gnss-js 2.11.0 → 2.12.0

package/dist/osnma.js

@@ -0,0 +1,1216 @@
+import {
+  scanSbfFrames,
+  svidToPrn
+} from "./chunk-E3Y6YKQM.js";
+import {
+  galInavPageCrcOk
+} from "./chunk-TWGZTRBL.js";
+import "./chunk-HUXQABJI.js";
+import "./chunk-V2D5KUKH.js";
+
+// src/osnma/sha256.ts
+var K = new Uint32Array([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var W = new Uint32Array(64);
+function compress(h, block, off) {
+  for (let i = 0; i < 16; i++) {
+    const j = off + 4 * i;
+    W[i] = block[j] << 24 | block[j + 1] << 16 | block[j + 2] << 8 | block[j + 3];
+  }
+  for (let i = 16; i < 64; i++) {
+    const a2 = W[i - 15];
+    const b2 = W[i - 2];
+    const s0 = (a2 >>> 7 | a2 << 25) ^ (a2 >>> 18 | a2 << 14) ^ a2 >>> 3;
+    const s1 = (b2 >>> 17 | b2 << 15) ^ (b2 >>> 19 | b2 << 13) ^ b2 >>> 10;
+    W[i] = W[i - 16] + s0 + W[i - 7] + s1 | 0;
+  }
+  let a = h[0];
+  let b = h[1];
+  let c = h[2];
+  let d = h[3];
+  let e = h[4];
+  let f = h[5];
+  let g = h[6];
+  let hh = h[7];
+  for (let i = 0; i < 64; i++) {
+    const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7);
+    const ch = e & f ^ ~e & g;
+    const t1 = hh + S1 + ch + K[i] + W[i] | 0;
+    const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10);
+    const maj = a & b ^ a & c ^ b & c;
+    const t2 = S0 + maj | 0;
+    hh = g;
+    g = f;
+    f = e;
+    e = d + t1 | 0;
+    d = c;
+    c = b;
+    b = a;
+    a = t1 + t2 | 0;
+  }
+  h[0] = h[0] + a | 0;
+  h[1] = h[1] + b | 0;
+  h[2] = h[2] + c | 0;
+  h[3] = h[3] + d | 0;
+  h[4] = h[4] + e | 0;
+  h[5] = h[5] + f | 0;
+  h[6] = h[6] + g | 0;
+  h[7] = h[7] + hh | 0;
+}
+function sha256(...parts) {
+  let len = 0;
+  for (const p of parts) len += p.length;
+  const padded = new Uint8Array(Math.ceil((len + 9) / 64) * 64);
+  let o = 0;
+  for (const p of parts) {
+    padded.set(p, o);
+    o += p.length;
+  }
+  padded[len] = 128;
+  const bitLen = len * 8;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLen / 4294967296));
+  view.setUint32(padded.length - 4, bitLen >>> 0);
+  const h = new Uint32Array([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  for (let off = 0; off < padded.length; off += 64) compress(h, padded, off);
+  const out = new Uint8Array(32);
+  const ov = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) ov.setUint32(4 * i, h[i]);
+  return out;
+}
+function hmacSha256(key, msg) {
+  const k = key.length > 64 ? sha256(key) : key;
+  const ipad = new Uint8Array(64).fill(54);
+  const opad = new Uint8Array(64).fill(92);
+  for (let i = 0; i < k.length; i++) {
+    ipad[i] ^= k[i];
+    opad[i] ^= k[i];
+  }
+  return sha256(opad, sha256(ipad, msg));
+}
+var K512 = [
+  "428a2f98d728ae22",
+  "7137449123ef65cd",
+  "b5c0fbcfec4d3b2f",
+  "e9b5dba58189dbbc",
+  "3956c25bf348b538",
+  "59f111f1b605d019",
+  "923f82a4af194f9b",
+  "ab1c5ed5da6d8118",
+  "d807aa98a3030242",
+  "12835b0145706fbe",
+  "243185be4ee4b28c",
+  "550c7dc3d5ffb4e2",
+  "72be5d74f27b896f",
+  "80deb1fe3b1696b1",
+  "9bdc06a725c71235",
+  "c19bf174cf692694",
+  "e49b69c19ef14ad2",
+  "efbe4786384f25e3",
+  "0fc19dc68b8cd5b5",
+  "240ca1cc77ac9c65",
+  "2de92c6f592b0275",
+  "4a7484aa6ea6e483",
+  "5cb0a9dcbd41fbd4",
+  "76f988da831153b5",
+  "983e5152ee66dfab",
+  "a831c66d2db43210",
+  "b00327c898fb213f",
+  "bf597fc7beef0ee4",
+  "c6e00bf33da88fc2",
+  "d5a79147930aa725",
+  "06ca6351e003826f",
+  "142929670a0e6e70",
+  "27b70a8546d22ffc",
+  "2e1b21385c26c926",
+  "4d2c6dfc5ac42aed",
+  "53380d139d95b3df",
+  "650a73548baf63de",
+  "766a0abb3c77b2a8",
+  "81c2c92e47edaee6",
+  "92722c851482353b",
+  "a2bfe8a14cf10364",
+  "a81a664bbc423001",
+  "c24b8b70d0f89791",
+  "c76c51a30654be30",
+  "d192e819d6ef5218",
+  "d69906245565a910",
+  "f40e35855771202a",
+  "106aa07032bbd1b8",
+  "19a4c116b8d2d0c8",
+  "1e376c085141ab53",
+  "2748774cdf8eeb99",
+  "34b0bcb5e19b48a8",
+  "391c0cb3c5c95a63",
+  "4ed8aa4ae3418acb",
+  "5b9cca4f7763e373",
+  "682e6ff3d6b2b8a3",
+  "748f82ee5defb2fc",
+  "78a5636f43172f60",
+  "84c87814a1f0ab72",
+  "8cc702081a6439ec",
