shifro 1.2.0 → 1.2.1

package/README.md

@@ -16,7 +16,7 @@ Run `npm install -g shifro` to install the command-line tool globally.
 shifro --key eb676abbcb345e96bbcf616630f1a3da:100b6c20940f779a4589152b57d2dacb ./input.mp4 ./output.mp4
 ```
 
->You can also use `npx shifro ...` to run the CLI tool without installing it globally
+> You can also use `npx shifro ...` to run the CLI tool without installing it globally
 
 This CLI can be used as an alternative to the [mp4decrypt](https://www.bento4.com/documentation/mp4decrypt/) or [shaka-packager](https://shaka-project.github.io/shaka-packager/html/documentation.html#raw-key-encryption-options).
 
@@ -38,7 +38,7 @@ async function decrypt() {
         ['4d97930a3d7b55fa81d0028653f5e499', '429ec76475e7a952d224d8ef867f12b6'],
         ['d21373c0b8ab5ba9954742bcdfb5f48b', '150a6c7d7dee6a91b74dccfce5b31928'],
       ]),
-      // Optinally, you can use this callback to handle encryption information (like key ID and PSSH boxes)
+      // Optionally, you can use this callback to handle encryption information (like key ID and PSSH boxes)
       handleEncryptionInfo: ({ keyId, psshBoxes }) => {
         console.group(`Key ID: ${keyId}`);
         for (const psshBox of psshBoxes) {
@@ -57,6 +57,38 @@ async function decrypt() {
 }
 ```
 
+#### Decrypting file with an external AES backend
+
+```ts
+import {
+  Decryption,
+  FilePathSource,
+  FilePathTarget,
+  Input,
+  Output,
+  decryptBytes,
+  type EncryptedBytes,
+} from 'shifro';
+
+// Decrypt bytes with your DRM library
+async function decryptProtectedData({ scheme, data, iv }: EncryptedBytes) {
+  // Your decryption logic here
+}
+
+async function runDecryption() {
+  const decryption = await Decryption.init({
+    input: new Input({
+      source: new FilePathSource('./input.mp4'),
+      // `decryptBytes` - helper function that allows to handle only the encrypted bytes. Clear sample bytes are not included.
+      decryptSample: decryptBytes(decryptProtectedData),
+    }),
+    output: new Output({ target: new FilePathTarget('./output.mp4') }),
+  });
+
+  await decryption.execute();
+}
+```
+
 #### Decrypting file using browser's Web Streams API
 
 ```ts

package/dist/cli.mjs

@@ -3,7 +3,7 @@ import { parseArgs } from "node:util";
 import { ALL_FORMATS, Conversion, EncodedPacket, FilePathSource, FilePathTarget, Input, Mp4OutputFormat, Output } from "mediabunny";
 //#region package.json
 var name = "shifro";
-var version = "1.2.0";
+var version = "1.2.1";
 var author = "Vitaly Gashkov <vitalygashkov@vk.com>";
 //#endregion
 //#region src/mediabunny-isobmff.ts
@@ -142,39 +142,6 @@ const psshBoxesAreEqual = (left, right) => {
 	for (let i = 0; i < left.data.byteLength; i++) if (left.data[i] !== right.data[i]) return false;
 	return true;
 };
-const collectCryptRanges = (subsamples, cryptByteBlock, skipByteBlock) => {
-	const ranges = [];
-	const hasPattern = cryptByteBlock !== 0 || skipByteBlock !== 0;
-	let cursor = 0;
-	for (const subsample of subsamples) {
-		cursor += subsample.clearLen;
-		if (!hasPattern) {
-			if (subsample.protectedLen > 0) ranges.push({
-				offset: cursor,
-				length: subsample.protectedLen
-			});
-			cursor += subsample.protectedLen;
-			continue;
-		}
-		let remaining = subsample.protectedLen;
-		let position = cursor;
-		while (remaining > 0) {
-			if (remaining < 16 * cryptByteBlock) break;
-			const cryptLength = 16 * cryptByteBlock;
-			ranges.push({
-				offset: position,
-				length: cryptLength
-			});
-			position += cryptLength;
-			remaining -= cryptLength;
-			const skipLength = Math.min(16 * skipByteBlock, remaining);
-			position += skipLength;
