@sweberdev/witness 0.1.0 → 0.2.0

package/dist/{chunk-UBRK4CTM.js → chunk-PT57EYD7.js}

@@ -1,16 +1,19 @@
+import {
+  detectMediaFormat,
+  markFile,
+  readMarking
+} from "./chunk-F7OWVTCS.js";
 import {
   detectImageFormat,
   iptcSourceType,
-  markImage,
-  readImageMarking,
   readTextWatermark
-} from "./chunk-APXU3MTX.js";
+} from "./chunk-GXMGYIOK.js";
 
 // src/cli.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
 import { basename, extname, join } from "path";
 import { parseArgs } from "util";
-var HELP = `witness: AI Act Article 50 marking for images and text
+var HELP = `witness: AI Act Article 50 marking for images, audio, video and text
 
 Usage
   witness mark <files...> (--out <dir> | --in-place) [options]
@@ -29,7 +32,8 @@ inspect options
   --json                     one JSON object per file
   --require                  exit 1 if a file carries no AI marking
 
-Images: PNG, JPEG, WebP (XMP with IPTC Digital Source Type).
+Images: PNG, JPEG, WebP. Audio and video: MP3, WAV, MP4, MOV, M4A.
+All get XMP with the IPTC Digital Source Type.
 Text files are checked for the Witness text watermark.`;
 var KINDS = ["generated", "edited", "deepfake"];
 async function runCli(argv, io = defaultIo) {
@@ -81,11 +85,11 @@ async function mark(argv, io) {
   let failed = 0;
   for (const file of positionals) {
     const bytes = new Uint8Array(await readFile(file));
-    const result = markImage(bytes, input, {
+    const result = markFile(bytes, input, {
       c2pa: values["overwrite-c2pa"] ? "overwrite" : "skip"
     });
     if (result.status === "unsupported") {
-      io.err(`${file}: not a PNG, JPEG or WebP file, skipped`);
+      io.err(`${file}: not a PNG, JPEG, WebP, MP3, WAV or MP4 file, skipped`);
       failed++;
       continue;
     }
@@ -109,9 +113,9 @@ async function inspect(argv, io) {
   let unmarked = 0;
   for (const file of positionals) {
     const bytes = new Uint8Array(await readFile(file));
-    const format = detectImageFormat(bytes);
+    const format = detectImageFormat(bytes) ?? detectMediaFormat(bytes);
     if (format) {
-      const info = readImageMarking(bytes);
+      const info = readMarking(bytes);
       const marked = info.aiGenerated || info.c2pa;
       if (!marked) unmarked++;
       if (values.json) {
@@ -153,4 +157,4 @@ var defaultIo = {
 export {
   runCli
 };
-//# sourceMappingURL=chunk-UBRK4CTM.js.map
+//# sourceMappingURL=chunk-PT57EYD7.js.map

package/dist/chunk-PT57EYD7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { basename, extname, join } from \"node:path\";\nimport { parseArgs } from \"node:util\";\nimport { detectImageFormat } from \"./image.js\";\nimport { iptcSourceType } from \"./marking.js\";\nimport { detectMediaFormat, markFile, readMarking } from \"./media.js\";\nimport type { ContentKind, MarkingInput } from \"./types.js\";\nimport { readTextWatermark } from \"./watermark.js\";\n\nexport interface CliIo {\n  out: (line: string) => void;\n  err: (line: string) => void;\n}\n\nconst HELP = `witness: AI Act Article 50 marking for images, audio, video and text\n\nUsage\n  witness mark <files...