@blockcast/mmt-manifest-verify 0.1.0

package/dist/verifier.js

@@ -0,0 +1,376 @@
+import { decodeSourceAuthManifestFrame, sourceAuthMerkleRoot, sourceAuthObjectDigest, sourceAuthSignaturePreimage, } from './source-auth.js';
+const FAILURE_REASONS = [
+    'sigInvalid',
+    'digestMismatch',
+    'manifestLate',
+    'manifestAbsent',
+    'verifierError',
+];
+const equalBytes = (left, right) => {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    let diff = 0;
+    for (let index = 0; index < left.byteLength; index++)
+        diff |= left[index] ^ right[index];
+    return diff === 0;
+};
+export class ManifestVerifier {
+    #config;
+    #verifySignature;
+    #onFailure;
+    #tracks = new Map();
+    #stats = {
+        verified: 0,
+        failures: Object.fromEntries(FAILURE_REASONS.map((reason) => [reason, 0])),
+        quarantinedBytes: 0,
+    };
+    constructor(options) {
+        this.#config = { ...options.manifestAuth };
+        this.#verifySignature = options.verifySignature;
+        this.#onFailure = options.onFailure;
+    }
+    get config() {
+        return this.#config;
+    }
+    get stats() {
+        return {
+            verified: this.#stats.verified,
+            failures: { ...this.#stats.failures },
+            quarantinedBytes: this.#stats.quarantinedBytes,
+        };
+    }
+    setMode(mode) {
+        this.#config = { ...this.#config, mode };
+        if (mode !== 'enforce')
+            this.#releaseAllQuarantine(false);
+    }
+    registerTrack(context) {
+        if (this.#tracks.has(context.trackName)) {
+            throw new Error(`manifest track ${context.trackName} is already registered`);
+        }
+        if (!Number.isFinite(context.bitrate) || context.bitrate <= 0) {
+            throw new Error('manifest track bitrate must be > 0');
+        }
+        if (!Number.isFinite(context.groupDurationMs) || context.groupDurationMs <= 0) {
+            throw new Error('manifest track groupDurationMs must be > 0');
+        }
+        if (context.authScope.byteLength !== 32)
+            throw new Error('manifest authScope must be 32 bytes');
+        if (context.publicKey.byteLength !== 32)
+            throw new Error('manifest publicKey must be 32 bytes');
+        for (const [name, value] of Object.entries({
+            broadcastNamespaceId: context.broadcastNamespaceId,
+            trackName: context.trackName,
+            codec: context.codec,
+            timing: context.timing,
+            fecGeometry: context.fecGeometry,
+        })) {
+            if (value.length === 0)
+                throw new Error(`manifest ${name} must not be empty`);
+        }
+        this.#tracks.set(context.trackName, {
+            context,
+            groups: new Map(),
+            quarantine: [],
+            quarantinedBytes: 0,
+            capBytes: Math.ceil((context.bitrate * context.groupDurationMs) / 8000),
+            manifestEntries: 0,
+            maxManifestEntries: Math.ceil((context.bitrate * context.groupDurationMs) / (8000 * 52)),
+            maxGroups: context.mapper.d + 1,
+        });
+    }
+    ingestManifestFrame(trackName, frameBytes) {
+        const track = this.#requireTrack(trackName);
+        try {
+            const frame = decodeSourceAuthManifestFrame(frameBytes);
+            const groupId = frame.groupId;
+            const group = this.#group(track, groupId);
+            if (frame.kind === 'object') {
+                if (group.close || group.failed) {
+                    this.#failure({ trackName, groupId, objectId: frame.objectId }, 'verifierError');
+                    return;
+                }
+                if (group.entries.has(frame.objectId)) {
+                    this.#failure({ trackName, groupId, objectId: frame.objectId }, 'verifierError');
+                    return;
+                }
+                if (group.entries.size >= 4096 || track.manifestEntries >= track.maxManifestEntries) {
+                    this.#failure({ trackName, groupId, objectId: frame.objectId }, 'verifierError');
+                    return;
+                }
+                group.entries.set(frame.objectId, frame);
+                track.manifestEntries++;
+                const pending = group.pending.get(frame.objectId);
+                if (pending) {
+                    this.#failure(pending.identity, 'manifestLate');
+                    this.#resolvePending(track, group, pending, frame);
+                }
+                if (group.pendingClose && group.entries.size === group.pendingClose.objectCount) {
+                    const close = group.pendingClose;
+                    group.pendingClose = undefined;
+                    this.#closeGroup(track, groupId, group, close);
+                }
+                return;
+            }
+            this.#closeGroup(track, groupId, group, frame);
+        }
+        catch {
+            this.#failure({ trackName, groupId: 0, objectId: 0 }, 'verifierError');
+        }
+    }
+    admitObject(identity, data, release) {
+        if (this.#config.mode === 'off') {
+            release();
