Initial commit: Null DRM Official

Capture, decrypt, and restream toolkit with compiled-in app modules
(RTE, TG4, BBC), on-device MITM proxy, streamd control plane, and www.
BBC module.yaml is published (clear streams); other module values stay local.

apps/pkg/mpd/kid.go

@@ -0,0 +1,50 @@
+package mpd
+
+import (
+	"encoding/xml"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var reDefaultKID = regexp.MustCompile(`(?i)default_KID="([^"]+)"`)
+
+// KIDToUUID normalizes any hex-ish KID spelling to dashed UUID form.
+func KIDToUUID(kid string) (string, error) {
+	var b strings.Builder
+	for _, r := range kid {
+		if (r >= '0' && r <= '9') || (r >= 'a' && r <= 'f') || (r >= 'A' && r <= 'F') {
+			b.WriteRune(r)
+		}
+	}
+	h := strings.ToLower(b.String())
+	if len(h) != 32 {
+		return "", fmt.Errorf("invalid KID %q", kid)
+	}
+	return fmt.Sprintf("%s-%s-%s-%s-%s", h[0:8], h[8:12], h[12:16], h[16:20], h[20:32]), nil
+}
+
+// KIDHex strips dashes and lowercases a KID (the form used as a map key).
+func KIDHex(kid string) string {
+	return strings.ToLower(strings.ReplaceAll(kid, "-", ""))
+}
+
+// ExtractDefaultKID pulls cenc:default_KID out of an MPD, as dashed UUID.
+func ExtractDefaultKID(xmlText string) string {
+	m := reDefaultKID.FindStringSubmatch(xmlText)
+	if len(m) < 2 {
+		return ""
+	}
+	u, err := KIDToUUID(m[1])
+	if err != nil {
+		return ""
+	}
+	return u
+}
+
+// XMLEscape escapes text for inclusion in an XML element body.
+func XMLEscape(s string) string {
+	var b strings.Builder
+	_ = xml.EscapeText(&b, []byte(s))
+	return b.String()
+}