> (--out <dir> | --in-place) [options]\n  witness inspect <files...> [--json] [--require]\n\nmark options\n  --generator <name>         AI system, e.g. \"gpt-image-2\"\n  --generator-version <v>    its version\n  --kind <kind>              generated (default), edited or deepfake\n  --provider <name>          your company or product\n  --url <url>                page that explains how you use AI\n  --description <text>       free text written to dc:description\n  --overwrite-c2pa           also rewrite files that carry a C2PA manifest\n\ninspect options\n  --json                     one JSON object per file\n  --require                  exit 1 if a file carries no AI marking\n\nImages: PNG, JPEG, WebP. Audio and video: MP3, WAV, MP4, MOV, M4A.\nAll get XMP with the IPTC Digital Source Type.\nText files are checked for the Witness text watermark.`;\n\nconst KINDS: ContentKind[] = [\"generated\", \"edited\", \"deepfake\"];\n\nexport async function runCli(argv: string[], io: CliIo = defaultIo): Promise<number> {\n  const [command, ...rest] = argv;\n  if (!command || command === \"--help\" || command === \"-h\" || command === \"help\") {\n    io.out(HELP);\n    return command ? 0 : 1;\n  }\n  try {\n    if (command === \"mark\") return await mark(rest, io);\n    if (command === \"inspect\") return await inspect(rest, io);\n    io.err(`Unknown command \"${command}\". Run \"witness --help\".`);\n    return 1;\n  } catch (error) {\n    io.err(error instanceof Error ? error.message : String(error));\n    return 1;\n  }\n}\n\nasync function mark(argv: string[], io: CliIo): Promise<number> {\n  const { values, positionals } = parseArgs({\n    args: argv,\n    allowPositionals: true,\n    options: {\n      out: { type: \"string\" },\n      \"in-place\": { type: \"boolean\" },\n      generator: { type: \"string\" },\n      \"generator-version\": { type: \"string\" },\n      kind: { type: \"string\" },\n      provider: { type: \"string\" },\n      url: { type: \"string\" },\n      description: { type: \"string\" },\n      \"overwrite-c2pa\": { type: \"boolean\" },\n    },\n  });\n  if (positionals.length === 0) throw new Error(\"witness mark: no files given.\");\n  if (!values.out && !values[\"in-place\"]) {\n    throw new Error(\"witness mark: pass --out <dir> or --in-place.\");\n  }\n  const kind = (values.kind ?? \"generated\") as ContentKind;\n  if (!KINDS.includes(kind))\n    throw new Error(`witness mark: --kind must be one of ${KINDS.join(\", \")}.`);\n  const input: MarkingInput = { kind };\n  if (values.generator) input.generator = values.generator;\n  if (values[\"generator-version\"]) input.generatorVersion = values[\"generator-version\"];\n  if (values.provider) input.provider = values.provider;\n  if (values.url) input.disclosureUrl = values.url;\n  if (values.description) input.description = values.description;\n  if (values.out) await mkdir(values.out, { recursive: true });\n\n  let failed = 0;\n  for (const file of positionals) {\n    const bytes = new Uint8Array(await readFile(file));\n    const result = markFile(bytes, input, {\n      c2pa: values[\"overwrite-c2pa\"] ? \"overwrite\" : \"skip\",\n    });\n    