+            return { action: 'play', verified: false };
+        }
+        const track = this.#tracks.get(identity.trackName);
+        if (!track) {
+            release();
+            this.#failure(identity, 'verifierError');
+            return { action: 'play', verified: false, reason: 'verifierError' };
+        }
+        try {
+            if (!this.#validateIdentity(track, identity)) {
+                return this.#rejectOrShadow(identity, release, 'digestMismatch');
+            }
+            const group = this.#group(track, BigInt(identity.groupId));
+            if (group.failed === 'sigInvalid' || group.failed === 'digestMismatch') {
+                return this.#rejectOrShadow(identity, release, group.failed);
+            }
+            const entry = group.entries.get(identity.objectId);
+            if (entry)
+                return this.#admitAgainstEntry(track, group, identity, data, release, entry);
+            if (this.#config.mode === 'shadow' || this.#config.onMissingManifest === 'fallback-shadow') {
+                release();
+                this.#failure(identity, 'manifestAbsent');
+                return { action: 'play', verified: false, reason: 'manifestAbsent' };
+            }
+            if (!this.#quarantine(track, group, { identity, data, release, bytes: data.byteLength })) {
+                return { action: 'drop', verified: false };
+            }
+            return { action: 'stall', verified: false };
+        }
+        catch {
+            release();
+            this.#failure(identity, 'verifierError');
+            return { action: 'play', verified: false, reason: 'verifierError' };
+        }
+    }
+    dispose() {
+        this.#releaseAllQuarantine(false);
+        this.#tracks.clear();
+    }
+    #requireTrack(trackName) {
+        const track = this.#tracks.get(trackName);
+        if (!track)
+            throw new Error(`unknown manifest track ${trackName}`);
+        return track;
+    }
+    #group(track, groupId) {
+        let group = track.groups.get(groupId);
+        if (!group) {
+            group = { entries: new Map(), pending: new Map(), rootVerified: false };
+            track.groups.set(groupId, group);
+            while (track.groups.size > track.maxGroups) {
+                const oldest = track.groups.entries().next().value;
+                if (!oldest)
+                    break;
+                const [oldestId, oldestGroup] = oldest;
+                for (const pending of [...oldestGroup.pending.values()]) {
+                    this.#removePending(track, oldestGroup, pending);
+                    pending.release();
+                    this.#failure(pending.identity, 'verifierError');
+                }
+                track.manifestEntries -= oldestGroup.entries.size;
+                track.groups.delete(oldestId);
+            }
+        }
+        return group;
+    }
+    #validateIdentity(track, identity) {
+        const coordinates = track.context.mapper.derive(Number(identity.groupId), identity.objectId);
+        return identity.ssId === undefined || coordinates.ssId === identity.ssId;
+    }
+    #admitAgainstEntry(track, group, identity, data, release, entry) {
+        if (entry.trueLength !== data.byteLength) {
+            return this.#rejectOrShadow(identity, release, 'digestMismatch');
+        }
+        const digestMatches = equalBytes(sourceAuthObjectDigest(data.subarray(0, entry.trueLength)), entry.digest);
+        if (!digestMatches)
+            return this.#rejectOrShadow(identity, release, 'digestMismatch');
+        if (!track.context.manifestChannelAuthenticated && !group.rootVerified) {
+            if (this.#config.mode === 'shadow') {
+                release();
+                return { action: 'play', verified: false };
+            }
+            if (!this.#quarantine(track, group, { identity, data, release, bytes: data.byteLength })) {
+                return { action: 'drop', verified: false };
+            }
+            return { action: 'stall', verified: false };
+        }
+        release();
+        this.#stats.verified++;
+        return { action: 'play', verified: true };
+    }
+    #rejectOrShadow(identity, release, reason) {
+        this.#failure(identity, reason);
+        if (this.#config.mode === 'enforce') {
+            console.warn(JSON.stringify({ event: 'manifest-enforce-drop', track: identity.trackName, group: String(identity.groupId), object: identity.objectId, reason }));
+            return { action: 'drop', verified: false, reason };
+        }
+        release();
+        return { action: 'play', verified: false, reason };
+    }
+    #resolvePending(track, group, pending, entry) {
+        this.#removePending(track, group, pending);
+        this.#admitAgainstEntry(track, group, pending.identity, pending.data, pending.release, entry);
+    }
+    #closeGroup(track, groupId, group, close) {
+        if (group.close)
+            return;
+        const entries = [...group.entries.values()];
+        if (entries.length !== close.objectCount) {
+            // Manifest-channel reordering: the close frame beat some object entries.
