@blockcast/mmt-manifest-verify 0.3.0 → 0.4.0-main.1d3ea1cc8ff2

package/dist/bc-provenance-v2-receiver.d.ts

@@ -0,0 +1,123 @@
+import { type BcProvenanceV2Endpoint } from './bc-provenance-v2.js';
+/**
+ * Receiver enforcement for bc-provenance version 2, draft-ramadan-moq-multicast-01
+ * Section 7.2.7 at abf183bfb83e616909453872c4d788db4b3acd19 (md :1397-2010).
+ * One instance is one flow (S, G, port) of one stream generation.
+ */
+/** Record path: `manifestPort` on the multicast tuple, or the MoQ manifest track mirror. */
+export type BcpV2RecordPath = 'multicast' | 'mirror';
+/** Data path: the multicast group, or a MoQ unicast path (hold queue widened by W). */
+export type BcpV2DataPath = 'multicast' | 'unicast';
+export type BcpV2RecordDrop = 'length' | 'magic' | 'kid' | 'epoch' | 'mseq' | 'closed' | 'sent' | 'count' | 'hash_alg' | 'ctx' | 'budget' | 'signature' | 'duplicate';
+export interface BcpV2Key {
+    kid: number;
+    publicKey: Uint8Array;
+    firstEpoch: number;
+}
+export interface BcpV2ReceiverConfig {
+    endpoint: BcProvenanceV2Endpoint;
+    keys: readonly BcpV2Key[];
+    /** Catalog (or provisioned) join floor. */
+    minEpoch: number;
+    /** Per-kid epoch floor kept with a key pin; applies at join. */
+    pinnedEpochFloor?: ReadonlyMap<number, number>;
+    /** Endpoint `bandwidth`, bits per second; bounds the hold queues. */
+    bandwidth: number;
+    maxAuthDelayMs?: number;
+    manifestTimerMs?: number;
+    /** Recomputed `ctx`; omit when the receiver has no catalog (ctx carried blind). */
+    catalogCtx?: Uint8Array;
+    acceptedHashAlgs?: readonly number[];
+    /** Widening W (ms) of the unicast hold and the mirror's freshness; capped at 5000. */
+    widenMs?: number;
+    /** True when the receiver reads the manifest track and may be on the multicast path: the lead applies. */
+    applyLead?: boolean;
+    /** False on a receiver without a UTC-synchronized clock (Clock paragraph). */
+    checkFreshness?: boolean;
+    /** Unix milliseconds; one clock serves both the UTC freshness check and the timers. */
+    now?: () => number;
+    verifySignature?: (publicKey: Uint8Array, message: Uint8Array, signature: Uint8Array) => boolean;
+}
+export interface BcpV2RecordResult {
+    verdict: 'verified' | BcpV2RecordDrop;
+    /** Held datagrams admitted, in order: by a verified record, or by a duplicate copy that raised the lead. */
+    admitted: Uint8Array[];
+}
+export interface BcpV2DatagramResult {
+    verdict: 'admitted' | 'held' | 'duplicate' | 'overflow';
+    admitted: Uint8Array[];
+}
+/** The bound of Section 7.2.5 (Emission and Cadence) on the lead and on W. */
+export declare const BCPV2_LEAD_BOUND_MS = 5000;
+interface Bucket {
+    tokens: number;
+    last: number;
+    dropped: number;
+}
+export declare class BcProvenanceV2Receiver {
+    readonly maxAuthDelayMs: number;
+    readonly manifestTimerMs: number;
+    readonly widenMs: number;
+    /** Datagrams that left a hold queue at expiry, per path: the loss signal for failover. */
+    readonly expired: {
+        multicast: number;
+        unicast: number;
+    };
+    private readonly cfg;
+    private readonly now;
+    private readonly verifySig;
+    private readonly accepted;
+    private readonly queueLimit;
+    private current;
+    private previous;
+    private graceStart;
+    private hashAlg;
+    private verified;
+    private highest;
+    private closedAt;
+    private lead;
+    private pending;
+    private admittedUntil;
+    private hold;
+    private holdBytes;
+    private order;
+    readonly buckets: Record<BcpV2RecordPath, Bucket>;
+    constructor(cfg: BcpV2ReceiverConfig);
+    private get grace();
+    /** The mirror's lead in force: 0 without a manifest track, the bound until one is measured. */
+    get leadMs(): number;
+    /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+    onRecord(bytes: Uint8Array, path: BcpV2RecordPath): BcpV2RecordResult;
+    /** Step 2: a data datagram on `port` (or a packet of a listed track over MoQ unicast). */
+    onDatagram(datagram: Uint8Array, path: BcpV2DataPath): BcpV2DatagramResult;
+    /**
+     * Discard the per-flow state on a `streamId` change or a key-set change that fails the
+     * flow's current (kid, epoch): budgets and hold queues survive, held digests are cleared.
