@blockcast/mmt-container 0.4.1 → 0.5.0-main.9c437a834da9

package/dist/browser-runtime.js

@@ -5066,18 +5066,18 @@ function hevcNalUnitsContainIrap(nals) {
   return sawNal ? false : void 0;
 }
 function classifyHevcKeyframe(data) {
-  const split = splitHevcSample(data);
-  return split === null ? void 0 : hevcNalUnitsContainIrap(split.nals);
+  const split2 = splitHevcSample(data);
+  return split2 === null ? void 0 : hevcNalUnitsContainIrap(split2.nals);
 }
 function detectHevcKeyframe(data) {
   return classifyHevcKeyframe(data) === true;
 }
 function prepareHevcCmafSample(data, sampleEntry) {
-  const split = splitHevcSample(data);
-  if (split === null) return null;
-  const keyframe = hevcNalUnitsContainIrap(split.nals);
+  const split2 = splitHevcSample(data);
+  if (split2 === null) return null;
+  const keyframe = hevcNalUnitsContainIrap(split2.nals);
   if (keyframe === void 0) return null;
-  const normalized = hevcNalUnitsToLengthPrefixed(data, split.nals, split.lengthPrefixed, sampleEntry);
+  const normalized = hevcNalUnitsToLengthPrefixed(data, split2.nals, split2.lengthPrefixed, sampleEntry);
   return normalized === null ? null : { keyframe, data: normalized };
 }
 function normalizeHevcSampleToLengthPrefixed(data, sampleEntry) {
@@ -7566,14 +7566,22 @@ function toWindowMulticastSubscribeConfig(input) {
   if (input.packetIds?.some((id) => !isMulticastTrackPacketId(id)) || input.tracks?.some((track) => !isMulticastTrackPacketId(track.packetId))) {
     throw new RangeError(`multicast packetId must be an integer from 1 to ${MMTP_PACKET_ID_MAX2}; packetId 0 is the MMTP signaling flow and is never a track's`);
   }
+  const source = input.source?.trim() || void 0;
+  const senderAddress = input.senderAddress?.trim() || void 0;
+  if (source && senderAddress) {
+    throw new TypeError("multicast senderAddress is an ASM filter and never appears beside source");
+  }
   const base = {
     group: input.group,
     port: input.port,
-    ...input.source?.trim() ? { source: input.source.trim() } : {},
+    ...source ? { source } : {},
     consume: "bytes",
     ...input.packetIds?.length ? { packetIds: [...input.packetIds] } : {}
   };
+  const filter = senderAddress ? { senderAddress } : {};
   if (input.atsc3) {
+    if (senderAddress)
+      throw new TypeError("an ATSC3 tuner request carries no senderAddress");
     const { frequency, plpId, serviceId } = input.atsc3;
     if (!Number.isInteger(frequency) || frequency < 1) {
       throw new TypeError(`ATSC3 tuning requires a positive integer frequency in kHz, got ${String(frequency)}`);
@@ -7593,6 +7601,7 @@ function toWindowMulticastSubscribeConfig(input) {
   if (!wantsAmt) {
     const native = {
       ...base,
+      ...filter,
       origin: "ip-multicast",
       ...input.tracks?.length ? { tracks: input.tracks.map(({ name, packetId }) => ({ name, packetId })) } : {}
     };
@@ -7618,6 +7627,7 @@ function toWindowMulticastSubscribeConfig(input) {
   }
   return {
     ...base,
+    ...filter,
     origin: "amt",
     relay,
     relayPort
@@ -7643,6 +7653,9 @@ function isValidMulticastGroupAddress(address) {
 function normalizeMulticastEndpoint(endpoint) {
   const groupAddress = endpoint.groupAddress.trim().toLowerCase();
   const sourceAddress = endpoint.sourceAddress?.trim().toLowerCase() || void 0;
+  const senderAddress = endpoint.senderAddress?.trim().toLowerCase() || void 0;
+  if (sourceAddress && senderAddress)
+    return void 0;
   const amtRelay = endpoint.amtRelay?.trim().toLowerCase() || void 0;
   if (!isValidMulticastGroupAddress(groupAddress) || !isPositivePort(endpoint.port))
     return void 0;
@@ -7653,6 +7666,7 @@ function normalizeMulticastEndpoint(endpoint) {
   return {
     groupAddress,
     ...sourceAddress ? { sourceAddress } : {},
+    ...senderAddress ? { senderAddress } : {},
     port: endpoint.port,
     ...endpoint.mode ? { mode: endpoint.mode } : {},
     ...amtRelay ? { amtRelay } : {},
@@ -7672,7 +7686,9 @@ function multicastEndpointKey(endpoint) {
     normalized.amtRelay ?? "",
     normalized.amtRelayPort ?? "",
     // A DRIAD join is a different gateway subscription from a native one.
-    ...normalized.amtDiscovery ? [normalized.amtDiscovery] : []
+    ...normalized.amtDiscovery ? [normalized.amtDiscovery] : [],
+    // An ASM sender filter is a different subscription from the unfiltered join.
+    ...normalized.senderAddress ? [{ senderAddress: normalized.senderAddress }] : []
   ]);
 }
 function isMulticastTrackPacketId(value) {
@@ -8930,14 +8946,14 @@ function validateNetworkSourceEntry(s, i) {
     }
     return;
   }
-  const inRange = (v, min, max) => Number.isInteger(v) && v >= min && v <= max;
-  if (!inRange(s.frequency, 1, Number.MAX_SAFE_INTEGER)) {
+  const inRange2 = (v, min, max) => Number.isInteger(v) && v >= min && v <= max;
+  if (!inRange2(s.frequency, 1, Number.MAX_SAFE_INTEGER)) {
     throw err("invalid_network_source", `frequency must be a positive integer in kHz; got ${s.frequency}`);
   }
-  if (s.plpId !== void 0 && !inRange(s.plpId, 0, 63)) {
+  if (s.plpId !== void 0 && !inRange2(s.plpId, 0, 63)) {
     throw err("invalid_network_source", `plpId must be 0..63; got ${s.plpId}`);
   }
-  if (s.serviceId !== void 0 && !inRange(s.serviceId, 0, 65535)) {
+  if (s.serviceId !== void 0 && !inRange2(s.serviceId, 0, 65535)) {
     throw err("invalid_network_source", `serviceId must be 0..65535; got ${s.serviceId}`);
   }
   if (s.slsUri !== void 0 && (typeof s.slsUri !== "string" || !isAbsoluteUri(s.slsUri))) {
@@ -10647,9 +10663,9 @@ var CmafBlockAssembler = class {
     const sample = splitH264SampleNalUnits(data);
     const nalTypes = describeH264NalTypes(sample.nals);
     const classify = classifyH264Keyframe(data);
-    const hex = Array.from(data.subarray(0, Math.min(48, data.length))).map((b) => b.toString(16).padStart(2, "0")).join(" ");
+    const hex3 = Array.from(data.subarray(0, Math.min(48, data.length))).map((b) => b.toString(16).padStart(2, "0")).join(" ");
     console.log(
-      `[L4-KF-GATE] reject#${this.#keyframeRejectDumpCount} len=${data.length} metadataKf=${metadataKeyframe} classify=${classify} format=${sample.format} nalTypes=[${nalTypes.join(",")}] first48=[${hex}]`
+      `[L4-KF-GATE] reject#${this.#keyframeRejectDumpCount} len=${data.length} metadataKf=${metadataKeyframe} classify=${classify} format=${sample.format} nalTypes=[${nalTypes.join(",")}] first48=[${hex3}]`
     );
   }
   /** Mark video as already synchronized by an external decoder path.
@@ -13257,6 +13273,79 @@ function decideGap(input) {
   });
 }
 
+// src/held-layer-admission.ts
+var HORIZON_CAP = 1073741824;
+function heldLayerAnchorHorizon(retentionBlocks, k) {
+  return retentionBlocks === void 0 || k <= 0 ? HORIZON_CAP : Math.min(HORIZON_CAP, retentionBlocks * k);
+}
+var HeldLayerAdmission = class {
+  #layerNames;
+  #states;
+  constructor(layers, heldLayers = [0]) {
+    const held = new Set(heldLayers);
+    this.#layerNames = new Set(layers.map((l) => l.repairTrackName));
+    this.#states = layers.filter((l) => held.has(l.layer)).map((l) => ({ layer: l.layer, repairTrackName: l.repairTrackName, total: l.rsIdOffset + l.repairSymbols }));
+  }
+  /**
+   * Judges one repair packet, after the 4.5 discards and the size check and
+   * before it places a block. `repairTrackName` is the subscribed repair
+   * track, never inferred from RS_ID; without it only (b) runs. A packet on a
+   * repair track the catalog does not list is `'discard'` and anchors nothing.
+   * `sourceFrontier` is the newest source SS_ID, if any: a repair more than
+   * `horizon` past it is judged without moving the anchored state.
+   *
+   * @returns undefined to admit, `'discard'`, or the fail-closed reason.
+   */
+  admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
+    if (repairTrackName !== void 0 && !this.#layerNames.has(repairTrackName)) return "discard";
+    const farAhead = sourceFrontier !== void 0 && serial32Precedes(sourceFrontier, ssStart) && serial32Distance(sourceFrontier, ssStart) > horizon;
+    for (const state of this.#states) {
+      let code;
+      if (farAhead) {
+        if (rsbLength < state.total) {
+          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+          else if (state.anchor !== void 0 || state.settled) code = "below_anchored_total";
+        }
+      } else {
+        if (state.newest === void 0 || serial32Precedes(state.newest, ssStart)) state.newest = ssStart;
+        const stale = (s) => serial32Distance(s, state.newest) > horizon;
+        if (state.latestBelow !== void 0 && stale(state.latestBelow)) {
+          delete state.latestBelow;
+          delete state.latestBelowRsb;
+        }
+        if (state.anchor !== void 0 && stale(state.anchor)) state.settled = true;
+        if (rsbLength < state.total) {
+          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+          else if (stale(ssStart)) continue;
+          else if (state.settled || state.anchor !== void 0 && !serial32Precedes(ssStart, state.anchor)) code = "below_anchored_total";
+          else if (state.latestBelow === void 0 || serial32Precedes(state.latestBelow, ssStart)) {
+            state.latestBelow = ssStart;
+            state.latestBelowRsb = rsbLength;
+          }
+        } else if (!state.settled && !stale(ssStart)) {
+          if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
+          if (state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
+            code = "below_anchored_total";
+            ssStart = state.latestBelow;
+            rsbLength = state.latestBelowRsb;
+          }
+        }
+      }
+      if (code !== void 0) {
+        return {
+          code,
+          layer: state.layer,
+          total: state.total,
+          rsbLength,
+          ssStart,
+          ...state.anchor === void 0 ? {} : { anchor: state.anchor }
+        };
+      }
+    }
+    return void 0;
+  }
+};
+
 // src/fec-manager.ts
 var RS_MAX_BLOCK_SYMBOLS = 255;
 var WORKER_ERROR_LOG_CAP = 5;
@@ -13771,12 +13860,12 @@ var FECManager = class _FECManager {
    * still be held behind it. Retirement is swept lazily here, on the stream's
    * own terminal events, so it needs no timer.
    */
-  #markTerminal(key, sbn, packetId, clean) {
+  #markTerminal(key, sbn, packetId, clean2) {
     const nowMs = performance.now();
     this.#retireTerminalBlocks(packetId, nowMs);
     this.#forgetOrderedPending(key);
     this.#completedBlocks.add(key);
-    if (clean) this.#cleanlyCompletedBlocks.add(key);
+    if (clean2) this.#cleanlyCompletedBlocks.add(key);
     this.#indexBlockKey(key, sbn, packetId);
     const config = this.#trackConfig(packetId);
     const expiresAtMs = nowMs + config.interleaveDepthMs + 2 * this.#blockLifetimeMs(config);
@@ -15352,6 +15441,18 @@ var FECManager = class _FECManager {
   blockAnchorAtMs(sbn, packetId, catalogTrackName) {
     return this.#blockAnchorsMs.get(this.#blockKey(sbn, packetId, catalogTrackName));
   }
+  /**
+   * How long ago (ms) the oldest open block of the stream, one with an FEC
+   * deadline, took its first accepted symbol; undefined with none open.
+   */
+  oldestOpenBlockAgeMs(packetId, catalogTrackName) {
+    let oldest = Infinity;
+    for (const key of this.#activeBlocks.keys()) {
+      if (!this.#belongsToStream(key, packetId, catalogTrackName)) continue;
+      oldest = Math.min(oldest, this.#blockAnchorsMs.get(key) ?? Infinity);
+    }
+    return oldest === Infinity ? void 0 : performance.now() - oldest;
+  }
   /** Absolute fail deadline of a still-open block, or undefined. */
   blockDeadlineAtMs(sbn, packetId, catalogTrackName) {
     return this.#activeBlockDeadlinesMs.get(this.#blockKey(sbn, packetId, catalogTrackName));
@@ -16174,66 +16275,26 @@ var FECManager = class _FECManager {
     const config = this.#trackConfigs.get(packetId);
     const layers = config?.repairLayers;
     if (layers === void 0 || layers.length === 0) return true;
-    if (repairTrackName !== void 0 && !layers.some((l) => l.repairTrackName === repairTrackName)) {
-      return false;
+    let admission = this.#heldLayerStates.get(streamKey);
+    if (admission === void 0) {
+      admission = new HeldLayerAdmission(layers, config.heldLayers);
+      this.#heldLayerStates.set(streamKey, admission);
     }
-    let states = this.#heldLayerStates.get(streamKey);
-    if (states === void 0) {
-      const held = new Set(config.heldLayers ?? [0]);
-      states = layers.filter((l) => held.has(l.layer)).map((l) => ({ layer: l.layer, repairTrackName: l.repairTrackName, total: l.rsIdOffset + l.repairSymbols }));
-      this.#heldLayerStates.set(streamKey, states);
-    }
-    const horizon = this.#layerAnchorHorizon(packetId);
-    const frontier = this.#sourceFrontiers.get(streamKey)?.sbn;
-    const farAhead = frontier !== void 0 && serial32Precedes(frontier, ssStart) && serial32Distance(frontier, ssStart) > horizon;
-    for (const state of states) {
-      let code;
-      if (farAhead) {
-        if (rsbLength < state.total) {
-          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
-          else if (state.anchor !== void 0 || state.settled) code = "below_anchored_total";
-        }
-      } else {
-        if (state.newest === void 0 || serial32Precedes(state.newest, ssStart)) state.newest = ssStart;
-        const stale = (s) => serial32Distance(s, state.newest) > horizon;
-        if (state.latestBelow !== void 0 && stale(state.latestBelow)) {
-          delete state.latestBelow;
-          delete state.latestBelowRsb;
-        }
-        if (state.anchor !== void 0 && stale(state.anchor)) state.settled = true;
-        if (rsbLength < state.total) {
-          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
-          else if (stale(ssStart)) continue;
-          else if (state.settled || state.anchor !== void 0 && !serial32Precedes(ssStart, state.anchor)) code = "below_anchored_total";
-          else if (state.latestBelow === void 0 || serial32Precedes(state.latestBelow, ssStart)) {
-            state.latestBelow = ssStart;
-            state.latestBelowRsb = rsbLength;
-          }
-        } else if (!state.settled && !stale(ssStart)) {
-          if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
-          if (state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
-            code = "below_anchored_total";
-            ssStart = state.latestBelow;
-            rsbLength = state.latestBelowRsb;
-          }
-        }
-      }
-      if (code !== void 0) {
-        const reason = {
-          code,
-          layer: state.layer,
-          total: state.total,
-          rsbLength,
-          ssStart,
-          ...state.anchor === void 0 ? {} : { anchor: state.anchor }
-        };
-        this.#fecFailClosed.set(streamKey, reason);
-        this.#onFecFailClosed?.({ ...reason, packetId, catalogTrackName });
-        console.warn(
-          `[FECManager] FEC failed closed (fec-01 6.3.9) packetId=${packetId} track=${catalogTrackName ?? "-"}: ${JSON.stringify(reason)}`
-        );
-        return false;
-      }
+    const verdict = admission.admit(
+      repairTrackName,
+      ssStart,
+      rsbLength,
+      this.#layerAnchorHorizon(packetId),
+      this.#sourceFrontiers.get(streamKey)?.sbn
+    );
+    if (verdict === "discard") return false;
+    if (verdict !== void 0) {
+      this.#fecFailClosed.set(streamKey, verdict);
+      this.#onFecFailClosed?.({ ...verdict, packetId, catalogTrackName });
+      console.warn(
+        `[FECManager] FEC failed closed (fec-01 6.3.9) packetId=${packetId} track=${catalogTrackName ?? "-"}: ${JSON.stringify(verdict)}`
+      );
+      return false;
     }
     return true;
   }
@@ -16243,15 +16304,13 @@ var FECManager = class _FECManager {
    * times K, capped at 2^30 so compared serials stay inside one half-window.