+            // Stash it (latest-wins on duplicates) so the object-entry path can
+            // re-attempt the close once the count matches; quarantined objects stay
+            // quarantined, and manifestAbsent below is a signal, not an eviction.
+            group.pendingClose = close;
+            const hadPending = group.pending.size > 0;
+            if (this.#config.onMissingManifest === 'fallback-shadow' || this.#config.mode === 'shadow') {
+                for (const pending of [...group.pending.values()]) {
+                    this.#removePending(track, group, pending);
+                    pending.release();
+                    this.#failure(pending.identity, 'manifestAbsent');
+                }
+            }
+            else {
+                for (const pending of group.pending.values()) {
+                    this.#failure(pending.identity, 'manifestAbsent');
+                }
+            }
+            if (!hadPending) {
+                this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, 'manifestAbsent');
+            }
+            return;
+        }
+        if (!equalBytes(sourceAuthMerkleRoot(entries), close.root)) {
+            group.failed = 'digestMismatch';
+            this.#failGroup(track, groupId, group, 'digestMismatch');
+            return;
+        }
+        const preimage = sourceAuthSignaturePreimage(track.context.authScope, close.groupId, close.objectCount, close.root);
+        let signatureValid;
+        try {
+            signatureValid = this.#verifySignature(track.context.publicKey, preimage, close.signature);
+        }
+        catch {
+            this.#failOpenGroup(track, groupId, group);
+            return;
+        }
+        if (!signatureValid) {
+            group.failed = 'sigInvalid';
+            this.#failGroup(track, groupId, group, 'sigInvalid');
+            return;
+        }
+        group.failed = undefined;
+        group.close = close;
+        group.pendingClose = undefined;
+        group.rootVerified = true;
+        for (const pending of [...group.pending.values()]) {
+            const entry = group.entries.get(pending.identity.objectId);
+            if (entry)
+                this.#resolvePending(track, group, pending, entry);
+            else if (this.#config.onMissingManifest === 'fallback-shadow') {
+                this.#removePending(track, group, pending);
+                pending.release();
+                this.#failure(pending.identity, 'manifestAbsent');
+            }
+        }
+    }
+    #failGroup(track, groupId, group, reason) {
+        if (group.pending.size === 0) {
+            this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, reason);
+            return;
+        }
+        for (const pending of [...group.pending.values()]) {
+            this.#removePending(track, group, pending);
+            this.#rejectOrShadow(pending.identity, pending.release, reason);
+        }
+    }
+    #removePending(track, group, pending) {
+        if (group.pending.get(pending.identity.objectId) === pending) {
+            group.pending.delete(pending.identity.objectId);
+        }
+        const index = track.quarantine.indexOf(pending);
+        if (index >= 0)
+            track.quarantine.splice(index, 1);
+        track.quarantinedBytes -= pending.bytes;
+        this.#stats.quarantinedBytes -= pending.bytes;
+    }
+    #quarantine(track, group, pending) {
+        if (group.pending.has(pending.identity.objectId))
+            return false;
+        group.pending.set(pending.identity.objectId, pending);
+        track.quarantine.push(pending);
+        track.quarantinedBytes += pending.bytes;
+        this.#stats.quarantinedBytes += pending.bytes;
+        this.#enforceCap(track);
+        return true;
+    }
+    #enforceCap(track) {
+        while (track.quarantinedBytes > track.capBytes && track.quarantine.length > 0) {
+            const pending = track.quarantine.shift();
+            const group = track.groups.get(BigInt(pending.identity.groupId));
+            if (group)
+                group.pending.delete(pending.identity.objectId);
+            track.quarantinedBytes -= pending.bytes;
+            this.#stats.quarantinedBytes -= pending.bytes;
+            pending.release();
+            this.#failure(pending.identity, 'verifierError');
+            console.warn(`[ManifestVerifier] quarantine cap eviction fail-open track=${pending.identity.trackName} group=${pending.identity.groupId} object=${pending.identity.objectId}`);
+        }
+    }
+    #failOpenTrack(track, reason) {
+        for (const pending of [...track.quarantine]) {
+            const group = track.groups.get(BigInt(pending.identity.groupId));
+            if (group)
+                this.#removePending(track, group, pending);