+  "90befffa23631e28",
+  "a4506cebde82bde9",
+  "bef9a3f7b2c67915",
+  "c67178f2e372532b",
+  "ca273eceea26619c",
+  "d186b8c721c0c207",
+  "eada7dd6cde0eb1e",
+  "f57d4f7fee6ed178",
+  "06f067aa72176fba",
+  "0a637dc5a2c898a6",
+  "113f9804bef90dae",
+  "1b710b35131c471b",
+  "28db77f523047d84",
+  "32caab7b40c72493",
+  "3c9ebe0a15c9bebc",
+  "431d67c49c100d4c",
+  "4cc5d4becb3e42b6",
+  "597f299cfc657e2a",
+  "5fcb6fab3ad6faec",
+  "6c44198c4a475817"
+].map((h) => BigInt("0x" + h));
+var M64 = (1n << 64n) - 1n;
+var rotr = (x, n) => (x >> n | x << 64n - n) & M64;
+function sha512(...parts) {
+  let len = 0;
+  for (const p of parts) len += p.length;
+  const padded = new Uint8Array(Math.ceil((len + 17) / 128) * 128);
+  let o = 0;
+  for (const p of parts) {
+    padded.set(p, o);
+    o += p.length;
+  }
+  padded[len] = 128;
+  const view = new DataView(padded.buffer);
+  view.setBigUint64(padded.length - 8, BigInt(len) * 8n);
+  const h = [
+    "6a09e667f3bcc908",
+    "bb67ae8584caa73b",
+    "3c6ef372fe94f82b",
+    "a54ff53a5f1d36f1",
+    "510e527fade682d1",
+    "9b05688c2b3e6c1f",
+    "1f83d9abfb41bd6b",
+    "5be0cd19137e2179"
+  ].map((x) => BigInt("0x" + x));
+  const w = new Array(80);
+  for (let off = 0; off < padded.length; off += 128) {
+    for (let i = 0; i < 16; i++) w[i] = view.getBigUint64(off + 8 * i);
+    for (let i = 16; i < 80; i++) {
+      const a2 = w[i - 15];
+      const b2 = w[i - 2];
+      const s0 = rotr(a2, 1n) ^ rotr(a2, 8n) ^ a2 >> 7n;
+      const s1 = rotr(b2, 19n) ^ rotr(b2, 61n) ^ b2 >> 6n;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 & M64;
+    }
+    let [a, b, c, d, e, f, g, hh] = h;
+    for (let i = 0; i < 80; i++) {
+      const S1 = rotr(e, 14n) ^ rotr(e, 18n) ^ rotr(e, 41n);
+      const ch = e & f ^ ~e & M64 & g;
+      const t1 = hh + S1 + ch + K512[i] + w[i] & M64;
+      const S0 = rotr(a, 28n) ^ rotr(a, 34n) ^ rotr(a, 39n);
+      const maj = a & b ^ a & c ^ b & c;
+      const t2 = S0 + maj & M64;
+      hh = g;
+      g = f;
+      f = e;
+      e = d + t1 & M64;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 & M64;
+    }
+    [a, b, c, d, e, f, g, hh].forEach((v, i) => h[i] = h[i] + v & M64);
+  }
+  const out = new Uint8Array(64);
+  const ov = new DataView(out.buffer);
+  h.forEach((v, i) => ov.setBigUint64(8 * i, v));
+  return out;
+}
+
+// src/osnma/ecdsa.ts
+var P256 = {
+  p: 0xffffffff00000001000000000000000000000000ffffffffffffffffffffffffn,
+  n: 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n,
+  b: 0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604bn,
+  gx: 0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296n,
+  gy: 0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5n,
+  size: 32,
+  hash: (m) => sha256(m)
+};
+var P521 = {
+  p: (1n << 521n) - 1n,
+  n: 0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409n,
+  b: 0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00n,
+  gx: 0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66n,
+  gy: 0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650n,
+  size: 66,
+  hash: (m) => sha512(m)
+};
+var mod = (a, m) => {
+  const r = a % m;
+  return r < 0n ? r + m : r;
+};
+function powMod(b, e, m) {
+  let r = 1n;
+  b = mod(b, m);
+  while (e > 0n) {
+    if (e & 1n) r = r * b % m;
+    b = b * b % m;
+    e >>= 1n;
+  }
+  return r;
+}
+var inv = (a, m) => powMod(a, m - 2n, m);
+var INF = [0n, 1n, 0n];
+function dbl(P, [x, y, z]) {
+  if (z === 0n || y === 0n) return INF;
+  const z2 = z * z % P;
+  const m = mod(3n * (x - z2) * (x + z2), P);
+  const y2 = y * y % P;
+  const s = 4n * x * y2 % P;
+  const x3 = mod(m * m - 2n * s, P);
+  const y3 = mod(m * (s - x3) - 8n * y2 * y2, P);
+  const z3 = 2n * y * z % P;
+  return [x3, y3, z3];
+}
+function add(P, p, q) {
+  if (p[2] === 0n) return q;
+  if (q[2] === 0n) return p;
+  const z1z1 = p[2] * p[2] % P;
+  const z2z2 = q[2] * q[2] % P;
+  const u1 = p[0] * z2z2 % P;
+  const u2 = q[0] * z1z1 % P;
+  const s1 = p[1] * q[2] * z2z2 % P;
+  const s2 = q[1] * p[2] * z1z1 % P;