if (result.status === \"unsupported\") {\n      io.err(`${file}: not a PNG, JPEG, WebP, MP3, WAV or MP4 file, skipped`);\n      failed++;\n      continue;\n    }\n    if (result.status === \"skipped-c2pa\") {\n      io.err(`${file}: carries a C2PA manifest, left unchanged (use --overwrite-c2pa to force)`);\n      continue;\n    }\n    const target = values.out ? join(values.out, basename(file)) : file;\n    await writeFile(target, result.bytes);\n    io.out(`${file}: marked (${result.format}) -> ${target}`);\n  }\n  return failed > 0 ? 1 : 0;\n}\n\nasync function inspect(argv: string[], io: CliIo): Promise<number> {\n  const { values, positionals } = parseArgs({\n    args: argv,\n    allowPositionals: true,\n    options: { json: { type: \"boolean\" }, require: { type: \"boolean\" } },\n  });\n  if (positionals.length === 0) throw new Error(\"witness inspect: no files given.\");\n  let unmarked = 0;\n  for (const file of positionals) {\n    const bytes = new Uint8Array(await readFile(file));\n    const format = detectImageFormat(bytes) ?? detectMediaFormat(bytes);\n    if (format) {\n      const info = readMarking(bytes);\n      const marked = info.aiGenerated || info.c2pa;\n      if (!marked) unmarked++;\n      if (values.json) {\n        const { xmp: _xmp, ...rest } = info;\n        io.out(JSON.stringify({ file, ...rest }));\n      } else {\n        const parts = [\n          `${file}: ${format}`,\n          info.sourceType\n            ? `source type ${iptcSourceType(info.sourceType)}`\n            : \"no IPTC source type\",\n          info.generator ? `generator ${info.generator}` : null,\n          info.c2pa ? \"C2PA manifest present (not verified)\" : null,\n          marked ? \"AI-marked\" : \"NOT AI-marked\",\n        ];\n        io.out(parts.filter(Boolean).join(\", \"));\n      }\n      continue;\n    }\n    const ext = extname(file).toLowerCase();\n    const text = new TextDecoder().decode(bytes);\n    const watermark = readTextWatermark(text);\n    if (!watermark) unmarked++;\n    if (values.json) {\n      io.out(JSON.stringify({ file, format: ext.slice(1) || \"text\", watermark }));\n    } else {\n      io.out(\n        watermark\n          ? `${file}: text watermark found${watermark.generator ? `, generator ${watermark.generator}` : \"\"}${watermark.createdAt ? `, created ${watermark.createdAt}` : \"\"}`\n          : `${file}: no Witness text watermark`,\n      );\n    }\n  }\n  return values.require && unmarked > 0 ? 1 : 0;\n}\n\nconst defaultIo: CliIo = {\n  out: (line) => process.stdout.write(`${line}\\n`),\n  err: (line) => process.stderr.write(`${line}\\n`),\n};\n"],"mappings":";;;;;;;;;;;;AAAA,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,UAAU,SAAS,YAAY;AACxC,SAAS,iBAAiB;AAY1B,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBb,IAAM,QAAuB,CAAC,aAAa,UAAU,UAAU;AAE/D,eAAsB,OAAO,MAAgB,KAAY,WAA4B;AACnF,QAAM,CAAC,SAAS,GAAG,IAAI,IAAI;AAC3B,MAAI,CAAC,WAAW,YAAY,YAAY,YAAY,QAAQ,YAAY,QAAQ;AAC9E,OAAG,IAAI,IAAI;AACX,WAAO,UAAU,IAAI;AAAA,EACvB;AACA,MAAI;AACF,QAAI,YAAY,OAAQ,QAAO,MAAM,KAAK,MAAM,EAAE;AAClD,QAAI,YAAY,UAAW,QAAO,MAAM,QAAQ,MAAM,EAAE;AACxD,OAAG,IAAI,oBAAoB,OAAO,0BAA0B;AAC5D,WAAO;AAAA,EACT,SAAS,OAAO;AACd,OAAG,IAAI,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAC7D,WAAO;AAAA,EACT;AACF;AAEA,eAAe,KAAK,MAAgB,IAA4B;AAC9D,QAAM,EAAE,QAAQ,YAAY,IAAI,UAAU;AAAA,IACxC,MAAM;AAAA,IACN,kBAAkB;AAAA,IAClB,SAAS;AAAA,MACP,KAAK,EAAE,MAAM,SAAS;AAAA,MACtB,YAAY,EAAE,MAAM,UAAU;AAAA,MAC9B,WAAW,EAAE,MAAM,SAAS;AAAA,MAC5B,qBAAqB,EAAE,MAAM,SAAS;AAAA,MACtC,MAAM,EAAE,MAAM,SAAS;AAAA,MACvB,UAAU,EAAE,MAAM,SAAS;AAAA,MAC3B,KAAK,EAAE,MAAM,SAAS;AAAA,MACtB,aAAa,EAAE,MAAM,SAAS;AAAA,MAC9B,kBAAkB,EAAE,MAAM,UAAU;AAAA,IACtC;AAAA,EACF,CAAC;AACD,MAAI,YAAY,WAAW,EAAG,OAAM,IAAI,MAAM,+BAA+B;AAC7E,MAAI,CAAC,OAAO,OAAO,CAAC,OAAO,UAAU,GAAG;AACtC,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AACA,QAAM,OAAQ,OAAO,QAAQ;AAC7B,MAAI,CAAC,MAAM,SAAS,IAAI;AACtB,UAAM,IAAI,MAAM,uCAAuC,MAAM,KAAK,IAAI,CAAC,GAAG;AAC5E,QAAM,QAAsB,EAAE,KAAK;AACnC,MAAI,OAAO,UAAW,OAAM,YAAY,OAAO;AAC/C,MAAI,OAAO,mBAAmB,EAAG,OAAM,mBAAmB,OAAO,mBAAmB;AACpF,MAAI,OAAO,SAAU,OAAM,WAAW,OAAO;AAC7C,MAAI,OAAO,IAAK,OAAM,gBAAgB,OAAO;AAC7C,MAAI,OAAO,YAAa,OAAM,cAAc,OAAO;AACnD,MAAI,OAAO,IAAK,OAAM,MAAM,OAAO,KAAK,EAAE,WAAW,KAAK,CAAC;AAE3D,MAAI,SAAS;AACb,aAAW,QAAQ,aAAa;AAC9B,UAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,IAAI,CAAC;AACjD,UAAM,SAAS,SAAS,OAAO,OAAO;AAAA,MACpC,MAAM,OAAO,gBAAgB,IAAI,cAAc;AAAA,IACjD,CAAC;AACD,QAAI,OAAO,WAAW,eAAe;AACnC,SAAG,IAAI,GAAG,IAAI,wDAAwD;AACtE;AACA;AAAA,IACF;AACA,QAAI,OAAO,WAAW,gBAAgB;AACpC,SAAG,IAAI,GAAG,IAAI,2EAA2E;AACzF;AAAA,IACF;AACA,UAAM,SAAS,OAAO,MAAM,KAAK,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI;AAC/D,UAAM,UAAU,QAAQ,OAAO,KAAK;AACpC,OAAG,IAAI,GAAG,IAAI,aAAa,OAAO,MAAM,QAAQ,MAAM,EAAE;AAAA,EAC1D;AACA,SAAO,SAAS,IAAI,IAAI;AAC1B;AAEA,eAAe,QAAQ,MAAgB,IAA4B;AACjE,QAAM,EAAE,QAAQ,YAAY,IAAI,UAAU;AAAA,IACxC,MAAM;AAAA,IACN,kBAAkB;AAAA,IAClB,SAAS,EAAE,MAAM,EAAE,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,UAAU,EAAE;AAAA,EACrE,CAAC;AACD,MAAI,YAAY,WAAW,EAAG,OAAM,IAAI,MAAM,kCAAkC;AAChF,MAAI,WAAW;AACf,aAAW,QAAQ,aAAa;AAC9B,UAAM,QAAQ,IAAI,WAAW,MAAM,SAAS,IAAI,CAAC;AACjD,UAAM,SAAS,kBAAkB,KAAK,KAAK,kBAAkB,KAAK;AAClE,QAAI,QAAQ;AACV,YAAM,OAAO,YAAY,KAAK;AAC9B,YAAM,SAAS,KAAK,eAAe,KAAK;AACxC,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,MAAM;AACf,cAAM,EAAE,KAAK,MAAM,GAAG,KAAK,IAAI;AAC/B,WAAG,IAAI,KAAK,UAAU,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;AAAA,MAC1C,OAAO;AACL,cAAM,QAAQ;AAAA,UACZ,GAAG,IAAI,KAAK,MAAM;AAAA,UAClB,KAAK,aACD,eAAe,eAAe,KAAK,UAAU,CAAC,KAC9C;AAAA,UACJ,KAAK,YAAY,aAAa,KAAK,SAAS,KAAK;AAAA,UACjD,KAAK,OAAO,yCAAyC;AAAA,UACrD,SAAS,cAAc;AAAA,QACzB;AACA,WAAG,IAAI,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACzC;AACA;AAAA,IACF;AACA,UAAM,MAAM,QAAQ,IAAI,EAAE,YAAY;AACtC,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK;AAC3C,UAAM,YAAY,kBAAkB,IAAI;AACxC,QAAI,CAAC,UAAW;AAChB,QAAI,OAAO,MAAM;AACf,SAAG,IAAI,KAAK,UAAU,EAAE,MAAM,QAAQ,IAAI,MAAM,CAAC,KAAK,QAAQ,UAAU,CAAC,CAAC;AAAA,IAC5E,OAAO;AACL,SAAG;AAAA,QACD,YACI,GAAG,IAAI,yBAAyB,UAAU,YAAY,eAAe,UAAU,SAAS,KAAK,EAAE,GAAG,UAAU,YAAY,aAAa,UAAU,SAAS,KAAK,EAAE,KAC/J,GAAG,IAAI;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,WAAW,WAAW,IAAI,IAAI;AAC9C;AAEA,IAAM,YAAmB;AAAA,EACvB,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AAAA,EAC/C,KAAK,CAAC,SAAS,QAAQ,OAAO,MAAM,GAAG,IAAI;AAAA,CAAI;AACjD;","names":[]}

