shifro 1.1.4 → 1.2.0

package/dist/cli.mjs

@@ -1,27 +1,428 @@
 #!/usr/bin/env node
 import { parseArgs } from "node:util";
-import { ALL_FORMATS, Conversion, FilePathSource, FilePathTarget, Input, Mp4OutputFormat, Output } from "mediabunny";
+import { ALL_FORMATS, Conversion, EncodedPacket, FilePathSource, FilePathTarget, Input, Mp4OutputFormat, Output } from "mediabunny";
 //#region package.json
 var name = "shifro";
-var version = "1.1.4";
+var version = "1.2.0";
 var author = "Vitaly Gashkov <vitalygashkov@vk.com>";
 //#endregion
+//#region src/mediabunny-isobmff.ts
+const binarySearchLessOrEqual = (items, needle, getValue) => {
+	let low = 0;
+	let high = items.length - 1;
+	let result = -1;
+	while (low <= high) {
+		const middle = low + Math.floor((high - low) / 2);
+		if (getValue(items[middle]) <= needle) {
+			result = middle;
+			low = middle + 1;
+		} else high = middle - 1;
+	}
+	return result;
+};
+const binarySearchExact = (items, needle, getValue) => {
+	let low = 0;
+	let high = items.length - 1;
+	while (low <= high) {
+		const middle = low + Math.floor((high - low) / 2);
+		const value = getValue(items[middle]);
+		if (value === needle) return middle;
+		if (value < needle) low = middle + 1;
+		else high = middle - 1;
+	}
+	return -1;
+};
+const readBytes = (slice, length) => {
+	const bytes = slice.bytes.slice(slice.bufferPos, slice.bufferPos + length);
+	slice.bufferPos += length;
+	return bytes;
+};
+const readU16Be = (slice) => {
+	const value = slice.view.getUint16(slice.bufferPos, false);
+	slice.bufferPos += 2;
+	return value;
+};
+const readU32Be = (slice) => {
+	const value = slice.view.getUint32(slice.bufferPos, false);
+	slice.bufferPos += 4;
+	return value;
+};
+const readSampleBytes = async (internalTrack, byteOffset, byteLength) => {
+	let slice = internalTrack.demuxer.reader.requestSlice(byteOffset, byteLength);
+	if (slice instanceof Promise) slice = await slice;
+	if (!slice) throw new Error("Failed to read encrypted sample bytes.");
+	return readBytes(slice, byteLength);
+};
+const resolveEncryptionAuxInfo = async (internalTrack, auxInfo) => {
+	if (auxInfo.resolved) return auxInfo.resolved;
+	const encryptionInfo = internalTrack.encryptionInfo;
+	if (!encryptionInfo || encryptionInfo.defaultPerSampleIvSize === null) throw new Error("Missing track encryption info.");
+	if (auxInfo.offset === null || auxInfo.sampleCount === 0) throw new Error("Incomplete saiz/saio info; cannot resolve encryption data.");
+	if (auxInfo.defaultSampleInfoSize === 0 && !auxInfo.sampleSizes) throw new Error("Invalid auxiliary encryption info: auxInfo.sampleSizes is required when auxInfo.defaultSampleInfoSize is 0.");
+	let totalSize = 0;
+	if (auxInfo.defaultSampleInfoSize > 0) totalSize = auxInfo.defaultSampleInfoSize * auxInfo.sampleCount;
+	else if (auxInfo.sampleSizes) for (const size of auxInfo.sampleSizes) totalSize += size;
+	let slice = internalTrack.demuxer.reader.requestSlice(auxInfo.offset, totalSize);
+	if (slice instanceof Promise) slice = await slice;
+	if (!slice) throw new Error("Failed to read auxiliary encryption info.");
+	const entries = [];
+	const ivSize = encryptionInfo.defaultPerSampleIvSize;
+	for (let i = 0; i < auxInfo.sampleCount; i++) {
+		const entrySize = auxInfo.defaultSampleInfoSize > 0 ? auxInfo.defaultSampleInfoSize : auxInfo.sampleSizes?.[i] ?? 0;
+		const iv = new Uint8Array(16);
+		if (ivSize > 0) iv.set(readBytes(slice, ivSize), 0);
+		else if (encryptionInfo.defaultConstantIv) iv.set(encryptionInfo.defaultConstantIv, 0);
+		let subsamples = null;
+		if (entrySize > ivSize) {
+			const subsampleCount = readU16Be(slice);
+			subsamples = [];
+			for (let j = 0; j < subsampleCount; j++) subsamples.push({
+				clearLen: readU16Be(slice),
+				protectedLen: readU32Be(slice)
+			});
+		}
+		entries.push({
+			iv,
+			subsamples
+		});
+	}
+	auxInfo.resolved = entries;
+	return entries;
+};
+const getSampleInfo = (sampleTable, sampleIndex) => {
+	const timingEntryIndex = binarySearchLessOrEqual(sampleTable.sampleTimingEntries, sampleIndex, (entry) => entry.startIndex);
+	const timingEntry = sampleTable.sampleTimingEntries[timingEntryIndex];
+	if (!timingEntry || timingEntry.startIndex + timingEntry.count <= sampleIndex) return null;
+	let presentationTimestamp = timingEntry.startDecodeTimestamp + (sampleIndex - timingEntry.startIndex) * timingEntry.delta;
+	const offsetEntryIndex = binarySearchLessOrEqual(sampleTable.sampleCompositionTimeOffsets, sampleIndex, (entry) => entry.startIndex);
+	const offsetEntry = sampleTable.sampleCompositionTimeOffsets[offsetEntryIndex];
+	if (offsetEntry && sampleIndex - offsetEntry.startIndex < offsetEntry.count) presentationTimestamp += offsetEntry.offset;
+	const sampleSize = sampleTable.sampleSizes[Math.min(sampleIndex, sampleTable.sampleSizes.length - 1)];
+	if (sampleSize === void 0) return null;
+	const chunkEntryIndex = binarySearchLessOrEqual(sampleTable.sampleToChunk, sampleIndex, (entry) => entry.startSampleIndex);
+	const chunkEntry = sampleTable.sampleToChunk[chunkEntryIndex];
+	if (!chunkEntry) return null;
+	const chunkIndex = chunkEntry.startChunkIndex + Math.floor((sampleIndex - chunkEntry.startSampleIndex) / chunkEntry.samplesPerChunk);
+	const chunkOffset = sampleTable.chunkOffsets[chunkIndex];
+	if (chunkOffset === void 0) return null;
+	const startSampleIndexOfChunk = chunkEntry.startSampleIndex + (chunkIndex - chunkEntry.startChunkIndex) * chunkEntry.samplesPerChunk;
+	let chunkSize = 0;
+	let sampleOffset = chunkOffset;
+	if (sampleTable.sampleSizes.length === 1) {
+		sampleOffset += sampleSize * (sampleIndex - startSampleIndexOfChunk);
+		chunkSize += sampleSize * chunkEntry.samplesPerChunk;
+	} else for (let i = startSampleIndexOfChunk; i < startSampleIndexOfChunk + chunkEntry.samplesPerChunk; i++) {
+		const currentSampleSize = sampleTable.sampleSizes[i];
+		if (currentSampleSize === void 0) return null;
+		if (i < sampleIndex) sampleOffset += currentSampleSize;
+		chunkSize += currentSampleSize;
+	}
+	let duration = timingEntry.delta;
+	if (sampleTable.presentationTimestamps && sampleTable.presentationTimestampIndexMap) {
+		const presentationIndex = sampleTable.presentationTimestampIndexMap[sampleIndex];
