@blockcast/mmt-container 0.3.0 → 0.4.0-main.1e94b11199ea

package/dist/fec-worker-setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../../fec-worker/src/fec-worker-client.ts", "../../fec-worker/src/shred-worker-client.ts", "../../fec-worker/src/index.ts", "../../mmt-alta-parse/src/index.ts", "../../mmt-base/src/mmtp.ts", "../../mmt-base/src/ntp-short.ts", "../../mmt-base/src/fec-block-profile.ts", "../src/fec-worker-setup.ts", "../src/track-session.ts"],
-  "sourcesContent": ["/**\n * @blockcast/fec-worker \u2014 Main-Thread Client\n *\n * Wraps one Worker per track instance. Provides typed API for the\n * FecWorkerCommand/FecWorkerEvent protocol with zero-copy ArrayBuffer transfers.\n *\n * Constructor accepts either a URL (creates Worker internally) or a pre-created\n * Worker instance (for testing via constructor injection).\n */\n\nimport type {\n\tFecWorkerCommand,\n\tFecSymbolCommand,\n\tFecWorkerEvent,\n\tFecTrackConfig,\n\tFecTrackStats,\n\tFecBlockSnapshot,\n\tFrameMeta,\n\tFecWorkerErrorCode,\n} from \"./fec-worker-types.js\";\n\nexport class FecWorkerClient {\n\treadonly #worker: Worker;\n\t#onFrame: ((data: ArrayBuffer, meta: FrameMeta) => void) | null = null;\n\t#onSnapshot: ((stats: FecTrackStats) => void) | null = null;\n\t#onBlockUpdate: ((block: FecBlockSnapshot) => void) | null = null;\n\t#onCleanupComplete: ((sbn: number) => void) | null = null;\n\t#onError: ((message: string, code?: FecWorkerErrorCode) => void) | null = null;\n\t#cleanupInFlight: Set<number> | null = null;\n\t#queuedCleanupSbns = new Set<number>();\n\t#pendingResets = 0;\n\t#resetFailed = false;\n\t#disposed = false;\n\t// Symbols fed during the current task, sent as one feedSymbols message\n\t// when the task's microtasks run (BLO-36599). A packet stream delivers many\n\t// symbols per task, and each postMessage is a structured-clone round trip\n\t// on the page thread; the batch boundary is the task, not a size or timer.\n\t#pendingSymbols: FecSymbolCommand[] = [];\n\t#pendingTransfer: Transferable[] = [];\n\t#flushQueued = false;\n\t// Batching starts only once the Worker announced it accepts feedSymbols.\n\t#batchSymbols = false;\n\t// The Worker posts blockUpdate events only to a client that subscribed,\n\t// which this client does once a callback is registered and the Worker\n\t// announced the command (BLO-36599).\n\t#blockUpdatesAnnounced = false;\n\t#blockUpdatesSubscribed = false;\n\n\t/**\n\t * Create a FecWorkerClient.\n\t * @param workerOrUrl - Either a Worker instance (for testing) or a URL to create one\n\t */\n\tconstructor(workerOrUrl: Worker | URL) {\n\t\tif (workerOrUrl instanceof URL) {\n\t\t\tthis.#worker = new Worker(workerOrUrl, { type: \"module\" });\n\t\t} else {\n\t\t\tthis.#worker = workerOrUrl;\n\t\t}\n\t\tthis.#worker.onmessage = (e: MessageEvent<FecWorkerEvent>) =>\n\t\t\tthis.#handleEvent(e.data);\n\t\tthis.#worker.onerror = (e) => {\n\t\t\tthis.#onError?.(formatWorkerError(e), \"worker-runtime\");\n\t\t};\n\t\tthis.#worker.onmessageerror = (e) => {\n\t\t\tthis.#onError?.(formatWorkerMessageError(e), \"worker-message\");\n\t\t};\n\t}\n\n\t/**\n\t * Configure the Worker with FEC parameters and WASM module.\n\t * wasmModule is transferred (not neutered \u2014 WebAssembly.Module is shareable).\n\t * altaPublicKey is PKCS#8 SPKI DER bytes (self-describing \u2014 algorithm detected from OID).\n\t *   Transferred (detached from sender).\n\t * altaWasmModule is structured-cloneable (NOT transferable \u2014 do not add to transfer list).\n\t */\n\tconfigure(\n\t\tconfig: FecTrackConfig,\n\t\twasmModule: WebAssembly.Module,\n\t\taltaPublicKey?: ArrayBuffer,\n\t\taltaWasmModule?: WebAssembly.Module,\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] disposed\");\n\t\tthis.#flushSymbols();\n\t\tconst cmd: FecWorkerCommand = {\n\t\t\ttype: \"configure\",\n\t\t\tconfig,\n\t\t\twasmModule,\n\t\t\taltaPublicKey,\n\t\t\taltaWasmModule,\n\t\t};\n\t\t// WebAssembly.Module is structured-cloneable, NOT transferable.\n\t\t// Pass it in the message body (Chrome clones it automatically).\n\t\t// Only ArrayBuffers (like altaPublicKey) go in the transfer list.\n\t\tconst transferList: Transferable[] = [];\n\t\tif (altaPublicKey) transferList.push(altaPublicKey);\n\t\t// altaWasmModule is structured-cloneable \u2014 NOT added to transferList\n\t\tthis.#worker.postMessage(cmd, transferList);\n\t}\n\n\t/**\n\t * Feed a source symbol to the Worker. data ArrayBuffer is transferred (zero-copy).\n\t * Caller must not access data after this call \u2014 it is transferred with the\n\t * task's symbol batch, before any later command of this client.\n\t *\n\t * Optional `alta` carries the detached ALTA authenticator bytes and the\n\t * byte offset in `data` where the signed payload ends. The auth buffer is\n\t * transferred zero-copy alongside `data`. Use {@link getMmtpAltaTrailer}\n\t * upstream (mmtp-router) to extract it from the wire packet.\n\t */\n\tfeedSource(\n\t\tssId: number,\n\t\tdata: ArrayBuffer,\n\t\tts: number,\n\t\talta?: { auth: ArrayBuffer; payloadEnd: number },\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] feedSource on a disposed client\");\n\t\tif (alta) {\n\t\t\tthis.#queueSymbol(\n\t\t\t\t{\n\t\t\t\t\ttype: \"feedSource\",\n\t\t\t\t\tssId,\n\t\t\t\t\tdata,\n\t\t\t\t\tts,\n\t\t\t\t\taltaAuth: alta.auth,\n\t\t\t\t\taltaPayloadEnd: alta.payloadEnd,\n\t\t\t\t},\n\t\t\t\tdata,\n\t\t\t\talta.auth,\n\t\t\t);\n\t\t} else {\n\t\t\tthis.#queueSymbol({ type: \"feedSource\", ssId, data, ts }, data);\n\t\t}\n\t}\n\n\t/**\n\t * Feed a repair symbol to the Worker. data ArrayBuffer is transferred (zero-copy).\n\t * Caller must not access data after this call \u2014 it is detached.\n\t *\n\t * Carries the wire-level Repair FEC Payload ID fields (ISO 23008-1 \u00A7C.5.3):\n\t * - ssStart:   SS_ID of first source symbol in the block (= SBN * configured K\n\t *              under `k-padded-v1`; any uint32, the block key, under `iso-ssbg1-v1`)\n\t * - ssbLength: authored source-symbol count (1..configured K)\n\t * - rsId:      repair symbol index within the block\n\t */\n\tfeedRepair(\n\t\tssStart: number,\n\t\tssbLength: number,\n\t\trsId: number,\n\t\tdata: ArrayBuffer,\n\t\tts: number,\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] feedRepair on a disposed client\");\n\t\tthis.#queueSymbol({ type: \"feedRepair\", ssStart, ssbLength, rsId, data, ts }, data);\n\t}\n\n\t#queueSymbol(symbol: FecSymbolCommand, data: ArrayBuffer, auth?: ArrayBuffer): void {\n\t\tif (!this.#batchSymbols) {\n\t\t\tthis.#worker.postMessage(symbol, auth ? [data, auth] : [data]);\n\t\t\treturn;\n\t\t}\n\t\tthis.#pendingSymbols.push(symbol);\n\t\tthis.#pendingTransfer.push(data);\n\t\tif (auth) this.#pendingTransfer.push(auth);\n\t\tif (this.#flushQueued) return;\n\t\tthis.#flushQueued = true;\n\t\tqueueMicrotask(() => {\n\t\t\tthis.#flushQueued = false;\n\t\t\tthis.#flushSymbols();\n\t\t});\n\t}\n\n\t/**\n\t * Send the symbols fed so far. Every other command calls this first, so a\n\t * cleanup barrier, reset or signature still follows all earlier symbols.\n\t */\n\t#flushSymbols(): void {\n\t\tif (this.#pendingSymbols.length === 0 || this.#disposed) return;\n\t\tconst symbols = this.#pendingSymbols;\n\t\tconst transfer = this.#pendingTransfer;\n\t\tthis.#pendingSymbols = [];\n\t\tthis.#pendingTransfer = [];\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"feedSymbols\", symbols } satisfies FecWorkerCommand,\n\t\t\ttransfer,\n\t\t);\n\t}\n\n\t/**\n\t * Submit relay block signature for verification. sig and hash are transferred.\n\t */\n\trelayBlockSig(sbn: number, sig: ArrayBuffer, hash: ArrayBuffer): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] relayBlockSig on a disposed client\");\n\t\tthis.#flushSymbols();\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"relayBlockSig\", sbn, sig, hash } satisfies FecWorkerCommand,\n\t\t\t[sig, hash],\n\t\t);\n\t}\n\n\t/**\n\t * Trigger cleanup after a block's inactivity deadline. `currentSbn` is the\n\t * block key: the SBN under `k-padded-v1`, the SS_Start under `iso-ssbg1-v1`.\n\t *\n\t * While one queue-drain barrier is in flight, later SBNs are coalesced into\n\t * the next command without losing their individual acknowledgement identity.\n\t */\n\tcleanup(currentSbn: number): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] cleanup on a disposed client\");\n\t\tif (\n\t\t\t!Number.isInteger(currentSbn) ||\n\t\t\tcurrentSbn < 0 ||\n\t\t\tcurrentSbn > 0xffff_ffff\n\t\t) {\n\t\t\tthrow new Error(\"[FecWorkerClient] cleanup: SBN must be a uint32\");\n\t\t}\n\t\tif (this.#cleanupInFlight) {\n\t\t\tthis.#queuedCleanupSbns.add(currentSbn);\n\t\t\treturn;\n\t\t}\n\t\tthis.#postCleanup(new Set([currentSbn]));\n\t}\n\n\t/** Reset this track's decoder epoch while preserving Worker configuration. */\n\treset(): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] reset on a disposed client\");\n\t\tthis.#flushSymbols();\n\t\tthis.#pendingResets++;\n\t\tthis.#cleanupInFlight = null;\n\t\tthis.#queuedCleanupSbns.clear();\n\t\tthis.#worker.postMessage({ type: \"reset\" } satisfies FecWorkerCommand);\n\t}\n\n\t#postCleanup(sbns: Set<number>): void {\n\t\t// The cleanup is a queue-drain barrier: every symbol fed before it is\n\t\t// posted must reach the Worker first.\n\t\tthis.#flushSymbols();\n\t\tthis.#cleanupInFlight = sbns;\n\t\tconst orderedSbns = [...sbns].sort((a, b) => a - b);\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"cleanup\", sbns: orderedSbns } satisfies FecWorkerCommand,\n\t\t);\n\t}\n\n\t/** Register callback for decoded/recovered frames (FEC-03). */\n\tonFrame(cb: (data: ArrayBuffer, meta: FrameMeta) => void): void {\n\t\tthis.#onFrame = cb;\n\t}\n\n\t/** Register callback for periodic stats snapshots (FEC-04). */\n\tonSnapshot(cb: (stats: FecTrackStats) => void): void {\n\t\tthis.#onSnapshot = cb;\n\t}\n\n\t/**\n\t * Register callback for individual block state changes. The Worker posts\n\t * them only once asked, so registering subscribes (after the Worker\n\t * announces `subscribeBlockUpdates`). An older Worker that does not\n\t * announce it posts them unasked.\n\t */\n\tonBlockUpdate(cb: (block: FecBlockSnapshot) => void): void {\n\t\tthis.#onBlockUpdate = cb;\n\t\tthis.#subscribeBlockUpdates();\n\t}\n\n\t#subscribeBlockUpdates(): void {\n\t\tif (\n\t\t\tthis.#disposed ||\n\t\t\tthis.#blockUpdatesSubscribed ||\n\t\t\t!this.#blockUpdatesAnnounced ||\n\t\t\t!this.#onBlockUpdate\n\t\t) return;\n\t\tthis.#blockUpdatesSubscribed = true;\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"subscribeBlockUpdates\" } satisfies FecWorkerCommand,\n\t\t);\n\t}\n\n\t/** Register callback fired after the Worker drains all commands queued before cleanup. */\n\tonCleanupComplete(cb: (sbn: number) => void): void {\n\t\tthis.#onCleanupComplete = cb;\n\t}\n\n\t/** Register callback for Worker errors. */\n\tonError(cb: (message: string, code?: FecWorkerErrorCode) => void): void {\n\t\tthis.#onError = cb;\n\t}\n\n\t/**\n\t * True once dispose() ran. A disposed client cannot decode, fill, or\n\t * acknowledge anything, so routing symbols to it discards them; every\n\t * command method (feedSource, feedRepair, relayBlockSig, cleanup, reset)\n\t * throws rather than pretend otherwise. Callers check this first.\n\t */\n\tget disposed(): boolean {\n\t\treturn this.#disposed;\n\t}\n\n\t/**\n\t * Dispose the Worker. Sends dispose command then terminates.\n\t * Idempotent \u2014 safe to call multiple times.\n\t */\n\tdispose(): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#disposed = true;\n\t\t// A terminated Worker decodes nothing; symbols still batched are dropped.\n\t\tthis.#pendingSymbols = [];\n\t\tthis.#pendingTransfer = [];\n\t\tthis.#cleanupInFlight = null;\n\t\tthis.#queuedCleanupSbns.clear();\n\t\tthis.#worker.postMessage({ type: \"dispose\" } satisfies FecWorkerCommand);\n\t\tthis.#worker.terminate();\n\t}\n\n\t#handleEvent(event: FecWorkerEvent): void {\n\t\tif (event.type === \"capabilities\") {\n\t\t\tif (Array.isArray(event.commands) && event.commands.includes(\"feedSymbols\")) {\n\t\t\t\tthis.#batchSymbols = true;\n\t\t\t}\n\t\t\tif (Array.isArray(event.commands) && event.commands.includes(\"subscribeBlockUpdates\")) {\n\t\t\t\tthis.#blockUpdatesAnnounced = true;\n\t\t\t\tthis.#subscribeBlockUpdates();\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (event.type === \"resetComplete\") {\n\t\t\tthis.#pendingResets = Math.max(0, this.#pendingResets - 1);\n\t\t\tthis.#resetFailed = false;\n\t\t\treturn;\n\t\t}\n\t\tif (event.type === \"error\") {\n\t\t\tif (event.code === \"reset-failed\") {\n\t\t\t\tthis.#pendingResets = Math.max(0, this.#pendingResets - 1);\n\t\t\t\tthis.#resetFailed = true;\n\t\t\t}\n\t\t\tif (event.code) this.#onError?.(event.message, event.code);\n\t\t\telse this.#onError?.(event.message);\n\t\t\treturn;\n\t\t}\n\t\tif (this.#pendingResets > 0 || this.#resetFailed) return;\n\t\tswitch (event.type) {\n\t\t\tcase \"frame\":\n\t\t\t\tthis.#onFrame?.(event.data, event.meta);\n\t\t\t\tbreak;\n\t\t\tcase \"snapshot\":\n\t\t\t\tthis.#onSnapshot?.(event.stats);\n\t\t\t\tbreak;\n\t\t\tcase \"blockUpdate\":\n\t\t\t\tthis.#onBlockUpdate?.(event.block);\n\t\t\t\tbreak;\n\t\t\tcase \"cleanupComplete\":\n\t\t\t\tfor (const sbn of event.sbns) {\n\t\t\t\t\tthis.#onCleanupComplete?.(sbn);\n\t\t\t\t}\n\t\t\t\tthis.#cleanupInFlight = null;\n\t\t\t\tif (this.#queuedCleanupSbns.size > 0) {\n\t\t\t\t\tconst next = this.#queuedCleanupSbns;\n\t\t\t\t\tthis.#queuedCleanupSbns = new Set();\n\t\t\t\t\tthis.#postCleanup(next);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nfunction formatWorkerError(event: ErrorEvent): string {\n\tconst parts = [\"Worker error\"];\n\tif (event.message) parts.push(event.message);\n\tif (event.filename) {\n\t\tconst location = [event.filename];\n\t\tif (event.lineno) location.push(String(event.lineno));\n\t\tif (event.colno) location.push(String(event.colno));\n\t\tparts.push(`at ${location.join(\":\")}`);\n\t}\n\tif (event.error instanceof Error) {\n\t\tif (event.error.message && event.error.message !== event.message) {\n\t\t\tparts.push(event.error.message);\n\t\t}\n\t\tif (event.error.stack) parts.push(event.error.stack);\n\t} else if (event.error != null) {\n\t\tparts.push(String(event.error));\n\t}\n\treturn parts.join(\": \");\n}\n\nfunction formatWorkerMessageError(event: MessageEvent): string {\n\tconst data = event.data;\n\tconst detail =\n\t\tdata == null ? \"\" :\n\t\t\tdata instanceof Error ? `: ${data.message}` :\n\t\t\t\t`: ${Object.prototype.toString.call(data)}`;\n\treturn `Worker messageerror: failed to deserialize worker message${detail}`;\n}\n", "/**\n * @blockcast/fec-worker \u2014 Shred Worker Main-Thread Client\n *\n * Thin wrapper over the shred (Reed-Solomon) worker, mirroring\n * {@link FecWorkerClient}'s shape. Spawns one Worker, speaks the\n * {@link ShredWorkerCommand}/{@link ShredWorkerEvent} protocol, and keeps the\n * datagram read loop + wire parse + WASM FEC off the main thread.\n *\n * Typical wiring for a WebTransport datagram source (fully off-thread):\n *\n *   const client = new ShredWorkerClient(new URL(\"./shred-fec-worker.js\", import.meta.url));\n *   client.onRecovered((data, meta) => renderRecoveredSet(data, meta));\n *   client.configure({ maxSlots: 5000, symbolSize: 512, wasmUrl: \"/vendor/fec/mmt_wasm.js\" });\n *   client.attachStream(wt.datagrams.readable); // transferred; main does no read() per packet\n *\n * For sources that demux on the main thread (moqtail OBJECT_DATAGRAM callback,\n * IWA multicast bridge), push each raw frame with {@link feedShred} instead.\n *\n * {@link feedShred} is a fire-and-forget `postMessage` with no native\n * backpressure, so a consumer that decodes slower than the ingest rate (a\n * backgrounded/throttled tab, WASM RS falling behind a ~4k shred/s feed) would\n * grow the worker's inbound message queue without limit \u2014 the queue lives in the\n * renderer process and has been observed to reach multiple GB, GC-thrashing the\n * page into a wedge. The client bounds it with an in-flight window keyed off the\n * worker's own periodic stats heartbeat (no per-frame ack round-trip); see\n * {@link ShredWorkerClientOptions.maxInflight}.\n */\n\nimport type {\n\tShredWorkerCommand,\n\tShredWorkerConfig,\n\tShredWorkerEvent,\n\tShredWorkerStats,\n\tShredWorkerErrorCode,\n\tRecoveredMeta,\n} from \"./shred-worker-types.js\";\n\n/** Construction-time options for {@link ShredWorkerClient}. */\nexport interface ShredWorkerClientOptions {\n\t/**\n\t * Cap on frames posted via {@link ShredWorkerClient.feedShred} but not yet\n\t * drained by the worker, before further frames are dropped (\"skip-to-live\" at\n\t * the worker boundary). Bounds the worker's inbound message queue \u2014 the sole\n\t * unbounded structure on the main-thread-demux (`feedShred`) path.\n\t *\n\t * The drain signal is the worker's periodic `stats` heartbeat: the monotonic\n\t * total of frames it has taken off the queue (`shredsRx + malformed +\n\t * versionMismatch`). No per-frame acknowledgement crosses the boundary, so the\n\t * bound is heartbeat-granular \u2014 size it above one heartbeat's worth of ingest\n\t * (default 250ms heartbeat \u00D7 ~4k frames/s \u2248 ~1k frames).\n\t *\n\t * Default {@link DEFAULT_MAX_INFLIGHT} (8192 frames \u2248 ~10 MB at ~1.3 KB/frame).\n\t * Set to `0` (or any value `<= 0`) to disable the bound entirely \u2014 only do so\n\t * for a source with its own backpressure (e.g. a bounded {@link\n\t * ShredWorkerClient.attachStream} producer). Note the bound assumes `feedShred`\n\t * is the sole ingest path; mixing it with `attachStream` (whose frames also\n\t * advance the heartbeat total) makes the window under-count and benignly\n\t * disables the drop.\n\t */\n\tmaxInflight?: number;\n}\n\n/** Default {@link ShredWorkerClientOptions.maxInflight} (~10 MB of queued frames). */\nexport const DEFAULT_MAX_INFLIGHT = 8192;\n\nexport class ShredWorkerClient {\n\treadonly #worker: Worker;\n\t#onRecovered: ((data: ArrayBuffer, meta: RecoveredMeta) => void) | null = null;\n\t#onStats: ((stats: ShredWorkerStats) => void) | null = null;\n\t#onError: ((message: string, code?: ShredWorkerErrorCode) => void) | null = null;\n\t#disposed = false;\n\n\t/** feedShred in-flight backpressure accounting (see ShredWorkerClientOptions.maxInflight). */\n\treadonly #maxInflight: number;\n\t#sent = 0; // frames posted via feedShred (monotonic)\n\t#processed = 0; // worker-consumed total from the last stats heartbeat (monotonic)\n\t#droppedBackpressure = 0; // frames dropped by the in-flight guard (monotonic)\n\n\t/**\n\t * @param workerOrUrl - A URL (a Worker is created internally, `type: module`)\n\t *   or a pre-created Worker (for testing via constructor injection).\n\t * @param opts - Optional {@link ShredWorkerClientOptions}.\n\t */\n\tconstructor(workerOrUrl: Worker | URL, opts: ShredWorkerClientOptions = {}) {\n\t\tthis.#maxInflight = opts.maxInflight ?? DEFAULT_MAX_INFLIGHT;\n\t\tthis.#worker =\n\t\t\tworkerOrUrl instanceof URL\n\t\t\t\t? new Worker(workerOrUrl, { type: \"module\" })\n\t\t\t\t: workerOrUrl;\n\t\tthis.#worker.onmessage = (e: MessageEvent<ShredWorkerEvent>) =>\n\t\t\tthis.#handleEvent(e.data);\n\t\tthis.#worker.onerror = (e) =>\n\t\t\tthis.#onError?.(formatWorkerError(e), \"worker-runtime\");\n\t\tthis.#worker.onmessageerror = () =>\n\t\t\tthis.#onError?.(\"failed to deserialize worker message\", \"worker-message\");\n\t}\n\n\t/** Configure the decoder (WASM load + ShredFecBuffer construction happen in the worker). */\n\tconfigure(config: ShredWorkerConfig): void {\n\t\tif (this.#disposed) throw new Error(\"[ShredWorkerClient] disposed\");\n\t\tthis.#post({ type: \"configure\", config });\n\t}\n\n\t/**\n\t * Hand the worker a stream of raw shred frames to batch-drain. The stream is\n\t * transferred \u2014 the caller must not use it afterward. One active stream at a\n\t * time; attaching a new one cancels the previous.\n\t */\n\tattachStream(readable: ReadableStream<Uint8Array>): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#post({ type: \"attachStream\", readable }, [readable]);\n\t}\n\n\t/**\n\t * Feed one already-demuxed raw shred frame. `frame` is transferred zero-copy;\n\t * the caller must not access it afterward.\n\t *\n\t * Dropped (frame NOT transferred, so the caller's buffer stays intact) when the\n\t * in-flight window is full \u2014 i.e. the worker is more than `maxInflight` frames\n\t * behind. This is the memory bound: a slow/wedged consumer costs bounded\n\t * skip-to-live drops (see {@link droppedBackpressure}), never an unbounded\n\t * renderer-heap blow-up.\n\t */\n\tfeedShred(frame: ArrayBuffer): void {\n\t\tif (this.#disposed) return;\n\t\tif (this.#maxInflight > 0 && this.#sent - this.#processed >= this.#maxInflight) {\n\t\t\tthis.#droppedBackpressure++;\n\t\t\treturn;\n\t\t}\n\t\tthis.#sent++;\n\t\tthis.#post({ type: \"feedShred\", frame }, [frame]);\n\t}\n\n\t/** Explicitly drive loss recovery (in addition to the worker's internal timer). */\n\trecoverAll(nowMs: number = Date.now()): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#post({ type: \"recoverAll\", nowMs });\n\t}\n\n\t/** Register callback for recovered/completed FEC sets. `data` is a transferred buffer. */\n\tonRecovered(cb: (data: ArrayBuffer, meta: RecoveredMeta) => void): void {\n\t\tthis.#onRecovered = cb;\n\t}\n\n\t/** Register callback for the coalesced stats heartbeat. */\n\tonStats(cb: (stats: ShredWorkerStats) => void): void {\n\t\tthis.#onStats = cb;\n\t}\n\n\t/** Register callback for worker errors. */\n\tonError(cb: (message: string, code?: ShredWorkerErrorCode) => void): void {\n\t\tthis.#onError = cb;\n\t}\n\n\t/**\n\t * Frames dropped by the in-flight backpressure guard since construction\n\t * (monotonic). Surface this in the UI so sustained loss is visible rather than\n\t * silent \u2014 a rising counter means the consumer can't keep pace with ingest.\n\t */\n\tget droppedBackpressure(): number {\n\t\treturn this.#droppedBackpressure;\n\t}\n\n\t/**\n\t * Frames posted via {@link feedShred} but not yet reported drained by the\n\t * worker's last stats heartbeat (best-effort, heartbeat-granular; never < 0).\n\t */\n\tget inflight(): number {\n\t\treturn Math.max(0, this.#sent - this.#processed);\n\t}\n\n\t/** Dispose the worker. Idempotent. */\n\tdispose(): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#disposed = true;\n\t\ttry {\n\t\t\tthis.#worker.postMessage({ type: \"dispose\" } satisfies ShredWorkerCommand);\n\t\t} catch {\n\t\t\t/* worker may already be gone */\n\t\t}\n\t\tthis.#worker.terminate();\n\t}\n\n\t#post(cmd: ShredWorkerCommand, transfer: Transferable[] = []): void {\n\t\tthis.#worker.postMessage(cmd, transfer);\n\t}\n\n\t#handleEvent(event: ShredWorkerEvent): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"recovered\":\n\t\t\t\tthis.#onRecovered?.(event.data, event.meta);\n\t\t\t\tbreak;\n\t\t\tcase \"stats\":\n\t\t\t\t// The worker's monotonic consumed-frame total is the drain signal for\n\t\t\t\t// the feedShred in-flight guard. shredsRx counts only valid frames;\n\t\t\t\t// malformed + versionMismatch are consumed off the queue too, so the\n\t\t\t\t// sum is the true \"frames taken off the queue\" and keeps the window\n\t\t\t\t// from inflating (and false-dropping) on a malformed/skewed source.\n\t\t\t\tthis.#processed =\n\t\t\t\t\tevent.stats.shredsRx + event.stats.malformed + event.stats.versionMismatch;\n\t\t\t\tthis.#onStats?.(event.stats);\n\t\t\t\tbreak;\n\t\t\tcase \"error\":\n\t\t\t\tif (event.code) this.#onError?.(event.message, event.code);\n\t\t\t\telse this.#onError?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nfunction formatWorkerError(event: ErrorEvent): string {\n\tconst parts = [\"Worker error\"];\n\tif (event.message) parts.push(event.message);\n\tif (event.filename) {\n\t\tconst loc = [event.filename];\n\t\tif (event.lineno) loc.push(String(event.lineno));\n\t\tif (event.colno) loc.push(String(event.colno));\n\t\tparts.push(`at ${loc.join(\":\")}`);\n\t}\n\tif (event.error instanceof Error && event.error.stack) parts.push(event.error.stack);\n\treturn parts.join(\": \");\n}\n", "/**\n * @blockcast/fec-worker \u2014 Worker-per-track FEC decode with zero-copy transfers\n *\n * Re-exports shared types and main-thread client.\n */\n\nexport type {\n\tFecWorkerCommand,\n\tFecSymbolCommand,\n\tFecWorkerOptionalCommand,\n\tFecWorkerEvent,\n\tFecWorkerErrorCode,\n\tFecBlockProfile,\n\tFecTrackConfig,\n\tFecTrackStats,\n\tFecBlockSnapshot,\n\tFrameMeta,\n} from \"./fec-worker-types.js\";\n\nexport { FecWorkerClient } from \"./fec-worker-client.js\";\n\n// --- Shred (Reed-Solomon) codec \u2014 sibling to the RaptorQ/MMTP worker above.\n// Different FEC payload identity (slot/fecSet/localIndex vs flat ssId) \u2192 its\n// own command shape and worker; shares the transfer + client/worker pattern.\nexport type {\n\tShredWorkerCommand,\n\tShredWorkerEvent,\n\tShredWorkerConfig,\n\tShredWorkerStats,\n\tShredWorkerErrorCode,\n\tRecoveredMeta,\n\tSlotSample,\n} from \"./shred-worker-types.js\";\n\nexport { ShredWorkerClient } from \"./shred-worker-client.js\";\n", "/**\n * Zero-dependency helper for extracting the detached ALTA authenticator trailer\n * from an MMTP source packet.\n *\n * Lives in its own leaf package so both `@blockcast/mmt-container` (wire-path\n * parsing) and `@blockcast/fec-worker` (FEC-recovered-source parsing) can share\n * one implementation without creating a package cycle between them.\n *\n * Spec: ISO/IEC 23008-1:2023 + draft-ramadan-moq-mmt \u00A712 (detached trailer, Path 2).\n */\n\n// --- Private MMTP/MPU/MFU constants (ISO/IEC 23008-1 \u00A79.2.2\u20139.2.3) ---\n// Duplicated here as immutable spec values so this package stays a leaf with\n// zero `@blockcast/*` dependencies. Re-deriving from `mmt-container` would\n// reintroduce the package cycle this split exists to avoid.\n\nconst MMTP_HEADER_SIZE = 12\nconst MPU_HEADER_SIZE = 8\nconst MPU_LENGTH_FIELD_SIZE = 2\nconst MPU_HEADER_REMAINDER_SIZE = MPU_HEADER_SIZE - MPU_LENGTH_FIELD_SIZE\nconst TIMED_MFU_DU_HEADER_SIZE = 14\nconst NONTIMED_MFU_DU_HEADER_SIZE = 4\nconst PACKET_TYPE_MPU = 0x00\n\n// --- Public ALTA trailer constants ---\n\n/**\n * MMTP header-extension ext_type assigned to the detached ALTA authenticator\n * trailer (Path 2 / 08-07). Carried in an `[ext_type][ext_length][auth]`\n * block appended after the MPU's declared payload bytes, before the 4-byte\n * Source FEC Payload ID. MMTP X-bit stays 0 \u2014 non-ALTA MMTP receivers treat\n * the trailer as bytes past `payload_length` and skip it (per ISO 23008-1\n * \u00A79.2.2 \"may be discarded without impacting correct processing\").\n */\nexport const MMTP_EXT_TYPE_ALTA_AUTH = 0xf0a1\n\n/** Fixed size of the trailer's `[ext_type][ext_length]` prefix (2 + 2 BE). */\nexport const MMTP_EXT_TRAILER_HEADER_SIZE = 4\n\n/** Result of extracting the detached ALTA authenticator from an MMTP packet. */\nexport interface AltaTrailer {\n  /** Authenticator bytes (no ext_type/ext_length prefix, no trailing padding). */\n  auth: Uint8Array\n  /**\n   * Wire-packet byte offset where the signed payload ends, i.e. where the\n   * trailer begins. Caller uses this to produce\n   * `payload = wirePacket.subarray(0, signedEnd)` for verify_detached.\n   */\n  signedEnd: number\n}\n\n/**\n * Extract the detached ALTA authenticator trailer from an MMTP source packet.\n *\n * Wire layout:\n *   `[MMTP hdr][length(2)][remaining MPU hdr(6)][DU?][media][TRAILER][SS_ID?]`\n *   `payload_length = 6 + DU bytes + media bytes`\n *\n * Returns `null` when:\n * - the packet is too small / malformed,\n * - `payload_length` cannot contain the remaining six MPU-header bytes,\n * - the declared payload overruns the packet,\n * - no bytes remain between `payload_length` and the SS_ID,\n * - the trailer's `ext_type` isn't {@link MMTP_EXT_TYPE_ALTA_AUTH},\n * - the declared `ext_length` would extend past the SS_ID boundary.\n *\n * Non-MPU packets (repair, signaling) always return `null`.\n *\n * @param options.skipFecId When true, do NOT reserve 4 trailing bytes for the\n *   Source FEC Payload ID. Use on FEC-recovered symbols where the PID has\n *   already been stripped upstream.\n */\nexport function extractAltaTrailer(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n): AltaTrailer | null {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) return null\n  // ISO/IEC 23008-1:2023 Figure 8 places V=0 packet_type in the low six bits.\n  const packetType = mmtpPacket[1]! & 0x3f\n  if (packetType !== PACKET_TYPE_MPU) return null\n\n  const fecType = (mmtpPacket[0]! >> 3) & 0x03\n  let headerLength = MMTP_HEADER_SIZE\n  if (fecType < 2 && (mmtpPacket[0]! & 0x20) !== 0) headerLength += 4\n  if (fecType < 2 && (mmtpPacket[0]! & 0x02) !== 0) {\n    if (headerLength + 4 > mmtpPacket.length) return null\n    const extensionLength = new DataView(\n      mmtpPacket.buffer,\n      mmtpPacket.byteOffset + headerLength + 2,\n      2,\n    ).getUint16(0, false)\n    headerLength += 4 + extensionLength\n  }\n  if (headerLength + MPU_HEADER_SIZE > mmtpPacket.length) return null\n\n  const payload = mmtpPacket.subarray(headerLength)\n\n  // Inline a minimal MPU-header read \u2014 only the fields extractAltaTrailer needs.\n  // payloadLength: 16 BE at bytes 0-1.\n  // Byte 2 packs FT(4) | T(1) | FI(2) | A(1).\n  const payloadLength = (payload[0]! << 8) | payload[1]!\n  const flagsByte = payload[2]!\n  const fragmentType = (flagsByte >> 4) & 0x0f\n  const timed = ((flagsByte >> 3) & 0x01) === 1\n  const fragmentationIndicator = (flagsByte >> 1) & 0x03\n\n  // Only MFU packets (FT=2) carry the detached trailer.\n  if (fragmentType !== 2) return null\n\n  // FI=0/1 structurally carries a DU header; FI=2/3 does not. Require at\n  // least one media byte after that deterministic layout so the bytes at the\n  // declared boundary cannot impersonate ALTA for a header-only fragment.\n  const dataUnitHeaderSize = fragmentationIndicator <= 1\n    ? (timed ? TIMED_MFU_DU_HEADER_SIZE : NONTIMED_MFU_DU_HEADER_SIZE)\n    : 0\n  if (payloadLength <= MPU_HEADER_REMAINDER_SIZE + dataUnitHeaderSize) return null\n\n  if (fecType > 1) return null\n  const hasFecId = !options?.skipFecId && fecType === 1\n  const payloadEnd = hasFecId ? payload.length - 4 : payload.length\n  const declaredEnd = MPU_LENGTH_FIELD_SIZE + payloadLength\n  if (declaredEnd > payloadEnd) return null\n\n  if (declaredEnd + MMTP_EXT_TRAILER_HEADER_SIZE > payloadEnd) return null\n  const extType = (payload[declaredEnd]! << 8) | payload[declaredEnd + 1]!\n  if (extType !== MMTP_EXT_TYPE_ALTA_AUTH) return null\n  const extLen = (payload[declaredEnd + 2]! << 8) | payload[declaredEnd + 3]!\n\n  const authStart = declaredEnd + MMTP_EXT_TRAILER_HEADER_SIZE\n  if (authStart + extLen !== payloadEnd) return null\n\n  return {\n    auth: payload.subarray(authStart, payloadEnd),\n    signedEnd: headerLength + declaredEnd,\n  }\n}\n", "import {\n  MMTP_EXT_TYPE_ALTA_AUTH as _LEAF_MMTP_EXT_TYPE_ALTA_AUTH,\n  MMTP_EXT_TRAILER_HEADER_SIZE as _LEAF_MMTP_EXT_TRAILER_HEADER_SIZE,\n  extractAltaTrailer as _leafExtractAltaTrailer,\n  type AltaTrailer as _LeafAltaTrailer,\n} from '@blockcast/mmt-alta-parse'\n\n/**\n * @mmt/container - MMTP Parser\n *\n * MMTP (MMT Protocol) packet parser based on ISO/IEC 23008-1:2023 Section 9.2\n *\n * MMTP header format (12 bytes):\n * - Byte 0: V(2) | C(1) | FEC_type(2) | r(1) | X(1) | R(1)\n * - Byte 1: reserved(2) | packet_type(6)\n * - Bytes 2-3: packet_id (big-endian)\n * - Bytes 4-7: timestamp (big-endian, 32-bit)\n * - Bytes 8-11: sequence_number (big-endian)\n *\n * FEC_type values:\n * - 0: No FEC / source packet\n * - 1: FEC mode 0 (source with FEC payload ID)\n * - 2: FEC repair packet mode 0\n * - 3: FEC repair packet mode 1\n *\n * @packageDocumentation\n */\n\nexport interface MMTPHeader {\n  version: number\n  /** Packet type: 0x00=MPU, 0x02=Signaling, 0x03=Repair */\n  packetType: number\n  packetId: number\n  timestamp: bigint\n  sequenceNumber: number\n  payloadLength: number\n  fecType: number\n  /** C flag: header carries a 32-bit packet_counter. */\n  packetCounterFlag: boolean\n  packetCounter?: number\n  /** X flag: header carries an extension header and value. */\n  extensionFlag: boolean\n  extension?: { type: number; data: Uint8Array }\n  /** Byte offset at which the MMTP payload begins. */\n  headerLength: number\n  /** Random Access Point flag - indicates keyframe (ISO 23008-1, byte 0 bit 0) */\n  rapFlag: boolean\n}\n\nexport interface MPUHeader {\n  mpuSequenceNumber: number\n  fragmentationIndicator: number // FI: 0=complete, 1=first, 2=middle, 3=last\n  /** 8-bit MPU fragment_counter from byte 3. */\n  fragmentCounter: number\n  /** T flag: 1=timed media (14-byte MFU DU header), 0=non-timed (4-byte header) */\n  timedFlag: number\n  /** A flag: aggregated MPU payload. This strict profile requires A=0. */\n  aggregationFlag: boolean\n  /** MPU payload_length (bytes 0-1): bytes after the length field, including\n   *  the remaining six MPU-header bytes and all data-unit bytes. */\n  payloadLength: number\n}\n\nexport interface MFUDuHeader {\n  movieFragmentSequenceNumber: number\n  sampleNumber: number\n  offset: number\n  priority: number\n  dependencyCounter: number\n}\n\nexport interface MMTPPacket {\n  header: MMTPHeader\n  payload: Uint8Array\n}\n\nexport const MMTP_HEADER_SIZE = 12\nexport const MPU_HEADER_SIZE = 8\nexport const MFU_DU_HEADER_SIZE_TIMED = 14    // T=1: timed media (video/audio samples)\nexport const MFU_DU_HEADER_SIZE_NONTIMED = 4  // T=0: non-timed media (item_id only)\n\nconst MPU_LENGTH_FIELD_SIZE = 2\nconst MPU_HEADER_REMAINDER_SIZE = MPU_HEADER_SIZE - MPU_LENGTH_FIELD_SIZE\nconst SOURCE_FEC_PAYLOAD_ID_SIZE = 4\n\n// MMTP Packet Types (ISO/IEC 23008-1:2023 Section 9.2.2)\nexport const PACKET_TYPE_MPU = 0x00\nexport const PACKET_TYPE_SIGNALING = 0x02\nexport const PACKET_TYPE_REPAIR = 0x03\n\n// AL-FEC Signaling Message ID (ISO/IEC 23008-1:2023 Amendment 1:2025)\nexport const ALFEC_MESSAGE_ID = 0x0203\n\n/**\n * MMTP `packet_id` of the signaling flow, which carries PACKET_TYPE_SIGNALING\n * packets such as the AL-FEC message (ALFEC_MESSAGE_ID). The FFmpeg `moq_mmt`\n * muxer sends that message on this packet_id into the same multicast group as\n * the media, and moqcast-draft (PR #44) makes advertising it for a track a\n * MUST NOT. A track's packet_id is therefore 1..MMTP_PACKET_ID_MAX.