@blockcast/mmt-container 0.4.1 → 0.5.0-main.2c1f81817995

package/src/repair-fetch.ts

@@ -394,6 +394,13 @@ export type RepairSkipReason =
   | 'presentation-delay-unavailable'
   /** A lost SS_ID in an undelimited span had no §7.5 anchor to extend it from. */
   | 'range-no-anchor'
+  /**
+   * The block lost more sources than its repair group carries symbols
+   * (sources + RSB_length < K'): no FETCH of the group can complete it, and
+   * when multicast already delivered the whole group the relay could serve
+   * only duplicates (BLO-50082).
+   */
+  | 'group-cannot-complete'
 
 /**
  * Which term set a FETCH's deadline (BLO-33597): the multicast wait, the
@@ -477,6 +484,8 @@ export interface RepairFetchHost {
   closeIsoHoles?(packetId: number, catalogTrackName: string | undefined, start: number, length: number): void
   clearRepairForBlock(sbn: number, packetId: number, catalogTrackName?: string): void
   processRepairFromMoQ(packet: Uint8Array, ownerPacketId?: number, catalogTrackName?: string): void
+  /** This scheduler can request unicast repair: protected flows keep pending entries for it (optional). */
+  setUnicastRepair?(enabled: boolean): void
   noteRepairScheduling(
     type: 'repair-preempted' | 'repair-deferred',
     sbn: number,
@@ -592,6 +601,7 @@ export function wireRepairFetch(mc: RepairFetchHost, opts: WireRepairFetchOption
   ) {
     throw new Error('[RepairFetch] rangeTransport needs repairEpochReference and a host that reports undelimited losses')
   }
+  mc.setUnicastRepair?.(true)
   const entries = new Map<string, RepairEntry>()
   const warnedNoTarget = new Set<string>()
   let disposed = false
@@ -656,19 +666,28 @@ export function wireRepairFetch(mc: RepairFetchHost, opts: WireRepairFetchOption
   }
 
   /**
-   * RTT admission: send only a FETCH the measured round trip says can land
-   * before the entry's deadline. A refused entry is released, not queued: the
+   * Admission: send only a FETCH whose repair group can complete the block
+   * and that the measured round trip says can land before the entry's
+   * deadline. A refused entry is released, not queued: the
    * deadline only gets closer. Returns the admitting RTT, or null when refused.
    */
   const admit = (entry: RepairEntry, now: number): number | null => {
     const budgetMs = entry.deadlineAt - now
     const rttMs = readRtt()
-    if (rttMs !== null && rttMs < budgetMs) return rttMs
+    const reason: RepairSkipReason | null =
+      !entry.range && !groupCanComplete(entry.sbn, entry.packetId, entry.catalogTrackName)
+        ? 'group-cannot-complete'
+        : rttMs === null
+          ? 'rtt-unmeasured'
+          : rttMs < budgetMs
+            ? null
+            : 'rtt-exceeds-budget'
+    if (reason === null) return rttMs
     retire(entry)
     releaseHold(entry)
     clearEntry(entry)
     mc.noteRepairSkipped(
-      rttMs === null ? 'rtt-unmeasured' : 'rtt-exceeds-budget',
+      reason,
       { rttMs, budgetMs, priority: entry.priority },
       entry.sbn,
       entry.packetId,
@@ -1233,6 +1252,7 @@ export function wireRepairFetch(mc: RepairFetchHost, opts: WireRepairFetchOption
 
   return () => {
     disposed = true
+    mc.setUnicastRepair?.(false)
     removeResetObserver()
     removeLifecycleObserver()
     for (const entry of [...entries.values()]) {

package/dist/manifest-auth-plan.d.ts

@@ -1,31 +0,0 @@
-import type { ManifestKey } from '@blockcast/mmt-manifest-verify';
-import { type ResolvedMulticastAuthFlow } from './multicast-auth-catalog.js';
-/**
- * The bc-provenance version 2 plan a receiver binds from one catalog
- * (draft-ramadan-moq-multicast-01 7.2.6): the key set, `minEpoch`, and one
- * flow per protected endpoint. The record verifier and the 7.2.7 state machine
- * consume it; this plan holds no verification state.