+		if (presentationIndex !== void 0 && presentationIndex < sampleTable.presentationTimestamps.length - 1) {
+			const nextEntry = sampleTable.presentationTimestamps[presentationIndex + 1];
+			if (nextEntry) duration = nextEntry.presentationTimestamp - presentationTimestamp;
+		}
+	}
+	const isKeyFrame = sampleTable.keySampleIndices ? binarySearchExact(sampleTable.keySampleIndices, sampleIndex, (value) => value) !== -1 : true;
+	return {
+		presentationTimestamp,
+		duration,
+		sampleOffset,
+		sampleSize,
+		chunkOffset,
+		chunkSize,
+		isKeyFrame
+	};
+};
+const psshBoxesAreEqual = (left, right) => {
+	if (left.systemId !== right.systemId) return false;
+	if (left.data.byteLength !== right.data.byteLength) return false;
+	for (let i = 0; i < left.data.byteLength; i++) if (left.data[i] !== right.data[i]) return false;
+	return true;
+};
+const collectCryptRanges = (subsamples, cryptByteBlock, skipByteBlock) => {
+	const ranges = [];
+	const hasPattern = cryptByteBlock !== 0 || skipByteBlock !== 0;
+	let cursor = 0;
+	for (const subsample of subsamples) {
+		cursor += subsample.clearLen;
+		if (!hasPattern) {
+			if (subsample.protectedLen > 0) ranges.push({
+				offset: cursor,
+				length: subsample.protectedLen
+			});
+			cursor += subsample.protectedLen;
+			continue;
+		}
+		let remaining = subsample.protectedLen;
+		let position = cursor;
+		while (remaining > 0) {
+			if (remaining < 16 * cryptByteBlock) break;
+			const cryptLength = 16 * cryptByteBlock;
+			ranges.push({
+				offset: position,
+				length: cryptLength
+			});
+			position += cryptLength;
+			remaining -= cryptLength;
+			const skipLength = Math.min(16 * skipByteBlock, remaining);
+			position += skipLength;
+			remaining -= skipLength;
+		}
+		cursor += subsample.protectedLen;
+	}
+	return ranges;
+};
+const cloneSubsamples = (subsamples) => {
+	if (!subsamples) return null;
+	return subsamples.map((subsample) => ({
+		clearLen: subsample.clearLen,
+		protectedLen: subsample.protectedLen
+	}));
+};
+const getPattern = (encryptionInfo) => {
+	const cryptByteBlock = encryptionInfo.defaultCryptByteBlock ?? 0;
+	const skipByteBlock = encryptionInfo.defaultSkipByteBlock ?? 0;
+	if (cryptByteBlock === 0 && skipByteBlock === 0) return null;
+	return {
+		cryptByteBlock,
+		skipByteBlock
+	};
+};
+const createProtectedDataLayout = (data, encryptionInfo, sampleEncryption) => {
+	if (!sampleEncryption.subsamples) return {
+		data,
+		merge: (decryptedData) => new Uint8Array(decryptedData)
+	};
+	if (encryptionInfo.scheme === "cbcs") return null;
+	const cryptRanges = collectCryptRanges(sampleEncryption.subsamples, encryptionInfo.defaultCryptByteBlock ?? 0, encryptionInfo.defaultSkipByteBlock ?? 0);
+	let totalCryptLength = 0;
+	for (const range of cryptRanges) totalCryptLength += range.length;
+	const protectedData = new Uint8Array(totalCryptLength);
+	let writeOffset = 0;
+	for (const range of cryptRanges) {
+		protectedData.set(data.subarray(range.offset, range.offset + range.length), writeOffset);
+		writeOffset += range.length;
+	}
+	return {
+		data: protectedData,
+		merge: (decryptedData) => {
+			const merged = new Uint8Array(data);
+			let readOffset = 0;
+			for (const range of cryptRanges) {
+				merged.set(decryptedData.subarray(readOffset, readOffset + range.length), range.offset);
+				readOffset += range.length;
+			}
+			return merged;
+		}
+	};
+};
+const isUint8Array = (value) => value instanceof Uint8Array;
+const isIsobmffTrackBacking = (backing) => {
+	if (!backing || typeof backing !== "object") return false;
+	const maybeBacking = backing;
+	const internalTrack = maybeBacking.internalTrack;
+	return Boolean(internalTrack && internalTrack.demuxer && typeof internalTrack.demuxer.getSampleTableForTrack === "function" && maybeBacking.packetToSampleIndex instanceof WeakMap && maybeBacking.packetToFragmentLocation instanceof WeakMap);
+};
+const getTrackEncryptionInfo = (backing) => backing.internalTrack.encryptionInfo;
+const getKeyId = (backing) => backing.internalTrack.encryptionInfo?.defaultKid ?? null;
+const getEncryptedSample = async (backing, packet) => {
+	const internalTrack = backing.internalTrack;
+	const fragmentLocation = backing.packetToFragmentLocation.get(packet);
+	if (fragmentLocation) {
+		const fragment = fragmentLocation.fragment;
+		const sample = fragment.trackData.get(internalTrack.id)?.samples[fragmentLocation.sampleIndex];
+		if (!sample?.encryption) return null;
+		return {
+			data: await readSampleBytes(internalTrack, sample.byteOffset, sample.byteSize),
+			sampleEncryption: sample.encryption,
+			fragment
+		};
+	}
+	const sampleIndex = backing.packetToSampleIndex.get(packet);
+	if (sampleIndex === void 0) return null;
+	const sampleInfo = getSampleInfo(internalTrack.demuxer.getSampleTableForTrack(internalTrack), sampleIndex);
+	if (!sampleInfo) return null;
+	const auxInfo = internalTrack.encryptionAuxInfo;
+	if (!auxInfo) return null;
+	const sampleEncryption = (await resolveEncryptionAuxInfo(internalTrack, auxInfo))[sampleIndex];
+	if (!sampleEncryption) return null;
+	return {
+		data: await readSampleBytes(internalTrack, sampleInfo.sampleOffset, sampleInfo.sampleSize),
+		sampleEncryption,
+		fragment: null
+	};
+};
+const getPsshBoxes = (backing, keyId, fragment) => {
+	const { psshBoxes } = backing.internalTrack.demuxer;
+	if (!fragment) return psshBoxes;
+	const boxes = [...psshBoxes, ...fragment.psshBoxes].filter((psshBox) => psshBox.keyIds === null || psshBox.keyIds.includes(keyId));
+	for (let i = 0; i < boxes.length - 1; i++) for (let j = i + 1; j < boxes.length; j++) if (psshBoxesAreEqual(boxes[i], boxes[j])) {
+		boxes.splice(j, 1);
+		j--;
+	}
+	return boxes;
+};
+//#endregion
+//#region src/isobmff-decrypt-sample-patcher.ts
+const createMetadataOnlyOptions = (options) => ({
+	...options,
+	metadataOnly: true,
+	verifyKeyPackets: false
+});
+var IsobmffDecryptSamplePatcher = class {
+	input;
+	decryptSample;
+	decryptProtectedData;
+	reportEncryptionInfo;
+	patchableTrackBackings = /* @__PURE__ */ new WeakSet();
+	patchTrackBackingsPromise = null;
+	constructor(input, decryptSample, decryptProtectedData, reportEncryptionInfo) {
+		this.input = input;
