();
+  var SQRT_M1 = ED25519_SQRT_M1;
+  var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+  var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+  var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+  var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+  var invertSqrt = (number) => uvRatio(_1n5, number);
+  var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+  var bytes255ToNumberLE = (bytes) => ed25519.Point.Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+  function calcElligatorRistrettoMap(r0) {
+    const { d } = ed25519_CURVE;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const r = mod2(SQRT_M1 * r0 * r0);
+    const Ns = mod2((r + _1n5) * ONE_MINUS_D_SQ);
+    let c = BigInt(-1);
+    const D = mod2((c - d * r) * mod2(r + d));
+    let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+    let s_ = mod2(s * r0);
+    if (!isNegativeLE(s_, P))
+      s_ = mod2(-s_);
+    if (!Ns_D_is_sq)
+      s = s_;
+    if (!Ns_D_is_sq)
+      c = r;
+    const Nt = mod2(c * (r - _1n5) * D_MINUS_ONE_SQ - D);
+    const s2 = s * s;
+    const W0 = mod2((s + s) * D);
+    const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
+    const W2 = mod2(_1n5 - s2);
+    const W3 = mod2(_1n5 + s2);
+    return new ed25519.Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
+  }
+  function ristretto255_map(bytes) {
+    abytes(bytes, 64);
+    const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
+    const R1 = calcElligatorRistrettoMap(r1);
+    const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
+    const R2 = calcElligatorRistrettoMap(r2);
+    return new _RistrettoPoint(R1.add(R2));
+  }
+  var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
+    constructor(ep) {
+      super(ep);
+    }
+    static fromAffine(ap) {
+      return new __RistrettoPoint(ed25519.Point.fromAffine(ap));
+    }
+    assertSame(other) {
+      if (!(other instanceof __RistrettoPoint))
+        throw new Error("RistrettoPoint expected");
+    }
+    init(ep) {
+      return new __RistrettoPoint(ep);
+    }
+    /** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+    static hashToCurve(hex2) {
+      return ristretto255_map(ensureBytes("ristrettoHash", hex2, 64));
+    }
+    static fromBytes(bytes) {
+      abytes(bytes, 32);
+      const { a, d } = ed25519_CURVE;
+      const P = ed25519_CURVE_p;
+      const mod2 = (n) => Fp.create(n);
+      const s = bytes255ToNumberLE(bytes);
+      if (!equalBytes2(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
+        throw new Error("invalid ristretto255 encoding 1");
+      const s2 = mod2(s * s);
+      const u1 = mod2(_1n5 + a * s2);
+      const u2 = mod2(_1n5 - a * s2);
+      const u1_2 = mod2(u1 * u1);
+      const u2_2 = mod2(u2 * u2);
+      const v = mod2(a * d * u1_2 - u2_2);
+      const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
+      const Dx = mod2(I * u2);
+      const Dy = mod2(I * Dx * v);
+      let x = mod2((s + s) * Dx);
+      if (isNegativeLE(x, P))
+        x = mod2(-x);
+      const y = mod2(u1 * Dy);
+      const t = mod2(x * y);
+      if (!isValid || isNegativeLE(t, P) || y === _0n5)
+        throw new Error("invalid ristretto255 encoding 2");
+      return new __RistrettoPoint(new ed25519.Point(x, y, _1n5, t));
     }
-    return {
-      keys: resolved.keys,
-      minEpoch: resolved.minEpoch,
-      flows: resolved.flows,
-      manifestTracks: [...byManifestTrack.keys()],
-      keyFor: (kid, epoch) => multicastAuthKeyFor(resolved, kid, epoch),
-      flowForManifestPort: (source, groupAddress, manifestPort) => resolved.flows.find((flow) => flow.source === source && flow.groupAddress === groupAddress && flow.manifestPort === manifestPort),
-      flowForManifestTrack: (manifestTrack) => byManifestTrack.get(manifestTrack)
-    };
+    /**
+     * Converts ristretto-encoded string to ristretto point.
+     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+     * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+     */
+    static fromHex(hex2) {
+      return __RistrettoPoint.fromBytes(ensureBytes("ristrettoHex", hex2, 32));
+    }
+    static msm(points, scalars) {
+      return pippenger(__RistrettoPoint, ed25519.Point.Fn, points, scalars);
+    }
+    /**
+     * Encodes ristretto point to Uint8Array.