\n */\nexport const MMTP_SIGNALING_PACKET_ID = 0\n\n/** Largest value of the 16-bit MMTP `packet_id` header field. */\nexport const MMTP_PACKET_ID_MAX = 0xffff\n\n// FEC Code IDs\nexport const FEC_CODE_XOR = 1\nexport const FEC_CODE_RAPTORQ = 2\n\n/**\n * Parse MMTP header from buffer\n */\nexport function parseMMTPHeader(buffer: Uint8Array): MMTPHeader {\n  if (buffer.length < MMTP_HEADER_SIZE) {\n    throw new Error(`MMTP packet too small: ${buffer.length} bytes`)\n  }\n\n  const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength)\n\n  const version = (buffer[0]! >> 6) & 0x03\n  if (version !== 0) {\n    throw new Error(`Unsupported MMTP version: ${version}`)\n  }\n\n  // Extract FEC type from byte 0, bits 3-4\n  const fecType = (buffer[0]! >> 3) & 0x03\n  const packetCounterFlag = (buffer[0]! & 0x20) !== 0\n  const extensionFlag = (buffer[0]! & 0x02) !== 0\n\n  // Extract RAP flag from byte 0, bit 0 (R bit - Random Access Point)\n  const rapFlag = (buffer[0]! & 0x01) === 1\n\n  // ISO/IEC 23008-1:2023 Figure 8 (V=0) places reserved(2) before\n  // packet_type(6), so packet_type occupies the low six bits of byte 1.\n  const packetType = buffer[1]! & 0x3F\n\n  let offset = 2\n\n  // Packet ID (2 bytes, big-endian)\n  const packetId = view.getUint16(offset, false)\n  offset += 2\n\n  // Timestamp (4 bytes, big-endian)\n  const timestamp = BigInt(view.getUint32(offset, false))\n  offset += 4\n\n  // Sequence number (4 bytes, big-endian)\n  const sequenceNumber = view.getUint32(offset, false)\n  offset += 4\n\n  let packetCounter: number | undefined\n  if (packetCounterFlag) {\n    if (offset + 4 > buffer.length) throw new Error('MMTP packet truncated in packet_counter')\n    packetCounter = view.getUint32(offset, false)\n    offset += 4\n  }\n\n  let extension: { type: number; data: Uint8Array } | undefined\n  if (extensionFlag) {\n    if (offset + 4 > buffer.length) throw new Error('MMTP packet truncated in header extension')\n    const type = view.getUint16(offset, false)\n    const length = view.getUint16(offset + 2, false)\n    offset += 4\n    if (offset + length > buffer.length) throw new Error('MMTP packet truncated in header extension value')\n    extension = { type, data: buffer.subarray(offset, offset + length) }\n    offset += length\n  }\n\n  return {\n    version,\n    packetType,\n    packetId,\n    timestamp,\n    sequenceNumber,\n    payloadLength: buffer.length - offset,\n    fecType,\n    packetCounterFlag,\n    packetCounter,\n    extensionFlag,\n    extension,\n    headerLength: offset,\n    rapFlag,\n  }\n}\n\n/**\n * The MMTP `packet_id` of `buffer`, or null exactly when parseMMTPHeader would\n * throw for it (short buffer, V != 0, truncated packet_counter or header\n * extension).\n *\n * This is the per-packet filter a receiver runs before any other work, so it\n * builds no header object, DataView or BigInt timestamp (BLO-36599). Use\n * parseMMTPHeader when any other header field is needed.\n */\nexport function readMMTPPacketId(buffer: Uint8Array): number | null {\n  if (buffer.length < MMTP_HEADER_SIZE) return null\n  const flags = buffer[0]!\n  if (((flags >> 6) & 0x03) !== 0) return null\n  let offset = MMTP_HEADER_SIZE\n  if ((flags & 0x20) !== 0) {\n    if (offset + 4 > buffer.length) return null\n    offset += 4\n  }\n  if ((flags & 0x02) !== 0) {\n    if (offset + 4 > buffer.length) return null\n    const length = (buffer[offset + 2]! << 8) | buffer[offset + 3]!\n    if (offset + 4 + length > buffer.length) return null\n  }\n  return (buffer[2]! << 8) | buffer[3]!\n}\n\n/**\n * Unwrap MMTP packet to extract payload\n */\nexport function unwrapMMTP(buffer: Uint8Array): MMTPPacket {\n  const header = parseMMTPHeader(buffer)\n  const payload = buffer.subarray(header.headerLength)\n\n  return { header, payload }\n}\n\n/**\n * Parse MPU header from payload\n * ISO/IEC 23008-1:2023 Section 9.2.3.3\n *\n * MPU Header format (8 bytes) as written by FFmpeg/libmmt:\n * - Bytes 0-1: payload_length (16 bits, big-endian)\n * - Byte 2: FT(4) | T(1) | FI(2) | A(1)\n * - Byte 3: fragment_counter (8 bits)\n * - Bytes 4-7: MPU_sequence_number (32 bits, big-endian)\n */\nexport function parseMPUHeader(payload: Uint8Array): MPUHeader {\n  if (payload.length < MPU_HEADER_SIZE) {\n    throw new Error(`Payload too small for MPU header: ${payload.length} bytes`)\n  }\n\n  const view = new DataView(payload.buffer, payload.byteOffset, payload.byteLength)\n\n  // Bytes 0-1: payload_length (16 bits, big-endian)\n  const payloadLength = view.getUint16(0, false)\n\n  // Byte 2: FT(4) | T(1) | FI(2) | A(1)\n  const flagsByte = payload[2]!\n  const timedFlag = (flagsByte >> 3) & 0x01\n  const fragmentationIndicator = (flagsByte >> 1) & 0x03\n  const aggregationFlag = (flagsByte & 0x01) !== 0\n\n  // Byte 3: fragment_counter (8 bits). The high bit is part of the counter in\n  // the current libmmt/FFmpeg writer ABI.\n  const fragmentCounter = payload[3]!\n\n  // Bytes 4-7: MPU_sequence_number (32 bits, big-endian)\n  const mpuSequenceNumber = view.getUint32(4, false)\n\n  return {\n    mpuSequenceNumber,\n    fragmentationIndicator,\n    fragmentCounter,\n    timedFlag,\n    aggregationFlag,\n    payloadLength,\n  }\n}\n\nexport function parseTimedMfuDuHeader(payload: Uint8Array, offset: number): MFUDuHeader | null {\n  if (offset < 0 || offset + MFU_DU_HEADER_SIZE_TIMED > payload.length) return null\n  const view = new DataView(payload.buffer, payload.byteOffset + offset, MFU_DU_HEADER_SIZE_TIMED)\n  return {\n    movieFragmentSequenceNumber: view.getUint32(0, false),\n    sampleNumber: view.getUint32(4, false),\n    offset: view.getUint32(8, false),\n    priority: payload[offset + 12]!,\n    dependencyCounter: payload[offset + 13]!,\n  }\n}\n\n/**\n * Why `extractMFUPayload` refused a packet.\n *\n * These identifiers are part of the public contract: callers surface them in\n * diagnostics, so renaming one is a breaking change.\n */\nexport type MFURejectionGate =\n  | 'packet-shorter-than-mmtp-plus-mpu-header'\n  | 'mmtp-header-unparseable'\n  | 'not-an-mpu-packet'\n  | 'payload-shorter-than-mpu-header'\n  | 'aggregation-flag-set'\n  | 'mpu-payload-length-below-header-remainder'\n  | 'mpu-declared-end-exceeds-payload'\n  | 'mfu-offset-at-or-past-declared-end'\n  | 'source-fec-payload-id-width-mismatch'\n  | 'declared-trailers-unresolved'\n\nexport interface MFURejection {\n  gate: MFURejectionGate\n  /** Human-readable detail, including the byte arithmetic that decided it. */\n  detail: string\n}\n\ninterface MfuPayloadLayout {\n  hasMfuDuHeader: boolean\n  mfuOffset: number\n  dataEnd: number\n}\n\nfunction resolveMfuPayloadLayout(\n  mpu: MPUHeader,\n  fragmentType: number,\n  payload: Uint8Array,\n): { layout: MfuPayloadLayout } | { rejection: MFURejection } {\n  if (mpu.payloadLength < MPU_HEADER_REMAINDER_SIZE) {\n    return {\n      rejection: {\n        gate: 'mpu-payload-length-below-header-remainder',\n        detail: `payload_length=${mpu.payloadLength} < ${MPU_HEADER_REMAINDER_SIZE}`,\n      },\n    }\n  }\n\n  // ISO/IEC 23008-1 defines payload_length from immediately after its own\n  // two-byte field. It therefore includes the remaining six MPU-header bytes.\n  const declaredEnd = MPU_LENGTH_FIELD_SIZE + mpu.payloadLength\n  if (declaredEnd > payload.length) {\n    return {\n      rejection: {\n        gate: 'mpu-declared-end-exceeds-payload',\n        detail:\n          `payload_length=${mpu.payloadLength} implies end=${declaredEnd}, ` +\n          `payload is ${payload.length} bytes`,\n      },\n    }\n  }\n\n  const hasHeader = fragmentType === 2 && mpu.fragmentationIndicator <= 1\n  const mfuHeaderSize = mpu.timedFlag ? MFU_DU_HEADER_SIZE_TIMED : MFU_DU_HEADER_SIZE_NONTIMED\n  const mfuOffset = MPU_HEADER_SIZE + (hasHeader ? mfuHeaderSize : 0)\n  if (mfuOffset >= declaredEnd) {\n    return {\n      rejection: {\n        gate: 'mfu-offset-at-or-past-declared-end',\n        detail: `mfuOffset=${mfuOffset} >= declaredEnd=${declaredEnd}`,\n      },\n    }\n  }\n\n  return {\n    layout: {\n      hasMfuDuHeader: hasHeader,\n      mfuOffset,\n      dataEnd: declaredEnd,\n    },\n  }\n}\n\nfunction isEmptyOrExactAltaTrailer(payload: Uint8Array, start: number, end: number): boolean {\n  if (start === end) return true\n  if (start < 0 || end > payload.length || start + _LEAF_MMTP_EXT_TRAILER_HEADER_SIZE > end) {\n    return false\n  }\n\n  const view = new DataView(\n    payload.buffer,\n    payload.byteOffset + start,\n    end - start,\n  )\n  if (view.getUint16(0, false) !== _LEAF_MMTP_EXT_TYPE_ALTA_AUTH) return false\n\n  const authLength = view.getUint16(2, false)\n  return start + _LEAF_MMTP_EXT_TRAILER_HEADER_SIZE + authLength === end\n}\n\ninterface DeclaredTrailerLayout {\n  hasFecId: boolean\n}\n\nfunction resolveDeclaredTrailers(\n  payload: Uint8Array,\n  declaredEnd: number,\n  fecType: number,\n  options?: { skipFecId?: boolean },\n): DeclaredTrailerLayout | null {\n  if (declaredEnd > payload.length) return null\n\n  if (options?.skipFecId) {\n    return isEmptyOrExactAltaTrailer(payload, declaredEnd, payload.length)\n      ? { hasFecId: false }\n      : null\n  }\n\n  if (fecType === 1) {\n    const fecStart = payload.length - SOURCE_FEC_PAYLOAD_ID_SIZE\n    if (fecStart < declaredEnd || !isEmptyOrExactAltaTrailer(payload, declaredEnd, fecStart)) {\n      return null\n    }\n    return { hasFecId: true }\n  }\n  if (fecType !== 0) return null\n\n  if (isEmptyOrExactAltaTrailer(payload, declaredEnd, payload.length)) {\n    return { hasFecId: false }\n  }\n\n  return null\n}\n\n/**\n * Extract NAL unit payload from MMTP packet\n */\nexport function extractNALUnit(mmtpPacket: Uint8Array): Uint8Array {\n  const extraction = extractMFUPayload(mmtpPacket)\n  if (!extraction) throw new Error('Malformed MMTP MPU payload')\n  return extraction.data\n}\n\n/** Result of extracting MFU payload from an MMTP packet */\nexport interface MFUExtraction {\n  /** MMTP header fields */\n  header: MMTPHeader\n  /** MPU header fields */\n  mpu: MPUHeader\n  /** Fragment type (FT field, 4 bits): 0=metadata, 2=MFU data */\n  fragmentType: number\n  /** MFU payload data (video/audio bytes, headers stripped, FEC ID excluded) */\n  data: Uint8Array\n  /** Parsed timed MFU DU header when present, otherwise null */\n  mfuDuHeader: MFUDuHeader | null\n  /** Non-timed MFU Item_ID when the 4-byte DU header is present. */\n  itemId: number | null\n  /** Source FEC Payload ID if present (`FEC_type == 1`), or null */\n  fecPayloadId: { ssId: number } | null\n}\n\n/**\n * Extract MFU payload from a raw MMTP packet.\n *\n * Handles all the byte arithmetic for:\n * - MMTP header (12 bytes)\n * - MPU sub-header (8 bytes, payloadLength field)\n * - MFU DU header (14 bytes timed / 4 bytes non-timed, only for FI \u2264 1)\n * - Source FEC Payload ID (4 bytes at end, only when `FEC_type == 1`)\n *\n * `payloadLength` is the ISO length-after-field value: six remaining MPU-header\n * bytes, then the MFU DU header when present, then media. ALTA and Source FEC\n * trailers are outside that declared span and must consume the exact suffix.\n *\n * @param mmtpPacket Raw MMTP packet (from multicast or MoQ)\n * @param options.skipFecId When true, do NOT subtract the 4-byte Source FEC Payload ID\n *   from the payload boundary, even if fecType >= 1 in the MMTP header.  Use this for\n *   FEC-recovered symbols where the FEC PID was already stripped before WASM decoding\n *   but the fecType bits in byte 0 still reflect the original packet (FEC Type=1 per\n *   draft-ramadan-moq-mmt-00 \u00A73.1).\n * @returns Extracted MFU data + metadata, or null if packet is too small\n */\ninterface MfuPlan {\n  header: MMTPHeader\n  payload: Uint8Array\n  mpu: MPUHeader\n  fragmentType: number\n  layout: MfuPayloadLayout\n  trailerLayout: DeclaredTrailerLayout\n}\n\n/**\n * Single source of truth for whether a packet yields an MFU payload.\n *\n * `extractMFUPayload` and `explainMFURejection` both delegate here, so the\n * reason reported to operators can never drift from the decision the parser\n * actually made.\n */\nfunction planMfuExtraction(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n  parsedHeader?: MMTPHeader,\n): { plan: MfuPlan } | { rejection: MFURejection } {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) {\n    return {\n      rejection: {\n        gate: 'packet-shorter-than-mmtp-plus-mpu-header',\n        detail: `${mmtpPacket.length} bytes < ${MMTP_HEADER_SIZE + MPU_HEADER_SIZE}`,\n      },\n    }\n  }\n\n  let header: MMTPHeader\n  if (parsedHeader) {\n    header = parsedHeader\n  } else {\n    try {\n      header = parseMMTPHeader(mmtpPacket)\n    } catch (error) {\n      return {\n        rejection: {\n          gate: 'mmtp-header-unparseable',\n          detail: error instanceof Error ? error.message : String(error),\n        },\n      }\n    }\n  }\n  if (header.packetType !== PACKET_TYPE_MPU) {\n    return {\n      rejection: {\n        gate: 'not-an-mpu-packet',\n        detail: `packetType=0x${header.packetType.toString(16).padStart(2, '0')}`,\n      },\n    }\n  }\n\n  const payload = mmtpPacket.subarray(header.headerLength)\n  if (payload.length < MPU_HEADER_SIZE) {\n    return {\n      rejection: {\n        gate: 'payload-shorter-than-mpu-header',\n        detail: `${payload.length} bytes < ${MPU_HEADER_SIZE}`,\n      },\n    }\n  }\n\n  const mpu = parseMPUHeader(payload)\n  if (mpu.aggregationFlag) {\n    return {\n      rejection: { gate: 'aggregation-flag-set', detail: 'strict profile requires A=0' },\n    }\n  }\n\n  // Fragment type from byte 2 upper nibble (not returned by parseMPUHeader)\n  const fragmentType = (payload[2]! >> 4) & 0x0f\n\n  const layoutResult = resolveMfuPayloadLayout(mpu, fragmentType, payload)\n  if ('rejection' in layoutResult) return layoutResult\n  const { layout } = layoutResult\n\n  const trailerLayout = resolveDeclaredTrailers(\n    payload,\n    layout.dataEnd,\n    header.fecType,\n    options,\n  )\n  if (!trailerLayout) {\n    // The most common cause is a producer whose Source FEC Payload ID width\n    // disagrees with ISO/IEC 23008-1 \u00A7C.5.2. Name that explicitly rather than\n    // leaving operators to infer it from a generic trailer error.\n    if (!options?.skipFecId && header.fecType === 1) {\n      const observed = payload.length - layout.dataEnd\n      if (observed !== SOURCE_FEC_PAYLOAD_ID_SIZE) {\n        return {\n          rejection: {\n            gate: 'source-fec-payload-id-width-mismatch',\n            detail:\n              `producer wrote a ${observed}-byte Source FEC Payload ID, ` +\n              `ISO/IEC 23008-1 \u00A7C.5.2 requires ${SOURCE_FEC_PAYLOAD_ID_SIZE} ` +\n              `(payload=${payload.length}, declaredEnd=${layout.dataEnd})`,\n          },\n        }\n      }\n    }\n    return {\n      rejection: {\n        gate: 'declared-trailers-unresolved',\n        detail:\n          `trailer bytes [${layout.dataEnd}, ${payload.length}) are neither empty ` +\n          `nor an exact ALTA trailer (fecType=${header.fecType})`,\n      },\n    }\n  }\n\n  return { plan: { header, payload, mpu, fragmentType, layout, trailerLayout } }\n}\n\n/**\n * Report why `extractMFUPayload` would refuse this packet, or null if it would\n * accept it.\n *\n * `extractMFUPayload` returns bare `null` on ten distinct conditions, which\n * makes a producer/consumer framing disagreement indistinguishable from a\n * publisher that never started \u2014 both render as silence. Use this wherever\n * that distinction matters: diagnostics, contract tests, and operator-facing\n * logs.\n */\nexport function explainMFURejection(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n): MFURejection | null {\n  const result = planMfuExtraction(mmtpPacket, options)\n  return 'rejection' in result ? result.rejection : null\n}\n\nexport function extractMFUPayload(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n): MFUExtraction | null {\n  return extractPlannedMfu(mmtpPacket, planMfuExtraction(mmtpPacket, options))\n}\n\n/**\n * extractMFUPayload for a caller that already holds this packet's parsed MMTP\n * header, so the header is not parsed a second time (BLO-36599).\n *\n * `header` must be `parseMMTPHeader(mmtpPacket)` of this same packet; the\n * result is then identical to `extractMFUPayload(mmtpPacket, options)`.\n */\nexport function extractMFUPayloadWithHeader(\n  mmtpPacket: Uint8Array,\n  header: MMTPHeader,\n  options?: { skipFecId?: boolean },\n): MFUExtraction | null {\n  return extractPlannedMfu(mmtpPacket, planMfuExtraction(mmtpPacket, options, header))\n}\n\nfunction extractPlannedMfu(\n  mmtpPacket: Uint8Array,\n  result: { plan: MfuPlan } | { rejection: MFURejection },\n): MFUExtraction | null {\n  if ('rejection' in result) return null\n  const { header, payload, mpu, fragmentType, layout, trailerLayout } = result.plan\n\n  const mfuDuHeaderPresent = layout.hasMfuDuHeader\n  const mfuOffset = layout.mfuOffset\n  const dataEnd = layout.dataEnd\n\n  const mfuDuHeader =\n    mfuDuHeaderPresent && mpu.timedFlag === 1\n      ? parseTimedMfuDuHeader(payload, MPU_HEADER_SIZE)\n      : null\n  const itemId =\n    mfuDuHeaderPresent && mpu.timedFlag === 0\n      ? new DataView(payload.buffer, payload.byteOffset + MPU_HEADER_SIZE, 4).getUint32(0, false)\n      : null\n\n  const data = payload.subarray(mfuOffset, dataEnd)\n\n  const fecPayloadId = trailerLayout.hasFecId\n    ? {\n        ssId: new DataView(\n          mmtpPacket.buffer,\n          mmtpPacket.byteOffset + mmtpPacket.length - SOURCE_FEC_PAYLOAD_ID_SIZE,\n          SOURCE_FEC_PAYLOAD_ID_SIZE,\n        ).getUint32(0, false),\n      }\n    : null\n\n  return { header, mpu, fragmentType, data, mfuDuHeader, itemId, fecPayloadId }\n}\n\n/**\n * Extract timestamp from MMTP packet\n */\nexport function extractTimestamp(mmtpPacket: Uint8Array): bigint {\n  const { header } = unwrapMMTP(mmtpPacket)\n  return header.timestamp\n}\n\n/**\n * Check if MMTP packet is an FEC repair packet\n * FEC_type 2 and 3 are repair packets\n */\nexport function isFecRepairPacket(mmtpPacket: Uint8Array): boolean {\n  if (mmtpPacket.length < 1) return false\n  const fecType = (mmtpPacket[0]! >> 3) & 0x03\n  return fecType >= 2\n}\n\n/**\n * Extract Source FEC Payload ID (SS_ID) from the last 4 bytes of an MMTP\n * source packet per ISO/IEC 23008-1:2023 Section C.5.2 Figure C.10.\n *\n * SS_ID is a flat 32-bit monotonic counter (incremented by 1 per packet\n * for ssbg_mode0 and ssbg_mode1). Block membership and ESI use the\n * configured K; repair SS_Start identifies the first SS_ID of the block and\n * SSB_length records the authored source-symbol count:\n *   SBN = floor(SS_ID / K), ESI = SS_ID % K\n *   SS_Start = SBN * K  (first SS_ID of the block)\n *\n * This matches FFmpeg moqenc_mmt.c, the drafts (draft-ramadan-moq-fec \u00A76.2),\n * and ATSC A/331 \u00A78.1.2.5 which defers to ISO 23008-1 Annex C.\n */\nexport function extractFecPayloadId(mmtpPacket: Uint8Array): { ssId: number } | null {\n  const header = parseHeaderForSourceFecId(mmtpPacket)\n  return header ? sourceFecPayloadIdOf(mmtpPacket, header) : null\n}\n\n/**\n * Return true when FEC_type=1 and the exact suffix after the ISO-declared MPU\n * payload contains a four-byte Source FEC Payload ID.\n */\nexport function hasSourceFecPayloadId(mmtpPacket: Uint8Array): boolean {\n  const header = parseHeaderForSourceFecId(mmtpPacket)\n  return header !== null && sourceFecPayloadIdOf(mmtpPacket, header) !== null\n}\n\nfunction parseHeaderForSourceFecId(mmtpPacket: Uint8Array): MMTPHeader | null {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) return null\n  try {\n    return parseMMTPHeader(mmtpPacket)\n  } catch {\n    return null\n  }\n}\n\n/**\n * The Source FEC Payload ID of a packet whose MMTP header the caller already\n * parsed, or null when the packet carries none: present only when FEC_type=1\n * and the exact suffix after the ISO-declared MPU payload holds the four-byte\n * ID (ISO/IEC 23008-1 \u00A7C.5.2). Same answer as extractFecPayloadId, without a\n * second header parse (BLO-36599).\n *\n * `header` must be `parseMMTPHeader(mmtpPacket)` of this same packet.\n */\nexport function sourceFecPayloadIdOf(\n  mmtpPacket: Uint8Array,\n  header: MMTPHeader,\n): { ssId: number } | null {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) return null\n  if (header.packetType !== PACKET_TYPE_MPU) return null\n\n  const payload = mmtpPacket.subarray(header.headerLength)\n  if (payload.length < MPU_HEADER_SIZE) return null\n  const payloadLength = (payload[0]! << 8) | payload[1]!\n  if (payloadLength < MPU_HEADER_REMAINDER_SIZE) return null\n  const declaredEnd = MPU_LENGTH_FIELD_SIZE + payloadLength\n  if (!resolveDeclaredTrailers(payload, declaredEnd, header.fecType)?.hasFecId) return null\n\n  // Flat 4-byte SS_ID: encoder writes block_id * K + symbol_id\n  const off = mmtpPacket.length - SOURCE_FEC_PAYLOAD_ID_SIZE\n  return {\n    ssId:\n      ((mmtpPacket[off]! << 24) |\n        (mmtpPacket[off + 1]! << 16) |\n        (mmtpPacket[off + 2]! << 8) |\n        mmtpPacket[off + 3]!) >>>\n      0,\n  }\n}\n\n/**\n * MMTP header-extension ext_type assigned to the detached ALTA authenticator\n * trailer (Path 2 / 08-07). Carried in an `[ext_type][ext_length][auth]`\n * block appended after the MPU's declared payload bytes, before the 4-byte\n * Source FEC Payload ID. MMTP X-bit stays 0 \u2014 non-ALTA MMTP receivers treat\n * the trailer as bytes past `payload_length` and skip it (per ISO 23008-1\n * \u00A79.2.2 \"may be discarded without impacting correct processing\").\n */\n// Re-export the ALTA trailer helper from the zero-dep leaf package. The leaf\n// owns the implementation so container and FEC consumers share one parser\n// without creating a package cycle.\nexport const MMTP_EXT_TYPE_ALTA_AUTH = _LEAF_MMTP_EXT_TYPE_ALTA_AUTH\nexport const MMTP_EXT_TRAILER_HEADER_SIZE = _LEAF_MMTP_EXT_TRAILER_HEADER_SIZE\nexport type AltaTrailer = _LeafAltaTrailer\nexport const extractAltaTrailer = _leafExtractAltaTrailer\n\n/** Size of Repair FEC Payload ID per ISO/IEC 23008-1 Section C.5.3 */\nexport const REPAIR_FEC_PID_SIZE = 13\n\n/**\n * Parse the 13-byte Repair FEC Payload ID after the complete dynamic MMTP header.\n * `parsedHeader`, when given, must be `parseMMTPHeader(mmtpPacket)` of this\n * same packet; it spares the second header parse (BLO-36599).\n */\nfunction readRepairFecPayloadIdFields(mmtpPacket: Uint8Array, parsedHeader?: MMTPHeader): {\n  packetId: number; ssStart: number; rsbLength: number; rsId: number; ssbLength: number; dataOffset: number\n} | null {\n  let header: MMTPHeader\n  if (parsedHeader) {\n    header = parsedHeader\n  } else {\n    try {\n      header = parseMMTPHeader(mmtpPacket)\n    } catch {\n      return null\n    }\n  }\n  if (header.packetType !== PACKET_TYPE_REPAIR || header.fecType !== 2) return null\n\n  const off = header.headerLength\n  if (mmtpPacket.length < off + REPAIR_FEC_PID_SIZE) return null\n  const ssStart =\n    ((mmtpPacket[off]! << 24) |\n      (mmtpPacket[off + 1]! << 16) |\n      (mmtpPacket[off + 2]! << 8) |\n      mmtpPacket[off + 3]!) >>>\n    0  // 32 bits\n  const rsbLength = (mmtpPacket[off + 4]! << 16) | (mmtpPacket[off + 5]! << 8) | mmtpPacket[off + 6]!  // 24 bits\n  const rsId = (mmtpPacket[off + 7]! << 16) | (mmtpPacket[off + 8]! << 8) | mmtpPacket[off + 9]!  // 24 bits\n  const ssbLength = (mmtpPacket[off + 10]! << 16) | (mmtpPacket[off + 11]! << 8) | mmtpPacket[off + 12]!  // 24 bits\n  return {\n    packetId: header.packetId,\n    ssStart,\n    rsbLength,\n    rsId,\n    ssbLength,\n    dataOffset: off + REPAIR_FEC_PID_SIZE,\n  }\n}\n\n/**\n * Extract Repair FEC Payload ID from a raw-multicast MMTP repair packet.\n * Per ISO/IEC 23008-1:2023 Section C.5.3 (ssbg_mode0, one-stage, no FFSRP_TS):\n *   [MMTP header][SS_Start:4][RSB_length:3][RS_ID:3][SSB_length:3][repair data]\n * OTI is delivered via AL-FEC signaling message (Table C.3), not per-packet.\n *\n * Byte 1 is reserved(2)|packet_type(6) for V=0, so repair type 0x03 is 0x03.\n * Pre-migration high-bits bytes (0x0c) are rejected \u2014 no compatibility decode.\n */\nexport function extractRepairFecPayloadId(mmtpPacket: Uint8Array): {\n  ssStart: number; rsbLength: number; rsId: number; ssbLength: number\n} | null {\n  const fields = readRepairFecPayloadIdFields(mmtpPacket)\n  if (!fields) return null\n  return {\n    ssStart: fields.ssStart,\n    rsbLength: fields.rsbLength,\n    rsId: fields.rsId,\n    ssbLength: fields.ssbLength,\n  }\n}\n\n/** Parsed MoQ repair frame per ISO/IEC 23008-1 Section C.4.3 + C.5.3 */\nexport interface MoqRepairFrame {\n  /** MMTP packetId (1=video, 2=audio) \u2014 for routing to correct FEC decoder */\n  packetId: number\n  /** SS_Start (32 bits): SS_ID of first source symbol in block */\n  ssStart: number\n  /** RSB_length (24 bits): number of repair symbols (P) */\n  rsbLength: number\n  /** RS_ID (24 bits): repair symbol index (0-based) */\n  rsId: number\n  /** SSB_length (24 bits): authored source-symbol count (1..=configured K) */\n  ssbLength: number\n  /** Repair symbol data after the dynamic MMTP header and 13-byte FEC payload ID. */\n  symbolData: Uint8Array\n}\n\n/**\n * Parse a MoQ repair frame (ISO/IEC 23008-1 Annex C format).\n *\n * Wire format per ISO 23008-1 \u00A7C.4.3 + \u00A7C.5.3:\n *   MMTP Header: fixed 12 bytes plus C/X optional fields\n *   then SS_Start (4 bytes) \u2192 block identifier\n *   then RSB_length (3 bytes) \u2192 P\n *   then RS_ID (3 bytes) \u2192 ESI = K + RS_ID\n *   then SSB_length (3 bytes) \u2192 authored source-symbol count (1..=K)\n *   then Repair Symbol Data (T bytes)\n *\n * @param frame - Raw MoQ repair frame bytes\n * @returns Parsed frame or null if invalid\n */\nexport function parseMoqRepairFrame(frame: Uint8Array): MoqRepairFrame | null {\n  return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame))\n}\n\n/**\n * parseMoqRepairFrame for a caller that already holds this frame's parsed MMTP\n * header, so the header is not parsed a second time (BLO-36599). The router's\n * multicast repair branch uses it: one repair packet in every K + P otherwise\n * paid two header parses.\n *\n * `header` must be `parseMMTPHeader(frame)` of this same frame; the result is\n * then identical to `parseMoqRepairFrame(frame)`.\n */\nexport function parseMoqRepairFrameWithHeader(\n  frame: Uint8Array,\n  header: MMTPHeader,\n): MoqRepairFrame | null {\n  return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame, header))\n}\n\nfunction moqRepairFrameFrom(\n  frame: Uint8Array,\n  repairId: ReturnType<typeof readRepairFecPayloadIdFields>,\n): MoqRepairFrame | null {\n  if (!repairId) return null\n\n  const symbolData = frame.subarray(repairId.dataOffset)\n  if (\n    repairId.rsbLength === 0 ||\n    repairId.ssbLength === 0 ||\n    repairId.rsId >= repairId.rsbLength ||\n    symbolData.length === 0\n  ) return null\n\n  return {\n    packetId: repairId.packetId,\n    ssStart: repairId.ssStart,\n    rsbLength: repairId.rsbLength,\n    rsId: repairId.rsId,\n    ssbLength: repairId.ssbLength,\n    symbolData,\n  }\n}\n\n// The signalling-message parsers (9.3.4.2 payload header, AL-FEC message,\n// PA/MPT) live in ./signalling.ts.\n", "/**\n * NTP short format (RFC 5905 \u00A76): an unsigned 32-bit, 16.16 fixed-point count\n * of seconds. The MMTP header `timestamp` field (ISO/IEC 23008-1 \u00A79.2.2)\n * carries each packet's UTC sending instant in this format, so the value wraps\n * to 0 every 2^16 s (~18.2 h).\n *\n * Plain numeric order on these values breaks at every wrap: a retained\n * `Math.max` stays at the pre-wrap value and every later instant compares as\n * older. Order send times only with {@link compareNtpShort}, which applies\n * RFC 1982 serial-number arithmetic over the field's width.\n */\n\n/** Width in bits of the MMTP `timestamp` field (NTP short). */\nexport const NTP_SHORT_BITS = 32\n\n/** Number of distinct NTP-short values; the field wraps to 0 here. */\nexport const NTP_SHORT_MODULUS = 2 ** NTP_SHORT_BITS\n\n/**\n * RFC 1982 \u00A73.2's `2^(SERIAL_BITS - 1)`. Two values whose forward distance is\n * below this are ordered; exactly this far apart they are not ordered at all.\n * Two instants must be less than this far apart (2^15 s, ~9.1 h of send time)\n * for the comparison to give their true order.\n */\nexport const NTP_SHORT_HALF_RANGE = 2 ** (NTP_SHORT_BITS - 1)\n\n/**\n * Serial order of one NTP-short value relative to another.\n *\n * `'unordered'` is RFC 1982's undefined case: the values are exactly\n * {@link NTP_SHORT_HALF_RANGE} apart, so neither precedes the other. It is\n * never folded into `'before'` or `'after'`; each caller decides what an\n * unorderable pair means for it.\n */\nexport type NtpShortOrder = 'before' | 'equal' | 'after' | 'unordered'\n\n/** True when `value` is an NTP-short value: an integer in [0, NTP_SHORT_MODULUS). */\nexport function isNtpShort(value: number): boolean {\n  return Number.isInteger(value) && value >= 0 && value < NTP_SHORT_MODULUS\n}\n\n/**\n * RFC 1982 serial comparison of NTP-short `a` against `b`: `'after'` when `a`\n * is the later instant, `'before'` when it is the earlier one.\n *\n * The answer is the true order only while the two instants are less than\n * {@link NTP_SHORT_HALF_RANGE} apart. Past that a 32-bit field cannot tell\n * later from earlier, and the result names whichever direction is nearer.\n * This is not a total order (it is not transitive across the whole space), so\n * it must never be used to sort.\n *\n * @throws {RangeError} if either operand is not an NTP-short value\n */\nexport function compareNtpShort(a: number, b: number): NtpShortOrder {\n  if (!isNtpShort(a) || !isNtpShort(b)) {\n    throw new RangeError(\n      `NTP-short values must be integers in [0, 2^${NTP_SHORT_BITS}), got ${String(a)} and ${String(b)}`,\n    )\n  }\n  if (a === b) return 'equal'\n  // Forward distance from b to a, reduced into [1, NTP_SHORT_MODULUS). Both\n  // operands are below 2^32, so every step is exact in a double.\n  const forward = (a - b + NTP_SHORT_MODULUS) % NTP_SHORT_MODULUS\n  if (forward < NTP_SHORT_HALF_RANGE) return 'after'\n  if (forward > NTP_SHORT_HALF_RANGE) return 'before'\n  return 'unordered'\n}\n", "/**\n * FEC block profile (BLO-35597, ISO/IEC 23008-1 Annex C).\n *\n * Every catalog `fec` object that declares an FEC instance names exactly one\n * block profile in `fec.blockProfile`. A receiver applies all of a profile's\n * rules or none of them, so the token is the one explicit per-stream\n * discriminator: it is never defaulted and never inferred from the wire.\n *\n * - `k-padded-v1` (legacy, Blockcast-private): a source symbol is the\n *   protected MMTP packet zero-padded to T with no length field; every block\n *   is a K-symbol RaptorQ block whose ESIs `SSB_length..K-1` are implicit\n *   zero padding; `SS_ID = SBN*K + ESI`, so `SS_Start = SBN*K`; repair\n *   ESI = K + RS_ID; the MoQ repair group id is the SBN.\n * - `iso-ssbg1-v1`: ssbg_mode1 (C.3.3): a source symbol is\n *   `u16 length || protected packet || zero padding` to T; a block is a\n *   K' = SSB_length RaptorQ block (C.5.3) and repair ESI = SSB_length + RS_ID;\n *   SS_ID increments by one per FEC source packet and wraps at 2^32 (C.5.2),\n *   so a block is located by membership in `[SS_Start, SS_Start + SSB_length)`\n *   under RFC 1982 serial arithmetic; the MoQ repair group id is the 62-bit\n *   wrap-epoch-extended SS_Start. The AL-FEC coding byte for this profile is\n *   0x14 (one-stage, ssbg_mode1, fec_payload_id_mode 0, Amd 1:2025 Table C.3).\n */\nimport { serial32Add, serial32Distance, serial32Precedes } from './serial-number.js'\n\n/** The two block profiles a catalog `fec.blockProfile` may name. */\nexport type FecBlockProfile = 'k-padded-v1' | 'iso-ssbg1-v1'\n\n/** Every accepted `fec.blockProfile` token, legacy first. */\nexport const FEC_BLOCK_PROFILES: readonly FecBlockProfile[] = Object.freeze([\n  'k-padded-v1',\n  'iso-ssbg1-v1',\n])\n\n/** True for a known block-profile token. */\nexport function isFecBlockProfile(value: unknown): value is FecBlockProfile {\n  return value === 'k-padded-v1' || value === 'iso-ssbg1-v1'\n}\n\n/**\n * Read a required `fec.blockProfile`. Throws on an absent or unknown token:\n * there is no default and nothing is inferred, because the two profiles carry\n * identical wire tuples whose repair math differs.\n *\n * @param where the catalog path of the field, for the error message.