@blockcast/mmt-manifest-verify 0.1.0

package/dist/admission.d.ts

@@ -0,0 +1,28 @@
+import { type SourceAuthGroupClose, type SourceAuthObjectEntry } from './source-auth.js';
+export type SourceAuthAdmissionState = 'pending-entry' | 'pending-object' | 'provisional' | 'authenticated';
+export interface SourceAuthObjectAdmission {
+    groupId: bigint;
+    objectId: number;
+    recovered: boolean;
+    state: Exclude<SourceAuthAdmissionState, 'pending-object'>;
+}
+/**
+ * Bounded media/manifest rendezvous for the browser player receive path.
+ * Object digest admission is synchronous; only the group-close signature is deferred.
+ */
+export declare class SourceAuthAdmission {
+    #private;
+    constructor(options: {
+        manifestAuthenticated: boolean;
+    });
+    admitObject(input: {
+        groupId: bigint;
+        objectId: number;
+        bytes: Uint8Array;
+        recovered?: boolean;
+    }): SourceAuthObjectAdmission;
+    admitEntry(entry: SourceAuthObjectEntry): SourceAuthObjectAdmission | SourceAuthAdmissionState;
+    objectState(objectId: number): SourceAuthAdmissionState | undefined;
+    verifyClose(close: SourceAuthGroupClose, authScope: Uint8Array, publicKey: CryptoKey, subtle?: SubtleCrypto): Promise<void>;
+}
+//# sourceMappingURL=admission.d.ts.map

package/dist/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC3B,MAAM,kBAAkB,CAAA;AAEzB,MAAM,MAAM,wBAAwB,GAChC,eAAe,GACf,gBAAgB,GAChB,aAAa,GACb,eAAe,CAAA;AAEnB,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,KAAK,EAAE,OAAO,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,CAAA;CAC3D;AAkBD;;;GAGG;AACH,qBAAa,mBAAmB;;gBASlB,OAAO,EAAE;QAAE,qBAAqB,EAAE,OAAO,CAAA;KAAE;IAIvD,WAAW,CAAC,KAAK,EAAE;QACjB,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,UAAU,CAAA;QACjB,SAAS,CAAC,EAAE,OAAO,CAAA;KACpB,GAAG,yBAAyB;IA0B7B,UAAU,CAAC,KAAK,EAAE,qBAAqB,GAAG,yBAAyB,GAAG,wBAAwB;IAmB9F,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,GAAG,SAAS;IAO7D,WAAW,CACf,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,SAAS,EACpB,MAAM,GAAE,YAAuC,GAC9C,OAAO,CAAC,IAAI,CAAC;CAqDjB"}

package/dist/admission.js

@@ -0,0 +1,128 @@
+import { sourceAuthMerkleRoot, sourceAuthObjectDigest, sourceAuthSignaturePreimage, trimRecoveredSourceAuthObject, } from './source-auth.js';
+function requireU64(name, value) {
+    if (value < 0n || value > 0xffffffffffffffffn) {
+        throw new Error(`${name} must be an unsigned 64-bit integer`);
+    }
+}
+function equalBytes(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return left.every((value, index) => value === right[index]);
+}
+/**
+ * Bounded media/manifest rendezvous for the browser player receive path.
+ * Object digest admission is synchronous; only the group-close signature is deferred.