- */
-export interface ManifestAuthPlan {
-    keys: readonly ManifestKey[];
-    minEpoch: number;
-    flows: readonly ResolvedMulticastAuthFlow[];
-    /** Every `manifestTrack` a flow names, for a unicast receiver to subscribe. */
-    manifestTracks: readonly string[];
-    /** The key that signs a record of `kid` at `epoch`; `undefined` drops it.
-     * Key selection only: it does not apply `minEpoch`, which the record
-     * verifier checks (BLO-49771). */
-    keyFor(kid: number, epoch: number): Uint8Array | undefined;
-    /** The flow whose records arrive on `(S, G, manifestPort)`. */
-    flowForManifestPort(source: string, groupAddress: string, manifestPort: number): ResolvedMulticastAuthFlow | undefined;
-    /** The flow a manifest track mirrors. */
-    flowForManifestTrack(manifestTrack: string): ResolvedMulticastAuthFlow | undefined;
-}
-/** Build the plan, or `undefined` for an unprotected catalog. Throws where
- * `resolveMulticastAuthCatalog` does: no key set, or authentication pinned
- * by `requireAuth` on a catalog without `multicast.auth`. */
-export declare function createManifestAuthPlan(catalog: unknown, options?: {
-    requireAuth?: boolean;
-    catalogNamespace?: string;
-}): ManifestAuthPlan | undefined;
-//# sourceMappingURL=manifest-auth-plan.d.ts.map

package/dist/manifest-auth-plan.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-auth-plan.d.ts","sourceRoot":"","sources":["../src/manifest-auth-plan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AACjE,OAAO,EAIL,KAAK,yBAAyB,EAC/B,MAAM,6BAA6B,CAAA;AAEpC;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,WAAW,EAAE,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC3C,+EAA+E;IAC/E,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;sCAEkC;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAA;IAC1D,+DAA+D;IAC/D,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAA;IACtH,yCAAyC;IACzC,oBAAoB,CAAC,aAAa,EAAE,MAAM,GAAG,yBAAyB,GAAG,SAAS,CAAA;CACnF;AAED;;6DAE6D;AAC7D,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAO,GACjE,gBAAgB,GAAG,SAAS,CAkB9B"}

package/dist/manifest-auth-plan.js

@@ -1,426 +0,0 @@
-// ../mmt-base/dist/mmtp.js
-var MPU_HEADER_SIZE = 8;
-var MPU_LENGTH_FIELD_SIZE = 2;
-var MPU_HEADER_REMAINDER_SIZE = MPU_HEADER_SIZE - MPU_LENGTH_FIELD_SIZE;
-
-// ../mmt-base/dist/ntp-short.js
-var NTP_SHORT_BITS = 32;
-var NTP_SHORT_MODULUS = 2 ** NTP_SHORT_BITS;
-var NTP_SHORT_HALF_RANGE = 2 ** (NTP_SHORT_BITS - 1);
-
-// ../mmt-base/dist/fec-block-profile.js
-var FEC_BLOCK_PROFILES = Object.freeze([
-  "iso-ssbg1-v1"
-]);
-
-// ../mmt-base/dist/catalog-fec-source.js
-var ALL_ROLES = Object.freeze(["video", "audio"]);
-
-// ../mmt-base/dist/multicast-catalog.js
-var ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
-var UINT32_MAX = 4294967295;
-var AUTH_MEMBERS = /* @__PURE__ */ new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
-var KEY_MEMBERS = /* @__PURE__ */ new Set(["kid", "publicKey", "firstEpoch"]);
-var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
-  "manifestPort",
-  "streamId",
-  "senderAddress",
-  "maxAuthDelayMs",
-  "manifestTimerMs",
-  "manifestTrack"
-]);
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-function isIntegerIn(value, min, max) {
-  return Number.isSafeInteger(value) && value >= min && value <= max;
-}
-function multicastEndpointSource(endpoint) {
-  if (!isObject(endpoint))
-    return void 0;
-  const sourceAddress = endpoint["sourceAddress"];
-  if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress))
-    return void 0;
-  const mode = sourceAddress === void 0 ? "asm" : "ssm";
-  const protocol = endpoint["protocol"];
-  if (protocol !== void 0 && protocol !== mode)
-    return void 0;
-  const auth = endpoint["auth"];
-  const senderAddress = isObject(auth) ? auth["senderAddress"] : void 0;