\n */\nexport function parseFecBlockProfile(value: unknown, where: string): FecBlockProfile {\n  if (isFecBlockProfile(value)) return value\n  if (value === undefined) {\n    throw new Error(\n      `${where} is required: name the FEC block profile (\"k-padded-v1\" or \"iso-ssbg1-v1\")`,\n    )\n  }\n  throw new Error(\n    `${where} must be \"k-padded-v1\" or \"iso-ssbg1-v1\" (got ${JSON.stringify(value)})`,\n  )\n}\n\n/** ISO/IEC 23008-1 C.3.3 ssbg_mode1: the two-octet packet length field. */\nexport const SSBG1_LENGTH_FIELD_BYTES = 2\n\n/** The largest protected packet an ssbg_mode1 symbol of size T can carry. */\nexport function ssbg1MaxPacketLength(symbolSize: number): number {\n  return symbolSize - SSBG1_LENGTH_FIELD_BYTES\n}\n\n/** Whether a protected packet of `packetLength` bytes fits one T-byte ssbg_mode1 symbol. */\nexport function ssbg1FitsSymbol(packetLength: number, symbolSize: number): boolean {\n  return (\n    Number.isSafeInteger(packetLength) &&\n    packetLength >= 0 &&\n    packetLength <= ssbg1MaxPacketLength(symbolSize) &&\n    packetLength <= 0xffff\n  )\n}\n\n/**\n * Build one ssbg_mode1 source symbol (C.3.3): the protected packet's length\n * in two octets, network byte order, then the packet, then zero octets up to\n * T. The protected packet is the MMTP packet before its Source FEC Payload ID\n * is appended (C.4.2).\n *\n * @throws when `length + 2 > T`: the packet cannot be protected under this\n * profile, and silently truncating it would corrupt every repair symbol.\n */\nexport function buildSsbg1SourceSymbol(packet: Uint8Array, symbolSize: number): Uint8Array {\n  if (!Number.isSafeInteger(symbolSize) || symbolSize <= SSBG1_LENGTH_FIELD_BYTES) {\n    throw new Error(`ssbg_mode1 symbol size must exceed ${SSBG1_LENGTH_FIELD_BYTES} (got ${symbolSize})`)\n  }\n  if (!ssbg1FitsSymbol(packet.byteLength, symbolSize)) {\n    throw new Error(\n      `ssbg_mode1 source symbol needs ${packet.byteLength} + ${SSBG1_LENGTH_FIELD_BYTES} bytes but T is ${symbolSize}`,\n    )\n  }\n  const symbol = new Uint8Array(symbolSize)\n  symbol[0] = (packet.byteLength >>> 8) & 0xff\n  symbol[1] = packet.byteLength & 0xff\n  symbol.set(packet, SSBG1_LENGTH_FIELD_BYTES)\n  return symbol\n}\n\n/**\n * Recover the protected packet from one ssbg_mode1 source symbol: the bytes\n * the length field names. Returns null, never a guess, when the length field\n * points past the symbol or any padding octet is non-zero (C.3.3 padding is\n * all 00h), since either means the recovered symbol is not what was sent.\n */\nexport function trimSsbg1SourceSymbol(symbol: Uint8Array): Uint8Array | null {\n  if (symbol.byteLength < SSBG1_LENGTH_FIELD_BYTES) return null\n  const length = (symbol[0]! << 8) | symbol[1]!\n  const end = SSBG1_LENGTH_FIELD_BYTES + length\n  if (end > symbol.byteLength) return null\n  for (let i = end; i < symbol.byteLength; i++) {\n    if (symbol[i] !== 0) return null\n  }\n  return symbol.subarray(SSBG1_LENGTH_FIELD_BYTES, end)\n}\n\n/** The SS_ID after the last source symbol of `[ssStart, ssStart + ssbLength)`. */\nexport function isoBlockEnd(ssStart: number, ssbLength: number): number {\n  return serial32Add(ssStart, ssbLength)\n}\n\n/**\n * Range membership (C.5.2, C.5.3): whether `ssId` is one of the\n * `ssbLength` consecutive SS_IDs starting at `ssStart`, modulo 2^32.\n */\nexport function isoBlockContains(ssStart: number, ssbLength: number, ssId: number): boolean {\n  return serial32Distance(ssStart, ssId) < ssbLength\n}\n\n/**\n * A lower bound on how many blocks the block starting at `a` lies behind the\n * one starting at `b` (0 when `a` does not precede `b`). An iso-ssbg1-v1\n * block holds at most `kMax` source symbols (the catalog `sourceSymbols`, the\n * AL-FEC maximum_k_for_repair_flow), so `n * kMax` SS_IDs always span at least\n * `n` blocks. Every interleave horizon in the receiver (decoder retention,\n * worker retirement, ordered-relay settlement) uses this one bound, so the\n * manager's horizon can never fall inside the decoder's.\n */\nexport function isoBlocksBehindLowerBound(a: number, b: number, kMax: number): number {\n  if (!Number.isSafeInteger(kMax) || kMax <= 0) {\n    throw new Error(`iso-ssbg1-v1 block horizon needs a positive maximum K (got ${kMax})`)\n  }\n  return serial32Precedes(a, b) ? Math.floor(serial32Distance(a, b) / kMax) : 0\n}\n", "/**\n * Shared fec-setup helper.\n *\n * Wires a FecWorkerClient into a MulticastManager for a specific track.\n * Both moq-lib (`hang-mmt-fec/js/watch/src/element.ts`) and moqtail\n * (`moqtail-private/apps/client-js/src/lib/player.ts`) call this from their\n * SessionManager `fec-setup` handler so the Worker+ALTA setup lives in one\n * place instead of being duplicated across ~80 lines per player.\n *\n * Callers are responsible for holding the returned `dispose()` and calling it\n * from their `fec-teardown` path (and/or effect cleanup). It unregisters the\n * Worker from MulticastManager before terminating it, so no symbol is routed\n * to a dead Worker; do not dispose the client directly.\n */\n\nimport { parseFecBlockProfile, type FecBlockProfile } from '@blockcast/mmt-base'\nimport type { FecWorkerClient, FecTrackConfig } from '@blockcast/fec-worker'\nimport type { MulticastManager } from './multicast-manager.js'\nimport { deriveFecRetentionBlocks } from '@blockcast/mmt-fec'\nimport { computeFecDeliveryWindowMs } from './track-session.js'\n\n/** Asset URLs the helper needs. Callers pass the already-resolved set. */\nexport interface FecWorkerAssetUrls {\n  /** URL to the fec-worker entry bundle (new Worker() target). */\n  fecWorker: string\n  /** URL to the RaptorQ WASM module (compiled via compileStreaming). */\n  rqWasm: string\n  /** URL to the ALTA WASM module. Fetched only when an ALTA key is provided. */\n  altaWasm: string\n}\n\nexport interface FecWorkerSetupOptions {\n  /** MulticastManager that should receive the configured Worker. */\n  multicastManager: MulticastManager\n  /** MMTP packetId this track occupies (from catalog). */\n  packetId: number\n  /** Human-readable track name (catalog key). */\n  trackName: string\n  /** Track type from catalog. Never inferred from name. */\n  trackType: 'video' | 'audio'\n  /**\n   * The catalog `fec.blockProfile` (BLO-35597). Required: `k-padded-v1` or\n   * `iso-ssbg1-v1`; never defaulted, never inferred.\n   */\n  fecBlockProfile: FecBlockProfile\n  /** FEC K from catalog (source symbols per block). Under iso-ssbg1-v1 the maximum SSB_length. */\n  fecK: number\n  /** Symbol size in bytes (T) \u2014 the ALTA-adjusted value if ALTA is signed. */\n  fecSymbolSize: number\n  /** Repair symbols per block (P). */\n  fecRepairCount: number\n  /**\n   * Repair symbols per block this receiver actually joined: the sum of\n   * `repairSymbols` over the joined BASE layers (draft-ramadan-moq-fec 6.3).\n   * Reported as P by the worker snapshot and CMCD `x-bc-fec-p`, because the\n   * catalog total is not what this receiver joined. Falls back to\n   * `fecRepairCount`, which is the same value on a single-layer track.\n   */\n  joinedRepairCount?: number\n  /** Interleave depth in ms. */\n  fecInterleaveMs: number\n  /** Explicit catalog jitter/reorder allowance in ms. */\n  fecReorderToleranceMs?: number\n  /** Duration of one FEC media unit in ms (video frame or audio access unit). */\n  mediaUnitDurationMs: number\n  /** Optional repair track name (MoQ). Forwarded to FecTrackConfig. */\n  repairTrackName?: string\n  /** Audio sample rate (optional \u2014 audio tracks only). */\n  sampleRate?: number\n  /** Codec string (optional; \"unknown\" is acceptable for first setup). */\n  codec?: string\n  /** Video framerate (optional metadata forwarded to the worker). */\n  framerate?: number\n  /** Base64 SPKI public key (optional). Accepts padded/unpadded, std or url-safe alphabet. */\n  altaPublicKeySpki?: string\n  /** Absolute or origin-relative asset URLs. */\n  assetUrls: FecWorkerAssetUrls\n  /** Optional FecWorkerClient factory \u2014 main use is test injection. */\n  clientFactory?: (workerUrl: URL) => FecWorkerClient\n}\n\nexport interface FecWorkerSetupResult {\n  /** The configured client (already registered with MulticastManager). */\n  client: FecWorkerClient\n  /** True when the ALTA public key decoded and the ALTA WASM compiled. */\n  altaEnabled: boolean\n  /** Removes the Worker from MulticastManager routing, then releases it. */\n  dispose: () => void\n}\n\n/**\n * Configure a FecWorkerClient and attach it to `multicastManager` via\n * `setFecWorker(packetId, client, trackType, config, trackName)`. Worker-path takes precedence\n * over any sync WASM decoder already registered for the same packetId \u2014\n * sync decoders remain as a fallback.\n *\n * Any loader failure is re-thrown so the caller can log and leave the sync\n * WASM decoder active as fallback (same pattern both players used before).\n */\nexport async function setupFecWorkerForTrack(\n  opts: FecWorkerSetupOptions,\n): Promise<FecWorkerSetupResult> {\n  // These two were previously validated as a side effect of calling\n  // deriveFecInterleaveDepth() here. That call is gone (see below), so the\n  // guards are explicit \u2014 a zero or non-finite span/media-unit must still fail\n  // closed rather than size a window from a hardcoded depth.\n  //\n  // `mediaUnitDurationMs` no longer influences the retention this function\n  // computes: it survives only as `mediaUnitsPerSecond`, which\n  // `computeFecDeliveryWindowMs` (track-session.ts) documents as geometry\n  // accepted for existing callers and deliberately not fed to deadline math.\n  // The guard stays anyway \u2014 this is a trust boundary for a catalog-supplied\n  // value, and the test `rejects missing media-unit timing instead of using a\n  // hardcoded depth` pins it. Not dead code. Cite both by symbol, not by line:\n  // a line number here is invalidated by the next edit to the file it points\n  // at, and this comment is the guard's only stated defence.\n  if (!Number.isFinite(opts.fecInterleaveMs) || opts.fecInterleaveMs <= 0) {\n    // Names the catalog field (`fec.interleaveDepthMs`), not the local option\n    // (`opts.fecInterleaveMs`), because that is the knob an operator fixes.\n    throw new Error(\n      `[FEC] interleaveDepthMs (opts.fecInterleaveMs) must be finite and > 0 ` +\n        `(got ${opts.fecInterleaveMs})`,\n    )\n  }\n  if (!Number.isFinite(opts.mediaUnitDurationMs) || opts.mediaUnitDurationMs <= 0) {\n    throw new Error(\n      `[FEC] mediaUnitDurationMs must be finite and > 0 (got ${opts.mediaUnitDurationMs})`,\n    )\n  }\n  const blockProfile = parseFecBlockProfile(\n    opts.fecBlockProfile,\n    `[FEC] ${opts.trackName} fec.blockProfile`,\n  )\n  const deliveryWindowMs = computeFecDeliveryWindowMs({\n    interleaveDepthMs: opts.fecInterleaveMs,\n    sourceSymbols: opts.fecK,\n    repairSymbols: opts.fecRepairCount,\n    symbolSize: opts.fecSymbolSize,\n    mediaUnitsPerSecond: 1000 / opts.mediaUnitDurationMs,\n    jitterBufferMs: opts.fecReorderToleranceMs,\n  })\n  // `FecTrackConfig.interleaveDepth` is a BLOCK COUNT, not D. Every consumer\n  // measures SBN distance with it: the worker's `advanceMediaHorizon` does\n  // `liveSbn - interleaveDepth`, and `MmtFecDecoder::new` documents its\n  // argument as \"the number of interleaved blocks\" before `cleanup_by_sbn`\n  // subtracts it from an SBN and counts the remainder `blocks_failed`.\n  //\n  // `deriveFecInterleaveDepth` returns D \u2014 MEDIA UNITS per block \u2014 so feeding\n  // it here mixed units and sized the retention window in the wrong quantity.\n  // It survived where D happened to land near the real block count and retired\n  // live blocks where it did not. Measured against the live ISS catalog at\n  // reorderToleranceMs=100, retention vs the block's own deadline (the worker\n  // arms `deadlineTs = now + deliveryWindowMs` per block):\n  //\n  //   720p  span 33ms  D=1 -> 2 blocks =  66ms  vs deadline 133ms  UNDER by 67ms\n  //   480p  span 67ms  D=2 -> 3 blocks = 201ms  vs deadline 167ms  ok\n  //   360p  span 67ms  D=2 -> 3 blocks = 201ms  vs deadline 167ms  ok\n  //   audio span 43ms  D=2 -> 3 blocks = 129ms  vs deadline 143ms  UNDER by 14ms\n  //\n  // 480p/360p passed only because D=2 coincided with a workable block count.\n  // On 720p and audio the decoder expired blocks \u2014 counting them failed \u2014 while\n  // the receiver's own deadline for them had not yet passed.\n  //\n  // Derive the count from the two quantities that define it, so retention\n  // always covers the deadline already armed for that block: the blocks that\n  // can be in flight within one block's budget, plus the one being filled.\n  //\n  // `deriveFecRetentionBlocks` is THE one derivation of this horizon -- the\n  // FECManager's ordered-relay settlement consumes the same function, so the\n  // two cannot drift apart again (BLO-35597 Decision E). It fails closed above\n  // the 255 the WASM decoder and the ISO/IEC 23008-1 AL-FEC signaling byte\n  // accept, rather than clamping to a retention shorter than this window.\n  const interleaveDepthBlocks = deriveFecRetentionBlocks(\n    deliveryWindowMs,\n    opts.fecInterleaveMs,\n  )\n  // Resolve URL against location.origin when available (browser runtime).\n  // Absolute URLs pass through unchanged per the URL() spec.\n  const origin =\n    typeof location !== 'undefined' && location.origin ? location.origin : 'http://localhost'\n  const workerUrl = new URL(opts.assetUrls.fecWorker, origin)\n\n  const FecWorkerCtor = await import('@blockcast/fec-worker')\n  const client = opts.clientFactory\n    ? opts.clientFactory(workerUrl)\n    : new FecWorkerCtor.FecWorkerClient(workerUrl)\n\n  // Compile RaptorQ WASM once; ALTA WASM only when we have a key to decode.\n  const rqWasm = await WebAssembly.compileStreaming(fetch(opts.assetUrls.rqWasm))\n\n  let altaKeyBuffer: ArrayBuffer | undefined\n  let altaWasmModule: WebAssembly.Module | undefined\n  if (opts.altaPublicKeySpki) {\n    const b64 = opts.altaPublicKeySpki.replace(/-/g, '+').replace(/_/g, '/')\n    const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, '=')\n    try {\n      const keyBytes = Uint8Array.from(atob(padded), c => c.charCodeAt(0))\n      // SPKI size range: Ed25519=44, P-256=91; tolerate 32..=256 for forward-compat.\n      if (keyBytes.length >= 32 && keyBytes.length <= 256) {\n        altaKeyBuffer = keyBytes.buffer\n        altaWasmModule = await WebAssembly.compileStreaming(fetch(opts.assetUrls.altaWasm))\n      } else {\n        console.warn(\n          `[fec-worker-setup] ALTA SPKI wrong length for \"${opts.trackName}\": ` +\n            `${keyBytes.length} (expected 32..256) \u2014 ALTA disabled`,\n        )\n      }\n    } catch (e) {\n      console.warn(`[fec-worker-setup] ALTA key decode / WASM compile failed for \"${opts.trackName}\":`, e)\n    }\n  }\n\n  const altaEnabled = !!(altaKeyBuffer && altaWasmModule)\n  const fecTrackConfig = {\n    codec: opts.codec ?? 'unknown',\n    trackName: opts.trackName,\n    trackType: opts.trackType,\n    framerate: opts.framerate,\n    sampleRate: opts.sampleRate,\n    algorithm: 'raptor',\n    blockProfile,\n    k: opts.fecK,\n    // P as this receiver joined it, not the catalog total: the worker snapshot\n    // and CMCD `x-bc-fec-p` are read from this. Identity on a single layer.\n    repairCount: opts.joinedRepairCount ?? opts.fecRepairCount,\n    symbolSize: opts.fecSymbolSize,\n    interleaveDepth: interleaveDepthBlocks,\n    interleaveMs: opts.fecInterleaveMs,\n    deliveryWindowMs,\n    fecMode: 'subframe' as const,\n    repairTrack: opts.repairTrackName,\n    altaEnabled,\n    relayBlockSigEnabled: false,\n  } as unknown as FecTrackConfig\n\n  client.configure(fecTrackConfig, rqWasm, altaKeyBuffer, altaWasmModule)\n  try {\n    opts.multicastManager.setFecWorker(opts.packetId, client, opts.trackType, {\n      blockProfile,\n      k: opts.fecK,\n      symbolSize: opts.fecSymbolSize,\n      interleaveDepthMs: opts.fecInterleaveMs,\n      // FEC timing is expressed in media units. For audio this is the access-unit\n      // cadence (for example 1024/48kHz), not a video-only framerate field.\n      fps: 1000 / opts.mediaUnitDurationMs,\n      timeoutMs: deliveryWindowMs,\n    }, opts.trackName)\n  } catch (e) {\n    // The manager refused the registration (for example the stream still\n    // routes to another Worker). The Worker this call created is not in\n    // routing and nothing else holds it, so release it before reporting.\n    try {\n      client.dispose()\n    } catch {\n      /* dispose errors are non-fatal */\n    }\n    throw e\n  }\n\n  let disposed = false\n  return {\n    client,\n    altaEnabled,\n    dispose: () => {\n      if (disposed) return\n      disposed = true\n      // Unregister first so no symbol is routed to a dead Worker between the\n      // dispose below and the manager noticing. A false return means the\n      // Worker was already gone from routing, which this helper never does on\n      // its own, so make that loud instead of leaving it to the next symbol.\n      if (!opts.multicastManager.clearFecWorker(opts.packetId, opts.trackName)) {\n        console.warn(\n          `[fec-worker-setup] packetId=${opts.packetId} track=${opts.trackName} Worker was not registered when disposed`,\n        )\n      }\n      try {\n        client.dispose()\n      } catch {\n        /* dispose errors are non-fatal */\n      }\n    },\n  }\n}\n", "/**\n * TrackSession \u2014 per-track transport state machine.\n * SessionManager \u2014 orchestrates all sessions + TransportPool.\n *\n * Implements Patent Claim 9 (draft-ramadan-moq-fec APPLICATION-1):\n *   (a) subscribe unicast\n *   (b) simultaneously join multicast\n *   (c) render from unicast during join\n *   (d) activate multicast on RAP, suppress unicast\n *   (e) cross-transport FEC repair during transition\n *   (f) hysteresis before switching away from multicast\n *   (g) re-subscribe unicast on sustained failure\n *\n * PIM: manages transport state without inspecting packet contents.\n */\n\nimport {\n  TransportPool,\n  type Subscription,\n  type SubscriptionMode,\n  type AcquireOptions,\n  type DirectSocketHealth,\n  type TransportPoolOptions,\n} from './transport-pool.js'\nimport { fecBlockBudgetMs } from '@blockcast/mmt-fec'\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type TrackState =\n  | 'idle'\n  | 'unicast'\n  | 'unicast-fallback'\n  | 'joining'\n  | 'multicast'\n  | 'amt'\n  | 'failing'\n\nexport interface TrackSessionConfig {\n  trackName: string\n  trackType: 'video' | 'audio'\n  packetId: number\n  /** FEC interleave depth from catalog (ms). Used for hysteresis timer. */\n  fecInterleaveMs: number\n  /** Explicit catalog jitter/reorder allowance in ms. */\n  fecReorderToleranceMs?: number\n  /** FEC K from catalog. Used for audio worklet latency calculation. */\n  fecK: number\n  /** FEC repair symbols per block (P). NOT symbol size. */\n  fecRepairCount: number\n  /**\n   * Repair symbols per block this receiver actually joined: the sum of\n   * `repairSymbols` over the joined BASE layers, not a count of layers\n   * (draft-ramadan-moq-fec 6.3). A keyframe overlay is a separate FEC instance\n   * and is not included.\n   *\n   * This is runtime join state, not catalog geometry: a receiver on a clean\n   * path joins layer 0 only while a lossy one adds layers, so the catalog's\n   * total P is not what this receiver is receiving. Diagnostics that report P\n   * (the worker snapshot, CMCD `x-bc-fec-p`) must read this.\n   *\n   * Absent when the caller joins no layers explicitly, in which case P_0 is\n   * what was joined. That is an identity on a single-layer track, not a\n   * catalog default: with one layer, P_0 is the total.\n   */\n  joinedRepairCount?: number\n  /** FEC symbol size in bytes (T). Required for WASM decoder OTI. */\n  fecSymbolSize: number\n  /** MoQ repair track name from catalog FEC config. */\n  repairTrackName?: string\n  /** Frame samples from initData parsing (audio-init-parser.ts). */\n  frameSamples?: number\n  /** Audio sample rate from catalog. */\n  sampleRate?: number\n  /** Ordered transport preference: best first. */\n  preferredTransports: SubscriptionMode[]\n  /** Subscription key for multicast/AMT: \"(S,G,port)\". */\n  multicastKey?: string\n  /** MoQ track name for unicast subscription. */\n  moqTrackName?: string\n  /** AMT relay address (if AMT is in preference chain). */\n  amtRelay?: string\n  /** MoQ relay URL (for WebTransport subscription). */\n  moqRelayUrl?: string\n}\n\n// ---------------------------------------------------------------------------\n// PIM callbacks (protocol-independent \u2014 transport state only)\n// ---------------------------------------------------------------------------\n\nexport interface SessionManagerCallbacks {\n  /** Fired on every transport state transition. */\n  onStateChange?(trackName: string, from: TrackState, to: TrackState): void\n  /** Fired to suppress/unsuppress unicast for this track (transport arbitration). */\n  onSuppress?(trackName: string, suppressed: boolean): void\n  /**\n   * Fired when a track sat in `joining` for SessionManager.takeoverDeadlineMs\n   * without a RAP (BLO-9413/D9). The session has already returned to `unicast`\n   * (nothing was suppressed, so nothing to restore) and it keeps its FEC\n   * decoder armed, because the multicast socket is still joined and the router\n   * still admits the stream's symbols. The host should abandon the router-side\n   * attempt (e.g. MediaRouter.failbackToMoq()) so the router stops waiting for\n   * a keyframe that is never coming; it must not dispose the decoder here. The\n   * decoder is released on the next transport edge (unsubscribe, failbackAll,\n   * or transportFailed falling back to unicast) through fec-teardown.\n   */\n  onTakeoverTimeout?(trackName: string): void\n}\n\n// ---------------------------------------------------------------------------\n// MMTP application-layer extension (FEC lifecycle, media resets)\n// ---------------------------------------------------------------------------\n\n/**\n * MMTP track events (discriminated union).\n * Each protocol layer defines its own event union \u2014 MMTP events cover\n * media resets, latency, and FEC lifecycle.\n */\nexport type MmtpTrackEvent =\n  | { type: 'reset' }\n  | { type: 'latency'; latencyMs: number }\n  | { type: 'fec-setup' }\n  | { type: 'fec-teardown' }\n\n/**\n * MMTP application-layer extension of SessionManagerCallbacks.\n * Single onTrackEvent dispatches all MMTP-specific events.\n * PIM consumers use the base SessionManagerCallbacks (no onTrackEvent).\n *\n * IWA can define its own subinterface with its own TrackEvent union\n * (e.g., IwaTrackEvent for socket health, AMT state) using the same pattern.\n */\nexport interface MmtpSessionCallbacks extends SessionManagerCallbacks {\n  onTrackEvent?(trackName: string, event: MmtpTrackEvent, config: TrackSessionConfig): void\n}\n\n/**\n * Loss-hysteresis window covering the signaled FEC block span plus jitter.\n *\n * `fecK` no longer feeds the math; it is still validated as a catalog\n * well-formedness guard and kept in the signature for positional API compat\n * (removal is a follow-up with the next cross-repo pin bump).\n */\nexport function computeFecLossWindowMs(fecInterleaveMs: number, fecK: number, jitterBufferMs?: number): number {\n  return computeFecDeliveryWindowMs({\n    interleaveDepthMs: fecInterleaveMs,\n    sourceSymbols: fecK,\n    jitterBufferMs,\n  })\n}\n\nexport interface FecDeliveryWindowConfig {\n  interleaveDepthMs: number\n  sourceSymbols: number\n  repairSymbols?: number\n  symbolSize?: number\n  mediaUnitsPerSecond?: number\n  bandwidthBps?: number\n  /**\n   * Explicit jitter/reorder allowance in ms, added once to the complete span.\n   * Callers pass their signaled catalog allowance, never a local default.\n   */\n  jitterBufferMs?: number\n}\n\n/**\n * The catalog interleaveDepthMs is the complete FEC block span, including the\n * repair tail. K, P, cadence, and bandwidth must not expand it again. Geometry\n * fields remain accepted for existing callers, but do not feed deadline math.\n */\nexport function computeFecDeliveryWindowMs(\n  config: FecDeliveryWindowConfig,\n): number {\n  const fecInterleaveMs = config.interleaveDepthMs\n  const fecK = config.sourceSymbols\n  if (!Number.isFinite(fecInterleaveMs) || fecInterleaveMs <= 0) {\n    throw new Error(\n      `[TrackSession] fecInterleaveMs=${fecInterleaveMs}. ` +\n      `Derive a positive FEC interleave window from the stream catalog.`\n    )\n  }\n  if (!Number.isFinite(fecK) || fecK <= 0) {\n    throw new Error(\n      `[TrackSession] fecK=${fecK}. ` +\n      `Derive a positive FEC source-symbol count from the stream catalog.`\n    )\n  }\n\n  // Absence stays absent; it does not authorize a synthesized reorder budget.\n  if (config.jitterBufferMs === undefined) return Math.ceil(fecInterleaveMs)\n  return fecBlockBudgetMs(fecInterleaveMs, config.jitterBufferMs)\n}\n\n/** Convert the shared FEC delivery deadline into an integer media timescale. */\nexport function computeFecDeliveryWindowMediaUnits(\n  config: FecDeliveryWindowConfig,\n  timestampTimescale: number,\n): number {\n  if (!Number.isFinite(timestampTimescale) || timestampTimescale <= 0) {\n    throw new Error(\n      `[TrackSession] timestampTimescale=${timestampTimescale}. ` +\n      'Derive a positive media timescale from the container.',\n    )\n  }\n  const deliveryWindow = Math.ceil(\n    computeFecDeliveryWindowMs(config) * timestampTimescale / 1000,\n  )\n  if (!Number.isSafeInteger(deliveryWindow)) {\n    throw new Error('[TrackSession] FEC delivery window exceeds the media timestamp range.')\n  }\n  return deliveryWindow\n}\n\n// ---------------------------------------------------------------------------\n// TrackSession\n// ---------------------------------------------------------------------------\n\nexport class TrackSession {\n  readonly config: TrackSessionConfig\n  #state: TrackState = 'idle'\n  #subscription: Subscription | null = null\n  #hysteresisTimer: ReturnType<typeof setTimeout> | null = null\n  #joinDeadlineTimer: ReturnType<typeof setTimeout> | null = null\n  #previousPrimary: SubscriptionMode | null = null\n  #manager: SessionManager\n  // Single suppression authority flag (BLO-9413 failback coherence): every\n  // suppress this session fires is recorded here, and every path that leaves\n  // a suppressed state unwinds through #unsuppress(). Before this flag,\n  // unsubscribe() only un-suppressed from multicast/amt \u2014 a session torn down\n  // from `failing` (exactly where a starving track sits) was re-subscribed to\n  // unicast with the host's media still muted: MoQ playing into a dead sink.\n  #suppressFired = false\n  // Single FEC authority flag: set by the fec-setup edges (joinStarted,\n  // enterUnicastFallback), cleared by the fec-teardown edge in #transition.\n  // Setup and teardown are paired by construction, so a takeover timeout that\n  // parks the session in `unicast` keeps the decoder the still-joined\n  // transport is feeding, and the later unsubscribe still tears it down.\n  #fecArmed = false\n\n  constructor(config: TrackSessionConfig, manager: SessionManager) {\n    this.config = config\n    this.#manager = manager\n  }\n\n  // -----------------------------------------------------------------------\n  // State\n  // -----------------------------------------------------------------------\n\n  get state(): TrackState { return this.#state }\n  get subscription(): Subscription | null { return this.#subscription }\n\n  /** True while this session's onSuppress(true) is outstanding (no matching\n   *  onSuppress(false) yet). Test/assertion surface for failback coherence. */\n  get isSuppressed(): boolean { return this.#suppressFired }\n\n  /** Current active transport mode, or null if idle. */\n  get transport(): SubscriptionMode | null {\n    switch (this.#state) {\n      case 'multicast': return 'multicast'\n      case 'amt': return 'amt'\n      case 'unicast': return 'moq'\n      case 'unicast-fallback': return 'moq' // SSM bridge absent \u2014 MoQ unicast is the only source\n      case 'joining': return 'moq' // MoQ still primary during join\n      case 'failing': return this.#previousPrimary\n      default: return null\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Computed (no magic numbers)\n  // -----------------------------------------------------------------------\n\n  /** Audio worklet latency: max(fecInterleaveMs, frameDurationMs * fecK).\n   *  Returns undefined if frame duration unknown (no initData). */\n  get audioLatencyMs(): number | undefined {\n    const fd = this.frameDurationMs\n    if (fd === undefined) {\n      return this.config.fecInterleaveMs > 0 ? this.config.fecInterleaveMs : undefined\n    }\n    return Math.max(this.config.fecInterleaveMs, fd * this.config.fecK)\n  }\n\n  /** Frame duration in ms, derived from frameSamples + sampleRate. */\n  get frameDurationMs(): number | undefined {\n    const { frameSamples, sampleRate } = this.config\n    if (!frameSamples || !sampleRate || sampleRate <= 0) return undefined\n    return (frameSamples / sampleRate) * 1000\n  }\n\n  // -----------------------------------------------------------------------\n  // Transitions (Patent Claim 9)\n  // -----------------------------------------------------------------------\n\n  /** idle \u2192 unicast: player subscribes to this track. */\n  subscribe(): void {\n    if (this.#state !== 'idle') return\n    this.#transition('unicast')\n\n    // Emit audio latency on first subscribe\n    if (this.config.trackType === 'audio') {\n      const latency = this.audioLatencyMs\n      if (latency !== undefined) {\n        this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'latency', latencyMs: latency }, this.config)\n      }\n    }\n  }\n\n  /** unicast \u2192 joining: multicast/AMT capability detected, join in progress. */\n  joinStarted(): void {\n    if (this.#state !== 'unicast') return\n    this.#transition('joining')\n    // FEC decoders must be ready before multicast data arrives (Claim 9e:\n    // cross-transport repair). A session re-joining after a takeover timeout\n    // still owns its decoder, so fec-setup fires once per FEC epoch.\n    this.#armFec()\n  }\n\n  /**\n   * any non-fallback state \u2192 unicast-fallback. Used when the SSM bridge is\n   * absent (vanilla Chromium / no extension) and the host falls back to a\n   * MoQ unicast subscription per track. Terminal-ish: activateMulticast,\n   * failbackAll, and transportFailed are no-ops while in this state.\n   *\n   * Fires fec-setup so the per-track repair worker spins up \u2014 repair packets\n   * still flow over the MoQ repair-track subscription, so FEC source+repair\n   * can converge as in the multicast path.\n   *\n   * Audio latency is NOT re-emitted here: subscribe() already fires latency\n   * once on the idle \u2192 unicast edge, and enterUnicastFallback is only ever\n   * reached from a non-idle state (SessionManager skips idle sessions).\n   */\n  enterUnicastFallback(): void {\n    if (this.#state === 'unicast-fallback') return\n    this.#clearHysteresis()\n    this.#transition('unicast-fallback')\n    // Suppress the redundant unicast media decoder. On the no-bridge path the\n    // host feeds MoQ-unicast source packets into MulticastManager (the render\n    // consumer); a second base-media subscribe (the @moq/watch decoder) would\n    // split the single connection's QUIC flow-control budget and stall delivery\n    // (BLO-8969). Fire suppress here, on the fallback edge, so the decoder is\n    // gated off before it subscribes rather than after the relay forward task\n    // has already wedged.\n    this.#suppress()\n    this.#armFec()\n  }\n\n  /**\n   * unicast-fallback \u2192 unicast. Called when the SSM bridge appears mid-session\n   * (extension installed after fallback engaged). Host first aborts the fallback\n   * drainers, then transitions sessions back to unicast so the regular\n   * multicast/AMT preference chain can take over via joinStarted().\n   */\n  exitUnicastFallback(): void {\n    if (this.#state !== 'unicast-fallback') return\n    this.#transition('unicast')\n    // Un-suppress the unicast decoder: the bridge appeared mid-session, so the\n    // host tears down the fallback drainers and the regular preference chain\n    // (joinStarted -> joining -> rapReceived) will re-suppress on multicast RAP.\n    this.#unsuppress()\n  }\n\n  /**\n   * joining \u2192 multicast or amt: RAP received on the joined transport (Claim 9d).\n   * Resets audio worklet, then suppresses MoQ.\n   */\n  rapReceived(mode: 'multicast' | 'amt'): void {\n    if (this.#state !== 'joining') return\n    this.#previousPrimary = mode\n    this.#transition(mode)\n    if (this.config.trackType === 'audio') {\n      this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'reset' }, this.config)\n    }\n    this.#suppress()\n  }\n\n  /** multicast/amt \u2192 failing: loss detected, start hysteresis timer (Claim 9f). */\n  lossDetected(): void {\n    if (this.#state !== 'multicast' && this.#state !== 'amt') return\n    this.#previousPrimary = this.#state as SubscriptionMode\n    this.#transition('failing')\n\n    // Hysteresis timer: sustained loss before failback (Claim 9f). Use the\n    // same complete span plus explicit allowance as FECManager and workers.\n    const hysteresisMs = computeFecLossWindowMs(\n      this.config.fecInterleaveMs,\n      this.config.fecK,\n      this.config.fecReorderToleranceMs,\n    )\n    this.#hysteresisTimer = setTimeout(() => {\n      this.hysteresisExpired()\n    }, hysteresisMs)\n  }\n\n  /** failing \u2192 previous primary: loss recovered within hysteresis window. */\n  lossRecovered(): void {\n    if (this.#state !== 'failing') return\n    this.#clearHysteresis()\n    if (this.#previousPrimary) {\n      this.#transition(this.#previousPrimary as TrackState)\n    }\n  }\n\n  /**\n   * Transport failed (AMT relay down, multicast interface gone).\n   * Try next transport in preference chain.\n   */\n  transportFailed(): void {\n    this.#clearHysteresis()\n    // Unicast-fallback is terminal: the host owns the subscription and\n    // SessionManager transport machinery does not arbitrate it.