+ */
+export class SourceAuthAdmission {
+    #manifestAuthenticated;
+    #entries = new Map();
+    #pendingObjects = new Map();
+    #entriesAwaitingObjects = new Set();
+    #admissions = new Map();
+    #groupId = null;
+    #closed = false;
+    constructor(options) {
+        this.#manifestAuthenticated = options.manifestAuthenticated;
+    }
+    admitObject(input) {
+        this.#requireGroup(input.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#admissions.has(input.objectId) || this.#pendingObjects.has(input.objectId)) {
+            throw new Error(`duplicate source-auth object ${input.objectId}`);
+        }
+        const entry = this.#entries.get(input.objectId);
+        if (entry) {
+            this.#entriesAwaitingObjects.delete(input.objectId);
+            return this.#verifyObject(entry, input.bytes, input.recovered ?? false);
+        }
+        if (this.#pendingObjects.size >= 1) {
+            throw new Error('source-auth media exceeds one-object manifest skew');
+        }
+        this.#pendingObjects.set(input.objectId, {
+            bytes: input.bytes,
+            recovered: input.recovered ?? false,
+        });
+        return {
+            groupId: input.groupId,
+            objectId: input.objectId,
+            recovered: input.recovered ?? false,
+            state: 'pending-entry',
+        };
+    }
+    admitEntry(entry) {
+        this.#requireGroup(entry.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#entries.has(entry.objectId)) {
+            throw new Error(`duplicate source-auth manifest entry ${entry.objectId}`);
+        }
+        const pending = this.#pendingObjects.get(entry.objectId);
+        if (!pending && this.#entriesAwaitingObjects.size >= 1) {
+            throw new Error('source-auth manifest exceeds one-object media skew');
+        }
+        this.#entries.set(entry.objectId, entry);
+        if (!pending) {
+            this.#entriesAwaitingObjects.add(entry.objectId);
+            return 'pending-object';
+        }
+        this.#pendingObjects.delete(entry.objectId);
+        return this.#verifyObject(entry, pending.bytes, pending.recovered);
+    }
+    objectState(objectId) {
+        if (this.#pendingObjects.has(objectId))
+            return 'pending-entry';
+        if (this.#entriesAwaitingObjects.has(objectId))
+            return 'pending-object';
+        if (this.#closed && this.#admissions.has(objectId))
+            return 'authenticated';
+        return this.#admissions.get(objectId)?.state;
+    }
+    async verifyClose(close, authScope, publicKey, subtle = globalThis.crypto.subtle) {
+        this.#requireGroup(close.groupId);
+        if (this.#closed)
+            throw new Error('source-auth group is already closed');
+        if (this.#pendingObjects.size !== 0 || this.#entriesAwaitingObjects.size !== 0) {
+            throw new Error('source-auth group closed with unmatched objects or entries');
+        }
+        if (close.objectCount !== this.#entries.size || this.#admissions.size !== this.#entries.size) {
+            throw new Error('source-auth group close object count mismatch');
+        }
+        const root = sourceAuthMerkleRoot([...this.#entries.values()]);
+        if (!equalBytes(root, close.root))
+            throw new Error('source-auth group root mismatch');
+        const verified = await subtle.verify('Ed25519', publicKey, new Uint8Array(close.signature).buffer, new Uint8Array(sourceAuthSignaturePreimage(authScope, close.groupId, close.objectCount, root)).buffer);
+        if (!verified)
+            throw new Error('source-auth group close signature failed');
+        for (const admission of this.#admissions.values())
+            admission.state = 'authenticated';
+        this.#closed = true;
+    }
+    #requireGroup(groupId) {
+        requireU64('groupId', groupId);
+        if (this.#groupId === null)
+            this.#groupId = groupId;
+        else if (this.#groupId !== groupId)
+            throw new Error('source-auth group identity mismatch');
+    }
+    #verifyObject(entry, bytes, recovered) {
+        const authenticated = recovered