-  if (mode === "ssm")
-    return senderAddress === void 0 ? { mode, source: sourceAddress } : void 0;
-  if (auth === void 0)
-    return { mode };
-  return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : void 0;
-}
-function authIssues(auth) {
-  const base = "$.multicast.auth";
-  const issue = (path, message) => [
-    { code: "multicast_auth", path: `${base}${path}`, message }
-  ];
-  if (!isObject(auth))
-    return issue("", "auth must be an object");
-  const unknown = Object.keys(auth).filter((key) => !AUTH_MEMBERS.has(key));
-  if (unknown.length > 0) {
-    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
-  }
-  if (auth["scheme"] !== "bc-provenance")
-    return issue(".scheme", 'scheme must be "bc-provenance"');
-  if (auth["version"] !== 2)
-    return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
-  if (auth["sig"] !== "ed25519")
-    return issue(".sig", 'sig must be "ed25519"');
-  const keys = auth["keys"];
-  if (!Array.isArray(keys) || keys.length < 1 || keys.length > 4) {
-    return issue(".keys", "keys must be an array of one to four {kid, publicKey, firstEpoch} objects");
-  }
-  const kids = /* @__PURE__ */ new Set();
-  const firstEpochs = /* @__PURE__ */ new Set();
-  for (let index = 0; index < keys.length; index++) {
-    const key = keys[index];
-    const at = `.keys[${index}]`;
-    if (!isObject(key) || Object.keys(key).some((member) => !KEY_MEMBERS.has(member))) {
-      return issue(at, "a key is exactly {kid, publicKey, firstEpoch}");
-    }
-    if (!isIntegerIn(key["kid"], 0, UINT32_MAX))
-      return issue(`${at}.kid`, "kid must be an unsigned 32-bit integer");
-    if (typeof key["publicKey"] !== "string" || !ED25519_PUBLIC_KEY_BASE64URL.test(key["publicKey"])) {
-      return issue(`${at}.publicKey`, "publicKey must be a 32-octet Ed25519 key in canonical unpadded base64url");
-    }
-    if (!isIntegerIn(key["firstEpoch"], 0, UINT32_MAX)) {
-      return issue(`${at}.firstEpoch`, "firstEpoch must be an unsigned 32-bit integer");
-    }
-    if (kids.has(key["kid"]))
-      return issue(`${at}.kid`, `kid ${key["kid"]} is repeated; the catalog holds no key set`);
-    if (firstEpochs.has(key["firstEpoch"])) {
-      return issue(`${at}.firstEpoch`, `firstEpoch ${key["firstEpoch"]} is repeated; the catalog holds no key set`);
-    }
-    kids.add(key["kid"]);
-    firstEpochs.add(key["firstEpoch"]);
-  }
-  if (!isIntegerIn(auth["minEpoch"], 0, UINT32_MAX)) {
-    return issue(".minEpoch", "minEpoch must be an unsigned 32-bit integer");
-  }
-  return [];
-}
-function endpointAuthIssue(endpoint, mode, at) {
-  const auth = endpoint["auth"];
-  if (!isObject(auth))
-    return { path: `${at}.auth`, message: "auth must be an object" };
-  const unknown = Object.keys(auth).filter((key) => !ENDPOINT_AUTH_MEMBERS.has(key));
-  if (unknown.length > 0)
-    return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
-  if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
-    return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
-  }
-  if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
-    return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
-  }
-  if (mode === "ssm" && auth["senderAddress"] !== void 0) {
-    return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
-  }
-  if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
-    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
-  }
-  if (auth["maxAuthDelayMs"] !== void 0 && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1e3)) {
-    return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
-  }
-  if (auth["manifestTimerMs"] !== void 0 && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
-  }
-  if (auth["manifestTrack"] !== void 0 && !isNonEmptyString(auth["manifestTrack"])) {