+     */
+    resetGeneration(): void;
+    /** The receiver ceased to hold the endpoint: drop everything; no drop here is an expiry. */
+    release(): void;
+    private digest;
+    private enqueue;
+    /** Remove and return the oldest held datagram with `digest`, across both queues. */
+    private takeHeld;
+    private dropAdmittedHeld;
+    /** Step 1 pair handling: admit a held copy, or insert a pending entry. */
+    private handlePair;
+    /** A byte-identical copy dropped by the already-verified lookup. */
+    private arrival;
+    private previousAdmitted;
+    /** The replay floor this record meets: its path's, or the higher of both from the mirror. */
+    private floor;
+    private raise;
+    private take;
+    private expire;
+    /**
+     * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
+     * while the freshness check would still pass its copy on `manifestPort`.
+     * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
+     */
+    private prune;
+}
+export {};
+//# sourceMappingURL=bc-provenance-v2-receiver.d.ts.map

package/dist/bc-provenance-v2-receiver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bc-provenance-v2-receiver.d.ts","sourceRoot":"","sources":["../src/bc-provenance-v2-receiver.ts"],"names":[],"mappings":"AAEA,OAAO,EAOL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAA;AAE9B;;;;GAIG;AAEH,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,CAAA;AACpD,uFAAuF;AACvF,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,CAAA;AAEnD,MAAM,MAAM,eAAe,GACvB,QAAQ,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAC3E,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,WAAW,GAAG,WAAW,CAAA;AAE7D,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,sBAAsB,CAAA;IAChC,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAA;IACzB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;IAChB,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9C,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mFAAmF;IACnF,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,8EAA8E;IAC9E,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uFAAuF;IACvF,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAA;CACjG;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,UAAU,GAAG,eAAe,CAAA;IACrC,4GAA4G;IAC5G,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,CAAA;IACvD,QAAQ,EAAE,UAAU,EAAE,CAAA;CACvB;AAED,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,OAAO,CAAA;AAsCvC,UAAU,MAAM;IACd,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAWD,qBAAa,sBAAsB;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,0FAA0F;IAC1F,QAAQ,CAAC,OAAO;;;MAA+B;IAE/C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAqB;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqD;IAC/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAE1D,OAAO,CAAC,OAAO,CAAgD;IAC/D,OAAO,CAAC,QAAQ,CAAmD;IACnE,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,OAAO,CAA4F;IAC3G,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,IAAI,CAAsB;IAClC,OAAO,CAAC,OAAO,CAA+B;IAC9C,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,IAAI,CAAgE;IAC5E,OAAO,CAAC,SAAS,CAA8D;IAC/E,OAAO,CAAC,KAAK,CAAI;IACjB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;gBAErC,GAAG,EAAE,mBAAmB;IAiCpC,OAAO,KAAK,KAAK,GAEhB;IAED,+FAA+F;IAC/F,IAAI,MAAM,IAAI,MAAM,CAGnB;IAED,6FAA6F;IAC7F,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,iBAAiB;IAoFrE,0FAA0F;IAC1F,UAAU,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,mBAAmB;IAqB1E;;;OAGG;IACH,eAAe,IAAI,IAAI;IAcvB,4FAA4F;IAC5F,OAAO,IAAI,IAAI;IAMf,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,OAAO;IAWf,oFAAoF;IACpF,OAAO,CAAC,QAAQ;IAchB,OAAO,CAAC,gBAAgB;IAUxB,0EAA0E;IAC1E,OAAO,CAAC,UAAU;IAelB,oEAAoE;IACpE,OAAO,CAAC,OAAO;IAmCf,OAAO,CAAC,gBAAgB;IAQxB,6FAA6F;IAC7F,OAAO,CAAC,KAAK;IAQb,OAAO,CAAC,KAAK;IAKb,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,MAAM;IAsBd;;;;OAIG;IACH,OAAO,CAAC,KAAK;CAWd"}

package/dist/bc-provenance-v2-receiver.js

@@ -0,0 +1,409 @@
+import { ed25519 } from '@noble/curves/ed25519';
+import { sha256 } from '@noble/hashes/sha256';
+import { BCPV2_HASH_ALG_SHA256, BCPV2_MAX_RECORD_LENGTH, BCPV2_MIN_RECORD_LENGTH, bcProvenanceV2DatagramDigest, bcProvenanceV2SignedMessage, decodeBcProvenanceV2Record, } from './bc-provenance-v2.js';
+/** The bound of Section 7.2.5 (Emission and Cadence) on the lead and on W. */
+export const BCPV2_LEAD_BOUND_MS = 5000;
+const REPLAY_WINDOW = 64n;
+const BUCKET_DEPTH = 64;
+const BUCKET_RATE_PER_MS = 1;
+const hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+function sameBytes(a, b) {
+    if (a.byteLength !== b.byteLength)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.byteLength; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+export class BcProvenanceV2Receiver {
+    maxAuthDelayMs;
+    manifestTimerMs;
+    widenMs;
+    /** Datagrams that left a hold queue at expiry, per path: the loss signal for failover. */
+    expired = { multicast: 0, unicast: 0 };
+    cfg;
+    now;
+    verifySig;
+    accepted;
+    queueLimit;
+    current = null;
+    previous = null;
+    graceStart = {};
+    hashAlg = null;
+    verified = new Map();
+    highest = { multicast: new Map(), mirror: new Map() };
+    closedAt = new Map();
+    lead = null;
+    pending = new Map();
+    admittedUntil = new Map();
+    hold = { multicast: [], unicast: [] };
+    holdBytes = { multicast: 0, unicast: 0 };
+    order = 0;
+    buckets;
+    constructor(cfg) {
+        this.maxAuthDelayMs = cfg.maxAuthDelayMs ?? 200;
+        this.manifestTimerMs = cfg.manifestTimerMs ?? 20;
+        // Section 4.1 / 7.2.6: an endpoint outside these ranges is ignored, never clamped.
