/** * Ogg/Opus container inspection. * * Pure functions, zero dependencies — no I/O, no env, no clients. Used to fill * the duration field of a voice-note bubble and as a regression check that TTS * output stayed mono (some mobile clients refuse stereo voice notes). * * Inbound audio is attacker-controlled, so this walks the page structure via * the segment table rather than scanning for the `OggS` capture pattern. A * scan would let those four bytes appearing inside packet payload masquerade * as a page header, and the granule read from that offset — arbitrary audio * data — would become the reported duration. */ export interface OggOpusInfo { /** Channel count from the OpusHead identification header. */ channels: number; /** Whole seconds, derived from the final page's granule position. */ seconds: number; } /** * Parse channel count and duration from an Ogg/Opus stream. * * Returns null for anything that is not a readable Ogg/Opus stream — a * truncated buffer, a missing or malformed OpusHead, a page whose segment * table runs past the end, or a granule we cannot trust (the unknown-position * sentinel, or a value implying an implausible duration). Callers treat null * as "do not send this as audio". */ export declare function parseOggOpus(bytes: Uint8Array): OggOpusInfo | null; /** * Look for container-metadata bleed-through in the comment (OpusTags) header * — the second page of a well-formed stream, right after OpusHead. * * This is a warning-level signal, not a validity check: `parseOggOpus` above * never reads this page and its pass/fail contract is unaffected either way. * A non-empty result means the encoder that produced this file carried * MP4/QuickTime container fields (`major_brand`, `com.android.version`, ...) * into the Ogg comment header — usually because a phone recording was * transcoded with ffmpeg's default `-map_metadata` instead of `-map_metadata * -1`. Some strict players (WhatsApp's Android extractor among them) reject * files with this signature even though lenient readers, including ffmpeg * itself, decode them fine. * * Returns `null` when there is no readable comment header to inspect (short * buffer, missing OpusTags page, truncated field) — that is "no signal", * distinct from an empty array meaning "read cleanly, nothing suspicious". */ export declare function findSuspiciousOggComments(bytes: Uint8Array): string[] | null;