-			remaining -= skipLength;
-		}
-		cursor += subsample.protectedLen;
-	}
-	return ranges;
-};
 const cloneSubsamples = (subsamples) => {
 	if (!subsamples) return null;
 	return subsamples.map((subsample) => ({
@@ -191,34 +158,6 @@ const getPattern = (encryptionInfo) => {
 		skipByteBlock
 	};
 };
-const createProtectedDataLayout = (data, encryptionInfo, sampleEncryption) => {
-	if (!sampleEncryption.subsamples) return {
-		data,
-		merge: (decryptedData) => new Uint8Array(decryptedData)
-	};
-	if (encryptionInfo.scheme === "cbcs") return null;
-	const cryptRanges = collectCryptRanges(sampleEncryption.subsamples, encryptionInfo.defaultCryptByteBlock ?? 0, encryptionInfo.defaultSkipByteBlock ?? 0);
-	let totalCryptLength = 0;
-	for (const range of cryptRanges) totalCryptLength += range.length;
-	const protectedData = new Uint8Array(totalCryptLength);
-	let writeOffset = 0;
-	for (const range of cryptRanges) {
-		protectedData.set(data.subarray(range.offset, range.offset + range.length), writeOffset);
-		writeOffset += range.length;
-	}
-	return {
-		data: protectedData,
-		merge: (decryptedData) => {
-			const merged = new Uint8Array(data);
-			let readOffset = 0;
-			for (const range of cryptRanges) {
-				merged.set(decryptedData.subarray(readOffset, readOffset + range.length), range.offset);
-				readOffset += range.length;
-			}
-			return merged;
-		}
-	};
-};
 const isUint8Array = (value) => value instanceof Uint8Array;
 const isIsobmffTrackBacking = (backing) => {
 	if (!backing || typeof backing !== "object") return false;
@@ -275,14 +214,12 @@ const createMetadataOnlyOptions = (options) => ({
 var IsobmffDecryptSamplePatcher = class {
 	input;
 	decryptSample;
-	decryptProtectedData;
 	reportEncryptionInfo;
 	patchableTrackBackings = /* @__PURE__ */ new WeakSet();
 	patchTrackBackingsPromise = null;
-	constructor(input, decryptSample, decryptProtectedData, reportEncryptionInfo) {
+	constructor(input, decryptSample, reportEncryptionInfo) {
 		this.input = input;
 		this.decryptSample = decryptSample;
-		this.decryptProtectedData = decryptProtectedData;
 		this.reportEncryptionInfo = reportEncryptionInfo;
 	}
 	async ensurePatched() {
@@ -351,7 +288,7 @@ var IsobmffDecryptSamplePatcher = class {
 		if (!encryptedSample) return fallback();
 		const psshBoxes = getPsshBoxes(backing, keyId, encryptedSample.fragment);
 		this.reportEncryptionInfo(keyId, psshBoxes);
-		const decryptedData = this.decryptSample ? await this.decryptSample({
+		const decryptedData = await this.decryptSample({
 			data: encryptedSample.data,
 			keyId,
 			psshBoxes,
@@ -360,32 +297,11 @@ var IsobmffDecryptSamplePatcher = class {
 			timestamp: metadataPacket.microsecondTimestamp,
 			subsamples: cloneSubsamples(encryptedSample.sampleEncryption.subsamples),
 			pattern: getPattern(encryptionInfo)
-		}) : await this.decryptWithProtectedData(encryptionInfo, encryptedSample, metadataPacket.microsecondTimestamp, keyId, psshBoxes);
+		});
 		if (!isUint8Array(decryptedData)) throw new TypeError("decryption callback must return a Uint8Array.");
 		if (decryptedData.byteLength !== metadataPacket.byteLength) throw new Error("decryption callback must return the same number of bytes as the encrypted sample.");
 		return new EncodedPacket(decryptedData, metadataPacket.type, metadataPacket.timestamp, metadataPacket.duration, metadataPacket.sequenceNumber, metadataPacket.byteLength, metadataPacket.sideData);
 	}
-	async decryptWithProtectedData(encryptionInfo, encryptedSample, timestamp, keyId, psshBoxes) {
-		if (!this.decryptProtectedData) throw new Error("Encrypted sample encountered without a decryption callback.");