+  if (u1 === u2) return s1 === s2 ? dbl(P, p) : INF;
+  const h = mod(u2 - u1, P);
+  const r = mod(s2 - s1, P);
+  const h2 = h * h % P;
+  const h3 = h * h2 % P;
+  const x3 = mod(r * r - h3 - 2n * u1 * h2, P);
+  const y3 = mod(r * (u1 * h2 - x3) - s1 * h3, P);
+  const z3 = h * p[2] * q[2] % P;
+  return [x3, y3, z3];
+}
+function mulAdd(c, u1, u2, q) {
+  const g = [c.gx, c.gy, 1n];
+  const gq = add(c.p, g, q);
+  let r = INF;
+  const bits = Math.max(u1.toString(2).length, u2.toString(2).length);
+  for (let i = bits - 1; i >= 0; i--) {
+    r = dbl(c.p, r);
+    const b1 = u1 >> BigInt(i) & 1n;
+    const b2 = u2 >> BigInt(i) & 1n;
+    if (b1 && b2) r = add(c.p, r, gq);
+    else if (b1) r = add(c.p, r, g);
+    else if (b2) r = add(c.p, r, q);
+  }
+  return r;
+}
+var toBig = (b) => {
+  let x = 0n;
+  for (const v of b) x = x << 8n | BigInt(v);
+  return x;
+};
+function decodeKey(c, key) {
+  const n = c.size;
+  const onCurve = (x2, y2) => mod(y2 * y2 - (x2 * x2 * x2 - 3n * x2 + c.b), c.p) === 0n;
+  if (key.length === 2 * n + 1 && key[0] === 4) {
+    const x2 = toBig(key.subarray(1, n + 1));
+    const y2 = toBig(key.subarray(n + 1));
+    return onCurve(x2, y2) ? [x2, y2] : null;
+  }
+  if (key.length !== n + 1 || key[0] !== 2 && key[0] !== 3) return null;
+  const x = toBig(key.subarray(1));
+  if (x >= c.p) return null;
+  const rhs = mod(x * x * x - 3n * x + c.b, c.p);
+  let y = powMod(rhs, (c.p + 1n) / 4n, c.p);
+  if (y * y % c.p !== rhs) return null;
+  if (Number(y & 1n) !== (key[0] & 1)) y = c.p - y;
+  return [x, y];
+}
+function verify(c, pubKey, msg, sig) {
+  const q = decodeKey(c, pubKey);
+  if (!q || sig.length !== 2 * c.size) return false;
+  const r = toBig(sig.subarray(0, c.size));
+  const s = toBig(sig.subarray(c.size));
+  if (r <= 0n || r >= c.n || s <= 0n || s >= c.n) return false;
+  const e = toBig(c.hash(msg));
+  const w = inv(s, c.n);
+  const x = mulAdd(c, e * w % c.n, r * w % c.n, [q[0], q[1], 1n]);
+  if (x[2] === 0n) return false;
+  const zi = inv(x[2], c.p);
+  return x[0] * zi * zi % c.p % c.n === r;
+}
+var p256Verify = (pubKey, msg, sig) => verify(P256, pubKey, msg, sig);
+var p521Verify = (pubKey, msg, sig) => verify(P521, pubKey, msg, sig);
+
+// src/osnma/merkle.ts
+var fromHex = (h) => new Uint8Array(h.match(/../g).map((b) => parseInt(b, 16)));
+var OSNMA_MERKLE_ROOT = fromHex(
+  "832E15EDE55655EAC6E399A539477B7C034CCE24C3C93FFC904ACD9BF842F04E"
+);
+var OSNMA_KNOWN_PUBLIC_KEYS = [
+  {
+    pkid: 2,
+    npkt: 1,
+    key: fromHex(
+      "02219204B5CA6C46B623EEED6CDD2CDDB1F7D6A7532767E5B8DA0DE1EBD695FC99"
+    ),
+    mid: 1,
+    path: [
+      fromHex(
+        "7B944FA20915C7931D48DD016D94F9C6381FD37DC6C125D97015272FDDE41393"
+      ),
+      fromHex(
+        "6AAFDE28017BF0744D42819CE40E3A0CDA1ECA3F7A4EA67E134E7AA714C1E843"
+      ),
+      fromHex(
+        "DE73D209E4C5BCDC34CD117F2FE40FD08B110009997AD2B3291D3A2CF29943F9"
+      ),
+      fromHex(
+        "84DE3669E6DA551292979E5B8D045787FA967C57CC23638A30237614EDD9171A"
+      )
+    ]
+  }
+];
+function merkleLeafOk(leaf, mid, path, root) {
+  if (path.length !== 4 || mid < 0 || mid > 15) return false;
+  let x = sha256(leaf);
+  let i = mid;
+  for (const node of path) {
+    x = i & 1 ? sha256(node, x) : sha256(x, node);
+    i >>= 1;
+  }
+  return x.every((b, k) => b === root[k]);
+}
+function publicKeyLeaf(npkt, pkid, key) {
+  const leaf = new Uint8Array(1 + key.length);
+  leaf[0] = (npkt & 15) << 4 | pkid & 15;
+  leaf.set(key, 1);
+  return leaf;
+}
+
+// src/osnma/receiver.ts
+var bitAt = (b, i) => b[i >> 3] >> 7 - (i & 7) & 1;
+function bitsU(b, start, n) {
+  let x = 0;
+  for (let i = 0; i < n; i++) x = x * 2 + bitAt(b, start + i);
+  return x;
+}
+function copyBits(dst, at, src, start, n) {
+  for (let i = 0; i < n; i++)
+    if (bitAt(src, start + i)) dst[at + i >> 3] |= 128 >> (at + i & 7);
+}
+function sliceBits(src, start, n) {
+  const out = new Uint8Array(Math.ceil(n / 8));
+  copyBits(out, 0, src, start, n);
+  return out;
+}