+            pending.release();
+            this.#failure(pending.identity, reason);
+        }
+    }
+    #failOpenGroup(track, groupId, group) {
+        const pending = [...group.pending.values()];
+        if (pending.length === 0) {
+            this.#failure({ trackName: track.context.trackName, groupId, objectId: 0 }, 'verifierError');
+            return;
+        }
+        for (const object of pending) {
+            this.#removePending(track, group, object);
+            object.release();
+            this.#failure(object.identity, 'verifierError');
+        }
+    }
+    #releaseAllQuarantine(countFailure) {
+        for (const track of this.#tracks.values()) {
+            for (const pending of [...track.quarantine]) {
+                const group = track.groups.get(BigInt(pending.identity.groupId));
+                if (group)
+                    this.#removePending(track, group, pending);
+                pending.release();
+                if (countFailure)
+                    this.#failure(pending.identity, 'verifierError');
+            }
+        }
+    }
+    #failure(identity, reason) {
+        this.#stats.failures[reason]++;
+        this.#onFailure?.({
+            trackName: identity.trackName,
+            groupId: identity.groupId,
+            objectId: identity.objectId,
+            reason,
+        });
+    }
+}
+//# sourceMappingURL=verifier.js.map

package/dist/verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier.js","sourceRoot":"","sources":["../src/verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,GAG5B,MAAM,kBAAkB,CAAA;AAsGzB,MAAM,eAAe,GAAqC;IACxD,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,eAAe;CAChB,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAiB,EAAW,EAAE;IAClE,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IACtD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE;QAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAE,GAAG,KAAK,CAAC,KAAK,CAAE,CAAA;IAC1F,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,OAAO,gBAAgB;IAC3B,OAAO,CAAoB;IAClB,gBAAgB,CAAmB;IACnC,UAAU,CAAqC;IAC/C,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IACvC,MAAM,GAA8B;QAC3C,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAA0C;QACnH,gBAAgB,EAAE,CAAC;KACpB,CAAA;IAED,YAAY,OAIX;QACC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAA;QAC1C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAA;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAA;IACrC,CAAC;IAED,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;IAED,IAAI,KAAK;QACP,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACrC,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,gBAAgB;SAC/C,CAAA;IACH,CAAC;IAED,OAAO,CAAC,IAAsB;QAC5B,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAA;QACxC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC;IAED,aAAa,CAAC,OAA6B;QACzC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,SAAS,wBAAwB,CAAC,CAAA;QAC9E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC/F,IAAI,OAAO,CAAC,SAAS,CAAC,UAAU,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;QAC/F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;YACzC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,EAAE,CAAC;YACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,oBAAoB,CAAC,CAAA;QAC/E,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;YAClC,OAAO;YACP,MAAM,EAAE,IAAI,GAAG,EAAE;YACjB,UAAU,EAAE,EAAE;YACd,gBAAgB,EAAE,CAAC;YACnB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC;YACvE,eAAe,EAAE,CAAC;YAClB,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;YACxF,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC;SAChC,CAAC,CAAA;IACJ,CAAC;IAED,mBAAmB,CAAC,SAAiB,EAAE,UAAsB;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAA;QAC3C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAA;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACzC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBAChC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAA;oBAChF,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAA;oBAChF,OAAM;gBACR,CAAC;gBACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;oBACpF,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,CAAA;oBAChF,OAAM;gBACR,CAAC;gBACD,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;gBACxC,KAAK,CAAC,eAAe,EAAE,CAAA;gBACvB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;gBACjD,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAA;oBAC/C,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;gBACpD,CAAC;gBACD,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;oBAChF,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,CAAA;oBAChC,KAAK,CAAC,YAAY,GAAG,SAAS,CAAA;oBAC9B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;gBAChD,CAAC;gBACD,OAAM;YACR,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,WAAW,CACT,QAAgC,EAChC,IAAgB,EAChB,OAAmB;QAEnB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAChC,OAAO,EAAE,CAAA;YACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC5C,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,CAAA;YACT,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACrE,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;YAClE,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClD,IAAI,KAAK;gBAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;YACvF,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;gBAC3F,OAAO,EAAE,CAAA;gBACT,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;gBACzC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;YACtE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;gBACzF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;YAC5C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;YACT,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACxC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACrE,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,aAAa,CAAC,SAAiB;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,SAAS,EAAE,CAAC,CAAA;QAClE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,CAAC,KAAiB,EAAE,OAAe;QACvC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;YACvE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAChC,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,KAAyC,CAAA;gBACtF,IAAI,CAAC,MAAM;oBAAE,MAAK;gBAClB,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,MAAM,CAAA;gBACtC,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBACxD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;oBAChD,OAAO,CAAC,OAAO,EAAE,CAAA;oBACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;gBAClD,CAAC;gBACD,KAAK,CAAC,eAAe,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,CAAA;gBACjD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,iBAAiB,CAAC,KAAiB,EAAE,QAAgC;QACnE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC5F,OAAO,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAA;IAC1E,CAAC;IAED,kBAAkB,CAChB,KAAiB,EACjB,KAAiB,EACjB,QAAgC,EAChC,IAAgB,EAChB,OAAmB,EACnB,KAA4B;QAE5B,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;QAClE,CAAC;QACD,MAAM,aAAa,GAAG,UAAU,CAAC,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC1G,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAA;QACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,4BAA4B,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnC,OAAO,EAAE,CAAA;gBACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;gBACzF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;YAC5C,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;QAC7C,CAAC;QACD,OAAO,EAAE,CAAA;QACT,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAA;QACtB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC3C,CAAC;IAED,eAAe,CACb,QAAgC,EAChC,OAAmB,EACnB,MAAuC;QAEvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;YAC/J,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;QACpD,CAAC;QACD,OAAO,EAAE,CAAA;QACT,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACpD,CAAC;IAED,eAAe,CACb,KAAiB,EACjB,KAAiB,EACjB,OAAsB,EACtB,KAA4B;QAE5B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1C,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/F,CAAC;IAED,WAAW,CACT,KAAiB,EACjB,OAAe,EACf,KAAiB,EACjB,KAA2B;QAE3B,IAAI,KAAK,CAAC,KAAK;YAAE,OAAM;QACvB,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;YACzC,yEAAyE;YACzE,oEAAoE;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAA;YAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAA;YACzC,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3F,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;oBAC1C,OAAO,CAAC,OAAO,EAAE,CAAA;oBACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;gBACnD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAA;YAC/F,CAAC;YACD,OAAM;QACR,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,MAAM,GAAG,gBAAgB,CAAA;YAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;YACxD,OAAM;QACR,CAAC;QACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACnH,IAAI,cAAuB,CAAA;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;QAC5F,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;YAC1C,OAAM;QACR,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,KAAK,CAAC,MAAM,GAAG,YAAY,CAAA;YAC3B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;YACpD,OAAM;QACR,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,SAAS,CAAA;QACxB,KAAK,CAAC,KAAK,GAAG,KAAK,CAAA;QACnB,KAAK,CAAC,YAAY,GAAG,SAAS,CAAA;QAC9B,KAAK,CAAC,YAAY,GAAG,IAAI,CAAA;QACzB,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1D,IAAI,KAAK;gBAAE,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;iBACxD,IAAI,IAAI,CAAC,OAAO,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,OAAO,EAAE,CAAA;gBACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAA;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