-		const protectedDataLayout = createProtectedDataLayout(encryptedSample.data, encryptionInfo, encryptedSample.sampleEncryption);
-		if (!protectedDataLayout) throw new Error("decryptProtectedData does not support cbcs samples with subsample encryption. Use decryptSample for this content.");
-		const decryptedProtectedData = await this.decryptProtectedData({
-			data: protectedDataLayout.data,
-			keyId,
-			psshBoxes,
-			scheme: encryptionInfo.scheme,
-			iv: encryptedSample.sampleEncryption.iv.slice(),
-			timestamp,
-			subsamples: [{
-				clearLen: 0,
-				protectedLen: protectedDataLayout.data.byteLength
-			}],
-			pattern: null
-		});
-		if (!isUint8Array(decryptedProtectedData)) throw new TypeError("decryptProtectedData must return a Uint8Array.");
-		if (decryptedProtectedData.byteLength !== protectedDataLayout.data.byteLength) throw new Error("decryptProtectedData must return the same number of bytes as the protected data input.");
-		return protectedDataLayout.merge(decryptedProtectedData);
-	}
 };
 //#endregion
 //#region src/index.ts
@@ -402,8 +318,8 @@ const createEncryptionReporter = (handleEncryptionInfo) => {
 };
 var Input$1 = class extends Input {
 	decryptSamplePatcher;
-	constructor({ keys, decryptSample, decryptProtectedData, handleEncryptionInfo, ...options }) {
-		if (!keys?.size && !decryptSample && !decryptProtectedData) throw new Error("Either keys, decryptSample, or decryptProtectedData must be provided.");
+	constructor({ keys, decryptSample, handleEncryptionInfo, ...options }) {
+		if (!keys?.size && !decryptSample) throw new Error("Either keys or decryptSample must be provided.");
 		const reportEncryptionInfo = createEncryptionReporter(handleEncryptionInfo);
 		super({
 			...options,
@@ -415,7 +331,7 @@ var Input$1 = class extends Input {
 				return key;
 			} } }
 		});
-		this.decryptSamplePatcher = decryptSample || decryptProtectedData ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, decryptProtectedData, reportEncryptionInfo) : null;
+		this.decryptSamplePatcher = decryptSample ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, reportEncryptionInfo) : null;
 	}
 	async getTracks(query) {
 		await this.decryptSamplePatcher?.ensurePatched();

package/dist/index.d.mts

@@ -1,10 +1,10 @@
-import { Conversion, FilePathSource, FilePathTarget, Input as Input$1, InputOptions as MediabunnyInputOptions, InputTrack, InputTrackQuery, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, OutputFormat, OutputOptions, PsshBox, ReadableStreamSource, StreamSource, StreamSourceOptions, StreamTarget, StreamTargetOptions, UrlSource } from "mediabunny";
+import { Conversion, FilePathSource, FilePathTarget, Input as Input$1, InputOptions as MediabunnyInputOptions, InputTrack, InputTrackQuery, MaybePromise, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, OutputFormat, OutputOptions, PsshBox, ReadableStreamSource, StreamSource, StreamSourceOptions, StreamTarget, StreamTargetOptions, UrlSource } from "mediabunny";
 
 //#region src/decrypt-sample.d.ts
 type KeyId = string;
 type Key = string;
 type KeyMap = Map<KeyId, Key>;
-type IsobmffScheme = 'cenc' | 'cens' | 'cbcs';
+type EncryptionScheme = 'cenc' | 'cens' | 'cbcs';
 type SubsampleEncryption = {
   /** Number of clear bytes that appear before the protected bytes in this subsample. */clearLen: number; /** Number of encrypted bytes in this subsample. */
   protectedLen: number;
@@ -23,44 +23,19 @@ type EncryptionPattern = {
  * that cannot be safely represented as a single flattened protected-byte stream, such as patterned `cbcs`
  * subsample encryption.