+        if (!(this.maxAuthDelayMs >= 50 && this.maxAuthDelayMs <= 1000) || !(this.manifestTimerMs >= 1)) {
+            throw new Error('BCPV2 endpoint ignored: maxAuthDelayMs or manifestTimerMs out of range');
+        }
+        if (!(cfg.bandwidth > 0))
+            throw new Error('BCPV2 endpoint ignored: protected endpoint without bandwidth');
+        const kids = new Set(cfg.keys.map((k) => k.kid));
+        const firsts = new Set(cfg.keys.map((k) => k.firstEpoch));
+        if (cfg.keys.length < 1 || kids.size !== cfg.keys.length || firsts.size !== cfg.keys.length) {
+            throw new Error('BCPV2 key set invalid: no keys, or a repeated kid or firstEpoch');
+        }
+        this.cfg = cfg;
+        this.widenMs = Math.min(Math.max(cfg.widenMs ?? 0, 0), BCPV2_LEAD_BOUND_MS);
+        this.now = cfg.now ?? Date.now;
+        this.verifySig = cfg.verifySignature ?? ((pk, msg, sig) => {
+            try {
+                return ed25519.verify(sig, msg, pk, { zip215: false });
+            }
+            catch {
+                return false;
+            }
+        });
+        this.accepted = cfg.acceptedHashAlgs ?? [BCPV2_HASH_ALG_SHA256];
+        // Receiver-local policy (Section 7.3) bounds the catalog's bandwidth: 10 Gbit/s.
+        const bandwidth = Math.min(cfg.bandwidth, 10e9);
+        this.queueLimit = {
+            multicast: (this.maxAuthDelayMs * bandwidth) / 8000,
+            unicast: ((this.maxAuthDelayMs + this.widenMs) * bandwidth) / 8000,
+        };
+        const t = this.now();
+        this.buckets = {
+            multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
+            mirror: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
+        };
+    }
+    get grace() {
+        return this.maxAuthDelayMs + 2 * this.manifestTimerMs;
+    }
+    /** The mirror's lead in force: 0 without a manifest track, the bound until one is measured. */
+    get leadMs() {
+        if (!this.cfg.applyLead)
+            return 0;
+        return this.lead ?? BCPV2_LEAD_BOUND_MS;
+    }
+    /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+    onRecord(bytes, path) {
+        const now = this.now();
+        this.expire(now);
+        const drop = (verdict) => ({ verdict, admitted: [] });
+        const len = bytes.byteLength;
+        if (len < BCPV2_MIN_RECORD_LENGTH || len > BCPV2_MAX_RECORD_LENGTH || (len - 132) % 32 !== 0)
+            return drop('length');
+        const view = new DataView(bytes.buffer, bytes.byteOffset, len);
+        if (view.getUint32(0) !== 0x4d484d32)
+            return drop('magic');
+        const kid = view.getUint32(4);
+        const epoch = view.getUint32(8);
+        const mseq = view.getBigUint64(12);
+        const count = view.getUint16(28);
+        const hashAlg = bytes[30];
+        const sent = view.getUint32(32);
+        const key = this.cfg.keys.find((k) => k.kid === kid);
+        if (!key)
+            return drop('kid');
+        const next = Math.min(...this.cfg.keys.map((k) => k.firstEpoch).filter((f) => f > key.firstEpoch), Infinity);
+        if (epoch < key.firstEpoch || epoch >= next)
+            return drop('epoch');
+        const id = `${kid}:${epoch}:${mseq}`;
+        const seen = this.verified.get(id);
+        if (seen) {
+            // One lookup and one hash: a byte-identical copy counts as an arrival on this path.