package/dist/cli.cjs

@@ -750,6 +750,293 @@ function unescapeXml(value) {
   return value.replace(/&quot;/g, '"').replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&apos;/g, "'").replace(/&amp;/g, "&");
 }
 
+// src/media.ts
+var XMP_UUID = hex("be7acfcb97a942e89c71999491e3afac");
+var C2PA_UUID = hex("d8fec3d61b0e483c92975828877ec481");
+function detectMediaFormat(bytes) {
+  if (bytes.length >= 10 && ascii2(bytes, 0, 3) === "ID3") return "mp3";
+  if (isMpegAudioFrame(bytes, 0)) return "mp3";
+  if (bytes.length >= 12 && ascii2(bytes, 0, 4) === "RIFF" && ascii2(bytes, 8, 4) === "WAVE") {
+    return "wav";
+  }
+  if (bytes.length >= 12 && ascii2(bytes, 4, 4) === "ftyp") return "mp4";
+  return null;
+}
+function markMedia(bytes, input = {}, options = {}) {
+  const format = detectMediaFormat(bytes);
+  if (!format) return { bytes, status: "unsupported", format };
+  const parsed = parse(bytes, format);
+  if (!parsed) return { bytes, status: "unsupported", format };
+  if (options.c2pa !== "overwrite" && parsed.c2pa) {
+    return { bytes, status: "skipped-c2pa", format };
+  }
+  const marking = "sourceType" in input && "humanReviewed" in input ? input : createMarking(input);
+  const xmp = buildXmp(marking, parsed.xmp);
+  const out = format === "mp3" ? writeMp3(bytes, xmp) : format === "wav" ? writeWav(bytes, xmp) : writeMp4(bytes, xmp);
+  if (!out) return { bytes, status: "unsupported", format };
+  return { bytes: out, status: "marked", format };
+}
+function readMediaMarking(bytes) {
+  const format = detectMediaFormat(bytes);
+  const parsed = format ? parse(bytes, format) : null;
+  if (!format || !parsed) {
+    return { format, xmp: null, aiGenerated: false, witness: false, c2pa: false };
+  }
+  return describe(format, parsed.xmp, parsed.c2pa);
+}
+function markFile(bytes, input = {}, options = {}) {
+  if (detectImageFormat(bytes)) return markImage(bytes, input, options);
+  return markMedia(bytes, input, options);
+}
+function readMarking(bytes) {
+  if (detectImageFormat(bytes)) return readImageMarking(bytes);
+  return readMediaMarking(bytes);
+}
+function describe(format, xmp, c2pa) {
+  const sourceType = xmp ? parseSourceType(xmpProperty(xmp, "Iptc4xmpExt:DigitalSourceType")) : void 0;
+  const generator = xmp ? xmpProperty(xmp, "Iptc4xmpExt:AISystemUsed") ?? xmpProperty(xmp, "xmp:CreatorTool") : void 0;
+  const info = {
+    format,
+    xmp,
+    aiGenerated: isAiSourceType(sourceType),
+    witness: xmp?.includes(WITNESS_NS) ?? false,
+    c2pa
+  };
+  if (sourceType) info.sourceType = sourceType;
+  if (generator) info.generator = generator;
+  return info;
+}
+function parse(bytes, format) {
+  if (format === "mp3") {
+    const tag = readId3(bytes);
+    if (tag === "unsupported") return null;
+    if (!tag) return { xmp: null, c2pa: false };
+    const xmpFrame = tag.frames.find((f) => f.id === "PRIV" && isXmpPriv(bytes, f));
+    return {
+      xmp: xmpFrame ? decode(bytes.subarray(xmpFrame.dataStart + 4, xmpFrame.end)) : null,
+      c2pa: tag.frames.some(