+     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+     */
+    toBytes() {
+      let { X, Y, Z, T } = this.ep;
+      const P = ed25519_CURVE_p;
+      const mod2 = (n) => Fp.create(n);
+      const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
+      const u2 = mod2(X * Y);
+      const u2sq = mod2(u2 * u2);
+      const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
+      const D1 = mod2(invsqrt * u1);
+      const D2 = mod2(invsqrt * u2);
+      const zInv = mod2(D1 * D2 * T);
+      let D;
+      if (isNegativeLE(T * zInv, P)) {
+        let _x = mod2(Y * SQRT_M1);
+        let _y = mod2(X * SQRT_M1);
+        X = _x;
+        Y = _y;
+        D = mod2(D1 * INVSQRT_A_MINUS_D);
+      } else {
+        D = D2;
+      }
+      if (isNegativeLE(X * zInv, P))
+        Y = mod2(-Y);
+      let s = mod2((Z - Y) * D);
+      if (isNegativeLE(s, P))
+        s = mod2(-s);
+      return Fp.toBytes(s);
+    }
+    /**
+     * Compares two Ristretto points.
+     * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+     */
+    equals(other) {
+      this.assertSame(other);
+      const { X: X1, Y: Y1 } = this.ep;
+      const { X: X2, Y: Y2 } = other.ep;
+      const mod2 = (n) => Fp.create(n);
+      const one = mod2(X1 * Y2) === mod2(Y1 * X2);
+      const two = mod2(Y1 * Y2) === mod2(X1 * X2);
+      return one || two;
+    }
+    is0() {
+      return this.equals(__RistrettoPoint.ZERO);
+    }
+  };
+  _RistrettoPoint.BASE = /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.BASE))();
+  _RistrettoPoint.ZERO = /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.ZERO))();
+  _RistrettoPoint.Fp = /* @__PURE__ */ (() => Fp)();
+  _RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
+
+  // ../mmt-manifest-verify/dist/bc-provenance-v2-receiver.js
+  var BCPV2_LEAD_BOUND_MS = 5e3;
+  var REPLAY_WINDOW = 64n;
+  var BUCKET_DEPTH = 64;
+  var BUCKET_RATE_PER_MS = 1;
+  var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  function sameBytes(a, b) {
+    if (a.byteLength !== b.byteLength)
+      return false;
+    let diff = 0;
+    for (let i = 0; i < a.byteLength; i++)
+      diff |= a[i] ^ b[i];
+    return diff === 0;
   }
+  var BcProvenanceV2Receiver = class {
+    constructor(cfg) {
+      __publicField(this, "maxAuthDelayMs");
+      __publicField(this, "manifestTimerMs");
+      __publicField(this, "widenMs");
+      /** Datagrams that left a hold queue at expiry, per path: the loss signal for failover. */
+      __publicField(this, "expired", { multicast: 0, unicast: 0 });
+      /**
+       * Unicast repair (Section 7.2.7 step 2): on a receiver that can request it, how
+       * long ago (ms) the first packet admitted into the oldest open block with an FEC
+       * deadline was admitted; undefined with none open. A pending entry still live
+       * then is kept instead of expiring, and is released with the block, under the
+       * open-block bound of [MOQ-FEC] Section 9.