+            ? trimRecoveredSourceAuthObject(bytes, entry.trueLength)
+            : bytes;
+        if (!recovered && bytes.byteLength !== entry.trueLength) {
+            throw new Error(`direct source-auth object length mismatch for ${entry.objectId}`);
+        }
+        if (!equalBytes(sourceAuthObjectDigest(authenticated), entry.digest)) {
+            throw new Error(`source-auth object digest mismatch for ${entry.objectId}`);
+        }
+        const admission = {
+            groupId: entry.groupId,
+            objectId: entry.objectId,
+            recovered,
+            state: this.#manifestAuthenticated ? 'authenticated' : 'provisional',
+        };
+        this.#admissions.set(entry.objectId, admission);
+        return admission;
+    }
+}
+//# sourceMappingURL=admission.js.map

package/dist/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../src/admission.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,6BAA6B,GAG9B,MAAM,kBAAkB,CAAA;AAoBzB,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,mBAAsB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IACtD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IACrB,sBAAsB,CAAS;IAC/B,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAA;IACnD,eAAe,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC5D,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3C,WAAW,GAAG,IAAI,GAAG,EAAqC,CAAA;IACnE,QAAQ,GAAkB,IAAI,CAAA;IAC9B,OAAO,GAAG,KAAK,CAAA;IAEf,YAAY,OAA2C;QACrD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAA;IAC7D,CAAC;IAED,WAAW,CAAC,KAKX;QACC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YACnD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;SACpC,CAAC,CAAA;QACF,OAAO;YACL,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;YACnC,KAAK,EAAE,eAAe;SACvB,CAAA;IACH,CAAC;IAED,UAAU,CAAC,KAA4B;QACrC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC3E,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACxD,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAChD,OAAO,gBAAgB,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IACpE,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,eAAe,CAAA;QAC9D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,gBAAgB,CAAA;QACvE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,eAAe,CAAA;QAC1E,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAA2B,EAC3B,SAAqB,EACrB,SAAoB,EACpB,SAAuB,UAAU,CAAC,MAAM,CAAC,MAAM;QAE/C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;QAC9D,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACrF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAClC,SAAS,EACT,SAAS,EACT,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,EACtC,IAAI,UAAU,CACZ,2BAA2B,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAC/E,CAAC,MAAM,CACT,CAAA;QACD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;QAC1E,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YAAE,SAAS,CAAC,KAAK,GAAG,eAAe,CAAA;QACpF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;IACrB,CAAC;IAED,aAAa,CAAC,OAAe;QAC3B,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI;YAAE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAA;aAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAC5F,CAAC;IAED,aAAa,CACX,KAA4B,EAC5B,KAAiB,EACjB,SAAkB;QAElB,MAAM,aAAa,GAAG,SAAS;YAC7B,CAAC,CAAC,6BAA6B,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC;YACxD,CAAC,CAAC,KAAK,CAAA;QACT,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC7E,CAAC;QACD,MAAM,SAAS,GAA8B;YAC3C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa;SACrE,CAAA;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './source-auth.js';
+export * from './admission.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export * from './source-auth.js';
+export * from './admission.js';
+export * from './verifier.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA"}

package/dist/source-auth.d.ts

@@ -0,0 +1,37 @@
+export declare const SOURCE_AUTH_MANIFEST_VERSION = 1;
+export declare const SOURCE_AUTH_OBJECT_ENTRY_FRAME = 1;
+export declare const SOURCE_AUTH_GROUP_CLOSE_FRAME = 2;
+export declare const SOURCE_AUTH_OBJECT_ENTRY_LENGTH = 52;
+export declare const SOURCE_AUTH_GROUP_CLOSE_LENGTH = 112;
+export declare const SOURCE_AUTH_MAX_OBJECTS_PER_GROUP = 4096;