+        (f) => f.id === "GEOB" && ascii2(bytes, f.dataStart, Math.min(64, f.end - f.dataStart)).toLowerCase().includes("c2pa")
+      )
+    };
+  }
+  if (format === "wav") {
+    const chunks = riffChunks(bytes);
+    if (!chunks) return null;
+    const xmp2 = chunks.find((c) => c.fourcc === "_PMX");
+    return {
+      xmp: xmp2 ? decode(bytes.subarray(xmp2.dataStart, xmp2.dataEnd)) : null,
+      c2pa: chunks.some((c) => c.fourcc === "C2PA")
+    };
+  }
+  const boxes = mp4Boxes(bytes);
+  if (!boxes) return null;
+  const xmp = boxes.find((b) => isUuidBox(bytes, b, XMP_UUID));
+  return {
+    xmp: xmp ? decode(bytes.subarray(xmp.dataStart + 16, xmp.end)) : null,
+    c2pa: boxes.some((b) => isUuidBox(bytes, b, C2PA_UUID))
+  };
+}
+function readId3(bytes) {
+  if (ascii2(bytes, 0, 3) !== "ID3") return null;
+  const version = bytes[3];
+  const flags = bytes[5] ?? 0;
+  if (version !== 3 && version !== 4) return "unsupported";
+  if (flags & 128 || flags & 16) return "unsupported";
+  const length = 10 + syncsafe(bytes, 6);
+  if (length > bytes.length) return "unsupported";
+  let offset = 10;
+  if (flags & 64) {
+    offset += version === 4 ? syncsafe(bytes, 10) : 4 + readU32BE2(bytes, 10);
+  }
+  const frames = [];
+  while (offset + 10 <= length) {
+    const id = ascii2(bytes, offset, 4);
+    if (!/^[A-Z0-9]{4}$/.test(id)) break;
+    const size = version === 4 ? syncsafe(bytes, offset + 4) : readU32BE2(bytes, offset + 4);
+    const end = offset + 10 + size;
+    if (end > length) return "unsupported";
+    frames.push({ id, start: offset, dataStart: offset + 10, end });
+    offset = end;
+  }
+  return { version, length, frames };
+}
+function isXmpPriv(bytes, frame) {
+  return ascii2(bytes, frame.dataStart, 4) === "XMP\0";
+}
+function writeMp3(bytes, xmp) {
+  const tag = readId3(bytes);
+  if (tag === "unsupported") return null;
+  const version = tag ? tag.version : 4;
+  const kept = tag ? tag.frames.filter((f) => !(f.id === "PRIV" && isXmpPriv(bytes, f))).map((f) => bytes.subarray(f.start, f.end)) : [];
+  const data = concat2(latin12("XMP\0"), utf82(xmp));
+  const frame = new Uint8Array(10 + data.length);
+  frame.set(latin12("PRIV"), 0);
+  if (version === 4) writeSyncsafe(frame, 4, data.length);
+  else writeU32BE2(frame, 4, data.length);
+  frame.set(data, 10);
+  const body = concat2(...kept, frame, new Uint8Array(64));
+  const header = new Uint8Array(10);
+  header.set(latin12("ID3"), 0);
+  header[3] = version;
+  writeSyncsafe(header, 6, body.length);
+  return concat2(header, body, bytes.subarray(tag ? tag.length : 0));
+}
+function isMpegAudioFrame(bytes, offset) {
+  const b1 = bytes[offset + 1] ?? 0;
+  return bytes[offset] === 255 && (b1 & 224) === 224 && (b1 & 24) !== 8 && (b1 & 6) !== 0;
+}
+function syncsafe(b, o) {
+  return ((b[o] ?? 0) & 127) << 21 | ((b[o + 1] ?? 0) & 127) << 14 | ((b[o + 2] ?? 0) & 127) << 7 | (b[o + 3] ?? 0) & 127;
+}
+function writeSyncsafe(b, o, v) {
+  b[o] = v >>> 21 & 127;
+  b[o + 1] = v >>> 14 & 127;
+  b[o + 2] = v >>> 7 & 127;
+  b[o + 3] = v & 127;
+}
+function riffChunks(bytes) {
+  const chunks = [];
