@blockcast/mmt-base 0.4.0 → 0.4.1-main.2e0aa69d293d

package/src/multicast-catalog.ts

@@ -0,0 +1,350 @@
+/**
+ * The draft-ramadan-moq-multicast-01 endpoint and `auth` rules, written once
+ * for both sides of the catalog: `validateCmsfMmtpCatalog` in
+ * `@blockcast/mmt-container` throws the first issue, and the receivers in
+ * `@blockcast/mmt-transport` ignore every endpoint an issue names (all of
+ * them when the issue is catalog-level). It lives here because mmt-base is
+ * the only package both depend on.
+ *
+ * Draft: Blockcast/moqcast-draft@fd962fd73d21ed281b60219c11ea61cc9e4e91c4
+ * (PR #2 head; normative text equal to 3162ef93), sections 4.1 and 7.2.6.
+ */
+
+export type MulticastJoinMode = "ssm" | "asm";
+
+/** An endpoint's join mode and `S` (4.1): `sourceAddress` on SSM,
+ * `auth.senderAddress` on protected ASM, absent on unprotected ASM. */
+export interface MulticastEndpointSource {
+	mode: MulticastJoinMode;
+	source?: string;
+}
+
+export type MulticastCatalogIssueCode =
+	| "multicast_auth"
+	| "multicast_endpoint"
+	| "multicast_endpoint_auth"
+	| "multicast_track";
+
+export interface MulticastCatalogIssue {
+	code: MulticastCatalogIssueCode;
+	/** JSONPath of the offending field. */
+	path: string;
+	message: string;
+	/** Endpoint the issue makes a receiver ignore; absent for a catalog-level
+	 * issue, which leaves the receiver no endpoint at all (7.2.6). */
+	endpointIndex?: number;
+}
+
+/** Canonical unpadded base64url of exactly 32 octets. */
+export const ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
+
+const UINT32_MAX = 0xffff_ffff;
+const AUTH_MEMBERS = new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
+const KEY_MEMBERS = new Set(["kid", "publicKey", "firstEpoch"]);
+const ENDPOINT_AUTH_MEMBERS = new Set([
+	"manifestPort",
+	"streamId",
+	"senderAddress",
+	"maxAuthDelayMs",
+	"manifestTimerMs",
+	"manifestTrack",
+]);
+
+type JsonObject = Record<string, unknown>;
+
+function isObject(value: unknown): value is JsonObject {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isNonEmptyString(value: unknown): value is string {
+	return typeof value === "string" && value.trim().length > 0;
+}
+
+function isIntegerIn(value: unknown, min: number, max: number): value is number {
+	return Number.isSafeInteger(value) && (value as number) >= min && (value as number) <= max;
+}
+
+/**
+ * Join mode and `S` of one endpoint, or `undefined` when its fields disagree
+ * and a receiver must ignore it (4.1). `sourceAddress` alone selects the mode;
+ * `protocol` may only restate it, so "amt" and "atsc3" (draft -00) are
+ * inconsistent here: a bearer is a `networkSource`, never a protocol.