    */
   #layerAnchorHorizon(packetId) {
-    const cap = 1073741824;
     let blocks;
     try {
       blocks = this.isoRetentionBlocksForPacket(packetId);
     } catch {
       blocks = void 0;
     }
-    const k = this.#trackConfigs.get(packetId)?.k ?? 0;
-    return blocks === void 0 || k <= 0 ? cap : Math.min(cap, blocks * k);
+    return heldLayerAnchorHorizon(blocks, this.#trackConfigs.get(packetId)?.k ?? 0);
   }
   /**
    * Report each stream whose FEC fails closed at runtime (fec-01 6.3.9), once,
@@ -19366,11 +19425,19 @@ var MmtpRouter = class {
   #fecManager;
   #defaultFecMapper;
   #fecMappersByPacketId = /* @__PURE__ */ new Map();
-  #manifestVerifier;
-  #ownsManifestVerifier;
-  #resolveManifestIdentity;
-  #resolveManifestIdentityForRoute;
-  #manifestRecoveryQueues = /* @__PURE__ */ new Map();
+  /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
+  #provenance = /* @__PURE__ */ new Map();
+  #onFlowProtected = null;
+  #unadmittedListedDrops = 0;
+  /** The ingress a held datagram arrived with; the receiver returns the same bytes on release. */
+  #heldIngress = /* @__PURE__ */ new WeakMap();
+  #unicastRepair = false;
+  /** How to route a held unicast (MoQ) datagram once a record admits it. */
+  #heldReplay = /* @__PURE__ */ new WeakMap();
+  /** The flow whose receiver admitted a stream's source datagrams, by packetId then catalog track name: recovered packets answer to it. */
+  #provenanceStreamFlow = /* @__PURE__ */ new Map();
+  #unregisteredFlowDrops = 0;
+  #ambiguousRecoveredDrops = 0;
   // Temp state set by #processMMTP before calling parser.feed(),
   // read by the parser's onFrame callback for CMAF assembly + dedup.
   #currentFecInfo;
@@ -19507,10 +19574,6 @@ var MmtpRouter = class {
     this.#fecManager = config?.fecManager ?? null;
     this.#onFrameGap = config?.onFrameGap ?? null;
     this.#defaultFecMapper = config?.fecMapper ?? null;
-    this.#manifestVerifier = config?.manifestVerifier ?? null;
-    this.#ownsManifestVerifier = config?.manifestVerifierOwnership !== "caller";
-    this.#resolveManifestIdentity = config?.resolveManifestIdentity ?? null;
-    this.#resolveManifestIdentityForRoute = config?.resolveManifestIdentityForRoute ?? null;
     this.#parser = new MmtpContainerParser({
       mfuTimeoutMs: config?.mfuTimeoutMs,
       reassemblyPolicy: config?.reassemblyPolicy,
@@ -20042,29 +20105,162 @@ var MmtpRouter = class {
       }
     });
   }
-  registerManifestTrack(context) {
-    if (!this.#manifestVerifier) throw new Error("manifest verifier is not configured");
-    this.#manifestVerifier.registerTrack(context);
-  }
-  feedManifestFrame(trackName, frame) {
-    this.#manifestVerifier?.ingestManifestFrame(trackName, frame);
-  }
-  setManifestAuthMode(mode) {
-    this.#manifestVerifier?.setMode(mode);
-    if (mode !== "enforce") {
-      for (const queue of this.#manifestRecoveryQueues.values()) {
-        for (const item of queue) {
-          this.#routeProcessedFecSymbols(
-            item.blockId,
-            item.result,
-            item.ownerPacketId,
-            item.catalogTrackName
-          );
+  /**
+   * Protect a flow (draft-ramadan-moq-multicast-01 7.2.7): every multicast
+   * datagram whose ingress names `ingress.flow`, source and repair alike, is
+   * admitted by `receiver` before anything reads it, and an unadmitted one is
+   * held or dropped. The caller owns the receiver's configuration; the router
+   * releases it on `releaseProvenanceFlow` and on dispose.
+   */
+  registerProvenanceFlow(ingress, receiver) {
+    this.#provenance.get(ingress.flow)?.receiver.release();
+    this.#provenance.set(ingress.flow, { receiver, ingress });
+    receiver.keepPendingAgeMs = () => this.#oldestOpenBlockAgeMs(ingress.flow);
+  }
+  /**
+   * Declare that this receiver can request unicast repair (a repair FETCH
+   * scheduler is wired): a protected flow then keeps the pending entries of
+   * its open blocks for the repair to consume (7.2.7 step 2).
+   */
+  setUnicastRepair(enabled) {
+    this.#unicastRepair = enabled;
+  }
+  #oldestOpenBlockAgeMs(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!this.#unicastRepair || !entry) return void 0;
+    let age;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      const a = name ? this.#fecManager?.oldestOpenBlockAgeMs?.(packetId, name) : void 0;
+      if (a !== void 0 && (age === void 0 || a > age)) age = a;
+    }
+    return age;
+  }
+  /**
+   * Replace a registered flow's ingress (a rendition switch staged, committed
+   * or cancelled) while keeping its receiver; a no-op for an unregistered flow.
+   */
+  updateProvenanceFlowIngress(ingress) {
+    const entry = this.#provenance.get(ingress.flow);
+    if (!entry) return;
+    this.#provenance.set(ingress.flow, { ...entry, ingress });
+    if (entry.protected) {
+      for (const { name, packetId } of ingress.tracks) {
+        if (name && !entry.ingress.tracks.some((t) => t.name === name && t.packetId === packetId)) {
+          this.#fecManager?.resetTrack?.(packetId, name);
         }
       }
-      this.#manifestRecoveryQueues.clear();
     }
   }
+  /**
+   * Called once per protection of a flow: at the admission that makes this
+   * router's consumers protected under it (7.2.7), after their unadmitted
+   * holdings of its listed tracks are discarded. Again after an unprotect.
+   */
+  onProvenanceFlowProtected(cb) {
+    this.#onFlowProtected = cb;
+  }
+  /**
+   * The receiver ceased to hold the flow's endpoint on failover (7.2.7): drop
+   * its state and hold queues (no expiry counted) and un-protect its tracks,
+   * which then take MoQ again. The registration stays, so multicast resuming
+   * protects the flow anew at its next admission.
+   */
+  unprotectProvenanceFlow(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!entry) return;
+    entry.receiver.release();
+    entry.protected = false;
+  }
+  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  get unadmittedListedDropCount() {
+    return this.#unadmittedListedDrops;
+  }
+  /**
+   * The admission that makes this router protected under `flow` (7.2.7):
+   * its FEC instances discard what they hold of the flow's listed tracks so
+   * no unadmitted symbol stands for an admitted one, then notify. Before it
+   * nothing of the flow was admitted, so every such symbol is unadmitted.
+   * The playback parse ledger is kept: it records MoQ copies already played,
+   * not holdings, and clearing it re-emits that media (audio twice).
+   * The FEC reset is the whole 7.2.7 discard here: no keyframe-overlay
+   * instance exists to hold anything (repair-layers.ts is the catalog
+   * contract only, no decoder), and packet_id 0 is never a listed track
+   * (`ingressHasPacketId`), so nothing of it is held for the flow.
+   */
+  #noteFlowAdmitted(flow) {
+    const entry = this.#provenance.get(flow);
+    if (!entry || entry.protected) return;
+    entry.protected = true;
+    for (const { name, packetId } of entry.ingress.tracks) {
+      if (name) this.#fecManager?.resetTrack?.(packetId, name);
+    }
+    this.#onFlowProtected?.(flow);
+  }
+  /**
+   * Admit a MoQ datagram of `packetId` on the unicast path of the protected
+   * flow that lists it (7.2.7). `unlisted`: no protected flow lists it, so it
+   * is read as before. A held datagram is routed by `replay` when a record
+   * admits it; one more than one protected flow lists is dropped. So is an
+   * overlap copy: it never enters FEC accounting, so admitting it would leave
+   * its multicast twin a duplicate and the block one symbol short.
+   */
+  #admitUnicast(packetId, packet, replay, overlapCopy = false) {
+    let receiver;
+    for (const entry of this.#provenance.values()) {
+      if (!entry.protected || !ingressHasPacketId(entry.ingress, packetId)) continue;
+      if (receiver || overlapCopy) {
+        this.#unadmittedListedDrops++;
+        return "dropped";
+      }
+      receiver = entry.receiver;
+    }
+    if (!receiver) return "unlisted";
+    const { verdict } = receiver.onDatagram(packet, "unicast");
+    if (verdict === "admitted") return "admitted";
+    if (verdict === "held") {
+      this.#heldReplay.set(packet, replay);
+      return "held";
+    }
+    this.#unadmittedListedDrops++;
+    return "dropped";
+  }
+  /**
+   * Feed one bc-provenance record of `flow`: a datagram from `manifestPort`
+   * (`multicast`) or an object of the manifest track (`mirror`). Held
+   * datagrams the record admits are routed before this returns.
+   */
+  feedProvenanceRecord(flow, record, path) {
+    const entry = this.#provenance.get(flow);
+    if (!entry || this.#disposed) return "unregistered";
+    const result = entry.receiver.onRecord(record, path);
+    if (result.admitted.length > 0) {
+      this.#noteFlowAdmitted(flow);
+      this.#withDeferredFecPokes(() => {
+        for (const datagram of result.admitted) {
+          const replay = this.#heldReplay.get(datagram);
+          if (replay) replay();
+          else this.#processMMTP(datagram, "multicast", true, this.#heldIngress.get(datagram) ?? entry.ingress, false, true);
+        }
+      });
+    }
+    return result.verdict;
+  }
+  /** The receiver ceased to hold the flow: its hold queues are dropped, not expired. */
+  releaseProvenanceFlow(flow) {
+    this.#provenance.get(flow)?.receiver.release();
+    this.#provenance.delete(flow);
+    for (const byName of this.#provenanceStreamFlow.values()) {
+      for (const [name, bound] of byName) if (bound === flow) byName.delete(name);
+    }
+  }
+  /** Multicast datagrams dropped because their ingress names a flow with no registered receiver. */
+  get unregisteredFlowDropCount() {
+    return this.#unregisteredFlowDrops;
+  }
+  /** Recovered packets dropped because more than one protected flow could own their stream. */
+  get ambiguousRecoveredDropCount() {
+    return this.#ambiguousRecoveredDrops;
+  }
   /**
    * Main entry point: feed a raw MMTP packet for processing.
    *
@@ -20079,10 +20275,10 @@ var MmtpRouter = class {
    * they may never have crossed — and that attribution is what the physical-
    * delivery evidence path is built on. Absence is not multicast; say which.
    */
-  feedPacket(packet, source, manifestIdentity, ingress) {
+  feedPacket(packet, source, ingress) {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, source, manifestIdentity, false, ingress);
+      this.#processMMTP(packet, source, false, ingress);
     });
   }
   /**
@@ -20117,7 +20313,7 @@ var MmtpRouter = class {
   feedOverlapCopy(packet, ingress) {
     if (this.#disposed) return;
     this.#withDeferredFecPokes(() => {
-      this.#processMMTP(packet, "moq", void 0, false, ingress, true);
+      this.#processMMTP(packet, "moq", false, ingress, true);
     });
   }
   /**
@@ -20130,7 +20326,7 @@ var MmtpRouter = class {
       this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName);
     });
   }
-  #feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName) {
+  #feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, admitted = false) {
     let header;
     try {
       header = parseMMTPHeader(packet);
@@ -20147,6 +20343,10 @@ var MmtpRouter = class {
         `[MmtpRouter] Dropping MoQ repair packet pid=${repairPacketId}: owner hint is required`
       );
     }
+    if (ownerPacketId != null && !admitted) {
+      const admit = this.#admitUnicast(ownerPacketId, packet, () => this.#feedRepairPacket(packet, ownerPacketIdHint, catalogTrackName, repairTrackName, true));
+      if (admit === "held" || admit === "dropped") return;
+    }
     if (ownerPacketId != null && this.#fecManager) {
       this.#moqRepairPidCounts[repairPacketId] = (this.#moqRepairPidCounts[repairPacketId] || 0) + 1;
       this.#moqRepairOwnerCounts[ownerPacketId] = (this.#moqRepairOwnerCounts[ownerPacketId] || 0) + 1;
@@ -20410,7 +20610,6 @@ var MmtpRouter = class {
     this.#lastDirectSourceAudioCursorByStream.delete(streamKey);
     this.#lastDirectEmittedAudioCursorByStream.delete(streamKey);
     this.#pendingDirectRecoveredAudioByStream.delete(streamKey);
-    this.#manifestRecoveryQueues.delete(streamKey);
     this.#deliveredVideoHighWaterByStream.delete(streamKey);
     this.#stream(packetId, catalogTrackName).duplicates.clear();
     const assemblersToReset = /* @__PURE__ */ new Set();
@@ -20460,7 +20659,6 @@ var MmtpRouter = class {
       this.#lastDirectSourceAudioCursorByStream.delete(key);
       this.#lastDirectEmittedAudioCursorByStream.delete(key);
       this.#pendingDirectRecoveredAudioByStream.delete(key);
-      this.#manifestRecoveryQueues.delete(key);
       this.#trackInitDelivered.delete(key);
       this.#parserDiagnostics.delete(key);
       this.#pendingFecPokes.delete(key);
@@ -20721,8 +20919,9 @@ var MmtpRouter = class {
     this.#parserDiagnostics.clear();
     this.#catalogTrackNamesByPacketId.clear();
     this.#repairOwnersByPacketId.clear();
-    if (this.#ownsManifestVerifier) this.#manifestVerifier?.dispose();
-    this.#manifestRecoveryQueues.clear();
+    for (const { receiver } of this.#provenance.values()) receiver.release();
+    this.#provenance.clear();
+    this.#provenanceStreamFlow.clear();
     for (const assembler of this.#mseAssemblers.values()) assembler.dispose();
     this.#mseAssemblers.clear();
   }
@@ -20999,7 +21198,7 @@ var MmtpRouter = class {
    *   1. parseHeader() → extract packetId + fecPayloadId for FEC feeding
    *   2. feed() → MFU extraction, reassembly, keyframe detection, emit via callbacks
    */
-  #processMMTP(packet, source, manifestIdentity, manifestAdmitted = false, ingress, overlapCopy = false, releasedFromQuarantine = false) {
+  #processMMTP(packet, source, manifestAdmitted = false, ingress, overlapCopy = false, releasedFromQuarantine = false) {
     const parsed = this.#parser.parsePacket(packet);
     if (!parsed) return;
     const info = parsed.info;
@@ -21024,43 +21223,29 @@ var MmtpRouter = class {
     }
     const fecUnreadable = !info.isRepair && info.fecPayloadId != null && this.#fecManager !== null && this.#classifyPacketId(info.packetId) !== null && this.#configuredBlockProfile(info.packetId) === void 0;
     if (fecUnreadable && !manifestAdmitted) this.#noteUnreadableFecPayloadId(info.packetId, "source");
-    if (!info.isRepair && this.#manifestVerifier && !manifestAdmitted) {
-      let identity = manifestIdentity;
-      if (!identity && info.fecPayloadId && !fecUnreadable && (this.#resolveManifestIdentityForRoute || this.#resolveManifestIdentity)) {
-        const catalogTrackName = catalogTrackNameForPacket(ingress, info.packetId);
-        const coordinates = this.#locateFecSource(info.packetId, catalogTrackName, info.fecPayloadId.ssId);
-        identity = coordinates === null ? void 0 : (this.#resolveManifestIdentityForRoute ? this.#resolveManifestIdentityForRoute({
-          packetId: info.packetId,
-          sbn: coordinates.sbn,
-          esi: coordinates.esi,
-          ...catalogTrackName === void 0 ? {} : { catalogTrackName },
-          recovered: false,
-          sourceSymbolFormat: "full-mmtp-packet"
-        }) : this.#resolveManifestIdentity(
-          info.packetId,
-          coordinates.sbn,
-          coordinates.esi,
-          catalogTrackName
-        )) ?? void 0;
-      }
-      if (identity) {
-        identity = {
-          ...identity,
-          packetId: info.packetId,
-          ...info.fecPayloadId ? { ssId: info.fecPayloadId.ssId } : {}
-        };
-        const authenticated = info.fecPayloadId ? packet.subarray(0, packet.length - 4) : packet;
-        let quarantined = false;
-        const admission = this.#manifestVerifier.admitObject(identity, authenticated, () => {
-          if (!this.#disposed) {
-            this.#processMMTP(packet, source, identity, true, ingress, overlapCopy, quarantined);
-          }
-        });
-        quarantined = admission.action === "stall";
+    if (source === "multicast" && manifestAdmitted && !info.isRepair && ingress?.flow !== void 0) {
+      let byName = this.#provenanceStreamFlow.get(info.packetId);
+      if (!byName) this.#provenanceStreamFlow.set(info.packetId, byName = /* @__PURE__ */ new Map());
+      byName.set(catalogTrackNameForPacket(ingress, info.packetId), ingress.flow);
+    }
+    if (source === "multicast" && !manifestAdmitted && ingress?.flow !== void 0) {
+      const protectedFlow = this.#provenance.get(ingress.flow);
+      if (!protectedFlow) {
+        this.#unregisteredFlowDrops++;
+        debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
-      if (this.#manifestVerifier.config.mode === "enforce" && this.#manifestVerifier.config.onMissingManifest === "stall") {
-        console.warn(`[MmtpRouter] manifest identity absent; stalling packetId=${info.packetId}`);
+      const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
+      if (verdict === "admitted") {
+        this.#noteFlowAdmitted(ingress.flow);
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+      } else if (verdict === "held") this.#heldIngress.set(packet, ingress);
+      return;
+    }
+    if (source === "moq" && !manifestAdmitted) {
+      const admit = this.#admitUnicast(info.packetId, packet, () => this.#processMMTP(packet, source, true, ingress, overlapCopy, true), overlapCopy);
+      if (admit !== "unlisted") {
+        if (admit === "admitted") this.#processMMTP(packet, source, true, ingress, overlapCopy);
         return;
       }
     }
@@ -21661,101 +21846,51 @@ var MmtpRouter = class {
     });
     this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
   }
+  /**
+   * A recovered source packet of a protected flow is admitted on its own
+   * digest: its bytes with the SS_ID it was sent with (SS_Start + ESI)
+   * appended are the datagram the record listed (7.2.7). One that no record
+   * lists is dropped; holding it would let it out later as a multicast arrival.