+		this.decryptSample = decryptSample;
+		this.decryptProtectedData = decryptProtectedData;
+		this.reportEncryptionInfo = reportEncryptionInfo;
+	}
+	async ensurePatched() {
+		this.patchTrackBackingsPromise ??= (async () => {
+			const tracks = await this.input.getTracks();
+			for (const track of tracks) {
+				const backing = track._backing;
+				if (!isIsobmffTrackBacking(backing) || this.patchableTrackBackings.has(backing)) continue;
+				this.patchableTrackBackings.add(backing);
+				this.patchTrackBacking(backing);
+			}
+		})();
+		await this.patchTrackBackingsPromise;
+	}
+	patchTrackBacking(backing) {
+		const packetToMetadataPacket = /* @__PURE__ */ new WeakMap();
+		const getOriginalPacket = (packet) => packetToMetadataPacket.get(packet) ?? packet;
+		const getFirstPacket = backing.getFirstPacket.bind(backing);
+		backing.getFirstPacket = async (options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getFirstPacket(options);
+			const metadataPacket = await getFirstPacket(createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getFirstPacket(options), packetToMetadataPacket);
+		};
+		const getPacket = backing.getPacket.bind(backing);
+		backing.getPacket = async (timestamp, options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getPacket(timestamp, options);
+			const metadataPacket = await getPacket(timestamp, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getPacket(timestamp, options), packetToMetadataPacket);
+		};
+		const getNextPacket = backing.getNextPacket.bind(backing);
+		backing.getNextPacket = async (packet, options) => {
+			const originalPacket = getOriginalPacket(packet);
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getNextPacket(originalPacket, options);
+			const metadataPacket = await getNextPacket(originalPacket, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getNextPacket(originalPacket, options), packetToMetadataPacket);
+		};
+		const getKeyPacket = backing.getKeyPacket.bind(backing);
+		backing.getKeyPacket = async (timestamp, options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getKeyPacket(timestamp, options);
+			const metadataPacket = await getKeyPacket(timestamp, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getKeyPacket(timestamp, options), packetToMetadataPacket);
+		};
+		const getNextKeyPacket = backing.getNextKeyPacket.bind(backing);
+		backing.getNextKeyPacket = async (packet, options) => {
+			const originalPacket = getOriginalPacket(packet);
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getNextKeyPacket(originalPacket, options);
+			const metadataPacket = await getNextKeyPacket(originalPacket, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getNextKeyPacket(originalPacket, options), packetToMetadataPacket);
+		};
+	}
+	shouldUseCustomDecryptSample(backing, options) {
+		return Boolean(!options.metadataOnly && getTrackEncryptionInfo(backing)?.defaultIsProtected !== false);
+	}
+	async materializePacket(backing, metadataPacket, fallback, packetToMetadataPacket) {
+		if (!metadataPacket) return null;
+		const decryptedPacket = await this.decryptPacket(backing, metadataPacket, fallback);
+		if (decryptedPacket && decryptedPacket !== metadataPacket) packetToMetadataPacket.set(decryptedPacket, metadataPacket);
+		return decryptedPacket;
+	}
+	async decryptPacket(backing, metadataPacket, fallback) {
+		const encryptionInfo = getTrackEncryptionInfo(backing);
+		if (!encryptionInfo?.defaultIsProtected) return fallback();
+		const keyId = getKeyId(backing);
+		if (!keyId) throw new Error("Encrypted sample encountered without a key ID.");
+		const encryptedSample = await getEncryptedSample(backing, metadataPacket);
+		if (!encryptedSample) return fallback();
+		const psshBoxes = getPsshBoxes(backing, keyId, encryptedSample.fragment);
+		this.reportEncryptionInfo(keyId, psshBoxes);
+		const decryptedData = this.decryptSample ? await this.decryptSample({
+			data: encryptedSample.data,
+			keyId,
+			psshBoxes,
+			scheme: encryptionInfo.scheme,
+			iv: encryptedSample.sampleEncryption.iv.slice(),
+			timestamp: metadataPacket.microsecondTimestamp,
+			subsamples: cloneSubsamples(encryptedSample.sampleEncryption.subsamples),
+			pattern: getPattern(encryptionInfo)
+		}) : await this.decryptWithProtectedData(encryptionInfo, encryptedSample, metadataPacket.microsecondTimestamp, keyId, psshBoxes);
+		if (!isUint8Array(decryptedData)) throw new TypeError("decryption callback must return a Uint8Array.");
+		if (decryptedData.byteLength !== metadataPacket.byteLength) throw new Error("decryption callback must return the same number of bytes as the encrypted sample.");
+		return new EncodedPacket(decryptedData, metadataPacket.type, metadataPacket.timestamp, metadataPacket.duration, metadataPacket.sequenceNumber, metadataPacket.byteLength, metadataPacket.sideData);
+	}
+	async decryptWithProtectedData(encryptionInfo, encryptedSample, timestamp, keyId, psshBoxes) {
+		if (!this.decryptProtectedData) throw new Error("Encrypted sample encountered without a decryption callback.");
+		const protectedDataLayout = createProtectedDataLayout(encryptedSample.data, encryptionInfo, encryptedSample.sampleEncryption);
+		if (!protectedDataLayout) throw new Error("decryptProtectedData does not support cbcs samples with subsample encryption. Use decryptSample for this content.");
+		const decryptedProtectedData = await this.decryptProtectedData({
+			data: protectedDataLayout.data,
+			keyId,
+			psshBoxes,
+			scheme: encryptionInfo.scheme,
+			iv: encryptedSample.sampleEncryption.iv.slice(),
+			timestamp,
+			subsamples: [{
+				clearLen: 0,
+				protectedLen: protectedDataLayout.data.byteLength
+			}],
+			pattern: null
+		});
+		if (!isUint8Array(decryptedProtectedData)) throw new TypeError("decryptProtectedData must return a Uint8Array.");
+		if (decryptedProtectedData.byteLength !== protectedDataLayout.data.byteLength) throw new Error("decryptProtectedData must return the same number of bytes as the protected data input.");
+		return protectedDataLayout.merge(decryptedProtectedData);
+	}
+};
+//#endregion
 //#region src/index.ts
+const createEncryptionReporter = (handleEncryptionInfo) => {
+	const reportedEncryptionInfo = /* @__PURE__ */ new Set();