+ */
+export function multicastEndpointSource(endpoint: unknown): MulticastEndpointSource | undefined {
+	if (!isObject(endpoint)) return undefined;
+	const sourceAddress = endpoint["sourceAddress"];
+	if (sourceAddress !== undefined && !isNonEmptyString(sourceAddress)) return undefined;
+	const mode: MulticastJoinMode = sourceAddress === undefined ? "asm" : "ssm";
+	const protocol = endpoint["protocol"];
+	if (protocol !== undefined && protocol !== mode) return undefined;
+	const auth = endpoint["auth"];
+	const senderAddress = isObject(auth) ? auth["senderAddress"] : undefined;
+	if (mode === "ssm") return senderAddress === undefined ? { mode, source: sourceAddress as string } : undefined;
+	if (auth === undefined) return { mode };
+	return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : undefined;
+}
+
+function authIssues(auth: unknown): MulticastCatalogIssue[] {
+	const base = "$.multicast.auth";
+	const issue = (path: string, message: string): MulticastCatalogIssue[] => [
+		{ code: "multicast_auth", path: `${base}${path}`, message },
+	];
+	if (!isObject(auth)) return issue("", "auth must be an object");
+	const unknown = Object.keys(auth).filter(key => !AUTH_MEMBERS.has(key));
+	if (unknown.length > 0) {
+		return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
+	}
+	if (auth["scheme"] !== "bc-provenance") return issue(".scheme", 'scheme must be "bc-provenance"');
+	if (auth["version"] !== 2) return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
+	if (auth["sig"] !== "ed25519") return issue(".sig", 'sig must be "ed25519"');
+	const keys = auth["keys"];
+	if (!Array.isArray(keys) || keys.length < 1 || keys.length > 4) {
+		return issue(".keys", "keys must be an array of one to four {kid, publicKey, firstEpoch} objects");
+	}
+	const kids = new Set<number>();
+	const firstEpochs = new Set<number>();
+	for (let index = 0; index < keys.length; index++) {
+		const key = keys[index];
+		const at = `.keys[${index}]`;
+		if (!isObject(key) || Object.keys(key).some(member => !KEY_MEMBERS.has(member))) {
+			return issue(at, "a key is exactly {kid, publicKey, firstEpoch}");
+		}
+		if (!isIntegerIn(key["kid"], 0, UINT32_MAX)) return issue(`${at}.kid`, "kid must be an unsigned 32-bit integer");
+		if (typeof key["publicKey"] !== "string" || !ED25519_PUBLIC_KEY_BASE64URL.test(key["publicKey"])) {
+			return issue(`${at}.publicKey`, "publicKey must be a 32-octet Ed25519 key in canonical unpadded base64url");
+		}
+		if (!isIntegerIn(key["firstEpoch"], 0, UINT32_MAX)) {
+			return issue(`${at}.firstEpoch`, "firstEpoch must be an unsigned 32-bit integer");
+		}
+		// A repeated kid or firstEpoch leaves no key set (7.2.6): fail the whole
+		// block, never fall back to unauthenticated reception.
+		if (kids.has(key["kid"])) return issue(`${at}.kid`, `kid ${key["kid"]} is repeated; the catalog holds no key set`);
+		if (firstEpochs.has(key["firstEpoch"])) {
+			return issue(`${at}.firstEpoch`, `firstEpoch ${key["firstEpoch"]} is repeated; the catalog holds no key set`);
+		}
+		kids.add(key["kid"]);
+		firstEpochs.add(key["firstEpoch"]);
+	}
+	if (!isIntegerIn(auth["minEpoch"], 0, UINT32_MAX)) {
+		return issue(".minEpoch", "minEpoch must be an unsigned 32-bit integer");
+	}
+	return [];
+}
+
+function endpointAuthIssue(
+	endpoint: JsonObject,
+	mode: MulticastJoinMode,
+	at: string,
+): { path: string; message: string } | undefined {
+	const auth = endpoint["auth"];
+	if (!isObject(auth)) return { path: `${at}.auth`, message: "auth must be an object" };
+	const unknown = Object.keys(auth).filter(key => !ENDPOINT_AUTH_MEMBERS.has(key));
+	if (unknown.length > 0) return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
+	if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
+		return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
+	}
+	if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
+		return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
+	}
+	if (mode === "ssm" && auth["senderAddress"] !== undefined) {
+		return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
+	}
+	if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
+		return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
+	}
+	if (auth["maxAuthDelayMs"] !== undefined && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1000)) {
+		return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
+	}
+	if (auth["manifestTimerMs"] !== undefined && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
+		return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
+	}
+	if (auth["manifestTrack"] !== undefined && !isNonEmptyString(auth["manifestTrack"])) {
+		return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
+	}
+	if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
+		return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
+	}
+	return undefined;
+}
+
+/**
+ * Where a catalog object carries the namespace of the catalog track it was
+ * read from. A symbol, so it is never wire data and survives object spread;
+ * `Symbol.for`, so two bundled copies of this module agree on it.