\n    if (this.#state === 'unicast-fallback') return\n    const current = this.#previousPrimary ?? this.transport\n    const prefs = this.config.preferredTransports\n    const currentIdx = current ? prefs.indexOf(current) : -1\n    const nextMode = prefs[currentIdx + 1]\n\n    if (nextMode !== undefined && nextMode !== 'moq') {\n      // Next is multicast or AMT: start joining. `joining` means MoQ is\n      // primary again (see transport getter), so if the failed transport had\n      // suppressed unicast, restore it for the join window or the viewer\n      // watches black video until the next RAP (which may never come).\n      // The chain position moves with the attempt: a join that times out\n      // parks the session in `unicast` with this transport recorded, so the\n      // next failure continues past it rather than re-trying the transport\n      // that already failed and re-firing onTakeoverTimeout on every lap.\n      this.#previousPrimary = nextMode\n      this.#transition('joining')\n      this.#unsuppress()\n      return\n    }\n    // MoQ is next, or the chain is exhausted: unicast either way (Claim 9g).\n    // For a session parked in `unicast` with its decoder retained after a\n    // takeover timeout, this transition is a self-edge and fires no teardown,\n    // so the release is explicit. It is the \"transportFailed falling back to\n    // unicast\" release path the onTakeoverTimeout doc names, and #disarmFec is\n    // idempotent, so it is a no-op when the transition already fired the\n    // teardown. The audio reset is not flag-guarded, so it is tied to the edge\n    // itself: a session already resting in unicast changed no transport and\n    // owes the host no reset, however many pool subscriptions fail for it.\n    const from = this.#state\n    this.#previousPrimary = null\n    this.#transition('unicast')\n    this.#disarmFec()\n    this.#unsuppress()\n    if (from !== 'unicast' && this.config.trackType === 'audio') {\n      this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'reset' }, this.config)\n    }\n  }\n\n  /** Hysteresis expired \u2192 failback to next transport (Claim 9g). */\n  hysteresisExpired(): void {\n    if (this.#state !== 'failing') return\n    this.#clearHysteresis()\n    this.transportFailed()\n  }\n\n  /** \u2192 idle: player unsubscribes / tab close / cleanup. */\n  unsubscribe(): void {\n    this.#clearHysteresis()\n    if (this.#state !== 'idle') {\n      this.#transition('idle')\n      // Unwind any outstanding suppression regardless of which state we left.\n      // The old `wasActive` check (multicast/amt only) leaked suppression when\n      // tearing down from `failing` or `unicast-fallback` \u2014 failbackAll()'s\n      // unsubscribe\u2192subscribe cycle then re-entered unicast with the host's\n      // media still muted (BLO-9413 freeze: \"failing back\" logged, video dead).\n      this.#unsuppress()\n    }\n  }\n\n  /** True when SessionManager.enterUnicastFallback put this track into the\n   *  host-driven unicast subscription mode. Host can iterate sessions to\n   *  decide whether to keep its fallback drainer alive across MediaRouter\n   *  arbitration events. */\n  get isUnicastFallback(): boolean {\n    return this.#state === 'unicast-fallback'\n  }\n\n  /**\n   * True while this track owns a FEC decoder (fec-setup fired, fec-teardown\n   * not yet). Stays true across a takeover timeout that parked the session in\n   * `unicast`; SessionManager.failbackAll uses it to release such sessions.\n   */\n  get isFecArmed(): boolean {\n    return this.#fecArmed\n  }\n\n  /**\n   * Start the deadline a `joining` entry deferred while the join was inactive\n   * (SessionManager.joinActive). The track gets the FULL deadline from here,\n   * because that is when media can first arrive. No-op outside `joining` and\n   * when a deadline is already running, so it never shortens or restarts one.\n   *\n   * The `joinActive` guard is what makes this safe to call from anywhere: a\n   * track parked in `joining` with a deferred (null) timer satisfies the other\n   * two, so without it a host calling this while the join is still inactive\n   * would arm the exact deadline the gate exists to defer -- silently\n   * reinstating BLO-34289. It is a no-op for the internal caller, which writes\n   * `#joinActive = true` before iterating the sessions.\n   */\n  armDeferredJoinDeadline(): void {\n    if (this.#state !== 'joining' || this.#joinDeadlineTimer !== null) return\n    if (!this.#manager.joinActive) return\n    this.#armJoinDeadline(this.#manager.takeoverDeadlineMs)\n  }\n\n  dispose(): void {\n    this.#clearHysteresis()\n    this.#clearJoinDeadline()\n    this.#state = 'idle'\n    this.#subscription = null\n    // Release through the teardown edge, not a bare assignment: the\n    // retained-FEC park makes `unicast` + isFecArmed a resting state, and\n    // SessionManager.dispose() calls this directly (removeTrack() reaches it\n    // via unsubscribe(), which has already disarmed). A bare assignment there\n    // drops the host's decoder without a fec-teardown -- a leaked Worker.\n    this.#disarmFec()\n  }\n\n  // -----------------------------------------------------------------------\n  // Internal\n  // -----------------------------------------------------------------------\n\n  #transition(to: TrackState, opts?: { retainFec?: boolean }): void {\n    const from = this.#state\n    if (from === to) return\n    // Takeover deadline (BLO-9413/D9): every entry into `joining` arms it\n    // (joinStarted AND transportFailed-failover both route through here);\n    // every exit cancels it. Without this, a transport that accepts the\n    // subscribe but never delivers a RAP parks the session in `joining`\n    // forever (observed live in the Phase-0 headless repro). The value is\n    // resolved before any state write, so the one residual failure -- a\n    // manager whose deadline was never set at all, which addTrack() refuses --\n    // leaves the session in its previous state rather than half-transitioned.\n    // Invalid values never reach here: SessionManager's setter refuses them.\n    // The read is unconditional even when `joinActive` defers the arm, so a\n    // manager without a deadline still fails closed on every joining edge.\n    const joinDeadlineMs = to === 'joining' ? this.#manager.takeoverDeadlineMs : undefined\n    this.#state = to\n    if (from === 'joining') this.#clearJoinDeadline()\n    if (joinDeadlineMs !== undefined && this.#manager.joinActive) {\n      this.#armJoinDeadline(joinDeadlineMs)\n    }\n    // FEC teardown: entering a state without a FEC decoder releases the one\n    // this track armed, unless the caller keeps it (takeover timeout: the\n    // transport is still joined and still feeding the decoder).\n    const fecActive = (s: TrackState) =>\n      s === 'joining' ||\n      s === 'multicast' ||\n      s === 'amt' ||\n      s === 'failing' ||\n      s === 'unicast-fallback'\n    if (!fecActive(to) && !opts?.retainFec) this.#disarmFec()\n    this.#manager.callbacks?.onStateChange?.(this.config.trackName, from, to)\n  }\n\n  #clearHysteresis(): void {\n    if (this.#hysteresisTimer !== null) {\n      clearTimeout(this.#hysteresisTimer)\n      this.#hysteresisTimer = null\n    }\n  }\n\n  #armJoinDeadline(deadlineMs: number): void {\n    this.#clearJoinDeadline()\n    if (deadlineMs === 0) return // a declared 0 disables the deadline\n    this.#joinDeadlineTimer = setTimeout(() => {\n      this.#joinDeadlineTimer = null\n      if (this.#state !== 'joining') return\n      // No RAP within the deadline: return to unicast for arbitration only.\n      // MoQ was never suppressed in `joining`, so there is nothing to restore\n      // and this edge stays silent on onSuppress (asserted in tests). The\n      // multicast socket is still joined and the router still admits this\n      // stream's symbols, so the FEC decoder stays armed; the next transport\n      // edge releases it.\n      this.#transition('unicast', { retainFec: true })\n      this.#manager.callbacks?.onTakeoverTimeout?.(this.config.trackName)\n    }, deadlineMs)\n  }\n\n  #clearJoinDeadline(): void {\n    if (this.#joinDeadlineTimer !== null) {\n      clearTimeout(this.#joinDeadlineTimer)\n      this.#joinDeadlineTimer = null\n    }\n  }\n\n  /** Fire fec-setup exactly once per FEC epoch. */\n  #armFec(): void {\n    if (this.#fecArmed) return\n    this.#fecArmed = true\n    this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'fec-setup' }, this.config)\n  }\n\n  /** Fire fec-teardown for an armed decoder; no-op when none is armed. */\n  #disarmFec(): void {\n    if (!this.#fecArmed) return\n    this.#fecArmed = false\n    this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'fec-teardown' }, this.config)\n  }\n\n  /** Fire onSuppress(true) exactly once per suppression epoch. */\n  #suppress(): void {\n    if (this.#suppressFired) return\n    this.#suppressFired = true\n    this.#manager.callbacks?.onSuppress?.(this.config.trackName, true)\n  }\n\n  /** Unwind an outstanding suppression; no-op when none is outstanding. */\n  #unsuppress(): void {\n    if (!this.#suppressFired) return\n    this.#suppressFired = false\n    this.#manager.callbacks?.onSuppress?.(this.config.trackName, false)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// SessionManager\n// ---------------------------------------------------------------------------\n\n/**\n * Largest takeover deadline setTimeout represents faithfully. setTimeout\n * coerces its delay to a signed 32-bit int, so a larger value fires on the\n * next tick (Node also warns TimeoutOverflowWarning) instead of after the\n * window the host asked for -- silently inverting the feature. Rejecting it\n * keeps the classic units bug (seconds-as-ms, a wrong timescale) loud.\n */\nexport const MAX_TAKEOVER_DEADLINE_MS = 2_147_483_647\n\n/**\n * How long `joinActive` may stay false before the library says so. The deferral\n * is unbounded by construction -- that is the feature -- so a host that never\n * flips it back parks every track in `joining` with no timer at all: exactly the\n * forever-join the takeover deadline exists to prevent, only silent. MoQ stays\n * unsuppressed so the viewer sees video, but onTakeoverTimeout never fires, the\n * FEC decoder stays armed, and the preference chain never advances past the\n * transport that failed. It looks like a slow join. A host is one un-awaited\n * rejection between `false` and `true` away from it, so the library complains\n * rather than trusting every future host to get all of its exit paths right.\n *\n * Generous against a genuinely slow subscribe -- a bridge reconnect or AMT relay\n * handshake is seconds -- so anything still unsettled here is broken, not slow.\n */\nexport const JOIN_DEFER_WARN_MS = 30_000\n\nexport class SessionManager {\n  readonly pool: TransportPool\n  readonly sessions = new Map<string, TrackSession>()\n  callbacks: SessionManagerCallbacks | null = null\n  #takeoverDeadlineMs: number | undefined = undefined\n  #joinActive = true\n  #joinDeferWarnTimer: ReturnType<typeof setTimeout> | null = null\n\n  /**\n   * Takeover deadline (BLO-9413/D9): the time a session may sit in `joining`\n   * without a RAP before returning to `unicast` and firing onTakeoverTimeout.\n   * MoQ is never suppressed during `joining`, so expiry abandons the takeover\n   * without a playback glitch. The host derives it from the catalog (RAP\n   * cadence from groupDurationTicks/timescale plus the signaled FEC delivery\n   * window or reorder tolerance) and sets it before addTrack(). There is no\n   * default: an unset value fails addTrack() closed, and reading the getter\n   * before assignment throws the same way, so no host ever holds a\n   * `number | undefined` it could coalesce back into a default.\n   * `hasTakeoverDeadline` answers whether one was admitted. A declared 0\n   * disables the deadline. The value is an integer number of milliseconds:\n   * setTimeout truncates fractions, so a host that divides ticks by a\n   * timescale must round before assigning.\n   *\n   * Assignment validates, so the diagnostic lands at the host's own call site.\n   * That is what bounds the blast radius: `joining` is entered from\n   * joinStarted(), from the transportFailed() failover branch -- itself\n   * reachable from a setTimeout via hysteresisExpired(), where no caller could\n   * catch a throw -- and from the activateMulticast()/activateAmt()/pool-failure\n   * loops, where a throw on one session would abandon its siblings mid-loop\n   * (the split-brain those loops exist to prevent). Refusing a bad value at\n   * assignment means no host mutation can make an already-admitted session\n   * throw out of a transport edge.\n   */\n  get takeoverDeadlineMs(): number {\n    return this.#requireTakeoverDeadlineMs()\n  }\n\n  set takeoverDeadlineMs(value: number) {\n    if (!Number.isInteger(value) || value < 0 || value > MAX_TAKEOVER_DEADLINE_MS) {\n      throw new Error(\n        `[SessionManager] takeoverDeadlineMs must be an integer from 0 to ${MAX_TAKEOVER_DEADLINE_MS} (0 disables it, larger values overflow setTimeout); got ${String(value)}`,\n      )\n    }\n    this.#takeoverDeadlineMs = value\n  }\n\n  /** True once the host has admitted a deadline; a declared 0 counts. */\n  get hasTakeoverDeadline(): boolean {\n    return this.#takeoverDeadlineMs !== undefined\n  }\n\n  /**\n   * Whether the transport the joining tracks are waiting on is actually\n   * subscribed. The takeover deadline is a media-arrival budget and media\n   * cannot arrive before the join exists, so while this is false, entering\n   * `joining` arms no deadline; flipping it true starts the FULL deadline for\n   * every track already parked there.\n   *\n   * Default true, which is the arm-on-`joining` behaviour every host had\n   * before: a host that only calls joinStarted() after its own join resolves\n   * (moqtail-private's player, post-BLO-33339) is already at the right edge and\n   * needs no gate. A host that arms joinStarted() up front \u2014 to have FEC\n   * decoders ready before the first datagram \u2014 sets this false before addTrack()\n   * and true when its subscribe settles. Charging a slow subscribe (bridge\n   * reconnect, AMT relay handshake) against the media budget expired the\n   * deadline before the subscription existed and abandoned the join on the\n   * happy path. BLO-34289.\n   *\n   * The deadline is a media budget (group cadence plus FEC delivery window) and\n   * budgets nothing for reaching the stream, so ideally it starts at\n   * MulticastTransport.onDataPlaneLive, the join's first accepted packet. Over\n   * AMT that is measurably later than a settled subscribe: the subscribe\n   * settles once the gateway has sent its Membership Update, and the relay's\n   * upstream join plus a path RTT (0.4-0.8 s measured to the prod relay) still\n   * precede the first packet. But RFC 7450 gives a gateway no signal that the\n   * relay has traffic for its (S,G), so a join whose source never sends never\n   * reaches that edge. Starting the deadline there is therefore sound only when\n   * the provider bounds the join phase itself, with a typed subscription error\n   * for a join that delivers nothing (MulticastTransport forwards it to\n   * onFailback). A host whose provider makes no such guarantee flips this true\n   * when the subscribe settles and accepts that join latency is charged to the\n   * media budget; holding it until the first packet would park a silent join\n   * in `joining` forever.\n   *\n   * The flag tracks the host's primary join, not per-track transport state. A\n   * track that fails over to the next transport in its own chain while this is\n   * false (transportFailed's failover branch also enters `joining`) has that\n   * deadline gated on the primary join activating, not on its own transport.\n   * Under the documented usage -- false once at setup, true once the subscribe\n   * settles -- the two coincide.\n   *\n   * The gate is on the ENTRY into `joining`, and false cannot take back a\n   * deadline already running: the `true -> false` edge arms the warn below and\n   * clears nothing. So set it false BEFORE the `joining` entry it is meant to\n   * gate. A host that instead flipped it false after a `transportFailed()`\n   * failover had already entered `joining` would leave the full deadline\n   * counting against a subscribe that had not begun -- BLO-34289 again, on the\n   * failover edge. Clearing running deadlines on that edge is deliberately NOT\n   * done: this flag is manager-wide, so one transport's brief false would\n   * cancel an unrelated track's live deadline and then re-arm it at FULL length\n   * on the next activation (armDeferredJoinDeadline sees `joining` + a null\n   * timer and cannot tell a cleared deadline from a deferred one). Every\n   * unrelated transport blip would restart the whole budget, so under repeated\n   * failover a track that should have timed out is extended indefinitely and\n   * never advances. Only a false that never returns true loses the timer\n   * outright, and JOIN_DEFER_WARN_MS already covers that.\n   *\n   * Leaving this false is not free: see JOIN_DEFER_WARN_MS.\n   */\n  get joinActive(): boolean {\n    return this.#joinActive\n  }\n\n  set joinActive(active: boolean) {\n    const wasActive = this.#joinActive\n    this.#joinActive = active\n    if (!active) {\n      // Edge-triggered: a host re-declaring false has not restarted its\n      // subscribe, and total deferral is what the warning is about.\n      if (wasActive) this.#armJoinDeferWarn()\n      return\n    }\n    this.#clearJoinDeferWarn()\n    if (wasActive) return\n    for (const [, session] of this.sessions) session.armDeferredJoinDeadline()\n  }\n\n  #armJoinDeferWarn(): void {\n    this.#joinDeferWarnTimer = setTimeout(() => {\n      this.#joinDeferWarnTimer = null\n      const deferred = [...this.sessions.values()].filter(s => s.state === 'joining').length\n      console.warn(\n        `[SessionManager] joinActive has been false for ${JOIN_DEFER_WARN_MS} ms and ${deferred} track(s) sit in 'joining' with no takeover deadline. Set joinActive = true when the subscribe settles, on every exit path including failures, or these tracks never time out, never release their FEC decoders, and never advance to the next transport.`,\n      )\n    }, JOIN_DEFER_WARN_MS)\n  }\n\n  #clearJoinDeferWarn(): void {\n    if (this.#joinDeferWarnTimer === null) return\n    clearTimeout(this.#joinDeferWarnTimer)\n    this.#joinDeferWarnTimer = null\n  }\n\n  /** Narrow to MMTP callbacks (onTrackEvent). Safe \u2014 optional chaining handles PIM-only consumers. */\n  get mmtp(): MmtpSessionCallbacks | null {\n    return this.callbacks as MmtpSessionCallbacks | null\n  }\n\n  constructor(poolOptions?: TransportPoolOptions) {\n    this.pool = new TransportPool(poolOptions)\n\n    // Wire pool failure \u2192 per-track failover\n    this.pool.onSubscriptionFailed(sub => {\n      for (const trackName of sub.consumers) {\n        const session = this.sessions.get(trackName)\n        if (session) session.transportFailed()\n      }\n    })\n  }\n\n  // -----------------------------------------------------------------------\n  // Track management\n  // -----------------------------------------------------------------------\n\n  /**\n   * The admitted takeover deadline. Throws only when the host never set one,\n   * every other invalid value being refused by the setter, and returns a\n   * declared 0 as 0. The getter and addTrack() both route through it, so a\n   * session cannot exist without an admitted deadline, which is what makes\n   * the #transition() read unable to throw on an already-admitted session.\n   */\n  #requireTakeoverDeadlineMs(): number {\n    const value = this.#takeoverDeadlineMs\n    if (value === undefined) {\n      throw new Error(\n        '[SessionManager] takeoverDeadlineMs is unset; set a catalog-derived takeover deadline (0 disables it) before adding tracks',\n      )\n    }\n    return value\n  }\n\n  /** Add a track session from catalog config. */\n  addTrack(config: TrackSessionConfig): TrackSession {\n    if (this.sessions.has(config.trackName)) {\n      throw new Error(`[SessionManager] Track \"${config.trackName}\" already exists`)\n    }\n    this.#requireTakeoverDeadlineMs()\n    const session = new TrackSession(config, this)\n    this.sessions.set(config.trackName, session)\n    return session\n  }\n\n  /** Remove a track session. Releases subscription with grace period. */\n  removeTrack(trackName: string): void {\n    const session = this.sessions.get(trackName)\n    if (!session) return\n    session.unsubscribe()\n\n    // Release pool subscription\n    const subKey = session.config.multicastKey ?? session.config.moqTrackName\n    if (subKey) this.pool.releaseSubscription(subKey, trackName)\n\n    session.dispose()\n    this.sessions.delete(trackName)\n  }\n\n  // -----------------------------------------------------------------------\n  // Atomic multi-track operations\n  // -----------------------------------------------------------------------\n\n  /**\n   * All tracks with multicast RAP \u2192 multicast state (atomic).\n   * Called when MediaRouter fires onSourceSwitch('multicast').\n   * Prevents split-brain between video and audio.\n   *\n   * A takeover deadline can return a track from `joining` to `unicast` while\n   * the multicast socket keeps delivering packets and the track keeps its FEC\n   * decoder armed. If a valid RAP arrives later, that late-RAP edge suppresses\n   * unicast and promotes multicast without a second fec-setup.\n   */\n  activateMulticast(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'unicast') {\n        session.joinStarted()\n      }\n      if (session.state === 'joining') {\n        session.rapReceived('multicast')\n      }\n    }\n  }\n\n  /**\n   * All tracks with AMT RAP \u2192 amt state (atomic).\n   */\n  activateAmt(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'unicast') {\n        session.joinStarted()\n      }\n      if (session.state === 'joining') {\n        session.rapReceived('amt')\n      }\n    }\n  }\n\n  /**\n   * All tracks \u2192 unicast (failback, atomic).\n   * Called when MulticastManager fires onFailback().\n   * unicast-fallback sessions are skipped \u2014 the host owns those subscriptions\n   * and they must drain uninterrupted across transport-state events.\n   *\n   * Coherence invariant (BLO-9413): after this returns, every non-fallback\n   * session is `unicast` (or `idle`), unsuppressed, and without a FEC decoder.\n   * unsubscribe() unwinds any outstanding suppression regardless of the state\n   * it tears down from (`failing` included; see TrackSession.#suppressFired),\n   * and a session that a takeover timeout parked in `unicast` with its decoder\n   * still armed is cycled too, because this transport edge is what releases\n   * that decoder (unsubscribe fires fec-teardown).\n   */\n  failbackAll(): void {\n    for (const [, session] of this.sessions) {\n      const parkedWithFec = session.state === 'unicast' && session.isFecArmed\n      if (\n        parkedWithFec ||\n        (session.state !== 'idle' &&\n          session.state !== 'unicast' &&\n          session.state !== 'unicast-fallback')\n      ) {\n        session.unsubscribe()\n        session.subscribe() // re-enter unicast\n      }\n    }\n  }\n\n  /**\n   * All tracks \u2192 unicast-fallback (atomic).\n   * Called by the host when the multicast gateway is absent and\n   * the player will subscribe to source tracks over MoQ unicast and feed\n   * packets via MulticastManager.feedUnicastSource() (or manager.router\n   * directly). Sessions in this state stay terminal until the host calls\n   * unsubscribe() / disposes the SessionManager.\n   */\n  enterUnicastFallback(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'idle') continue\n      session.enterUnicastFallback()\n    }\n  }\n\n  /**\n   * True if any session is currently in unicast-fallback. Hosts use this to\n   * gate `multicastTrack.close()` on failback events \u2014 closing the shared\n   * broadcast would kill the host's fallback drainers.\n   */\n  hasActiveFallback(): boolean {\n    for (const [, session] of this.sessions) {\n      if (session.isUnicastFallback) return true\n    }\n    return false\n  }\n\n  /**\n   * All fallback tracks \u2192 unicast (atomic).\n   * Called when the SSM bridge appears mid-session and the host has aborted\n   * the fallback drainers. The session re-enters the regular preference chain\n   * via joinStarted() (issued by the host immediately after).\n   */\n  exitUnicastFallback(): void {\n    for (const [, session] of this.sessions) {\n      if (session.isUnicastFallback) session.exitUnicastFallback()\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Cleanup lifecycle\n  // -----------------------------------------------------------------------\n\n  /** Tab closed \u2014 release all subscriptions for this tab (grace period). */\n  tabClosed(tabId: string): void {\n    // All tracks owned by this tab \u2192 idle\n    for (const [trackName, session] of this.sessions) {\n      session.unsubscribe()\n      this.pool.releaseAllForConsumer(trackName)\n    }\n  }\n\n  /** Bridge WebTransport connection dropped \u2014 same as tab close. */\n  bridgeDisconnected(): void {\n    this.tabClosed('bridge')\n  }\n\n  /**\n   * Track selection changed (user or ABR).\n   * Old track released (grace period), new track subscribed.\n   */\n  trackSelectionChanged(oldTrackName: string, newConfig: TrackSessionConfig): void {\n    this.removeTrack(oldTrackName)\n    const session = this.addTrack(newConfig)\n    session.subscribe()\n  }\n\n  // -----------------------------------------------------------------------\n  // Query\n  // -----------------------------------------------------------------------\n\n  /** Get a track session by name. */\n  getTrack(trackName: string): TrackSession | undefined {\n    return this.sessions.get(trackName)\n  }\n\n  // -----------------------------------------------------------------------\n  // Cleanup\n  // -----------------------------------------------------------------------\n\n  dispose(): void {\n    this.#clearJoinDeferWarn()\n    for (const [, session] of this.sessions) {\n      session.dispose()\n    }\n    this.sessions.clear()\n    this.pool.dispose()\n    this.callbacks = null\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;AA4WA,SAAS,kBAAkB,OAAiB;AAC3C,QAAM,QAAQ,CAAC,cAAc;AAC7B,MAAI,MAAM;AAAS,UAAM,KAAK,MAAM,OAAO;AAC3C,MAAI,MAAM,UAAU;AACnB,UAAMA,YAAW,CAAC,MAAM,QAAQ;AAChC,QAAI,MAAM;AAAQ,MAAAA,UAAS,KAAK,OAAO,MAAM,MAAM,CAAC;AACpD,QAAI,MAAM;AAAO,MAAAA,UAAS,KAAK,OAAO,MAAM,KAAK,CAAC;AAClD,UAAM,KAAK,MAAMA,UAAS,KAAK,GAAG,CAAC,EAAE;EACtC;AACA,MAAI,MAAM,iBAAiB,OAAO;AACjC,QAAI,MAAM,MAAM,WAAW,MAAM,MAAM,YAAY,MAAM,SAAS;AACjE,YAAM,KAAK,MAAM,MAAM,OAAO;IAC/B;AACA,QAAI,MAAM,MAAM;AAAO,YAAM,KAAK,MAAM,MAAM,KAAK;EACpD,WAAW,MAAM,SAAS,MAAM;AAC/B,UAAM,KAAK,OAAO,MAAM,KAAK,CAAC;EAC/B;AACA,SAAO,MAAM,KAAK,IAAI;AACvB;AAEA,SAAS,yBAAyB,OAAmB;AACpD,QAAM,OAAO,MAAM;AACnB,QAAM,SACL,QAAQ,OAAO,KACd,gBAAgB,QAAQ,KAAK,KAAK,OAAO,KACxC,KAAK,OAAO,UAAU,SAAS,KAAK,IAAI,CAAC;AAC5C,SAAO,4DAA4D,MAAM;AAC1E;AAvYA,IAqBa;AArBb;;;AAqBM,IAAO,kBAAP,MAAsB;MAClB;MACT,WAAkE;MAClE,cAAuD;MACvD,iBAA6D;MAC7D,qBAAqD;MACrD,WAA0E;MAC1E,mBAAuC;MACvC,qBAAqB,oBAAI,IAAG;MAC5B,iBAAiB;MACjB,eAAe;MACf,YAAY;;;;;MAKZ,kBAAsC,CAAA;MACtC,mBAAmC,CAAA;MACnC,eAAe;;MAEf,gBAAgB;;;;MAIhB,yBAAyB;MACzB,0BAA0B;;;;;MAM1B,YAAY,aAAyB;AACpC,YAAI,uBAAuB,KAAK;AAC/B,eAAK,UAAU,IAAI,OAAO,aAAa,EAAE,MAAM,SAAQ,CAAE;QAC1D,OAAO;AACN,eAAK,UAAU;QAChB;AACA,aAAK,QAAQ,YAAY,CAAC,MACzB,KAAK,aAAa,EAAE,IAAI;AACzB,aAAK,QAAQ,UAAU,CAAC,MAAK;AAC5B,eAAK,WAAW,kBAAkB,CAAC,GAAG,gBAAgB;QACvD;AACA,aAAK,QAAQ,iBAAiB,CAAC,MAAK;AACnC,eAAK,WAAW,yBAAyB,CAAC,GAAG,gBAAgB;QAC9D;MACD;;;;;;;;MASA,UACC,QACA,YACA,eACA,gBAAmC;AAEnC,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,4BAA4B;AAChE,aAAK,cAAa;AAClB,cAAM,MAAwB;UAC7B,MAAM;UACN;UACA;UACA;UACA;;AAKD,cAAM,eAA+B,CAAA;AACrC,YAAI;AAAe,uBAAa,KAAK,aAAa;AAElD,aAAK,QAAQ,YAAY,KAAK,YAAY;MAC3C;;;;;;;;;;;MAYA,WACC,MACA,MACA,IACA,MAAgD;AAEhD,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,mDAAmD;AACvF,YAAI,MAAM;AACT,eAAK,aACJ;YACC,MAAM;YACN;YACA;YACA;YACA,UAAU,KAAK;YACf,gBAAgB,KAAK;aAEtB,MACA,KAAK,IAAI;QAEX,OAAO;AACN,eAAK,aAAa,EAAE,MAAM,cAAc,MAAM,MAAM,GAAE,GAAI,IAAI;QAC/D;MACD;;;;;;;;;;;MAYA,WACC,SACA,WACA,MACA,MACA,IAAU;AAEV,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,mDAAmD;AACvF,aAAK,aAAa,EAAE,MAAM,cAAc,SAAS,WAAW,MAAM,MAAM,GAAE,GAAI,IAAI;MACnF;MAEA,aAAa,QAA0B,MAAmB,MAAkB;AAC3E,YAAI,CAAC,KAAK,eAAe;AACxB,eAAK,QAAQ,YAAY,QAAQ,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC;AAC7D;QACD;AACA,aAAK,gBAAgB,KAAK,MAAM;AAChC,aAAK,iBAAiB,KAAK,IAAI;AAC/B,YAAI;AAAM,eAAK,iBAAiB,KAAK,IAAI;AACzC,YAAI,KAAK;AAAc;AACvB,aAAK,eAAe;AACpB,uBAAe,MAAK;AACnB,eAAK,eAAe;AACpB,eAAK,cAAa;QACnB,CAAC;MACF;;;;;MAMA,gBAAa;AACZ,YAAI,KAAK,gBAAgB,WAAW,KAAK,KAAK;AAAW;AACzD,cAAM,UAAU,KAAK;AACrB,cAAM,WAAW,KAAK;AACtB,aAAK,kBAAkB,CAAA;AACvB,aAAK,mBAAmB,CAAA;AACxB,aAAK,QAAQ,YACZ,EAAE,MAAM,eAAe,QAAO,GAC9B,QAAQ;MAEV;;;;MAKA,cAAc,KAAa,KAAkB,MAAiB;AAC7D,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,sDAAsD;AAC1F,aAAK,cAAa;AAClB,aAAK,QAAQ,YACZ,EAAE,MAAM,iBAAiB,KAAK,KAAK,KAAI,GACvC,CAAC,KAAK,IAAI,CAAC;MAEb;;;;;;;;MASA,QAAQ,YAAkB;AACzB,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,gDAAgD;AACpF,YACC,CAAC,OAAO,UAAU,UAAU,KAC5B,aAAa,KACb,aAAa,YACZ;AACD,gBAAM,IAAI,MAAM,iDAAiD;QAClE;AACA,YAAI,KAAK,kBAAkB;AAC1B,eAAK,mBAAmB,IAAI,UAAU;AACtC;QACD;AACA,aAAK,aAAa,oBAAI,IAAI,CAAC,UAAU,CAAC,CAAC;MACxC;;MAGA,QAAK;AACJ,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,8CAA8C;AAClF,aAAK,cAAa;AAClB,aAAK;AACL,aAAK,mBAAmB;AACxB,aAAK,mBAAmB,MAAK;AAC7B,aAAK,QAAQ,YAAY,EAAE,MAAM,QAAO,CAA6B;MACtE;MAEA,aAAa,MAAiB;AAG7B,aAAK,cAAa;AAClB,aAAK,mBAAmB;AACxB,cAAM,cAAc,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AAClD,aAAK,QAAQ,YACZ,EAAE,MAAM,WAAW,MAAM,YAAW,CAA6B;MAEnE;;MAGA,QAAQ,IAAgD;AACvD,aAAK,WAAW;MACjB;;MAGA,WAAW,IAAkC;AAC5C,aAAK,cAAc;MACpB;;;;;;;MAQA,cAAc,IAAqC;AAClD,aAAK,iBAAiB;AACtB,aAAK,uBAAsB;MAC5B;MAEA,yBAAsB;AACrB,YACC,KAAK,aACL,KAAK,2BACL,CAAC,KAAK,0BACN,CAAC,KAAK;AACL;AACF,aAAK,0BAA0B;AAC/B,aAAK,QAAQ,YACZ,EAAE,MAAM,wBAAuB,CAA6B;MAE9D;;MAGA,kBAAkB,IAAyB;AAC1C,aAAK,qBAAqB;MAC3B;;MAGA,QAAQ,IAAwD;AAC/D,aAAK,WAAW;MACjB;;;;;;;MAQA,IAAI,WAAQ;AACX,eAAO,KAAK;MACb;;;;;MAMA,UAAO;AACN,YAAI,KAAK;AAAW;AACpB,aAAK,YAAY;AAEjB,aAAK,kBAAkB,CAAA;AACvB,aAAK,mBAAmB,CAAA;AACxB,aAAK,mBAAmB;AACxB,aAAK,mBAAmB,MAAK;AAC7B,aAAK,QAAQ,YAAY,EAAE,MAAM,UAAS,CAA6B;AACvE,aAAK,QAAQ,UAAS;MACvB;MAEA,aAAa,OAAqB;AACjC,YAAI,MAAM,SAAS,gBAAgB;AAClC,cAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,aAAa,GAAG;AAC5E,iBAAK,gBAAgB;UACtB;AACA,cAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,uBAAuB,GAAG;AACtF,iBAAK,yBAAyB;AAC9B,iBAAK,uBAAsB;UAC5B;AACA;QACD;AACA,YAAI,MAAM,SAAS,iBAAiB;AACnC,eAAK,iBAAiB,KAAK,IAAI,GAAG,KAAK,iBAAiB,CAAC;AACzD,eAAK,eAAe;AACpB;QACD;AACA,YAAI,MAAM,SAAS,SAAS;AAC3B,cAAI,MAAM,SAAS,gBAAgB;AAClC,iBAAK,iBAAiB,KAAK,IAAI,GAAG,KAAK,iBAAiB,CAAC;AACzD,iBAAK,eAAe;UACrB;AACA,cAAI,MAAM;AAAM,iBAAK,WAAW,MAAM,SAAS,MAAM,IAAI;;AACpD,iBAAK,WAAW,MAAM,OAAO;AAClC;QACD;AACA,YAAI,KAAK,iBAAiB,KAAK,KAAK;AAAc;AAClD,gBAAQ,MAAM,MAAM;UACnB,KAAK;AACJ,iBAAK,WAAW,MAAM,MAAM,MAAM,IAAI;AACtC;UACD,KAAK;AACJ,iBAAK,cAAc,MAAM,KAAK;AAC9B;UACD,KAAK;AACJ,iBAAK,iBAAiB,MAAM,KAAK;AACjC;UACD,KAAK;AACJ,uBAAW,OAAO,MAAM,MAAM;AAC7B,mBAAK,qBAAqB,GAAG;YAC9B;AACA,iBAAK,mBAAmB;AACxB,gBAAI,KAAK,mBAAmB,OAAO,GAAG;AACrC,oBAAM,OAAO,KAAK;AAClB,mBAAK,qBAAqB,oBAAI,IAAG;AACjC,mBAAK,aAAa,IAAI;YACvB;AACA;QACF;MACD;;;;;;ACvJD,SAASC,mBAAkB,OAAiB;AAC3C,QAAM,QAAQ,CAAC,cAAc;AAC7B,MAAI,MAAM;AAAS,UAAM,KAAK,MAAM,OAAO;AAC3C,MAAI,MAAM,UAAU;AACnB,UAAM,MAAM,CAAC,MAAM,QAAQ;AAC3B,QAAI,MAAM;AAAQ,UAAI,KAAK,OAAO,MAAM,MAAM,CAAC;AAC/C,QAAI,MAAM;AAAO,UAAI,KAAK,OAAO,MAAM,KAAK,CAAC;AAC7C,UAAM,KAAK,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE;EACjC;AACA,MAAI,MAAM,iBAAiB,SAAS,MAAM,MAAM;AAAO,UAAM,KAAK,MAAM,MAAM,KAAK;AACnF,SAAO,MAAM,KAAK,IAAI;AACvB;AA7NA,IA+Da,sBAEA;AAjEb;;;AA+DO,IAAM,uBAAuB;AAE9B,IAAO,oBAAP,MAAwB;MACpB;MACT,eAA0E;MAC1E,WAAuD;MACvD,WAA4E;MAC5E,YAAY;;MAGH;MACT,QAAQ;;MACR,aAAa;;MACb,uBAAuB;;;;;;;MAOvB,YAAY,aAA2B,OAAiC,CAAA,GAAE;AACzE,aAAK,eAAe,KAAK,eAAe;AACxC,aAAK,UACJ,uBAAuB,MACpB,IAAI,OAAO,aAAa,EAAE,MAAM,SAAQ,CAAE,IAC1C;AACJ,aAAK,QAAQ,YAAY,CAAC,MACzB,KAAK,aAAa,EAAE,IAAI;AACzB,aAAK,QAAQ,UAAU,CAAC,MACvB,KAAK,WAAWA,mBAAkB,CAAC,GAAG,gBAAgB;AACvD,aAAK,QAAQ,iBAAiB,MAC7B,KAAK,WAAW,wCAAwC,gBAAgB;MAC1E;;MAGA,UAAU,QAAyB;AAClC,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,8BAA8B;AAClE,aAAK,MAAM,EAAE,MAAM,aAAa,OAAM,CAAE;MACzC;;;;;;MAOA,aAAa,UAAoC;AAChD,YAAI,KAAK;AAAW;AACpB,aAAK,MAAM,EAAE,MAAM,gBAAgB,SAAQ,GAAI,CAAC,QAAQ,CAAC;MAC1D;;;;;;;;;;;MAYA,UAAU,OAAkB;AAC3B,YAAI,KAAK;AAAW;AACpB,YAAI,KAAK,eAAe,KAAK,KAAK,QAAQ,KAAK,cAAc,KAAK,cAAc;AAC/E,eAAK;AACL;QACD;AACA,aAAK;AACL,aAAK,MAAM,EAAE,MAAM,aAAa,MAAK,GAAI,CAAC,KAAK,CAAC;MACjD;;MAGA,WAAW,QAAgB,KAAK,IAAG,GAAE;AACpC,YAAI,KAAK;AAAW;AACpB,aAAK,MAAM,EAAE,MAAM,cAAc,MAAK,CAAE;MACzC;;MAGA,YAAY,IAAoD;AAC/D,aAAK,eAAe;MACrB;;MAGA,QAAQ,IAAqC;AAC5C,aAAK,WAAW;MACjB;;MAGA,QAAQ,IAA0D;AACjE,aAAK,WAAW;MACjB;;;;;;MAOA,IAAI,sBAAmB;AACtB,eAAO,KAAK;MACb;;;;;MAMA,IAAI,WAAQ;AACX,eAAO,KAAK,IAAI,GAAG,KAAK,QAAQ,KAAK,UAAU;MAChD;;MAGA,UAAO;AACN,YAAI,KAAK;AAAW;AACpB,aAAK,YAAY;AACjB,YAAI;AACH,eAAK,QAAQ,YAAY,EAAE,MAAM,UAAS,CAA+B;QAC1E,QAAQ;QAER;AACA,aAAK,QAAQ,UAAS;MACvB;MAEA,MAAM,KAAyB,WAA2B,CAAA,GAAE;AAC3D,aAAK,QAAQ,YAAY,KAAK,QAAQ;MACvC;MAEA,aAAa,OAAuB;AACnC,gBAAQ,MAAM,MAAM;UACnB,KAAK;AACJ,iBAAK,eAAe,MAAM,MAAM,MAAM,IAAI;AAC1C;UACD,KAAK;AAMJ,iBAAK,aACJ,MAAM,MAAM,WAAW,MAAM,MAAM,YAAY,MAAM,MAAM;AAC5D,iBAAK,WAAW,MAAM,KAAK;AAC3B;UACD,KAAK;AACJ,gBAAI,MAAM;AAAM,mBAAK,WAAW,MAAM,SAAS,MAAM,IAAI;;AACpD,mBAAK,WAAW,MAAM,OAAO;AAClC;QACF;MACD;;;;;;AC/MD;;;;;;;;AAmBA;AAeA;;;;;ACjBA,IAAM,kBAAkB;AACxB,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,kBAAkB;;;AC0D7C,IAAMC,mBAAkB;AAI/B,IAAMC,yBAAwB;AAC9B,IAAMC,6BAA4BC,mBAAkBF;;;ACrE7C,IAAM,iBAAiB;AAGvB,IAAM,oBAAoB,KAAK;AAQ/B,IAAM,uBAAuB,MAAM,iBAAiB;;;ACIpD,IAAM,qBAAiD,OAAO,OAAO;EAC1E;EACA;CACD;AAGK,SAAU,kBAAkB,OAAc;AAC9C,SAAO,UAAU,iBAAiB,UAAU;AAC9C;AASM,SAAU,qBAAqB,OAAgB,OAAa;AAChE,MAAI,kBAAkB,KAAK;AAAG,WAAO;AACrC,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,MACR,GAAG,KAAK,4EAA4E;EAExF;AACA,QAAM,IAAI,MACR,GAAG,KAAK,iDAAiD,KAAK,UAAU,KAAK,CAAC,GAAG;AAErF;;;ACrCA,SAAS,gCAAgC;;;ACMzC,SAAS,wBAAwB;AAmJ1B,SAAS,2BACd,QACQ;AACR,QAAM,kBAAkB,OAAO;AAC/B,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,OAAO,SAAS,eAAe,KAAK,mBAAmB,GAAG;AAC7D,UAAM,IAAI;AAAA,MACR,kCAAkC,eAAe;AAAA,IAEnD;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,IAAI,KAAK,QAAQ,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAE7B;AAAA,EACF;AAGA,MAAI,OAAO,mBAAmB,OAAW,QAAO,KAAK,KAAK,eAAe;AACzE,SAAO,iBAAiB,iBAAiB,OAAO,cAAc;AAChE;;;AD7FA,eAAsB,uBACpB,MAC+B;AAe/B,MAAI,CAAC,OAAO,SAAS,KAAK,eAAe,KAAK,KAAK,mBAAmB,GAAG;AAGvE,UAAM,IAAI;AAAA,MACR,8EACU,KAAK,eAAe;AAAA,IAChC;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,mBAAmB,KAAK,KAAK,uBAAuB,GAAG;AAC/E,UAAM,IAAI;AAAA,MACR,yDAAyD,KAAK,mBAAmB;AAAA,IACnF;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,KAAK;AAAA,IACL,SAAS,KAAK,SAAS;AAAA,EACzB;AACA,QAAM,mBAAmB,2BAA2B;AAAA,IAClD,mBAAmB,KAAK;AAAA,IACxB,eAAe,KAAK;AAAA,IACpB,eAAe,KAAK;AAAA,IACpB,YAAY,KAAK;AAAA,IACjB,qBAAqB,MAAO,KAAK;AAAA,IACjC,gBAAgB,KAAK;AAAA,EACvB,CAAC;AAgCD,QAAM,wBAAwB;AAAA,IAC5B;AAAA,IACA,KAAK;AAAA,EACP;AAGA,QAAM,SACJ,OAAO,aAAa,eAAe,SAAS,SAAS,SAAS,SAAS;AACzE,QAAM,YAAY,IAAI,IAAI,KAAK,UAAU,WAAW,MAAM;AAE1D,QAAM,gBAAgB,MAAM;AAC5B,QAAM,SAAS,KAAK,gBAChB,KAAK,cAAc,SAAS,IAC5B,IAAI,cAAc,gBAAgB,SAAS;AAG/C,QAAM,SAAS,MAAM,YAAY,iBAAiB,MAAM,KAAK,UAAU,MAAM,CAAC;AAE9E,MAAI;AACJ,MAAI;AACJ,MAAI,KAAK,mBAAmB;AAC1B,UAAM,MAAM,KAAK,kBAAkB,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACvE,UAAM,SAAS,IAAI,OAAO,KAAK,KAAK,IAAI,SAAS,CAAC,IAAI,GAAG,GAAG;AAC5D,QAAI;AACF,YAAM,WAAW,WAAW,KAAK,KAAK,MAAM,GAAG,OAAK,EAAE,WAAW,CAAC,CAAC;AAEnE,UAAI,SAAS,UAAU,MAAM,SAAS,UAAU,KAAK;AACnD,wBAAgB,SAAS;AACzB,yBAAiB,MAAM,YAAY,iBAAiB,MAAM,KAAK,UAAU,QAAQ,CAAC;AAAA,MACpF,OAAO;AACL,gBAAQ;AAAA,UACN,kDAAkD,KAAK,SAAS,MAC3D,SAAS,MAAM;AAAA,QACtB;AAAA,MACF;AAAA,IACF,SAAS,GAAG;AACV,cAAQ,KAAK,iEAAiE,KAAK,SAAS,MAAM,CAAC;AAAA,IACrG;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,EAAE,iBAAiB;AACxC,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK,SAAS;AAAA,IACrB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,IACA,GAAG,KAAK;AAAA;AAAA;AAAA,IAGR,aAAa,KAAK,qBAAqB,KAAK;AAAA,IAC5C,YAAY,KAAK;AAAA,IACjB,iBAAiB;AAAA,IACjB,cAAc,KAAK;AAAA,IACnB;AAAA,IACA,SAAS;AAAA,IACT,aAAa,KAAK;AAAA,IAClB;AAAA,IACA,sBAAsB;AAAA,EACxB;AAEA,SAAO,UAAU,gBAAgB,QAAQ,eAAe,cAAc;AACtE,MAAI;AACF,SAAK,iBAAiB,aAAa,KAAK,UAAU,QAAQ,KAAK,WAAW;AAAA,MACxE;AAAA,MACA,GAAG,KAAK;AAAA,MACR,YAAY,KAAK;AAAA,MACjB,mBAAmB,KAAK;AAAA;AAAA;AAAA,MAGxB,KAAK,MAAO,KAAK;AAAA,MACjB,WAAW;AAAA,IACb,GAAG,KAAK,SAAS;AAAA,EACnB,SAAS,GAAG;AAIV,QAAI;AACF,aAAO,QAAQ;AAAA,IACjB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,MAAI,WAAW;AACf,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS,MAAM;AACb,UAAI,SAAU;AACd,iBAAW;AAKX,UAAI,CAAC,KAAK,iBAAiB,eAAe,KAAK,UAAU,KAAK,SAAS,GAAG;AACxE,gBAAQ;AAAA,UACN,+BAA+B,KAAK,QAAQ,UAAU,KAAK,SAAS;AAAA,QACtE;AAAA,MACF;AACA,UAAI;AACF,eAAO,QAAQ;AAAA,MACjB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;",