+export declare const SOURCE_AUTH_MAX_TRUE_LENGTH: number;
+export declare const SOURCE_AUTH_SCOPE_LENGTH = 32;
+export interface SourceAuthObjectEntry {
+    kind: 'object';
+    groupId: bigint;
+    objectId: number;
+    trueLength: number;
+    digest: Uint8Array;
+}
+export interface SourceAuthGroupClose {
+    kind: 'close';
+    groupId: bigint;
+    objectCount: number;
+    root: Uint8Array;
+    signature: Uint8Array;
+}
+export type SourceAuthManifestFrame = SourceAuthObjectEntry | SourceAuthGroupClose;
+export declare function sourceAuthObjectDigest(object: Uint8Array): Uint8Array;
+export declare function sourceAuthLeafHash(groupId: bigint, objectId: number, digest: Uint8Array, trueLength: number): Uint8Array;
+export declare function sourceAuthMerkleRoot(entries: readonly {
+    groupId: bigint;
+    objectId: number;
+    digest: Uint8Array;
+    trueLength: number;
+}[]): Uint8Array;
+export declare function trimRecoveredSourceAuthObject(recoveredSymbol: Uint8Array, trueLength: number): Uint8Array;
+export declare function encodeSourceAuthObjectEntry(entry: Omit<SourceAuthObjectEntry, 'kind'>): Uint8Array;
+export declare function encodeSourceAuthGroupClose(close: Omit<SourceAuthGroupClose, 'kind'>): Uint8Array;
+export declare function sourceAuthSignaturePreimage(authScope: Uint8Array, groupId: bigint, objectCount: number, root: Uint8Array): Uint8Array;
+export declare function decodeSourceAuthManifestFrame(frame: Uint8Array): SourceAuthManifestFrame;
+//# sourceMappingURL=source-auth.d.ts.map

package/dist/source-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-auth.d.ts","sourceRoot":"","sources":["../src/source-auth.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,IAAI,CAAA;AAC7C,eAAO,MAAM,8BAA8B,IAAI,CAAA;AAC/C,eAAO,MAAM,6BAA6B,IAAI,CAAA;AAC9C,eAAO,MAAM,+BAA+B,KAAK,CAAA;AACjD,eAAO,MAAM,8BAA8B,MAAM,CAAA;AACjD,eAAO,MAAM,iCAAiC,OAAO,CAAA;AACrD,eAAO,MAAM,2BAA2B,QAAmB,CAAA;AAC3D,eAAO,MAAM,wBAAwB,KAAK,CAAA;AAI1C,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,UAAU,CAAA;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,OAAO,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;CACtB;AAED,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG,oBAAoB,CAAA;AA2BlF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,UAAU,CAErE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,UAAU,EAClB,UAAU,EAAE,MAAM,GACjB,UAAU,CAYZ;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,SAAS;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB,EAAE,GACF,UAAU,CA4BZ;AAED,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,UAAU,EAC3B,UAAU,EAAE,MAAM,GACjB,UAAU,CAMZ;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,GACzC,UAAU,CAcZ;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,GACxC,UAAU,CAiBZ;AAED,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,UAAU,GACf,UAAU,CAgBZ;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,UAAU,GAAG,uBAAuB,CAwCxF"}

package/dist/source-auth.js

@@ -0,0 +1,179 @@
+import { blake3 } from '@noble/hashes/blake3';
+export const SOURCE_AUTH_MANIFEST_VERSION = 1;
+export const SOURCE_AUTH_OBJECT_ENTRY_FRAME = 1;
+export const SOURCE_AUTH_GROUP_CLOSE_FRAME = 2;
+export const SOURCE_AUTH_OBJECT_ENTRY_LENGTH = 52;
+export const SOURCE_AUTH_GROUP_CLOSE_LENGTH = 112;
+export const SOURCE_AUTH_MAX_OBJECTS_PER_GROUP = 4096;
+export const SOURCE_AUTH_MAX_TRUE_LENGTH = 16 * 1024 * 1024;
+export const SOURCE_AUTH_SCOPE_LENGTH = 32;
+const SIGNATURE_DOMAIN = new TextEncoder().encode('blockcast-mmt-root-v1\0\0\0');
+function requireBytes(name, value, length) {
+    if (value.byteLength !== length) {
+        throw new Error(`${name} must be ${length} bytes, got ${value.byteLength}`);
+    }
+}
+function requireU32(name, value) {
+    if (!Number.isInteger(value) || value < 0 || value > 0xffff_ffff) {
+        throw new Error(`${name} must be an unsigned 32-bit integer`);
+    }
+}
+function requireU64(name, value) {
+    if (value < 0n || value > 0xffffffffffffffffn) {
+        throw new Error(`${name} must be an unsigned 64-bit integer`);
+    }
+}
+function requireTrueLength(value) {
+    requireU32('trueLength', value);