+ */
+export const CATALOG_NAMESPACE: unique symbol = Symbol.for("@blockcast/mmt-base/catalogNamespace");
+
+/**
+ * `catalog` tagged with the namespace of its catalog track. Every receiver
+ * rule that takes the catalog (`multicastCatalogIssues`,
+ * `admittedMulticastEndpoints` and the transport selectors built on them)
+ * then judges the foreign-namespace rule against it, independent of track
+ * order. Tag once, where the catalog track is read.
+ */
+export function withCatalogNamespace<T extends object>(catalog: T, namespace: string): T {
+	return { ...catalog, [CATALOG_NAMESPACE]: namespace };
+}
+
+/**
+ * Every draft -01 4.1 / 7.2.6 violation in `catalog.multicast`, in document
+ * order. Packet-id, group-address and track-existence rules are not here; the
+ * container validator and the receivers already check those.
+ *
+ * `catalogNamespace` is the namespace of the catalog track, from `options` or else the
+ * catalog's `withCatalogNamespace` tag. Without it the
+ * foreign-namespace rule can only compare listed tracks with each other: the
+ * first listed track's namespace becomes the reference, so which side of a
+ * disagreement is dropped depends on order. It still fails closed; pass
+ * `catalogNamespace` wherever the catalog track is known.
+ */
+export function multicastCatalogIssues(
+	catalog: unknown,
+	options: { catalogNamespace?: string } = {},
+): MulticastCatalogIssue[] {
+	if (!isObject(catalog)) return [];
+	const issues: MulticastCatalogIssue[] = [];
+	if ("multicast.auth" in catalog) {
+		// Fail closed: a draft -00 publisher meant the flow to be protected, and
+		// the key it names verifies nothing in bc-provenance version 2.
+		issues.push({
+			code: "multicast_auth",
+			path: '$["multicast.auth"]',
+			message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)',
+		});
+	}
+	const multicast = catalog["multicast"];
+	if (!isObject(multicast)) return issues;
+	const protectedCatalog = multicast["auth"] !== undefined;
+	if (protectedCatalog) issues.push(...authIssues(multicast["auth"]));
+	const endpoints = multicast["endpoints"];
+	if (!Array.isArray(endpoints)) return issues;
+
+	const tracks = Array.isArray(catalog["tracks"]) ? catalog["tracks"] : [];
+	const namespaceOf = new Map<string, unknown>();
+	for (const track of tracks) {
+		if (isObject(track) && typeof track["name"] === "string") namespaceOf.set(track["name"], track["namespace"]);
+	}
+	const tagged = (catalog as { [CATALOG_NAMESPACE]?: unknown })[CATALOG_NAMESPACE];
+	let referenceNamespace = options.catalogNamespace ?? (typeof tagged === "string" ? tagged : undefined);
+
+	const sources: Array<MulticastEndpointSource | undefined> = [];
+	for (let index = 0; index < endpoints.length; index++) {
+		const endpoint = endpoints[index];
+		const at = `$.multicast.endpoints[${index}]`;
+		const fail = (code: MulticastCatalogIssueCode, path: string, message: string) => {
+			issues.push({ code, path, message, endpointIndex: index });
+		};
+		sources.push(undefined);
+		if (!isObject(endpoint)) {
+			fail("multicast_endpoint", at, "endpoint must be an object");
+			continue;
+		}
+		const protocol = endpoint["protocol"];
+		if (protocol !== undefined && protocol !== "ssm" && protocol !== "asm") {
+			fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
+			continue;
+		}
+		const hasAuth = endpoint["auth"] !== undefined;
+		if (protectedCatalog !== hasAuth) {
+			fail(
+				"multicast_endpoint_auth",
+				`${at}.auth`,
+				protectedCatalog
+					? "every endpoint requires auth when multicast carries auth; a receiver ignores this endpoint"
+					: "auth names no key without multicast.auth; a receiver ignores this endpoint",
+			);
+			continue;
+		}
+		const sourceAddress = endpoint["sourceAddress"];
+		if (sourceAddress !== undefined && !isNonEmptyString(sourceAddress)) {
+			fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
+			continue;
+		}
+		const mode: MulticastJoinMode = sourceAddress === undefined ? "asm" : "ssm";
+		if (protocol !== undefined && protocol !== mode) {
+			fail("multicast_endpoint", `${at}.protocol`, `protocol ${JSON.stringify(protocol)} disagrees with sourceAddress, which selects ${mode}`);
+			continue;
+		}
+		// The (S, G, port) rule below compares ports with ===, so only an
+		// integer may reach it: "5001" and 5001 would otherwise both pass.