  */
-type IsobmffDecryptSampleOptions = {
+type EncryptedSample = {
   /** Full sample bytes as stored in the container. Clear and protected regions are both present in this buffer. */data: Uint8Array; /** Key ID from the track encryption metadata. */
   keyId: string; /** PSSH boxes associated with this key/sample and useful for DRM-specific key resolution. */
   psshBoxes: PsshBox[]; /** Sample encryption scheme. */
-  scheme: IsobmffScheme; /** Per-sample IV resolved from container metadata. */
+  scheme: EncryptionScheme; /** Per-sample IV resolved from container metadata. */
   iv: Uint8Array; /** Presentation timestamp of the sample in microseconds. */
   timestamp: number; /** Subsample layout describing which parts of `data` are clear vs protected, or `null` for whole-sample encryption. */
   subsamples: SubsampleEncryption[] | null; /** Pattern encryption parameters, or `null` when no pattern is used. */
   pattern: EncryptionPattern | null;
 };
-/**
- * Options passed to {@link DecryptProtectedData}.
- *
- * This is the compatibility/simple callback contract. `data` contains only the protected byte stream that needs
- * to be decrypted. `shifro` is responsible for extracting those protected bytes from the sample and inserting the
- * decrypted result back into the sample afterward.
- *
- * This matches the old `transformSample` style API used by `wapter`.
- */
-type IsobmffDecryptProtectedDataOptions = {
-  /** Only the protected bytes that should be decrypted. Clear sample bytes are not included. */data: Uint8Array; /** Key ID from the track encryption metadata. */
-  keyId: string; /** PSSH boxes associated with this key/sample and useful for DRM-specific key resolution. */
-  psshBoxes: PsshBox[]; /** Sample encryption scheme. */
-  scheme: IsobmffScheme; /** Per-sample IV resolved from container metadata. */
-  iv: Uint8Array; /** Presentation timestamp of the sample in microseconds. */
-  timestamp: number;
-  /**
-   * Subsample layout for the protected-data buffer passed to this callback.
-   *
-   * Since `data` already contains only protected bytes, this is typically a single entry covering the whole buffer.
-   */
-  subsamples: SubsampleEncryption[];
-  /**
-   * Pattern metadata for the protected-data buffer passed to this callback.
-   *
-   * This is `null` when the flattened protected-data representation no longer has any skipped blocks to describe.
-   */
-  pattern: EncryptionPattern | null;
+/** Options passed to {@link decryptBytes}. */
+type EncryptedBytes = Omit<EncryptedSample, 'data'> & {
+  /** Only the encrypted bytes that should be decrypted. Clear sample bytes are not included. */data: Uint8Array;
 };
 /**
  * Advanced sample decryption callback.
@@ -69,20 +44,10 @@ type IsobmffDecryptProtectedDataOptions = {
  * exact same length. This is the most general integration point and should be used when a backend needs explicit
  * subsample and pattern metadata.
  */
-type DecryptSample = (options: IsobmffDecryptSampleOptions) => Uint8Array | Promise<Uint8Array>;
-/**
- * Simplified protected-data decryption callback.
- *
- * The callback receives only the protected byte stream extracted from a sample and must return the decrypted bytes
- * for that protected region with the exact same length. `shifro` handles extraction from and reinsertion into the
- * original sample.
- *
- * This is the recommended callback for integrations that only need a raw "decrypt these bytes" operation.
- *
- * Note: this simplified callback is not sufficient for every encryption layout. For example, `cbcs` samples with
- * subsample encryption still require {@link DecryptSample}.
- */
-type DecryptProtectedData = (options: IsobmffDecryptProtectedDataOptions) => Uint8Array | Promise<Uint8Array>;
+type DecryptSample = (options: EncryptedSample) => MaybePromise<Uint8Array>;
+/** Raw byte decryption callback used by {@link decryptBytes}. */
+type DecryptBytesCallback = (options: EncryptedBytes) => MaybePromise<Uint8Array>;
+declare const decryptBytes: (decryptBytesCallback: DecryptBytesCallback) => DecryptSample;
 //#endregion
 //#region src/index.d.ts
 /**
@@ -106,13 +71,6 @@ type ShifroInputOptions = Omit<MediabunnyInputOptions, 'formats' | 'formatOption
    * metadata, or pattern encryption information.