+  const limit = Math.min(bytes.length, 8 + readU32LE2(bytes, 4));
+  let offset = 12;
+  while (offset + 8 <= limit) {
+    const size = readU32LE2(bytes, offset + 4);
+    const dataEnd = offset + 8 + size;
+    if (dataEnd > bytes.length) return null;
+    const end = Math.min(dataEnd + size % 2, bytes.length);
+    chunks.push({
+      fourcc: ascii2(bytes, offset, 4),
+      start: offset,
+      dataStart: offset + 8,
+      dataEnd,
+      end
+    });
+    offset = end;
+  }
+  return chunks;
+}
+function writeWav(bytes, xmp) {
+  const chunks = riffChunks(bytes);
+  if (!chunks) return null;
+  const data = utf82(xmp);
+  const chunk = new Uint8Array(8 + data.length + data.length % 2);
+  chunk.set(latin12("_PMX"), 0);
+  writeU32LE2(chunk, 4, data.length);
+  chunk.set(data, 8);
+  const body = concat2(
+    ...chunks.filter((c) => c.fourcc !== "_PMX").map((c) => bytes.subarray(c.start, c.end)),
+    chunk
+  );
+  const out = concat2(bytes.subarray(0, 12), body);
+  writeU32LE2(out, 4, out.length - 8);
+  return out;
+}
+function mp4Boxes(bytes) {
+  const boxes = [];
+  let offset = 0;
+  while (offset + 8 <= bytes.length) {
+    const size = readU32BE2(bytes, offset);
+    const type = ascii2(bytes, offset + 4, 4);
+    let header = 8;
+    let end;
+    if (size === 1) {
+      if (offset + 16 > bytes.length) return null;
+      const high = readU32BE2(bytes, offset + 8);
+      end = offset + high * 2 ** 32 + readU32BE2(bytes, offset + 12);
+      header = 16;
+    } else if (size === 0) {
+      end = bytes.length;
+    } else {
+      end = offset + size;
+    }
+    if (end > bytes.length || end < offset + header) return null;
+    boxes.push({ type, start: offset, dataStart: offset + header, end, open: size === 0 });
+    offset = end;
+  }
+  return boxes;
+}
+function isUuidBox(bytes, box, uuid) {
+  if (box.type !== "uuid" || box.end - box.dataStart < 16) return false;
+  for (let i = 0; i < 16; i++) if (bytes[box.dataStart + i] !== uuid[i]) return false;
+  return true;
+}
+function writeMp4(bytes, xmp) {
+  const boxes = mp4Boxes(bytes);
+  if (!boxes) return null;
+  const last = boxes[boxes.length - 1];
+  let head = bytes;
+  let length = bytes.length;
+  if (last && isUuidBox(bytes, last, XMP_UUID)) length = last.start;
+  head = bytes.slice(0, length);
+  for (const box2 of boxes) {
+    if (box2.start < length && isUuidBox(bytes, box2, XMP_UUID)) {
+      head.set(latin12("free"), box2.start + 4);
+    }
+  }
+  const open = boxes.find((b) => b.open && b.start < length);
+  if (open) {
+    const size = length - open.start;
+    if (size > 4294967295) return null;
+    writeU32BE2(head, open.start, size);
+  }
+  const data = utf82(xmp);
+  const box = new Uint8Array(8 + 16 + data.length);
+  writeU32BE2(box, 0, box.length);
+  box.set(latin12("uuid"), 4);
+  box.set(XMP_UUID, 8);
+  box.set(data, 24);
+  return concat2(head, box);
+}
+function hex(value) {
+  const out = new Uint8Array(value.length / 2);
+  for (let i = 0; i < out.length; i++) out[i] = Number.parseInt(value.slice(i * 2, i * 2 + 2), 16);
+  return out;
+}
+function decode(bytes) {