+    if (value > SOURCE_AUTH_MAX_TRUE_LENGTH) {
+        throw new Error(`trueLength exceeds the ${SOURCE_AUTH_MAX_TRUE_LENGTH}-byte profile maximum`);
+    }
+}
+export function sourceAuthObjectDigest(object) {
+    return blake3(object);
+}
+export function sourceAuthLeafHash(groupId, objectId, digest, trueLength) {
+    requireU64('groupId', groupId);
+    requireU32('objectId', objectId);
+    requireBytes('digest', digest, 32);
+    requireTrueLength(trueLength);
+    const preimage = new Uint8Array(49);
+    const view = new DataView(preimage.buffer);
+    view.setBigUint64(1, groupId);
+    view.setUint32(9, objectId);
+    preimage.set(digest, 13);
+    view.setUint32(45, trueLength);
+    return blake3(preimage);
+}
+export function sourceAuthMerkleRoot(entries) {
+    if (entries.length === 0)
+        throw new Error('Merkle tree requires at least one object');
+    if (entries.length > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
+        throw new Error(`group exceeds ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP} objects`);
+    }
+    const groupId = entries[0].groupId;
+    const objectIds = new Set();
+    const ordered = [...entries].sort((left, right) => left.objectId - right.objectId);
+    let level = ordered.map((entry) => {
+        if (entry.groupId !== groupId)
+            throw new Error('Merkle entries must belong to one group');
+        if (objectIds.has(entry.objectId))
+            throw new Error(`duplicate objectId ${entry.objectId}`);
+        objectIds.add(entry.objectId);
+        return sourceAuthLeafHash(entry.groupId, entry.objectId, entry.digest, entry.trueLength);
+    });
+    while (level.length > 1) {
+        const parents = [];
+        for (let index = 0; index < level.length; index += 2) {
+            const left = level[index];
+            const right = level[index + 1] ?? left;
+            const preimage = new Uint8Array(65);
+            preimage[0] = 1;
+            preimage.set(left, 1);
+            preimage.set(right, 33);
+            parents.push(blake3(preimage));
+        }
+        level = parents;
+    }
+    return level[0];
+}
+export function trimRecoveredSourceAuthObject(recoveredSymbol, trueLength) {
+    requireTrueLength(trueLength);
+    if (trueLength > recoveredSymbol.byteLength) {
+        throw new Error(`true length ${trueLength} exceeds recovered object size ${recoveredSymbol.byteLength}`);
+    }
+    return recoveredSymbol.subarray(0, trueLength);
+}
+export function encodeSourceAuthObjectEntry(entry) {
+    requireU32('objectId', entry.objectId);
+    requireTrueLength(entry.trueLength);
+    requireU64('groupId', entry.groupId);
+    requireBytes('digest', entry.digest, 32);
+    const frame = new Uint8Array(SOURCE_AUTH_OBJECT_ENTRY_LENGTH);
+    const view = new DataView(frame.buffer);
+    frame[0] = SOURCE_AUTH_OBJECT_ENTRY_FRAME;
+    frame[1] = SOURCE_AUTH_MANIFEST_VERSION;
+    view.setBigUint64(4, entry.groupId);
+    view.setUint32(12, entry.objectId);
+    view.setUint32(16, entry.trueLength);
+    frame.set(entry.digest, 20);
+    return frame;
+}
+export function encodeSourceAuthGroupClose(close) {
+    requireU32('objectCount', close.objectCount);
+    if (close.objectCount === 0 || close.objectCount > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
+        throw new Error(`objectCount must be between 1 and ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP}`);
+    }
+    requireU64('groupId', close.groupId);
+    requireBytes('root', close.root, 32);
+    requireBytes('signature', close.signature, 64);
+    const frame = new Uint8Array(SOURCE_AUTH_GROUP_CLOSE_LENGTH);
+    const view = new DataView(frame.buffer);
+    frame[0] = SOURCE_AUTH_GROUP_CLOSE_FRAME;
+    frame[1] = SOURCE_AUTH_MANIFEST_VERSION;
+    view.setBigUint64(4, close.groupId);
+    view.setUint32(12, close.objectCount);
+    frame.set(close.root, 16);
+    frame.set(close.signature, 48);
+    return frame;
+}
+export function sourceAuthSignaturePreimage(authScope, groupId, objectCount, root) {
+    requireU32('objectCount', objectCount);
+    if (objectCount === 0 || objectCount > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