+	return (keyId, psshBoxes) => {
+		if (!handleEncryptionInfo || reportedEncryptionInfo.has(keyId)) return;
+		reportedEncryptionInfo.add(keyId);
+		handleEncryptionInfo({
+			keyId,
+			psshBoxes
+		});
+	};
+};
 var Input$1 = class extends Input {
-	constructor({ keys, handleEncryptionInfo, ...options }) {
+	decryptSamplePatcher;
+	constructor({ keys, decryptSample, decryptProtectedData, handleEncryptionInfo, ...options }) {
+		if (!keys?.size && !decryptSample && !decryptProtectedData) throw new Error("Either keys, decryptSample, or decryptProtectedData must be provided.");
+		const reportEncryptionInfo = createEncryptionReporter(handleEncryptionInfo);
 		super({
 			...options,
 			formats: ALL_FORMATS,
 			formatOptions: { isobmff: { resolveKeyId: ({ keyId, psshBoxes }) => {
-				handleEncryptionInfo?.({
-					keyId,
-					psshBoxes
-				});
-				const key = keys.get(keyId);
+				reportEncryptionInfo(keyId, psshBoxes);
+				const key = keys?.get(keyId);
 				if (!key) throw new Error("Unknown key ID.");
 				return key;
 			} } }
 		});
+		this.decryptSamplePatcher = decryptSample || decryptProtectedData ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, decryptProtectedData, reportEncryptionInfo) : null;
+	}
+	async getTracks(query) {
+		await this.decryptSamplePatcher?.ensurePatched();
+		return super.getTracks(query);
+	}
+	async getTracksWithoutPatching(query) {
+		return super.getTracks(query);
 	}
 };
 var Output$1 = class extends Output {

package/dist/index.d.mts

@@ -1,21 +1,140 @@
-import { Conversion, FilePathSource, FilePathTarget, Input as Input$1, InputOptions, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, OutputFormat, OutputOptions, PsshBox, ReadableStreamSource, StreamSource, StreamSourceOptions, StreamTarget, StreamTargetOptions, UrlSource } from "mediabunny";
+import { Conversion, FilePathSource, FilePathTarget, Input as Input$1, InputOptions as MediabunnyInputOptions, InputTrack, InputTrackQuery, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, OutputFormat, OutputOptions, PsshBox, ReadableStreamSource, StreamSource, StreamSourceOptions, StreamTarget, StreamTargetOptions, UrlSource } from "mediabunny";
 
-//#region src/index.d.ts
+//#region src/decrypt-sample.d.ts
 type KeyId = string;
 type Key = string;
 type KeyMap = Map<KeyId, Key>;
+type IsobmffScheme = 'cenc' | 'cens' | 'cbcs';
+type SubsampleEncryption = {
+  /** Number of clear bytes that appear before the protected bytes in this subsample. */clearLen: number; /** Number of encrypted bytes in this subsample. */
+  protectedLen: number;
+};
+type EncryptionPattern = {
+  /** Number of consecutive 16-byte blocks that are encrypted in each pattern step. */cryptByteBlock: number; /** Number of consecutive 16-byte blocks that are skipped in each pattern step. */
+  skipByteBlock: number;
+};
+/**
+ * Options passed to {@link DecryptSample}.
+ *
+ * This is the advanced callback contract. `data` contains the full sample bytes exactly as they appear in the
+ * container, including any clear regions. `subsamples` and `pattern` describe which parts of `data` are protected.
+ *
+ * Use this callback when the decryption backend needs the original sample layout, or when working with content
+ * that cannot be safely represented as a single flattened protected-byte stream, such as patterned `cbcs`
+ * subsample encryption.
+ */
+type IsobmffDecryptSampleOptions = {
+  /** Full sample bytes as stored in the container. Clear and protected regions are both present in this buffer. */data: Uint8Array; /** Key ID from the track encryption metadata. */
+  keyId: string; /** PSSH boxes associated with this key/sample and useful for DRM-specific key resolution. */
+  psshBoxes: PsshBox[]; /** Sample encryption scheme. */
+  scheme: IsobmffScheme; /** Per-sample IV resolved from container metadata. */
+  iv: Uint8Array; /** Presentation timestamp of the sample in microseconds. */
+  timestamp: number; /** Subsample layout describing which parts of `data` are clear vs protected, or `null` for whole-sample encryption. */
+  subsamples: SubsampleEncryption[] | null; /** Pattern encryption parameters, or `null` when no pattern is used. */
+  pattern: EncryptionPattern | null;
+};
+/**
+ * Options passed to {@link DecryptProtectedData}.
+ *
+ * This is the compatibility/simple callback contract. `data` contains only the protected byte stream that needs
+ * to be decrypted. `shifro` is responsible for extracting those protected bytes from the sample and inserting the
+ * decrypted result back into the sample afterward.
+ *
+ * This matches the old `transformSample` style API used by `wapter`.
+ */
+type IsobmffDecryptProtectedDataOptions = {
+  /** Only the protected bytes that should be decrypted. Clear sample bytes are not included. */data: Uint8Array; /** Key ID from the track encryption metadata. */
+  keyId: string; /** PSSH boxes associated with this key/sample and useful for DRM-specific key resolution. */
+  psshBoxes: PsshBox[]; /** Sample encryption scheme. */
+  scheme: IsobmffScheme; /** Per-sample IV resolved from container metadata. */
+  iv: Uint8Array; /** Presentation timestamp of the sample in microseconds. */
+  timestamp: number;
+  /**
+   * Subsample layout for the protected-data buffer passed to this callback.
+   *
+   * Since `data` already contains only protected bytes, this is typically a single entry covering the whole buffer.
+   */
+  subsamples: SubsampleEncryption[];
+  /**
+   * Pattern metadata for the protected-data buffer passed to this callback.
+   *
+   * This is `null` when the flattened protected-data representation no longer has any skipped blocks to describe.
+   */
+  pattern: EncryptionPattern | null;
+};
+/**
+ * Advanced sample decryption callback.
+ *
+ * The callback receives the full encrypted sample layout and must return the fully decrypted sample bytes with the
+ * exact same length. This is the most general integration point and should be used when a backend needs explicit
+ * subsample and pattern metadata.
+ */
+type DecryptSample = (options: IsobmffDecryptSampleOptions) => Uint8Array | Promise<Uint8Array>;
+/**
+ * Simplified protected-data decryption callback.