+  return new TextDecoder().decode(bytes).replace(/\0+$/, "");
+}
+function ascii2(bytes, offset, length) {
+  let out = "";
+  for (let i = offset; i < offset + length && i < bytes.length; i++) {
+    out += String.fromCharCode(bytes[i] ?? 0);
+  }
+  return out;
+}
+function latin12(text) {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) out[i] = text.charCodeAt(i) & 255;
+  return out;
+}
+function utf82(text) {
+  return new TextEncoder().encode(text);
+}
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((sum, part) => sum + part.length, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.length;
+  }
+  return out;
+}
+function readU32BE2(b, o) {
+  return ((b[o] ?? 0) << 24 | (b[o + 1] ?? 0) << 16 | (b[o + 2] ?? 0) << 8 | (b[o + 3] ?? 0)) >>> 0;
+}
+function readU32LE2(b, o) {
+  return ((b[o] ?? 0) | (b[o + 1] ?? 0) << 8 | (b[o + 2] ?? 0) << 16 | (b[o + 3] ?? 0) << 24) >>> 0;
+}
+function writeU32BE2(b, o, v) {
+  b[o] = v >>> 24 & 255;
+  b[o + 1] = v >>> 16 & 255;
+  b[o + 2] = v >>> 8 & 255;
+  b[o + 3] = v & 255;
+}
+function writeU32LE2(b, o, v) {
+  b[o] = v & 255;
+  b[o + 1] = v >>> 8 & 255;
+  b[o + 2] = v >>> 16 & 255;
+  b[o + 3] = v >>> 24 & 255;
+}
+
 // src/watermark.ts
 var MAGIC = [87, 49];
 function readTextWatermark(text) {
@@ -818,7 +1105,7 @@ function findInRun(bytes) {
 }
 
 // src/cli.ts
-var HELP = `witness: AI Act Article 50 marking for images and text
+var HELP = `witness: AI Act Article 50 marking for images, audio, video and text
 
 Usage
   witness mark <files...> (--out <dir> | --in-place) [options]
@@ -837,7 +1124,8 @@ inspect options
   --json                     one JSON object per file
   --require                  exit 1 if a file carries no AI marking
 
-Images: PNG, JPEG, WebP (XMP with IPTC Digital Source Type).
+Images: PNG, JPEG, WebP. Audio and video: MP3, WAV, MP4, MOV, M4A.
+All get XMP with the IPTC Digital Source Type.
 Text files are checked for the Witness text watermark.`;
 var KINDS = ["generated", "edited", "deepfake"];
 async function runCli(argv, io = defaultIo) {
@@ -889,11 +1177,11 @@ async function mark(argv, io) {
   let failed = 0;
   for (const file of positionals) {
     const bytes = new Uint8Array(await (0, import_promises.readFile)(file));
-    const result = markImage(bytes, input, {
+    const result = markFile(bytes, input, {
       c2pa: values["overwrite-c2pa"] ? "overwrite" : "skip"
     });
     if (result.status === "unsupported") {
-      io.err(`${file}: not a PNG, JPEG or WebP file, skipped`);
+      io.err(`${file}: not a PNG, JPEG, WebP, MP3, WAV or MP4 file, skipped`);
       failed++;
       continue;
     }
@@ -917,9 +1205,9 @@ async function inspect(argv, io) {
   let unmarked = 0;
   for (const file of positionals) {
     const bytes = new Uint8Array(await (0, import_promises.readFile)(file));
-    const format = detectImageFormat(bytes);
+    const format = detectImageFormat(bytes) ?? detectMediaFormat(bytes);
     if (format) {
-      const info = readImageMarking(bytes);
+      const info = readMarking(bytes);
       const marked = info.aiGenerated || info.c2pa;
       if (!marked) unmarked++;
       if (values.json) {