,UAAU,CACR,KAAiB,EACjB,OAAe,EACf,KAAiB,EACjB,MAAuC;QAEvC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;YACnF,OAAM;QACR,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;YAC1C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAiB,EAAE,KAAiB,EAAE,OAAsB;QACzE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,OAAO,EAAE,CAAC;YAC7D,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACjD,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,KAAK,IAAI,CAAC;YAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACjD,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;IAC/C,CAAC;IAED,WAAW,CAAC,KAAiB,EAAE,KAAiB,EAAE,OAAsB;QACtE,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC9D,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QACrD,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9B,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;QACvC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;QAC7C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,WAAW,CAAC,KAAiB;QAC3B,OAAO,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,EAAG,CAAA;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAChE,IAAI,KAAK;gBAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAC1D,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;YACvC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAA;YAC7C,OAAO,CAAC,OAAO,EAAE,CAAA;YACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YAChD,OAAO,CAAC,IAAI,CAAC,8DAA8D,OAAO,CAAC,QAAQ,CAAC,SAAS,UAAU,OAAO,CAAC,QAAQ,CAAC,OAAO,WAAW,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChL,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAiB,EAAE,MAAuB;QACvD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;YAChE,IAAI,KAAK;gBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;YACrD,OAAO,CAAC,OAAO,EAAE,CAAA;YACjB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,cAAc,CAAC,KAAiB,EAAE,OAAe,EAAE,KAAiB;QAClE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,eAAe,CAAC,CAAA;YAC5F,OAAM;QACR,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACzC,MAAM,CAAC,OAAO,EAAE,CAAA;YAChB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;QACjD,CAAC;IACH,CAAC;IAED,qBAAqB,CAAC,YAAqB;QACzC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;gBAChE,IAAI,KAAK;oBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;gBACrD,OAAO,CAAC,OAAO,EAAE,CAAA;gBACjB,IAAI,YAAY;oBAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,QAAgC,EAAE,MAA6B;QACtE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAA;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;CACF"}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@blockcast/mmt-manifest-verify",
+  "version": "0.1.0",
+  "description": "Canonical live MMT source-auth manifest verifier",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.8.0"
+  },
+  "devDependencies": {
+    "@blockcast/mmt-fec": "file:../fec",
+    "typescript": "^5.3.0",
+    "vitest": "^1.0.0"
+  },
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Blockcast/libmmt.git",
+    "directory": "packages/mmt-manifest-verify"
+  }
+}

package/src/admission.ts

@@ -0,0 +1,171 @@
+import {
+  sourceAuthMerkleRoot,
+  sourceAuthObjectDigest,
+  sourceAuthSignaturePreimage,
+  trimRecoveredSourceAuthObject,
+  type SourceAuthGroupClose,
+  type SourceAuthObjectEntry,
+} from './source-auth.js'
+
+export type SourceAuthAdmissionState =
+  | 'pending-entry'
+  | 'pending-object'
+  | 'provisional'
+  | 'authenticated'
+
+export interface SourceAuthObjectAdmission {
+  groupId: bigint
+  objectId: number
+  recovered: boolean
+  state: Exclude<SourceAuthAdmissionState, 'pending-object'>
+}
+
+interface PendingSourceAuthObject {
+  bytes: Uint8Array
+  recovered: boolean
+}
+
+function requireU64(name: string, value: bigint): void {
+  if (value < 0n || value > 0xffff_ffff_ffff_ffffn) {
+    throw new Error(`${name} must be an unsigned 64-bit integer`)
+  }
+}
+
+function equalBytes(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.byteLength !== right.byteLength) return false
+  return left.every((value, index) => value === right[index])
+}
+
+/**
+ * Bounded media/manifest rendezvous for the browser player receive path.
+ * Object digest admission is synchronous; only the group-close signature is deferred.
+ */
+export class SourceAuthAdmission {
+  readonly #manifestAuthenticated: boolean
+  readonly #entries = new Map<number, SourceAuthObjectEntry>()
+  readonly #pendingObjects = new Map<number, PendingSourceAuthObject>()
+  readonly #entriesAwaitingObjects = new Set<number>()
+  readonly #admissions = new Map<number, SourceAuthObjectAdmission>()
+  #groupId: bigint | null = null
+  #closed = false
+
+  constructor(options: { manifestAuthenticated: boolean }) {
+    this.#manifestAuthenticated = options.manifestAuthenticated
+  }
+
+  admitObject(input: {