-  "names": ["location", "formatWorkerError", "MPU_HEADER_SIZE", "MPU_LENGTH_FIELD_SIZE", "MPU_HEADER_REMAINDER_SIZE", "MPU_HEADER_SIZE"]
+  "sources": ["../../fec-worker/src/fec-worker-client.ts", "../../fec-worker/src/shred-worker-client.ts", "../../fec-worker/src/index.ts", "../../mmt-base/src/mmtp.ts", "../../mmt-base/src/ntp-short.ts", "../../mmt-base/src/fec-block-profile.ts", "../src/fec-worker-setup.ts", "../src/track-session.ts"],
+  "sourcesContent": ["/**\n * @blockcast/fec-worker \u2014 Main-Thread Client\n *\n * Wraps one Worker per track instance. Provides typed API for the\n * FecWorkerCommand/FecWorkerEvent protocol with zero-copy ArrayBuffer transfers.\n *\n * Constructor accepts either a URL (creates Worker internally) or a pre-created\n * Worker instance (for testing via constructor injection).\n */\n\nimport type {\n\tFecWorkerCommand,\n\tFecSymbolCommand,\n\tFecWorkerEvent,\n\tFecTrackConfig,\n\tFecTrackStats,\n\tFecBlockSnapshot,\n\tFrameMeta,\n\tFecWorkerErrorCode,\n} from \"./fec-worker-types.js\";\n\nexport class FecWorkerClient {\n\treadonly #worker: Worker;\n\t#onFrame: ((data: ArrayBuffer, meta: FrameMeta) => void) | null = null;\n\t#onSnapshot: ((stats: FecTrackStats) => void) | null = null;\n\t#onBlockUpdate: ((block: FecBlockSnapshot) => void) | null = null;\n\t#onCleanupComplete: ((sbn: number) => void) | null = null;\n\t#onError: ((message: string, code?: FecWorkerErrorCode) => void) | null = null;\n\t#cleanupInFlight: Set<number> | null = null;\n\t#queuedCleanupSbns = new Set<number>();\n\t#pendingResets = 0;\n\t#resetFailed = false;\n\t#disposed = false;\n\t// Symbols fed during the current task, sent as one feedSymbols message\n\t// when the task's microtasks run (BLO-36599). A packet stream delivers many\n\t// symbols per task, and each postMessage is a structured-clone round trip\n\t// on the page thread; the batch boundary is the task, not a size or timer.\n\t#pendingSymbols: FecSymbolCommand[] = [];\n\t#pendingTransfer: Transferable[] = [];\n\t#flushQueued = false;\n\t// Batching starts only once the Worker announced it accepts feedSymbols.\n\t#batchSymbols = false;\n\t// The Worker posts blockUpdate events only to a client that subscribed,\n\t// which this client does once a callback is registered and the Worker\n\t// announced the command (BLO-36599).\n\t#blockUpdatesAnnounced = false;\n\t#blockUpdatesSubscribed = false;\n\n\t/**\n\t * Create a FecWorkerClient.\n\t * @param workerOrUrl - Either a Worker instance (for testing) or a URL to create one\n\t */\n\tconstructor(workerOrUrl: Worker | URL) {\n\t\tif (workerOrUrl instanceof URL) {\n\t\t\tthis.#worker = new Worker(workerOrUrl, { type: \"module\" });\n\t\t} else {\n\t\t\tthis.#worker = workerOrUrl;\n\t\t}\n\t\tthis.#worker.onmessage = (e: MessageEvent<FecWorkerEvent>) =>\n\t\t\tthis.#handleEvent(e.data);\n\t\tthis.#worker.onerror = (e) => {\n\t\t\tthis.#onError?.(formatWorkerError(e), \"worker-runtime\");\n\t\t};\n\t\tthis.#worker.onmessageerror = (e) => {\n\t\t\tthis.#onError?.(formatWorkerMessageError(e), \"worker-message\");\n\t\t};\n\t}\n\n\t/**\n\t * Configure the Worker with FEC parameters and WASM module.\n\t * `interleaveMs: 0` is a valid no-span catalog value; in that mode the\n\t * caller supplies a positive receiver-local `deliveryWindowMs`.\n\t * wasmModule is transferred (not neutered \u2014 WebAssembly.Module is shareable).\n\t */\n\tconfigure(\n\t\tconfig: FecTrackConfig,\n\t\twasmModule: WebAssembly.Module,\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] disposed\");\n\t\tthis.#flushSymbols();\n\t\tconst cmd: FecWorkerCommand = {\n\t\t\ttype: \"configure\",\n\t\t\tconfig,\n\t\t\twasmModule,\n\t\t};\n\t\t// WebAssembly.Module is structured-cloneable, NOT transferable.\n\t\t// Pass it in the message body (Chrome clones it automatically).\n\t\tthis.#worker.postMessage(cmd);\n\t}\n\n\t/**\n\t * Feed a source symbol to the Worker. data ArrayBuffer is transferred (zero-copy).\n\t * Caller must not access data after this call \u2014 it is transferred with the\n\t * task's symbol batch, before any later command of this client.\n\t */\n\tfeedSource(\n\t\tssId: number,\n\t\tdata: ArrayBuffer,\n\t\tts: number,\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] feedSource on a disposed client\");\n\t\tthis.#queueSymbol({ type: \"feedSource\", ssId, data, ts }, data);\n\t}\n\n\t/**\n\t * Feed a repair symbol to the Worker. data ArrayBuffer is transferred (zero-copy).\n\t * Caller must not access data after this call \u2014 it is detached.\n\t *\n\t * Carries the wire-level Repair FEC Payload ID fields (ISO 23008-1 \u00A7C.5.3):\n\t * - ssStart:   SS_ID of first source symbol in the block (any uint32; the block key)\n\t * - ssbLength: authored source-symbol count (1..configured K)\n\t * - rsId:      repair symbol index within the block\n\t */\n\tfeedRepair(\n\t\tssStart: number,\n\t\tssbLength: number,\n\t\trsId: number,\n\t\tdata: ArrayBuffer,\n\t\tts: number,\n\t): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] feedRepair on a disposed client\");\n\t\tthis.#queueSymbol({ type: \"feedRepair\", ssStart, ssbLength, rsId, data, ts }, data);\n\t}\n\n\t#queueSymbol(symbol: FecSymbolCommand, data: ArrayBuffer): void {\n\t\tif (!this.#batchSymbols) {\n\t\t\tthis.#worker.postMessage(symbol, [data]);\n\t\t\treturn;\n\t\t}\n\t\tthis.#pendingSymbols.push(symbol);\n\t\tthis.#pendingTransfer.push(data);\n\t\tif (this.#flushQueued) return;\n\t\tthis.#flushQueued = true;\n\t\tqueueMicrotask(() => {\n\t\t\tthis.#flushQueued = false;\n\t\t\tthis.#flushSymbols();\n\t\t});\n\t}\n\n\t/**\n\t * Send the symbols fed so far. Every other command calls this first, so a\n\t * cleanup barrier, reset or signature still follows all earlier symbols.\n\t */\n\t#flushSymbols(): void {\n\t\tif (this.#pendingSymbols.length === 0 || this.#disposed) return;\n\t\tconst symbols = this.#pendingSymbols;\n\t\tconst transfer = this.#pendingTransfer;\n\t\tthis.#pendingSymbols = [];\n\t\tthis.#pendingTransfer = [];\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"feedSymbols\", symbols } satisfies FecWorkerCommand,\n\t\t\ttransfer,\n\t\t);\n\t}\n\n\t/**\n\t * Submit relay block signature for verification. sig and hash are transferred.\n\t */\n\trelayBlockSig(sbn: number, sig: ArrayBuffer, hash: ArrayBuffer): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] relayBlockSig on a disposed client\");\n\t\tthis.#flushSymbols();\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"relayBlockSig\", sbn, sig, hash } satisfies FecWorkerCommand,\n\t\t\t[sig, hash],\n\t\t);\n\t}\n\n\t/**\n\t * Trigger cleanup after a block's inactivity deadline. `currentSbn` is the\n\t * block key, the block's SS_Start.\n\t *\n\t * While one queue-drain barrier is in flight, later SBNs are coalesced into\n\t * the next command without losing their individual acknowledgement identity.\n\t */\n\tcleanup(currentSbn: number): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] cleanup on a disposed client\");\n\t\tif (\n\t\t\t!Number.isInteger(currentSbn) ||\n\t\t\tcurrentSbn < 0 ||\n\t\t\tcurrentSbn > 0xffff_ffff\n\t\t) {\n\t\t\tthrow new Error(\"[FecWorkerClient] cleanup: SBN must be a uint32\");\n\t\t}\n\t\tif (this.#cleanupInFlight) {\n\t\t\tthis.#queuedCleanupSbns.add(currentSbn);\n\t\t\treturn;\n\t\t}\n\t\tthis.#postCleanup(new Set([currentSbn]));\n\t}\n\n\t/** Reset this track's decoder epoch while preserving Worker configuration. */\n\treset(): void {\n\t\tif (this.#disposed) throw new Error(\"[FecWorkerClient] reset on a disposed client\");\n\t\tthis.#flushSymbols();\n\t\tthis.#pendingResets++;\n\t\tthis.#cleanupInFlight = null;\n\t\tthis.#queuedCleanupSbns.clear();\n\t\tthis.#worker.postMessage({ type: \"reset\" } satisfies FecWorkerCommand);\n\t}\n\n\t#postCleanup(sbns: Set<number>): void {\n\t\t// The cleanup is a queue-drain barrier: every symbol fed before it is\n\t\t// posted must reach the Worker first.\n\t\tthis.#flushSymbols();\n\t\tthis.#cleanupInFlight = sbns;\n\t\tconst orderedSbns = [...sbns].sort((a, b) => a - b);\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"cleanup\", sbns: orderedSbns } satisfies FecWorkerCommand,\n\t\t);\n\t}\n\n\t/** Register callback for decoded/recovered frames (FEC-03). */\n\tonFrame(cb: (data: ArrayBuffer, meta: FrameMeta) => void): void {\n\t\tthis.#onFrame = cb;\n\t}\n\n\t/** Register callback for periodic stats snapshots (FEC-04). */\n\tonSnapshot(cb: (stats: FecTrackStats) => void): void {\n\t\tthis.#onSnapshot = cb;\n\t}\n\n\t/**\n\t * Register callback for individual block state changes. The Worker posts\n\t * them only once asked, so registering subscribes (after the Worker\n\t * announces `subscribeBlockUpdates`). An older Worker that does not\n\t * announce it posts them unasked.\n\t */\n\tonBlockUpdate(cb: (block: FecBlockSnapshot) => void): void {\n\t\tthis.#onBlockUpdate = cb;\n\t\tthis.#subscribeBlockUpdates();\n\t}\n\n\t#subscribeBlockUpdates(): void {\n\t\tif (\n\t\t\tthis.#disposed ||\n\t\t\tthis.#blockUpdatesSubscribed ||\n\t\t\t!this.#blockUpdatesAnnounced ||\n\t\t\t!this.#onBlockUpdate\n\t\t) return;\n\t\tthis.#blockUpdatesSubscribed = true;\n\t\tthis.#worker.postMessage(\n\t\t\t{ type: \"subscribeBlockUpdates\" } satisfies FecWorkerCommand,\n\t\t);\n\t}\n\n\t/** Register callback fired after the Worker drains all commands queued before cleanup. */\n\tonCleanupComplete(cb: (sbn: number) => void): void {\n\t\tthis.#onCleanupComplete = cb;\n\t}\n\n\t/** Register callback for Worker errors. */\n\tonError(cb: (message: string, code?: FecWorkerErrorCode) => void): void {\n\t\tthis.#onError = cb;\n\t}\n\n\t/**\n\t * True once dispose() ran. A disposed client cannot decode, fill, or\n\t * acknowledge anything, so routing symbols to it discards them; every\n\t * command method (feedSource, feedRepair, relayBlockSig, cleanup, reset)\n\t * throws rather than pretend otherwise. Callers check this first.\n\t */\n\tget disposed(): boolean {\n\t\treturn this.#disposed;\n\t}\n\n\t/**\n\t * Dispose the Worker. Sends dispose command then terminates.\n\t * Idempotent \u2014 safe to call multiple times.\n\t */\n\tdispose(): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#disposed = true;\n\t\t// A terminated Worker decodes nothing; symbols still batched are dropped.\n\t\tthis.#pendingSymbols = [];\n\t\tthis.#pendingTransfer = [];\n\t\tthis.#cleanupInFlight = null;\n\t\tthis.#queuedCleanupSbns.clear();\n\t\tthis.#worker.postMessage({ type: \"dispose\" } satisfies FecWorkerCommand);\n\t\tthis.#worker.terminate();\n\t}\n\n\t#handleEvent(event: FecWorkerEvent): void {\n\t\tif (event.type === \"capabilities\") {\n\t\t\tif (Array.isArray(event.commands) && event.commands.includes(\"feedSymbols\")) {\n\t\t\t\tthis.#batchSymbols = true;\n\t\t\t}\n\t\t\tif (Array.isArray(event.commands) && event.commands.includes(\"subscribeBlockUpdates\")) {\n\t\t\t\tthis.#blockUpdatesAnnounced = true;\n\t\t\t\tthis.#subscribeBlockUpdates();\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (event.type === \"resetComplete\") {\n\t\t\tthis.#pendingResets = Math.max(0, this.#pendingResets - 1);\n\t\t\tthis.#resetFailed = false;\n\t\t\treturn;\n\t\t}\n\t\tif (event.type === \"error\") {\n\t\t\tif (event.code === \"reset-failed\") {\n\t\t\t\tthis.#pendingResets = Math.max(0, this.#pendingResets - 1);\n\t\t\t\tthis.#resetFailed = true;\n\t\t\t}\n\t\t\tif (event.code) this.#onError?.(event.message, event.code);\n\t\t\telse this.#onError?.(event.message);\n\t\t\treturn;\n\t\t}\n\t\tif (this.#pendingResets > 0 || this.#resetFailed) return;\n\t\tswitch (event.type) {\n\t\t\tcase \"frame\":\n\t\t\t\tthis.#onFrame?.(event.data, event.meta);\n\t\t\t\tbreak;\n\t\t\tcase \"snapshot\":\n\t\t\t\tthis.#onSnapshot?.(event.stats);\n\t\t\t\tbreak;\n\t\t\tcase \"blockUpdate\":\n\t\t\t\tthis.#onBlockUpdate?.(event.block);\n\t\t\t\tbreak;\n\t\t\tcase \"cleanupComplete\":\n\t\t\t\tfor (const sbn of event.sbns) {\n\t\t\t\t\tthis.#onCleanupComplete?.(sbn);\n\t\t\t\t}\n\t\t\t\tthis.#cleanupInFlight = null;\n\t\t\t\tif (this.#queuedCleanupSbns.size > 0) {\n\t\t\t\t\tconst next = this.#queuedCleanupSbns;\n\t\t\t\t\tthis.#queuedCleanupSbns = new Set();\n\t\t\t\t\tthis.#postCleanup(next);\n\t\t\t\t}\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nfunction formatWorkerError(event: ErrorEvent): string {\n\tconst parts = [\"Worker error\"];\n\tif (event.message) parts.push(event.message);\n\tif (event.filename) {\n\t\tconst location = [event.filename];\n\t\tif (event.lineno) location.push(String(event.lineno));\n\t\tif (event.colno) location.push(String(event.colno));\n\t\tparts.push(`at ${location.join(\":\")}`);\n\t}\n\tif (event.error instanceof Error) {\n\t\tif (event.error.message && event.error.message !== event.message) {\n\t\t\tparts.push(event.error.message);\n\t\t}\n\t\tif (event.error.stack) parts.push(event.error.stack);\n\t} else if (event.error != null) {\n\t\tparts.push(String(event.error));\n\t}\n\treturn parts.join(\": \");\n}\n\nfunction formatWorkerMessageError(event: MessageEvent): string {\n\tconst data = event.data;\n\tconst detail =\n\t\tdata == null ? \"\" :\n\t\t\tdata instanceof Error ? `: ${data.message}` :\n\t\t\t\t`: ${Object.prototype.toString.call(data)}`;\n\treturn `Worker messageerror: failed to deserialize worker message${detail}`;\n}\n", "/**\n * @blockcast/fec-worker \u2014 Shred Worker Main-Thread Client\n *\n * Thin wrapper over the shred (Reed-Solomon) worker, mirroring\n * {@link FecWorkerClient}'s shape. Spawns one Worker, speaks the\n * {@link ShredWorkerCommand}/{@link ShredWorkerEvent} protocol, and keeps the\n * datagram read loop + wire parse + WASM FEC off the main thread.\n *\n * Typical wiring for a WebTransport datagram source (fully off-thread):\n *\n *   const client = new ShredWorkerClient(new URL(\"./shred-fec-worker.js\", import.meta.url));\n *   client.onRecovered((data, meta) => renderRecoveredSet(data, meta));\n *   client.configure({ maxSlots: 5000, symbolSize: 512, wasmUrl: \"/vendor/fec/mmt_wasm.js\" });\n *   client.attachStream(wt.datagrams.readable); // transferred; main does no read() per packet\n *\n * For sources that demux on the main thread (moqtail OBJECT_DATAGRAM callback,\n * IWA multicast bridge), push each raw frame with {@link feedShred} instead.\n *\n * {@link feedShred} is a fire-and-forget `postMessage` with no native\n * backpressure, so a consumer that decodes slower than the ingest rate (a\n * backgrounded/throttled tab, WASM RS falling behind a ~4k shred/s feed) would\n * grow the worker's inbound message queue without limit \u2014 the queue lives in the\n * renderer process and has been observed to reach multiple GB, GC-thrashing the\n * page into a wedge. The client bounds it with an in-flight window keyed off the\n * worker's own periodic stats heartbeat (no per-frame ack round-trip); see\n * {@link ShredWorkerClientOptions.maxInflight}.\n */\n\nimport type {\n\tShredWorkerCommand,\n\tShredWorkerConfig,\n\tShredWorkerEvent,\n\tShredWorkerStats,\n\tShredWorkerErrorCode,\n\tRecoveredMeta,\n} from \"./shred-worker-types.js\";\n\n/** Construction-time options for {@link ShredWorkerClient}. */\nexport interface ShredWorkerClientOptions {\n\t/**\n\t * Cap on frames posted via {@link ShredWorkerClient.feedShred} but not yet\n\t * drained by the worker, before further frames are dropped (\"skip-to-live\" at\n\t * the worker boundary). Bounds the worker's inbound message queue \u2014 the sole\n\t * unbounded structure on the main-thread-demux (`feedShred`) path.\n\t *\n\t * The drain signal is the worker's periodic `stats` heartbeat: the monotonic\n\t * total of frames it has taken off the queue (`shredsRx + malformed +\n\t * versionMismatch`). No per-frame acknowledgement crosses the boundary, so the\n\t * bound is heartbeat-granular \u2014 size it above one heartbeat's worth of ingest\n\t * (default 250ms heartbeat \u00D7 ~4k frames/s \u2248 ~1k frames).\n\t *\n\t * Default {@link DEFAULT_MAX_INFLIGHT} (8192 frames \u2248 ~10 MB at ~1.3 KB/frame).\n\t * Set to `0` (or any value `<= 0`) to disable the bound entirely \u2014 only do so\n\t * for a source with its own backpressure (e.g. a bounded {@link\n\t * ShredWorkerClient.attachStream} producer). Note the bound assumes `feedShred`\n\t * is the sole ingest path; mixing it with `attachStream` (whose frames also\n\t * advance the heartbeat total) makes the window under-count and benignly\n\t * disables the drop.\n\t */\n\tmaxInflight?: number;\n}\n\n/** Default {@link ShredWorkerClientOptions.maxInflight} (~10 MB of queued frames). */\nexport const DEFAULT_MAX_INFLIGHT = 8192;\n\nexport class ShredWorkerClient {\n\treadonly #worker: Worker;\n\t#onRecovered: ((data: ArrayBuffer, meta: RecoveredMeta) => void) | null = null;\n\t#onStats: ((stats: ShredWorkerStats) => void) | null = null;\n\t#onError: ((message: string, code?: ShredWorkerErrorCode) => void) | null = null;\n\t#disposed = false;\n\n\t/** feedShred in-flight backpressure accounting (see ShredWorkerClientOptions.maxInflight). */\n\treadonly #maxInflight: number;\n\t#sent = 0; // frames posted via feedShred (monotonic)\n\t#processed = 0; // worker-consumed total from the last stats heartbeat (monotonic)\n\t#droppedBackpressure = 0; // frames dropped by the in-flight guard (monotonic)\n\n\t/**\n\t * @param workerOrUrl - A URL (a Worker is created internally, `type: module`)\n\t *   or a pre-created Worker (for testing via constructor injection).\n\t * @param opts - Optional {@link ShredWorkerClientOptions}.\n\t */\n\tconstructor(workerOrUrl: Worker | URL, opts: ShredWorkerClientOptions = {}) {\n\t\tthis.#maxInflight = opts.maxInflight ?? DEFAULT_MAX_INFLIGHT;\n\t\tthis.#worker =\n\t\t\tworkerOrUrl instanceof URL\n\t\t\t\t? new Worker(workerOrUrl, { type: \"module\" })\n\t\t\t\t: workerOrUrl;\n\t\tthis.#worker.onmessage = (e: MessageEvent<ShredWorkerEvent>) =>\n\t\t\tthis.#handleEvent(e.data);\n\t\tthis.#worker.onerror = (e) =>\n\t\t\tthis.#onError?.(formatWorkerError(e), \"worker-runtime\");\n\t\tthis.#worker.onmessageerror = () =>\n\t\t\tthis.#onError?.(\"failed to deserialize worker message\", \"worker-message\");\n\t}\n\n\t/** Configure the decoder (WASM load + ShredFecBuffer construction happen in the worker). */\n\tconfigure(config: ShredWorkerConfig): void {\n\t\tif (this.#disposed) throw new Error(\"[ShredWorkerClient] disposed\");\n\t\tthis.#post({ type: \"configure\", config });\n\t}\n\n\t/**\n\t * Hand the worker a stream of raw shred frames to batch-drain. The stream is\n\t * transferred \u2014 the caller must not use it afterward. One active stream at a\n\t * time; attaching a new one cancels the previous.\n\t */\n\tattachStream(readable: ReadableStream<Uint8Array>): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#post({ type: \"attachStream\", readable }, [readable]);\n\t}\n\n\t/**\n\t * Feed one already-demuxed raw shred frame. `frame` is transferred zero-copy;\n\t * the caller must not access it afterward.\n\t *\n\t * Dropped (frame NOT transferred, so the caller's buffer stays intact) when the\n\t * in-flight window is full \u2014 i.e. the worker is more than `maxInflight` frames\n\t * behind. This is the memory bound: a slow/wedged consumer costs bounded\n\t * skip-to-live drops (see {@link droppedBackpressure}), never an unbounded\n\t * renderer-heap blow-up.\n\t */\n\tfeedShred(frame: ArrayBuffer): void {\n\t\tif (this.#disposed) return;\n\t\tif (this.#maxInflight > 0 && this.#sent - this.#processed >= this.#maxInflight) {\n\t\t\tthis.#droppedBackpressure++;\n\t\t\treturn;\n\t\t}\n\t\tthis.#sent++;\n\t\tthis.#post({ type: \"feedShred\", frame }, [frame]);\n\t}\n\n\t/** Explicitly drive loss recovery (in addition to the worker's internal timer). */\n\trecoverAll(nowMs: number = Date.now()): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#post({ type: \"recoverAll\", nowMs });\n\t}\n\n\t/** Register callback for recovered/completed FEC sets. `data` is a transferred buffer. */\n\tonRecovered(cb: (data: ArrayBuffer, meta: RecoveredMeta) => void): void {\n\t\tthis.#onRecovered = cb;\n\t}\n\n\t/** Register callback for the coalesced stats heartbeat. */\n\tonStats(cb: (stats: ShredWorkerStats) => void): void {\n\t\tthis.#onStats = cb;\n\t}\n\n\t/** Register callback for worker errors. */\n\tonError(cb: (message: string, code?: ShredWorkerErrorCode) => void): void {\n\t\tthis.#onError = cb;\n\t}\n\n\t/**\n\t * Frames dropped by the in-flight backpressure guard since construction\n\t * (monotonic). Surface this in the UI so sustained loss is visible rather than\n\t * silent \u2014 a rising counter means the consumer can't keep pace with ingest.\n\t */\n\tget droppedBackpressure(): number {\n\t\treturn this.#droppedBackpressure;\n\t}\n\n\t/**\n\t * Frames posted via {@link feedShred} but not yet reported drained by the\n\t * worker's last stats heartbeat (best-effort, heartbeat-granular; never < 0).\n\t */\n\tget inflight(): number {\n\t\treturn Math.max(0, this.#sent - this.#processed);\n\t}\n\n\t/** Dispose the worker. Idempotent. */\n\tdispose(): void {\n\t\tif (this.#disposed) return;\n\t\tthis.#disposed = true;\n\t\ttry {\n\t\t\tthis.#worker.postMessage({ type: \"dispose\" } satisfies ShredWorkerCommand);\n\t\t} catch {\n\t\t\t/* worker may already be gone */\n\t\t}\n\t\tthis.#worker.terminate();\n\t}\n\n\t#post(cmd: ShredWorkerCommand, transfer: Transferable[] = []): void {\n\t\tthis.#worker.postMessage(cmd, transfer);\n\t}\n\n\t#handleEvent(event: ShredWorkerEvent): void {\n\t\tswitch (event.type) {\n\t\t\tcase \"recovered\":\n\t\t\t\tthis.#onRecovered?.(event.data, event.meta);\n\t\t\t\tbreak;\n\t\t\tcase \"stats\":\n\t\t\t\t// The worker's monotonic consumed-frame total is the drain signal for\n\t\t\t\t// the feedShred in-flight guard. shredsRx counts only valid frames;\n\t\t\t\t// malformed + versionMismatch are consumed off the queue too, so the\n\t\t\t\t// sum is the true \"frames taken off the queue\" and keeps the window\n\t\t\t\t// from inflating (and false-dropping) on a malformed/skewed source.\n\t\t\t\tthis.#processed =\n\t\t\t\t\tevent.stats.shredsRx + event.stats.malformed + event.stats.versionMismatch;\n\t\t\t\tthis.#onStats?.(event.stats);\n\t\t\t\tbreak;\n\t\t\tcase \"error\":\n\t\t\t\tif (event.code) this.#onError?.(event.message, event.code);\n\t\t\t\telse this.#onError?.(event.message);\n\t\t\t\tbreak;\n\t\t}\n\t}\n}\n\nfunction formatWorkerError(event: ErrorEvent): string {\n\tconst parts = [\"Worker error\"];\n\tif (event.message) parts.push(event.message);\n\tif (event.filename) {\n\t\tconst loc = [event.filename];\n\t\tif (event.lineno) loc.push(String(event.lineno));\n\t\tif (event.colno) loc.push(String(event.colno));\n\t\tparts.push(`at ${loc.join(\":\")}`);\n\t}\n\tif (event.error instanceof Error && event.error.stack) parts.push(event.error.stack);\n\treturn parts.join(\": \");\n}\n", "/**\n * @blockcast/fec-worker \u2014 Worker-per-track FEC decode with zero-copy transfers\n *\n * Re-exports shared types and main-thread client.\n */\n\nexport type {\n\tFecWorkerCommand,\n\tFecSymbolCommand,\n\tFecWorkerOptionalCommand,\n\tFecWorkerEvent,\n\tFecWorkerErrorCode,\n\tFecBlockProfile,\n\tFecTrackConfig,\n\tFecTrackStats,\n\tFecBlockSnapshot,\n\tFrameMeta,\n} from \"./fec-worker-types.js\";\n\nexport { FecWorkerClient } from \"./fec-worker-client.js\";\n\n// --- Shred (Reed-Solomon) codec \u2014 sibling to the RaptorQ/MMTP worker above.\n// Different FEC payload identity (slot/fecSet/localIndex vs flat ssId) \u2192 its\n// own command shape and worker; shares the transfer + client/worker pattern.\nexport type {\n\tShredWorkerCommand,\n\tShredWorkerEvent,\n\tShredWorkerConfig,\n\tShredWorkerStats,\n\tShredWorkerErrorCode,\n\tRecoveredMeta,\n\tSlotSample,\n} from \"./shred-worker-types.js\";\n\nexport { ShredWorkerClient } from \"./shred-worker-client.js\";\n", "/**\n * @mmt/container - MMTP Parser\n *\n * MMTP (MMT Protocol) packet parser based on ISO/IEC 23008-1:2023 Section 9.2\n *\n * MMTP header format (12 bytes):\n * - Byte 0: V(2) | C(1) | FEC_type(2) | r(1) | X(1) | R(1)\n * - Byte 1: reserved(2) | packet_type(6)\n * - Bytes 2-3: packet_id (big-endian)\n * - Bytes 4-7: timestamp (big-endian, 32-bit)\n * - Bytes 8-11: sequence_number (big-endian)\n *\n * FEC_type values:\n * - 0: No FEC / source packet\n * - 1: FEC mode 0 (source with FEC payload ID)\n * - 2: FEC repair packet mode 0\n * - 3: FEC repair packet mode 1\n *\n * @packageDocumentation\n */\n\nexport interface MMTPHeader {\n  version: number\n  /** Packet type: 0x00=MPU, 0x02=Signaling, 0x03=Repair */\n  packetType: number\n  packetId: number\n  timestamp: bigint\n  sequenceNumber: number\n  payloadLength: number\n  fecType: number\n  /** C flag: header carries a 32-bit packet_counter. */\n  packetCounterFlag: boolean\n  packetCounter?: number\n  /** X flag: header carries an extension header and value. */\n  extensionFlag: boolean\n  extension?: { type: number; data: Uint8Array }\n  /** Byte offset at which the MMTP payload begins. */\n  headerLength: number\n  /** Random Access Point flag - indicates keyframe (ISO 23008-1, byte 0 bit 0) */\n  rapFlag: boolean\n}\n\nexport interface MPUHeader {\n  mpuSequenceNumber: number\n  fragmentationIndicator: number // FI: 0=complete, 1=first, 2=middle, 3=last\n  /** 8-bit MPU fragment_counter from byte 3. */\n  fragmentCounter: number\n  /** T flag: 1=timed media (14-byte MFU DU header), 0=non-timed (4-byte header) */\n  timedFlag: number\n  /** A flag: aggregated MPU payload. This strict profile requires A=0. */\n  aggregationFlag: boolean\n  /** MPU payload_length (bytes 0-1): bytes after the length field, including\n   *  the remaining six MPU-header bytes and all data-unit bytes. */\n  payloadLength: number\n}\n\nexport interface MFUDuHeader {\n  movieFragmentSequenceNumber: number\n  sampleNumber: number\n  offset: number\n  priority: number\n  dependencyCounter: number\n}\n\nexport interface MMTPPacket {\n  header: MMTPHeader\n  payload: Uint8Array\n}\n\nexport const MMTP_HEADER_SIZE = 12\nexport const MPU_HEADER_SIZE = 8\nexport const MFU_DU_HEADER_SIZE_TIMED = 14    // T=1: timed media (video/audio samples)\nexport const MFU_DU_HEADER_SIZE_NONTIMED = 4  // T=0: non-timed media (item_id only)\n\nconst MPU_LENGTH_FIELD_SIZE = 2\nconst MPU_HEADER_REMAINDER_SIZE = MPU_HEADER_SIZE - MPU_LENGTH_FIELD_SIZE\nconst SOURCE_FEC_PAYLOAD_ID_SIZE = 4\n\n// MMTP Packet Types (ISO/IEC 23008-1:2023 Section 9.2.2)\nexport const PACKET_TYPE_MPU = 0x00\nexport const PACKET_TYPE_SIGNALING = 0x02\nexport const PACKET_TYPE_REPAIR = 0x03\n\n// AL-FEC Signaling Message ID (ISO/IEC 23008-1:2023 Amendment 1:2025)\nexport const ALFEC_MESSAGE_ID = 0x0203\n\n/**\n * MMTP `packet_id` of the signaling flow, which carries PACKET_TYPE_SIGNALING\n * packets such as the AL-FEC message (ALFEC_MESSAGE_ID). The FFmpeg `moq_mmt`\n * muxer sends that message on this packet_id into the same multicast group as\n * the media, and moqcast-draft (PR #44) makes advertising it for a track a\n * MUST NOT. A track's packet_id is therefore 1..MMTP_PACKET_ID_MAX.\n */\nexport const MMTP_SIGNALING_PACKET_ID = 0\n\n/** Largest value of the 16-bit MMTP `packet_id` header field. */\nexport const MMTP_PACKET_ID_MAX = 0xffff\n\n// FEC Code IDs\nexport const FEC_CODE_XOR = 1\nexport const FEC_CODE_RAPTORQ = 2\n\n/**\n * Parse MMTP header from buffer\n */\nexport function parseMMTPHeader(buffer: Uint8Array): MMTPHeader {\n  if (buffer.length < MMTP_HEADER_SIZE) {\n    throw new Error(`MMTP packet too small: ${buffer.length} bytes`)\n  }\n\n  const view = new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength)\n\n  const version = (buffer[0]! >> 6) & 0x03\n  if (version !== 0) {\n    throw new Error(`Unsupported MMTP version: ${version}`)\n  }\n\n  // Extract FEC type from byte 0, bits 3-4\n  const fecType = (buffer[0]! >> 3) & 0x03\n  const packetCounterFlag = (buffer[0]! & 0x20) !== 0\n  const extensionFlag = (buffer[0]! & 0x02) !== 0\n\n  // Extract RAP flag from byte 0, bit 0 (R bit - Random Access Point)\n  const rapFlag = (buffer[0]! & 0x01) === 1\n\n  // ISO/IEC 23008-1:2023 Figure 8 (V=0) places reserved(2) before\n  // packet_type(6), so packet_type occupies the low six bits of byte 1.\n  const packetType = buffer[1]! & 0x3F\n\n  let offset = 2\n\n  // Packet ID (2 bytes, big-endian)\n  const packetId = view.getUint16(offset, false)\n  offset += 2\n\n  // Timestamp (4 bytes, big-endian)\n  const timestamp = BigInt(view.getUint32(offset, false))\n  offset += 4\n\n  // Sequence number (4 bytes, big-endian)\n  const sequenceNumber = view.getUint32(offset, false)\n  offset += 4\n\n  let packetCounter: number | undefined\n  if (packetCounterFlag) {\n    if (offset + 4 > buffer.length) throw new Error('MMTP packet truncated in packet_counter')\n    packetCounter = view.getUint32(offset, false)\n    offset += 4\n  }\n\n  let extension: { type: number; data: Uint8Array } | undefined\n  if (extensionFlag) {\n    if (offset + 4 > buffer.length) throw new Error('MMTP packet truncated in header extension')\n    const type = view.getUint16(offset, false)\n    const length = view.getUint16(offset + 2, false)\n    offset += 4\n    if (offset + length > buffer.length) throw new Error('MMTP packet truncated in header extension value')\n    extension = { type, data: buffer.subarray(offset, offset + length) }\n    offset += length\n  }\n\n  return {\n    version,\n    packetType,\n    packetId,\n    timestamp,\n    sequenceNumber,\n    payloadLength: buffer.length - offset,\n    fecType,\n    packetCounterFlag,\n    packetCounter,\n    extensionFlag,\n    extension,\n    headerLength: offset,\n    rapFlag,\n  }\n}\n\n/**\n * The MMTP `packet_id` of `buffer`, or null exactly when parseMMTPHeader would\n * throw for it (short buffer, V != 0, truncated packet_counter or header\n * extension).\n *\n * This is the per-packet filter a receiver runs before any other work, so it\n * builds no header object, DataView or BigInt timestamp (BLO-36599). Use\n * parseMMTPHeader when any other header field is needed.\n */\nexport function readMMTPPacketId(buffer: Uint8Array): number | null {\n  if (buffer.length < MMTP_HEADER_SIZE) return null\n  const flags = buffer[0]!\n  if (((flags >> 6) & 0x03) !== 0) return null\n  let offset = MMTP_HEADER_SIZE\n  if ((flags & 0x20) !