+       */
+      __publicField(this, "keepPendingAgeMs", null);
+      __publicField(this, "cfg");
+      __publicField(this, "now");
+      __publicField(this, "verifySig");
+      __publicField(this, "accepted");
+      __publicField(this, "queueLimit");
+      __publicField(this, "current", null);
+      __publicField(this, "previous", null);
+      __publicField(this, "graceStart", {});
+      __publicField(this, "hashAlg", null);
+      __publicField(this, "verified", /* @__PURE__ */ new Map());
+      __publicField(this, "highest", { multicast: /* @__PURE__ */ new Map(), mirror: /* @__PURE__ */ new Map() });
+      __publicField(this, "closedAt", /* @__PURE__ */ new Map());
+      __publicField(this, "lead", null);
+      __publicField(this, "pending", /* @__PURE__ */ new Map());
+      __publicField(this, "admittedUntil", /* @__PURE__ */ new Map());
+      __publicField(this, "hold", { multicast: [], unicast: [] });
+      __publicField(this, "holdBytes", { multicast: 0, unicast: 0 });
+      __publicField(this, "order", 0);
+      __publicField(this, "buckets");
+      this.maxAuthDelayMs = cfg.maxAuthDelayMs ?? 200;
+      this.manifestTimerMs = cfg.manifestTimerMs ?? 20;
+      if (!(this.maxAuthDelayMs >= 50 && this.maxAuthDelayMs <= 1e3) || !(this.manifestTimerMs >= 1)) {
+        throw new Error("BCPV2 endpoint ignored: maxAuthDelayMs or manifestTimerMs out of range");
+      }
+      if (!(cfg.bandwidth > 0))
+        throw new Error("BCPV2 endpoint ignored: protected endpoint without bandwidth");
+      const kids = new Set(cfg.keys.map((k) => k.kid));
+      const firsts = new Set(cfg.keys.map((k) => k.firstEpoch));
+      if (cfg.keys.length < 1 || kids.size !== cfg.keys.length || firsts.size !== cfg.keys.length) {
+        throw new Error("BCPV2 key set invalid: no keys, or a repeated kid or firstEpoch");
+      }
+      this.cfg = cfg;
+      this.widenMs = Math.min(Math.max(cfg.widenMs ?? 0, 0), BCPV2_LEAD_BOUND_MS);
+      this.now = cfg.now ?? Date.now;
+      this.verifySig = cfg.verifySignature ?? ((pk, msg, sig) => {
+        try {
+          return ed25519.verify(sig, msg, pk, { zip215: false });
+        } catch {
+          return false;
+        }
+      });
+      this.accepted = cfg.acceptedHashAlgs ?? [BCPV2_HASH_ALG_SHA256];
+      const bandwidth = Math.min(cfg.bandwidth, 1e10);
+      this.queueLimit = {
+        multicast: this.maxAuthDelayMs * bandwidth / 8e3,
+        unicast: (this.maxAuthDelayMs + this.widenMs) * bandwidth / 8e3
+      };
+      const t = this.now();
+      this.buckets = {
+        multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
+        mirror: { tokens: BUCKET_DEPTH, last: t, dropped: 0 }
+      };
+    }
+    get grace() {
+      return this.maxAuthDelayMs + 2 * this.manifestTimerMs;
+    }
+    /** The mirror's lead in force: 0 without a manifest track, the bound until one is measured. */
+    get leadMs() {
+      if (!this.cfg.applyLead)
+        return 0;
+      return this.lead ?? BCPV2_LEAD_BOUND_MS;
+    }
+    /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+    onRecord(bytes, path) {
+      var _a;
+      const now = this.now();
+      this.expire(now);
+      const drop = (verdict) => ({ verdict, admitted: [] });
+      const len = bytes.byteLength;
+      if (len < BCPV2_MIN_RECORD_LENGTH || len > BCPV2_MAX_RECORD_LENGTH || (len - 132) % 32 !== 0)
+        return drop("length");
+      const view2 = new DataView(bytes.buffer, bytes.byteOffset, len);
+      if (view2.getUint32(0) !== 1296583986)
+        return drop("magic");
+      const kid = view2.getUint32(4);
+      const epoch = view2.getUint32(8);
+      const mseq = view2.getBigUint64(12);
+      const count = view2.getUint16(28);
+      const hashAlg = bytes[30];
+      const sent = view2.getUint32(32);
+      const key = this.cfg.keys.find((k) => k.kid === kid);
+      if (!key)
+        return drop("kid");
+      const next = Math.min(...this.cfg.keys.map((k) => k.firstEpoch).filter((f) => f > key.firstEpoch), Infinity);
+      if (epoch < key.firstEpoch || epoch >= next)
+        return drop("epoch");
+      const id = `${kid}:${epoch}:${mseq}`;
+      const seen = this.verified.get(id);
+      if (seen) {
+        const admitted2 = hex(sha2562(bytes)) === seen.digest ? this.arrival(seen, path, now) : [];