+		if (!isIntegerIn(endpoint["port"], 1, 65535)) {
+			fail("multicast_endpoint", `${at}.port`, "port must be an integer from 1 to 65535");
+			continue;
+		}
+		if (hasAuth) {
+			const authIssue = endpointAuthIssue(endpoint, mode, at);
+			if (authIssue) {
+				fail("multicast_endpoint_auth", authIssue.path, authIssue.message);
+				continue;
+			}
+		}
+		sources[index] = multicastEndpointSource(endpoint);
+
+		const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
+		for (let refIndex = 0; refIndex < refs.length; refIndex++) {
+			const ref = refs[refIndex];
+			const name = isObject(ref) ? ref["name"] : ref;
+			if (typeof name !== "string") continue;
+			const namespace = namespaceOf.get(name);
+			if (typeof namespace !== "string") continue;
+			referenceNamespace ??= namespace;
+			if (namespace !== referenceNamespace) {
+				fail("multicast_track", `${at}.tracks[${refIndex}].name`, `track ${JSON.stringify(name)} declares namespace ${JSON.stringify(namespace)}, not the catalog track's ${JSON.stringify(referenceNamespace)}`);
+			}
+		}
+	}
+
+	// One endpoint object per (S, G, port), and a manifestPort that is no port
+	// and no other manifestPort of its (S, G) (4.1, 7.2.6). The rule binds the
+	// endpoint whose manifestPort clashes; two equal tuples or two equal
+	// manifestPorts break it on both sides, so both are named.
+	const tupleOf = (index: number) => {
+		const endpoint = endpoints[index] as JsonObject;
+		const auth = endpoint["auth"];
+		return {
+			sg: JSON.stringify([sources[index]!.source ?? null, endpoint["groupAddress"]]),
+			port: endpoint["port"],
+			manifestPort: isObject(auth) ? auth["manifestPort"] : undefined,
+		};
+	};
+	for (let index = 0; index < endpoints.length; index++) {
+		if (!sources[index]) continue;
+		const own = tupleOf(index);
+		const at = `$.multicast.endpoints[${index}]`;
+		if (own.manifestPort !== undefined && own.manifestPort === own.port) {
+			issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
+			continue;
+		}
+		for (let other = 0; other < endpoints.length; other++) {
+			if (other === index || !sources[other]) continue;
+			const peer = tupleOf(other);
+			if (peer.sg !== own.sg) continue;
+			if (peer.port === own.port) {
+				issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
+				break;
+			}
+			if (own.manifestPort !== undefined && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
+				issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
+				break;
+			}
+		}
+	}
+	return issues;
+}
+
+/**
+ * Indices of the endpoints a receiver may use: none when a catalog-level
+ * issue leaves it no key set (7.2.6), otherwise every endpoint no issue
+ * names. Other receiver checks (group address, packet ids) still apply.