== 0) {\n    if (offset + 4 > buffer.length) return null\n    offset += 4\n  }\n  if ((flags & 0x02) !== 0) {\n    if (offset + 4 > buffer.length) return null\n    const length = (buffer[offset + 2]! << 8) | buffer[offset + 3]!\n    if (offset + 4 + length > buffer.length) return null\n  }\n  return (buffer[2]! << 8) | buffer[3]!\n}\n\n/**\n * Unwrap MMTP packet to extract payload\n */\nexport function unwrapMMTP(buffer: Uint8Array): MMTPPacket {\n  const header = parseMMTPHeader(buffer)\n  const payload = buffer.subarray(header.headerLength)\n\n  return { header, payload }\n}\n\n/**\n * Parse MPU header from payload\n * ISO/IEC 23008-1:2023 Section 9.2.3.3\n *\n * MPU Header format (8 bytes) as written by FFmpeg/libmmt:\n * - Bytes 0-1: payload_length (16 bits, big-endian)\n * - Byte 2: FT(4) | T(1) | FI(2) | A(1)\n * - Byte 3: fragment_counter (8 bits)\n * - Bytes 4-7: MPU_sequence_number (32 bits, big-endian)\n */\nexport function parseMPUHeader(payload: Uint8Array): MPUHeader {\n  if (payload.length < MPU_HEADER_SIZE) {\n    throw new Error(`Payload too small for MPU header: ${payload.length} bytes`)\n  }\n\n  const view = new DataView(payload.buffer, payload.byteOffset, payload.byteLength)\n\n  // Bytes 0-1: payload_length (16 bits, big-endian)\n  const payloadLength = view.getUint16(0, false)\n\n  // Byte 2: FT(4) | T(1) | FI(2) | A(1)\n  const flagsByte = payload[2]!\n  const timedFlag = (flagsByte >> 3) & 0x01\n  const fragmentationIndicator = (flagsByte >> 1) & 0x03\n  const aggregationFlag = (flagsByte & 0x01) !== 0\n\n  // Byte 3: fragment_counter (8 bits). The high bit is part of the counter in\n  // the current libmmt/FFmpeg writer ABI.\n  const fragmentCounter = payload[3]!\n\n  // Bytes 4-7: MPU_sequence_number (32 bits, big-endian)\n  const mpuSequenceNumber = view.getUint32(4, false)\n\n  return {\n    mpuSequenceNumber,\n    fragmentationIndicator,\n    fragmentCounter,\n    timedFlag,\n    aggregationFlag,\n    payloadLength,\n  }\n}\n\nexport function parseTimedMfuDuHeader(payload: Uint8Array, offset: number): MFUDuHeader | null {\n  if (offset < 0 || offset + MFU_DU_HEADER_SIZE_TIMED > payload.length) return null\n  const view = new DataView(payload.buffer, payload.byteOffset + offset, MFU_DU_HEADER_SIZE_TIMED)\n  return {\n    movieFragmentSequenceNumber: view.getUint32(0, false),\n    sampleNumber: view.getUint32(4, false),\n    offset: view.getUint32(8, false),\n    priority: payload[offset + 12]!,\n    dependencyCounter: payload[offset + 13]!,\n  }\n}\n\n/**\n * Why `extractMFUPayload` refused a packet.\n *\n * These identifiers are part of the public contract: callers surface them in\n * diagnostics, so renaming one is a breaking change.\n */\nexport type MFURejectionGate =\n  | 'packet-shorter-than-mmtp-plus-mpu-header'\n  | 'mmtp-header-unparseable'\n  | 'not-an-mpu-packet'\n  | 'payload-shorter-than-mpu-header'\n  | 'aggregation-flag-set'\n  | 'mpu-payload-length-below-header-remainder'\n  | 'mpu-declared-end-exceeds-payload'\n  | 'mfu-offset-at-or-past-declared-end'\n  | 'source-fec-payload-id-width-mismatch'\n  | 'declared-trailers-unresolved'\n\nexport interface MFURejection {\n  gate: MFURejectionGate\n  /** Human-readable detail, including the byte arithmetic that decided it. */\n  detail: string\n}\n\ninterface MfuPayloadLayout {\n  hasMfuDuHeader: boolean\n  mfuOffset: number\n  dataEnd: number\n}\n\nfunction resolveMfuPayloadLayout(\n  mpu: MPUHeader,\n  fragmentType: number,\n  payload: Uint8Array,\n): { layout: MfuPayloadLayout } | { rejection: MFURejection } {\n  if (mpu.payloadLength < MPU_HEADER_REMAINDER_SIZE) {\n    return {\n      rejection: {\n        gate: 'mpu-payload-length-below-header-remainder',\n        detail: `payload_length=${mpu.payloadLength} < ${MPU_HEADER_REMAINDER_SIZE}`,\n      },\n    }\n  }\n\n  // ISO/IEC 23008-1 defines payload_length from immediately after its own\n  // two-byte field. It therefore includes the remaining six MPU-header bytes.\n  const declaredEnd = MPU_LENGTH_FIELD_SIZE + mpu.payloadLength\n  if (declaredEnd > payload.length) {\n    return {\n      rejection: {\n        gate: 'mpu-declared-end-exceeds-payload',\n        detail:\n          `payload_length=${mpu.payloadLength} implies end=${declaredEnd}, ` +\n          `payload is ${payload.length} bytes`,\n      },\n    }\n  }\n\n  const hasHeader = fragmentType === 2 && mpu.fragmentationIndicator <= 1\n  const mfuHeaderSize = mpu.timedFlag ? MFU_DU_HEADER_SIZE_TIMED : MFU_DU_HEADER_SIZE_NONTIMED\n  const mfuOffset = MPU_HEADER_SIZE + (hasHeader ? mfuHeaderSize : 0)\n  if (mfuOffset >= declaredEnd) {\n    return {\n      rejection: {\n        gate: 'mfu-offset-at-or-past-declared-end',\n        detail: `mfuOffset=${mfuOffset} >= declaredEnd=${declaredEnd}`,\n      },\n    }\n  }\n\n  return {\n    layout: {\n      hasMfuDuHeader: hasHeader,\n      mfuOffset,\n      dataEnd: declaredEnd,\n    },\n  }\n}\n\n// Legacy detached per-packet authenticator suffix `[0xf0a1][len][auth]`. Its\n// producer was removed (BLO-16483) and nothing verifies it any more; provenance\n// is the signed per-group manifest. Receivers still skip an exact suffix so a\n// stale producer degrades to unauthenticated playback instead of dropped\n// packets. ponytail: hard-cut to reject once no deployed producer can emit it.\nconst LEGACY_TRAILER_EXT_TYPE = 0xf0a1\nconst LEGACY_TRAILER_HEADER_SIZE = 4\n\nfunction isEmptyOrExactLegacyTrailer(payload: Uint8Array, start: number, end: number): boolean {\n  if (start === end) return true\n  if (start < 0 || end > payload.length || start + LEGACY_TRAILER_HEADER_SIZE > end) {\n    return false\n  }\n\n  const view = new DataView(\n    payload.buffer,\n    payload.byteOffset + start,\n    end - start,\n  )\n  if (view.getUint16(0, false) !== LEGACY_TRAILER_EXT_TYPE) return false\n\n  const authLength = view.getUint16(2, false)\n  return start + LEGACY_TRAILER_HEADER_SIZE + authLength === end\n}\n\ninterface DeclaredTrailerLayout {\n  hasFecId: boolean\n}\n\nfunction resolveDeclaredTrailers(\n  payload: Uint8Array,\n  declaredEnd: number,\n  fecType: number,\n  options?: { skipFecId?: boolean },\n): DeclaredTrailerLayout | null {\n  if (declaredEnd > payload.length) return null\n\n  if (options?.skipFecId) {\n    return isEmptyOrExactLegacyTrailer(payload, declaredEnd, payload.length)\n      ? { hasFecId: false }\n      : null\n  }\n\n  if (fecType === 1) {\n    const fecStart = payload.length - SOURCE_FEC_PAYLOAD_ID_SIZE\n    if (fecStart < declaredEnd || !isEmptyOrExactLegacyTrailer(payload, declaredEnd, fecStart)) {\n      return null\n    }\n    return { hasFecId: true }\n  }\n  if (fecType !== 0) return null\n\n  if (isEmptyOrExactLegacyTrailer(payload, declaredEnd, payload.length)) {\n    return { hasFecId: false }\n  }\n\n  return null\n}\n\n/**\n * Extract NAL unit payload from MMTP packet\n */\nexport function extractNALUnit(mmtpPacket: Uint8Array): Uint8Array {\n  const extraction = extractMFUPayload(mmtpPacket)\n  if (!extraction) throw new Error('Malformed MMTP MPU payload')\n  return extraction.data\n}\n\n/** Result of extracting MFU payload from an MMTP packet */\nexport interface MFUExtraction {\n  /** MMTP header fields */\n  header: MMTPHeader\n  /** MPU header fields */\n  mpu: MPUHeader\n  /** Fragment type (FT field, 4 bits): 0=metadata, 2=MFU data */\n  fragmentType: number\n  /** MFU payload data (video/audio bytes, headers stripped, FEC ID excluded) */\n  data: Uint8Array\n  /** Parsed timed MFU DU header when present, otherwise null */\n  mfuDuHeader: MFUDuHeader | null\n  /** Non-timed MFU Item_ID when the 4-byte DU header is present. */\n  itemId: number | null\n  /** Source FEC Payload ID if present (`FEC_type == 1`), or null */\n  fecPayloadId: { ssId: number } | null\n}\n\n/**\n * Extract MFU payload from a raw MMTP packet.\n *\n * Handles all the byte arithmetic for:\n * - MMTP header (12 bytes)\n * - MPU sub-header (8 bytes, payloadLength field)\n * - MFU DU header (14 bytes timed / 4 bytes non-timed, only for FI \u2264 1)\n * - Source FEC Payload ID (4 bytes at end, only when `FEC_type == 1`)\n *\n * `payloadLength` is the ISO length-after-field value: six remaining MPU-header\n * bytes, then the MFU DU header when present, then media. The legacy\n * authenticator suffix and the Source FEC trailer are outside that declared span and must consume the exact suffix.\n *\n * @param mmtpPacket Raw MMTP packet (from multicast or MoQ)\n * @param options.skipFecId When true, do NOT subtract the 4-byte Source FEC Payload ID\n *   from the payload boundary, even if fecType >= 1 in the MMTP header.  Use this for\n *   FEC-recovered symbols where the FEC PID was already stripped before WASM decoding\n *   but the fecType bits in byte 0 still reflect the original packet (FEC Type=1 per\n *   draft-ramadan-moq-mmt-00 \u00A73.1).\n * @returns Extracted MFU data + metadata, or null if packet is too small\n */\ninterface MfuPlan {\n  header: MMTPHeader\n  payload: Uint8Array\n  mpu: MPUHeader\n  fragmentType: number\n  layout: MfuPayloadLayout\n  trailerLayout: DeclaredTrailerLayout\n}\n\n/**\n * Single source of truth for whether a packet yields an MFU payload.\n *\n * `extractMFUPayload` and `explainMFURejection` both delegate here, so the\n * reason reported to operators can never drift from the decision the parser\n * actually made.\n */\nfunction planMfuExtraction(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n  parsedHeader?: MMTPHeader,\n): { plan: MfuPlan } | { rejection: MFURejection } {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) {\n    return {\n      rejection: {\n        gate: 'packet-shorter-than-mmtp-plus-mpu-header',\n        detail: `${mmtpPacket.length} bytes < ${MMTP_HEADER_SIZE + MPU_HEADER_SIZE}`,\n      },\n    }\n  }\n\n  let header: MMTPHeader\n  if (parsedHeader) {\n    header = parsedHeader\n  } else {\n    try {\n      header = parseMMTPHeader(mmtpPacket)\n    } catch (error) {\n      return {\n        rejection: {\n          gate: 'mmtp-header-unparseable',\n          detail: error instanceof Error ? error.message : String(error),\n        },\n      }\n    }\n  }\n  if (header.packetType !== PACKET_TYPE_MPU) {\n    return {\n      rejection: {\n        gate: 'not-an-mpu-packet',\n        detail: `packetType=0x${header.packetType.toString(16).padStart(2, '0')}`,\n      },\n    }\n  }\n\n  const payload = mmtpPacket.subarray(header.headerLength)\n  if (payload.length < MPU_HEADER_SIZE) {\n    return {\n      rejection: {\n        gate: 'payload-shorter-than-mpu-header',\n        detail: `${payload.length} bytes < ${MPU_HEADER_SIZE}`,\n      },\n    }\n  }\n\n  const mpu = parseMPUHeader(payload)\n  if (mpu.aggregationFlag) {\n    return {\n      rejection: { gate: 'aggregation-flag-set', detail: 'strict profile requires A=0' },\n    }\n  }\n\n  // Fragment type from byte 2 upper nibble (not returned by parseMPUHeader)\n  const fragmentType = (payload[2]! >> 4) & 0x0f\n\n  const layoutResult = resolveMfuPayloadLayout(mpu, fragmentType, payload)\n  if ('rejection' in layoutResult) return layoutResult\n  const { layout } = layoutResult\n\n  const trailerLayout = resolveDeclaredTrailers(\n    payload,\n    layout.dataEnd,\n    header.fecType,\n    options,\n  )\n  if (!trailerLayout) {\n    // The most common cause is a producer whose Source FEC Payload ID width\n    // disagrees with ISO/IEC 23008-1 \u00A7C.5.2. Name that explicitly rather than\n    // leaving operators to infer it from a generic trailer error.\n    if (!options?.skipFecId && header.fecType === 1) {\n      const observed = payload.length - layout.dataEnd\n      if (observed !== SOURCE_FEC_PAYLOAD_ID_SIZE) {\n        return {\n          rejection: {\n            gate: 'source-fec-payload-id-width-mismatch',\n            detail:\n              `producer wrote a ${observed}-byte Source FEC Payload ID, ` +\n              `ISO/IEC 23008-1 \u00A7C.5.2 requires ${SOURCE_FEC_PAYLOAD_ID_SIZE} ` +\n              `(payload=${payload.length}, declaredEnd=${layout.dataEnd})`,\n          },\n        }\n      }\n    }\n    return {\n      rejection: {\n        gate: 'declared-trailers-unresolved',\n        detail:\n          `trailer bytes [${layout.dataEnd}, ${payload.length}) are neither empty ` +\n          `nor an exact legacy authenticator trailer (fecType=${header.fecType})`,\n      },\n    }\n  }\n\n  return { plan: { header, payload, mpu, fragmentType, layout, trailerLayout } }\n}\n\n/**\n * Report why `extractMFUPayload` would refuse this packet, or null if it would\n * accept it.\n *\n * `extractMFUPayload` returns bare `null` on ten distinct conditions, which\n * makes a producer/consumer framing disagreement indistinguishable from a\n * publisher that never started \u2014 both render as silence. Use this wherever\n * that distinction matters: diagnostics, contract tests, and operator-facing\n * logs.\n */\nexport function explainMFURejection(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n): MFURejection | null {\n  const result = planMfuExtraction(mmtpPacket, options)\n  return 'rejection' in result ? result.rejection : null\n}\n\nexport function extractMFUPayload(\n  mmtpPacket: Uint8Array,\n  options?: { skipFecId?: boolean },\n): MFUExtraction | null {\n  return extractPlannedMfu(mmtpPacket, planMfuExtraction(mmtpPacket, options))\n}\n\n/**\n * extractMFUPayload for a caller that already holds this packet's parsed MMTP\n * header, so the header is not parsed a second time (BLO-36599).\n *\n * `header` must be `parseMMTPHeader(mmtpPacket)` of this same packet; the\n * result is then identical to `extractMFUPayload(mmtpPacket, options)`.\n */\nexport function extractMFUPayloadWithHeader(\n  mmtpPacket: Uint8Array,\n  header: MMTPHeader,\n  options?: { skipFecId?: boolean },\n): MFUExtraction | null {\n  return extractPlannedMfu(mmtpPacket, planMfuExtraction(mmtpPacket, options, header))\n}\n\nfunction extractPlannedMfu(\n  mmtpPacket: Uint8Array,\n  result: { plan: MfuPlan } | { rejection: MFURejection },\n): MFUExtraction | null {\n  if ('rejection' in result) return null\n  const { header, payload, mpu, fragmentType, layout, trailerLayout } = result.plan\n\n  const mfuDuHeaderPresent = layout.hasMfuDuHeader\n  const mfuOffset = layout.mfuOffset\n  const dataEnd = layout.dataEnd\n\n  const mfuDuHeader =\n    mfuDuHeaderPresent && mpu.timedFlag === 1\n      ? parseTimedMfuDuHeader(payload, MPU_HEADER_SIZE)\n      : null\n  const itemId =\n    mfuDuHeaderPresent && mpu.timedFlag === 0\n      ? new DataView(payload.buffer, payload.byteOffset + MPU_HEADER_SIZE, 4).getUint32(0, false)\n      : null\n\n  const data = payload.subarray(mfuOffset, dataEnd)\n\n  const fecPayloadId = trailerLayout.hasFecId\n    ? {\n        ssId: new DataView(\n          mmtpPacket.buffer,\n          mmtpPacket.byteOffset + mmtpPacket.length - SOURCE_FEC_PAYLOAD_ID_SIZE,\n          SOURCE_FEC_PAYLOAD_ID_SIZE,\n        ).getUint32(0, false),\n      }\n    : null\n\n  return { header, mpu, fragmentType, data, mfuDuHeader, itemId, fecPayloadId }\n}\n\n/**\n * Extract timestamp from MMTP packet\n */\nexport function extractTimestamp(mmtpPacket: Uint8Array): bigint {\n  const { header } = unwrapMMTP(mmtpPacket)\n  return header.timestamp\n}\n\n/**\n * Check if MMTP packet is an FEC repair packet\n * FEC_type 2 and 3 are repair packets\n */\nexport function isFecRepairPacket(mmtpPacket: Uint8Array): boolean {\n  if (mmtpPacket.length < 1) return false\n  const fecType = (mmtpPacket[0]! >> 3) & 0x03\n  return fecType >= 2\n}\n\n/**\n * Extract Source FEC Payload ID (SS_ID) from the last 4 bytes of an MMTP\n * source packet per ISO/IEC 23008-1:2023 Section C.5.2 Figure C.10.\n *\n * SS_ID is a flat 32-bit monotonic counter (incremented by 1 per packet\n * for ssbg_mode0 and ssbg_mode1). Block membership and ESI use the\n * configured K; repair SS_Start identifies the first SS_ID of the block and\n * SSB_length records the authored source-symbol count:\n *   SBN = floor(SS_ID / K), ESI = SS_ID % K\n *   SS_Start = SBN * K  (first SS_ID of the block)\n *\n * This matches FFmpeg moqenc_mmt.c, the drafts (draft-ramadan-moq-fec \u00A76.2),\n * and ATSC A/331 \u00A78.1.2.5 which defers to ISO 23008-1 Annex C.\n */\nexport function extractFecPayloadId(mmtpPacket: Uint8Array): { ssId: number } | null {\n  const header = parseHeaderForSourceFecId(mmtpPacket)\n  return header ? sourceFecPayloadIdOf(mmtpPacket, header) : null\n}\n\n/**\n * Return true when FEC_type=1 and the exact suffix after the ISO-declared MPU\n * payload contains a four-byte Source FEC Payload ID.\n */\nexport function hasSourceFecPayloadId(mmtpPacket: Uint8Array): boolean {\n  const header = parseHeaderForSourceFecId(mmtpPacket)\n  return header !== null && sourceFecPayloadIdOf(mmtpPacket, header) !== null\n}\n\nfunction parseHeaderForSourceFecId(mmtpPacket: Uint8Array): MMTPHeader | null {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) return null\n  try {\n    return parseMMTPHeader(mmtpPacket)\n  } catch {\n    return null\n  }\n}\n\n/**\n * The Source FEC Payload ID of a packet whose MMTP header the caller already\n * parsed, or null when the packet carries none: present only when FEC_type=1\n * and the exact suffix after the ISO-declared MPU payload holds the four-byte\n * ID (ISO/IEC 23008-1 \u00A7C.5.2). Same answer as extractFecPayloadId, without a\n * second header parse (BLO-36599).\n *\n * `header` must be `parseMMTPHeader(mmtpPacket)` of this same packet.\n */\nexport function sourceFecPayloadIdOf(\n  mmtpPacket: Uint8Array,\n  header: MMTPHeader,\n): { ssId: number } | null {\n  if (mmtpPacket.length < MMTP_HEADER_SIZE + MPU_HEADER_SIZE) return null\n  if (header.packetType !== PACKET_TYPE_MPU) return null\n\n  const payload = mmtpPacket.subarray(header.headerLength)\n  if (payload.length < MPU_HEADER_SIZE) return null\n  const payloadLength = (payload[0]! << 8) | payload[1]!\n  if (payloadLength < MPU_HEADER_REMAINDER_SIZE) return null\n  const declaredEnd = MPU_LENGTH_FIELD_SIZE + payloadLength\n  if (!resolveDeclaredTrailers(payload, declaredEnd, header.fecType)?.hasFecId) return null\n\n  // Flat 4-byte SS_ID: encoder writes block_id * K + symbol_id\n  const off = mmtpPacket.length - SOURCE_FEC_PAYLOAD_ID_SIZE\n  return {\n    ssId:\n      ((mmtpPacket[off]! << 24) |\n        (mmtpPacket[off + 1]! << 16) |\n        (mmtpPacket[off + 2]! << 8) |\n        mmtpPacket[off + 3]!) >>>\n      0,\n  }\n}\n\n/** Size of Repair FEC Payload ID per ISO/IEC 23008-1 Section C.5.3 */\nexport const REPAIR_FEC_PID_SIZE = 13\n\n/**\n * Parse the 13-byte Repair FEC Payload ID after the complete dynamic MMTP header.\n * `parsedHeader`, when given, must be `parseMMTPHeader(mmtpPacket)` of this\n * same packet; it spares the second header parse (BLO-36599).\n */\nfunction readRepairFecPayloadIdFields(mmtpPacket: Uint8Array, parsedHeader?: MMTPHeader): {\n  packetId: number; ssStart: number; rsbLength: number; rsId: number; ssbLength: number; dataOffset: number\n} | null {\n  let header: MMTPHeader\n  if (parsedHeader) {\n    header = parsedHeader\n  } else {\n    try {\n      header = parseMMTPHeader(mmtpPacket)\n    } catch {\n      return null\n    }\n  }\n  if (header.packetType !== PACKET_TYPE_REPAIR || header.fecType !== 2) return null\n\n  const off = header.headerLength\n  if (mmtpPacket.length < off + REPAIR_FEC_PID_SIZE) return null\n  const ssStart =\n    ((mmtpPacket[off]! << 24) |\n      (mmtpPacket[off + 1]! << 16) |\n      (mmtpPacket[off + 2]! << 8) |\n      mmtpPacket[off + 3]!) >>>\n    0  // 32 bits\n  const rsbLength = (mmtpPacket[off + 4]! << 16) | (mmtpPacket[off + 5]! << 8) | mmtpPacket[off + 6]!  // 24 bits\n  const rsId = (mmtpPacket[off + 7]! << 16) | (mmtpPacket[off + 8]! << 8) | mmtpPacket[off + 9]!  // 24 bits\n  const ssbLength = (mmtpPacket[off + 10]! << 16) | (mmtpPacket[off + 11]! << 8) | mmtpPacket[off + 12]!  // 24 bits\n  return {\n    packetId: header.packetId,\n    ssStart,\n    rsbLength,\n    rsId,\n    ssbLength,\n    dataOffset: off + REPAIR_FEC_PID_SIZE,\n  }\n}\n\n/**\n * Extract Repair FEC Payload ID from a raw-multicast MMTP repair packet.\n * Per ISO/IEC 23008-1:2023 Section C.5.3 (ssbg_mode0, one-stage, no FFSRP_TS):\n *   [MMTP header][SS_Start:4][RSB_length:3][RS_ID:3][SSB_length:3][repair data]\n * OTI is delivered via AL-FEC signaling message (Table C.3), not per-packet.\n *\n * Byte 1 is reserved(2)|packet_type(6) for V=0, so repair type 0x03 is 0x03.\n * Pre-migration high-bits bytes (0x0c) are rejected \u2014 no compatibility decode.\n */\nexport function extractRepairFecPayloadId(mmtpPacket: Uint8Array): {\n  ssStart: number; rsbLength: number; rsId: number; ssbLength: number\n} | null {\n  const fields = readRepairFecPayloadIdFields(mmtpPacket)\n  if (!fields) return null\n  return {\n    ssStart: fields.ssStart,\n    rsbLength: fields.rsbLength,\n    rsId: fields.rsId,\n    ssbLength: fields.ssbLength,\n  }\n}\n\n/** Parsed MoQ repair frame per ISO/IEC 23008-1 Section C.4.3 + C.5.3 */\nexport interface MoqRepairFrame {\n  /** MMTP packetId (1=video, 2=audio) \u2014 for routing to correct FEC decoder */\n  packetId: number\n  /** SS_Start (32 bits): SS_ID of first source symbol in block */\n  ssStart: number\n  /** RSB_length (24 bits): number of repair symbols (P) */\n  rsbLength: number\n  /** RS_ID (24 bits): repair symbol index (0-based) */\n  rsId: number\n  /** SSB_length (24 bits): authored source-symbol count (1..=configured K) */\n  ssbLength: number\n  /** Repair symbol data after the dynamic MMTP header and 13-byte FEC payload ID. */\n  symbolData: Uint8Array\n}\n\n/**\n * Parse a MoQ repair frame (ISO/IEC 23008-1 Annex C format).\n *\n * Wire format per ISO 23008-1 \u00A7C.4.3 + \u00A7C.5.3:\n *   MMTP Header: fixed 12 bytes plus C/X optional fields\n *   then SS_Start (4 bytes) \u2192 block identifier\n *   then RSB_length (3 bytes) \u2192 P\n *   then RS_ID (3 bytes) \u2192 ESI = K + RS_ID\n *   then SSB_length (3 bytes) \u2192 authored source-symbol count (1..=K)\n *   then Repair Symbol Data (T bytes)\n *\n * @param frame - Raw MoQ repair frame bytes\n * @returns Parsed frame or null if invalid\n */\nexport function parseMoqRepairFrame(frame: Uint8Array): MoqRepairFrame | null {\n  return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame))\n}\n\n/**\n * parseMoqRepairFrame for a caller that already holds this frame's parsed MMTP\n * header, so the header is not parsed a second time (BLO-36599). The router's\n * multicast repair branch uses it: one repair packet in every K + P otherwise\n * paid two header parses.\n *\n * `header` must be `parseMMTPHeader(frame)` of this same frame; the result is\n * then identical to `parseMoqRepairFrame(frame)`.\n */\nexport function parseMoqRepairFrameWithHeader(\n  frame: Uint8Array,\n  header: MMTPHeader,\n): MoqRepairFrame | null {\n  return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame, header))\n}\n\nfunction moqRepairFrameFrom(\n  frame: Uint8Array,\n  repairId: ReturnType<typeof readRepairFecPayloadIdFields>,\n): MoqRepairFrame | null {\n  if (!repairId) return null\n\n  const symbolData = frame.subarray(repairId.dataOffset)\n  if (\n    repairId.rsbLength === 0 ||\n    repairId.ssbLength === 0 ||\n    repairId.rsId >= repairId.rsbLength ||\n    symbolData.length === 0\n  ) return null\n\n  return {\n    packetId: repairId.packetId,\n    ssStart: repairId.ssStart,\n    rsbLength: repairId.rsbLength,\n    rsId: repairId.rsId,\n    ssbLength: repairId.ssbLength,\n    symbolData,\n  }\n}\n\n// The signalling-message parsers (9.3.4.2 payload header, AL-FEC message,\n// PA/MPT) live in ./signalling.ts.\n", "/**\n * NTP short format (RFC 5905 \u00A76): an unsigned 32-bit, 16.16 fixed-point count\n * of seconds. The MMTP header `timestamp` field (ISO/IEC 23008-1 \u00A79.2.2)\n * carries each packet's UTC sending instant in this format, so the value wraps\n * to 0 every 2^16 s (~18.2 h).\n *\n * Plain numeric order on these values breaks at every wrap: a retained\n * `Math.max` stays at the pre-wrap value and every later instant compares as\n * older. Order send times only with {@link compareNtpShort}, which applies\n * RFC 1982 serial-number arithmetic over the field's width.\n */\n\n/** Width in bits of the MMTP `timestamp` field (NTP short). */\nexport const NTP_SHORT_BITS = 32\n\n/** Number of distinct NTP-short values; the field wraps to 0 here. */\nexport const NTP_SHORT_MODULUS = 2 ** NTP_SHORT_BITS\n\n/**\n * RFC 1982 \u00A73.2's `2^(SERIAL_BITS - 1)`. Two values whose forward distance is\n * below this are ordered; exactly this far apart they are not ordered at all.\n * Two instants must be less than this far apart (2^15 s, ~9.1 h of send time)\n * for the comparison to give their true order.\n */\nexport const NTP_SHORT_HALF_RANGE = 2 ** (NTP_SHORT_BITS - 1)\n\n/**\n * Serial order of one NTP-short value relative to another.\n *\n * `'unordered'` is RFC 1982's undefined case: the values are exactly\n * {@link NTP_SHORT_HALF_RANGE} apart, so neither precedes the other. It is\n * never folded into `'before'` or `'after'`; each caller decides what an\n * unorderable pair means for it.\n */\nexport type NtpShortOrder = 'before' | 'equal' | 'after' | 'unordered'\n\n/** True when `value` is an NTP-short value: an integer in [0, NTP_SHORT_MODULUS). */\nexport function isNtpShort(value: number): boolean {\n  return Number.isInteger(value) && value >= 0 && value < NTP_SHORT_MODULUS\n}\n\n/**\n * RFC 1982 serial comparison of NTP-short `a` against `b`: `'after'` when `a`\n * is the later instant, `'before'` when it is the earlier one.\n *\n * The answer is the true order only while the two instants are less than\n * {@link NTP_SHORT_HALF_RANGE} apart. Past that a 32-bit field cannot tell\n * later from earlier, and the result names whichever direction is nearer.\n * This is not a total order (it is not transitive across the whole space), so\n * it must never be used to sort.\n *\n * @throws {RangeError} if either operand is not an NTP-short value\n */\nexport function compareNtpShort(a: number, b: number): NtpShortOrder {\n  if (!isNtpShort(a) || !isNtpShort(b)) {\n    throw new RangeError(\n      `NTP-short values must be integers in [0, 2^${NTP_SHORT_BITS}), got ${String(a)} and ${String(b)}`,\n    )\n  }\n  if (a === b) return 'equal'\n  // Forward distance from b to a, reduced into [1, NTP_SHORT_MODULUS). Both\n  // operands are below 2^32, so every step is exact in a double.\n  const forward = (a - b + NTP_SHORT_MODULUS) % NTP_SHORT_MODULUS\n  if (forward < NTP_SHORT_HALF_RANGE) return 'after'\n  if (forward > NTP_SHORT_HALF_RANGE) return 'before'\n  return 'unordered'\n}\n", "/**\n * FEC block profile (BLO-35597, ISO/IEC 23008-1 Annex C).\n *\n * Every catalog `fec` object that declares an FEC instance names its block\n * profile in `fec.blockProfile`. A receiver applies all of a profile's rules\n * or none of them, so the token is the one explicit per-stream discriminator:\n * it is never defaulted and never inferred from the wire.\n *\n * draft-ramadan-moq-fec \u00A75.1 defines exactly one value, and it is the only\n * profile this library implements:\n *\n * - `iso-ssbg1-v1`: ssbg_mode1 (C.3.3): a source symbol is\n *   `u16 length || protected packet || zero padding` to T; a block is a\n *   K' = SSB_length RaptorQ block (C.5.3) and repair ESI = SSB_length + RS_ID;\n *   SS_ID increments by one per FEC source packet and wraps at 2^32 (C.5.2),\n *   so a block is located by membership in `[SS_Start, SS_Start + SSB_length)`\n *   under RFC 1982 serial arithmetic; the MoQ repair group id is the 62-bit\n *   wrap-epoch-extended SS_Start. The AL-FEC coding byte for this profile is\n *   0x14 (one-stage, ssbg_mode1, fec_payload_id_mode 0, Amd 1:2025 Table C.3).\n *\n * A track whose `blockProfile` is absent or names any other token (the\n * retired Blockcast-private `k-padded-v1` included) has no FEC: a receiver\n * consumes its source without FEC and joins none of its repair tracks\n * (draft-ramadan-moq-fec \u00A75.1). `parseFecBlockProfile` throws for such a\n * token; the per-track catalog resolver turns the same rule into a typed\n * per-track \"FEC unavailable\" outcome instead of failing the session.\n */\nimport { serial32Add, serial32Distance, serial32Precedes } from './serial-number.js'\n\n/** The block profile a catalog `fec.blockProfile` may name: the one this library implements. */\nexport type FecBlockProfile = 'iso-ssbg1-v1'\n\n/** Every accepted `fec.blockProfile` token. */\nexport const FEC_BLOCK_PROFILES: readonly FecBlockProfile[] = Object.freeze([\n  'iso-ssbg1-v1',\n])\n\n/** True for a block-profile token this library implements. */\nexport function isFecBlockProfile(value: unknown): value is FecBlockProfile {\n  return value === 'iso-ssbg1-v1'\n}\n\n/**\n * Read a required `fec.blockProfile`. Throws on an absent token and on any\n * token other than `iso-ssbg1-v1`: there is no default and nothing is\n * inferred from the wire (draft-ramadan-moq-fec \u00A75.1).\n *\n * @param where the catalog path of the field, for the error message.\n */\nexport function parseFecBlockProfile(value: unknown, where: string): FecBlockProfile {\n  if (isFecBlockProfile(value)) return value\n  if (value === undefined) {\n    throw new Error(`${where} is required: name the FEC block profile (\"iso-ssbg1-v1\")`)\n  }\n  throw new Error(`${where} must be \"iso-ssbg1-v1\" (got ${JSON.stringify(value)})`)\n}\n\n/** ISO/IEC 23008-1 C.3.3 ssbg_mode1: the two-octet packet length field. */\nexport const SSBG1_LENGTH_FIELD_BYTES = 2\n\n/** The largest protected packet an ssbg_mode1 symbol of size T can carry. */\nexport function ssbg1MaxPacketLength(symbolSize: number): number {\n  return symbolSize - SSBG1_LENGTH_FIELD_BYTES\n}\n\n/** Whether a protected packet of `packetLength` bytes fits one T-byte ssbg_mode1 symbol. */\nexport function ssbg1FitsSymbol(packetLength: number, symbolSize: number): boolean {\n  return (\n    Number.isSafeInteger(packetLength) &&\n    packetLength >= 0 &&\n    packetLength <= ssbg1MaxPacketLength(symbolSize) &&\n    packetLength <= 0xffff\n  )\n}\n\n/**\n * Build one ssbg_mode1 source symbol (C.3.3): the protected packet's length\n * in two octets, network byte order, then the packet, then zero octets up to\n * T. The protected packet is the MMTP packet before its Source FEC Payload ID\n * is appended (C.4.2).\n *\n * @throws when `length + 2 > T`: the packet cannot be protected under this\n * profile, and silently truncating it would corrupt every repair symbol.\n */\nexport function buildSsbg1SourceSymbol(packet: Uint8Array, symbolSize: number): Uint8Array {\n  if (!Number.isSafeInteger(symbolSize) || symbolSize <= SSBG1_LENGTH_FIELD_BYTES) {\n    throw new Error(`ssbg_mode1 symbol size must exceed ${SSBG1_LENGTH_FIELD_BYTES} (got ${symbolSize})`)\n  }\n  if (!ssbg1FitsSymbol(packet.byteLength, symbolSize)) {\n    throw new Error(\n      `ssbg_mode1 source symbol needs ${packet.byteLength} + ${SSBG1_LENGTH_FIELD_BYTES} bytes but T is ${symbolSize}`,\n    )\n  }\n  const symbol = new Uint8Array(symbolSize)\n  symbol[0] = (packet.byteLength >>> 8) & 0xff\n  symbol[1] = packet.byteLength & 0xff\n  symbol.set(packet, SSBG1_LENGTH_FIELD_BYTES)\n  return symbol\n}\n\n/**\n * Recover the protected packet from one ssbg_mode1 source symbol: the bytes\n * the length field names. Returns null, never a guess, when the length field\n * points past the symbol or any padding octet is non-zero (C.3.3 padding is\n * all 00h), since either means the recovered symbol is not what was sent.\n */\nexport function trimSsbg1SourceSymbol(symbol: Uint8Array): Uint8Array | null {\n  if (symbol.byteLength < SSBG1_LENGTH_FIELD_BYTES) return null\n  const length = (symbol[0]! << 8) | symbol[1]!\n  const end = SSBG1_LENGTH_FIELD_BYTES + length\n  if (end > symbol.byteLength) return null\n  for (let i = end; i < symbol.byteLength; i++) {\n    if (symbol[i] !== 0) return null\n  }\n  return symbol.subarray(SSBG1_LENGTH_FIELD_BYTES, end)\n}\n\n/** The SS_ID after the last source symbol of `[ssStart, ssStart + ssbLength)`. */\nexport function isoBlockEnd(ssStart: number, ssbLength: number): number {\n  return serial32Add(ssStart, ssbLength)\n}\n\n/**\n * Range membership (C.5.2, C.5.3): whether `ssId` is one of the\n * `ssbLength` consecutive SS_IDs starting at `ssStart`, modulo 2^32.\n */\nexport function isoBlockContains(ssStart: number, ssbLength: number, ssId: number): boolean {\n  return serial32Distance(ssStart, ssId) < ssbLength\n}\n\n/**\n * A lower bound on how many blocks the block starting at `a` lies behind the\n * one starting at `b` (0 when `a` does not precede `b`). An iso-ssbg1-v1\n * block holds at most `kMax` source symbols (the catalog `sourceSymbols`, the\n * AL-FEC maximum_k_for_repair_flow), so `n * kMax` SS_IDs always span at least\n * `n` blocks. Every interleave horizon in the receiver (decoder retention,\n * worker retirement, ordered-relay settlement) uses this one bound, so the\n * manager's horizon can never fall inside the decoder's.\n */\nexport function isoBlocksBehindLowerBound(a: number, b: number, kMax: number): number {\n  if (!Number.isSafeInteger(kMax) || kMax <= 0) {\n    throw new Error(`iso-ssbg1-v1 block horizon needs a positive maximum K (got ${kMax})`)\n  }\n  return serial32Precedes(a, b) ? Math.floor(serial32Distance(a, b) / kMax) : 0\n}\n", "/**\n * Shared fec-setup helper.\n *\n * Wires a FecWorkerClient into a MulticastManager for a specific track.\n * Both moq-lib (`hang-mmt-fec/js/watch/src/element.ts`) and moqtail\n * (`moqtail-private/apps/client-js/src/lib/player.ts`) call this from their\n * SessionManager `fec-setup` handler so the Worker setup lives in one\n * place instead of being duplicated across ~80 lines per player.