+ *
+ * The callback receives only the protected byte stream extracted from a sample and must return the decrypted bytes
+ * for that protected region with the exact same length. `shifro` handles extraction from and reinsertion into the
+ * original sample.
+ *
+ * This is the recommended callback for integrations that only need a raw "decrypt these bytes" operation.
+ *
+ * Note: this simplified callback is not sufficient for every encryption layout. For example, `cbcs` samples with
+ * subsample encryption still require {@link DecryptSample}.
+ */
+type DecryptProtectedData = (options: IsobmffDecryptProtectedDataOptions) => Uint8Array | Promise<Uint8Array>;
+//#endregion
+//#region src/index.d.ts
+/**
+ * Options for creating a `shifro` {@link Input}.
+ *
+ * In addition to the regular Mediabunny input options, `shifro` accepts either raw content keys or one of the
+ * decryption callbacks used to delegate decryption to another library.
+ */
+type ShifroInputOptions = Omit<MediabunnyInputOptions, 'formats' | 'formatOptions'> & {
+  /**
+   * Content decryption keys indexed by key ID.
+   *
+   * Use this when the caller already has the actual content keys and wants `shifro`/Mediabunny to perform the
+   * sample decryption internally.
+   */
+  keys?: KeyMap;
+  /**
+   * Advanced decryption callback that receives the full encrypted sample layout.
+   *
+   * Use this when the decryption backend needs explicit access to the sample's clear/protected layout, subsample
+   * metadata, or pattern encryption information.
+   */
+  decryptSample?: DecryptSample;
+  /**
+   * Simplified decryption callback that receives only the flattened protected byte stream.
+   *
+   * `shifro` extracts the protected bytes from the sample before calling this callback and reinserts the decrypted
+   * bytes back into the sample afterward.
+   */
+  decryptProtectedData?: DecryptProtectedData;
+  /**
+   * Optional callback invoked when encryption metadata is discovered for a sample.
+   *
+   * This is useful when the caller wants access to the key ID and PSSH boxes without providing the key directly,
+   * for example to perform external DRM license handling.
+   */
+  handleEncryptionInfo?: (options: {
+    keyId: string;
+    psshBoxes: PsshBox[];
+  }) => void;
+};
 declare class Input extends Input$1 {
+  private readonly decryptSamplePatcher;
   constructor({
     keys,
+    decryptSample,
+    decryptProtectedData,
     handleEncryptionInfo,
     ...options
-  }: Omit<InputOptions, 'formats' | 'formatOptions'> & {
-    keys: KeyMap;
-    handleEncryptionInfo?: (options: {
-      keyId: string;
-      psshBoxes: PsshBox[];
-    }) => void;
-  });
+  }: ShifroInputOptions);
+  getTracks(query?: InputTrackQuery<InputTrack>): Promise<InputTrack[]>;
+  private getTracksWithoutPatching;
 }
 declare class Output extends Output$1 {
   constructor({
@@ -25,4 +144,4 @@ declare class Output extends Output$1 {
   });
 }
 //#endregion
-export { Conversion as Decryption, FilePathSource, FilePathTarget, Input, type InputOptions, type Key, type KeyId, type KeyMap, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, type OutputFormat, type OutputOptions, ReadableStreamSource, StreamSource, type StreamSourceOptions, StreamTarget, type StreamTargetOptions, UrlSource };
+export { type DecryptProtectedData, type DecryptSample, Conversion as Decryption, FilePathSource, FilePathTarget, Input, type MediabunnyInputOptions as InputOptions, type IsobmffDecryptProtectedDataOptions, type IsobmffDecryptSampleOptions, type Key, type KeyId, type KeyMap, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, type OutputFormat, type OutputOptions, ReadableStreamSource, ShifroInputOptions, StreamSource, type StreamSourceOptions, StreamTarget, type StreamTargetOptions, UrlSource };

package/dist/index.mjs

@@ -1,20 +1,421 @@
-import { ALL_FORMATS, Conversion, FilePathSource, FilePathTarget, Input as Input$1, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, ReadableStreamSource, StreamSource, StreamTarget, UrlSource } from "mediabunny";
+import { ALL_FORMATS, Conversion, EncodedPacket, FilePathSource, FilePathTarget, Input as Input$1, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, ReadableStreamSource, StreamSource, StreamTarget, UrlSource } from "mediabunny";
+//#region src/mediabunny-isobmff.ts
+const binarySearchLessOrEqual = (items, needle, getValue) => {
+	let low = 0;
+	let high = items.length - 1;
+	let result = -1;
+	while (low <= high) {
+		const middle = low + Math.floor((high - low) / 2);
+		if (getValue(items[middle]) <= needle) {
+			result = middle;
+			low = middle + 1;
+		} else high = middle - 1;
+	}
+	return result;
+};
+const binarySearchExact = (items, needle, getValue) => {
+	let low = 0;
+	let high = items.length - 1;
+	while (low <= high) {
+		const middle = low + Math.floor((high - low) / 2);
+		const value = getValue(items[middle]);
+		if (value === needle) return middle;
+		if (value < needle) low = middle + 1;
+		else high = middle - 1;
+	}
+	return -1;
+};
+const readBytes = (slice, length) => {
+	const bytes = slice.bytes.slice(slice.bufferPos, slice.bufferPos + length);
+	slice.bufferPos += length;
+	return bytes;
+};
+const readU16Be = (slice) => {
+	const value = slice.view.getUint16(slice.bufferPos, false);
+	slice.bufferPos += 2;
+	return value;
+};
+const readU32Be = (slice) => {
+	const value = slice.view.getUint32(slice.bufferPos, false);
+	slice.bufferPos += 4;
+	return value;
+};
+const readSampleBytes = async (internalTrack, byteOffset, byteLength) => {
+	let slice = internalTrack.demuxer.reader.requestSlice(byteOffset, byteLength);
+	if (slice instanceof Promise) slice = await slice;
+	if (!slice) throw new Error("Failed to read encrypted sample bytes.");
+	return readBytes(slice, byteLength);
+};
+const resolveEncryptionAuxInfo = async (internalTrack, auxInfo) => {
+	if (auxInfo.resolved) return auxInfo.resolved;
+	const encryptionInfo = internalTrack.encryptionInfo;
+	if (!encryptionInfo || encryptionInfo.defaultPerSampleIvSize === null) throw new Error("Missing track encryption info.");