+        throw new Error(`objectCount must be between 1 and ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP}`);
+    }
+    requireU64('groupId', groupId);
+    requireBytes('authScope', authScope, SOURCE_AUTH_SCOPE_LENGTH);
+    requireBytes('root', root, 32);
+    const preimage = new Uint8Array(100);
+    const view = new DataView(preimage.buffer);
+    preimage.set(SIGNATURE_DOMAIN);
+    preimage.set(authScope, 24);
+    view.setBigUint64(56, groupId);
+    view.setUint32(64, objectCount);
+    preimage.set(root, 68);
+    return preimage;
+}
+export function decodeSourceAuthManifestFrame(frame) {
+    const frameType = frame[0];
+    const expectedLength = frameType === SOURCE_AUTH_OBJECT_ENTRY_FRAME
+        ? SOURCE_AUTH_OBJECT_ENTRY_LENGTH
+        : frameType === SOURCE_AUTH_GROUP_CLOSE_FRAME
+            ? SOURCE_AUTH_GROUP_CLOSE_LENGTH
+            : 0;
+    if (expectedLength === 0)
+        throw new Error(`unsupported manifest frame type ${frameType}`);
+    if (frame.byteLength !== expectedLength) {
+        throw new Error(`manifest frame has invalid length ${frame.byteLength} for type ${frameType}`);
+    }
+    if (frame[1] !== SOURCE_AUTH_MANIFEST_VERSION) {
+        throw new Error(`unsupported manifest version ${frame[1]}`);
+    }
+    if (frame[2] !== 0 || frame[3] !== 0)
+        throw new Error('manifest reserved bits must be zero');
+    const view = new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
+    const groupId = view.getBigUint64(4);
+    if (frameType === SOURCE_AUTH_OBJECT_ENTRY_FRAME) {
+        const entry = {
+            kind: 'object',
+            groupId,
+            objectId: view.getUint32(12),
+            trueLength: view.getUint32(16),
+            digest: frame.slice(20, 52),
+        };
+        requireTrueLength(entry.trueLength);
+        return entry;
+    }
+    const close = {
+        kind: 'close',
+        groupId,
+        objectCount: view.getUint32(12),
+        root: frame.slice(16, 48),
+        signature: frame.slice(48, 112),
+    };
+    if (close.objectCount === 0 || close.objectCount > SOURCE_AUTH_MAX_OBJECTS_PER_GROUP) {
+        throw new Error(`objectCount must be between 1 and ${SOURCE_AUTH_MAX_OBJECTS_PER_GROUP}`);
+    }
+    return close;
+}
+//# sourceMappingURL=source-auth.js.map

package/dist/source-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-auth.js","sourceRoot":"","sources":["../src/source-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAE7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAA;AAC7C,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAA;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAA;AAC9C,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAA;AACjD,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAA;AACjD,MAAM,CAAC,MAAM,iCAAiC,GAAG,IAAI,CAAA;AACrD,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC3D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAE1C,MAAM,gBAAgB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;AAoBhF,SAAS,YAAY,CAAC,IAAY,EAAE,KAAiB,EAAE,MAAc;IACnE,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,YAAY,MAAM,eAAe,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,WAAW,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,mBAAsB,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,qCAAqC,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;IAC/B,IAAI,KAAK,GAAG,2BAA2B,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,0BAA0B,2BAA2B,uBAAuB,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAkB;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB,EAChB,MAAkB,EAClB,UAAkB;IAElB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC9B,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;IAChC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;IAClC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;IAC3B,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACxB,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAKG;IAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IACrF,IAAI,OAAO,CAAC,MAAM,GAAG,iCAAiC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,iBAAiB,iCAAiC,UAAU,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC,OAAO,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAClF,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QAChC,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QACzF,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC1F,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAC7B,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAiB,EAAE,CAAA;QAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAA;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAA;YACtC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;YACnC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACf,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACrB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YACvB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,KAAK,GAAG,OAAO,CAAA;IACjB,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAE,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,eAA2B,EAC3B,UAAkB;IAElB,iBAAiB,CAAC,UAAU,CAAC,CAAA;IAC7B,IAAI,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,eAAe,UAAU,kCAAkC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAA;IAC1G,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAA0C;IAE1C,UAAU,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IACtC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACnC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACpC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,CAAC,CAAC,GAAG,8BAA8B,CAAA;IACzC,KAAK,CAAC,CAAC,CAAC,GAAG,4BAA4B,CAAA;IACvC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;IAClC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IACpC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC3B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAyC;IAEzC,UAAU,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC5C,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,iCAAiC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,qCAAqC,iCAAiC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACpC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACpC,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC9C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,8BAA8B,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACvC,KAAK,CAAC,CAAC,CAAC,GAAG,6BAA6B,CAAA;IACxC,KAAK,CAAC,CAAC,CAAC,GAAG,4BAA4B,CAAA;IACvC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IACrC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACzB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,SAAqB,EACrB,OAAe,EACf,WAAmB,EACnB,IAAgB;IAEhB,UAAU,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IACtC,IAAI,WAAW,KAAK,CAAC,IAAI,WAAW,GAAG,iCAAiC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,qCAAqC,iCAAiC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC9B,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAA;IAC9D,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC1C,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC3B,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IAC9B,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACtB,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAiB;IAC7D,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1B,MAAM,cAAc,GAAG,SAAS,KAAK,8BAA8B;QACjE,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,SAAS,KAAK,6BAA6B;YAC3C,CAAC,CAAC,8BAA8B;YAChC,CAAC,CAAC,CAAC,CAAA;IACP,IAAI,cAAc,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAA;IACzF,IAAI,KAAK,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,UAAU,aAAa,SAAS,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,4BAA4B,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAE5F,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACpC,IAAI,SAAS,KAAK,8BAA8B,EAAE,CAAC;QACjD,MAAM,KAAK,GAA0B;YACnC,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;SAC5B,CAAA;QACD,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAyB;QAClC,IAAI,EAAE,OAAO;QACb,OAAO;QACP,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACzB,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC;KAChC,CAAA;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,GAAG,iCAAiC,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,qCAAqC,iCAAiC,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/verifier.d.ts