\n *\n * Callers are responsible for holding the returned `dispose()` and calling it\n * from their `fec-teardown` path (and/or effect cleanup). It unregisters the\n * Worker from MulticastManager before terminating it, so no symbol is routed\n * to a dead Worker; do not dispose the client directly.\n */\n\nimport { parseFecBlockProfile, type FecBlockProfile } from '@blockcast/mmt-base'\nimport type { FecWorkerClient, FecTrackConfig } from '@blockcast/fec-worker'\nimport type { MulticastManager } from './multicast-manager.js'\nimport {\n  deriveFecRetentionBlocks,\n  LOCAL_FEC_RETENTION_BLOCKS,\n  LOCAL_FEC_TIMEOUT_MS,\n} from '@blockcast/mmt-fec'\nimport { computeFecDeliveryWindowMs } from './track-session.js'\n\n/** Asset URLs the helper needs. Callers pass the already-resolved set. */\nexport interface FecWorkerAssetUrls {\n  /** URL to the fec-worker entry bundle (new Worker() target). */\n  fecWorker: string\n  /** URL to the RaptorQ WASM module (compiled via compileStreaming). */\n  rqWasm: string\n}\n\nexport interface FecWorkerSetupOptions {\n  /** MulticastManager that should receive the configured Worker. */\n  multicastManager: MulticastManager\n  /** MMTP packetId this track occupies (from catalog). */\n  packetId: number\n  /** Human-readable track name (catalog key). */\n  trackName: string\n  /** Track type from catalog. Never inferred from name. */\n  trackType: 'video' | 'audio'\n  /**\n   * The catalog `fec.blockProfile` (BLO-35597). Required and validated with\n   * `parseFecBlockProfile`: `iso-ssbg1-v1` is the only FEC block profile, and\n   * any other token (the retired `k-padded-v1` included) throws before a\n   * Worker is created. Never defaulted, never inferred.\n   */\n  fecBlockProfile: FecBlockProfile\n  /**\n   * FEC K from catalog: the maximum SSB_length (K_max) of any block. Blocks\n   * are variable-length ssbg_mode1 blocks keyed by SS_Start, so K bounds\n   * block distance from below; it never strides SS_IDs into blocks.\n   */\n  fecK: number\n  /** Symbol size in bytes (T). */\n  fecSymbolSize: number\n  /** Repair symbols per block (P). */\n  fecRepairCount: number\n  /**\n   * Repair symbols per block this receiver actually joined: the sum of\n   * `repairSymbols` over the joined BASE layers (draft-ramadan-moq-fec 6.3).\n   * Reported as P by the worker snapshot and CMCD `x-bc-fec-p`, because the\n   * catalog total is not what this receiver joined. Falls back to\n   * `fecRepairCount`, which is the same value on a single-layer track.\n   */\n  joinedRepairCount?: number\n  /** Catalog interleave span in integer milliseconds; zero means no span. */\n  fecInterleaveMs: number\n  /** Explicit catalog jitter/reorder allowance in ms. */\n  fecReorderToleranceMs?: number\n  /**\n   * Duration of one FEC media unit in ms (video frame or audio access unit).\n   * Required only when the catalog supplies a positive elapsed FEC span. A\n   * missing/zero span must not invent a media cadence for its local bound.\n   */\n  mediaUnitDurationMs?: number\n  /** Optional repair track name (MoQ). Forwarded to FecTrackConfig. */\n  repairTrackName?: string\n  /** Audio sample rate (optional \u2014 audio tracks only). */\n  sampleRate?: number\n  /** Codec string (optional; \"unknown\" is acceptable for first setup). */\n  codec?: string\n  /** Video framerate (optional metadata forwarded to the worker). */\n  framerate?: number\n  /** Absolute or origin-relative asset URLs. */\n  assetUrls: FecWorkerAssetUrls\n  /** Optional FecWorkerClient factory \u2014 main use is test injection. */\n  clientFactory?: (workerUrl: URL) => FecWorkerClient\n}\n\nexport interface FecWorkerSetupResult {\n  /** The configured client (already registered with MulticastManager). */\n  client: FecWorkerClient\n  /** Removes the Worker from MulticastManager routing, then releases it. */\n  dispose: () => void\n}\n\n/**\n * Configure a FecWorkerClient and attach it to `multicastManager` via\n * `setFecWorker(packetId, client, trackType, config, trackName)`. Worker-path takes precedence\n * over any sync WASM decoder already registered for the same packetId \u2014\n * sync decoders remain as a fallback.\n *\n * Any loader failure is re-thrown so the caller can log and leave the sync\n * WASM decoder active as fallback (same pattern both players used before).\n */\nexport async function setupFecWorkerForTrack(\n  opts: FecWorkerSetupOptions,\n): Promise<FecWorkerSetupResult> {\n  // A zero span is the catalog's no-deadline signal. It still configures the\n  // decoder, but its retention and cleanup values are receiver-local. Do not\n  // pass it through a timing derivation: that would turn a missing media\n  // cadence into a made-up FEC deadline.\n  if (\n    !Number.isFinite(opts.fecInterleaveMs) ||\n    !Number.isSafeInteger(opts.fecInterleaveMs) ||\n    opts.fecInterleaveMs < 0\n  ) {\n    throw new Error(\n      `[FEC] interleaveDepthMs (opts.fecInterleaveMs) must be a finite non-negative integer ` +\n        `(got ${opts.fecInterleaveMs})`,\n    )\n  }\n  if (\n    opts.fecReorderToleranceMs !== undefined &&\n    (!Number.isFinite(opts.fecReorderToleranceMs) || opts.fecReorderToleranceMs < 0)\n  ) {\n    throw new Error(\n      `[FEC] fecReorderToleranceMs must be finite and >= 0 ` +\n        `(got ${opts.fecReorderToleranceMs})`,\n    )\n  }\n  const hasCatalogTiming = opts.fecInterleaveMs > 0\n  const validateWorkerGeometry = (): void => {\n    // `computeFecDeliveryWindowMs` used to reject a malformed K as a side\n    // effect. The no-span path intentionally skips that timing derivation, so\n    // keep decoder geometry validation at this trust boundary before creating\n    // a Worker. T is likewise checked here because the Worker receives it\n    // through the asynchronous configure message.\n    if (!Number.isSafeInteger(opts.fecK) || opts.fecK <= 0) {\n      throw new Error(`[FEC] fecK must be a finite positive integer (got ${opts.fecK})`)\n    }\n    if (\n      !Number.isSafeInteger(opts.fecSymbolSize) ||\n      opts.fecSymbolSize <= 0 ||\n      opts.fecSymbolSize % 8 !== 0\n    ) {\n      throw new Error(\n        `[FEC] fecSymbolSize must be a positive 8-byte-aligned integer (got ${opts.fecSymbolSize})`,\n      )\n    }\n    if (!Number.isSafeInteger(opts.fecRepairCount) || opts.fecRepairCount <= 0) {\n      throw new Error(\n        `[FEC] fecRepairCount must be a finite positive integer (got ${opts.fecRepairCount})`,\n      )\n    }\n  }\n  let deliveryWindowMs: number\n  let interleaveDepthBlocks: number\n  if (!hasCatalogTiming) {\n    validateWorkerGeometry()\n    deliveryWindowMs = LOCAL_FEC_TIMEOUT_MS\n    interleaveDepthBlocks = LOCAL_FEC_RETENTION_BLOCKS\n  } else {\n    const mediaUnitDurationMs = opts.mediaUnitDurationMs\n    if (\n      typeof mediaUnitDurationMs !== 'number' ||\n      !Number.isFinite(mediaUnitDurationMs) ||\n      mediaUnitDurationMs <= 0\n    ) {\n      throw new Error(\n        `[FEC] mediaUnitDurationMs must be finite and > 0 (got ${mediaUnitDurationMs})`,\n      )\n    }\n    validateWorkerGeometry()\n    deliveryWindowMs = computeFecDeliveryWindowMs({\n      interleaveDepthMs: opts.fecInterleaveMs,\n      sourceSymbols: opts.fecK,\n      repairSymbols: opts.fecRepairCount,\n      symbolSize: opts.fecSymbolSize,\n      mediaUnitsPerSecond: 1000 / mediaUnitDurationMs,\n      jitterBufferMs: opts.fecReorderToleranceMs,\n    })\n    // `interleaveDepth` is a decoder block count. It is derived only for a\n    // positive catalog span; no-span uses the fixed local count above.\n    interleaveDepthBlocks = deriveFecRetentionBlocks(\n      deliveryWindowMs,\n      opts.fecInterleaveMs,\n    )\n  }\n  const blockProfile = parseFecBlockProfile(\n    opts.fecBlockProfile,\n    `[FEC] ${opts.trackName} fec.blockProfile`,\n  )\n  // `FecTrackConfig.interleaveDepth` is a BLOCK COUNT, not D. Every consumer\n  // measures block distance with it: the worker's `advanceMediaHorizon`\n  // retires a block more than `interleaveDepth` blocks behind the live SS_ID\n  // (`isoBlocksBehind`, a lower bound from K_max), and `MmtFecDecoder::new`\n  // documents its argument as \"the number of interleaved blocks\" before\n  // `cleanup_by_ss_start` retires every block that far behind and counts it\n  // `blocks_failed`.\n  //\n  // `deriveFecInterleaveDepth` returns D \u2014 MEDIA UNITS per block \u2014 so feeding\n  // it here mixed units and sized the retention window in the wrong quantity.\n  // It survived where D happened to land near the real block count and retired\n  // live blocks where it did not. Measured against the live ISS catalog at\n  // reorderToleranceMs=100, retention vs the block's own deadline (the worker\n  // arms `deadlineTs = now + deliveryWindowMs` per block):\n  //\n  //   720p  span 33ms  D=1 -> 2 blocks =  66ms  vs deadline 133ms  UNDER by 67ms\n  //   480p  span 67ms  D=2 -> 3 blocks = 201ms  vs deadline 167ms  ok\n  //   360p  span 67ms  D=2 -> 3 blocks = 201ms  vs deadline 167ms  ok\n  //   audio span 43ms  D=2 -> 3 blocks = 129ms  vs deadline 143ms  UNDER by 14ms\n  //\n  // 480p/360p passed only because D=2 coincided with a workable block count.\n  // On 720p and audio the decoder expired blocks \u2014 counting them failed \u2014 while\n  // the receiver's own deadline for them had not yet passed.\n  //\n  // Resolve URL against location.origin when available (browser runtime).\n  // Absolute URLs pass through unchanged per the URL() spec.\n  const origin =\n    typeof location !== 'undefined' && location.origin ? location.origin : 'http://localhost'\n  const workerUrl = new URL(opts.assetUrls.fecWorker, origin)\n\n  const FecWorkerCtor = await import('@blockcast/fec-worker')\n  const client = opts.clientFactory\n    ? opts.clientFactory(workerUrl)\n    : new FecWorkerCtor.FecWorkerClient(workerUrl)\n\n  // Compile RaptorQ WASM once.\n  const rqWasm = await WebAssembly.compileStreaming(fetch(opts.assetUrls.rqWasm))\n\n  const fecTrackConfig = {\n    codec: opts.codec ?? 'unknown',\n    trackName: opts.trackName,\n    trackType: opts.trackType,\n    framerate: opts.framerate,\n    sampleRate: opts.sampleRate,\n    algorithm: 'raptor',\n    blockProfile,\n    k: opts.fecK,\n    // P as this receiver joined it, not the catalog total: the worker snapshot\n    // and CMCD `x-bc-fec-p` are read from this. Identity on a single layer.\n    repairCount: opts.joinedRepairCount ?? opts.fecRepairCount,\n    symbolSize: opts.fecSymbolSize,\n    interleaveDepth: interleaveDepthBlocks,\n    interleaveMs: opts.fecInterleaveMs,\n    deliveryWindowMs,\n    fecMode: 'subframe' as const,\n    repairTrack: opts.repairTrackName,\n    relayBlockSigEnabled: false,\n  } as unknown as FecTrackConfig\n\n  client.configure(fecTrackConfig, rqWasm)\n  try {\n    opts.multicastManager.setFecWorker(opts.packetId, client, opts.trackType, {\n      blockProfile,\n      k: opts.fecK,\n      symbolSize: opts.fecSymbolSize,\n      interleaveDepthMs: opts.fecInterleaveMs,\n      // No-span tracks have no catalog media cadence. The manager still gets\n      // the local cleanup budget, but it must not use a guessed fps for timing\n      // or classification.\n      ...(hasCatalogTiming ? { fps: 1000 / opts.mediaUnitDurationMs! } : {}),\n      timeoutMs: deliveryWindowMs,\n    }, opts.trackName)\n  } catch (e) {\n    // The manager refused the registration (for example the stream still\n    // routes to another Worker). The Worker this call created is not in\n    // routing and nothing else holds it, so release it before reporting.\n    try {\n      client.dispose()\n    } catch {\n      /* dispose errors are non-fatal */\n    }\n    throw e\n  }\n\n  let disposed = false\n  return {\n    client,\n    dispose: () => {\n      if (disposed) return\n      disposed = true\n      // Unregister first so no symbol is routed to a dead Worker between the\n      // dispose below and the manager noticing. A false return means the\n      // Worker was already gone from routing, which this helper never does on\n      // its own, so make that loud instead of leaving it to the next symbol.\n      if (!opts.multicastManager.clearFecWorker(opts.packetId, opts.trackName)) {\n        console.warn(\n          `[fec-worker-setup] packetId=${opts.packetId} track=${opts.trackName} Worker was not registered when disposed`,\n        )\n      }\n      try {\n        client.dispose()\n      } catch {\n        /* dispose errors are non-fatal */\n      }\n    },\n  }\n}\n", "/**\n * TrackSession \u2014 per-track transport state machine.\n * SessionManager \u2014 orchestrates all sessions + TransportPool.\n *\n * Implements Patent Claim 9 (draft-ramadan-moq-fec APPLICATION-1):\n *   (a) subscribe unicast\n *   (b) simultaneously join multicast\n *   (c) render from unicast during join\n *   (d) activate multicast on RAP, suppress unicast\n *   (e) cross-transport FEC repair during transition\n *   (f) hysteresis before switching away from multicast\n *   (g) re-subscribe unicast on sustained failure\n *\n * PIM: manages transport state without inspecting packet contents.\n */\n\nimport {\n  TransportPool,\n  type Subscription,\n  type SubscriptionMode,\n  type AcquireOptions,\n  type DirectSocketHealth,\n  type TransportPoolOptions,\n} from './transport-pool.js'\nimport { fecBlockBudgetMs } from '@blockcast/mmt-fec'\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\nexport type TrackState =\n  | 'idle'\n  | 'unicast'\n  | 'unicast-fallback'\n  | 'joining'\n  | 'multicast'\n  | 'amt'\n  | 'failing'\n\nexport interface TrackSessionConfig {\n  trackName: string\n  trackType: 'video' | 'audio'\n  packetId: number\n  /** FEC interleave depth from catalog (ms). Used for hysteresis timer. */\n  fecInterleaveMs: number\n  /** Explicit catalog jitter/reorder allowance in ms. */\n  fecReorderToleranceMs?: number\n  /** FEC K from catalog. Used for audio worklet latency calculation. */\n  fecK: number\n  /** FEC repair symbols per block (P). NOT symbol size. */\n  fecRepairCount: number\n  /**\n   * Repair symbols per block this receiver actually joined: the sum of\n   * `repairSymbols` over the joined BASE layers, not a count of layers\n   * (draft-ramadan-moq-fec 6.3). A keyframe overlay is a separate FEC instance\n   * and is not included.\n   *\n   * This is runtime join state, not catalog geometry: a receiver on a clean\n   * path joins layer 0 only while a lossy one adds layers, so the catalog's\n   * total P is not what this receiver is receiving. Diagnostics that report P\n   * (the worker snapshot, CMCD `x-bc-fec-p`) must read this.\n   *\n   * Absent when the caller joins no layers explicitly, in which case P_0 is\n   * what was joined. That is an identity on a single-layer track, not a\n   * catalog default: with one layer, P_0 is the total.\n   */\n  joinedRepairCount?: number\n  /** FEC symbol size in bytes (T). Required for WASM decoder OTI. */\n  fecSymbolSize: number\n  /** MoQ repair track name from catalog FEC config. */\n  repairTrackName?: string\n  /** Frame samples from initData parsing (audio-init-parser.ts). */\n  frameSamples?: number\n  /** Audio sample rate from catalog. */\n  sampleRate?: number\n  /** Ordered transport preference: best first. */\n  preferredTransports: SubscriptionMode[]\n  /** Subscription key for multicast/AMT: \"(S,G,port)\". */\n  multicastKey?: string\n  /** MoQ track name for unicast subscription. */\n  moqTrackName?: string\n  /** AMT relay address (if AMT is in preference chain). */\n  amtRelay?: string\n  /** MoQ relay URL (for WebTransport subscription). */\n  moqRelayUrl?: string\n}\n\n// ---------------------------------------------------------------------------\n// PIM callbacks (protocol-independent \u2014 transport state only)\n// ---------------------------------------------------------------------------\n\nexport interface SessionManagerCallbacks {\n  /** Fired on every transport state transition. */\n  onStateChange?(trackName: string, from: TrackState, to: TrackState): void\n  /** Fired to suppress/unsuppress unicast for this track (transport arbitration). */\n  onSuppress?(trackName: string, suppressed: boolean): void\n  /**\n   * Fired when a track sat in `joining` for SessionManager.takeoverDeadlineMs\n   * without a RAP (BLO-9413/D9). The session has already returned to `unicast`\n   * (nothing was suppressed, so nothing to restore) and it keeps its FEC\n   * decoder armed, because the multicast socket is still joined and the router\n   * still admits the stream's symbols. The host should abandon the router-side\n   * attempt (e.g. MediaRouter.failbackToMoq()) so the router stops waiting for\n   * a keyframe that is never coming; it must not dispose the decoder here. The\n   * decoder is released on the next transport edge (unsubscribe, failbackAll,\n   * or transportFailed falling back to unicast) through fec-teardown.\n   */\n  onTakeoverTimeout?(trackName: string): void\n}\n\n// ---------------------------------------------------------------------------\n// MMTP application-layer extension (FEC lifecycle, media resets)\n// ---------------------------------------------------------------------------\n\n/**\n * MMTP track events (discriminated union).\n * Each protocol layer defines its own event union \u2014 MMTP events cover\n * media resets, latency, and FEC lifecycle.\n */\nexport type MmtpTrackEvent =\n  | { type: 'reset' }\n  | { type: 'latency'; latencyMs: number }\n  | { type: 'fec-setup' }\n  | { type: 'fec-teardown' }\n\n/**\n * MMTP application-layer extension of SessionManagerCallbacks.\n * Single onTrackEvent dispatches all MMTP-specific events.\n * PIM consumers use the base SessionManagerCallbacks (no onTrackEvent).\n *\n * IWA can define its own subinterface with its own TrackEvent union\n * (e.g., IwaTrackEvent for socket health, AMT state) using the same pattern.\n */\nexport interface MmtpSessionCallbacks extends SessionManagerCallbacks {\n  onTrackEvent?(trackName: string, event: MmtpTrackEvent, config: TrackSessionConfig): void\n}\n\n/**\n * Loss-hysteresis window covering the signaled FEC block span plus jitter.\n *\n * `fecK` no longer feeds the math; it is still validated as a catalog\n * well-formedness guard and kept in the signature for positional API compat\n * (removal is a follow-up with the next cross-repo pin bump).\n */\nexport function computeFecLossWindowMs(fecInterleaveMs: number, fecK: number, jitterBufferMs?: number): number {\n  return computeFecDeliveryWindowMs({\n    interleaveDepthMs: fecInterleaveMs,\n    sourceSymbols: fecK,\n    jitterBufferMs,\n  })\n}\n\nexport interface FecDeliveryWindowConfig {\n  interleaveDepthMs: number\n  sourceSymbols: number\n  repairSymbols?: number\n  symbolSize?: number\n  mediaUnitsPerSecond?: number\n  bandwidthBps?: number\n  /**\n   * Explicit jitter/reorder allowance in ms, added once to the complete span.\n   * Callers pass their signaled catalog allowance, never a local default.\n   */\n  jitterBufferMs?: number\n}\n\n/**\n * The catalog interleaveDepthMs is the complete FEC block span, including the\n * repair tail. K, P, cadence, and bandwidth must not expand it again. Geometry\n * fields remain accepted for existing callers, but do not feed deadline math.\n */\nexport function computeFecDeliveryWindowMs(\n  config: FecDeliveryWindowConfig,\n): number {\n  const fecK = config.sourceSymbols\n  if (!Number.isFinite(fecK) || fecK <= 0) {\n    throw new Error(\n      `[TrackSession] fecK=${fecK}. ` +\n      `Derive a positive FEC source-symbol count from the stream catalog.`\n    )\n  }\n  return fecSpanDeliveryWindowMs(config.interleaveDepthMs, config.jitterBufferMs)\n}\n\n/**\n * The delivery window of a \u00A75.1 span alone. Every window is this; K only\n * validates a track's geometry in computeFecDeliveryWindowMs, so a caller\n * with a span and no K (FECManager's stream-global envelope) uses this\n * rather than invent one.\n */\nexport function fecSpanDeliveryWindowMs(interleaveDepthMs: number, jitterBufferMs?: number): number {\n  if (!Number.isFinite(interleaveDepthMs) || interleaveDepthMs <= 0) {\n    throw new Error(\n      `[TrackSession] fecInterleaveMs=${interleaveDepthMs}. ` +\n      `Derive a positive FEC interleave window from the stream catalog.`\n    )\n  }\n  // Absence stays absent; it does not authorize a synthesized reorder budget.\n  if (jitterBufferMs === undefined) return Math.ceil(interleaveDepthMs)\n  return fecBlockBudgetMs(interleaveDepthMs, jitterBufferMs)\n}\n\n/** Convert the shared FEC delivery deadline into an integer media timescale. */\nexport function computeFecDeliveryWindowMediaUnits(\n  config: FecDeliveryWindowConfig,\n  timestampTimescale: number,\n): number {\n  if (!Number.isFinite(timestampTimescale) || timestampTimescale <= 0) {\n    throw new Error(\n      `[TrackSession] timestampTimescale=${timestampTimescale}. ` +\n      'Derive a positive media timescale from the container.',\n    )\n  }\n  const deliveryWindow = Math.ceil(\n    computeFecDeliveryWindowMs(config) * timestampTimescale / 1000,\n  )\n  if (!Number.isSafeInteger(deliveryWindow)) {\n    throw new Error('[TrackSession] FEC delivery window exceeds the media timestamp range.')\n  }\n  return deliveryWindow\n}\n\n// ---------------------------------------------------------------------------\n// TrackSession\n// ---------------------------------------------------------------------------\n\nexport class TrackSession {\n  readonly config: TrackSessionConfig\n  #state: TrackState = 'idle'\n  #subscription: Subscription | null = null\n  #hysteresisTimer: ReturnType<typeof setTimeout> | null = null\n  #joinDeadlineTimer: ReturnType<typeof setTimeout> | null = null\n  #previousPrimary: SubscriptionMode | null = null\n  #manager: SessionManager\n  // Single suppression authority flag (BLO-9413 failback coherence): every\n  // suppress this session fires is recorded here, and every path that leaves\n  // a suppressed state unwinds through #unsuppress(). Before this flag,\n  // unsubscribe() only un-suppressed from multicast/amt \u2014 a session torn down\n  // from `failing` (exactly where a starving track sits) was re-subscribed to\n  // unicast with the host's media still muted: MoQ playing into a dead sink.\n  #suppressFired = false\n  // Single FEC authority flag: set by the fec-setup edges (joinStarted,\n  // enterUnicastFallback), cleared by the fec-teardown edge in #transition.\n  // Setup and teardown are paired by construction, so a takeover timeout that\n  // parks the session in `unicast` keeps the decoder the still-joined\n  // transport is feeding, and the later unsubscribe still tears it down.\n  #fecArmed = false\n\n  constructor(config: TrackSessionConfig, manager: SessionManager) {\n    this.config = config\n    this.#manager = manager\n  }\n\n  // -----------------------------------------------------------------------\n  // State\n  // -----------------------------------------------------------------------\n\n  get state(): TrackState { return this.#state }\n  get subscription(): Subscription | null { return this.#subscription }\n\n  /** True while this session's onSuppress(true) is outstanding (no matching\n   *  onSuppress(false) yet). Test/assertion surface for failback coherence. */\n  get isSuppressed(): boolean { return this.#suppressFired }\n\n  /** Current active transport mode, or null if idle. */\n  get transport(): SubscriptionMode | null {\n    switch (this.#state) {\n      case 'multicast': return 'multicast'\n      case 'amt': return 'amt'\n      case 'unicast': return 'moq'\n      case 'unicast-fallback': return 'moq' // SSM bridge absent \u2014 MoQ unicast is the only source\n      case 'joining': return 'moq' // MoQ still primary during join\n      case 'failing': return this.#previousPrimary\n      default: return null\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Computed (no magic numbers)\n  // -----------------------------------------------------------------------\n\n  /** Audio worklet latency: max(fecInterleaveMs, frameDurationMs * fecK).\n   *  Returns undefined if frame duration unknown (no initData). */\n  get audioLatencyMs(): number | undefined {\n    const fd = this.frameDurationMs\n    if (fd === undefined) {\n      return this.config.fecInterleaveMs > 0 ? this.config.fecInterleaveMs : undefined\n    }\n    return Math.max(this.config.fecInterleaveMs, fd * this.config.fecK)\n  }\n\n  /** Frame duration in ms, derived from frameSamples + sampleRate. */\n  get frameDurationMs(): number | undefined {\n    const { frameSamples, sampleRate } = this.config\n    if (!frameSamples || !sampleRate || sampleRate <= 0) return undefined\n    return (frameSamples / sampleRate) * 1000\n  }\n\n  // -----------------------------------------------------------------------\n  // Transitions (Patent Claim 9)\n  // -----------------------------------------------------------------------\n\n  /** idle \u2192 unicast: player subscribes to this track. */\n  subscribe(): void {\n    if (this.#state !== 'idle') return\n    this.#transition('unicast')\n\n    // Emit audio latency on first subscribe\n    if (this.config.trackType === 'audio') {\n      const latency = this.audioLatencyMs\n      if (latency !== undefined) {\n        this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'latency', latencyMs: latency }, this.config)\n      }\n    }\n  }\n\n  /** unicast \u2192 joining: multicast/AMT capability detected, join in progress. */\n  joinStarted(): void {\n    if (this.#state !== 'unicast') return\n    this.#transition('joining')\n    // FEC decoders must be ready before multicast data arrives (Claim 9e:\n    // cross-transport repair). A session re-joining after a takeover timeout\n    // still owns its decoder, so fec-setup fires once per FEC epoch.\n    this.#armFec()\n  }\n\n  /**\n   * any non-fallback state \u2192 unicast-fallback. Used when the SSM bridge is\n   * absent (vanilla Chromium / no extension) and the host falls back to a\n   * MoQ unicast subscription per track. Terminal-ish: activateMulticast,\n   * failbackAll, and transportFailed are no-ops while in this state.\n   *\n   * Fires fec-setup so the per-track repair worker spins up \u2014 repair packets\n   * still flow over the MoQ repair-track subscription, so FEC source+repair\n   * can converge as in the multicast path.\n   *\n   * Audio latency is NOT re-emitted here: subscribe() already fires latency\n   * once on the idle \u2192 unicast edge, and enterUnicastFallback is only ever\n   * reached from a non-idle state (SessionManager skips idle sessions).\n   */\n  enterUnicastFallback(): void {\n    if (this.#state === 'unicast-fallback') return\n    this.#clearHysteresis()\n    this.#transition('unicast-fallback')\n    // Suppress the redundant unicast media decoder. On the no-bridge path the\n    // host feeds MoQ-unicast source packets into MulticastManager (the render\n    // consumer); a second base-media subscribe (the @moq/watch decoder) would\n    // split the single connection's QUIC flow-control budget and stall delivery\n    // (BLO-8969). Fire suppress here, on the fallback edge, so the decoder is\n    // gated off before it subscribes rather than after the relay forward task\n    // has already wedged.\n    this.#suppress()\n    this.#armFec()\n  }\n\n  /**\n   * unicast-fallback \u2192 unicast. Called when the SSM bridge appears mid-session\n   * (extension installed after fallback engaged). Host first aborts the fallback\n   * drainers, then transitions sessions back to unicast so the regular\n   * multicast/AMT preference chain can take over via joinStarted().\n   */\n  exitUnicastFallback(): void {\n    if (this.#state !== 'unicast-fallback') return\n    this.#transition('unicast')\n    // Un-suppress the unicast decoder: the bridge appeared mid-session, so the\n    // host tears down the fallback drainers and the regular preference chain\n    // (joinStarted -> joining -> rapReceived) will re-suppress on multicast RAP.\n    this.#unsuppress()\n  }\n\n  /**\n   * joining \u2192 multicast or amt: RAP received on the joined transport (Claim 9d).\n   * Resets audio worklet, then suppresses MoQ.\n   */\n  rapReceived(mode: 'multicast' | 'amt'): void {\n    if (this.#state !== 'joining') return\n    this.#previousPrimary = mode\n    this.#transition(mode)\n    if (this.config.trackType === 'audio') {\n      this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'reset' }, this.config)\n    }\n    this.#suppress()\n  }\n\n  /** multicast/amt \u2192 failing: loss detected, start hysteresis timer (Claim 9f). */\n  lossDetected(): void {\n    if (this.#state !== 'multicast' && this.#state !== 'amt') return\n\n    // A zero/absent catalog span carries no elapsed FEC deadline. The stall\n    // detector that calls this method already supplied the generic loss\n    // evidence, so there is no FEC hysteresis window to derive here. Follow\n    // the existing transport-failure edge immediately instead of inventing a\n    // local timeout for a catalog value that explicitly supplied none.\n    if (this.config.fecInterleaveMs === 0 || this.config.fecInterleaveMs === undefined) {\n      this.transportFailed()\n      return\n    }\n\n    this.#previousPrimary = this.#state as SubscriptionMode\n    this.#transition('failing')\n\n    // Hysteresis timer: sustained loss before failback (Claim 9f). Use the\n    // same complete span plus explicit allowance as FECManager and workers.\n    const hysteresisMs = computeFecLossWindowMs(\n      this.config.fecInterleaveMs,\n      this.config.fecK,\n      this.config.fecReorderToleranceMs,\n    )\n    this.#hysteresisTimer = setTimeout(() => {\n      this.hysteresisExpired()\n    }, hysteresisMs)\n  }\n\n  /** failing \u2192 previous primary: loss recovered within hysteresis window. */\n  lossRecovered(): void {\n    if (this.#state !== 'failing') return\n    this.#clearHysteresis()\n    if (this.#previousPrimary) {\n      this.#transition(this.#previousPrimary as TrackState)\n    }\n  }\n\n  /**\n   * Transport failed (AMT relay down, multicast interface gone).\n   * Try next transport in preference chain.\n   */\n  transportFailed(): void {\n    this.#clearHysteresis()\n    // Unicast-fallback is terminal: the host owns the subscription and\n    // SessionManager transport machinery does not arbitrate it.\n    if (this.#state === 'unicast-fallback') return\n    const current = this.#previousPrimary ?? this.transport\n    const prefs = this.config.preferredTransports\n    const currentIdx = current ? prefs.indexOf(current) : -1\n    const nextMode = prefs[currentIdx + 1]\n\n    if (nextMode !== undefined && nextMode !== 'moq') {\n      // Next is multicast or AMT: start joining. `joining` means MoQ is\n      // primary again (see transport getter), so if the failed transport had\n      // suppressed unicast, restore it for the join window or the viewer\n      // watches black video until the next RAP (which may never come).\n      // The chain position moves with the attempt: a join that times out\n      // parks the session in `unicast` with this transport recorded, so the\n      // next failure continues past it rather than re-trying the transport\n      // that already failed and re-firing onTakeoverTimeout on every lap.\n      this.#previousPrimary = nextMode\n      this.#transition('joining')\n      this.#unsuppress()\n      return\n    }\n    // MoQ is next, or the chain is exhausted: unicast either way (Claim 9g).\n    // For a session parked in `unicast` with its decoder retained after a\n    // takeover timeout, this transition is a self-edge and fires no teardown,\n    // so the release is explicit. It is the \"transportFailed falling back to\n    // unicast\" release path the onTakeoverTimeout doc names, and #disarmFec is\n    // idempotent, so it is a no-op when the transition already fired the\n    // teardown. The audio reset is not flag-guarded, so it is tied to the edge\n    // itself: a session already resting in unicast changed no transport and\n    // owes the host no reset, however many pool subscriptions fail for it.\n    const from = this.#state\n    this.#previousPrimary = null\n    this.#transition('unicast')\n    this.#disarmFec()\n    this.#unsuppress()\n    if (from !== 'unicast' && this.config.trackType === 'audio') {\n      this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'reset' }, this.config)\n    }\n  }\n\n  /** Hysteresis expired \u2192 failback to next transport (Claim 9g). */\n  hysteresisExpired(): void {\n    if (this.#state !== 'failing') return\n    this.#clearHysteresis()\n    this.transportFailed()\n  }\n\n  /** \u2192 idle: player unsubscribes / tab close / cleanup. */\n  unsubscribe(): void {\n    this.#clearHysteresis()\n    if (this.#state !== 'idle') {\n      this.#transition('idle')\n      // Unwind any outstanding suppression regardless of which state we left.\n      // The old `wasActive` check (multicast/amt only) leaked suppression when\n      // tearing down from `failing` or `unicast-fallback` \u2014 failbackAll()'s\n      // unsubscribe\u2192subscribe cycle then re-entered unicast with the host's\n      // media still muted (BLO-9413 freeze: \"failing back\" logged, video dead).\n      this.#unsuppress()\n    }\n  }\n\n  /** True when SessionManager.enterUnicastFallback put this track into the\n   *  host-driven unicast subscription mode. Host can iterate sessions to\n   *  decide whether to keep its fallback drainer alive across MediaRouter\n   *  arbitration events. */\n  get isUnicastFallback(): boolean {\n    return this.#state === 'unicast-fallback'\n  }\n\n  /**\n   * True while this track owns a FEC decoder (fec-setup fired, fec-teardown\n   * not yet). Stays true across a takeover timeout that parked the session in\n   * `unicast`; SessionManager.failbackAll uses it to release such sessions.