+var eqBytes = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
+function eqBits(a, b, nBits) {
+  for (let i = 0; i < nBits; i++) if (bitAt(a, i) !== bitAt(b, i)) return false;
+  return true;
+}
+var WEEK = 604800;
+var HISTORY_SUBFRAMES = 80;
+var MAX_DERIVATIONS = 3e3;
+var MIN_TAG_BITS = { 0: 80, 4: 40, 12: 80 };
+var KEY_BITS = [96, 104, 112, 120, 128, 160, 192, 224, 256];
+var TAG_BITS = { 5: 20, 6: 24, 7: 28, 8: 32, 9: 40 };
+var MACLT = {
+  27: [
+    ["00S", "00E", "00E", "00E", "12S", "00E"],
+    ["00S", "00E", "00E", "04S", "12S", "00E"]
+  ],
+  28: [
+    ["00S", "00E", "00E", "00E", "00S", "00E", "00E", "12S", "00E", "00E"],
+    ["00S", "00E", "00E", "00S", "00E", "00E", "04S", "12S", "00E", "00E"]
+  ],
+  31: [
+    ["00S", "00E", "00E", "12S", "00E"],
+    ["00S", "00E", "00E", "12S", "04S"]
+  ],
+  33: [
+    ["00S", "00E", "04S", "00E", "12S", "00E"],
+    ["00S", "00E", "00E", "12S", "00E", "12E"]
+  ],
+  34: [
+    ["00S", "FLX", "04S", "FLX", "12S", "00E"],
+    ["00S", "FLX", "00E", "12S", "00E", "12E"]
+  ],
+  35: [
+    ["00S", "FLX", "04S", "FLX", "12S", "FLX"],
+    ["00S", "FLX", "FLX", "12S", "FLX", "FLX"]
+  ],
+  36: [
+    ["00S", "FLX", "04S", "FLX", "12S"],
+    ["00S", "FLX", "00E", "12S", "12E"]
+  ],
+  37: [
+    ["00S", "00E", "04S", "00E", "12S"],
+    ["00S", "00E", "00E", "12S", "12E"]
+  ],
+  38: [
+    ["00S", "FLX", "04S", "FLX", "12S"],
+    ["00S", "FLX", "FLX", "12S", "FLX"]
+  ],
+  39: [
+    ["00S", "FLX", "04S", "FLX"],
+    ["00S", "FLX", "00E", "12S"]
+  ],
+  40: [
+    ["00S", "00E", "04S", "12S"],
+    ["00S", "00E", "00E", "12E"]
+  ]
+};
+var ADKD0_WORDS = [
+  // [word type, first bit in the 128-bit word, bit count]
+  [1, 6, 120],
+  [2, 6, 120],
+  [3, 6, 122],
+  [4, 6, 120],
+  [5, 6, 67]
+];
+var ADKD0_BITS = 549;
+var ADKD4_BITS = 141;
+var NMAS = ["reserved", "test", "operational", "dont-use"];
+var CPKS = [
+  "reserved",
+  "nominal",
+  "end-of-chain",
+  "chain-revoked",
+  "new-public-key",
+  "public-key-revoked",
+  "new-merkle-tree",
+  "alert-message"
+];
+var gstOf = (abs) => ({
+  wn: Math.floor(abs / WEEK),
+  tow: abs % WEEK
+});
+function gst32(abs) {
+  const { wn, tow } = gstOf(abs);
+  const v = (wn & 4095) << 20 | tow & 1048575;
+  return new Uint8Array([
+    v >>> 24,
+    v >>> 16 & 255,
+    v >>> 8 & 255,
+    v & 255
+  ]);
+}
+var hexOf = (b) => Array.from(b, (v) => v.toString(16).padStart(2, "0")).join("");
+var prnName = (svid) => `E${String(svid).padStart(2, "0")}`;
+var OsnmaReceiver = class {
+  roots;
+  /** An authenticated OSNMA Alert Message stopped all processing. */
+  alerted = false;
+  /** Revoked public keys and chains (hex), never to be used again. */
+  revoked = /* @__PURE__ */ new Set();
+  pubKeys = /* @__PURE__ */ new Map();
+  collect = /* @__PURE__ */ new Map();
+  // per svid
+  dsms = /* @__PURE__ */ new Map();
+  // per DSM ID
+  chains = /* @__PURE__ */ new Map();
+  // per CID
+  macks = [];
+  words = /* @__PURE__ */ new Map();
+  sats = /* @__PURE__ */ new Map();
+  events = [];
+  nmaHeader = null;
+  keysVerified = 0;
+  keysRejected = 0;
+  lastKey = null;
+  tags = { ok: 0, failed: 0, unverifiable: 0, dummy: 0 };
+  osnmaPages = 0;
+  dontUseMacks = 0;
+  latestSf = 0;
+  /** Keys already rejected, as `sf:hex` (one event each). */
+  rejectedKeys = /* @__PURE__ */ new Set();
+  constructor(opts = {}) {
+    const r = opts.merkleRoot ?? OSNMA_MERKLE_ROOT;
+    this.roots = r instanceof Uint8Array ? [r] : [...r];
+    for (const r2 of opts.publicKeys ?? OSNMA_KNOWN_PUBLIC_KEYS) {
+      const leaf = publicKeyLeaf(r2.npkt, r2.pkid, r2.key);
+      if (this.leafOk(leaf, r2.mid, r2.path))
+        this.pubKeys.set(r2.pkid, { key: r2.key, npkt: r2.npkt, source: "known" });
+    }
+  }
+  /**
+   * Feed one E1-B I/NAV nominal page pair: `page` holds the 114-bit even
+   * part (tail removed) followed by the 120-bit odd part, MSB first, as
+   * Septentrio's GALRawINAV carries it (CRC already checked by the
+   * caller). `wn`/`tow` give the GST of the page's first symbol.