+ */
+export function admittedMulticastEndpoints(
+	catalog: unknown,
+	options: { catalogNamespace?: string } = {},
+): ReadonlySet<number> {
+	const multicast = isObject(catalog) ? catalog["multicast"] : undefined;
+	const endpoints = isObject(multicast) && Array.isArray(multicast["endpoints"]) ? multicast["endpoints"] : [];
+	const issues = multicastCatalogIssues(catalog, options);
+	if (issues.some(issue => issue.endpointIndex === undefined)) return new Set();
+	const ignored = new Set(issues.map(issue => issue.endpointIndex));
+	return new Set(endpoints.map((_, index) => index).filter(index => !ignored.has(index)));
+}

package/src/signalling.ts

@@ -23,6 +23,8 @@
 import {
   ALFEC_MESSAGE_ID,
   FEC_CODE_RAPTORQ,
+  FEC_CODE_REED_SOLOMON,
+  MMTP_SIGNALING_PACKET_ID,
   PACKET_TYPE_SIGNALING,
   parseMMTPHeader,
   type MMTPHeader,
@@ -453,100 +455,112 @@ export function parseAlFecMessage(mmtpPacket: Uint8Array): AlFecMessage | null {
 }
 
 /**
- * Decoder geometry of one FEC flow under the Blockcast one-stage RaptorQ
- * profile: private_field = RaptorQ FEC OTI (RFC 6330 3.3.2-3.3.3, 12 bytes)
- * followed by the interleave depth (1 byte).
+ * Decoder geometry of one FEC flow's AL-FEC message entry under
+ * draft-ramadan-moq-mmt-01 Section 8.3 ("iso-ssbg1-v1"): one Asset, coding
+ * byte 0x14, fec_code_id_for_repair_flow 3 (RaptorQ) or 1 (Reed-Solomon),
+ * and no OTI (draft-ramadan-moq-mmt-01 Section 7.2). K, T and P come from
+ * the entry's own fields; a private field, if present, is ignored.
  */
 export interface AlFecRaptorQFlowConfig {
+  /** The flow's one Asset packet_id (number_of_assets is 1). */
   sourcePacketIds: number[]
   repairFlowId: number
+  /** `FEC_CODE_RAPTORQ` (3) or `FEC_CODE_REED_SOLOMON` (1). */
+  fecCodeId: number
   /** Always `SSBG_MODE_1` (`iso-ssbg1-v1`). */
   ssbgMode: number
-  /** The coding byte's low bit as signalled (see AlFecFlow.fecPayloadIdMode). */
+  /** Always 0: the profile's coding byte is exactly 0x14. */
   fecPayloadIdMode: 0 | 1
+  /** T, from length_of_repair_symbol. */
   repairSymbolSize: number
+  /** K, from maximum_k_for_repair_flow. */
   maximumK: number
+  /** P, from maximum_p_for_repair_flow: the RSB_length total over every published layer. */
   maximumP: number
-  interleaveDepth: number
-  oti: Uint8Array
   protectionWindowTime: number
   protectionWindowSize: number
 }
 
-const RAPTORQ_PRIVATE_FIELD_LENGTH = 13
 const RAPTORQ_MAX_SOURCE_SYMBOLS = 56_403
 const REPAIR_SYMBOL_ID_MAX = 0x00ff_ffff
-
-function canonicalRaptorQOtiK(oti: Uint8Array, repairSymbolSize: number): number | null {
-  if (oti.length !== 12 || oti[5] !== 0) return null
-  const transferLength = (oti[0]! * 0x1_0000_0000) +
-    (((oti[1]! << 24) | (oti[2]! << 16) | (oti[3]! << 8) | oti[4]!) >>> 0)
-  const symbolSize = (oti[6]! << 8) | oti[7]!
-  const sourceBlocks = oti[8]!