    */
   decryptSample?: DecryptSample;
-  /**
-   * Simplified decryption callback that receives only the flattened protected byte stream.
-   *
-   * `shifro` extracts the protected bytes from the sample before calling this callback and reinserts the decrypted
-   * bytes back into the sample afterward.
-   */
-  decryptProtectedData?: DecryptProtectedData;
   /**
    * Optional callback invoked when encryption metadata is discovered for a sample.
    *
@@ -129,7 +87,6 @@ declare class Input extends Input$1 {
   constructor({
     keys,
     decryptSample,
-    decryptProtectedData,
     handleEncryptionInfo,
     ...options
   }: ShifroInputOptions);
@@ -144,4 +101,4 @@ declare class Output extends Output$1 {
   });
 }
 //#endregion
-export { type DecryptProtectedData, type DecryptSample, Conversion as Decryption, FilePathSource, FilePathTarget, Input, type MediabunnyInputOptions as InputOptions, type IsobmffDecryptProtectedDataOptions, type IsobmffDecryptSampleOptions, type Key, type KeyId, type KeyMap, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, type OutputFormat, type OutputOptions, ReadableStreamSource, ShifroInputOptions, StreamSource, type StreamSourceOptions, StreamTarget, type StreamTargetOptions, UrlSource };
+export { type DecryptBytesCallback, type DecryptSample, Conversion as Decryption, type EncryptedBytes, type EncryptedSample, type EncryptionPattern, FilePathSource, FilePathTarget, Input, type MediabunnyInputOptions as InputOptions, type Key, type KeyId, type KeyMap, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, type OutputFormat, type OutputOptions, ReadableStreamSource, ShifroInputOptions, StreamSource, type StreamSourceOptions, StreamTarget, type StreamTargetOptions, type SubsampleEncryption, UrlSource, decryptBytes };

package/dist/index.mjs

@@ -1,4 +1,131 @@
 import { ALL_FORMATS, Conversion, EncodedPacket, FilePathSource, FilePathTarget, Input as Input$1, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output as Output$1, ReadableStreamSource, StreamSource, StreamTarget, UrlSource } from "mediabunny";
+//#region src/decrypt-sample.ts
+const AES_BLOCK_SIZE = 16;
+const isUint8Array$1 = (value) => value instanceof Uint8Array;
+const cloneSubsamples$1 = (subsamples) => {
+	if (!subsamples) return null;
+	return subsamples.map((subsample) => ({
+		clearLen: subsample.clearLen,
+		protectedLen: subsample.protectedLen
+	}));
+};
+const clonePattern = (pattern) => {
+	if (!pattern) return null;
+	return {
+		cryptByteBlock: pattern.cryptByteBlock,
+		skipByteBlock: pattern.skipByteBlock
+	};
+};
+const collectProtectedRanges = (offset, protectedLen, pattern, fullBlocksOnly) => {
+	if (!pattern) {
+		const length = fullBlocksOnly ? protectedLen - protectedLen % AES_BLOCK_SIZE : protectedLen;
+		return length > 0 ? [{
+			offset,
+			length
+		}] : [];
+	}
+	if (pattern.cryptByteBlock <= 0) return [];
+	const ranges = [];
+	const cryptLen = AES_BLOCK_SIZE * pattern.cryptByteBlock;
+	const skipLen = AES_BLOCK_SIZE * pattern.skipByteBlock;
+	let remaining = protectedLen;
+	let position = offset;
+	while (remaining > 0) {
+		if (remaining < cryptLen) break;
+		ranges.push({
+			offset: position,
+			length: cryptLen
+		});
+		position += cryptLen;
+		remaining -= cryptLen;
+		const currentSkipLen = Math.min(skipLen, remaining);
+		position += currentSkipLen;
+		remaining -= currentSkipLen;
+	}
+	return ranges;
+};
+const collectCtrRanges = (options) => {
+	if (!options.subsamples) return [{
+		offset: 0,
+		length: options.data.byteLength
+	}];
+	const ranges = [];