-    return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
-  }
-  if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
-  }
-  return void 0;
-}
-var CATALOG_NAMESPACE = /* @__PURE__ */ Symbol.for("@blockcast/mmt-base/catalogNamespace");
-function multicastCatalogIssues(catalog, options = {}) {
-  if (!isObject(catalog))
-    return [];
-  const issues = [];
-  if ("multicast.auth" in catalog) {
-    issues.push({
-      code: "multicast_auth",
-      path: '$["multicast.auth"]',
-      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)'
-    });
-  }
-  const multicast = catalog["multicast"];
-  if (!isObject(multicast))
-    return issues;
-  const protectedCatalog = multicast["auth"] !== void 0;
-  if (protectedCatalog)
-    issues.push(...authIssues(multicast["auth"]));
-  const endpoints = multicast["endpoints"];
-  if (!Array.isArray(endpoints))
-    return issues;
-  const tracks = Array.isArray(catalog["tracks"]) ? catalog["tracks"] : [];
-  const namespaceOf = /* @__PURE__ */ new Map();
-  for (const track of tracks) {
-    if (isObject(track) && typeof track["name"] === "string")
-      namespaceOf.set(track["name"], track["namespace"]);
-  }
-  const tagged = catalog[CATALOG_NAMESPACE];
-  let referenceNamespace = options.catalogNamespace ?? (typeof tagged === "string" ? tagged : void 0);
-  const sources = [];
-  for (let index = 0; index < endpoints.length; index++) {
-    const endpoint = endpoints[index];
-    const at = `$.multicast.endpoints[${index}]`;
-    const fail = (code, path, message) => {
-      issues.push({ code, path, message, endpointIndex: index });
-    };
-    sources.push(void 0);
-    if (!isObject(endpoint)) {
-      fail("multicast_endpoint", at, "endpoint must be an object");
-      continue;
-    }
-    const protocol = endpoint["protocol"];
-    if (protocol !== void 0 && protocol !== "ssm" && protocol !== "asm") {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
-      continue;
-    }
-    const hasAuth = endpoint["auth"] !== void 0;
-    if (protectedCatalog !== hasAuth) {
-      fail("multicast_endpoint_auth", `${at}.auth`, protectedCatalog ? "every endpoint requires auth when multicast carries auth; a receiver ignores this endpoint" : "auth names no key without multicast.auth; a receiver ignores this endpoint");
-      continue;
-    }
-    const sourceAddress = endpoint["sourceAddress"];
-    if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress)) {
-      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
-      continue;
-    }
-    const mode = sourceAddress === void 0 ? "asm" : "ssm";
-    if (protocol !== void 0 && protocol !== mode) {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol ${JSON.stringify(protocol)} disagrees with sourceAddress, which selects ${mode}`);
-      continue;
-    }
-    if (!isIntegerIn(endpoint["port"], 1, 65535)) {
-      fail("multicast_endpoint", `${at}.port`, "port must be an integer from 1 to 65535");
-      continue;
-    }
-    if (hasAuth) {
-      const authIssue = endpointAuthIssue(endpoint, mode, at);
-      if (authIssue) {
-        fail("multicast_endpoint_auth", authIssue.path, authIssue.message);
-        continue;
-      }
-    }
-    sources[index] = multicastEndpointSource(endpoint);
-    const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
-    for (let refIndex = 0; refIndex < refs.length; refIndex++) {
-      const ref = refs[refIndex];
-      const name = isObject(ref) ? ref["name"] : ref;
-      if (typeof name !== "string")
-        continue;
-      const namespace = namespaceOf.get(name);
-      if (typeof namespace !== "string")
-        continue;
-      referenceNamespace ??= namespace;
-      if (namespace !== referenceNamespace) {