+   */
+  pushPage(svid, wn, tow, page) {
+    if (svid < 1 || svid > 36) return;
+    if (bitAt(page, 0) !== 0 || bitAt(page, 114) !== 1) return;
+    if (bitAt(page, 1) || bitAt(page, 115)) return;
+    const abs = wn * WEEK + Math.round(tow);
+    const sf = abs - abs % 30;
+    const idx = Math.floor(abs % 30 / 2);
+    const word = new Uint8Array(16);
+    copyBits(word, 0, page, 2, 112);
+    copyBits(word, 112, page, 116, 16);
+    this.storeWord(svid, sf, word);
+    const hk = bitsU(page, 132, 8);
+    const mack = sliceBits(page, 140, 32);
+    const osnma = hk !== 0 || mack.some((b) => b !== 0);
+    if (osnma) {
+      this.osnmaPages++;
+      this.sat(svid).transmitsOsnma = true;
+    }
+    let c = this.collect.get(svid);
+    if (c && c.sf !== sf) {
+      this.closeSubframe(svid, c);
+      c = void 0;
+    }
+    if (!c) {
+      c = { sf, hk: [], mack: [] };
+      this.collect.set(svid, c);
+    }
+    if (osnma) {
+      c.hk[idx] = hk;
+      c.mack[idx] = mack;
+    }
+    if (idx === 14) {
+      this.closeSubframe(svid, c);
+      this.collect.delete(svid);
+    }
+    if (sf > this.latestSf) {
+      this.latestSf = sf;
+      this.prune();
+    }
+  }
+  /** Process anything still buffered (end of a file). */
+  flush() {
+    for (const [svid, c] of this.collect) this.closeSubframe(svid, c);
+    this.collect.clear();
+  }
+  status() {
+    const h = this.nmaHeader;
+    return {
+      nmaStatus: h === null ? null : NMAS[h >> 6],
+      cid: h === null ? null : h >> 4 & 3,
+      cpks: h === null ? null : CPKS[h >> 1 & 7],
+      publicKeys: [...this.pubKeys].map(([pkid, k]) => ({
+        pkid,
+        source: k.source
+      })),
+      chains: [...this.chains.values()].map((c) => ({
+        cid: c.cid,
+        pkid: c.pkid,
+        hashFunction: c.hashFunction,
+        macFunction: c.macFunction,
+        keyBits: c.keyBits,
+        tagBits: c.tagBits,
+        maclt: c.maclt,
+        gst0: c.gst0,
+        supported: c.supported
+      })),
+      keysVerified: this.keysVerified,
+      keysRejected: this.keysRejected,
+      lastKey: this.lastKey === null ? null : gstOf(this.lastKey),
+      tags: { ...this.tags },
+      satellites: [...this.sats.entries()].sort((a, b) => a[0] - b[0]).map(([, s]) => ({
+        prn: s.prn,
+        transmitsOsnma: s.transmitsOsnma,
+        ced: { ...s.ced },
+        timing: { ...s.timing }
+      })),
+      events: this.events.slice(),
+      osnmaPages: this.osnmaPages,
+      dontUseMacks: this.dontUseMacks,
+      alert: this.alerted
+    };
+  }
+  /* ---------------------------- internals --------------------------- */
+  sat(svid) {
+    let s = this.sats.get(svid);
+    if (!s) {
+      s = {
+        prn: prnName(svid),
+        transmitsOsnma: false,
+        ced: {
+          ok: 0,
+          failed: 0,
+          authenticatedIodNav: null,
+          lastAuthenticated: null
+        },
+        timing: { ok: 0, failed: 0, lastAuthenticated: null },
+        acc: /* @__PURE__ */ new Map()
+      };
+      this.sats.set(svid, s);
+    }
+    return s;
+  }
+  event(e) {
+    this.events.push(e);
+    if (this.events.length > 200) this.events.shift();
+  }
+  storeWord(svid, sf, word) {
+    const wt = bitsU(word, 0, 6);
+    if (!(wt >= 1 && wt <= 6 || wt === 10)) return;
+    let m = this.words.get(svid);
+    if (!m) this.words.set(svid, m = /* @__PURE__ */ new Map());
+    let list = m.get(wt);
+    if (!list) m.set(wt, list = []);
+    const last = list[list.length - 1];
+    if (last && last.sf === sf) last.word = word;
+    else list.push({ sf, word });
+    if (list.length > HISTORY_SUBFRAMES) list.shift();
+  }
+  prune() {
+    const oldest = this.latestSf - HISTORY_SUBFRAMES * 30;
+    while (this.macks.length && this.macks[0].sf < oldest) {
+      const m = this.macks.shift();
+      if (!m.fastDone || !m.slowDone) this.tags.unverifiable++;
+    }
+    for (const c of this.chains.values())
+      for (const sf of c.keys.keys())
+        if (sf < oldest && sf !== this.lastKey) c.keys.delete(sf);
+  }
+  closeSubframe(svid, c) {
+    for (let i = 0; i < 15; i++)
+      if (c.hk[i] === void 0 || !c.mack[i]) return;
+    const hk = new Uint8Array(c.hk);
+    const mack = new Uint8Array(60);
+    for (let i = 0; i < 15; i++) mack.set(c.mack[i], 4 * i);
+    const nma = hk[0];
+    this.nmaHeader = nma;
+    if (this.alerted || nma >> 6 === 0) return;
+    this.applyRevocations(nma);
+    this.onDsmBlock(c.sf, nma, hk[1] >> 4, hk[1] & 15, hk.subarray(2));
+    this.macks.push({
+      sf: c.sf,
+      prna: svid,
+      nmaHeader: nma,
+      mack,
+      fastDone: false,
+      slowDone: false
+    });
+    this.onKeyFrom(this.macks[this.macks.length - 1]);
+    this.processMacks();
+  }
+  leafOk(leaf, mid, path) {
+    return this.roots.some((root) => merkleLeafOk(leaf, mid, path, root));
+  }
+  /**
+   * "Don't use" headers announcing a revocation (ICD §5.4.1, §5.5.3):
+   * drop the revoked chain or public key and never accept it again.