-  const subBlocks = (oti[9]! << 8) | oti[10]!
-  const alignment = oti[11]!
-  if (!Number.isSafeInteger(transferLength) || transferLength <= 0 ||
-      symbolSize !== repairSymbolSize || symbolSize === 0 || symbolSize % 8 !== 0 ||
-      sourceBlocks !== 1 || subBlocks !== 1 || alignment !== 8 ||
-      transferLength % symbolSize !== 0) {
-    return null
-  }
-  const k = transferLength / symbolSize
-  return Number.isInteger(k) && k >= 1 && k <= RAPTORQ_MAX_SOURCE_SYMBOLS ? k : null
-}
+/** The 12-octet MMTP header plus the 2-octet length of the T - 2 construction (moq-fec-01 Section 7.3). */
+const MIN_REPAIR_SYMBOL_SIZE = 14
+const REED_SOLOMON_MAX_BLOCK = 255
 
 /**
- * Validate one parsed FEC flow against the Blockcast one-stage RaptorQ
- * profile and return its decoder geometry, or null when the flow is outside
- * the profile. Nothing is inferred: K comes from the OTI and must equal
- * maximum_k_for_repair_flow.
+ * Validate one parsed FEC flow against draft-ramadan-moq-mmt-01 Sections 8.3
+ * and 12.2 and return its decoder geometry, or null when the entry is
+ * outside them. Fail closed on everything else:
+ *
+ * - coding byte other than 0x14 (one-stage, ssbg_mode1, ffsrpts_flag 0,
+ *   fec_payload_id_mode 0). 0x15 is fec_payload_id_mode 1 under Amd 1:2025,
+ *   which "iso-ssbg1-v1" does not describe (moq-fec-01 Section 7.3);
+ * - number_of_assets other than 1;
+ * - fec_code_id_for_repair_flow other than 3 or 1, the retired Blockcast
+ *   code 2 included (ISO/IEC 23008-10 Table 1);
+ * - T < 14, K = 0, P = 0, K + P - 1 > 2^24 - 1;
+ * - RaptorQ: T not a multiple of 8, or K > 56403;
+ * - Reed-Solomon: K + P > 255;
+ * - repair_flow_id 0 (the signalling flow) or the flow's own packet_id.
  *
- * The profile is `iso-ssbg1-v1`, whose AL-FEC coding byte is 0x14
- * (draft-ramadan-moq-fec §7.3; ISO/IEC 23008-1 Table C.3 as replaced by
- * Amd 1:2025): one-stage, ssbg_mode1, ffsrpts_flag 0, fec_payload_id_mode 0.
- * 0x15 is accepted too: its low bit is fec_payload_id_mode 1 under Amd
- * 1:2025 but reserved "1" in the unamended 2023 Table C.3, so a 2023 sender
- * of the same profile emits it. No later field depends on the bit, and each
- * source packet's FEC_type says whether it carries a Source FEC Payload ID,
- * so the bit is reported, not interpreted (BLO-35597 N1). Any other coding
- * byte is refused here, though `parseAlFecMessageBody` still reports it:
- * ssbg_mode0 (0x10/0x11, the retired `k-padded-v1` wire) carries no length
- * field; ffsrpts_flag=1 changes the source/repair packet trailer layout.
+ * Checks that span entries (another entry's packet_id, a duplicate
+ * repair_flow_id or Asset) are `alFecMessageFlowConfigs`'.
  */
 export function alFecRaptorQFlowConfig(flow: AlFecFlow): AlFecRaptorQFlowConfig | null {
   if (flow.fecCodingStructure !== FEC_CODING_STRUCTURE_ONE_STAGE || flow.repairFlows.length !== 1) return null
-  if (flow.ssbgMode !== SSBG_MODE_1) return null
-  if (flow.ffsrptsFlag !== 0) return null
+  if (flow.ssbgMode !== SSBG_MODE_1 || flow.ffsrptsFlag !== 0 || flow.fecPayloadIdMode !== 0) return null
+  if (flow.packetIds.length !== 1) return null
   const repair = flow.repairFlows[0]!