+        return { verdict: "duplicate", admitted: admitted2 };
+      }
+      const ke = `${kid}:${epoch}`;
+      if (this.current === null) {
+        if (epoch < this.cfg.minEpoch || epoch < (this.cfg.pinnedEpochFloor?.get(kid) ?? 0))
+          return drop("epoch");
+      } else if (epoch < this.current.epoch && !this.previousAdmitted(epoch, path, now)) {
+        return drop("epoch");
+      }
+      const floor = this.floor(ke, path);
+      if (floor !== void 0 && mseq <= floor - REPLAY_WINDOW)
+        return drop("mseq");
+      const closed = this.closedAt.get(ke);
+      if (closed !== void 0 && mseq > closed)
+        return drop("closed");
+      if (this.cfg.checkFreshness !== false) {
+        const behind = 7e3 + this.maxAuthDelayMs + (path === "mirror" ? this.widenMs : 0);
+        if (sent * 1e3 < now - behind || sent * 1e3 > now + 6e3)
+          return drop("sent");
+      }
+      if (count !== (len - 132) / 32)
+        return drop("count");
+      if (!this.accepted.includes(hashAlg) || this.hashAlg !== null && hashAlg !== this.hashAlg)
+        return drop("hash_alg");
+      if (this.cfg.catalogCtx && !sameBytes(bytes.subarray(36, 68), this.cfg.catalogCtx))
+        return drop("ctx");
+      if (!this.take(path, now))
+        return drop("budget");
+      const record = decodeBcProvenanceV2Record(bytes);
+      if (!this.verifySig(key.publicKey, bcProvenanceV2SignedMessage(record, this.cfg.endpoint), record.signature)) {
+        return drop("signature");
+      }
+      if (this.current === null || epoch > this.current.epoch) {
+        if (this.current !== null) {
+          this.previous = { epoch: this.current.epoch, deadline: now + BCPV2_LEAD_BOUND_MS + this.grace };
+        }
+        this.current = { epoch, since: now };
+        this.graceStart = { [path]: now };
+        if (this.hashAlg === null) {
+          this.hashAlg = hashAlg;
+          for (const queue of Object.values(this.hold)) {
+            for (const held of queue)
+              held.digest ?? (held.digest = this.digest(held.datagram));
+          }
+        }
+      } else if (epoch === this.current.epoch) {
+        (_a = this.graceStart)[path] ?? (_a[path] = now);
+      }
+      const entry = {
+        kid,
+        epoch,
+        mseq,
+        path,
+        arrival: now,
+        sent,
+        digest: hex(sha2562(bytes)),
+        pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+        awaitingMulticast: path === "mirror"
+      };
+      this.verified.set(id, entry);
+      this.raise(ke, path, mseq);
+      if (record.flags & 1)
+        this.closedAt.set(ke, mseq);
+      const widen = path === "mirror" ? this.cfg.applyLead ? this.leadMs : this.widenMs : 0;
+      const admitted = [];
+      for (const pair of entry.pairs)
+        this.handlePair(pair, now, now + this.grace + widen, now, admitted);
+      this.dropAdmittedHeld();
+      this.prune(now);
+      return { verdict: "verified", admitted };
+    }
+    /** Step 2: a data datagram on `port` (or a packet of a listed track over MoQ unicast). */
+    onDatagram(datagram, path) {
+      const now = this.now();
+      this.expire(now);
+      if (this.hashAlg !== null) {
+        const d = this.digest(datagram);
+        if (this.consumePending(d, now))
+          return { verdict: "admitted", admitted: [datagram] };
+        if (this.admittedUntil.has(d))
+          return { verdict: "duplicate", admitted: [] };
+        return this.enqueue({ digest: d, datagram, expiry: 0, order: 0 }, path, now);
+      }
+      return this.enqueue({ datagram, expiry: 0, order: 0 }, path, now);
+    }
+    /**
+     * A source packet recovered by FEC decode, its base SS_ID (SS_Start + ESI)
+     * appended: admitted only on a pending entry it consumes, never held. One no
+     * verified record lists, or a copy of an admitted packet, is dropped.
+     */
+    admitRecovered(datagram) {
+      const now = this.now();
+      this.expire(now);
+      return this.hashAlg !== null && this.consumePending(this.digest(datagram), now);
+    }
+    /**
+     * Discard the per-flow state on a `streamId` change or a key-set change that fails the
+     * flow's current (kid, epoch): budgets and hold queues survive, held digests are cleared.