+            const admitted = hex(sha256(bytes)) === seen.digest ? this.arrival(seen, path, now) : [];
+            return { verdict: 'duplicate', admitted };
+        }
+        const ke = `${kid}:${epoch}`;
+        if (this.current === null) {
+            if (epoch < this.cfg.minEpoch || epoch < (this.cfg.pinnedEpochFloor?.get(kid) ?? 0))
+                return drop('epoch');
+        }
+        else if (epoch < this.current.epoch && !this.previousAdmitted(epoch, path, now)) {
+            return drop('epoch');
+        }
+        const floor = this.floor(ke, path);
+        if (floor !== undefined && mseq <= floor - REPLAY_WINDOW)
+            return drop('mseq');
+        const closed = this.closedAt.get(ke);
+        if (closed !== undefined && mseq > closed)
+            return drop('closed');
+        if (this.cfg.checkFreshness !== false) {
+            const behind = 7000 + this.maxAuthDelayMs + (path === 'mirror' ? this.widenMs : 0);
+            if (sent * 1000 < now - behind || sent * 1000 > now + 6000)
+                return drop('sent');
+        }
+        if (count !== (len - 132) / 32)
+            return drop('count');
+        if (!this.accepted.includes(hashAlg) || (this.hashAlg !== null && hashAlg !== this.hashAlg))
+            return drop('hash_alg');
+        if (this.cfg.catalogCtx && !sameBytes(bytes.subarray(36, 68), this.cfg.catalogCtx))
+            return drop('ctx');
+        if (!this.take(path, now))
+            return drop('budget');
+        const record = decodeBcProvenanceV2Record(bytes);
+        if (!this.verifySig(key.publicKey, bcProvenanceV2SignedMessage(record, this.cfg.endpoint), record.signature)) {
+            return drop('signature');
+        }
+        if (this.current === null || epoch > this.current.epoch) {
+            if (this.current !== null) {
+                this.previous = { epoch: this.current.epoch, deadline: now + BCPV2_LEAD_BOUND_MS + this.grace };
+            }
+            this.current = { epoch, since: now };
+            this.graceStart = { [path]: now };
+            if (this.hashAlg === null) {
+                this.hashAlg = hashAlg;
+                for (const queue of Object.values(this.hold)) {
+                    for (const held of queue)
+                        held.digest ??= this.digest(held.datagram);
+                }
+            }
+        }
+        else if (epoch === this.current.epoch) {
+            this.graceStart[path] ??= now;
+        }
+        const entry = {
+            kid, epoch, mseq, path, arrival: now, sent,
+            digest: hex(sha256(bytes)),
+            pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+            awaitingMulticast: path === 'mirror',
+        };
+        this.verified.set(id, entry);
+        this.raise(ke, path, mseq);
+        if (record.flags & 1)
+            this.closedAt.set(ke, mseq);
+        const widen = path === 'mirror' ? (this.cfg.applyLead ? this.leadMs : this.widenMs) : 0;
+        const admitted = [];
+        for (const pair of entry.pairs)
+            this.handlePair(pair, now, now + this.grace + widen, now, admitted);
+        this.dropAdmittedHeld();
+        this.prune(now);
+        return { verdict: 'verified', admitted };
+    }
+    /** Step 2: a data datagram on `port` (or a packet of a listed track over MoQ unicast). */
+    onDatagram(datagram, path) {
+        const now = this.now();
+        this.expire(now);
+        if (this.hashAlg !== null) {
+            const d = this.digest(datagram);
+            const list = this.pending.get(d);
+            if (list?.length) {
+                list.sort((a, b) => (a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0));
+                const hit = list.shift();
+                if (list.length === 0)
+                    this.pending.delete(d);
+                hit.pair.pending = undefined;
+                hit.pair.admitted = true;
+                this.admittedUntil.set(d, now + this.maxAuthDelayMs + this.leadMs);
+                return { verdict: 'admitted', admitted: [datagram] };
+            }
+            if (this.admittedUntil.has(d))
+                return { verdict: 'duplicate', admitted: [] };
+            return this.enqueue({ digest: d, datagram, expiry: 0, order: 0 }, path, now);
+        }
+        return this.enqueue({ datagram, expiry: 0, order: 0 }, path, now);
+    }
+    /**
+     * Discard the per-flow state on a `streamId` change or a key-set change that fails the
+     * flow's current (kid, epoch): budgets and hold queues survive, held digests are cleared.
+     */
+    resetGeneration() {
+        this.current = null;
+        this.previous = null;
+        this.graceStart = {};
+        this.hashAlg = null;
+        this.verified.clear();
+        this.highest = { multicast: new Map(), mirror: new Map() };
+        this.closedAt.clear();
+        this.lead = null;
+        this.pending.clear();
+        this.admittedUntil.clear();
+        for (const queue of Object.values(this.hold))
+            for (const held of queue)
+                held.digest = undefined;
+    }
+    /** The receiver ceased to hold the endpoint: drop everything; no drop here is an expiry. */
+    release() {
+        this.resetGeneration();
+        this.hold = { multicast: [], unicast: [] };
+        this.holdBytes = { multicast: 0, unicast: 0 };
+    }
+    digest(datagram) {
+        return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
+    }
+    enqueue(held, path, now) {
+        if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+            return { verdict: 'overflow', admitted: [] }; // drop newest
+        }
+        held.expiry = now + this.maxAuthDelayMs + (path === 'unicast' ? this.widenMs : 0);
+        held.order = this.order++;
+        this.hold[path].push(held);
+        this.holdBytes[path] += held.datagram.byteLength;
+        return { verdict: 'held', admitted: [] };
+    }