+   */
+  applyRevocations(nma) {
+    if (nma >> 6 !== 3) return;
+    const cpks = nma >> 1 & 7;
+    const chain = this.chains.get(nma >> 4 & 3);
+    if (cpks === 3 && chain) {
+      this.revoked.add(hexOf(chain.kroot));
+      this.chains.delete(chain.cid);
+    }
+    if (cpks === 5 && chain) {
+      const pk = this.pubKeys.get(chain.pkid);
+      if (pk) this.revoked.add(hexOf(pk.key));
+      this.pubKeys.delete(chain.pkid);
+      for (const [cid, c] of this.chains)
+        if (c.pkid === chain.pkid) {
+          this.revoked.add(hexOf(c.kroot));
+          this.chains.delete(cid);
+        }
+    }
+  }
+  /* ----------------------------- DSM ------------------------------- */
+  onDsmBlock(sf, nma, id, bid, block) {
+    let d = this.dsms.get(id);
+    const prev = d?.blocks[bid];
+    if (d && prev && !eqBytes(prev, block)) d = void 0;
+    if (!d) {
+      d = { blocks: [], nmaHeader: nma };
+      this.dsms.set(id, d);
+    }
+    d.blocks[bid] = block.slice();
+    d.nmaHeader = nma;
+    const b0 = d.blocks[0];
+    if (!b0) return;
+    const nb = (b0[0] >> 4) + 6;
+    if (nb < 7 || nb > 16) return;
+    for (let i = 0; i < nb; i++) if (!d.blocks[i]) return;
+    const msg = new Uint8Array(13 * nb);
+    for (let i = 0; i < nb; i++) msg.set(d.blocks[i], 13 * i);
+    this.dsms.delete(id);
+    if (id >= 12) this.onPkr(sf, msg);
+    else this.onKroot(sf, d.nmaHeader, msg);
+  }
+  onPkr(sf, msg) {
+    const mid = msg[0] & 15;
+    const path = [0, 1, 2, 3].map((j) => msg.slice(1 + 32 * j, 33 + 32 * j));
+    const npkt = msg[129] >> 4;
+    const npkid = msg[129] & 15;
+    const gst = gstOf(sf);
+    if (npkt === 4) {
+      const leaf2 = msg.slice(129);
+      if (this.leafOk(leaf2, mid, path)) {
+        this.event({
+          gst,
+          kind: "alert-message",
+          message: "OSNMA Alert Message received: stop using OSNMA."
+        });
+        this.alerted = true;
+        this.pubKeys.clear();
+        this.chains.clear();
+      }
+      return;
+    }
+    const keyLen = npkt === 1 ? 33 : npkt === 3 ? 67 : 0;
+    if (!keyLen) return;
+    const key = msg.slice(130, 130 + keyLen);
+    const leaf = msg.slice(129, 130 + keyLen);
+    if (this.revoked.has(hexOf(key))) return;
+    if (!this.leafOk(leaf, mid, path)) {
+      this.event({
+        gst,
+        kind: "public-key-rejected",
+        message: `Broadcast public key PKID ${npkid} does not verify against the Merkle root.`
+      });
+      return;
+    }
+    const had = this.pubKeys.get(npkid);
+    if (!had || !eqBytes(had.key, key))
+      this.pubKeys.set(npkid, { key, npkt, source: "broadcast" });
+    this.event({
+      gst,
+      kind: "public-key-verified",
+      message: had && eqBytes(had.key, key) ? `Broadcast public key PKID ${npkid} verified against the Merkle root (matches the known key).` : `Public key PKID ${npkid} received and verified against the Merkle root.`
+    });
+  }
+  onKroot(sf, nma, msg) {
+    const gst = gstOf(sf);
+    const pkid = msg[0] & 15;
+    const cid = msg[1] >> 6;
+    const hf = msg[1] >> 2 & 3;
+    const mf = msg[1] & 3;
+    const ks = msg[2] >> 4;
+    const ts = msg[2] & 15;
+    const maclt = msg[3];
+    const wnk = (msg[4] & 15) << 8 | msg[5];
+    const towhk = msg[6];
+    const keyBits = KEY_BITS[ks];
+    const tagBits = TAG_BITS[ts];
+    if (!keyBits || !tagBits) return;
+    const klen = keyBits / 8;
+    const pk = this.pubKeys.get(pkid);
+    if (!pk) return;
+    const m = new Uint8Array(13 + klen);
+    m[0] = nma;
+    m.set(msg.subarray(1, 13 + klen), 1);
+    const sigLen = pk.npkt === 1 ? 64 : 132;
+    const sig = msg.subarray(13 + klen, 13 + klen + sigLen);
+    const verify2 = pk.npkt === 1 ? p256Verify : p521Verify;
+    if (sig.length !== sigLen || !verify2(pk.key, m, sig)) {
+      this.event({
+        gst,
+        kind: "kroot-rejected",
+        message: `DSM-KROOT (chain ${cid}) signature does not verify with public key PKID ${pkid}.`
+      });
+      return;
+    }
+    const kroot = msg.slice(13, 13 + klen);
+    if (this.revoked.has(hexOf(kroot))) return;
+    const gst0 = wnk * WEEK + towhk * 3600;
+    if ((nma >> 1 & 7) !== 6) {
+      for (const id of [...this.pubKeys.keys()])
+        if (id < pkid) this.pubKeys.delete(id);
+    }
+    const existing = this.chains.get(cid);
+    if (existing && eqBytes(existing.alpha, msg.subarray(7, 13))) {
+      existing.keys.set(gst0 - 30, kroot);
+      return;
+    }
+    const chain = {
+      cid,
+      pkid,
+      hashFunction: ["SHA-256", "reserved", "SHA3-256", "reserved"][hf],
+      macFunction: ["HMAC-SHA-256", "CMAC-AES", "reserved", "reserved"][mf],
+      keyBits,
+      tagBits,
+      maclt,
+      gst0: gstOf(gst0),
+      supported: hf === 0 && mf === 0 && maclt in MACLT,
+      kroot,
+      alpha: msg.slice(7, 13),
+      keys: /* @__PURE__ */ new Map([[gst0 - 30, kroot]])