+     */
+    resetGeneration() {
+      this.current = null;
+      this.previous = null;
+      this.graceStart = {};
+      this.hashAlg = null;
+      this.verified.clear();
+      this.highest = { multicast: /* @__PURE__ */ new Map(), mirror: /* @__PURE__ */ new Map() };
+      this.closedAt.clear();
+      this.lead = null;
+      this.pending.clear();
+      this.admittedUntil.clear();
+      for (const queue of Object.values(this.hold))
+        for (const held of queue)
+          held.digest = void 0;
+    }
+    /** The receiver ceased to hold the endpoint: drop everything; no drop here is an expiry. */
+    release() {
+      this.resetGeneration();
+      this.hold = { multicast: [], unicast: [] };
+      this.holdBytes = { multicast: 0, unicast: 0 };
+    }
+    digest(datagram) {
+      return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
+    }
+    /** Consume the lowest-seq pending entry for `digest`, admitting it. */
+    consumePending(digest, now) {
+      const list = this.pending.get(digest);
+      if (!list?.length)
+        return false;
+      list.sort((a, b) => a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0);
+      const hit = list.shift();
+      if (list.length === 0)
+        this.pending.delete(digest);
+      hit.pair.pending = void 0;
+      hit.pair.admitted = true;
+      this.admittedUntil.set(digest, now + this.maxAuthDelayMs + this.leadMs);
+      return true;
+    }
+    enqueue(held, path, now) {
+      if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+        return { verdict: "overflow", admitted: [] };
+      }
+      held.expiry = now + this.maxAuthDelayMs + (path === "unicast" ? this.widenMs : 0);
+      held.order = this.order++;
+      this.hold[path].push(held);
+      this.holdBytes[path] += held.datagram.byteLength;
+      return { verdict: "held", admitted: [] };
+    }
+    /** Remove and return the oldest held datagram with `digest`, across both queues. */
+    takeHeld(digest) {
+      let best;
+      for (const path of ["multicast", "unicast"]) {
+        const index = this.hold[path].findIndex((h) => h.digest === digest);
+        if (index >= 0 && (!best || this.hold[path][index].order < best.order)) {
+          best = { path, index, order: this.hold[path][index].order };
+        }
+      }
+      if (!best)
+        return void 0;
+      const [held] = this.hold[best.path].splice(best.index, 1);
+      this.holdBytes[best.path] -= held.datagram.byteLength;
+      return held.datagram;
+    }
+    dropAdmittedHeld() {
+      for (const path of ["multicast", "unicast"]) {
+        this.hold[path] = this.hold[path].filter((h) => {
+          const keep = h.digest === void 0 || !this.admittedUntil.has(h.digest);
+          if (!keep)
+            this.holdBytes[path] -= h.datagram.byteLength;
+          return keep;
+        });
+      }
+    }
+    /** Step 1 pair handling: admit a held copy, or insert a pending entry. */
+    handlePair(pair, now, expiry, inserted, out) {
+      const datagram = this.takeHeld(pair.digest);
+      if (datagram) {
+        pair.admitted = true;
+        this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + this.leadMs);
+        out.push(datagram);
+        return;
+      }
+      const entry = { pair, inserted, expiry };
+      pair.pending = entry;
+      const list = this.pending.get(pair.digest);
+      if (list)
+        list.push(entry);
+      else
+        this.pending.set(pair.digest, [entry]);
+    }
+    /** A byte-identical copy dropped by the already-verified lookup. */
+    arrival(seen, path, now) {
+      var _a;
+      const ke = `${seen.kid}:${seen.epoch}`;
+      this.raise(ke, path, seen.mseq);
+      if (this.current && seen.epoch === this.current.epoch)
+        (_a = this.graceStart)[path] ?? (_a[path] = now);
+      if (path !== "multicast" || !seen.awaitingMulticast)
+        return [];
+      seen.awaitingMulticast = false;
+      if (!this.cfg.applyLead)
+        return [];
+      const t = this.manifestTimerMs;
+      const interval = Math.min(Math.ceil((now - seen.arrival) / t) * t, BCPV2_LEAD_BOUND_MS);
+      if (this.lead === null) {
+        this.lead = interval;
+        return [];
+      }
+      if (interval <= this.lead)
+        return [];
+      this.lead = interval;
+      const out = [];