+   */
   #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName) {
-    if (!this.#manifestVerifier || ownerPacketId == null) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
-    }
-    if (!this.#resolveManifestIdentity && !this.#resolveManifestIdentityForRoute) {
-      console.warn(`[MmtpRouter] manifest identity resolver unavailable; recovered media is fail-open for packetId=${ownerPacketId} block=${blockId}`);
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      return;
+    const receiver = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    if (receiver === "ambiguous") {
+      this.#ambiguousRecoveredDrops += result.symbols.length;
+      result = { ...result, symbols: [] };
+    } else if (receiver) {
+      result = {
+        ...result,
+        symbols: result.symbols.filter((sym) => {
+          const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
+          wire.set(sym.rawSymbol);
+          new DataView(wire.buffer).setUint32(sym.rawSymbol.byteLength, this.#fecAnchorForRecovered(blockId, sym.index));
+          return receiver.admitRecovered(wire);
+        })
+      };
     }
-    const queueKey = this.#mediaStreamKey(ownerPacketId, catalogTrackName);
-    const queue = this.#manifestRecoveryQueues.get(queueKey) ?? [];
-    queue.push({ blockId, result, ownerPacketId, catalogTrackName });
-    this.#manifestRecoveryQueues.set(queueKey, queue);
-    if (queue.length > 1) return;
-    const drain = () => {
-      const next = queue[0];
-      if (!next) {
-        this.#manifestRecoveryQueues.delete(queueKey);
-        return;
+    this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
+  }
+  /**
+   * The receiver a recovered packet of `packetId` answers to: the flow that
+   * admitted the stream's source datagrams. Before any was admitted, the one
+   * flow whose registration lists the stream; more than one (a repair flow
+   * also lists its owners' source tracks) cannot be told apart, so none.
+   */
+  #provenanceFor(packetId, catalogTrackName) {
+    const byName = this.#provenanceStreamFlow.get(packetId);
+    const flows = new Set(
+      catalogTrackName === void 0 || !byName ? byName?.values() : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)] : []
+    );
+    if (flows.size > 1) return "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    let match;
+    for (const { receiver, ingress } of this.#provenance.values()) {
+      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
+        if (match) return "ambiguous";
+        match = receiver;
       }
-      this.#admitRecoveredResult(
-        next.blockId,
-        next.result,
-        next.ownerPacketId,
-        next.catalogTrackName,
-        () => {
-          queue.shift();
-          drain();
-        }
-      );
-    };
-    drain();
-  }
-  #admitRecoveredResult(blockId, result, ownerPacketId, catalogTrackName, done) {
-    const verifier = this.#manifestVerifier;
-    const resolveIdentity = this.#resolveManifestIdentity;
-    const resolveIdentityForRoute = this.#resolveManifestIdentityForRoute;
-    if (!verifier) {
-      this.#routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName);
-      done();
-      return;
     }
-    if (!resolveIdentity && !resolveIdentityForRoute) throw new Error("manifest identity resolver disappeared during admission");
-    const symbols = result.symbols;
-    const admitNext = (index) => {
-      const symbol = symbols[index];
-      if (!symbol) {
-        done();
-        return;
-      }
-      const identity = resolveIdentityForRoute ? resolveIdentityForRoute({
-        packetId: ownerPacketId,
-        sbn: blockId,
-        esi: symbol.index,
-        ...catalogTrackName === void 0 ? {} : { catalogTrackName },
-        recovered: true,
-        sourceSymbolFormat: "fec-padded-recovery"
-      }) : resolveIdentity(ownerPacketId, blockId, symbol.index, catalogTrackName);
-      if (!identity) {
-        console.warn(`[MmtpRouter] manifest identity unresolved; recovered symbol is fail-open for packetId=${ownerPacketId} block=${blockId} esi=${symbol.index}`);
-        this.#routeProcessedFecSymbols(
-          blockId,
-          { ...result, symbols: [symbol] },
-          ownerPacketId,
-          catalogTrackName
-        );
-        admitNext(index + 1);
-        return;
-      }
-      const admission = verifier.admitObject(
-        {
-          ...identity,
-          packetId: ownerPacketId
-        },
-        symbol.rawSymbol,
-        () => {
-          if (!this.#disposed) {
-            this.#routeProcessedFecSymbols(
-              blockId,
-              { ...result, symbols: [symbol] },
-              ownerPacketId,
-              catalogTrackName
-            );
-          }
-          admitNext(index + 1);
-        },
-        // A stalled symbol that is later discarded instead of played must still
-        // advance this loop; enforce mode never calls the release callback for
-        // it (BLO-30095).
-        () => admitNext(index + 1)
-      );
-      if (admission.action === "drop") admitNext(index + 1);
-    };
-    admitNext(0);
+    return match;
   }
   #routeProcessedFecSymbols(blockId, result, ownerPacketId, catalogTrackName) {
     if (ownerPacketId == null) return;
@@ -22652,10 +22787,11 @@ var MulticastTransport = class {
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null;
       console.log(
-        `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress}, ${config.groupAddress}, ${config.port})`
+        `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress ?? config.senderAddress ?? "*"}, ${config.groupAddress}, ${config.port})`
       );
       const subscribeConfig = toWindowMulticastSubscribeConfig({
         source: config.sourceAddress,
+        senderAddress: config.senderAddress,
         group: config.groupAddress,
         port: config.port,
         mode: config.mode,
@@ -23251,6 +23387,2726 @@ var MulticastTransport = class {
   }
 };
 
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/crypto.js
+var crypto2 = typeof globalThis === "object" && "crypto" in globalThis ? globalThis.crypto : void 0;
+
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+}
+function anumber(n) {
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new Error("positive integer expected, got " + n);
+}
+function abytes(b, ...lengths) {
+  if (!isBytes(b))
+    throw new Error("Uint8Array expected");
+  if (lengths.length > 0 && !lengths.includes(b.length))
+    throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b.length);
+}
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("Hash instance has been destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("Hash#digest() has already been called");
+}
+function aoutput(out, instance) {
+  abytes(out);
+  const min = instance.outputLen;
+  if (out.length < min) {
+    throw new Error("digestInto() expects output buffer of length at least " + min);
+  }
+}
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
+  }
+}
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
+}
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
+}
+var hasHexBuiltin = /* @__PURE__ */ (() => (
+  // @ts-ignore
+  typeof Uint8Array.from([]).toHex === "function" && typeof Uint8Array.fromHex === "function"
+))();
+var hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, "0"));
+function bytesToHex(bytes) {
+  abytes(bytes);
+  if (hasHexBuiltin)
+    return bytes.toHex();
+  let hex3 = "";
+  for (let i = 0; i < bytes.length; i++) {
+    hex3 += hexes[bytes[i]];
+  }
+  return hex3;
+}
+var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+function asciiToBase16(ch) {
+  if (ch >= asciis._0 && ch <= asciis._9)
+    return ch - asciis._0;
+  if (ch >= asciis.A && ch <= asciis.F)
+    return ch - (asciis.A - 10);
+  if (ch >= asciis.a && ch <= asciis.f)
+    return ch - (asciis.a - 10);
+  return;
+}
+function hexToBytes(hex3) {
+  if (typeof hex3 !== "string")
+    throw new Error("hex string expected, got " + typeof hex3);
+  if (hasHexBuiltin)
+    return Uint8Array.fromHex(hex3);
+  const hl = hex3.length;
+  const al = hl / 2;
+  if (hl % 2)
+    throw new Error("hex string expected, got unpadded hex of length " + hl);
+  const array = new Uint8Array(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = asciiToBase16(hex3.charCodeAt(hi));
+    const n2 = asciiToBase16(hex3.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0) {
+      const char = hex3[hi] + hex3[hi + 1];
+      throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
+    }
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+}
+function utf8ToBytes(str) {
+  if (typeof str !== "string")
+    throw new Error("string expected");
+  return new Uint8Array(new TextEncoder().encode(str));
+}
+function toBytes(data) {
+  if (typeof data === "string")
+    data = utf8ToBytes(data);
+  abytes(data);
+  return data;
+}
+function concatBytes(...arrays) {
+  let sum = 0;
+  for (let i = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    abytes(a);
+    sum += a.length;
+  }
+  const res = new Uint8Array(sum);
+  for (let i = 0, pad = 0; i < arrays.length; i++) {
+    const a = arrays[i];
+    res.set(a, pad);
+    pad += a.length;
+  }
+  return res;
+}
+var Hash = class {
+};
+function createHasher(hashCons) {
+  const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
+  const tmp = hashCons();
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.create = () => hashCons();
+  return hashC;
+}
+function randomBytes(bytesLength = 32) {
+  if (crypto2 && typeof crypto2.getRandomValues === "function") {
+    return crypto2.getRandomValues(new Uint8Array(bytesLength));
+  }
+  if (crypto2 && typeof crypto2.randomBytes === "function") {
+    return Uint8Array.from(crypto2.randomBytes(bytesLength));
+  }
+  throw new Error("crypto.getRandomValues must be defined");
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_md.js
+function setBigUint64(view2, byteOffset, value, isLE) {
+  if (typeof view2.setBigUint64 === "function")
+    return view2.setBigUint64(byteOffset, value, isLE);
+  const _32n2 = BigInt(32);
+  const _u32_max = BigInt(4294967295);
+  const wh = Number(value >> _32n2 & _u32_max);
+  const wl = Number(value & _u32_max);
+  const h = isLE ? 4 : 0;
+  const l = isLE ? 0 : 4;
+  view2.setUint32(byteOffset + h, wh, isLE);
+  view2.setUint32(byteOffset + l, wl, isLE);
+}
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class extends Hash {
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    super();
+    this.finished = false;
+    this.length = 0;
+    this.pos = 0;
+    this.destroyed = false;
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    data = toBytes(data);
+    abytes(data);
+    const { view: view2, buffer, blockLen } = this;
+    const len = data.length;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        continue;
+      }
+      buffer.set(data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view2, 0);
+        this.pos = 0;
+      }
+    }
+    this.length += data.length;
+    this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view: view2, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    clean(this.buffer.subarray(pos));
+    if (this.padOffset > blockLen - pos) {
+      this.process(view2, 0);
+      pos = 0;
+    }
+    for (let i = pos; i < blockLen; i++)
+      buffer[i] = 0;
+    setBigUint64(view2, blockLen - 8, BigInt(this.length * 8), isLE);
+    this.process(view2, 0);
+    const oview = createView(out);
+    const len = this.outputLen;
+    if (len % 4)
+      throw new Error("_sha2: outputLen should be aligned to 32bit");
+    const outLen = len / 4;
+    const state = this.get();
+    if (outLen > state.length)
+      throw new Error("_sha2: outputLen bigger than state");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneInto(to) {
+    to || (to = new this.constructor());
+    to.set(...this.get());
+    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (length % blockLen)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
+  }
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  4089235720,
+  3144134277,
+  2227873595,
+  1013904242,
+  4271175723,
+  2773480762,
+  1595750129,
+  1359893119,
+  2917565137,
+  2600822924,
+  725511199,
+  528734635,
+  4215389547,
+  1541459225,
+  327033209
+]);
+
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/_u64.js
+var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA256 = class extends HashMD {
+  constructor(outputLen = 32) {
+    super(64, outputLen, 8, false);
+    this.A = SHA256_IV[0] | 0;
+    this.B = SHA256_IV[1] | 0;
+    this.C = SHA256_IV[2] | 0;
+    this.D = SHA256_IV[3] | 0;
+    this.E = SHA256_IV[4] | 0;
+    this.F = SHA256_IV[5] | 0;
+    this.G = SHA256_IV[6] | 0;
+    this.H = SHA256_IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  process(view2, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view2.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var K512 = /* @__PURE__ */ (() => split([
+  "0x428a2f98d728ae22",
+  "0x7137449123ef65cd",
+  "0xb5c0fbcfec4d3b2f",
+  "0xe9b5dba58189dbbc",
+  "0x3956c25bf348b538",
+  "0x59f111f1b605d019",
+  "0x923f82a4af194f9b",
+  "0xab1c5ed5da6d8118",
+  "0xd807aa98a3030242",
+  "0x12835b0145706fbe",
+  "0x243185be4ee4b28c",
+  "0x550c7dc3d5ffb4e2",
+  "0x72be5d74f27b896f",
+  "0x80deb1fe3b1696b1",
+  "0x9bdc06a725c71235",
+  "0xc19bf174cf692694",
+  "0xe49b69c19ef14ad2",
+  "0xefbe4786384f25e3",
+  "0x0fc19dc68b8cd5b5",
+  "0x240ca1cc77ac9c65",
+  "0x2de92c6f592b0275",
+  "0x4a7484aa6ea6e483",
+  "0x5cb0a9dcbd41fbd4",
+  "0x76f988da831153b5",
+  "0x983e5152ee66dfab",
+  "0xa831c66d2db43210",
+  "0xb00327c898fb213f",
+  "0xbf597fc7beef0ee4",
+  "0xc6e00bf33da88fc2",
+  "0xd5a79147930aa725",
+  "0x06ca6351e003826f",
+  "0x142929670a0e6e70",
+  "0x27b70a8546d22ffc",
+  "0x2e1b21385c26c926",
+  "0x4d2c6dfc5ac42aed",
+  "0x53380d139d95b3df",
+  "0x650a73548baf63de",
+  "0x766a0abb3c77b2a8",
+  "0x81c2c92e47edaee6",
+  "0x92722c851482353b",
+  "0xa2bfe8a14cf10364",
+  "0xa81a664bbc423001",
+  "0xc24b8b70d0f89791",
+  "0xc76c51a30654be30",
+  "0xd192e819d6ef5218",
+  "0xd69906245565a910",
+  "0xf40e35855771202a",
+  "0x106aa07032bbd1b8",
+  "0x19a4c116b8d2d0c8",
+  "0x1e376c085141ab53",
+  "0x2748774cdf8eeb99",
+  "0x34b0bcb5e19b48a8",
+  "0x391c0cb3c5c95a63",
+  "0x4ed8aa4ae3418acb",
+  "0x5b9cca4f7763e373",
+  "0x682e6ff3d6b2b8a3",
+  "0x748f82ee5defb2fc",
+  "0x78a5636f43172f60",
+  "0x84c87814a1f0ab72",
+  "0x8cc702081a6439ec",
+  "0x90befffa23631e28",
+  "0xa4506cebde82bde9",
+  "0xbef9a3f7b2c67915",
+  "0xc67178f2e372532b",
+  "0xca273eceea26619c",
+  "0xd186b8c721c0c207",
+  "0xeada7dd6cde0eb1e",
+  "0xf57d4f7fee6ed178",
+  "0x06f067aa72176fba",
+  "0x0a637dc5a2c898a6",
+  "0x113f9804bef90dae",
+  "0x1b710b35131c471b",
+  "0x28db77f523047d84",
+  "0x32caab7b40c72493",
+  "0x3c9ebe0a15c9bebc",
+  "0x431d67c49c100d4c",
+  "0x4cc5d4becb3e42b6",
+  "0x597f299cfc657e2a",
+  "0x5fcb6fab3ad6faec",
+  "0x6c44198c4a475817"
+].map((n) => BigInt(n))))();
+var SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
+var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
+var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
+var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
+var SHA512 = class extends HashMD {
+  constructor(outputLen = 64) {
+    super(128, outputLen, 16, false);
+    this.Ah = SHA512_IV[0] | 0;
+    this.Al = SHA512_IV[1] | 0;
+    this.Bh = SHA512_IV[2] | 0;
+    this.Bl = SHA512_IV[3] | 0;
+    this.Ch = SHA512_IV[4] | 0;
+    this.Cl = SHA512_IV[5] | 0;
+    this.Dh = SHA512_IV[6] | 0;
+    this.Dl = SHA512_IV[7] | 0;
+    this.Eh = SHA512_IV[8] | 0;
+    this.El = SHA512_IV[9] | 0;
+    this.Fh = SHA512_IV[10] | 0;
+    this.Fl = SHA512_IV[11] | 0;
+    this.Gh = SHA512_IV[12] | 0;
+    this.Gl = SHA512_IV[13] | 0;
+    this.Hh = SHA512_IV[14] | 0;
+    this.Hl = SHA512_IV[15] | 0;
+  }
+  // prettier-ignore
+  get() {
+    const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
+  }
+  // prettier-ignore
+  set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
+    this.Ah = Ah | 0;
+    this.Al = Al | 0;
+    this.Bh = Bh | 0;
+    this.Bl = Bl | 0;
+    this.Ch = Ch | 0;
+    this.Cl = Cl | 0;
+    this.Dh = Dh | 0;
+    this.Dl = Dl | 0;
+    this.Eh = Eh | 0;
+    this.El = El | 0;
+    this.Fh = Fh | 0;
+    this.Fl = Fl | 0;
+    this.Gh = Gh | 0;
+    this.Gl = Gl | 0;
+    this.Hh = Hh | 0;
+    this.Hl = Hl | 0;
+  }
+  process(view2, offset) {
+    for (let i = 0; i < 16; i++, offset += 4) {
+      SHA512_W_H[i] = view2.getUint32(offset);
+      SHA512_W_L[i] = view2.getUint32(offset += 4);
+    }
+    for (let i = 16; i < 80; i++) {