+	let cursor = 0;
+	for (const subsample of options.subsamples) {
+		cursor += subsample.clearLen;
+		ranges.push(...collectProtectedRanges(cursor, subsample.protectedLen, options.pattern, false));
+		cursor += subsample.protectedLen;
+	}
+	return ranges;
+};
+const collectCbcsGroups = (options) => {
+	if (!options.subsamples) return [{
+		iv: options.iv.slice(),
+		ranges: [{
+			offset: 0,
+			length: options.data.byteLength - options.data.byteLength % AES_BLOCK_SIZE
+		}]
+	}];
+	if (!options.pattern) throw new Error("decryptBytes does not support cbcs subsample encryption without pattern encryption.");
+	const groups = [];
+	let cursor = 0;
+	for (const subsample of options.subsamples) {
+		cursor += subsample.clearLen;
+		groups.push({
+			iv: options.iv.slice(),
+			ranges: collectProtectedRanges(cursor, subsample.protectedLen, options.pattern, true)
+		});
+		cursor += subsample.protectedLen;
+	}
+	return groups;
+};
+const getRangeData = (data, ranges) => {
+	let totalLength = 0;
+	for (const range of ranges) totalLength += range.length;
+	const protectedData = new Uint8Array(totalLength);
+	let writeOffset = 0;
+	for (const range of ranges) {
+		protectedData.set(data.subarray(range.offset, range.offset + range.length), writeOffset);
+		writeOffset += range.length;
+	}
+	return protectedData;
+};
+const mergeRangeData = (target, decryptedData, ranges) => {
+	let readOffset = 0;
+	for (const range of ranges) {
+		target.set(decryptedData.subarray(readOffset, readOffset + range.length), range.offset);
+		readOffset += range.length;
+	}
+};
+const decryptGroups = async (options, groups, decryptBytesCallback) => {
+	const decryptedSample = new Uint8Array(options.data);
+	for (const group of groups) {
+		const encryptedData = getRangeData(options.data, group.ranges);
+		if (encryptedData.byteLength === 0) continue;
+		const decryptedData = await decryptBytesCallback({
+			data: encryptedData,
+			keyId: options.keyId,
+			psshBoxes: options.psshBoxes,
+			scheme: options.scheme,
+			iv: group.iv.slice(),
+			timestamp: options.timestamp,
+			subsamples: cloneSubsamples$1(options.subsamples),
+			pattern: clonePattern(options.pattern)
+		});
+		if (!isUint8Array$1(decryptedData)) throw new TypeError("decryptBytes callback must return a Uint8Array.");
+		if (decryptedData.byteLength !== encryptedData.byteLength) throw new Error("decryptBytes callback must return the same number of bytes as the encrypted input.");
+		mergeRangeData(decryptedSample, decryptedData, group.ranges);
+	}
+	return decryptedSample;
+};
+const decryptBytes = (decryptBytesCallback) => async (options) => {
+	if (options.scheme === "cbcs") return decryptGroups(options, collectCbcsGroups(options), decryptBytesCallback);
+	return decryptGroups(options, [{
+		iv: options.iv.slice(),
+		ranges: collectCtrRanges(options)
+	}], decryptBytesCallback);
+};
+//#endregion
 //#region src/mediabunny-isobmff.ts
 const binarySearchLessOrEqual = (items, needle, getValue) => {
 	let low = 0;
@@ -135,39 +262,6 @@ const psshBoxesAreEqual = (left, right) => {
 	for (let i = 0; i < left.data.byteLength; i++) if (left.data[i] !== right.data[i]) return false;
 	return true;
 };
-const collectCryptRanges = (subsamples, cryptByteBlock, skipByteBlock) => {
-	const ranges = [];
-	const hasPattern = cryptByteBlock !== 0 || skipByteBlock !== 0;
-	let cursor = 0;
-	for (const subsample of subsamples) {
-		cursor += subsample.clearLen;
-		if (!hasPattern) {
-			if (subsample.protectedLen > 0) ranges.push({
-				offset: cursor,
-				length: subsample.protectedLen