+    groupId: bigint
+    objectId: number
+    bytes: Uint8Array
+    recovered?: boolean
+  }): SourceAuthObjectAdmission {
+    this.#requireGroup(input.groupId)
+    if (this.#closed) throw new Error('source-auth group is already closed')
+    if (this.#admissions.has(input.objectId) || this.#pendingObjects.has(input.objectId)) {
+      throw new Error(`duplicate source-auth object ${input.objectId}`)
+    }
+    const entry = this.#entries.get(input.objectId)
+    if (entry) {
+      this.#entriesAwaitingObjects.delete(input.objectId)
+      return this.#verifyObject(entry, input.bytes, input.recovered ?? false)
+    }
+    if (this.#pendingObjects.size >= 1) {
+      throw new Error('source-auth media exceeds one-object manifest skew')
+    }
+    this.#pendingObjects.set(input.objectId, {
+      bytes: input.bytes,
+      recovered: input.recovered ?? false,
+    })
+    return {
+      groupId: input.groupId,
+      objectId: input.objectId,
+      recovered: input.recovered ?? false,
+      state: 'pending-entry',
+    }
+  }
+
+  admitEntry(entry: SourceAuthObjectEntry): SourceAuthObjectAdmission | SourceAuthAdmissionState {
+    this.#requireGroup(entry.groupId)
+    if (this.#closed) throw new Error('source-auth group is already closed')
+    if (this.#entries.has(entry.objectId)) {
+      throw new Error(`duplicate source-auth manifest entry ${entry.objectId}`)
+    }
+    const pending = this.#pendingObjects.get(entry.objectId)
+    if (!pending && this.#entriesAwaitingObjects.size >= 1) {
+      throw new Error('source-auth manifest exceeds one-object media skew')
+    }
+    this.#entries.set(entry.objectId, entry)
+    if (!pending) {
+      this.#entriesAwaitingObjects.add(entry.objectId)
+      return 'pending-object'
+    }
+    this.#pendingObjects.delete(entry.objectId)
+    return this.#verifyObject(entry, pending.bytes, pending.recovered)
+  }
+
+  objectState(objectId: number): SourceAuthAdmissionState | undefined {
+    if (this.#pendingObjects.has(objectId)) return 'pending-entry'
+    if (this.#entriesAwaitingObjects.has(objectId)) return 'pending-object'
+    if (this.#closed && this.#admissions.has(objectId)) return 'authenticated'
+    return this.#admissions.get(objectId)?.state
+  }
+
+  async verifyClose(
+    close: SourceAuthGroupClose,
+    authScope: Uint8Array,
+    publicKey: CryptoKey,
+    subtle: SubtleCrypto = globalThis.crypto.subtle,
+  ): Promise<void> {
+    this.#requireGroup(close.groupId)
+    if (this.#closed) throw new Error('source-auth group is already closed')
+    if (this.#pendingObjects.size !== 0 || this.#entriesAwaitingObjects.size !== 0) {
+      throw new Error('source-auth group closed with unmatched objects or entries')
+    }
+    if (close.objectCount !== this.#entries.size || this.#admissions.size !== this.#entries.size) {
+      throw new Error('source-auth group close object count mismatch')
+    }
+    const root = sourceAuthMerkleRoot([...this.#entries.values()])
+    if (!equalBytes(root, close.root)) throw new Error('source-auth group root mismatch')
+    const verified = await subtle.verify(
+      'Ed25519',
+      publicKey,
+      new Uint8Array(close.signature).buffer,
+      new Uint8Array(
+        sourceAuthSignaturePreimage(authScope, close.groupId, close.objectCount, root),
+      ).buffer,
+    )
+    if (!verified) throw new Error('source-auth group close signature failed')
+    for (const admission of this.#admissions.values()) admission.state = 'authenticated'
+    this.#closed = true
+  }
+
+  #requireGroup(groupId: bigint): void {
+    requireU64('groupId', groupId)
+    if (this.#groupId === null) this.#groupId = groupId
+    else if (this.#groupId !== groupId) throw new Error('source-auth group identity mismatch')
+  }
+
+  #verifyObject(
+    entry: SourceAuthObjectEntry,
+    bytes: Uint8Array,
+    recovered: boolean,
+  ): SourceAuthObjectAdmission {
+    const authenticated = recovered
+      ? trimRecoveredSourceAuthObject(bytes, entry.trueLength)
+      : bytes
+    if (!recovered && bytes.byteLength !== entry.trueLength) {
+      throw new Error(`direct source-auth object length mismatch for ${entry.objectId}`)
+    }
+    if (!equalBytes(sourceAuthObjectDigest(authenticated), entry.digest)) {
+      throw new Error(`source-auth object digest mismatch for ${entry.objectId}`)
+    }
+    const admission: SourceAuthObjectAdmission = {
+      groupId: entry.groupId,
+      objectId: entry.objectId,
+      recovered,
+      state: this.#manifestAuthenticated ? 'authenticated' : 'provisional',
+    }
+    this.#admissions.set(entry.objectId, admission)
+    return admission
+  }
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+export * from './source-auth.js'
+export * from './admission.js'
+export * from './verifier.js'