+      const W15h = SHA512_W_H[i - 15] | 0;
+      const W15l = SHA512_W_L[i - 15] | 0;
+      const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
+      const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
+      const W2h = SHA512_W_H[i - 2] | 0;
+      const W2l = SHA512_W_L[i - 2] | 0;
+      const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
+      const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
+      const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
+      const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
+      SHA512_W_H[i] = SUMh | 0;
+      SHA512_W_L[i] = SUMl | 0;
+    }
+    let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
+    for (let i = 0; i < 80; i++) {
+      const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
+      const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
+      const CHIh = Eh & Fh ^ ~Eh & Gh;
+      const CHIl = El & Fl ^ ~El & Gl;
+      const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
+      const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
+      const T1l = T1ll | 0;
+      const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
+      const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
+      const MAJh = Ah & Bh ^ Ah & Ch ^ Bh & Ch;
+      const MAJl = Al & Bl ^ Al & Cl ^ Bl & Cl;
+      Hh = Gh | 0;
+      Hl = Gl | 0;
+      Gh = Fh | 0;
+      Gl = Fl | 0;
+      Fh = Eh | 0;
+      Fl = El | 0;
+      ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
+      Dh = Ch | 0;
+      Dl = Cl | 0;
+      Ch = Bh | 0;
+      Cl = Bl | 0;
+      Bh = Ah | 0;
+      Bl = Al | 0;
+      const All = add3L(T1l, sigma0l, MAJl);
+      Ah = add3H(All, T1h, sigma0h, MAJh);
+      Al = All | 0;
+    }
+    ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
+    ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
+    ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
+    ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
+    ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
+    ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
+    ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
+    ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
+    this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
+  }
+  roundClean() {
+    clean(SHA512_W_H, SHA512_W_L);
+  }
+  destroy() {
+    clean(this.buffer);
+    this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
+var sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
+
+// ../mmt-manifest-verify/node_modules/@noble/hashes/esm/sha256.js
+var sha2562 = sha256;
+
+// ../mmt-manifest-verify/dist/bc-provenance-v2.js
+var BCPV2_HEADER_LENGTH = 68;
+var BCPV2_SIGNATURE_LENGTH = 64;
+var BCPV2_MIN_RECORD_LENGTH = BCPV2_HEADER_LENGTH + 32 + BCPV2_SIGNATURE_LENGTH;
+var BCPV2_MAX_RECORD_LENGTH = 1316;
+var BCPV2_MAX_DIGESTS = 37;
+var BCPV2_HASH_ALG_SHA256 = 1;
+var text = new TextEncoder();
+var MAGIC = Uint8Array.from([77, 72, 77, 50]);
+var SIGNING_DOMAIN = text.encode("mcast-manifest-v2\0");
+function equalBytes(left, right) {
+  if (left.byteLength !== right.byteLength)
+    return false;
+  let different = 0;
+  for (let index = 0; index < left.byteLength; index++)
+    different |= left[index] ^ right[index];
+  return different === 0;
+}
+function u16(value) {
+  const result = new Uint8Array(2);
+  new DataView(result.buffer).setUint16(0, value);
+  return result;
+}
+function u322(value) {
+  const result = new Uint8Array(4);
+  new DataView(result.buffer).setUint32(0, value);
+  return result;
+}
+function validU32(value) {
+  return Number.isInteger(value) && value >= 0 && value <= 4294967295;
+}
+function validPort(value) {
+  return Number.isInteger(value) && value >= 0 && value <= 65535;
+}
+function parseIpv4(address) {
+  const fields = address.split(".");
+  if (fields.length !== 4 || fields.some((field) => !/^\d+$/.test(field))) {
+    throw new Error(`invalid IPv4 address ${address}`);
+  }
+  const values = fields.map(Number);
+  if (values.some((value, index) => value > 255 || String(value) !== fields[index])) {
+    throw new Error(`invalid IPv4 address ${address}`);
+  }
+  return Uint8Array.from(values);
+}
+function parseIpv6(address) {
+  const compressed = address.includes("::");
+  if ((address.match(/::/g) ?? []).length > 1)
+    throw new Error(`invalid IPv6 address ${address}`);
+  const [leftText, rightText = ""] = address.split("::");
+  const left = leftText ? leftText.split(":") : [];
+  const right = rightText ? rightText.split(":") : [];
+  if (left.some((group) => group.includes(".")) || right.some((group) => group.includes("."))) {
+    throw new Error(`invalid IPv6 address ${address}`);
+  }
+  const missing = 8 - left.length - right.length;
+  if (missing < 0 || !compressed && missing !== 0 || compressed && missing < 1) {
+    throw new Error(`invalid IPv6 address ${address}`);
+  }
+  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) {
+    throw new Error(`invalid IPv6 address ${address}`);
+  }
+  const result = new Uint8Array(16);
+  const view2 = new DataView(result.buffer);
+  groups.forEach((group, index) => view2.setUint16(index * 2, Number.parseInt(group, 16)));
+  return result;
+}
+function parseBcProvenanceV2Address(address) {
+  if (address.includes(":"))
+    return parseIpv6(address);
+  return parseIpv4(address);
+}
+function endpointBytes(endpoint) {
+  if (!validPort(endpoint.port) || !validPort(endpoint.manifestPort) || !validU32(endpoint.streamId)) {
+    throw new Error("invalid BCPV2 endpoint");
+  }
+  const source = parseBcProvenanceV2Address(endpoint.sourceAddress);
+  const group = parseBcProvenanceV2Address(endpoint.groupAddress);
+  if (source.byteLength !== group.byteLength)
+    throw new Error("endpoint address families differ");
+  return { source, group };
+}
+function readU32(view2, offset) {
+  return view2.getUint32(offset);
+}
+function readU642(view2, offset) {
+  return view2.getBigUint64(offset);
+}
+function decodeBcProvenanceV2Record(input) {
+  const bytes = Uint8Array.from(input);
+  if (bytes.byteLength < BCPV2_MIN_RECORD_LENGTH || bytes.byteLength > BCPV2_MAX_RECORD_LENGTH || (bytes.byteLength - 132) % 32 !== 0) {
+    throw new Error("invalid BCPV2 record length");
+  }
+  const view2 = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (!equalBytes(bytes.subarray(0, 4), MAGIC))
+    throw new Error("invalid BCPV2 record magic");
+  const count = view2.getUint16(28);
+  if (count < 1 || count > BCPV2_MAX_DIGESTS || bytes.byteLength !== 132 + count * 32) {
+    throw new Error("invalid BCPV2 record count");
+  }
+  const body = bytes.slice(0, bytes.byteLength - BCPV2_SIGNATURE_LENGTH);
+  const digests = [];
+  for (let index = 0; index < count; index++) {
+    digests.push(bytes.slice(BCPV2_HEADER_LENGTH + index * 32, BCPV2_HEADER_LENGTH + (index + 1) * 32));
+  }
+  return {
+    kid: readU32(view2, 4),
+    epoch: readU32(view2, 8),
+    mseq: readU642(view2, 12),
+    firstSeq: readU642(view2, 20),
+    count,
+    hashAlg: bytes[30],
+    flags: bytes[31],
+    sent: readU32(view2, 32),
+    ctx: bytes.slice(36, 68),
+    digests,
+    signature: bytes.slice(bytes.byteLength - BCPV2_SIGNATURE_LENGTH),
+    body,
+    raw: bytes
+  };
+}
+function bcProvenanceV2SignedMessage(record, endpoint) {
+  const { source, group } = endpointBytes(endpoint);
+  const prefix = new Uint8Array(SIGNING_DOMAIN.byteLength + 4 + source.byteLength + group.byteLength + 2);
+  let offset = 0;
+  prefix.set(SIGNING_DOMAIN, offset);
+  offset += SIGNING_DOMAIN.byteLength;
+  prefix.set(u322(endpoint.streamId), offset);
+  offset += 4;
+  prefix.set(source, offset);
+  offset += source.byteLength;
+  prefix.set(group, offset);
+  offset += group.byteLength;
+  prefix.set(u16(endpoint.manifestPort), offset);
+  const message = new Uint8Array(prefix.byteLength + record.body.byteLength);
+  message.set(prefix);
+  message.set(record.body, prefix.byteLength);
+  return message;
+}
+function bcProvenanceV2DatagramDigest(endpoint, payload) {
+  if (payload.byteLength > 65535)
+    throw new Error("datagram payload exceeds u16 length");
+  const { source, group } = endpointBytes(endpoint);
+  const pseudoheader = new Uint8Array(source.byteLength + group.byteLength + 2 + 2 + 2 + 2 + 4);
+  let offset = 0;
+  pseudoheader.set(source, offset);
+  offset += source.byteLength;
+  pseudoheader.set(group, offset);
+  offset += group.byteLength;
+  pseudoheader.set([0, 17], offset);
+  offset += 2;
+  pseudoheader.set(u16(payload.byteLength), offset);
+  offset += 2;
+  pseudoheader.set(u16(endpoint.port), offset);
+  offset += 2;
+  pseudoheader.set(u16(endpoint.port), offset);
+  offset += 2;
+  pseudoheader.set(u322(endpoint.streamId), offset);
+  const input = new Uint8Array(pseudoheader.byteLength + payload.byteLength);
+  input.set(pseudoheader);
+  input.set(payload, pseudoheader.byteLength);
+  return sha2562(input);
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/curves/esm/utils.js
+var _0n = /* @__PURE__ */ BigInt(0);
+var _1n = /* @__PURE__ */ BigInt(1);
+function _abool2(value, title = "") {
+  if (typeof value !== "boolean") {
+    const prefix = title && `"${title}"`;
+    throw new Error(prefix + "expected boolean, got type=" + typeof value);
+  }
+  return value;
+}
+function _abytes2(value, length, title = "") {
+  const bytes = isBytes(value);
+  const len = value?.length;
+  const needsLen = length !== void 0;
+  if (!bytes || needsLen && len !== length) {
+    const prefix = title && `"${title}" `;
+    const ofLen = needsLen ? ` of length ${length}` : "";
+    const got = bytes ? `length=${len}` : `type=${typeof value}`;
+    throw new Error(prefix + "expected Uint8Array" + ofLen + ", got " + got);
+  }
+  return value;
+}
+function hexToNumber(hex3) {
+  if (typeof hex3 !== "string")
+    throw new Error("hex string expected, got " + typeof hex3);
+  return hex3 === "" ? _0n : BigInt("0x" + hex3);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function bytesToNumberLE(bytes) {
+  abytes(bytes);
+  return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));
+}
+function numberToBytesBE(n, len) {
+  return hexToBytes(n.toString(16).padStart(len * 2, "0"));
+}
+function numberToBytesLE(n, len) {
+  return numberToBytesBE(n, len).reverse();
+}
+function ensureBytes(title, hex3, expectedLength) {
+  let res;
+  if (typeof hex3 === "string") {
+    try {
+      res = hexToBytes(hex3);
+    } catch (e) {
+      throw new Error(title + " must be hex string or Uint8Array, cause: " + e);
+    }
+  } else if (isBytes(hex3)) {
+    res = Uint8Array.from(hex3);
+  } else {
+    throw new Error(title + " must be hex string or Uint8Array");
+  }
+  const len = res.length;
+  if (typeof expectedLength === "number" && len !== expectedLength)
+    throw new Error(title + " of length " + expectedLength + " expected, got " + len);
+  return res;
+}
+function equalBytes2(a, b) {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function copyBytes(bytes) {
+  return Uint8Array.from(bytes);
+}
+var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+function inRange(n, min, max) {
+  return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+function aInRange(title, n, min, max) {
+  if (!inRange(n, min, max))
+    throw new Error("expected valid " + title + ": " + min + " <= n < " + max + ", got " + n);
+}
+function bitLen(n) {
+  let len;
+  for (len = 0; n > _0n; n >>= _1n, len += 1)
+    ;
+  return len;
+}
+var bitMask = (n) => (_1n << BigInt(n)) - _1n;
+function _validateObject(object2, fields, optFields = {}) {
+  if (!object2 || typeof object2 !== "object")
+    throw new Error("expected valid options object");
+  function checkField2(fieldName, expectedType, isOpt) {
+    const val = object2[fieldName];
+    if (isOpt && val === void 0)
+      return;
+    const current = typeof val;
+    if (current !== expectedType || val === null)
+      throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+  }
+  Object.entries(fields).forEach(([k, v]) => checkField2(k, v, false));
+  Object.entries(optFields).forEach(([k, v]) => checkField2(k, v, true));
+}
+var notImplemented = () => {
+  throw new Error("not implemented");
+};
+function memoized(fn) {
+  const map = /* @__PURE__ */ new WeakMap();
+  return (arg, ...args) => {
+    const val = map.get(arg);
+    if (val !== void 0)
+      return val;
+    const computed = fn(arg, ...args);
+    map.set(arg, computed);
+    return computed;
+  };
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/modular.js
+var _0n2 = BigInt(0);
+var _1n2 = BigInt(1);
+var _2n = /* @__PURE__ */ BigInt(2);
+var _3n = /* @__PURE__ */ BigInt(3);
+var _4n = /* @__PURE__ */ BigInt(4);
+var _5n = /* @__PURE__ */ BigInt(5);
+var _7n = /* @__PURE__ */ BigInt(7);
+var _8n = /* @__PURE__ */ BigInt(8);
+var _9n = /* @__PURE__ */ BigInt(9);
+var _16n = /* @__PURE__ */ BigInt(16);
+function mod(a, b) {
+  const result = a % b;
+  return result >= _0n2 ? result : b + result;
+}
+function pow2(x, power, modulo) {
+  let res = x;
+  while (power-- > _0n2) {
+    res *= res;
+    res %= modulo;
+  }
+  return res;
+}
+function invert(number, modulo) {
+  if (number === _0n2)
+    throw new Error("invert: expected non-zero number");
+  if (modulo <= _0n2)
+    throw new Error("invert: expected positive modulus, got " + modulo);
+  let a = mod(number, modulo);
+  let b = modulo;
+  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  while (a !== _0n2) {
+    const q = b / a;
+    const r = b % a;
+    const m = x - u * q;
+    const n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  const gcd = b;
+  if (gcd !== _1n2)
+    throw new Error("invert: does not exist");
+  return mod(x, modulo);
+}
+function assertIsSquare(Fp2, root, n) {
+  if (!Fp2.eql(Fp2.sqr(root), n))
+    throw new Error("Cannot find square root");
+}
+function sqrt3mod4(Fp2, n) {
+  const p1div4 = (Fp2.ORDER + _1n2) / _4n;
+  const root = Fp2.pow(n, p1div4);
+  assertIsSquare(Fp2, root, n);
+  return root;
+}
+function sqrt5mod8(Fp2, n) {
+  const p5div8 = (Fp2.ORDER - _5n) / _8n;
+  const n2 = Fp2.mul(n, _2n);
+  const v = Fp2.pow(n2, p5div8);
+  const nv = Fp2.mul(n, v);
+  const i = Fp2.mul(Fp2.mul(nv, _2n), v);
+  const root = Fp2.mul(nv, Fp2.sub(i, Fp2.ONE));
+  assertIsSquare(Fp2, root, n);
+  return root;
+}
+function sqrt9mod16(P) {
+  const Fp_ = Field(P);
+  const tn = tonelliShanks(P);
+  const c1 = tn(Fp_, Fp_.neg(Fp_.ONE));
+  const c2 = tn(Fp_, c1);
+  const c3 = tn(Fp_, Fp_.neg(c1));
+  const c4 = (P + _7n) / _16n;
+  return (Fp2, n) => {
+    let tv1 = Fp2.pow(n, c4);
+    let tv2 = Fp2.mul(tv1, c1);
+    const tv3 = Fp2.mul(tv1, c2);
+    const tv4 = Fp2.mul(tv1, c3);
+    const e1 = Fp2.eql(Fp2.sqr(tv2), n);
+    const e2 = Fp2.eql(Fp2.sqr(tv3), n);
+    tv1 = Fp2.cmov(tv1, tv2, e1);
+    tv2 = Fp2.cmov(tv4, tv3, e2);
+    const e3 = Fp2.eql(Fp2.sqr(tv2), n);
+    const root = Fp2.cmov(tv1, tv2, e3);
+    assertIsSquare(Fp2, root, n);
+    return root;
+  };
+}
+function tonelliShanks(P) {
+  if (P < _3n)
+    throw new Error("sqrt is not defined for small field");
+  let Q = P - _1n2;
+  let S = 0;
+  while (Q % _2n === _0n2) {
+    Q /= _2n;
+    S++;
+  }
+  let Z = _2n;
+  const _Fp = Field(P);
+  while (FpLegendre(_Fp, Z) === 1) {
+    if (Z++ > 1e3)
+      throw new Error("Cannot find square root: probably non-prime P");
+  }
+  if (S === 1)
+    return sqrt3mod4;
+  let cc = _Fp.pow(Z, Q);
+  const Q1div2 = (Q + _1n2) / _2n;
+  return function tonelliSlow(Fp2, n) {
+    if (Fp2.is0(n))
+      return n;
+    if (FpLegendre(Fp2, n) !== 1)
+      throw new Error("Cannot find square root");
+    let M = S;
+    let c = Fp2.mul(Fp2.ONE, cc);
+    let t = Fp2.pow(n, Q);
+    let R = Fp2.pow(n, Q1div2);
+    while (!Fp2.eql(t, Fp2.ONE)) {
+      if (Fp2.is0(t))
+        return Fp2.ZERO;
+      let i = 1;
+      let t_tmp = Fp2.sqr(t);
+      while (!Fp2.eql(t_tmp, Fp2.ONE)) {
+        i++;
+        t_tmp = Fp2.sqr(t_tmp);
+        if (i === M)
+          throw new Error("Cannot find square root");
+      }
+      const exponent = _1n2 << BigInt(M - i - 1);
+      const b = Fp2.pow(c, exponent);
+      M = i;
+      c = Fp2.sqr(b);
+      t = Fp2.mul(t, c);
+      R = Fp2.mul(R, b);
+    }
+    return R;
+  };
+}
+function FpSqrt(P) {
+  if (P % _4n === _3n)
+    return sqrt3mod4;
+  if (P % _8n === _5n)
+    return sqrt5mod8;
+  if (P % _16n === _9n)
+    return sqrt9mod16(P);
+  return tonelliShanks(P);
+}
+var isNegativeLE = (num, modulo) => (mod(num, modulo) & _1n2) === _1n2;
+var FIELD_FIELDS = [
+  "create",
+  "isValid",
+  "is0",
+  "neg",
+  "inv",
+  "sqrt",
+  "sqr",
+  "eql",
+  "add",
+  "sub",
+  "mul",
+  "pow",
+  "div",
+  "addN",