@@ -0,0 +1,72 @@
+export type ManifestAuthMode = 'off' | 'shadow' | 'enforce';
+export type MissingManifestPolicy = 'stall' | 'fallback-shadow';
+export type ManifestFailureReason = 'sigInvalid' | 'digestMismatch' | 'manifestLate' | 'manifestAbsent' | 'verifierError';
+export interface ManifestAuthConfig {
+    mode: ManifestAuthMode;
+    onMissingManifest: MissingManifestPolicy;
+}
+export interface ManifestObjectIdentity {
+    trackName: string;
+    /** MoQ group ids are u62; values above 2^53 must be passed as bigint. */
+    groupId: number | bigint;
+    objectId: number;
+    packetId?: number;
+    ssId?: number;
+}
+export interface ManifestFecBlockMapper {
+    readonly d: number;
+    derive(groupId: number, objectId: number): {
+        ssId: number;
+    };
+}
+export interface ManifestTrackContext {
+    broadcastNamespaceId: string;
+    trackName: string;
+    keyEpoch: number;
+    codec: string;
+    timing: string;
+    fecGeometry: string;
+    manifestFormatVersion: number;
+    /** Authenticated-catalog binding for the namespace, track, epoch, codec,
+     * timing, FEC geometry, and manifest version fields above. */
+    authScope: Uint8Array;
+    publicKey: Uint8Array;
+    bitrate: number;
+    groupDurationMs: number;
+    mapper: ManifestFecBlockMapper;
+    manifestChannelAuthenticated: boolean;
+}
+export interface ManifestVerificationStats {
+    verified: number;
+    failures: Record<ManifestFailureReason, number>;
+    quarantinedBytes: number;
+}
+export interface ManifestFailure {
+    trackName: string;
+    groupId: number | bigint;
+    objectId: number;
+    reason: ManifestFailureReason;
+}
+export interface ManifestAdmission {
+    action: 'play' | 'stall' | 'drop';
+    verified: boolean;
+    reason?: ManifestFailureReason;
+}
+type SignatureVerifier = (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;
+export declare class ManifestVerifier {
+    #private;
+    constructor(options: {
+        manifestAuth: ManifestAuthConfig;
+        verifySignature: SignatureVerifier;
+        onFailure?: (failure: ManifestFailure) => void;
+    });
+    get config(): Readonly<ManifestAuthConfig>;
+    get stats(): ManifestVerificationStats;
+    setMode(mode: ManifestAuthMode): void;
+    registerTrack(context: ManifestTrackContext): void;
+    ingestManifestFrame(trackName: string, frameBytes: Uint8Array): void;
+    admitObject(identity: ManifestObjectIdentity, data: Uint8Array, release: () => void): ManifestAdmission;
+    dispose(): void;
+}
+export {};
+//# sourceMappingURL=verifier.d.ts.map

package/dist/verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.d.ts","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAA;AAC3D,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,iBAAiB,CAAA;AAC/D,MAAM,MAAM,qBAAqB,GAC7B,YAAY,GACZ,gBAAgB,GAChB,cAAc,GACd,gBAAgB,GAChB,eAAe,CAAA;AAEnB,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,gBAAgB,CAAA;IACtB,iBAAiB,EAAE,qBAAqB,CAAA;CACzC;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5D;AAED,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,qBAAqB,EAAE,MAAM,CAAA;IAC7B;kEAC8D;IAC9D,SAAS,EAAE,UAAU,CAAA;IACrB,SAAS,EAAE,UAAU,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,sBAAsB,CAAA;IAC9B,4BAA4B,EAAE,OAAO,CAAA;CACtC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAC/C,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,qBAAqB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,qBAAqB,CAAA;CAC/B;AAED,KAAK,iBAAiB,GAAG,CACvB,SAAS,EAAE,UAAU,EACrB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,UAAU,KAClB,OAAO,CAAA;AA8CZ,qBAAa,gBAAgB;;gBAWf,OAAO,EAAE;QACnB,YAAY,EAAE,kBAAkB,CAAA;QAChC,eAAe,EAAE,iBAAiB,CAAA;QAClC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,IAAI,CAAA;KAC/C;IAMD,IAAI,MAAM,IAAI,QAAQ,CAAC,kBAAkB,CAAC,CAEzC;IAED,IAAI,KAAK,IAAI,yBAAyB,CAMrC;IAED,OAAO,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI;IAKrC,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI;IAiClD,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,IAAI;IAuCpE,WAAW,CACT,QAAQ,EAAE,sBAAsB,EAChC,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,MAAM,IAAI,GAClB,iBAAiB;IAqCpB,OAAO,IAAI,IAAI;CAoPhB"}