+	if (auxInfo.offset === null || auxInfo.sampleCount === 0) throw new Error("Incomplete saiz/saio info; cannot resolve encryption data.");
+	if (auxInfo.defaultSampleInfoSize === 0 && !auxInfo.sampleSizes) throw new Error("Invalid auxiliary encryption info: auxInfo.sampleSizes is required when auxInfo.defaultSampleInfoSize is 0.");
+	let totalSize = 0;
+	if (auxInfo.defaultSampleInfoSize > 0) totalSize = auxInfo.defaultSampleInfoSize * auxInfo.sampleCount;
+	else if (auxInfo.sampleSizes) for (const size of auxInfo.sampleSizes) totalSize += size;
+	let slice = internalTrack.demuxer.reader.requestSlice(auxInfo.offset, totalSize);
+	if (slice instanceof Promise) slice = await slice;
+	if (!slice) throw new Error("Failed to read auxiliary encryption info.");
+	const entries = [];
+	const ivSize = encryptionInfo.defaultPerSampleIvSize;
+	for (let i = 0; i < auxInfo.sampleCount; i++) {
+		const entrySize = auxInfo.defaultSampleInfoSize > 0 ? auxInfo.defaultSampleInfoSize : auxInfo.sampleSizes?.[i] ?? 0;
+		const iv = new Uint8Array(16);
+		if (ivSize > 0) iv.set(readBytes(slice, ivSize), 0);
+		else if (encryptionInfo.defaultConstantIv) iv.set(encryptionInfo.defaultConstantIv, 0);
+		let subsamples = null;
+		if (entrySize > ivSize) {
+			const subsampleCount = readU16Be(slice);
+			subsamples = [];
+			for (let j = 0; j < subsampleCount; j++) subsamples.push({
+				clearLen: readU16Be(slice),
+				protectedLen: readU32Be(slice)
+			});
+		}
+		entries.push({
+			iv,
+			subsamples
+		});
+	}
+	auxInfo.resolved = entries;
+	return entries;
+};
+const getSampleInfo = (sampleTable, sampleIndex) => {
+	const timingEntryIndex = binarySearchLessOrEqual(sampleTable.sampleTimingEntries, sampleIndex, (entry) => entry.startIndex);
+	const timingEntry = sampleTable.sampleTimingEntries[timingEntryIndex];
+	if (!timingEntry || timingEntry.startIndex + timingEntry.count <= sampleIndex) return null;
+	let presentationTimestamp = timingEntry.startDecodeTimestamp + (sampleIndex - timingEntry.startIndex) * timingEntry.delta;
+	const offsetEntryIndex = binarySearchLessOrEqual(sampleTable.sampleCompositionTimeOffsets, sampleIndex, (entry) => entry.startIndex);
+	const offsetEntry = sampleTable.sampleCompositionTimeOffsets[offsetEntryIndex];
+	if (offsetEntry && sampleIndex - offsetEntry.startIndex < offsetEntry.count) presentationTimestamp += offsetEntry.offset;
+	const sampleSize = sampleTable.sampleSizes[Math.min(sampleIndex, sampleTable.sampleSizes.length - 1)];
+	if (sampleSize === void 0) return null;
+	const chunkEntryIndex = binarySearchLessOrEqual(sampleTable.sampleToChunk, sampleIndex, (entry) => entry.startSampleIndex);
+	const chunkEntry = sampleTable.sampleToChunk[chunkEntryIndex];
+	if (!chunkEntry) return null;
+	const chunkIndex = chunkEntry.startChunkIndex + Math.floor((sampleIndex - chunkEntry.startSampleIndex) / chunkEntry.samplesPerChunk);
+	const chunkOffset = sampleTable.chunkOffsets[chunkIndex];
+	if (chunkOffset === void 0) return null;
+	const startSampleIndexOfChunk = chunkEntry.startSampleIndex + (chunkIndex - chunkEntry.startChunkIndex) * chunkEntry.samplesPerChunk;
+	let chunkSize = 0;
+	let sampleOffset = chunkOffset;
+	if (sampleTable.sampleSizes.length === 1) {
+		sampleOffset += sampleSize * (sampleIndex - startSampleIndexOfChunk);
+		chunkSize += sampleSize * chunkEntry.samplesPerChunk;
+	} else for (let i = startSampleIndexOfChunk; i < startSampleIndexOfChunk + chunkEntry.samplesPerChunk; i++) {
+		const currentSampleSize = sampleTable.sampleSizes[i];
+		if (currentSampleSize === void 0) return null;
+		if (i < sampleIndex) sampleOffset += currentSampleSize;
+		chunkSize += currentSampleSize;
+	}
+	let duration = timingEntry.delta;
+	if (sampleTable.presentationTimestamps && sampleTable.presentationTimestampIndexMap) {
+		const presentationIndex = sampleTable.presentationTimestampIndexMap[sampleIndex];
+		if (presentationIndex !== void 0 && presentationIndex < sampleTable.presentationTimestamps.length - 1) {
+			const nextEntry = sampleTable.presentationTimestamps[presentationIndex + 1];
+			if (nextEntry) duration = nextEntry.presentationTimestamp - presentationTimestamp;
+		}
+	}
+	const isKeyFrame = sampleTable.keySampleIndices ? binarySearchExact(sampleTable.keySampleIndices, sampleIndex, (value) => value) !== -1 : true;
+	return {
+		presentationTimestamp,
+		duration,
+		sampleOffset,
+		sampleSize,
+		chunkOffset,
+		chunkSize,
+		isKeyFrame
+	};
+};
+const psshBoxesAreEqual = (left, right) => {
+	if (left.systemId !== right.systemId) return false;
+	if (left.data.byteLength !== right.data.byteLength) return false;
+	for (let i = 0; i < left.data.byteLength; i++) if (left.data[i] !== right.data[i]) return false;
+	return true;
+};
+const collectCryptRanges = (subsamples, cryptByteBlock, skipByteBlock) => {
+	const ranges = [];
+	const hasPattern = cryptByteBlock !== 0 || skipByteBlock !== 0;
+	let cursor = 0;
+	for (const subsample of subsamples) {
+		cursor += subsample.clearLen;
+		if (!hasPattern) {
+			if (subsample.protectedLen > 0) ranges.push({
+				offset: cursor,
+				length: subsample.protectedLen
+			});
+			cursor += subsample.protectedLen;
+			continue;
+		}
+		let remaining = subsample.protectedLen;
+		let position = cursor;
+		while (remaining > 0) {
+			if (remaining < 16 * cryptByteBlock) break;
+			const cryptLength = 16 * cryptByteBlock;
+			ranges.push({
+				offset: position,
+				length: cryptLength
+			});
+			position += cryptLength;
+			remaining -= cryptLength;
+			const skipLength = Math.min(16 * skipByteBlock, remaining);
+			position += skipLength;
+			remaining -= skipLength;
+		}
+		cursor += subsample.protectedLen;
+	}
+	return ranges;
+};
+const cloneSubsamples = (subsamples) => {
+	if (!subsamples) return null;
+	return subsamples.map((subsample) => ({
+		clearLen: subsample.clearLen,
+		protectedLen: subsample.protectedLen
+	}));
+};
+const getPattern = (encryptionInfo) => {
+	const cryptByteBlock = encryptionInfo.defaultCryptByteBlock ?? 0;
+	const skipByteBlock = encryptionInfo.defaultSkipByteBlock ?? 0;
+	if (cryptByteBlock === 0 && skipByteBlock === 0) return null;
+	return {
+		cryptByteBlock,
+		skipByteBlock
+	};
+};
+const createProtectedDataLayout = (data, encryptionInfo, sampleEncryption) => {