+  "subN",
+  "mulN",
+  "sqrN"
+];
+function validateField(field) {
+  const initial = {
+    ORDER: "bigint",
+    MASK: "bigint",
+    BYTES: "number",
+    BITS: "number"
+  };
+  const opts = FIELD_FIELDS.reduce((map, val) => {
+    map[val] = "function";
+    return map;
+  }, initial);
+  _validateObject(field, opts);
+  return field;
+}
+function FpPow(Fp2, num, power) {
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return Fp2.ONE;
+  if (power === _1n2)
+    return num;
+  let p = Fp2.ONE;
+  let d = num;
+  while (power > _0n2) {
+    if (power & _1n2)
+      p = Fp2.mul(p, d);
+    d = Fp2.sqr(d);
+    power >>= _1n2;
+  }
+  return p;
+}
+function FpInvertBatch(Fp2, nums, passZero = false) {
+  const inverted = new Array(nums.length).fill(passZero ? Fp2.ZERO : void 0);
+  const multipliedAcc = nums.reduce((acc, num, i) => {
+    if (Fp2.is0(num))
+      return acc;
+    inverted[i] = acc;
+    return Fp2.mul(acc, num);
+  }, Fp2.ONE);
+  const invertedAcc = Fp2.inv(multipliedAcc);
+  nums.reduceRight((acc, num, i) => {
+    if (Fp2.is0(num))
+      return acc;
+    inverted[i] = Fp2.mul(acc, inverted[i]);
+    return Fp2.mul(acc, num);
+  }, invertedAcc);
+  return inverted;
+}
+function FpLegendre(Fp2, n) {
+  const p1mod2 = (Fp2.ORDER - _1n2) / _2n;
+  const powered = Fp2.pow(n, p1mod2);
+  const yes = Fp2.eql(powered, Fp2.ONE);
+  const zero = Fp2.eql(powered, Fp2.ZERO);
+  const no = Fp2.eql(powered, Fp2.neg(Fp2.ONE));
+  if (!yes && !zero && !no)
+    throw new Error("invalid Legendre symbol result");
+  return yes ? 1 : zero ? 0 : -1;
+}
+function nLength(n, nBitLength) {
+  if (nBitLength !== void 0)
+    anumber(nBitLength);
+  const _nBitLength = nBitLength !== void 0 ? nBitLength : n.toString(2).length;
+  const nByteLength = Math.ceil(_nBitLength / 8);
+  return { nBitLength: _nBitLength, nByteLength };
+}
+function Field(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
+  if (ORDER <= _0n2)
+    throw new Error("invalid field: expected ORDER > 0, got " + ORDER);
+  let _nbitLength = void 0;
+  let _sqrt = void 0;
+  let modFromBytes = false;
+  let allowedLengths = void 0;
+  if (typeof bitLenOrOpts === "object" && bitLenOrOpts != null) {
+    if (opts.sqrt || isLE)
+      throw new Error("cannot specify opts in two arguments");
+    const _opts = bitLenOrOpts;
+    if (_opts.BITS)
+      _nbitLength = _opts.BITS;
+    if (_opts.sqrt)
+      _sqrt = _opts.sqrt;
+    if (typeof _opts.isLE === "boolean")
+      isLE = _opts.isLE;
+    if (typeof _opts.modFromBytes === "boolean")
+      modFromBytes = _opts.modFromBytes;
+    allowedLengths = _opts.allowedLengths;
+  } else {
+    if (typeof bitLenOrOpts === "number")
+      _nbitLength = bitLenOrOpts;
+    if (opts.sqrt)
+      _sqrt = opts.sqrt;
+  }
+  const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);
+  if (BYTES > 2048)
+    throw new Error("invalid field: expected ORDER of <= 2048 bytes");
+  let sqrtP;
+  const f = Object.freeze({
+    ORDER,
+    isLE,
+    BITS,
+    BYTES,
+    MASK: bitMask(BITS),
+    ZERO: _0n2,
+    ONE: _1n2,
+    allowedLengths,
+    create: (num) => mod(num, ORDER),
+    isValid: (num) => {
+      if (typeof num !== "bigint")
+        throw new Error("invalid field element: expected bigint, got " + typeof num);
+      return _0n2 <= num && num < ORDER;
+    },
+    is0: (num) => num === _0n2,
+    // is valid and invertible
+    isValidNot0: (num) => !f.is0(num) && f.isValid(num),
+    isOdd: (num) => (num & _1n2) === _1n2,
+    neg: (num) => mod(-num, ORDER),
+    eql: (lhs, rhs) => lhs === rhs,
+    sqr: (num) => mod(num * num, ORDER),
+    add: (lhs, rhs) => mod(lhs + rhs, ORDER),
+    sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
+    mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
+    pow: (num, power) => FpPow(f, num, power),
+    div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
+    // Same as above, but doesn't normalize
+    sqrN: (num) => num * num,
+    addN: (lhs, rhs) => lhs + rhs,
+    subN: (lhs, rhs) => lhs - rhs,
+    mulN: (lhs, rhs) => lhs * rhs,
+    inv: (num) => invert(num, ORDER),
+    sqrt: _sqrt || ((n) => {
+      if (!sqrtP)
+        sqrtP = FpSqrt(ORDER);
+      return sqrtP(f, n);
+    }),
+    toBytes: (num) => isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES),
+    fromBytes: (bytes, skipValidation = true) => {
+      if (allowedLengths) {
+        if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+          throw new Error("Field.fromBytes: expected " + allowedLengths + " bytes, got " + bytes.length);
+        }
+        const padded = new Uint8Array(BYTES);
+        padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+        bytes = padded;
+      }
+      if (bytes.length !== BYTES)
+        throw new Error("Field.fromBytes: expected " + BYTES + " bytes, got " + bytes.length);
+      let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+      if (modFromBytes)
+        scalar = mod(scalar, ORDER);
+      if (!skipValidation) {
+        if (!f.isValid(scalar))
+          throw new Error("invalid field element: outside of range 0..ORDER");
+      }
+      return scalar;
+    },
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch: (lst) => FpInvertBatch(f, lst),
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov: (a, b, c) => c ? b : a
+  });
+  return Object.freeze(f);
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/curve.js
+var _0n3 = BigInt(0);
+var _1n3 = BigInt(1);
+function negateCt(condition, item) {
+  const neg = item.negate();
+  return condition ? neg : item;
+}
+function normalizeZ(c, points) {
+  const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+  return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits) {
+  if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+    throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+  validateW(W, scalarBits);
+  const windows = Math.ceil(scalarBits / W) + 1;
+  const windowSize = 2 ** (W - 1);
+  const maxNumber = 2 ** W;
+  const mask = bitMask(W);
+  const shiftBy = BigInt(W);
+  return { windows, windowSize, mask, maxNumber, shiftBy };
+}
+function calcOffsets(n, window2, wOpts) {
+  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+  let wbits = Number(n & mask);
+  let nextN = n >> shiftBy;
+  if (wbits > windowSize) {
+    wbits -= maxNumber;
+    nextN += _1n3;
+  }
+  const offsetStart = window2 * windowSize;
+  const offset = offsetStart + Math.abs(wbits) - 1;
+  const isZero = wbits === 0;
+  const isNeg = wbits < 0;
+  const isNegF = window2 % 2 !== 0;
+  const offsetF = offsetStart;
+  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+}
+function validateMSMPoints(points, c) {
+  if (!Array.isArray(points))
+    throw new Error("array expected");
+  points.forEach((p, i) => {
+    if (!(p instanceof c))
+      throw new Error("invalid point at index " + i);
+  });
+}
+function validateMSMScalars(scalars, field) {
+  if (!Array.isArray(scalars))
+    throw new Error("array of scalars expected");
+  scalars.forEach((s, i) => {
+    if (!field.isValid(s))
+      throw new Error("invalid scalar at index " + i);
+  });
+}
+var pointPrecomputes = /* @__PURE__ */ new WeakMap();
+var pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+  return pointWindowSizes.get(P) || 1;
+}
+function assert0(n) {
+  if (n !== _0n3)
+    throw new Error("invalid wNAF");
+}
+var wNAF = class {
+  // Parametrized with a given Point class (not individual point)
+  constructor(Point, bits) {
+    this.BASE = Point.BASE;
+    this.ZERO = Point.ZERO;
+    this.Fn = Point.Fn;
+    this.bits = bits;
+  }
+  // non-const time multiplication ladder
+  _unsafeLadder(elm, n, p = this.ZERO) {
+    let d = elm;
+    while (n > _0n3) {
+      if (n & _1n3)
+        p = p.add(d);
+      d = d.double();
+      n >>= _1n3;
+    }
+    return p;
+  }
+  /**
+   * Creates a wNAF precomputation window. Used for caching.
+   * Default window size is set by `utils.precompute()` and is equal to 8.
+   * Number of precomputed points depends on the curve size:
+   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+   * - 𝑊 is the window size
+   * - 𝑛 is the bitlength of the curve order.
+   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * @param point Point instance
+   * @param W window size
+   * @returns precomputed point tables flattened to a single array
+   */
+  precomputeWindow(point, W) {
+    const { windows, windowSize } = calcWOpts(W, this.bits);
+    const points = [];
+    let p = point;
+    let base = p;
+    for (let window2 = 0; window2 < windows; window2++) {
+      base = p;
+      points.push(base);
+      for (let i = 1; i < windowSize; i++) {
+        base = base.add(p);
+        points.push(base);
+      }
+      p = base.double();
+    }
+    return points;
+  }
+  /**
+   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+   * More compact implementation:
+   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * @returns real and fake (for const-time) points
+   */
+  wNAF(W, precomputes, n) {
+    if (!this.Fn.isValid(n))
+      throw new Error("invalid scalar");
+    let p = this.ZERO;
+    let f = this.BASE;
+    const wo = calcWOpts(W, this.bits);
+    for (let window2 = 0; window2 < wo.windows; window2++) {
+      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window2, wo);
+      n = nextN;
+      if (isZero) {
+        f = f.add(negateCt(isNegF, precomputes[offsetF]));
+      } else {
+        p = p.add(negateCt(isNeg, precomputes[offset]));
+      }
+    }
+    assert0(n);
+    return { p, f };
+  }
+  /**
+   * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+   * @param acc accumulator point to add result of multiplication
+   * @returns point
+   */
+  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+    const wo = calcWOpts(W, this.bits);
+    for (let window2 = 0; window2 < wo.windows; window2++) {
+      if (n === _0n3)
+        break;
+      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window2, wo);
+      n = nextN;
+      if (isZero) {
+        continue;
+      } else {
+        const item = precomputes[offset];
+        acc = acc.add(isNeg ? item.negate() : item);
+      }
+    }
+    assert0(n);
+    return acc;
+  }
+  getPrecomputes(W, point, transform) {
+    let comp = pointPrecomputes.get(point);
+    if (!comp) {
+      comp = this.precomputeWindow(point, W);
+      if (W !== 1) {
+        if (typeof transform === "function")
+          comp = transform(comp);
+        pointPrecomputes.set(point, comp);
+      }
+    }
+    return comp;
+  }
+  cached(point, scalar, transform) {
+    const W = getW(point);
+    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  }
+  unsafe(point, scalar, transform, prev) {
+    const W = getW(point);
+    if (W === 1)
+      return this._unsafeLadder(point, scalar, prev);
+    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+  }
+  // We calculate precomputes for elliptic curve point multiplication
+  // using windowed method. This specifies window size and
+  // stores precomputed values. Usually only base point would be precomputed.
+  createCache(P, W) {
+    validateW(W, this.bits);
+    pointWindowSizes.set(P, W);
+    pointPrecomputes.delete(P);
+  }
+  hasCache(elm) {
+    return getW(elm) !== 1;
+  }
+};
+function pippenger(c, fieldN, points, scalars) {
+  validateMSMPoints(points, c);
+  validateMSMScalars(scalars, fieldN);
+  const plength = points.length;
+  const slength = scalars.length;
+  if (plength !== slength)
+    throw new Error("arrays of points and scalars must have equal length");
+  const zero = c.ZERO;
+  const wbits = bitLen(BigInt(plength));
+  let windowSize = 1;
+  if (wbits > 12)
+    windowSize = wbits - 3;
+  else if (wbits > 4)
+    windowSize = wbits - 2;
+  else if (wbits > 0)
+    windowSize = 2;
+  const MASK = bitMask(windowSize);
+  const buckets = new Array(Number(MASK) + 1).fill(zero);
+  const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+  let sum = zero;
+  for (let i = lastBits; i >= 0; i -= windowSize) {
+    buckets.fill(zero);
+    for (let j = 0; j < slength; j++) {
+      const scalar = scalars[j];
+      const wbits2 = Number(scalar >> BigInt(i) & MASK);
+      buckets[wbits2] = buckets[wbits2].add(points[j]);
+    }
+    let resI = zero;
+    for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+      sumI = sumI.add(buckets[j]);
+      resI = resI.add(sumI);
+    }
+    sum = sum.add(resI);
+    if (i !== 0)
+      for (let j = 0; j < windowSize; j++)
+        sum = sum.double();
+  }
+  return sum;
+}
+function createField(order, field, isLE) {
+  if (field) {
+    if (field.ORDER !== order)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    validateField(field);
+    return field;
+  } else {
+    return Field(order, { isLE });
+  }
+}
+function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (FpFnLE === void 0)
+    FpFnLE = type === "edwards";
+  if (!CURVE || typeof CURVE !== "object")
+    throw new Error(`expected valid ${type} CURVE object`);
+  for (const p of ["p", "n", "h"]) {
+    const val = CURVE[p];
+    if (!(typeof val === "bigint" && val > _0n3))
+      throw new Error(`CURVE.${p} must be positive bigint`);
+  }
+  const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+  const Fn2 = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+  const _b = type === "weierstrass" ? "b" : "d";
+  const params = ["Gx", "Gy", "a", _b];
+  for (const p of params) {
+    if (!Fp2.isValid(CURVE[p]))
+      throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+  }
+  CURVE = Object.freeze(Object.assign({}, CURVE));
+  return { CURVE, Fp: Fp2, Fn: Fn2 };
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/curves/esm/abstract/edwards.js
+var _0n4 = BigInt(0);
+var _1n4 = BigInt(1);
+var _2n2 = BigInt(2);
+var _8n2 = BigInt(8);
+function isEdValidXY(Fp2, CURVE, x, y) {
+  const x2 = Fp2.sqr(x);
+  const y2 = Fp2.sqr(y);
+  const left = Fp2.add(Fp2.mul(CURVE.a, x2), y2);
+  const right = Fp2.add(Fp2.ONE, Fp2.mul(CURVE.d, Fp2.mul(x2, y2)));
+  return Fp2.eql(left, right);
+}
+function edwards(params, extraOpts = {}) {
+  const validated = _createCurveFields("edwards", params, extraOpts, extraOpts.FpFnLE);
+  const { Fp: Fp2, Fn: Fn2 } = validated;
+  let CURVE = validated.CURVE;
+  const { h: cofactor } = CURVE;
+  _validateObject(extraOpts, {}, { uvRatio: "function" });
+  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
+  const modP = (n) => Fp2.create(n);
+  const uvRatio2 = extraOpts.uvRatio || ((u, v) => {
+    try {
+      return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
+    } catch (e) {
+      return { isValid: false, value: _0n4 };
+    }
+  });
+  if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
+    throw new Error("bad curve params: generator point");
+  function acoord(title, n, banZero = false) {
+    const min = banZero ? _1n4 : _0n4;
+    aInRange("coordinate " + title, n, min, MASK);
+    return n;
+  }
+  function aextpoint(other) {
+    if (!(other instanceof Point))
+      throw new Error("ExtendedPoint expected");
+  }
+  const toAffineMemo = memoized((p, iz) => {
+    const { X, Y, Z } = p;
+    const is0 = p.is0();
+    if (iz == null)
+      iz = is0 ? _8n2 : Fp2.inv(Z);
+    const x = modP(X * iz);
+    const y = modP(Y * iz);
+    const zz = Fp2.mul(Z, iz);
+    if (is0)
+      return { x: _0n4, y: _1n4 };
+    if (zz !== _1n4)
+      throw new Error("invZ was invalid");
+    return { x, y };
+  });
+  const assertValidMemo = memoized((p) => {
+    const { a, d } = CURVE;
+    if (p.is0())
+      throw new Error("bad point: ZERO");
+    const { X, Y, Z, T } = p;
+    const X2 = modP(X * X);
+    const Y2 = modP(Y * Y);
+    const Z2 = modP(Z * Z);
+    const Z4 = modP(Z2 * Z2);
+    const aX2 = modP(X2 * a);
+    const left = modP(Z2 * modP(aX2 + Y2));
+    const right = modP(Z4 + modP(d * modP(X2 * Y2)));
+    if (left !== right)
+      throw new Error("bad point: equation left != right (1)");
+    const XY = modP(X * Y);
+    const ZT = modP(Z * T);
+    if (XY !== ZT)
+      throw new Error("bad point: equation left != right (2)");
+    return true;
+  });
+  class Point {
+    constructor(X, Y, Z, T) {
+      this.X = acoord("x", X);
+      this.Y = acoord("y", Y);
+      this.Z = acoord("z", Z, true);
+      this.T = acoord("t", T);
+      Object.freeze(this);
+    }
+    static CURVE() {
+      return CURVE;
+    }
+    static fromAffine(p) {
+      if (p instanceof Point)
+        throw new Error("extended point not allowed");
+      const { x, y } = p || {};
+      acoord("x", x);
+      acoord("y", y);
+      return new Point(x, y, _1n4, modP(x * y));
+    }
+    // Uses algo from RFC8032 5.1.3.