+    /** Remove and return the oldest held datagram with `digest`, across both queues. */
+    takeHeld(digest) {
+        let best;
+        for (const path of ['multicast', 'unicast']) {
+            const index = this.hold[path].findIndex((h) => h.digest === digest);
+            if (index >= 0 && (!best || this.hold[path][index].order < best.order)) {
+                best = { path, index, order: this.hold[path][index].order };
+            }
+        }
+        if (!best)
+            return undefined;
+        const [held] = this.hold[best.path].splice(best.index, 1);
+        this.holdBytes[best.path] -= held.datagram.byteLength;
+        return held.datagram;
+    }
+    dropAdmittedHeld() {
+        for (const path of ['multicast', 'unicast']) {
+            this.hold[path] = this.hold[path].filter((h) => {
+                const keep = h.digest === undefined || !this.admittedUntil.has(h.digest);
+                if (!keep)
+                    this.holdBytes[path] -= h.datagram.byteLength;
+                return keep;
+            });
+        }
+    }
+    /** Step 1 pair handling: admit a held copy, or insert a pending entry. */
+    handlePair(pair, now, expiry, inserted, out) {
+        const datagram = this.takeHeld(pair.digest);
+        if (datagram) {
+            pair.admitted = true;
+            this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + this.leadMs);
+            out.push(datagram);
+            return;
+        }
+        const entry = { pair, inserted, expiry };
+        pair.pending = entry;
+        const list = this.pending.get(pair.digest);
+        if (list)
+            list.push(entry);
+        else
+            this.pending.set(pair.digest, [entry]);
+    }
+    /** A byte-identical copy dropped by the already-verified lookup. */
+    arrival(seen, path, now) {
+        const ke = `${seen.kid}:${seen.epoch}`;
+        this.raise(ke, path, seen.mseq);
+        if (this.current && seen.epoch === this.current.epoch)
+            this.graceStart[path] ??= now;
+        if (path !== 'multicast' || !seen.awaitingMulticast)
+            return [];
+        seen.awaitingMulticast = false;
+        if (!this.cfg.applyLead)
+            return [];
+        const t = this.manifestTimerMs;
+        const interval = Math.min(Math.ceil((now - seen.arrival) / t) * t, BCPV2_LEAD_BOUND_MS);
+        if (this.lead === null) {
+            this.lead = interval; // the bound applied until now covered every earlier entry
+            return [];
+        }
+        if (interval <= this.lead)
+            return [];
+        this.lead = interval;
+        // Re-handle this record and every mirrored record within the raised lead still awaiting its copy.
+        const out = [];
+        const records = [seen, ...[...this.verified.values()].filter((v) => v.awaitingMulticast && v.arrival >= now - interval)];
+        for (const v of records) {
+            for (const pair of v.pairs) {
+                if (pair.admitted) {
+                    this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + interval);
+                }
+                else if (pair.pending) {
+                    pair.pending.expiry = pair.pending.inserted + this.grace + interval;
+                }
+                else {
+                    this.handlePair(pair, now, now + this.grace + interval, now, out);
+                }
+            }
+        }
+        this.dropAdmittedHeld();
+        return out;
+    }
+    previousAdmitted(epoch, path, now) {
+        if (!this.previous || epoch !== this.previous.epoch)
+            return false; // expire() retires it at its deadline
+        const m = this.graceStart.multicast;
+        if (path === 'multicast')
+            return m === undefined || now <= m + this.grace;
+        const starts = [m, this.graceStart.mirror].filter((s) => s !== undefined);
+        return starts.length > 0 && now <= Math.min(...starts) + this.grace;
+    }
+    /** The replay floor this record meets: its path's, or the higher of both from the mirror. */
+    floor(ke, path) {
+        const m = this.highest.multicast.get(ke);
+        if (path === 'multicast')
+            return m;
+        const r = this.highest.mirror.get(ke);
+        if (m === undefined)
+            return r;
+        return r === undefined || m > r ? m : r;
+    }
+    raise(ke, path, mseq) {
+        const h = this.highest[path].get(ke);
+        if (h === undefined || mseq > h)
+            this.highest[path].set(ke, mseq);
+    }
+    take(path, now) {
+        const b = this.buckets[path];
+        b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+        b.last = now;
+        if (b.tokens < 1) {
+            b.dropped++;
+            return false;
+        }
+        b.tokens -= 1;
+        return true;
+    }
+    expire(now) {
+        for (const path of ['multicast', 'unicast']) {
+            this.hold[path] = this.hold[path].filter((h) => {
+                if (h.expiry > now)
+                    return true;
+                this.holdBytes[path] -= h.datagram.byteLength;
+                this.expired[path]++;
+                return false;
+            });
+        }
+        for (const [d, list] of this.pending) {
+            const live = list.filter((p) => {
+                if (p.expiry > now)
+                    return true;
+                p.pair.pending = undefined;
+                return false;
+            });
+            if (live.length)
+                this.pending.set(d, live);
+            else
+                this.pending.delete(d);
+        }
+        for (const [d, until] of this.admittedUntil)
+            if (until <= now)
+                this.admittedUntil.delete(d);
+        if (this.previous && now > this.previous.deadline)
+            this.previous = null;
+    }
+    /**
+     * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
+     * while the freshness check would still pass its copy on `manifestPort`.