+      const records = [seen, ...[...this.verified.values()].filter((v) => v.awaitingMulticast && v.arrival >= now - interval)];
+      for (const v of records) {
+        for (const pair of v.pairs) {
+          if (pair.admitted) {
+            this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + interval);
+          } else if (pair.pending) {
+            pair.pending.expiry = pair.pending.inserted + this.grace + interval;
+          } else {
+            this.handlePair(pair, now, now + this.grace + interval, now, out);
+          }
+        }
+      }
+      this.dropAdmittedHeld();
+      return out;
+    }
+    previousAdmitted(epoch, path, now) {
+      if (!this.previous || epoch !== this.previous.epoch)
+        return false;
+      const m = this.graceStart.multicast;
+      if (path === "multicast")
+        return m === void 0 || now <= m + this.grace;
+      const starts = [m, this.graceStart.mirror].filter((s) => s !== void 0);
+      return starts.length > 0 && now <= Math.min(...starts) + this.grace;
+    }
+    /** The replay floor this record meets: its path's, or the higher of both from the mirror. */
+    floor(ke, path) {
+      const m = this.highest.multicast.get(ke);
+      if (path === "multicast")
+        return m;
+      const r = this.highest.mirror.get(ke);
+      if (m === void 0)
+        return r;
+      return r === void 0 || m > r ? m : r;
+    }
+    raise(ke, path, mseq) {
+      const h = this.highest[path].get(ke);
+      if (h === void 0 || mseq > h)
+        this.highest[path].set(ke, mseq);
+    }
+    take(path, now) {
+      const b = this.buckets[path];
+      b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+      b.last = now;
+      if (b.tokens < 1) {
+        b.dropped++;
+        return false;
+      }
+      b.tokens -= 1;
+      return true;
+    }
+    expire(now) {
+      for (const path of ["multicast", "unicast"]) {
+        this.hold[path] = this.hold[path].filter((h) => {
+          if (h.expiry > now)
+            return true;
+          this.holdBytes[path] -= h.datagram.byteLength;
+          this.expired[path]++;
+          return false;
+        });
+      }
+      let keepFrom = null;
+      for (const [d, list] of this.pending) {
+        const live = list.filter((p) => {
+          if (p.expiry > now)
+            return true;
+          if (keepFrom === null) {
+            const age = this.keepPendingAgeMs?.();
+            keepFrom = age === void 0 ? void 0 : now - age;
+          }
+          if (keepFrom !== void 0 && keepFrom !== null && p.expiry > keepFrom)
+            return true;
+          p.pair.pending = void 0;
+          return false;
+        });
+        if (live.length)
+          this.pending.set(d, live);
+        else
+          this.pending.delete(d);
+      }
+      for (const [d, until] of this.admittedUntil)
+        if (until <= now)
+          this.admittedUntil.delete(d);
+      if (this.previous && now > this.previous.deadline)
+        this.previous = null;
+    }
+    /**
+     * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
+     * while the freshness check would still pass its copy on `manifestPort`.
+     * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
+     */
+    prune(now) {
+      const retention = 7e3 + this.maxAuthDelayMs;
+      for (const [id, v] of this.verified) {
+        const h = this.highest[v.path].get(`${v.kid}:${v.epoch}`);
+        const aboveFloor = h === void 0 || v.mseq > h - REPLAY_WINDOW;
+        const fresh = this.cfg.checkFreshness === false ? v.arrival + retention >= now : v.sent * 1e3 + retention >= now;
+        const current = this.current && (v.epoch === this.current.epoch || v.epoch === this.previous?.epoch);
+        if (current && (aboveFloor || v.path === "mirror" && fresh))
+          continue;
+        this.verified.delete(id);
+      }
+    }
+  };
   return __toCommonJS(no_modules_exports);
 })();
 /*! Bundled license information:
 
 @noble/hashes/esm/utils.js:
   (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+
+@noble/curves/esm/utils.js:
+@noble/curves/esm/abstract/modular.js:
+@noble/curves/esm/abstract/curve.js:
+@noble/curves/esm/abstract/edwards.js:
+@noble/curves/esm/ed25519.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */
 globalThis.BlockcastMmt = BlockcastMmt;
 //# sourceMappingURL=mmtp-container-parser.no-modules.js.map