+    static fromBytes(bytes, zip215 = false) {
+      const len = Fp2.BYTES;
+      const { a, d } = CURVE;
+      bytes = copyBytes(_abytes2(bytes, len, "point"));
+      _abool2(zip215, "zip215");
+      const normed = copyBytes(bytes);
+      const lastByte = bytes[len - 1];
+      normed[len - 1] = lastByte & ~128;
+      const y = bytesToNumberLE(normed);
+      const max = zip215 ? MASK : Fp2.ORDER;
+      aInRange("point.y", y, _0n4, max);
+      const y2 = modP(y * y);
+      const u = modP(y2 - _1n4);
+      const v = modP(d * y2 - a);
+      let { isValid, value: x } = uvRatio2(u, v);
+      if (!isValid)
+        throw new Error("bad point: invalid y coordinate");
+      const isXOdd = (x & _1n4) === _1n4;
+      const isLastByteOdd = (lastByte & 128) !== 0;
+      if (!zip215 && x === _0n4 && isLastByteOdd)
+        throw new Error("bad point: x=0 and x_0=1");
+      if (isLastByteOdd !== isXOdd)
+        x = modP(-x);
+      return Point.fromAffine({ x, y });
+    }
+    static fromHex(bytes, zip215 = false) {
+      return Point.fromBytes(ensureBytes("point", bytes), zip215);
+    }
+    get x() {
+      return this.toAffine().x;
+    }
+    get y() {
+      return this.toAffine().y;
+    }
+    precompute(windowSize = 8, isLazy = true) {
+      wnaf.createCache(this, windowSize);
+      if (!isLazy)
+        this.multiply(_2n2);
+      return this;
+    }
+    // Useful in fromAffine() - not for fromBytes(), which always created valid points.
+    assertValidity() {
+      assertValidMemo(this);
+    }
+    // Compare one point to another.
+    equals(other) {
+      aextpoint(other);
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const { X: X2, Y: Y2, Z: Z2 } = other;
+      const X1Z2 = modP(X1 * Z2);
+      const X2Z1 = modP(X2 * Z1);
+      const Y1Z2 = modP(Y1 * Z2);
+      const Y2Z1 = modP(Y2 * Z1);
+      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+    }
+    is0() {
+      return this.equals(Point.ZERO);
+    }
+    negate() {
+      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+    }
+    // Fast algo for doubling Extended Point.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
+    // Cost: 4M + 4S + 1*a + 6add + 1*2.
+    double() {
+      const { a } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1 } = this;
+      const A = modP(X1 * X1);
+      const B = modP(Y1 * Y1);
+      const C = modP(_2n2 * modP(Z1 * Z1));
+      const D = modP(a * A);
+      const x1y1 = X1 + Y1;
+      const E = modP(modP(x1y1 * x1y1) - A - B);
+      const G = D + B;
+      const F = G - C;
+      const H = D - B;
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    // Fast algo for adding 2 Extended Points.
+    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
+    // Cost: 9M + 1*a + 1*d + 7add.
+    add(other) {
+      aextpoint(other);
+      const { a, d } = CURVE;
+      const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
+      const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
+      const A = modP(X1 * X2);
+      const B = modP(Y1 * Y2);
+      const C = modP(T1 * d * T2);
+      const D = modP(Z1 * Z2);
+      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
+      const F = D - C;
+      const G = D + C;
+      const H = modP(B - a * A);
+      const X3 = modP(E * F);
+      const Y3 = modP(G * H);
+      const T3 = modP(E * H);
+      const Z3 = modP(F * G);
+      return new Point(X3, Y3, Z3, T3);
+    }
+    subtract(other) {
+      return this.add(other.negate());
+    }
+    // Constant-time multiplication.
+    multiply(scalar) {
+      if (!Fn2.isValidNot0(scalar))
+        throw new Error("invalid scalar: expected 1 <= sc < curve.n");
+      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
+      return normalizeZ(Point, [p, f])[0];
+    }
+    // Non-constant-time multiplication. Uses double-and-add algorithm.
+    // It's faster, but should only be used when you don't care about
+    // an exposed private key e.g. sig verification.
+    // Does NOT allow scalars higher than CURVE.n.
+    // Accepts optional accumulator to merge with multiply (important for sparse scalars)
+    multiplyUnsafe(scalar, acc = Point.ZERO) {
+      if (!Fn2.isValid(scalar))
+        throw new Error("invalid scalar: expected 0 <= sc < curve.n");
+      if (scalar === _0n4)
+        return Point.ZERO;
+      if (this.is0() || scalar === _1n4)
+        return this;
+      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p), acc);
+    }
+    // Checks if point is of small order.
+    // If you add something to small order point, you will have "dirty"
+    // point with torsion component.
+    // Multiplies point by cofactor and checks if the result is 0.
+    isSmallOrder() {
+      return this.multiplyUnsafe(cofactor).is0();
+    }
+    // Multiplies point by curve order and checks if the result is 0.
+    // Returns `false` is the point is dirty.
+    isTorsionFree() {
+      return wnaf.unsafe(this, CURVE.n).is0();
+    }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    toAffine(invertedZ) {
+      return toAffineMemo(this, invertedZ);
+    }
+    clearCofactor() {
+      if (cofactor === _1n4)
+        return this;
+      return this.multiplyUnsafe(cofactor);
+    }
+    toBytes() {
+      const { x, y } = this.toAffine();
+      const bytes = Fp2.toBytes(y);
+      bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
+      return bytes;
+    }
+    toHex() {
+      return bytesToHex(this.toBytes());
+    }
+    toString() {
+      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
+    }
+    // TODO: remove
+    get ex() {
+      return this.X;
+    }
+    get ey() {
+      return this.Y;
+    }
+    get ez() {
+      return this.Z;
+    }
+    get et() {
+      return this.T;
+    }
+    static normalizeZ(points) {
+      return normalizeZ(Point, points);
+    }
+    static msm(points, scalars) {
+      return pippenger(Point, Fn2, points, scalars);
+    }
+    _setWindowSize(windowSize) {
+      this.precompute(windowSize);
+    }
+    toRawBytes() {
+      return this.toBytes();
+    }
+  }
+  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
+  Point.ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
+  Point.Fp = Fp2;
+  Point.Fn = Fn2;
+  const wnaf = new wNAF(Point, Fn2.BITS);
+  Point.BASE.precompute(8);
+  return Point;
+}
+var PrimeEdwardsPoint = class {
+  constructor(ep) {
+    this.ep = ep;
+  }
+  // Static methods that must be implemented by subclasses
+  static fromBytes(_bytes) {
+    notImplemented();
+  }
+  static fromHex(_hex) {
+    notImplemented();
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  // Common implementations
+  clearCofactor() {
+    return this;
+  }
+  assertValidity() {
+    this.ep.assertValidity();
+  }
+  toAffine(invertedZ) {
+    return this.ep.toAffine(invertedZ);
+  }
+  toHex() {
+    return bytesToHex(this.toBytes());
+  }
+  toString() {
+    return this.toHex();
+  }
+  isTorsionFree() {
+    return true;
+  }
+  isSmallOrder() {
+    return false;
+  }
+  add(other) {
+    this.assertSame(other);
+    return this.init(this.ep.add(other.ep));
+  }
+  subtract(other) {
+    this.assertSame(other);
+    return this.init(this.ep.subtract(other.ep));
+  }
+  multiply(scalar) {
+    return this.init(this.ep.multiply(scalar));
+  }
+  multiplyUnsafe(scalar) {
+    return this.init(this.ep.multiplyUnsafe(scalar));
+  }
+  double() {
+    return this.init(this.ep.double());
+  }
+  negate() {
+    return this.init(this.ep.negate());
+  }
+  precompute(windowSize, isLazy) {
+    return this.init(this.ep.precompute(windowSize, isLazy));
+  }
+  /** @deprecated use `toBytes` */
+  toRawBytes() {
+    return this.toBytes();
+  }
+};
+function eddsa(Point, cHash, eddsaOpts = {}) {
+  if (typeof cHash !== "function")
+    throw new Error('"hash" function param is required');
+  _validateObject(eddsaOpts, {}, {
+    adjustScalarBytes: "function",
+    randomBytes: "function",
+    domain: "function",
+    prehash: "function",
+    mapToCurve: "function"
+  });
+  const { prehash } = eddsaOpts;
+  const { BASE, Fp: Fp2, Fn: Fn2 } = Point;
+  const randomBytes2 = eddsaOpts.randomBytes || randomBytes;
+  const adjustScalarBytes2 = eddsaOpts.adjustScalarBytes || ((bytes) => bytes);
+  const domain = eddsaOpts.domain || ((data, ctx, phflag) => {
+    _abool2(phflag, "phflag");
+    if (ctx.length || phflag)
+      throw new Error("Contexts/pre-hash are not supported");
+    return data;
+  });
+  function modN_LE(hash) {
+    return Fn2.create(bytesToNumberLE(hash));
+  }
+  function getPrivateScalar(key) {
+    const len = lengths.secretKey;
+    key = ensureBytes("private key", key, len);
+    const hashed = ensureBytes("hashed private key", cHash(key), 2 * len);
+    const head = adjustScalarBytes2(hashed.slice(0, len));
+    const prefix = hashed.slice(len, 2 * len);
+    const scalar = modN_LE(head);
+    return { head, prefix, scalar };
+  }
+  function getExtendedPublicKey(secretKey) {
+    const { head, prefix, scalar } = getPrivateScalar(secretKey);
+    const point = BASE.multiply(scalar);
+    const pointBytes = point.toBytes();
+    return { head, prefix, scalar, point, pointBytes };
+  }
+  function getPublicKey(secretKey) {
+    return getExtendedPublicKey(secretKey).pointBytes;
+  }
+  function hashDomainToScalar(context = Uint8Array.of(), ...msgs) {
+    const msg = concatBytes(...msgs);
+    return modN_LE(cHash(domain(msg, ensureBytes("context", context), !!prehash)));
+  }
+  function sign(msg, secretKey, options = {}) {
+    msg = ensureBytes("message", msg);
+    if (prehash)
+      msg = prehash(msg);
+    const { prefix, scalar, pointBytes } = getExtendedPublicKey(secretKey);
+    const r = hashDomainToScalar(options.context, prefix, msg);
+    const R = BASE.multiply(r).toBytes();
+    const k = hashDomainToScalar(options.context, R, pointBytes, msg);
+    const s = Fn2.create(r + k * scalar);
+    if (!Fn2.isValid(s))
+      throw new Error("sign failed: invalid s");
+    const rs = concatBytes(R, Fn2.toBytes(s));
+    return _abytes2(rs, lengths.signature, "result");
+  }
+  const verifyOpts = { zip215: true };
+  function verify(sig, msg, publicKey, options = verifyOpts) {
+    const { context, zip215 } = options;
+    const len = lengths.signature;
+    sig = ensureBytes("signature", sig, len);
+    msg = ensureBytes("message", msg);
+    publicKey = ensureBytes("publicKey", publicKey, lengths.publicKey);
+    if (zip215 !== void 0)
+      _abool2(zip215, "zip215");
+    if (prehash)
+      msg = prehash(msg);
+    const mid = len / 2;
+    const r = sig.subarray(0, mid);
+    const s = bytesToNumberLE(sig.subarray(mid, len));
+    let A, R, SB;
+    try {
+      A = Point.fromBytes(publicKey, zip215);
+      R = Point.fromBytes(r, zip215);
+      SB = BASE.multiplyUnsafe(s);
+    } catch (error) {
+      return false;
+    }
+    if (!zip215 && A.isSmallOrder())
+      return false;
+    const k = hashDomainToScalar(context, R.toBytes(), A.toBytes(), msg);
+    const RkA = R.add(A.multiplyUnsafe(k));
+    return RkA.subtract(SB).clearCofactor().is0();
+  }
+  const _size = Fp2.BYTES;
+  const lengths = {
+    secretKey: _size,
+    publicKey: _size,
+    signature: 2 * _size,
+    seed: _size
+  };
+  function randomSecretKey(seed = randomBytes2(lengths.seed)) {
+    return _abytes2(seed, lengths.seed, "seed");
+  }
+  function keygen(seed) {
+    const secretKey = utils.randomSecretKey(seed);
+    return { secretKey, publicKey: getPublicKey(secretKey) };
+  }
+  function isValidSecretKey(key) {
+    return isBytes(key) && key.length === Fn2.BYTES;
+  }
+  function isValidPublicKey(key, zip215) {
+    try {
+      return !!Point.fromBytes(key, zip215);
+    } catch (error) {
+      return false;
+    }
+  }
+  const utils = {
+    getExtendedPublicKey,
+    randomSecretKey,
+    isValidSecretKey,
+    isValidPublicKey,
+    /**
+     * Converts ed public key to x public key. Uses formula:
+     * - ed25519:
+     *   - `(u, v) = ((1+y)/(1-y), sqrt(-486664)*u/x)`
+     *   - `(x, y) = (sqrt(-486664)*u/v, (u-1)/(u+1))`
+     * - ed448:
+     *   - `(u, v) = ((y-1)/(y+1), sqrt(156324)*u/x)`
+     *   - `(x, y) = (sqrt(156324)*u/v, (1+u)/(1-u))`
+     */
+    toMontgomery(publicKey) {
+      const { y } = Point.fromBytes(publicKey);
+      const size = lengths.publicKey;
+      const is25519 = size === 32;
+      if (!is25519 && size !== 57)
+        throw new Error("only defined for 25519 and 448");
+      const u = is25519 ? Fp2.div(_1n4 + y, _1n4 - y) : Fp2.div(y - _1n4, y + _1n4);
+      return Fp2.toBytes(u);
+    },
+    toMontgomerySecret(secretKey) {
+      const size = lengths.secretKey;
+      _abytes2(secretKey, size);
+      const hashed = cHash(secretKey.subarray(0, size));
+      return adjustScalarBytes2(hashed).subarray(0, size);
+    },
+    /** @deprecated */
+    randomPrivateKey: randomSecretKey,
+    /** @deprecated */
+    precompute(windowSize = 8, point = Point.BASE) {
+      return point.precompute(windowSize, false);
+    }
+  };
+  return Object.freeze({
+    keygen,
+    getPublicKey,
+    sign,
+    verify,
+    utils,
+    Point,
+    lengths
+  });
+}
+function _eddsa_legacy_opts_to_new(c) {
+  const CURVE = {
+    a: c.a,
+    d: c.d,
+    p: c.Fp.ORDER,
+    n: c.n,
+    h: c.h,
+    Gx: c.Gx,
+    Gy: c.Gy
+  };
+  const Fp2 = c.Fp;
+  const Fn2 = Field(CURVE.n, c.nBitLength, true);
+  const curveOpts = { Fp: Fp2, Fn: Fn2, uvRatio: c.uvRatio };
+  const eddsaOpts = {
+    randomBytes: c.randomBytes,
+    adjustScalarBytes: c.adjustScalarBytes,
+    domain: c.domain,
+    prehash: c.prehash,
+    mapToCurve: c.mapToCurve
+  };
+  return { CURVE, curveOpts, hash: c.hash, eddsaOpts };
+}
+function _eddsa_new_output_to_legacy(c, eddsa2) {
+  const Point = eddsa2.Point;
+  const legacy = Object.assign({}, eddsa2, {
+    ExtendedPoint: Point,
+    CURVE: c,
+    nBitLength: Point.Fn.BITS,
+    nByteLength: Point.Fn.BYTES
+  });
+  return legacy;
+}
+function twistedEdwards(c) {
+  const { CURVE, curveOpts, hash, eddsaOpts } = _eddsa_legacy_opts_to_new(c);
+  const Point = edwards(CURVE, curveOpts);
+  const EDDSA = eddsa(Point, hash, eddsaOpts);
+  return _eddsa_new_output_to_legacy(c, EDDSA);
+}
+
+// ../mmt-manifest-verify/node_modules/@noble/curves/esm/ed25519.js
+var _0n5 = /* @__PURE__ */ BigInt(0);
+var _1n5 = BigInt(1);
+var _2n3 = BigInt(2);
+var _3n2 = BigInt(3);
+var _5n2 = BigInt(5);
+var _8n3 = BigInt(8);
+var ed25519_CURVE_p = BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
+var ed25519_CURVE = /* @__PURE__ */ (() => ({
+  p: ed25519_CURVE_p,
+  n: BigInt("0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed"),
+  h: _8n3,
+  a: BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec"),
+  d: BigInt("0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3"),
+  Gx: BigInt("0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51a"),
+  Gy: BigInt("0x6666666666666666666666666666666666666666666666666666666666666658")
+}))();
+function ed25519_pow_2_252_3(x) {
+  const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+  const P = ed25519_CURVE_p;
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, _2n3, P) * b2 % P;
+  const b5 = pow2(b4, _1n5, P) * x % P;
+  const b10 = pow2(b5, _5n2, P) * b5 % P;
+  const b20 = pow2(b10, _10n, P) * b10 % P;
+  const b40 = pow2(b20, _20n, P) * b20 % P;
+  const b80 = pow2(b40, _40n, P) * b40 % P;