+     * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
+     */
+    prune(now) {
+        const retention = 7000 + this.maxAuthDelayMs;
+        for (const [id, v] of this.verified) {
+            const h = this.highest[v.path].get(`${v.kid}:${v.epoch}`);
+            const aboveFloor = h === undefined || v.mseq > h - REPLAY_WINDOW;
+            const fresh = this.cfg.checkFreshness === false ? v.arrival + retention >= now : v.sent * 1000 + retention >= now;
+            const current = this.current && (v.epoch === this.current.epoch || v.epoch === this.previous?.epoch);
+            if (current && (aboveFloor || (v.path === 'mirror' && fresh)))
+                continue;
+            this.verified.delete(id);
+        }
+    }
+}
+//# sourceMappingURL=bc-provenance-v2-receiver.js.map

package/dist/bc-provenance-v2-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bc-provenance-v2-receiver.js","sourceRoot":"","sources":["../src/bc-provenance-v2-receiver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAE3B,MAAM,uBAAuB,CAAA;AA2D9B,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AACvC,MAAM,aAAa,GAAG,GAAG,CAAA;AACzB,MAAM,YAAY,GAAG,EAAE,CAAA;AACvB,MAAM,kBAAkB,GAAG,CAAC,CAAA;AAyC5B,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAE7G,SAAS,SAAS,CAAC,CAAa,EAAE,CAAa;IAC7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAA;IAC5D,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC;AAED,MAAM,OAAO,sBAAsB;IACxB,cAAc,CAAQ;IACtB,eAAe,CAAQ;IACvB,OAAO,CAAQ;IACxB,0FAA0F;IACjF,OAAO,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IAE9B,GAAG,CAAqB;IACxB,GAAG,CAAc;IACjB,SAAS,CAAqD;IAC9D,QAAQ,CAAmB;IAC3B,UAAU,CAA+B;IAElD,OAAO,GAA4C,IAAI,CAAA;IACvD,QAAQ,GAA+C,IAAI,CAAA;IAC3D,UAAU,GAA6C,EAAE,CAAA;IACzD,OAAO,GAAkB,IAAI,CAAA;IAC7B,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAA;IACtC,OAAO,GAAiD,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;IACnG,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IACpC,IAAI,GAAkB,IAAI,CAAA;IAC1B,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAA;IACtC,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAA;IACzC,IAAI,GAAkC,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpE,SAAS,GAAkC,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IACvE,KAAK,GAAG,CAAC,CAAA;IACR,OAAO,CAAiC;IAEjD,YAAY,GAAwB;QAClC,IAAI,CAAC,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAA;QAC/C,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,IAAI,EAAE,CAAA;QAChD,mFAAmF;QACnF,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,IAAI,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;QACzG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;QACzD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACpF,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAA;QAC3E,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAC9B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACxD,IAAI,CAAC;gBAAC,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAA;YAAC,CAAC;QACvF,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,gBAAgB,IAAI,CAAC,qBAAqB,CAAC,CAAA;QAC/D,iFAAiF;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,UAAU,GAAG;YAChB,SAAS,EAAE,CAAC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,GAAG,IAAI;YACnD,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,GAAG,IAAI;SACnE,CAAA;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG;YACb,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;YACxD,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;SACtD,CAAA;IACH,CAAC;IAED,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,CAAA;IACvD,CAAC;IAED,+FAA+F;IAC/F,IAAI,MAAM;QACR,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,CAAA;QACjC,OAAO,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAA;IACzC,CAAC;IAED,6FAA6F;IAC7F,QAAQ,CAAC,KAAiB,EAAE,IAAqB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,MAAM,IAAI,GAAG,CAAC,OAAwB,EAAqB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QACzF,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;QAC5B,IAAI,GAAG,GAAG,uBAAuB,IAAI,GAAG,GAAG,uBAAuB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QACnH,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAE,CAAA;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAA;QAC5G,IAAI,KAAK,GAAG,GAAG,CAAC,UAAU,IAAI,KAAK,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QAEjE,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAClC,IAAI,IAAI,EAAE,CAAC;YACT,oFAAoF;YACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACxF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAA;QAC3C,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,GAAG,IAAI,KAAK,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3G,CAAC;aAAM,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAClF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QACtB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,IAAI,KAAK,GAAG,aAAa;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChE,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YAClF,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,GAAG,IAAI;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAA;QACjF,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,CAAA;QACpD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,CAAA;QACpH,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;QACtG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,2BAA2B,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7G,OAAO,IAAI,CAAC,WAAW,CAAC,CAAA;QAC1B,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,mBAAmB,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;YACjG,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAA;YACpC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;YACjC,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;gBACtB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,KAAK,MAAM,IAAI,IAAI,KAAK;wBAAE,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACtE,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG,CAAA;QAC/B,CAAC;QAED,MAAM,KAAK,GAAa;YACtB,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI;YAC1C,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5G,iBAAiB,EAAE,IAAI,KAAK,QAAQ;SACrC,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1B,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACvF,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;QACnG,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACf,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;IAC1C,CAAC;IAED,0FAA0F;IAC1F,UAAU,CAAC,QAAoB,EAAE,IAAmB;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAChB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAChC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBACrF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAG,CAAA;gBACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC7C,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;gBAC5B,GAAG,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;gBACxB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;gBAClE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAA;YACtD,CAAC;YACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;YAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IACnE,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;QACpB,IAAI,CAAC,UAAU,GAAG,EAAE,CAAA;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACrB,IAAI,CAAC,OAAO,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAA;QAC1D,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;QACpB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAA;QAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;IACjG,CAAC;IAED,4FAA4F;IAC5F,OAAO;QACL,IAAI,CAAC,eAAe,EAAE,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;QAC1C,IAAI,CAAC,SAAS,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAA;IAC/C,CAAC;IAEO,MAAM,CAAC,QAAoB;QACjC,OAAO,GAAG,CAAC,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACvE,CAAC;IAEO,OAAO,CAAC,IAAU,EAAE,IAAmB,EAAE,GAAW;QAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA,CAAC,cAAc;QAC7D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACjF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAA;QAChD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC1C,CAAC;IAED,oFAAoF;IAC5E,QAAQ,CAAC,MAAc;QAC7B,IAAI,IAAuE,CAAA;QAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,SAAS,CAAU,EAAE,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;YACnE,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAE,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAE,CAAC,KAAK,EAAE,CAAA;YAC9D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAA;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAK,CAAC,QAAQ,CAAC,UAAU,CAAA;QACtD,OAAO,IAAK,CAAC,QAAQ,CAAA;IACvB,CAAC;IAEO,gBAAgB;QACtB,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,SAAS,CAAU,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;gBACxE,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAA;gBACxD,OAAO,IAAI,CAAA;YACb,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,UAAU,CAAC,IAAU,EAAE,GAAW,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAiB;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;YACpB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,MAAM,KAAK,GAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;QACjD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAA;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC1C,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;;YACrB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,oEAAoE;IAC5D,OAAO,CAAC,IAAc,EAAE,IAAqB,EAAE,GAAW;QAChE,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAA;QACtC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,GAAG,CAAA;QACpF,IAAI,IAAI,KAAK,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,CAAA;QAC9D,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAA;QAC9B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,OAAO,EAAE,CAAA;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,eAAe,CAAA;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAA;QACvF,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAA,CAAC,0DAA0D;YAC/E,OAAO,EAAE,CAAA;QACX,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAA;QACpC,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAA;QACpB,kGAAkG;QAClG,MAAM,GAAG,GAAiB,EAAE,CAAA;QAC5B,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,OAAO,IAAI,GAAG,GAAG,QAAQ,CAC1D,CAAC,CAAA;QACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC3B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAClB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC,CAAA;gBAC3E,CAAC;qBAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;gBACrE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,KAAK,GAAG,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;gBACnE,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAA;QACvB,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,gBAAgB,CAAC,KAAa,EAAE,IAAqB,EAAE,GAAW;QACxE,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA,CAAC,sCAAsC;QACxG,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAA;QACnC,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,CAAC,KAAK,SAAS,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;QACzE,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;QACtF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;IACrE,CAAC;IAED,6FAA6F;IACrF,KAAK,CAAC,EAAU,EAAE,IAAqB;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,CAAC,CAAA;QAClC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAA;QAC7B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,EAAU,EAAE,IAAqB,EAAE,IAAY;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IACnE,CAAC;IAEO,IAAI,CAAC,IAAqB,EAAE,GAAW;QAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC5B,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,CAAA;QACjF,CAAC,CAAC,IAAI,GAAG,GAAG,CAAA;QACZ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC,CAAC,OAAO,EAAE,CAAA;YACX,OAAO,KAAK,CAAA;QACd,CAAC;QACD,CAAC,CAAC,MAAM,IAAI,CAAC,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,MAAM,CAAC,GAAW;QACxB,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,SAAS,CAAU,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7C,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,IAAI,CAAA;gBAC/B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAA;gBAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;gBACpB,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC7B,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;oBAAE,OAAO,IAAI,CAAA;gBAC/B,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAA;gBAC1B,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CAAA;YACF,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;;gBACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC7B,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa;YAAE,IAAI,KAAK,IAAI,GAAG;gBAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3F,IAAI,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACzE,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,GAAW;QACvB,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,cAAc,CAAA;QAC5C,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;YACzD,MAAM,UAAU,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,aAAa,CAAA;YAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,GAAG,SAAS,IAAI,GAAG,CAAA;YACjH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YACpG,IAAI,OAAO,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC;gBAAE,SAAQ;YACvE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/bc-provenance-v2.d.ts

@@ -0,0 +1,74 @@
+/** Fixed-width bytes before a record's digest list. */
+export declare const BCPV2_HEADER_LENGTH = 68;
+export declare const BCPV2_SIGNATURE_LENGTH = 64;
+export declare const BCPV2_MIN_RECORD_LENGTH: number;
+export declare const BCPV2_MAX_RECORD_LENGTH = 1316;
+export declare const BCPV2_MAX_DIGESTS = 37;
+export declare const BCPV2_HASH_ALG_SHA256 = 1;
+export interface BcProvenanceV2Endpoint {
+    /** S in the AMBI pseudoheader and signature context. */
+    sourceAddress: string;
+    /** G in the AMBI pseudoheader and signature context. */
+    groupAddress: string;
+    /** UDP source and destination port of protected datagrams. */
+    port: number;
+    /** UDP destination port carrying manifest records. */
+    manifestPort: number;
+    /** Catalog-declared channel generation. */
+    streamId: number;
+}
+export interface BcProvenanceV2Record {
+    kid: number;
+    epoch: number;
+    mseq: bigint;
+    firstSeq: bigint;
+    count: number;
+    hashAlg: number;
+    flags: number;
+    sent: number;
+    ctx: Uint8Array;
+    digests: Uint8Array[];
+    signature: Uint8Array;
+    /** Record bytes covered by the signature, excluding the signature itself. */
+    body: Uint8Array;
+    /** A defensive copy of the complete wire record. */
+    raw: Uint8Array;
+}
+/** Parse an IPv4 or IPv6 address in the native-width form used on the wire. */
+export declare function parseBcProvenanceV2Address(address: string): Uint8Array;
+/**
+ * Decode the fixed-layout BCPV2 record from multicast-01 Section 7.2.3.