-			});
-			cursor += subsample.protectedLen;
-			continue;
-		}
-		let remaining = subsample.protectedLen;
-		let position = cursor;
-		while (remaining > 0) {
-			if (remaining < 16 * cryptByteBlock) break;
-			const cryptLength = 16 * cryptByteBlock;
-			ranges.push({
-				offset: position,
-				length: cryptLength
-			});
-			position += cryptLength;
-			remaining -= cryptLength;
-			const skipLength = Math.min(16 * skipByteBlock, remaining);
-			position += skipLength;
-			remaining -= skipLength;
-		}
-		cursor += subsample.protectedLen;
-	}
-	return ranges;
-};
 const cloneSubsamples = (subsamples) => {
 	if (!subsamples) return null;
 	return subsamples.map((subsample) => ({
@@ -184,34 +278,6 @@ const getPattern = (encryptionInfo) => {
 		skipByteBlock
 	};
 };
-const createProtectedDataLayout = (data, encryptionInfo, sampleEncryption) => {
-	if (!sampleEncryption.subsamples) return {
-		data,
-		merge: (decryptedData) => new Uint8Array(decryptedData)
-	};
-	if (encryptionInfo.scheme === "cbcs") return null;
-	const cryptRanges = collectCryptRanges(sampleEncryption.subsamples, encryptionInfo.defaultCryptByteBlock ?? 0, encryptionInfo.defaultSkipByteBlock ?? 0);
-	let totalCryptLength = 0;
-	for (const range of cryptRanges) totalCryptLength += range.length;
-	const protectedData = new Uint8Array(totalCryptLength);
-	let writeOffset = 0;
-	for (const range of cryptRanges) {
-		protectedData.set(data.subarray(range.offset, range.offset + range.length), writeOffset);
-		writeOffset += range.length;
-	}
-	return {
-		data: protectedData,
-		merge: (decryptedData) => {
-			const merged = new Uint8Array(data);
-			let readOffset = 0;
-			for (const range of cryptRanges) {
-				merged.set(decryptedData.subarray(readOffset, readOffset + range.length), range.offset);
-				readOffset += range.length;
-			}
-			return merged;
-		}
-	};
-};
 const isUint8Array = (value) => value instanceof Uint8Array;
 const isIsobmffTrackBacking = (backing) => {
 	if (!backing || typeof backing !== "object") return false;
@@ -268,14 +334,12 @@ const createMetadataOnlyOptions = (options) => ({
 var IsobmffDecryptSamplePatcher = class {
 	input;
 	decryptSample;
-	decryptProtectedData;
 	reportEncryptionInfo;
 	patchableTrackBackings = /* @__PURE__ */ new WeakSet();
 	patchTrackBackingsPromise = null;
-	constructor(input, decryptSample, decryptProtectedData, reportEncryptionInfo) {
+	constructor(input, decryptSample, reportEncryptionInfo) {
 		this.input = input;
 		this.decryptSample = decryptSample;
-		this.decryptProtectedData = decryptProtectedData;
 		this.reportEncryptionInfo = reportEncryptionInfo;
 	}
 	async ensurePatched() {
@@ -344,7 +408,7 @@ var IsobmffDecryptSamplePatcher = class {
 		if (!encryptedSample) return fallback();
 		const psshBoxes = getPsshBoxes(backing, keyId, encryptedSample.fragment);
 		this.reportEncryptionInfo(keyId, psshBoxes);
-		const decryptedData = this.decryptSample ? await this.decryptSample({
+		const decryptedData = await this.decryptSample({
 			data: encryptedSample.data,
 			keyId,
 			psshBoxes,
@@ -353,32 +417,11 @@ var IsobmffDecryptSamplePatcher = class {
 			timestamp: metadataPacket.microsecondTimestamp,
 			subsamples: cloneSubsamples(encryptedSample.sampleEncryption.subsamples),
 			pattern: getPattern(encryptionInfo)
-		}) : await this.decryptWithProtectedData(encryptionInfo, encryptedSample, metadataPacket.microsecondTimestamp, keyId, psshBoxes);
+		});
 		if (!isUint8Array(decryptedData)) throw new TypeError("decryption callback must return a Uint8Array.");