-        fail("multicast_track", `${at}.tracks[${refIndex}].name`, `track ${JSON.stringify(name)} declares namespace ${JSON.stringify(namespace)}, not the catalog track's ${JSON.stringify(referenceNamespace)}`);
-      }
-    }
-  }
-  const tupleOf = (index) => {
-    const endpoint = endpoints[index];
-    const auth = endpoint["auth"];
-    return {
-      sg: JSON.stringify([sources[index].source ?? null, endpoint["groupAddress"]]),
-      port: endpoint["port"],
-      manifestPort: isObject(auth) ? auth["manifestPort"] : void 0
-    };
-  };
-  for (let index = 0; index < endpoints.length; index++) {
-    if (!sources[index])
-      continue;
-    const own = tupleOf(index);
-    const at = `$.multicast.endpoints[${index}]`;
-    if (own.manifestPort !== void 0 && own.manifestPort === own.port) {
-      issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
-      continue;
-    }
-    for (let other = 0; other < endpoints.length; other++) {
-      if (other === index || !sources[other])
-        continue;
-      const peer = tupleOf(other);
-      if (peer.sg !== own.sg)
-        continue;
-      if (peer.port === own.port) {
-        issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
-        break;
-      }
-      if (own.manifestPort !== void 0 && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
-        issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
-        break;
-      }
-    }
-  }
-  return issues;
-}
-
-// ../mmt-manifest-verify/dist/source-auth.js
-var SOURCE_AUTH_MAX_TRUE_LENGTH = 16 * 1024 * 1024;
-var SIGNATURE_DOMAIN = new TextEncoder().encode("blockcast-mmt-root-v1\0\0\0");
-
-// ../mmt-manifest-verify/dist/verifier.js
-function manifestKeyFor(keys, epoch, kid) {
-  if (new Set(keys.map((key) => key.kid)).size !== keys.length)
-    return void 0;
-  if (new Set(keys.map((key) => key.firstEpoch)).size !== keys.length)
-    return void 0;
-  let signer;
-  for (const key of keys) {
-    if (key.firstEpoch <= epoch && (signer === void 0 || key.firstEpoch > signer.firstEpoch))
-      signer = key;
-  }
-  if (signer === void 0 || kid !== void 0 && signer.kid !== kid)
-    return void 0;
-  return signer.publicKey;
-}
-
-// ../mmt-manifest-verify/dist/bc-provenance-v2.js
-var BCPV2_HEADER_LENGTH = 68;
-var BCPV2_SIGNATURE_LENGTH = 64;
-var BCPV2_MIN_RECORD_LENGTH = BCPV2_HEADER_LENGTH + 32 + BCPV2_SIGNATURE_LENGTH;
-var text = new TextEncoder();
-var MAGIC = Uint8Array.from([77, 72, 77, 50]);
-var SIGNING_DOMAIN = text.encode("mcast-manifest-v2\0");
-
-// src/multicast-auth-catalog.ts
-var RAW_ED25519_KEY_LENGTH = 32;
-var DEFAULT_MAX_AUTH_DELAY_MS = 200;
-var DEFAULT_MANIFEST_TIMER_MS = 20;
-var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-function encodeBase64Url(bytes) {
-  let output = "";
-  for (let i = 0; i < bytes.length; i += 3) {
-    const b0 = bytes[i];
-    const b1 = bytes[i + 1];
-    const b2 = bytes[i + 2];
-    output += BASE64URL_ALPHABET[b0 >> 2];
-    output += BASE64URL_ALPHABET[(b0 & 3) << 4 | (b1 === void 0 ? 0 : b1 >> 4)];
-    if (b1 === void 0) break;
-    output += BASE64URL_ALPHABET[(b1 & 15) << 2 | (b2 === void 0 ? 0 : b2 >> 6)];
-    if (b2 === void 0) break;
-    output += BASE64URL_ALPHABET[b2 & 63];
-  }
-  return output;
-}
-var BASE64URL_DECODE_TABLE = (() => {
-  const table = new Int8Array(128).fill(-1);
-  for (let i = 0; i < BASE64URL_ALPHABET.length; i++) {
-    table[BASE64URL_ALPHABET.charCodeAt(i)] = i;
-  }
-  return table;
-})();
-function decodeBase64Url(text2) {
-  if (text2.length % 4 === 1) {
-    throw new Error(`[multicast-auth-catalog] invalid unpadded base64url length for "${text2}"`);
-  }
-  const bytes = [];
-  let buffer = 0;
-  let bits = 0;
-  for (let i = 0; i < text2.length; i++) {
-    const code = text2.charCodeAt(i);
-    const value = code < 128 ? BASE64URL_DECODE_TABLE[code] : -1;
-    if (value === void 0 || value < 0) {