+	if (!sampleEncryption.subsamples) return {
+		data,
+		merge: (decryptedData) => new Uint8Array(decryptedData)
+	};
+	if (encryptionInfo.scheme === "cbcs") return null;
+	const cryptRanges = collectCryptRanges(sampleEncryption.subsamples, encryptionInfo.defaultCryptByteBlock ?? 0, encryptionInfo.defaultSkipByteBlock ?? 0);
+	let totalCryptLength = 0;
+	for (const range of cryptRanges) totalCryptLength += range.length;
+	const protectedData = new Uint8Array(totalCryptLength);
+	let writeOffset = 0;
+	for (const range of cryptRanges) {
+		protectedData.set(data.subarray(range.offset, range.offset + range.length), writeOffset);
+		writeOffset += range.length;
+	}
+	return {
+		data: protectedData,
+		merge: (decryptedData) => {
+			const merged = new Uint8Array(data);
+			let readOffset = 0;
+			for (const range of cryptRanges) {
+				merged.set(decryptedData.subarray(readOffset, readOffset + range.length), range.offset);
+				readOffset += range.length;
+			}
+			return merged;
+		}
+	};
+};
+const isUint8Array = (value) => value instanceof Uint8Array;
+const isIsobmffTrackBacking = (backing) => {
+	if (!backing || typeof backing !== "object") return false;
+	const maybeBacking = backing;
+	const internalTrack = maybeBacking.internalTrack;
+	return Boolean(internalTrack && internalTrack.demuxer && typeof internalTrack.demuxer.getSampleTableForTrack === "function" && maybeBacking.packetToSampleIndex instanceof WeakMap && maybeBacking.packetToFragmentLocation instanceof WeakMap);
+};
+const getTrackEncryptionInfo = (backing) => backing.internalTrack.encryptionInfo;
+const getKeyId = (backing) => backing.internalTrack.encryptionInfo?.defaultKid ?? null;
+const getEncryptedSample = async (backing, packet) => {
+	const internalTrack = backing.internalTrack;
+	const fragmentLocation = backing.packetToFragmentLocation.get(packet);
+	if (fragmentLocation) {
+		const fragment = fragmentLocation.fragment;
+		const sample = fragment.trackData.get(internalTrack.id)?.samples[fragmentLocation.sampleIndex];
+		if (!sample?.encryption) return null;
+		return {
+			data: await readSampleBytes(internalTrack, sample.byteOffset, sample.byteSize),
+			sampleEncryption: sample.encryption,
+			fragment
+		};
+	}
+	const sampleIndex = backing.packetToSampleIndex.get(packet);
+	if (sampleIndex === void 0) return null;
+	const sampleInfo = getSampleInfo(internalTrack.demuxer.getSampleTableForTrack(internalTrack), sampleIndex);
+	if (!sampleInfo) return null;
+	const auxInfo = internalTrack.encryptionAuxInfo;
+	if (!auxInfo) return null;
+	const sampleEncryption = (await resolveEncryptionAuxInfo(internalTrack, auxInfo))[sampleIndex];
+	if (!sampleEncryption) return null;
+	return {
+		data: await readSampleBytes(internalTrack, sampleInfo.sampleOffset, sampleInfo.sampleSize),
+		sampleEncryption,
+		fragment: null
+	};
+};
+const getPsshBoxes = (backing, keyId, fragment) => {
+	const { psshBoxes } = backing.internalTrack.demuxer;
+	if (!fragment) return psshBoxes;
+	const boxes = [...psshBoxes, ...fragment.psshBoxes].filter((psshBox) => psshBox.keyIds === null || psshBox.keyIds.includes(keyId));
+	for (let i = 0; i < boxes.length - 1; i++) for (let j = i + 1; j < boxes.length; j++) if (psshBoxesAreEqual(boxes[i], boxes[j])) {
+		boxes.splice(j, 1);
+		j--;
+	}
+	return boxes;
+};
+//#endregion
+//#region src/isobmff-decrypt-sample-patcher.ts
+const createMetadataOnlyOptions = (options) => ({
+	...options,
+	metadataOnly: true,
+	verifyKeyPackets: false
+});
+var IsobmffDecryptSamplePatcher = class {
+	input;
+	decryptSample;
+	decryptProtectedData;
+	reportEncryptionInfo;
+	patchableTrackBackings = /* @__PURE__ */ new WeakSet();
+	patchTrackBackingsPromise = null;
+	constructor(input, decryptSample, decryptProtectedData, reportEncryptionInfo) {
+		this.input = input;
+		this.decryptSample = decryptSample;
+		this.decryptProtectedData = decryptProtectedData;
+		this.reportEncryptionInfo = reportEncryptionInfo;
+	}
+	async ensurePatched() {
+		this.patchTrackBackingsPromise ??= (async () => {
+			const tracks = await this.input.getTracks();
+			for (const track of tracks) {
+				const backing = track._backing;
+				if (!isIsobmffTrackBacking(backing) || this.patchableTrackBackings.has(backing)) continue;
+				this.patchableTrackBackings.add(backing);
+				this.patchTrackBacking(backing);
+			}
+		})();
+		await this.patchTrackBackingsPromise;
+	}
+	patchTrackBacking(backing) {
+		const packetToMetadataPacket = /* @__PURE__ */ new WeakMap();
+		const getOriginalPacket = (packet) => packetToMetadataPacket.get(packet) ?? packet;
+		const getFirstPacket = backing.getFirstPacket.bind(backing);
+		backing.getFirstPacket = async (options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getFirstPacket(options);
+			const metadataPacket = await getFirstPacket(createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getFirstPacket(options), packetToMetadataPacket);
+		};
+		const getPacket = backing.getPacket.bind(backing);
+		backing.getPacket = async (timestamp, options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getPacket(timestamp, options);
+			const metadataPacket = await getPacket(timestamp, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getPacket(timestamp, options), packetToMetadataPacket);
+		};
+		const getNextPacket = backing.getNextPacket.bind(backing);
+		backing.getNextPacket = async (packet, options) => {
+			const originalPacket = getOriginalPacket(packet);
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getNextPacket(originalPacket, options);
+			const metadataPacket = await getNextPacket(originalPacket, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getNextPacket(originalPacket, options), packetToMetadataPacket);
+		};
+		const getKeyPacket = backing.getKeyPacket.bind(backing);
+		backing.getKeyPacket = async (timestamp, options) => {
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getKeyPacket(timestamp, options);
+			const metadataPacket = await getKeyPacket(timestamp, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getKeyPacket(timestamp, options), packetToMetadataPacket);
+		};