+    };
+    this.chains.set(cid, chain);
+    this.event({
+      gst,
+      kind: "kroot-verified",
+      message: `TESLA root key of chain ${cid} verified with public key PKID ${pkid}.`
+    });
+    if (!chain.supported)
+      this.event({
+        gst,
+        kind: "unsupported",
+        message: `Chain ${cid} uses ${chain.hashFunction}/${chain.macFunction}, MACLT ${maclt}: tags not verified.`
+      });
+    for (const r of this.macks) this.onKeyFrom(r);
+    this.processMacks();
+  }
+  /* ---------------------------- TESLA ------------------------------ */
+  /** F(K) for the key of subframe `sf`: the key of subframe sf − 30. */
+  oneWay(c, key, sf) {
+    return sha256(key, gst32(sf - 30), c.alpha).slice(0, c.keyBits / 8);
+  }
+  chainFor(nmaHeader) {
+    return this.chains.get(nmaHeader >> 4 & 3);
+  }
+  /** Verify the TESLA key carried in a MACK against the chain. */
+  onKeyFrom(r) {
+    const c = this.chainFor(r.nmaHeader);
+    if (!c || !c.supported) return;
+    const nt = Math.floor((480 - c.keyBits) / (c.tagBits + 16));
+    const key = sliceBits(r.mack, nt * (c.tagBits + 16), c.keyBits);
+    const known = c.keys.get(r.sf);
+    if (known) {
+      if (!eqBytes(known, key)) this.rejectKey(r);
+      return;
+    }
+    const tag = `${r.sf}:${hexOf(key)}`;
+    if (this.rejectedKeys.has(tag)) return;
+    let anchor = -Infinity;
+    for (const sf of c.keys.keys()) if (sf < r.sf && sf > anchor) anchor = sf;
+    if (anchor === -Infinity) return;
+    const n = (r.sf - anchor) / 30;
+    if (n > MAX_DERIVATIONS) return;
+    let k = key;
+    for (let i = 0, sf = r.sf; i < n; i++, sf -= 30) k = this.oneWay(c, k, sf);
+    if (eqBytes(k, c.keys.get(anchor))) {
+      c.keys.set(r.sf, key);
+      this.keysVerified++;
+      if (this.lastKey === null || r.sf > this.lastKey) this.lastKey = r.sf;
+    } else {
+      this.rejectedKeys.add(tag);
+      this.rejectKey(r);
+    }
+  }
+  rejectKey(r) {
+    this.keysRejected++;
+    this.event({
+      gst: gstOf(r.sf),
+      kind: "key-rejected",
+      prn: prnName(r.prna),
+      message: `TESLA key from ${prnName(r.prna)} does not hash back to the verified chain.`
+    });
+  }
+  /* ----------------------------- tags ------------------------------ */
+  processMacks() {
+    for (const r of this.macks) {
+      if (r.fastDone && r.slowDone) continue;
+      if (r.nmaHeader >> 6 === 3) {
+        r.fastDone = r.slowDone = true;
+        this.dontUseMacks++;
+        continue;
+      }
+      const c = this.chainFor(r.nmaHeader);
+      if (!c || !c.supported) continue;
+      const fastKey = c.keys.get(r.sf + 30);
+      const slowKey = c.keys.get(r.sf + 330);
+      if (!r.fastDone && fastKey) {
+        this.verifyTags(c, r, fastKey, false);
+        r.fastDone = true;
+      }
+      if (!r.slowDone && slowKey) {
+        this.verifyTags(c, r, slowKey, true);
+        r.slowDone = true;
+      }
+    }
+  }
+  verifyTags(c, r, key, slow) {
+    const lt = c.tagBits;
+    const nt = Math.floor((480 - c.keyBits) / (lt + 16));
+    const seq = MACLT[c.maclt][r.sf / 30 % 2];
+    if (seq.length !== nt) return;
+    const nmas = r.nmaHeader >> 6;
+    const tagAt = (i) => sliceBits(r.mack, i * (lt + 16), lt);
+    const infoAt = (i) => bitsU(r.mack, i * (lt + 16) + lt, 16);
+    if (!slow) {
+      const flex = [];
+      seq.forEach((s, i) => s === "FLX" && flex.push(i));
+      const m = new Uint8Array(5 + 2 * flex.length);
+      m[0] = r.prna;
+      m.set(gst32(r.sf), 1);
+      flex.forEach((i, k) => {
+        const v = infoAt(i);
+        m[5 + 2 * k] = v >> 8;
+        m[6 + 2 * k] = v & 255;
+      });
+      const macseq = bitsU(r.mack, lt, 12);
+      const calc = bitsU(hmacSha256(key, m), 0, 12);
+      if (macseq !== calc) {
+        this.event({
+          gst: gstOf(r.sf),
+          kind: "macseq-failed",
+          prn: prnName(r.prna),
+          message: `MACSEQ from ${prnName(r.prna)} does not verify: its tag list is not trusted.`
+        });
+        this.tags.failed++;
+        return;
+      }
+    }
+    for (let i = 0; i < nt; i++) {
+      let prnd;
+      let adkd;
+      let cop;
+      if (i === 0) {
+        prnd = r.prna;
+        adkd = 0;
+        cop = bitsU(r.mack, lt + 12, 4);
+      } else {
+        const info = infoAt(i);
+        prnd = info >> 8;
+        adkd = info >> 4 & 15;
+        cop = info & 15;
+      }
+      if (adkd === 12 !== slow) continue;
+      const slot = seq[i];
+      if (slot !== "FLX") {
+        const want = parseInt(slot.slice(0, 2), 10);
+        const self = slot[2] === "S";
+        if (adkd !== want || prnd === r.prna !== self) {
+          this.tags.failed++;
+          this.event({
+            gst: gstOf(r.sf),
+            kind: "tag-failed",
+            prn: prnName(r.prna),
+            message: `Tag ${i} from ${prnName(r.prna)} breaks the MAC look-up table (ADKD ${adkd}).`