-      throw new Error(`[multicast-auth-catalog] invalid base64url character in "${text2}"`);
-    }
-    buffer = buffer << 6 | value;
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      bytes.push(buffer >> bits & 255);
-    }
-  }
-  const decoded = Uint8Array.from(bytes);
-  if (encodeBase64Url(decoded) !== text2) {
-    throw new Error(`[multicast-auth-catalog] non-canonical base64url encoding "${text2}"`);
-  }
-  return decoded;
-}
-function decodeEd25519PublicKey(publicKey) {
-  const bytes = decodeBase64Url(publicKey);
-  if (bytes.byteLength !== RAW_ED25519_KEY_LENGTH) {
-    throw new Error(
-      `[multicast-auth-catalog] public key must decode to ${RAW_ED25519_KEY_LENGTH} raw bytes, got ${bytes.byteLength}`
-    );
-  }
-  return bytes;
-}
-function resolveMulticastAuthCatalog(catalog, options = {}) {
-  if (typeof catalog !== "object" || catalog === null || Array.isArray(catalog)) {
-    throw new Error("[multicast-auth-catalog] catalog must be an object");
-  }
-  const issues = multicastCatalogIssues(catalog, options);
-  const fatal = issues.find((issue) => issue.endpointIndex === void 0);
-  if (fatal) throw new Error(`[multicast-auth-catalog] ${fatal.path}: ${fatal.message}`);
-  const multicast = catalog["multicast"];
-  const auth = multicast?.["auth"];
-  if (auth === void 0) {
-    if (options.requireAuth) {
-      throw new Error("[multicast-auth-catalog] authentication is pinned but the catalog declares no multicast.auth");
-    }
-    return void 0;
-  }
-  const ignored = new Set(issues.map((issue) => issue.endpointIndex));
-  const endpoints = multicast["endpoints"] ?? [];
-  const flows = [];
-  endpoints.forEach((endpoint, endpointIndex) => {
-    if (ignored.has(endpointIndex)) return;
-    const flowAuth = endpoint["auth"];
-    flows.push({
-      endpointIndex,
-      source: endpoint["sourceAddress"] ?? flowAuth.senderAddress,
-      groupAddress: endpoint["groupAddress"],
-      port: endpoint["port"],
-      bandwidth: endpoint["bandwidth"],
-      manifestPort: flowAuth.manifestPort,
-      streamId: flowAuth.streamId,
-      maxAuthDelayMs: flowAuth.maxAuthDelayMs ?? DEFAULT_MAX_AUTH_DELAY_MS,
-      manifestTimerMs: flowAuth.manifestTimerMs ?? DEFAULT_MANIFEST_TIMER_MS,
-      ...flowAuth.manifestTrack === void 0 ? {} : { manifestTrack: flowAuth.manifestTrack },
-      tracks: (endpoint["tracks"] ?? []).map(({ name, packetId }) => ({
-        name,
-        packetId
-      }))
-    });
-  });
-  return {
-    keys: auth.keys.map((key) => ({ kid: key.kid, publicKey: decodeEd25519PublicKey(key.publicKey), firstEpoch: key.firstEpoch })).sort((a, b) => a.firstEpoch - b.firstEpoch),
-    minEpoch: auth.minEpoch,
-    flows
-  };
-}
-function multicastAuthKeyFor(resolved, kid, epoch) {
-  return manifestKeyFor(resolved.keys, epoch, kid);
-}
-
-// src/manifest-auth-plan.ts
-function createManifestAuthPlan(catalog, options = {}) {
-  const resolved = resolveMulticastAuthCatalog(catalog, options);
-  if (!resolved) return void 0;
-  const byManifestTrack = /* @__PURE__ */ new Map();
-  for (const flow of resolved.flows) {
-    if (flow.manifestTrack !== void 0) byManifestTrack.set(flow.manifestTrack, flow);
-  }
-  return {
-    keys: resolved.keys,
-    minEpoch: resolved.minEpoch,
-    flows: resolved.flows,
-    manifestTracks: [...byManifestTrack.keys()],
-    keyFor: (kid, epoch) => multicastAuthKeyFor(resolved, kid, epoch),
-    flowForManifestPort: (source, groupAddress, manifestPort) => resolved.flows.find((flow) => flow.source === source && flow.groupAddress === groupAddress && flow.manifestPort === manifestPort),
-    flowForManifestTrack: (manifestTrack) => byManifestTrack.get(manifestTrack)
-  };
-}
-export {
-  createManifestAuthPlan
-};
-//# sourceMappingURL=manifest-auth-plan.js.map