-  if (repair.fecCodeId !== FEC_CODE_RAPTORQ) return null
-  const privateField = repair.privateField
-  if (!privateField || privateField.privateFlag !== 1 ||
-      privateField.data.length !== RAPTORQ_PRIVATE_FIELD_LENGTH) {
-    return null
-  }
-  const oti = privateField.data.slice(0, 12)
-  const interleaveDepth = privateField.data[12]!
-  const otiK = canonicalRaptorQOtiK(oti, flow.repairSymbolSize)
-  if (otiK === null || interleaveDepth === 0) return null
-  if (repair.maximumK !== otiK || repair.maximumP === 0 ||
-      repair.maximumK + repair.maximumP - 1 > REPAIR_SYMBOL_ID_MAX) {
+  const { fecCodeId, maximumK: k, maximumP: p } = repair
+  const t = flow.repairSymbolSize
+  if (t < MIN_REPAIR_SYMBOL_SIZE || k < 1 || p < 1 || k + p - 1 > REPAIR_SYMBOL_ID_MAX) return null
+  if (fecCodeId === FEC_CODE_RAPTORQ) {
+    if (t % 8 !== 0 || k > RAPTORQ_MAX_SOURCE_SYMBOLS) return null
+  } else if (fecCodeId === FEC_CODE_REED_SOLOMON) {
+    if (k + p > REED_SOLOMON_MAX_BLOCK) return null
+  } else {
     return null
   }
+  if (repair.repairFlowId === MMTP_SIGNALING_PACKET_ID || repair.repairFlowId === flow.packetIds[0]) return null
   return {
     sourcePacketIds: [...flow.packetIds],
     repairFlowId: repair.repairFlowId,
+    fecCodeId,
     ssbgMode: flow.ssbgMode,
     fecPayloadIdMode: flow.fecPayloadIdMode,
-    repairSymbolSize: flow.repairSymbolSize,
-    maximumK: repair.maximumK,
-    maximumP: repair.maximumP,
-    interleaveDepth,
-    oti,
+    repairSymbolSize: t,
+    maximumK: k,
+    maximumP: p,
     protectionWindowTime: repair.protectionWindowTime,
     protectionWindowSize: repair.protectionWindowSize,
   }
 }
 
+/**
+ * `alFecRaptorQFlowConfig` for every entry of a message, index for index,
+ * plus the draft-ramadan-moq-mmt-01 Section 12.2 checks that span entries: an
+ * entry whose repair_flow_id is another entry's Asset packet_id, and every
+ * entry of two that name one repair_flow_id or list one Asset, is null.
+ */
+export function alFecMessageFlowConfigs(message: AlFecMessageBody): (AlFecRaptorQFlowConfig | null)[] {
+  const assetCount = new Map<number, number>()
+  const repairCount = new Map<number, number>()
+  const bump = (map: Map<number, number>, key: number) => map.set(key, (map.get(key) ?? 0) + 1)
+  for (const flow of message.flows) {
+    for (const id of flow.packetIds) bump(assetCount, id)
+    for (const repair of flow.repairFlows) bump(repairCount, repair.repairFlowId)
+  }
+  return message.flows.map(flow => {
+    const config = alFecRaptorQFlowConfig(flow)
+    if (!config) return null
+    const [asset] = config.sourcePacketIds
+    if (assetCount.get(asset!) !== 1 || repairCount.get(config.repairFlowId) !== 1) return null
+    // Its own packet_id is already refused, so any count here is another entry's.
+    if (assetCount.has(config.repairFlowId)) return null
+    return config
+  })
+}
+
 // ---------------------------------------------------------------------------
 // 10.6 — location, asset_id and identifier mapping
 // ---------------------------------------------------------------------------