+  const b160 = pow2(b80, _80n, P) * b80 % P;
+  const b240 = pow2(b160, _80n, P) * b80 % P;
+  const b250 = pow2(b240, _10n, P) * b10 % P;
+  const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
+  return { pow_p_5_8, b2 };
+}
+function adjustScalarBytes(bytes) {
+  bytes[0] &= 248;
+  bytes[31] &= 127;
+  bytes[31] |= 64;
+  return bytes;
+}
+var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
+function uvRatio(u, v) {
+  const P = ed25519_CURVE_p;
+  const v3 = mod(v * v * v, P);
+  const v7 = mod(v3 * v3 * v, P);
+  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = mod(u * v3 * pow, P);
+  const vx2 = mod(v * x * x, P);
+  const root1 = x;
+  const root2 = mod(x * ED25519_SQRT_M1, P);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === mod(-u, P);
+  const noRoot = vx2 === mod(-u * ED25519_SQRT_M1, P);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if (isNegativeLE(x, P))
+    x = mod(-x, P);
+  return { isValid: useRoot1 || useRoot2, value: x };
+}
+var Fp = /* @__PURE__ */ (() => Field(ed25519_CURVE.p, { isLE: true }))();
+var Fn = /* @__PURE__ */ (() => Field(ed25519_CURVE.n, { isLE: true }))();
+var ed25519Defaults = /* @__PURE__ */ (() => ({
+  ...ed25519_CURVE,
+  Fp,
+  hash: sha512,
+  adjustScalarBytes,
+  // dom2
+  // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
+  // Constant-time, u/√v
+  uvRatio
+}))();
+var ed25519 = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();
+var SQRT_M1 = ED25519_SQRT_M1;
+var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702152701244531502492656460079210482610430750235");
+var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
+var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
+var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
+var invertSqrt = (number) => uvRatio(_1n5, number);
+var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
+var bytes255ToNumberLE = (bytes) => ed25519.Point.Fp.create(bytesToNumberLE(bytes) & MAX_255B);
+function calcElligatorRistrettoMap(r0) {
+  const { d } = ed25519_CURVE;
+  const P = ed25519_CURVE_p;
+  const mod2 = (n) => Fp.create(n);
+  const r = mod2(SQRT_M1 * r0 * r0);
+  const Ns = mod2((r + _1n5) * ONE_MINUS_D_SQ);
+  let c = BigInt(-1);
+  const D = mod2((c - d * r) * mod2(r + d));
+  let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
+  let s_ = mod2(s * r0);
+  if (!isNegativeLE(s_, P))
+    s_ = mod2(-s_);
+  if (!Ns_D_is_sq)
+    s = s_;
+  if (!Ns_D_is_sq)
+    c = r;
+  const Nt = mod2(c * (r - _1n5) * D_MINUS_ONE_SQ - D);
+  const s2 = s * s;
+  const W0 = mod2((s + s) * D);
+  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
+  const W2 = mod2(_1n5 - s2);
+  const W3 = mod2(_1n5 + s2);
+  return new ed25519.Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
+}
+function ristretto255_map(bytes) {
+  abytes(bytes, 64);
+  const r1 = bytes255ToNumberLE(bytes.subarray(0, 32));
+  const R1 = calcElligatorRistrettoMap(r1);
+  const r2 = bytes255ToNumberLE(bytes.subarray(32, 64));
+  const R2 = calcElligatorRistrettoMap(r2);
+  return new _RistrettoPoint(R1.add(R2));
+}
+var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
+  constructor(ep) {
+    super(ep);
+  }
+  static fromAffine(ap) {
+    return new __RistrettoPoint(ed25519.Point.fromAffine(ap));
+  }
+  assertSame(other) {
+    if (!(other instanceof __RistrettoPoint))
+      throw new Error("RistrettoPoint expected");
+  }
+  init(ep) {
+    return new __RistrettoPoint(ep);
+  }
+  /** @deprecated use `import { ristretto255_hasher } from '@noble/curves/ed25519.js';` */
+  static hashToCurve(hex3) {
+    return ristretto255_map(ensureBytes("ristrettoHash", hex3, 64));
+  }
+  static fromBytes(bytes) {
+    abytes(bytes, 32);
+    const { a, d } = ed25519_CURVE;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const s = bytes255ToNumberLE(bytes);
+    if (!equalBytes2(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
+      throw new Error("invalid ristretto255 encoding 1");
+    const s2 = mod2(s * s);
+    const u1 = mod2(_1n5 + a * s2);
+    const u2 = mod2(_1n5 - a * s2);
+    const u1_2 = mod2(u1 * u1);
+    const u2_2 = mod2(u2 * u2);
+    const v = mod2(a * d * u1_2 - u2_2);
+    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
+    const Dx = mod2(I * u2);
+    const Dy = mod2(I * Dx * v);
+    let x = mod2((s + s) * Dx);
+    if (isNegativeLE(x, P))
+      x = mod2(-x);
+    const y = mod2(u1 * Dy);
+    const t = mod2(x * y);
+    if (!isValid || isNegativeLE(t, P) || y === _0n5)
+      throw new Error("invalid ristretto255 encoding 2");
+    return new __RistrettoPoint(new ed25519.Point(x, y, _1n5, t));
+  }
+  /**
+   * Converts ristretto-encoded string to ristretto point.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
+   * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
+   */
+  static fromHex(hex3) {
+    return __RistrettoPoint.fromBytes(ensureBytes("ristrettoHex", hex3, 32));
+  }
+  static msm(points, scalars) {
+    return pippenger(__RistrettoPoint, ed25519.Point.Fn, points, scalars);
+  }
+  /**
+   * Encodes ristretto point to Uint8Array.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
+   */
+  toBytes() {
+    let { X, Y, Z, T } = this.ep;
+    const P = ed25519_CURVE_p;
+    const mod2 = (n) => Fp.create(n);
+    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
+    const u2 = mod2(X * Y);
+    const u2sq = mod2(u2 * u2);
+    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
+    const D1 = mod2(invsqrt * u1);
+    const D2 = mod2(invsqrt * u2);
+    const zInv = mod2(D1 * D2 * T);
+    let D;
+    if (isNegativeLE(T * zInv, P)) {
+      let _x = mod2(Y * SQRT_M1);
+      let _y = mod2(X * SQRT_M1);
+      X = _x;
+      Y = _y;
+      D = mod2(D1 * INVSQRT_A_MINUS_D);
+    } else {
+      D = D2;
+    }
+    if (isNegativeLE(X * zInv, P))
+      Y = mod2(-Y);
+    let s = mod2((Z - Y) * D);
+    if (isNegativeLE(s, P))
+      s = mod2(-s);
+    return Fp.toBytes(s);
+  }
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
+  equals(other) {
+    this.assertSame(other);
+    const { X: X1, Y: Y1 } = this.ep;
+    const { X: X2, Y: Y2 } = other.ep;
+    const mod2 = (n) => Fp.create(n);
+    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
+    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
+    return one || two;
+  }
+  is0() {
+    return this.equals(__RistrettoPoint.ZERO);
+  }
+};
+_RistrettoPoint.BASE = /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.BASE))();
+_RistrettoPoint.ZERO = /* @__PURE__ */ (() => new _RistrettoPoint(ed25519.Point.ZERO))();
+_RistrettoPoint.Fp = /* @__PURE__ */ (() => Fp)();
+_RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
+
+// ../mmt-manifest-verify/dist/bc-provenance-v2-receiver.js
+var BCPV2_LEAD_BOUND_MS = 5e3;
+var REPLAY_WINDOW = 64n;
+var BUCKET_DEPTH = 64;
+var BUCKET_RATE_PER_MS = 1;
+var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+function sameBytes(a, b) {
+  if (a.byteLength !== b.byteLength)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.byteLength; i++)
+    diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+var BcProvenanceV2Receiver = class {
+  maxAuthDelayMs;
+  manifestTimerMs;
+  widenMs;
+  /** Datagrams that left a hold queue at expiry, per path: the loss signal for failover. */
+  expired = { multicast: 0, unicast: 0 };
+  /**
+   * Unicast repair (Section 7.2.7 step 2): on a receiver that can request it, how
+   * long ago (ms) the first packet admitted into the oldest open block with an FEC
+   * deadline was admitted; undefined with none open. A pending entry still live
+   * then is kept instead of expiring, and is released with the block, under the
+   * open-block bound of [MOQ-FEC] Section 9.
+   */
+  keepPendingAgeMs = null;
+  cfg;
+  now;
+  verifySig;
+  accepted;
+  queueLimit;
+  current = null;
+  previous = null;
+  graceStart = {};
+  hashAlg = null;
+  verified = /* @__PURE__ */ new Map();
+  highest = { multicast: /* @__PURE__ */ new Map(), mirror: /* @__PURE__ */ new Map() };
+  closedAt = /* @__PURE__ */ new Map();
+  lead = null;
+  pending = /* @__PURE__ */ new Map();
+  admittedUntil = /* @__PURE__ */ new Map();
+  hold = { multicast: [], unicast: [] };
+  holdBytes = { multicast: 0, unicast: 0 };
+  order = 0;
+  buckets;
+  constructor(cfg) {
+    this.maxAuthDelayMs = cfg.maxAuthDelayMs ?? 200;
+    this.manifestTimerMs = cfg.manifestTimerMs ?? 20;
+    if (!(this.maxAuthDelayMs >= 50 && this.maxAuthDelayMs <= 1e3) || !(this.manifestTimerMs >= 1)) {
+      throw new Error("BCPV2 endpoint ignored: maxAuthDelayMs or manifestTimerMs out of range");
+    }
+    if (!(cfg.bandwidth > 0))
+      throw new Error("BCPV2 endpoint ignored: protected endpoint without bandwidth");
+    const kids = new Set(cfg.keys.map((k) => k.kid));
+    const firsts = new Set(cfg.keys.map((k) => k.firstEpoch));
+    if (cfg.keys.length < 1 || kids.size !== cfg.keys.length || firsts.size !== cfg.keys.length) {
+      throw new Error("BCPV2 key set invalid: no keys, or a repeated kid or firstEpoch");
+    }
+    this.cfg = cfg;
+    this.widenMs = Math.min(Math.max(cfg.widenMs ?? 0, 0), BCPV2_LEAD_BOUND_MS);
+    this.now = cfg.now ?? Date.now;
+    this.verifySig = cfg.verifySignature ?? ((pk, msg, sig) => {
+      try {
+        return ed25519.verify(sig, msg, pk, { zip215: false });
+      } catch {
+        return false;
+      }
+    });
+    this.accepted = cfg.acceptedHashAlgs ?? [BCPV2_HASH_ALG_SHA256];
+    const bandwidth = Math.min(cfg.bandwidth, 1e10);
+    this.queueLimit = {
+      multicast: this.maxAuthDelayMs * bandwidth / 8e3,
+      unicast: (this.maxAuthDelayMs + this.widenMs) * bandwidth / 8e3
+    };
+    const t = this.now();
+    this.buckets = {
+      multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
+      mirror: { tokens: BUCKET_DEPTH, last: t, dropped: 0 }
+    };
+  }
+  get grace() {
+    return this.maxAuthDelayMs + 2 * this.manifestTimerMs;
+  }
+  /** The mirror's lead in force: 0 without a manifest track, the bound until one is measured. */
+  get leadMs() {
+    if (!this.cfg.applyLead)
+      return 0;
+    return this.lead ?? BCPV2_LEAD_BOUND_MS;
+  }
+  /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+  onRecord(bytes, path) {
+    const now = this.now();
+    this.expire(now);
+    const drop = (verdict) => ({ verdict, admitted: [] });
+    const len = bytes.byteLength;
+    if (len < BCPV2_MIN_RECORD_LENGTH || len > BCPV2_MAX_RECORD_LENGTH || (len - 132) % 32 !== 0)
+      return drop("length");
+    const view2 = new DataView(bytes.buffer, bytes.byteOffset, len);
+    if (view2.getUint32(0) !== 1296583986)
+      return drop("magic");
+    const kid = view2.getUint32(4);
+    const epoch = view2.getUint32(8);
+    const mseq = view2.getBigUint64(12);
+    const count = view2.getUint16(28);
+    const hashAlg = bytes[30];
+    const sent = view2.getUint32(32);
+    const key = this.cfg.keys.find((k) => k.kid === kid);
+    if (!key)
+      return drop("kid");
+    const next = Math.min(...this.cfg.keys.map((k) => k.firstEpoch).filter((f) => f > key.firstEpoch), Infinity);
+    if (epoch < key.firstEpoch || epoch >= next)
+      return drop("epoch");
+    const id = `${kid}:${epoch}:${mseq}`;
+    const seen = this.verified.get(id);
+    if (seen) {
+      const admitted2 = hex(sha2562(bytes)) === seen.digest ? this.arrival(seen, path, now) : [];
+      return { verdict: "duplicate", admitted: admitted2 };
+    }
+    const ke = `${kid}:${epoch}`;
+    if (this.current === null) {
+      if (epoch < this.cfg.minEpoch || epoch < (this.cfg.pinnedEpochFloor?.get(kid) ?? 0))
+        return drop("epoch");
+    } else if (epoch < this.current.epoch && !this.previousAdmitted(epoch, path, now)) {
+      return drop("epoch");
+    }
+    const floor = this.floor(ke, path);
+    if (floor !== void 0 && mseq <= floor - REPLAY_WINDOW)
+      return drop("mseq");
+    const closed = this.closedAt.get(ke);
+    if (closed !== void 0 && mseq > closed)
+      return drop("closed");
+    if (this.cfg.checkFreshness !== false) {
+      const behind = 7e3 + this.maxAuthDelayMs + (path === "mirror" ? this.widenMs : 0);
+      if (sent * 1e3 < now - behind || sent * 1e3 > now + 6e3)
+        return drop("sent");
+    }
+    if (count !== (len - 132) / 32)
+      return drop("count");
+    if (!this.accepted.includes(hashAlg) || this.hashAlg !== null && hashAlg !== this.hashAlg)
+      return drop("hash_alg");
+    if (this.cfg.catalogCtx && !sameBytes(bytes.subarray(36, 68), this.cfg.catalogCtx))
+      return drop("ctx");
+    if (!this.take(path, now))
+      return drop("budget");
+    const record = decodeBcProvenanceV2Record(bytes);
+    if (!this.verifySig(key.publicKey, bcProvenanceV2SignedMessage(record, this.cfg.endpoint), record.signature)) {
+      return drop("signature");
+    }
+    if (this.current === null || epoch > this.current.epoch) {
+      if (this.current !== null) {
+        this.previous = { epoch: this.current.epoch, deadline: now + BCPV2_LEAD_BOUND_MS + this.grace };
+      }
+      this.current = { epoch, since: now };
+      this.graceStart = { [path]: now };
+      if (this.hashAlg === null) {
+        this.hashAlg = hashAlg;
+        for (const queue of Object.values(this.hold)) {
+          for (const held of queue)
+            held.digest ??= this.digest(held.datagram);
+        }
+      }
+    } else if (epoch === this.current.epoch) {
+      this.graceStart[path] ??= now;
+    }
+    const entry = {
+      kid,
+      epoch,
+      mseq,
+      path,
+      arrival: now,
+      sent,
+      digest: hex(sha2562(bytes)),
+      pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+      awaitingMulticast: path === "mirror"
+    };
+    this.verified.set(id, entry);
+    this.raise(ke, path, mseq);
+    if (record.flags & 1)
+      this.closedAt.set(ke, mseq);
+    const widen = path === "mirror" ? this.cfg.applyLead ? this.leadMs : this.widenMs : 0;
+    const admitted = [];
+    for (const pair of entry.pairs)
+      this.handlePair(pair, now, now + this.grace + widen, now, admitted);
+    this.dropAdmittedHeld();
+    this.prune(now);
+    return { verdict: "verified", admitted };
+  }
+  /** Step 2: a data datagram on `port` (or a packet of a listed track over MoQ unicast). */
+  onDatagram(datagram, path) {
+    const now = this.now();
+    this.expire(now);
+    if (this.hashAlg !== null) {
+      const d = this.digest(datagram);
+      if (this.consumePending(d, now))
+        return { verdict: "admitted", admitted: [datagram] };
+      if (this.admittedUntil.has(d))
+        return { verdict: "duplicate", admitted: [] };
+      return this.enqueue({ digest: d, datagram, expiry: 0, order: 0 }, path, now);
+    }
+    return this.enqueue({ datagram, expiry: 0, order: 0 }, path, now);
+  }
+  /**
+   * A source packet recovered by FEC decode, its base SS_ID (SS_Start + ESI)
+   * appended: admitted only on a pending entry it consumes, never held. One no
+   * verified record lists, or a copy of an admitted packet, is dropped.
+   */
+  admitRecovered(datagram) {
+    const now = this.now();
+    this.expire(now);
+    return this.hashAlg !== null && this.consumePending(this.digest(datagram), now);
+  }
+  /**
+   * Discard the per-flow state on a `streamId` change or a key-set change that fails the
+   * flow's current (kid, epoch): budgets and hold queues survive, held digests are cleared.