 		if (decryptedData.byteLength !== metadataPacket.byteLength) throw new Error("decryption callback must return the same number of bytes as the encrypted sample.");
 		return new EncodedPacket(decryptedData, metadataPacket.type, metadataPacket.timestamp, metadataPacket.duration, metadataPacket.sequenceNumber, metadataPacket.byteLength, metadataPacket.sideData);
 	}
-	async decryptWithProtectedData(encryptionInfo, encryptedSample, timestamp, keyId, psshBoxes) {
-		if (!this.decryptProtectedData) throw new Error("Encrypted sample encountered without a decryption callback.");
-		const protectedDataLayout = createProtectedDataLayout(encryptedSample.data, encryptionInfo, encryptedSample.sampleEncryption);
-		if (!protectedDataLayout) throw new Error("decryptProtectedData does not support cbcs samples with subsample encryption. Use decryptSample for this content.");
-		const decryptedProtectedData = await this.decryptProtectedData({
-			data: protectedDataLayout.data,
-			keyId,
-			psshBoxes,
-			scheme: encryptionInfo.scheme,
-			iv: encryptedSample.sampleEncryption.iv.slice(),
-			timestamp,
-			subsamples: [{
-				clearLen: 0,
-				protectedLen: protectedDataLayout.data.byteLength
-			}],
-			pattern: null
-		});
-		if (!isUint8Array(decryptedProtectedData)) throw new TypeError("decryptProtectedData must return a Uint8Array.");
-		if (decryptedProtectedData.byteLength !== protectedDataLayout.data.byteLength) throw new Error("decryptProtectedData must return the same number of bytes as the protected data input.");
-		return protectedDataLayout.merge(decryptedProtectedData);
-	}
 };
 //#endregion
 //#region src/index.ts
@@ -395,8 +438,8 @@ const createEncryptionReporter = (handleEncryptionInfo) => {
 };
 var Input = class extends Input$1 {
 	decryptSamplePatcher;
-	constructor({ keys, decryptSample, decryptProtectedData, handleEncryptionInfo, ...options }) {
-		if (!keys?.size && !decryptSample && !decryptProtectedData) throw new Error("Either keys, decryptSample, or decryptProtectedData must be provided.");
+	constructor({ keys, decryptSample, handleEncryptionInfo, ...options }) {
+		if (!keys?.size && !decryptSample) throw new Error("Either keys or decryptSample must be provided.");
 		const reportEncryptionInfo = createEncryptionReporter(handleEncryptionInfo);
 		super({
 			...options,
@@ -408,7 +451,7 @@ var Input = class extends Input$1 {
 				return key;
 			} } }
 		});
-		this.decryptSamplePatcher = decryptSample || decryptProtectedData ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, decryptProtectedData, reportEncryptionInfo) : null;
+		this.decryptSamplePatcher = decryptSample ? new IsobmffDecryptSamplePatcher({ getTracks: (query) => this.getTracksWithoutPatching(query) }, decryptSample, reportEncryptionInfo) : null;
 	}
 	async getTracks(query) {
 		await this.decryptSamplePatcher?.ensurePatched();
@@ -427,4 +470,4 @@ var Output = class extends Output$1 {
 	}
 };
 //#endregion
-export { Conversion as Decryption, FilePathSource, FilePathTarget, Input, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, ReadableStreamSource, StreamSource, StreamTarget, UrlSource };
+export { Conversion as Decryption, FilePathSource, FilePathTarget, Input, MkvOutputFormat, MovOutputFormat, Mp3OutputFormat, Mp4OutputFormat, Output, ReadableStreamSource, StreamSource, StreamTarget, UrlSource, decryptBytes };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shifro",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "A lightweight library and command-line tool for decrypting MP4 files",
   "files": [
     "dist"