+		const getNextKeyPacket = backing.getNextKeyPacket.bind(backing);
+		backing.getNextKeyPacket = async (packet, options) => {
+			const originalPacket = getOriginalPacket(packet);
+			if (!this.shouldUseCustomDecryptSample(backing, options)) return getNextKeyPacket(originalPacket, options);
+			const metadataPacket = await getNextKeyPacket(originalPacket, createMetadataOnlyOptions(options));
+			return this.materializePacket(backing, metadataPacket, () => getNextKeyPacket(originalPacket, options), packetToMetadataPacket);
+		};
+	}
+	shouldUseCustomDecryptSample(backing, options) {
+		return Boolean(!options.metadataOnly && getTrackEncryptionInfo(backing)?.defaultIsProtected !== false);
+	}
+	async materializePacket(backing, metadataPacket, fallback, packetToMetadataPacket) {
+		if (!metadataPacket) return null;
+		const decryptedPacket = await this.decryptPacket(backing, metadataPacket, fallback);
+		if (decryptedPacket && decryptedPacket !== metadataPacket) packetToMetadataPacket.set(decryptedPacket, metadataPacket);
+		return decryptedPacket;
+	}
+	async decryptPacket(backing, metadataPacket, fallback) {
+		const encryptionInfo = getTrackEncryptionInfo(backing);
+		if (!encryptionInfo?.defaultIsProtected) return fallback();
+		const keyId = getKeyId(backing);
+		if (!keyId) throw new Error("Encrypted sample encountered without a key ID.");
+		const encryptedSample = await getEncryptedSample(backing, metadataPacket);
+		if (!encryptedSample) return fallback();
+		const psshBoxes = getPsshBoxes(backing, keyId, encryptedSample.fragment);
+		this.reportEncryptionInfo(keyId, psshBoxes);
+		const decryptedData = this.decryptSample ? await this.decryptSample({
+			data: encryptedSample.data,
+			keyId,
+			psshBoxes,
+			scheme: encryptionInfo.scheme,
+			iv: encryptedSample.sampleEncryption.iv.slice(),
+			timestamp: metadataPacket.microsecondTimestamp,
+			subsamples: cloneSubsamples(encryptedSample.sampleEncryption.subsamples),
+			pattern: getPattern(encryptionInfo)
+		}) : await this.decryptWithProtectedData(encryptionInfo, encryptedSample, metadataPacket.microsecondTimestamp, keyId, psshBoxes);
+		if (!isUint8Array(decryptedData)) throw new TypeError("decryption callback must return a Uint8Array.");
+		if (decryptedData.byteLength !== metadataPacket.byteLength) throw new Error("decryption callback must return the same number of bytes as the encrypted sample.");
+		return new EncodedPacket(decryptedData, metadataPacket.type, metadataPacket.timestamp, metadataPacket.duration, metadataPacket.sequenceNumber, metadataPacket.byteLength, metadataPacket.sideData);
+	}
+	async decryptWithProtectedData(encryptionInfo, encryptedSample, timestamp, keyId, psshBoxes) {
+		if (!this.decryptProtectedData) throw new Error("Encrypted sample encountered without a decryption callback.");
+		const protectedDataLayout = createProtectedDataLayout(encryptedSample.data, encryptionInfo, encryptedSample.sampleEncryption);
+		if (!protectedDataLayout) throw new Error("decryptProtectedData does not support cbcs samples with subsample encryption. Use decryptSample for this content.");
+		const decryptedProtectedData = await this.decryptProtectedData({
+			data: protectedDataLayout.data,
+			keyId,
+			psshBoxes,
+			scheme: encryptionInfo.scheme,
+			iv: encryptedSample.sampleEncryption.iv.slice(),
+			timestamp,
+			subsamples: [{
+				clearLen: 0,
+				protectedLen: protectedDataLayout.data.byteLength
+			}],
+			pattern: null
+		});
+		if (!isUint8Array(decryptedProtectedData)) throw new TypeError("decryptProtectedData must return a Uint8Array.");
+		if (decryptedProtectedData.byteLength !== protectedDataLayout.data.byteLength) throw new Error("decryptProtectedData must return the same number of bytes as the protected data input.");
+		return protectedDataLayout.merge(decryptedProtectedData);
+	}
+};
+//#endregion
 //#region src/index.ts
+const createEncryptionReporter = (handleEncryptionInfo) => {
+	const reportedEncryptionInfo = /* @__PURE__ */ new Set();
+	return (keyId, psshBoxes) => {
+		if (!handleEncryptionInfo || reportedEncryptionInfo.has(keyId)) return;
+		reportedEncryptionInfo.add(keyId);
+		handleEncryptionInfo({
+			keyId,
+			psshBoxes
+		});
+	};
+};
 var Input = class extends Input$1 {
-	constructor({ keys, handleEncryptionInfo, ...options }) {
+	decryptSamplePatcher;
+	constructor({ keys, decryptSample, decryptProtectedData, handleEncryptionInfo, ...options }) {
+		if (!keys?.size && !decryptSample && !decryptProtectedData) throw new Error("Either keys, decryptSample, or decryptProtectedData must be provided.");
+		const reportEncryptionInfo = createEncryptionReporter(handleEncryptionInfo);
 		super({
 			...options,
 			formats: ALL_FORMATS,
 			formatOptions: { isobmff: { resolveKeyId: ({ keyId, psshBoxes }) => {
-				handleEncryptionInfo?.({
-					keyId,
-					psshBoxes
-				});
-				const key = keys.get(keyId);
+				reportEncryptionInfo(keyId, psshBoxes);
+				const key = keys?.get(keyId);
 				if (!key) throw new Error("Unknown key ID.");
 				return key;
 			} } }
 		});
+		this.decryptSamplePatcher = decryptSample || decryptProtectedData ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, decryptProtectedData, reportEncryptionInfo) : null;
+	}
+	async getTracks(query) {
+		await this.decryptSamplePatcher?.ensurePatched();
+		return super.getTracks(query);
+	}
+	async getTracksWithoutPatching(query) {
+		return super.getTracks(query);
 	}
 };
 var Output = class extends Output$1 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shifro",
-  "version": "1.1.4",
+  "version": "1.2.0",
   "description": "A lightweight library and command-line tool for decrypting MP4 files",
   "files": [
     "dist"
@@ -55,15 +55,15 @@
     "node": ">=22.18"
   },
   "peerDependencies": {
-    "mediabunny": "^1.44.2"
+    "mediabunny": "^1.45.2"
   },
   "devDependencies": {
-    "@types/node": "^25.6.2",
-    "oxfmt": "^0.48.0",
-    "oxlint": "^1.63.0",
+    "@types/node": "^25.8.0",
+    "oxfmt": "^0.50.0",
+    "oxlint": "^1.65.0",
     "tsdown": "^0.22.0",
     "typescript": "~6.0.3",
-    "vitest": "^4.1.5"
+    "vitest": "^4.1.6"
   },
   "scripts": {
     "start": "node ./dist/cli.mjs",