+ * Structural validation happens before callers inspect the variable digest list.
+ */
+export declare function decodeBcProvenanceV2Record(input: Uint8Array): BcProvenanceV2Record;
+/** Return the exact Ed25519 preimage from multicast-01 Section 7.2.4. */
+export declare function bcProvenanceV2SignedMessage(record: BcProvenanceV2Record, endpoint: BcProvenanceV2Endpoint): Uint8Array;
+/**
+ * Compute the AMBI Section 3.4.2 digest for one transmitted datagram.
+ * The payload includes the Source FEC Payload ID when one was transmitted.
+ */
+export declare function bcProvenanceV2DatagramDigest(endpoint: BcProvenanceV2Endpoint, payload: Uint8Array): Uint8Array;
+/** Verify the ordered digest list against the transmitted datagrams. */
+export declare function verifyBcProvenanceV2Datagrams(record: BcProvenanceV2Record, endpoint: BcProvenanceV2Endpoint, datagrams: readonly Uint8Array[]): boolean;
+export interface BcProvenanceV2Params {
+    codec: string;
+    /** 0 where MOQ-MMT Section 4.4.2 resolves none. */
+    timescale: number;
+    groupDurationTicks: number;
+    /** Absent for an entry with no `fec` object. */
+    fec?: {
+        algorithm: string;
+        sourceSymbols: number;
+        repairSymbols: number;
+        symbolSize: number;
+        interleaveDepthMs?: number;
+    };
+}
+/** `params_hash` of multicast-01 Section 7.2.4 (md :1068-1110), hash_alg 1. */
+export declare function bcProvenanceV2ParamsHash(params: BcProvenanceV2Params): Uint8Array;
+/**
+ * `ctx` of multicast-01 Section 7.2.4: the namespace fields in order, the endpoint's
+ * packetIds ascending, and `params_hash`. A flow without a MoQ catalog uses 32 zero octets.
+ */
+export declare function bcProvenanceV2Ctx(namespace: readonly (Uint8Array | string)[], packetIds: readonly number[], params: BcProvenanceV2Params): Uint8Array;
+//# sourceMappingURL=bc-provenance-v2.d.ts.map

package/dist/bc-provenance-v2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bc-provenance-v2.d.ts","sourceRoot":"","sources":["../src/bc-provenance-v2.ts"],"names":[],"mappings":"AAEA,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,KAAK,CAAA;AACrC,eAAO,MAAM,sBAAsB,KAAK,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAoD,CAAA;AACxF,eAAO,MAAM,uBAAuB,OAAO,CAAA;AAC3C,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,MAAM,WAAW,sBAAsB;IACrC,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAA;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAA;IACpB,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,UAAU,CAAA;IACf,OAAO,EAAE,UAAU,EAAE,CAAA;IACrB,SAAS,EAAE,UAAU,CAAA;IACrB,6EAA6E;IAC7E,IAAI,EAAE,UAAU,CAAA;IAChB,oDAAoD;IACpD,GAAG,EAAE,UAAU,CAAA;CAChB;AAqED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,CAGtE;AAuBD;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAmClF;AAED,yEAAyE;AACzE,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,sBAAsB,GAC/B,UAAU,CAiBZ;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,sBAAsB,EAChC,OAAO,EAAE,UAAU,GAClB,UAAU,CAsBZ;AAED,wEAAwE;AACxE,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,sBAAsB,EAChC,SAAS,EAAE,SAAS,UAAU,EAAE,GAC/B,OAAO,CAOT;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAA;IACjB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gDAAgD;IAChD,GAAG,CAAC,EAAE;QACJ,SAAS,EAAE,MAAM,CAAA;QACjB,aAAa,EAAE,MAAM,CAAA;QACrB,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAkBD,+EAA+E;AAC/E,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,GAAG,UAAU,CAajF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,SAAS,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,EAC3C,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,MAAM,EAAE,oBAAoB,GAC3B,UAAU,CAWZ"}