\n   */\n  get isFecArmed(): boolean {\n    return this.#fecArmed\n  }\n\n  /**\n   * Start the deadline a `joining` entry deferred while the join was inactive\n   * (SessionManager.joinActive). The track gets the FULL deadline from here,\n   * because that is when media can first arrive. No-op outside `joining` and\n   * when a deadline is already running, so it never shortens or restarts one.\n   *\n   * The `joinActive` guard is what makes this safe to call from anywhere: a\n   * track parked in `joining` with a deferred (null) timer satisfies the other\n   * two, so without it a host calling this while the join is still inactive\n   * would arm the exact deadline the gate exists to defer -- silently\n   * reinstating BLO-34289. It is a no-op for the internal caller, which writes\n   * `#joinActive = true` before iterating the sessions.\n   */\n  armDeferredJoinDeadline(): void {\n    if (this.#state !== 'joining' || this.#joinDeadlineTimer !== null) return\n    if (!this.#manager.joinActive) return\n    this.#armJoinDeadline(this.#manager.takeoverDeadlineMs)\n  }\n\n  dispose(): void {\n    this.#clearHysteresis()\n    this.#clearJoinDeadline()\n    this.#state = 'idle'\n    this.#subscription = null\n    // Release through the teardown edge, not a bare assignment: the\n    // retained-FEC park makes `unicast` + isFecArmed a resting state, and\n    // SessionManager.dispose() calls this directly (removeTrack() reaches it\n    // via unsubscribe(), which has already disarmed). A bare assignment there\n    // drops the host's decoder without a fec-teardown -- a leaked Worker.\n    this.#disarmFec()\n  }\n\n  // -----------------------------------------------------------------------\n  // Internal\n  // -----------------------------------------------------------------------\n\n  #transition(to: TrackState, opts?: { retainFec?: boolean }): void {\n    const from = this.#state\n    if (from === to) return\n    // Takeover deadline (BLO-9413/D9): every entry into `joining` arms it\n    // (joinStarted AND transportFailed-failover both route through here);\n    // every exit cancels it. Without this, a transport that accepts the\n    // subscribe but never delivers a RAP parks the session in `joining`\n    // forever (observed live in the Phase-0 headless repro). The value is\n    // resolved before any state write, so the one residual failure -- a\n    // manager whose deadline was never set at all, which addTrack() refuses --\n    // leaves the session in its previous state rather than half-transitioned.\n    // Invalid values never reach here: SessionManager's setter refuses them.\n    // The read is unconditional even when `joinActive` defers the arm, so a\n    // manager without a deadline still fails closed on every joining edge.\n    const joinDeadlineMs = to === 'joining' ? this.#manager.takeoverDeadlineMs : undefined\n    this.#state = to\n    if (from === 'joining') this.#clearJoinDeadline()\n    if (joinDeadlineMs !== undefined && this.#manager.joinActive) {\n      this.#armJoinDeadline(joinDeadlineMs)\n    }\n    // FEC teardown: entering a state without a FEC decoder releases the one\n    // this track armed, unless the caller keeps it (takeover timeout: the\n    // transport is still joined and still feeding the decoder).\n    const fecActive = (s: TrackState) =>\n      s === 'joining' ||\n      s === 'multicast' ||\n      s === 'amt' ||\n      s === 'failing' ||\n      s === 'unicast-fallback'\n    if (!fecActive(to) && !opts?.retainFec) this.#disarmFec()\n    this.#manager.callbacks?.onStateChange?.(this.config.trackName, from, to)\n  }\n\n  #clearHysteresis(): void {\n    if (this.#hysteresisTimer !== null) {\n      clearTimeout(this.#hysteresisTimer)\n      this.#hysteresisTimer = null\n    }\n  }\n\n  #armJoinDeadline(deadlineMs: number): void {\n    this.#clearJoinDeadline()\n    if (deadlineMs === 0) return // a declared 0 disables the deadline\n    this.#joinDeadlineTimer = setTimeout(() => {\n      this.#joinDeadlineTimer = null\n      if (this.#state !== 'joining') return\n      // No RAP within the deadline: return to unicast for arbitration only.\n      // MoQ was never suppressed in `joining`, so there is nothing to restore\n      // and this edge stays silent on onSuppress (asserted in tests). The\n      // multicast socket is still joined and the router still admits this\n      // stream's symbols, so the FEC decoder stays armed; the next transport\n      // edge releases it.\n      this.#transition('unicast', { retainFec: true })\n      this.#manager.callbacks?.onTakeoverTimeout?.(this.config.trackName)\n    }, deadlineMs)\n  }\n\n  #clearJoinDeadline(): void {\n    if (this.#joinDeadlineTimer !== null) {\n      clearTimeout(this.#joinDeadlineTimer)\n      this.#joinDeadlineTimer = null\n    }\n  }\n\n  /** Fire fec-setup exactly once per FEC epoch. */\n  #armFec(): void {\n    if (this.#fecArmed) return\n    this.#fecArmed = true\n    this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'fec-setup' }, this.config)\n  }\n\n  /** Fire fec-teardown for an armed decoder; no-op when none is armed. */\n  #disarmFec(): void {\n    if (!this.#fecArmed) return\n    this.#fecArmed = false\n    this.#manager.mmtp?.onTrackEvent?.(this.config.trackName, { type: 'fec-teardown' }, this.config)\n  }\n\n  /** Fire onSuppress(true) exactly once per suppression epoch. */\n  #suppress(): void {\n    if (this.#suppressFired) return\n    this.#suppressFired = true\n    this.#manager.callbacks?.onSuppress?.(this.config.trackName, true)\n  }\n\n  /** Unwind an outstanding suppression; no-op when none is outstanding. */\n  #unsuppress(): void {\n    if (!this.#suppressFired) return\n    this.#suppressFired = false\n    this.#manager.callbacks?.onSuppress?.(this.config.trackName, false)\n  }\n}\n\n// ---------------------------------------------------------------------------\n// SessionManager\n// ---------------------------------------------------------------------------\n\n/**\n * Largest takeover deadline setTimeout represents faithfully. setTimeout\n * coerces its delay to a signed 32-bit int, so a larger value fires on the\n * next tick (Node also warns TimeoutOverflowWarning) instead of after the\n * window the host asked for -- silently inverting the feature. Rejecting it\n * keeps the classic units bug (seconds-as-ms, a wrong timescale) loud.\n */\nexport const MAX_TAKEOVER_DEADLINE_MS = 2_147_483_647\n\n/**\n * How long `joinActive` may stay false before the library says so. The deferral\n * is unbounded by construction -- that is the feature -- so a host that never\n * flips it back parks every track in `joining` with no timer at all: exactly the\n * forever-join the takeover deadline exists to prevent, only silent. MoQ stays\n * unsuppressed so the viewer sees video, but onTakeoverTimeout never fires, the\n * FEC decoder stays armed, and the preference chain never advances past the\n * transport that failed. It looks like a slow join. A host is one un-awaited\n * rejection between `false` and `true` away from it, so the library complains\n * rather than trusting every future host to get all of its exit paths right.\n *\n * Generous against a genuinely slow subscribe -- a bridge reconnect or AMT relay\n * handshake is seconds -- so anything still unsettled here is broken, not slow.\n */\nexport const JOIN_DEFER_WARN_MS = 30_000\n\nexport class SessionManager {\n  readonly pool: TransportPool\n  readonly sessions = new Map<string, TrackSession>()\n  callbacks: SessionManagerCallbacks | null = null\n  #takeoverDeadlineMs: number | undefined = undefined\n  #joinActive = true\n  #joinDeferWarnTimer: ReturnType<typeof setTimeout> | null = null\n\n  /**\n   * Takeover deadline (BLO-9413/D9): the time a session may sit in `joining`\n   * without a RAP before returning to `unicast` and firing onTakeoverTimeout.\n   * MoQ is never suppressed during `joining`, so expiry abandons the takeover\n   * without a playback glitch. The host derives it from the catalog (RAP\n   * cadence from groupDurationTicks/timescale plus the signaled FEC delivery\n   * window or reorder tolerance) and sets it before addTrack(). There is no\n   * default: an unset value fails addTrack() closed, and reading the getter\n   * before assignment throws the same way, so no host ever holds a\n   * `number | undefined` it could coalesce back into a default.\n   * `hasTakeoverDeadline` answers whether one was admitted. A declared 0\n   * disables the deadline. The value is an integer number of milliseconds:\n   * setTimeout truncates fractions, so a host that divides ticks by a\n   * timescale must round before assigning.\n   *\n   * Assignment validates, so the diagnostic lands at the host's own call site.\n   * That is what bounds the blast radius: `joining` is entered from\n   * joinStarted(), from the transportFailed() failover branch -- itself\n   * reachable from a setTimeout via hysteresisExpired(), where no caller could\n   * catch a throw -- and from the activateMulticast()/activateAmt()/pool-failure\n   * loops, where a throw on one session would abandon its siblings mid-loop\n   * (the split-brain those loops exist to prevent). Refusing a bad value at\n   * assignment means no host mutation can make an already-admitted session\n   * throw out of a transport edge.\n   */\n  get takeoverDeadlineMs(): number {\n    return this.#requireTakeoverDeadlineMs()\n  }\n\n  set takeoverDeadlineMs(value: number) {\n    if (!Number.isInteger(value) || value < 0 || value > MAX_TAKEOVER_DEADLINE_MS) {\n      throw new Error(\n        `[SessionManager] takeoverDeadlineMs must be an integer from 0 to ${MAX_TAKEOVER_DEADLINE_MS} (0 disables it, larger values overflow setTimeout); got ${String(value)}`,\n      )\n    }\n    this.#takeoverDeadlineMs = value\n  }\n\n  /** True once the host has admitted a deadline; a declared 0 counts. */\n  get hasTakeoverDeadline(): boolean {\n    return this.#takeoverDeadlineMs !== undefined\n  }\n\n  /**\n   * Whether the transport the joining tracks are waiting on is actually\n   * subscribed. The takeover deadline is a media-arrival budget and media\n   * cannot arrive before the join exists, so while this is false, entering\n   * `joining` arms no deadline; flipping it true starts the FULL deadline for\n   * every track already parked there.\n   *\n   * Default true, which is the arm-on-`joining` behaviour every host had\n   * before: a host that only calls joinStarted() after its own join resolves\n   * (moqtail-private's player, post-BLO-33339) is already at the right edge and\n   * needs no gate. A host that arms joinStarted() up front \u2014 to have FEC\n   * decoders ready before the first datagram \u2014 sets this false before addTrack()\n   * and true when its subscribe settles. Charging a slow subscribe (bridge\n   * reconnect, AMT relay handshake) against the media budget expired the\n   * deadline before the subscription existed and abandoned the join on the\n   * happy path. BLO-34289.\n   *\n   * The deadline is a media budget (group cadence plus FEC delivery window) and\n   * budgets nothing for reaching the stream, so ideally it starts at\n   * MulticastTransport.onDataPlaneLive, the join's first accepted packet. Over\n   * AMT that is measurably later than a settled subscribe: the subscribe\n   * settles once the gateway has sent its Membership Update, and the relay's\n   * upstream join plus a path RTT (0.4-0.8 s measured to the prod relay) still\n   * precede the first packet. But RFC 7450 gives a gateway no signal that the\n   * relay has traffic for its (S,G), so a join whose source never sends never\n   * reaches that edge. Starting the deadline there is therefore sound only when\n   * the provider bounds the join phase itself, with a typed subscription error\n   * for a join that delivers nothing (MulticastTransport forwards it to\n   * onFailback). A host whose provider makes no such guarantee flips this true\n   * when the subscribe settles and accepts that join latency is charged to the\n   * media budget; holding it until the first packet would park a silent join\n   * in `joining` forever.\n   *\n   * The flag tracks the host's primary join, not per-track transport state. A\n   * track that fails over to the next transport in its own chain while this is\n   * false (transportFailed's failover branch also enters `joining`) has that\n   * deadline gated on the primary join activating, not on its own transport.\n   * Under the documented usage -- false once at setup, true once the subscribe\n   * settles -- the two coincide.\n   *\n   * The gate is on the ENTRY into `joining`, and false cannot take back a\n   * deadline already running: the `true -> false` edge arms the warn below and\n   * clears nothing. So set it false BEFORE the `joining` entry it is meant to\n   * gate. A host that instead flipped it false after a `transportFailed()`\n   * failover had already entered `joining` would leave the full deadline\n   * counting against a subscribe that had not begun -- BLO-34289 again, on the\n   * failover edge. Clearing running deadlines on that edge is deliberately NOT\n   * done: this flag is manager-wide, so one transport's brief false would\n   * cancel an unrelated track's live deadline and then re-arm it at FULL length\n   * on the next activation (armDeferredJoinDeadline sees `joining` + a null\n   * timer and cannot tell a cleared deadline from a deferred one). Every\n   * unrelated transport blip would restart the whole budget, so under repeated\n   * failover a track that should have timed out is extended indefinitely and\n   * never advances. Only a false that never returns true loses the timer\n   * outright, and JOIN_DEFER_WARN_MS already covers that.\n   *\n   * Leaving this false is not free: see JOIN_DEFER_WARN_MS.\n   */\n  get joinActive(): boolean {\n    return this.#joinActive\n  }\n\n  set joinActive(active: boolean) {\n    const wasActive = this.#joinActive\n    this.#joinActive = active\n    if (!active) {\n      // Edge-triggered: a host re-declaring false has not restarted its\n      // subscribe, and total deferral is what the warning is about.\n      if (wasActive) this.#armJoinDeferWarn()\n      return\n    }\n    this.#clearJoinDeferWarn()\n    if (wasActive) return\n    for (const [, session] of this.sessions) session.armDeferredJoinDeadline()\n  }\n\n  #armJoinDeferWarn(): void {\n    this.#joinDeferWarnTimer = setTimeout(() => {\n      this.#joinDeferWarnTimer = null\n      const deferred = [...this.sessions.values()].filter(s => s.state === 'joining').length\n      console.warn(\n        `[SessionManager] joinActive has been false for ${JOIN_DEFER_WARN_MS} ms and ${deferred} track(s) sit in 'joining' with no takeover deadline. Set joinActive = true when the subscribe settles, on every exit path including failures, or these tracks never time out, never release their FEC decoders, and never advance to the next transport.`,\n      )\n    }, JOIN_DEFER_WARN_MS)\n  }\n\n  #clearJoinDeferWarn(): void {\n    if (this.#joinDeferWarnTimer === null) return\n    clearTimeout(this.#joinDeferWarnTimer)\n    this.#joinDeferWarnTimer = null\n  }\n\n  /** Narrow to MMTP callbacks (onTrackEvent). Safe \u2014 optional chaining handles PIM-only consumers. */\n  get mmtp(): MmtpSessionCallbacks | null {\n    return this.callbacks as MmtpSessionCallbacks | null\n  }\n\n  constructor(poolOptions?: TransportPoolOptions) {\n    this.pool = new TransportPool(poolOptions)\n\n    // Wire pool failure \u2192 per-track failover\n    this.pool.onSubscriptionFailed(sub => {\n      for (const trackName of sub.consumers) {\n        const session = this.sessions.get(trackName)\n        if (session) session.transportFailed()\n      }\n    })\n  }\n\n  // -----------------------------------------------------------------------\n  // Track management\n  // -----------------------------------------------------------------------\n\n  /**\n   * The admitted takeover deadline. Throws only when the host never set one,\n   * every other invalid value being refused by the setter, and returns a\n   * declared 0 as 0. The getter and addTrack() both route through it, so a\n   * session cannot exist without an admitted deadline, which is what makes\n   * the #transition() read unable to throw on an already-admitted session.\n   */\n  #requireTakeoverDeadlineMs(): number {\n    const value = this.#takeoverDeadlineMs\n    if (value === undefined) {\n      throw new Error(\n        '[SessionManager] takeoverDeadlineMs is unset; set a catalog-derived takeover deadline (0 disables it) before adding tracks',\n      )\n    }\n    return value\n  }\n\n  /** Add a track session from catalog config. */\n  addTrack(config: TrackSessionConfig): TrackSession {\n    if (this.sessions.has(config.trackName)) {\n      throw new Error(`[SessionManager] Track \"${config.trackName}\" already exists`)\n    }\n    this.#requireTakeoverDeadlineMs()\n    const session = new TrackSession(config, this)\n    this.sessions.set(config.trackName, session)\n    return session\n  }\n\n  /** Remove a track session. Releases subscription with grace period. */\n  removeTrack(trackName: string): void {\n    const session = this.sessions.get(trackName)\n    if (!session) return\n    session.unsubscribe()\n\n    // Release pool subscription\n    const subKey = session.config.multicastKey ?? session.config.moqTrackName\n    if (subKey) this.pool.releaseSubscription(subKey, trackName)\n\n    session.dispose()\n    this.sessions.delete(trackName)\n  }\n\n  // -----------------------------------------------------------------------\n  // Atomic multi-track operations\n  // -----------------------------------------------------------------------\n\n  /**\n   * All tracks with multicast RAP \u2192 multicast state (atomic).\n   * Called when MediaRouter fires onSourceSwitch('multicast').\n   * Prevents split-brain between video and audio.\n   *\n   * A takeover deadline can return a track from `joining` to `unicast` while\n   * the multicast socket keeps delivering packets and the track keeps its FEC\n   * decoder armed. If a valid RAP arrives later, that late-RAP edge suppresses\n   * unicast and promotes multicast without a second fec-setup.\n   */\n  activateMulticast(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'unicast') {\n        session.joinStarted()\n      }\n      if (session.state === 'joining') {\n        session.rapReceived('multicast')\n      }\n    }\n  }\n\n  /**\n   * All tracks with AMT RAP \u2192 amt state (atomic).\n   */\n  activateAmt(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'unicast') {\n        session.joinStarted()\n      }\n      if (session.state === 'joining') {\n        session.rapReceived('amt')\n      }\n    }\n  }\n\n  /**\n   * All tracks \u2192 unicast (failback, atomic).\n   * Called when MulticastManager fires onFailback().\n   * unicast-fallback sessions are skipped \u2014 the host owns those subscriptions\n   * and they must drain uninterrupted across transport-state events.\n   *\n   * Coherence invariant (BLO-9413): after this returns, every non-fallback\n   * session is `unicast` (or `idle`), unsuppressed, and without a FEC decoder.\n   * unsubscribe() unwinds any outstanding suppression regardless of the state\n   * it tears down from (`failing` included; see TrackSession.#suppressFired),\n   * and a session that a takeover timeout parked in `unicast` with its decoder\n   * still armed is cycled too, because this transport edge is what releases\n   * that decoder (unsubscribe fires fec-teardown).\n   */\n  failbackAll(): void {\n    for (const [, session] of this.sessions) {\n      const parkedWithFec = session.state === 'unicast' && session.isFecArmed\n      if (\n        parkedWithFec ||\n        (session.state !== 'idle' &&\n          session.state !== 'unicast' &&\n          session.state !== 'unicast-fallback')\n      ) {\n        session.unsubscribe()\n        session.subscribe() // re-enter unicast\n      }\n    }\n  }\n\n  /**\n   * All tracks \u2192 unicast-fallback (atomic).\n   * Called by the host when the multicast gateway is absent and\n   * the player will subscribe to source tracks over MoQ unicast and feed\n   * packets via MulticastManager.feedUnicastSource() (or manager.router\n   * directly). Sessions in this state stay terminal until the host calls\n   * unsubscribe() / disposes the SessionManager.\n   */\n  enterUnicastFallback(): void {\n    for (const [, session] of this.sessions) {\n      if (session.state === 'idle') continue\n      session.enterUnicastFallback()\n    }\n  }\n\n  /**\n   * True if any session is currently in unicast-fallback. Hosts use this to\n   * gate `multicastTrack.close()` on failback events \u2014 closing the shared\n   * broadcast would kill the host's fallback drainers.\n   */\n  hasActiveFallback(): boolean {\n    for (const [, session] of this.sessions) {\n      if (session.isUnicastFallback) return true\n    }\n    return false\n  }\n\n  /**\n   * All fallback tracks \u2192 unicast (atomic).\n   * Called when the SSM bridge appears mid-session and the host has aborted\n   * the fallback drainers. The session re-enters the regular preference chain\n   * via joinStarted() (issued by the host immediately after).\n   */\n  exitUnicastFallback(): void {\n    for (const [, session] of this.sessions) {\n      if (session.isUnicastFallback) session.exitUnicastFallback()\n    }\n  }\n\n  // -----------------------------------------------------------------------\n  // Cleanup lifecycle\n  // -----------------------------------------------------------------------\n\n  /** Tab closed \u2014 release all subscriptions for this tab (grace period). */\n  tabClosed(tabId: string): void {\n    // All tracks owned by this tab \u2192 idle\n    for (const [trackName, session] of this.sessions) {\n      session.unsubscribe()\n      this.pool.releaseAllForConsumer(trackName)\n    }\n  }\n\n  /** Bridge WebTransport connection dropped \u2014 same as tab close. */\n  bridgeDisconnected(): void {\n    this.tabClosed('bridge')\n  }\n\n  /**\n   * Track selection changed (user or ABR).\n   * Old track released (grace period), new track subscribed.\n   */\n  trackSelectionChanged(oldTrackName: string, newConfig: TrackSessionConfig): void {\n    this.removeTrack(oldTrackName)\n    const session = this.addTrack(newConfig)\n    session.subscribe()\n  }\n\n  // -----------------------------------------------------------------------\n  // Query\n  // -----------------------------------------------------------------------\n\n  /** Get a track session by name. */\n  getTrack(trackName: string): TrackSession | undefined {\n    return this.sessions.get(trackName)\n  }\n\n  // -----------------------------------------------------------------------\n  // Cleanup\n  // -----------------------------------------------------------------------\n\n  dispose(): void {\n    this.#clearJoinDeferWarn()\n    for (const [, session] of this.sessions) {\n      session.dispose()\n    }\n    this.sessions.clear()\n    this.pool.dispose()\n    this.callbacks = null\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;AA4UA,SAAS,kBAAkB,OAAiB;AAC3C,QAAM,QAAQ,CAAC,cAAc;AAC7B,MAAI,MAAM;AAAS,UAAM,KAAK,MAAM,OAAO;AAC3C,MAAI,MAAM,UAAU;AACnB,UAAMA,YAAW,CAAC,MAAM,QAAQ;AAChC,QAAI,MAAM;AAAQ,MAAAA,UAAS,KAAK,OAAO,MAAM,MAAM,CAAC;AACpD,QAAI,MAAM;AAAO,MAAAA,UAAS,KAAK,OAAO,MAAM,KAAK,CAAC;AAClD,UAAM,KAAK,MAAMA,UAAS,KAAK,GAAG,CAAC,EAAE;EACtC;AACA,MAAI,MAAM,iBAAiB,OAAO;AACjC,QAAI,MAAM,MAAM,WAAW,MAAM,MAAM,YAAY,MAAM,SAAS;AACjE,YAAM,KAAK,MAAM,MAAM,OAAO;IAC/B;AACA,QAAI,MAAM,MAAM;AAAO,YAAM,KAAK,MAAM,MAAM,KAAK;EACpD,WAAW,MAAM,SAAS,MAAM;AAC/B,UAAM,KAAK,OAAO,MAAM,KAAK,CAAC;EAC/B;AACA,SAAO,MAAM,KAAK,IAAI;AACvB;AAEA,SAAS,yBAAyB,OAAmB;AACpD,QAAM,OAAO,MAAM;AACnB,QAAM,SACL,QAAQ,OAAO,KACd,gBAAgB,QAAQ,KAAK,KAAK,OAAO,KACxC,KAAK,OAAO,UAAU,SAAS,KAAK,IAAI,CAAC;AAC5C,SAAO,4DAA4D,MAAM;AAC1E;AAvWA,IAqBa;AArBb;;;AAqBM,IAAO,kBAAP,MAAsB;MAClB;MACT,WAAkE;MAClE,cAAuD;MACvD,iBAA6D;MAC7D,qBAAqD;MACrD,WAA0E;MAC1E,mBAAuC;MACvC,qBAAqB,oBAAI,IAAG;MAC5B,iBAAiB;MACjB,eAAe;MACf,YAAY;;;;;MAKZ,kBAAsC,CAAA;MACtC,mBAAmC,CAAA;MACnC,eAAe;;MAEf,gBAAgB;;;;MAIhB,yBAAyB;MACzB,0BAA0B;;;;;MAM1B,YAAY,aAAyB;AACpC,YAAI,uBAAuB,KAAK;AAC/B,eAAK,UAAU,IAAI,OAAO,aAAa,EAAE,MAAM,SAAQ,CAAE;QAC1D,OAAO;AACN,eAAK,UAAU;QAChB;AACA,aAAK,QAAQ,YAAY,CAAC,MACzB,KAAK,aAAa,EAAE,IAAI;AACzB,aAAK,QAAQ,UAAU,CAAC,MAAK;AAC5B,eAAK,WAAW,kBAAkB,CAAC,GAAG,gBAAgB;QACvD;AACA,aAAK,QAAQ,iBAAiB,CAAC,MAAK;AACnC,eAAK,WAAW,yBAAyB,CAAC,GAAG,gBAAgB;QAC9D;MACD;;;;;;;MAQA,UACC,QACA,YAA8B;AAE9B,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,4BAA4B;AAChE,aAAK,cAAa;AAClB,cAAM,MAAwB;UAC7B,MAAM;UACN;UACA;;AAID,aAAK,QAAQ,YAAY,GAAG;MAC7B;;;;;;MAOA,WACC,MACA,MACA,IAAU;AAEV,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,mDAAmD;AACvF,aAAK,aAAa,EAAE,MAAM,cAAc,MAAM,MAAM,GAAE,GAAI,IAAI;MAC/D;;;;;;;;;;MAWA,WACC,SACA,WACA,MACA,MACA,IAAU;AAEV,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,mDAAmD;AACvF,aAAK,aAAa,EAAE,MAAM,cAAc,SAAS,WAAW,MAAM,MAAM,GAAE,GAAI,IAAI;MACnF;MAEA,aAAa,QAA0B,MAAiB;AACvD,YAAI,CAAC,KAAK,eAAe;AACxB,eAAK,QAAQ,YAAY,QAAQ,CAAC,IAAI,CAAC;AACvC;QACD;AACA,aAAK,gBAAgB,KAAK,MAAM;AAChC,aAAK,iBAAiB,KAAK,IAAI;AAC/B,YAAI,KAAK;AAAc;AACvB,aAAK,eAAe;AACpB,uBAAe,MAAK;AACnB,eAAK,eAAe;AACpB,eAAK,cAAa;QACnB,CAAC;MACF;;;;;MAMA,gBAAa;AACZ,YAAI,KAAK,gBAAgB,WAAW,KAAK,KAAK;AAAW;AACzD,cAAM,UAAU,KAAK;AACrB,cAAM,WAAW,KAAK;AACtB,aAAK,kBAAkB,CAAA;AACvB,aAAK,mBAAmB,CAAA;AACxB,aAAK,QAAQ,YACZ,EAAE,MAAM,eAAe,QAAO,GAC9B,QAAQ;MAEV;;;;MAKA,cAAc,KAAa,KAAkB,MAAiB;AAC7D,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,sDAAsD;AAC1F,aAAK,cAAa;AAClB,aAAK,QAAQ,YACZ,EAAE,MAAM,iBAAiB,KAAK,KAAK,KAAI,GACvC,CAAC,KAAK,IAAI,CAAC;MAEb;;;;;;;;MASA,QAAQ,YAAkB;AACzB,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,gDAAgD;AACpF,YACC,CAAC,OAAO,UAAU,UAAU,KAC5B,aAAa,KACb,aAAa,YACZ;AACD,gBAAM,IAAI,MAAM,iDAAiD;QAClE;AACA,YAAI,KAAK,kBAAkB;AAC1B,eAAK,mBAAmB,IAAI,UAAU;AACtC;QACD;AACA,aAAK,aAAa,oBAAI,IAAI,CAAC,UAAU,CAAC,CAAC;MACxC;;MAGA,QAAK;AACJ,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,8CAA8C;AAClF,aAAK,cAAa;AAClB,aAAK;AACL,aAAK,mBAAmB;AACxB,aAAK,mBAAmB,MAAK;AAC7B,aAAK,QAAQ,YAAY,EAAE,MAAM,QAAO,CAA6B;MACtE;MAEA,aAAa,MAAiB;AAG7B,aAAK,cAAa;AAClB,aAAK,mBAAmB;AACxB,cAAM,cAAc,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AAClD,aAAK,QAAQ,YACZ,EAAE,MAAM,WAAW,MAAM,YAAW,CAA6B;MAEnE;;MAGA,QAAQ,IAAgD;AACvD,aAAK,WAAW;MACjB;;MAGA,WAAW,IAAkC;AAC5C,aAAK,cAAc;MACpB;;;;;;;MAQA,cAAc,IAAqC;AAClD,aAAK,iBAAiB;AACtB,aAAK,uBAAsB;MAC5B;MAEA,yBAAsB;AACrB,YACC,KAAK,aACL,KAAK,2BACL,CAAC,KAAK,0BACN,CAAC,KAAK;AACL;AACF,aAAK,0BAA0B;AAC/B,aAAK,QAAQ,YACZ,EAAE,MAAM,wBAAuB,CAA6B;MAE9D;;MAGA,kBAAkB,IAAyB;AAC1C,aAAK,qBAAqB;MAC3B;;MAGA,QAAQ,IAAwD;AAC/D,aAAK,WAAW;MACjB;;;;;;;MAQA,IAAI,WAAQ;AACX,eAAO,KAAK;MACb;;;;;MAMA,UAAO;AACN,YAAI,KAAK;AAAW;AACpB,aAAK,YAAY;AAEjB,aAAK,kBAAkB,CAAA;AACvB,aAAK,mBAAmB,CAAA;AACxB,aAAK,mBAAmB;AACxB,aAAK,mBAAmB,MAAK;AAC7B,aAAK,QAAQ,YAAY,EAAE,MAAM,UAAS,CAA6B;AACvE,aAAK,QAAQ,UAAS;MACvB;MAEA,aAAa,OAAqB;AACjC,YAAI,MAAM,SAAS,gBAAgB;AAClC,cAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,aAAa,GAAG;AAC5E,iBAAK,gBAAgB;UACtB;AACA,cAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK,MAAM,SAAS,SAAS,uBAAuB,GAAG;AACtF,iBAAK,yBAAyB;AAC9B,iBAAK,uBAAsB;UAC5B;AACA;QACD;AACA,YAAI,MAAM,SAAS,iBAAiB;AACnC,eAAK,iBAAiB,KAAK,IAAI,GAAG,KAAK,iBAAiB,CAAC;AACzD,eAAK,eAAe;AACpB;QACD;AACA,YAAI,MAAM,SAAS,SAAS;AAC3B,cAAI,MAAM,SAAS,gBAAgB;AAClC,iBAAK,iBAAiB,KAAK,IAAI,GAAG,KAAK,iBAAiB,CAAC;AACzD,iBAAK,eAAe;UACrB;AACA,cAAI,MAAM;AAAM,iBAAK,WAAW,MAAM,SAAS,MAAM,IAAI;;AACpD,iBAAK,WAAW,MAAM,OAAO;AAClC;QACD;AACA,YAAI,KAAK,iBAAiB,KAAK,KAAK;AAAc;AAClD,gBAAQ,MAAM,MAAM;UACnB,KAAK;AACJ,iBAAK,WAAW,MAAM,MAAM,MAAM,IAAI;AACtC;UACD,KAAK;AACJ,iBAAK,cAAc,MAAM,KAAK;AAC9B;UACD,KAAK;AACJ,iBAAK,iBAAiB,MAAM,KAAK;AACjC;UACD,KAAK;AACJ,uBAAW,OAAO,MAAM,MAAM;AAC7B,mBAAK,qBAAqB,GAAG;YAC9B;AACA,iBAAK,mBAAmB;AACxB,gBAAI,KAAK,mBAAmB,OAAO,GAAG;AACrC,oBAAM,OAAO,KAAK;AAClB,mBAAK,qBAAqB,oBAAI,IAAG;AACjC,mBAAK,aAAa,IAAI;YACvB;AACA;QACF;MACD;;;;;;ACvHD,SAASC,mBAAkB,OAAiB;AAC3C,QAAM,QAAQ,CAAC,cAAc;AAC7B,MAAI,MAAM;AAAS,UAAM,KAAK,MAAM,OAAO;AAC3C,MAAI,MAAM,UAAU;AACnB,UAAM,MAAM,CAAC,MAAM,QAAQ;AAC3B,QAAI,MAAM;AAAQ,UAAI,KAAK,OAAO,MAAM,MAAM,CAAC;AAC/C,QAAI,MAAM;AAAO,UAAI,KAAK,OAAO,MAAM,KAAK,CAAC;AAC7C,UAAM,KAAK,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE;EACjC;AACA,MAAI,MAAM,iBAAiB,SAAS,MAAM,MAAM;AAAO,UAAM,KAAK,MAAM,MAAM,KAAK;AACnF,SAAO,MAAM,KAAK,IAAI;AACvB;AA7NA,IA+Da,sBAEA;AAjEb;;;AA+DO,IAAM,uBAAuB;AAE9B,IAAO,oBAAP,MAAwB;MACpB;MACT,eAA0E;MAC1E,WAAuD;MACvD,WAA4E;MAC5E,YAAY;;MAGH;MACT,QAAQ;;MACR,aAAa;;MACb,uBAAuB;;;;;;;MAOvB,YAAY,aAA2B,OAAiC,CAAA,GAAE;AACzE,aAAK,eAAe,KAAK,eAAe;AACxC,aAAK,UACJ,uBAAuB,MACpB,IAAI,OAAO,aAAa,EAAE,MAAM,SAAQ,CAAE,IAC1C;AACJ,aAAK,QAAQ,YAAY,CAAC,MACzB,KAAK,aAAa,EAAE,IAAI;AACzB,aAAK,QAAQ,UAAU,CAAC,MACvB,KAAK,WAAWA,mBAAkB,CAAC,GAAG,gBAAgB;AACvD,aAAK,QAAQ,iBAAiB,MAC7B,KAAK,WAAW,wCAAwC,gBAAgB;MAC1E;;MAGA,UAAU,QAAyB;AAClC,YAAI,KAAK;AAAW,gBAAM,IAAI,MAAM,8BAA8B;AAClE,aAAK,MAAM,EAAE,MAAM,aAAa,OAAM,CAAE;MACzC;;;;;;MAOA,aAAa,UAAoC;AAChD,YAAI,KAAK;AAAW;AACpB,aAAK,MAAM,EAAE,MAAM,gBAAgB,SAAQ,GAAI,CAAC,QAAQ,CAAC;MAC1D;;;;;;;;;;;MAYA,UAAU,OAAkB;AAC3B,YAAI,KAAK;AAAW;AACpB,YAAI,KAAK,eAAe,KAAK,KAAK,QAAQ,KAAK,cAAc,KAAK,cAAc;AAC/E,eAAK;AACL;QACD;AACA,aAAK;AACL,aAAK,MAAM,EAAE,MAAM,aAAa,MAAK,GAAI,CAAC,KAAK,CAAC;MACjD;;MAGA,WAAW,QAAgB,KAAK,IAAG,GAAE;AACpC,YAAI,KAAK;AAAW;AACpB,aAAK,MAAM,EAAE,MAAM,cAAc,MAAK,CAAE;MACzC;;MAGA,YAAY,IAAoD;AAC/D,aAAK,eAAe;MACrB;;MAGA,QAAQ,IAAqC;AAC5C,aAAK,WAAW;MACjB;;MAGA,QAAQ,IAA0D;AACjE,aAAK,WAAW;MACjB;;;;;;MAOA,IAAI,sBAAmB;AACtB,eAAO,KAAK;MACb;;;;;MAMA,IAAI,WAAQ;AACX,eAAO,KAAK,IAAI,GAAG,KAAK,QAAQ,KAAK,UAAU;MAChD;;MAGA,UAAO;AACN,YAAI,KAAK;AAAW;AACpB,aAAK,YAAY;AACjB,YAAI;AACH,eAAK,QAAQ,YAAY,EAAE,MAAM,UAAS,CAA+B;QAC1E,QAAQ;QAER;AACA,aAAK,QAAQ,UAAS;MACvB;MAEA,MAAM,KAAyB,WAA2B,CAAA,GAAE;AAC3D,aAAK,QAAQ,YAAY,KAAK,QAAQ;MACvC;MAEA,aAAa,OAAuB;AACnC,gBAAQ,MAAM,MAAM;UACnB,KAAK;AACJ,iBAAK,eAAe,MAAM,MAAM,MAAM,IAAI;AAC1C;UACD,KAAK;AAMJ,iBAAK,aACJ,MAAM,MAAM,WAAW,MAAM,MAAM,YAAY,MAAM,MAAM;AAC5D,iBAAK,WAAW,MAAM,KAAK;AAC3B;UACD,KAAK;AACJ,gBAAI,MAAM;AAAM,mBAAK,WAAW,MAAM,SAAS,MAAM,IAAI;;AACpD,mBAAK,WAAW,MAAM,OAAO;AAClC;QACF;MACD;;;;;;AC/MD;;;;;;;;AAmBA;AAeA;;;;;ACoCO,IAAM,kBAAkB;AAI/B,IAAM,wBAAwB;AAC9B,IAAM,4BAA4B,kBAAkB;;;AC9D7C,IAAM,iBAAiB;AAGvB,IAAM,oBAAoB,KAAK;AAQ/B,IAAM,uBAAuB,MAAM,iBAAiB;;;ACSpD,IAAM,qBAAiD,OAAO,OAAO;EAC1E;CACD;AAGK,SAAU,kBAAkB,OAAc;AAC9C,SAAO,UAAU;AACnB;AASM,SAAU,qBAAqB,OAAgB,OAAa;AAChE,MAAI,kBAAkB,KAAK;AAAG,WAAO;AACrC,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI,MAAM,GAAG,KAAK,2DAA2D;EACrF;AACA,QAAM,IAAI,MAAM,GAAG,KAAK,gCAAgC,KAAK,UAAU,KAAK,CAAC,GAAG;AAClF;;;ACrCA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACEP,SAAS,wBAAwB;AAmJ1B,SAAS,2BACd,QACQ;AACR,QAAM,OAAO,OAAO;AACpB,MAAI,CAAC,OAAO,SAAS,IAAI,KAAK,QAAQ,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,uBAAuB,IAAI;AAAA,IAE7B;AAAA,EACF;AACA,SAAO,wBAAwB,OAAO,mBAAmB,OAAO,cAAc;AAChF;AAQO,SAAS,wBAAwB,mBAA2B,gBAAiC;AAClG,MAAI,CAAC,OAAO,SAAS,iBAAiB,KAAK,qBAAqB,GAAG;AACjE,UAAM,IAAI;AAAA,MACR,kCAAkC,iBAAiB;AAAA,IAErD;AAAA,EACF;AAEA,MAAI,mBAAmB,OAAW,QAAO,KAAK,KAAK,iBAAiB;AACpE,SAAO,iBAAiB,mBAAmB,cAAc;AAC3D;;;AD7FA,eAAsB,uBACpB,MAC+B;AAK/B,MACE,CAAC,OAAO,SAAS,KAAK,eAAe,KACrC,CAAC,OAAO,cAAc,KAAK,eAAe,KAC1C,KAAK,kBAAkB,GACvB;AACA,UAAM,IAAI;AAAA,MACR,6FACU,KAAK,eAAe;AAAA,IAChC;AAAA,EACF;AACA,MACE,KAAK,0BAA0B,WAC9B,CAAC,OAAO,SAAS,KAAK,qBAAqB,KAAK,KAAK,wBAAwB,IAC9E;AACA,UAAM,IAAI;AAAA,MACR,4DACU,KAAK,qBAAqB;AAAA,IACtC;AAAA,EACF;AACA,QAAM,mBAAmB,KAAK,kBAAkB;AAChD,QAAM,yBAAyB,MAAY;AAMzC,QAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,QAAQ,GAAG;AACtD,YAAM,IAAI,MAAM,qDAAqD,KAAK,IAAI,GAAG;AAAA,IACnF;AACA,QACE,CAAC,OAAO,cAAc,KAAK,aAAa,KACxC,KAAK,iBAAiB,KACtB,KAAK,gBAAgB,MAAM,GAC3B;AACA,YAAM,IAAI;AAAA,QACR,sEAAsE,KAAK,aAAa;AAAA,MAC1F;AAAA,IACF;AACA,QAAI,CAAC,OAAO,cAAc,KAAK,cAAc,KAAK,KAAK,kBAAkB,GAAG;AAC1E,YAAM,IAAI;AAAA,QACR,+DAA+D,KAAK,cAAc;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACJ,MAAI,CAAC,kBAAkB;AACrB,2BAAuB;AACvB,uBAAmB;AACnB,4BAAwB;AAAA,EAC1B,OAAO;AACL,UAAM,sBAAsB,KAAK;AACjC,QACE,OAAO,wBAAwB,YAC/B,CAAC,OAAO,SAAS,mBAAmB,KACpC,uBAAuB,GACvB;AACA,YAAM,IAAI;AAAA,QACR,yDAAyD,mBAAmB;AAAA,MAC9E;AAAA,IACF;AACA,2BAAuB;AACvB,uBAAmB,2BAA2B;AAAA,MAC5C,mBAAmB,KAAK;AAAA,MACxB,eAAe,KAAK;AAAA,MACpB,eAAe,KAAK;AAAA,MACpB,YAAY,KAAK;AAAA,MACjB,qBAAqB,MAAO;AAAA,MAC5B,gBAAgB,KAAK;AAAA,IACvB,CAAC;AAGD,4BAAwB;AAAA,MACtB;AAAA,MACA,KAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,eAAe;AAAA,IACnB,KAAK;AAAA,IACL,SAAS,KAAK,SAAS;AAAA,EACzB;AA2BA,QAAM,SACJ,OAAO,aAAa,eAAe,SAAS,SAAS,SAAS,SAAS;AACzE,QAAM,YAAY,IAAI,IAAI,KAAK,UAAU,WAAW,MAAM;AAE1D,QAAM,gBAAgB,MAAM;AAC5B,QAAM,SAAS,KAAK,gBAChB,KAAK,cAAc,SAAS,IAC5B,IAAI,cAAc,gBAAgB,SAAS;AAG/C,QAAM,SAAS,MAAM,YAAY,iBAAiB,MAAM,KAAK,UAAU,MAAM,CAAC;AAE9E,QAAM,iBAAiB;AAAA,IACrB,OAAO,KAAK,SAAS;AAAA,IACrB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,IACA,GAAG,KAAK;AAAA;AAAA;AAAA,IAGR,aAAa,KAAK,qBAAqB,KAAK;AAAA,IAC5C,YAAY,KAAK;AAAA,IACjB,iBAAiB;AAAA,IACjB,cAAc,KAAK;AAAA,IACnB;AAAA,IACA,SAAS;AAAA,IACT,aAAa,KAAK;AAAA,IAClB,sBAAsB;AAAA,EACxB;AAEA,SAAO,UAAU,gBAAgB,MAAM;AACvC,MAAI;AACF,SAAK,iBAAiB,aAAa,KAAK,UAAU,QAAQ,KAAK,WAAW;AAAA,MACxE;AAAA,MACA,GAAG,KAAK;AAAA,MACR,YAAY,KAAK;AAAA,MACjB,mBAAmB,KAAK;AAAA;AAAA;AAAA;AAAA,MAIxB,GAAI,mBAAmB,EAAE,KAAK,MAAO,KAAK,oBAAqB,IAAI,CAAC;AAAA,MACpE,WAAW;AAAA,IACb,GAAG,KAAK,SAAS;AAAA,EACnB,SAAS,GAAG;AAIV,QAAI;AACF,aAAO,QAAQ;AAAA,IACjB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,MAAI,WAAW;AACf,SAAO;AAAA,IACL;AAAA,IACA,SAAS,MAAM;AACb,UAAI,SAAU;AACd,iBAAW;AAKX,UAAI,CAAC,KAAK,iBAAiB,eAAe,KAAK,UAAU,KAAK,SAAS,GAAG;AACxE,gBAAQ;AAAA,UACN,+BAA+B,KAAK,QAAQ,UAAU,KAAK,SAAS;AAAA,QACtE;AAAA,MACF;AACA,UAAI;AACF,eAAO,QAAQ;AAAA,MACjB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["location", "formatWorkerError"]
 }