+          });
+          continue;
+        }
+      }
+      if (prnd < 1 || prnd > 36 || adkd !== 0 && adkd !== 4 && adkd !== 12)
+        continue;
+      const nav = cop === 0 ? new Uint8Array(
+        Math.ceil((adkd === 4 ? ADKD4_BITS : ADKD0_BITS) / 8)
+      ) : adkd === 4 ? this.timingData(prnd, r.sf, cop) : this.cedData(prnd, r.sf, cop);
+      if (!nav) {
+        this.tags.unverifiable++;
+        continue;
+      }
+      const nBits = adkd === 4 ? ADKD4_BITS : ADKD0_BITS;
+      const head = i === 0 ? 6 : 7;
+      const m = new Uint8Array(head + Math.ceil((2 + nBits) / 8));
+      let o = 0;
+      if (i !== 0) m[o++] = prnd;
+      m[o++] = r.prna;
+      m.set(gst32(r.sf), o);
+      o += 4;
+      m[o++] = i + 1;
+      m[o] = nmas << 6;
+      copyBits(m, 8 * o + 2, nav, 0, nBits);
+      const mac = hmacSha256(key, m);
+      const ok = eqBits(mac, tagAt(i), lt);
+      if (cop === 0) {
+        if (ok) this.tags.dummy++;
+        else this.tags.failed++;
+        continue;
+      }
+      this.onTag(prnd, adkd, r, nav, ok, lt);
+    }
+  }
+  onTag(prnd, adkd, r, nav, ok, lt) {
+    const s = this.sat(prnd);
+    const stats = adkd === 4 ? s.timing : s.ced;
+    if (!ok) {
+      this.tags.failed++;
+      stats.failed++;
+      this.event({
+        gst: gstOf(r.sf),
+        kind: "tag-failed",
+        prn: s.prn,
+        message: `${adkd === 4 ? "Timing" : "Ephemeris"} tag for ${s.prn} (sent by ${prnName(r.prna)}) does not match its navigation data.`
+      });
+      return;
+    }
+    this.tags.ok++;
+    stats.ok++;
+    const group = adkd === 4 ? 4 : 0;
+    const id = Array.from(nav).join(",");
+    let a = s.acc.get(group);
+    if (!a || a.key !== id) s.acc.set(group, a = { key: id, bits: 0 });
+    a.bits += lt;
+    if (a.bits >= MIN_TAG_BITS[adkd]) {
+      if (adkd === 4) s.timing.lastAuthenticated = gstOf(r.sf);
+      else {
+        s.ced.lastAuthenticated = gstOf(r.sf);
+        s.ced.authenticatedIodNav = bitsU(nav, 0, 10);
+      }
+    }
+  }
+  /** Latest word of `wt` from `svid` in subframes [sf − 30·cop, sf − 30]. */
+  wordIn(svid, wt, sf, cop) {
+    const list = this.words.get(svid)?.get(wt);
+    if (!list) return void 0;
+    const lo = sf - 30 * Math.max(cop, 1);
+    for (let i = list.length - 1; i >= 0; i--) {
+      const w = list[i];
+      if (w.sf < sf && w.sf >= lo) return w.word;
+      if (w.sf < lo) break;
+    }
+    return void 0;
+  }
+  /** ADKD 0/12 data: WT1-5 of one IODnav (Annex B.1). */
+  cedData(svid, sf, cop) {
+    const out = new Uint8Array(Math.ceil(ADKD0_BITS / 8));
+    let at = 0;
+    let iod = null;
+    for (const [wt, start, n] of ADKD0_WORDS) {
+      const w = this.wordIn(svid, wt, sf, cop);
+      if (!w) return null;
+      if (wt <= 4) {
+        const v = bitsU(w, 6, 10);
+        if (iod === null) iod = v;
+        else if (v !== iod) return null;
+      }
+      copyBits(out, at, w, start, n);
+      at += n;
+    }
+    return out;
+  }
+  /** ADKD 4 data: WT6 ‖ WT10 timing parameters (Annex B.2). */
+  timingData(svid, sf, cop) {
+    const w6 = this.wordIn(svid, 6, sf, cop);
+    const w10 = this.wordIn(svid, 10, sf, Math.max(cop, 2));
+    if (!w6 || !w10) return null;
+    const out = new Uint8Array(Math.ceil(ADKD4_BITS / 8));
+    copyBits(out, 0, w6, 6, 99);
+    copyBits(out, 99, w10, 86, 42);
+    return out;
+  }
+};
+
+// src/osnma/sbf.ts
+var SIG_E1BC = 17;
+var TOW_DNU = 4294967295;
+var GST_GPS_WEEK_OFFSET = 1024;
+function feedSbfOsnmaBlock(data, view, b, id, len, rx) {
+  if (id !== 4023 || len < 52) return false;
+  if ((data[b + 17] & 31) !== SIG_E1BC) return false;
+  const prn = svidToPrn(data[b + 14]);
+  if (!prn || prn[0] !== "E") return false;
+  const towMs = view.getUint32(b + 8, true);
+  const wnc = view.getUint16(b + 12, true);
+  if (towMs === TOW_DNU || wnc === 65535) return false;
+  const page = new Uint8Array(32);
+  for (let k = 0; k < 8; k++) {
+    const w = view.getUint32(b + 20 + 4 * k, true);
+    page[4 * k] = w >>> 24;
+    page[4 * k + 1] = w >>> 16 & 255;
+    page[4 * k + 2] = w >>> 8 & 255;
+    page[4 * k + 3] = w & 255;
+  }
+  if (!galInavPageCrcOk(page)) return false;
+  let tow = Math.round(towMs / 1e3) - 2;
+  let wn = wnc - GST_GPS_WEEK_OFFSET;
+  if (tow < 0) {
+    tow += 604800;
+    wn--;
+  }
+  rx.pushPage(parseInt(prn.slice(1), 10), wn, tow, page);
+  return true;
+}
+function verifySbfOsnma(data, opts) {
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  const rx = new OsnmaReceiver(opts);
+  scanSbfFrames(data, view, (id, b, len) => {
+    feedSbfOsnmaBlock(data, view, b, id, len, rx);
+  });
+  rx.flush();
+  return rx.status();
+}
+export {
+  OSNMA_KNOWN_PUBLIC_KEYS,
+  OSNMA_MERKLE_ROOT,
+  OsnmaReceiver,
+  feedSbfOsnmaBlock,
+  hmacSha256,
+  merkleLeafOk,
+  p256Verify,
+  p521Verify,
+  sha256,
+  sha512,
+  verifySbfOsnma
+};