+   */
+  resetGeneration() {
+    this.current = null;
+    this.previous = null;
+    this.graceStart = {};
+    this.hashAlg = null;
+    this.verified.clear();
+    this.highest = { multicast: /* @__PURE__ */ new Map(), mirror: /* @__PURE__ */ new Map() };
+    this.closedAt.clear();
+    this.lead = null;
+    this.pending.clear();
+    this.admittedUntil.clear();
+    for (const queue of Object.values(this.hold))
+      for (const held of queue)
+        held.digest = void 0;
+  }
+  /** The receiver ceased to hold the endpoint: drop everything; no drop here is an expiry. */
+  release() {
+    this.resetGeneration();
+    this.hold = { multicast: [], unicast: [] };
+    this.holdBytes = { multicast: 0, unicast: 0 };
+  }
+  digest(datagram) {
+    return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
+  }
+  /** Consume the lowest-seq pending entry for `digest`, admitting it. */
+  consumePending(digest, now) {
+    const list = this.pending.get(digest);
+    if (!list?.length)
+      return false;
+    list.sort((a, b) => a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0);
+    const hit = list.shift();
+    if (list.length === 0)
+      this.pending.delete(digest);
+    hit.pair.pending = void 0;
+    hit.pair.admitted = true;
+    this.admittedUntil.set(digest, now + this.maxAuthDelayMs + this.leadMs);
+    return true;
+  }
+  enqueue(held, path, now) {
+    if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+      return { verdict: "overflow", admitted: [] };
+    }
+    held.expiry = now + this.maxAuthDelayMs + (path === "unicast" ? this.widenMs : 0);
+    held.order = this.order++;
+    this.hold[path].push(held);
+    this.holdBytes[path] += held.datagram.byteLength;
+    return { verdict: "held", admitted: [] };
+  }
+  /** Remove and return the oldest held datagram with `digest`, across both queues. */
+  takeHeld(digest) {
+    let best;
+    for (const path of ["multicast", "unicast"]) {
+      const index = this.hold[path].findIndex((h) => h.digest === digest);
+      if (index >= 0 && (!best || this.hold[path][index].order < best.order)) {
+        best = { path, index, order: this.hold[path][index].order };
+      }
+    }
+    if (!best)
+      return void 0;
+    const [held] = this.hold[best.path].splice(best.index, 1);
+    this.holdBytes[best.path] -= held.datagram.byteLength;
+    return held.datagram;
+  }
+  dropAdmittedHeld() {
+    for (const path of ["multicast", "unicast"]) {
+      this.hold[path] = this.hold[path].filter((h) => {
+        const keep = h.digest === void 0 || !this.admittedUntil.has(h.digest);
+        if (!keep)
+          this.holdBytes[path] -= h.datagram.byteLength;
+        return keep;
+      });
+    }
+  }
+  /** Step 1 pair handling: admit a held copy, or insert a pending entry. */
+  handlePair(pair, now, expiry, inserted, out) {
+    const datagram = this.takeHeld(pair.digest);
+    if (datagram) {
+      pair.admitted = true;
+      this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + this.leadMs);
+      out.push(datagram);
+      return;
+    }
+    const entry = { pair, inserted, expiry };
+    pair.pending = entry;
+    const list = this.pending.get(pair.digest);
+    if (list)
+      list.push(entry);
+    else
+      this.pending.set(pair.digest, [entry]);
+  }
+  /** A byte-identical copy dropped by the already-verified lookup. */
+  arrival(seen, path, now) {
+    const ke = `${seen.kid}:${seen.epoch}`;
+    this.raise(ke, path, seen.mseq);
+    if (this.current && seen.epoch === this.current.epoch)
+      this.graceStart[path] ??= now;
+    if (path !== "multicast" || !seen.awaitingMulticast)
+      return [];
+    seen.awaitingMulticast = false;
+    if (!this.cfg.applyLead)
+      return [];
+    const t = this.manifestTimerMs;
+    const interval = Math.min(Math.ceil((now - seen.arrival) / t) * t, BCPV2_LEAD_BOUND_MS);
+    if (this.lead === null) {
+      this.lead = interval;
+      return [];
+    }
+    if (interval <= this.lead)
+      return [];
+    this.lead = interval;
+    const out = [];
+    const records = [seen, ...[...this.verified.values()].filter((v) => v.awaitingMulticast && v.arrival >= now - interval)];
+    for (const v of records) {
+      for (const pair of v.pairs) {
+        if (pair.admitted) {
+          this.admittedUntil.set(pair.digest, now + this.maxAuthDelayMs + interval);
+        } else if (pair.pending) {
+          pair.pending.expiry = pair.pending.inserted + this.grace + interval;
+        } else {
+          this.handlePair(pair, now, now + this.grace + interval, now, out);
+        }
+      }
+    }
+    this.dropAdmittedHeld();
+    return out;
+  }
+  previousAdmitted(epoch, path, now) {
+    if (!this.previous || epoch !== this.previous.epoch)
+      return false;
+    const m = this.graceStart.multicast;
+    if (path === "multicast")
+      return m === void 0 || now <= m + this.grace;
+    const starts = [m, this.graceStart.mirror].filter((s) => s !== void 0);
+    return starts.length > 0 && now <= Math.min(...starts) + this.grace;
+  }
+  /** The replay floor this record meets: its path's, or the higher of both from the mirror. */
+  floor(ke, path) {
+    const m = this.highest.multicast.get(ke);
+    if (path === "multicast")
+      return m;
+    const r = this.highest.mirror.get(ke);
+    if (m === void 0)
+      return r;
+    return r === void 0 || m > r ? m : r;
+  }
+  raise(ke, path, mseq) {
+    const h = this.highest[path].get(ke);
+    if (h === void 0 || mseq > h)
+      this.highest[path].set(ke, mseq);
+  }
+  take(path, now) {
+    const b = this.buckets[path];
+    b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+    b.last = now;
+    if (b.tokens < 1) {
+      b.dropped++;
+      return false;
+    }
+    b.tokens -= 1;
+    return true;
+  }
+  expire(now) {
+    for (const path of ["multicast", "unicast"]) {
+      this.hold[path] = this.hold[path].filter((h) => {
+        if (h.expiry > now)
+          return true;
+        this.holdBytes[path] -= h.datagram.byteLength;
+        this.expired[path]++;
+        return false;
+      });
+    }
+    let keepFrom = null;
+    for (const [d, list] of this.pending) {
+      const live = list.filter((p) => {
+        if (p.expiry > now)
+          return true;
+        if (keepFrom === null) {
+          const age = this.keepPendingAgeMs?.();
+          keepFrom = age === void 0 ? void 0 : now - age;
+        }
+        if (keepFrom !== void 0 && keepFrom !== null && p.expiry > keepFrom)
+          return true;
+        p.pair.pending = void 0;
+        return false;
+      });
+      if (live.length)
+        this.pending.set(d, live);
+      else
+        this.pending.delete(d);
+    }
+    for (const [d, until] of this.admittedUntil)
+      if (until <= now)
+        this.admittedUntil.delete(d);
+    if (this.previous && now > this.previous.deadline)
+      this.previous = null;
+  }
+  /**
+   * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
+   * while the freshness check would still pass its copy on `manifestPort`.
+   * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
+   */
+  prune(now) {
+    const retention = 7e3 + this.maxAuthDelayMs;
+    for (const [id, v] of this.verified) {
+      const h = this.highest[v.path].get(`${v.kid}:${v.epoch}`);
+      const aboveFloor = h === void 0 || v.mseq > h - REPLAY_WINDOW;
+      const fresh = this.cfg.checkFreshness === false ? v.arrival + retention >= now : v.sent * 1e3 + retention >= now;
+      const current = this.current && (v.epoch === this.current.epoch || v.epoch === this.previous?.epoch);
+      if (current && (aboveFloor || v.path === "mirror" && fresh))
+        continue;
+      this.verified.delete(id);
+    }
+  }
+};
+
 // src/catalog-network-source.ts
 function normalizePort(value) {
   const n = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
@@ -23602,11 +26458,12 @@ function resolveCatalogTrackFec(catalog, tracks) {
 }
 
 // src/multicast-manager.ts
-function freezeIngress(tracks) {
+function freezeIngress(tracks, flow) {
   return Object.freeze({
     tracks: Object.freeze(
       [...tracks].map(({ name, packetId }) => Object.freeze({ name, packetId }))
-    )
+    ),
+    ...flow === void 0 ? {} : { flow }
   });
 }
 function sameIdSet(a, b) {
@@ -23636,6 +26493,7 @@ function newBlockPolicyStats(packetId, catalogTrackName, epoch) {
     repairsSkippedRttExceedsBudget: 0,
     repairsSkippedPresentationDelayUnavailable: 0,
     repairsSkippedRangeNoAnchor: 0,
+    repairsSkippedGroupCannotComplete: 0,
     lastRepairSkip: null,
     keyframeRepairFetchesSent: 0,
     rangeRepairFetchesSent: 0,
@@ -23720,7 +26578,9 @@ var REPAIR_PRIORITY_REASONS = /* @__PURE__ */ new Set([
 var REPAIR_SKIP_REASONS = /* @__PURE__ */ new Set([
   "rtt-unmeasured",
   "rtt-exceeds-budget",
-  "presentation-delay-unavailable"
+  "presentation-delay-unavailable",
+  "range-no-anchor",
+  "group-cannot-complete"
 ]);
 var REPAIR_DEADLINE_BOUNDS = /* @__PURE__ */ new Set(["wait", "presentation", "keyframe", "retention"]);
 var GAP_REASONS = {
@@ -23938,7 +26798,7 @@ function altGroupKey(track) {
 }
 function repairTrackNamesBySource(tracks) {
   const bySource = /* @__PURE__ */ new Map();
-  const add = (source, repair) => {
+  const add2 = (source, repair) => {
     if (!source || !repair) return;
     const names = bySource.get(source) ?? /* @__PURE__ */ new Set();
     names.add(repair);
@@ -23946,9 +26806,9 @@ function repairTrackNamesBySource(tracks) {
   };
   for (const track of tracks) {
     const repairTrack = typeof track.fec === "object" && track.fec !== null ? track.fec.repairTrack : void 0;
-    if (typeof repairTrack === "string") add(track.name, repairTrack);
+    if (typeof repairTrack === "string") add2(track.name, repairTrack);
     if (track.packaging === "fec-repair" && Array.isArray(track.depends) && track.depends.length === 1) {
-      add(track.depends[0], track.name);
+      add2(track.depends[0], track.name);
     }
   }
   return bySource;
@@ -23958,6 +26818,10 @@ var MulticastManager = class {
   #router;
   #hostMfuTimeoutMs;
   #transport;
+  /** The protected flow of the current join and its manifestPort subscription. */
+  #provenanceJoin = null;
+  #onFailback = null;
+  #failbackHooked = false;
   /** Live joinRepairEndpoints() releases → the repair owners they registered,
    *  re-applied after configureMultiTrack() clears catalog-derived owners. */
   #repairReleases = /* @__PURE__ */ new Map();
@@ -24010,10 +26874,6 @@ var MulticastManager = class {
       reassemblyPolicy: options?.reassemblyPolicy,
       reassembler: options?.reassembler,
       maxBufferedMfus: options?.maxBufferedMfus,
-      manifestVerifier: options?.manifestVerifier,
-      manifestVerifierOwnership: options?.manifestVerifierOwnership,
-      resolveManifestIdentity: options?.resolveManifestIdentity,
-      resolveManifestIdentityForRoute: options?.resolveManifestIdentityForRoute,
       // The router has reset its own state for the stream; reset the rest.
       onPublisherRestart: (packetId, catalogTrackName) => {
         this.#resetStreamOutsideRouter(packetId, catalogTrackName);
@@ -24060,7 +26920,7 @@ var MulticastManager = class {
     });
     this.#hostMfuTimeoutMs = this.#router.reassembler.timeoutMs;
     this.#transport = new MulticastTransport((packet, ingress) => {
-      this.#router.feedPacket(packet, "multicast", void 0, ingress);
+      this.#router.feedPacket(packet, "multicast", ingress);
     });
     this.#transport.onDelivery((delivery) => {
       this.#fec.setMulticastSymbolDelivery(delivery);
@@ -24153,6 +27013,10 @@ var MulticastManager = class {
   get router() {
     return this.#router;
   }
+  /** Repair FETCH wiring (wireRepairFetch): this manager can request unicast repair. */
+  setUnicastRepair(enabled) {
+    this.#router.setUnicastRepair(enabled);
+  }
   get transport() {
     return this.#transport;
   }
@@ -24563,8 +27427,35 @@ var MulticastManager = class {
   onTakeover(cb) {
     this.#transport.onTakeover(cb);
   }
+  /** Failback un-protects the join's flow (7.2.7 failover), so the fallback's MoQ packets are read. */
   onFailback(cb) {
-    this.#transport.onFailback(cb);
+    this.#onFailback = cb;
+    this.#hookFailback();
+  }
+  /**
+   * Install the manager's own failback listener on the media transport, which
+   * arms its silence watchdog: a protected join un-protects on failover even
+   * when no player listens, else its tracks' MoQ copies stay dropped.
+   */
+  #hookFailback() {
+    if (this.#failbackHooked) return;
+    this.#failbackHooked = true;
+    this.#transport.onFailback((reason) => {
+      const joined = this.#provenanceJoin;
+      if (joined !== null) this.#router.unprotectProvenanceFlow(joined.flow);
+      this.#onFailback?.(reason);
+    });
+  }
+  /**
+   * A protected join's handoff (draft -01 7.2.7), before `onTakeover`: its
+   * first admitted datagram. MoQ copies of the flow's tracks the router still
+   * held unadmitted are discarded, and later ones are dropped. Fires again
+   * after a failback once multicast resumes.
+   */
+  onProtected(cb) {
+    this.#router.onProvenanceFlowProtected(cb && ((flow) => {
+      if (this.#provenanceJoin?.flow === flow) cb();
+    }));
   }
   /** See MulticastTransport.onDataPlaneLive: the join's first accepted packet. */
   onDataPlaneLive(cb) {
@@ -24580,6 +27471,12 @@ var MulticastManager = class {
     return MulticastTransport.isAvailable();
   }
   async join(config) {
+    const provenanceFlow = config.provenance?.flow;
+    if (provenanceFlow !== void 0 && ((config.sourceAddress ?? config.senderAddress) !== provenanceFlow.source || config.groupAddress !== provenanceFlow.groupAddress || config.port !== provenanceFlow.port)) {
+      throw new RangeError(
+        "[MulticastManager] join: provenance flow (S, G, port) must match sourceAddress ?? senderAddress, groupAddress and port"
+      );
+    }
     const staged = this.#renditionSwitch;
     if (staged !== null) this.#endRenditionSwitch(staged, { reason: "superseded" }, false);
     this.configureFec(config);
@@ -24587,16 +27484,21 @@ var MulticastManager = class {
     const selectedPacketIds = config.packetIds?.length ? new Set(config.packetIds) : null;
     const catalogTracks = config.tracks?.filter(({ packetId }) => selectedPacketIds === null || selectedPacketIds.has(packetId));
     const ingressTracks = catalogTracks ? catalogTracks : selectedPacketIds === null ? void 0 : [...selectedPacketIds].map((packetId) => ({ name: "", packetId }));
-    const ingress = ingressTracks === void 0 ? void 0 : {
+    this.#releaseProvenanceJoin();
+    const provenance = config.provenance;
+    const protectedTracks = ingressTracks ?? provenance?.flow.tracks;
+    const ingress = protectedTracks === void 0 ? void 0 : {
       tracks: Object.freeze(
-        ingressTracks.map(
+        protectedTracks.map(
           ({ name, packetId }) => Object.freeze({ name, packetId })
         )
-      )
+      ),
+      ...provenance === void 0 ? {} : { flow: multicastProvenanceFlowKey(provenance.flow) }
     };
     const amtRelay = config.amtRelay;
     const transportConfig = {
       sourceAddress: config.sourceAddress,
+      senderAddress: config.senderAddress,
       groupAddress: config.groupAddress,
       port: config.port,
       mode: config.mode,
@@ -24623,7 +27525,61 @@ var MulticastManager = class {
       packetIds: config.packetIds,
       tracks: catalogTracks?.map(({ name, packetId }) => ({ name, packetId }))
     };
-    return ingress === void 0 ? this.#transport.join(transportConfig) : this.#transport.join(transportConfig, ingress);
+    if (provenance !== void 0) this.#joinProvenance(provenance, ingress, transportConfig);
+    const protectedJoin = this.#provenanceJoin;
+    const joined = await (ingress === void 0 ? this.#transport.join(transportConfig) : this.#transport.join(transportConfig, ingress));
+    if (!joined && protectedJoin !== null && this.#provenanceJoin === protectedJoin) this.#releaseProvenanceJoin();
+    return joined;
+  }
+  /**
+   * Register the protected flow and subscribe its `manifestPort` on the same
+   * `(S, G)` with its own listener (draft -01 7.2.7), so records reach the
+   * flow's receiver and media datagrams are held until one admits them. A
+   * manifest subscription that fails to join admits nothing: the media is
+   * held and expires, never read unauthenticated.
+   */
+  #joinProvenance(provenance, ingress, media) {
+    const { flow, auth } = provenance;
+    const receiver = new BcProvenanceV2Receiver({
+      ...provenance.receiver,
+      // The caller's ctx when it passes one, else the catalog's: an explicit
+      // `catalogCtx: undefined` must not switch off the 7.2.4 ctx check.
+      catalogCtx: provenance.receiver?.catalogCtx ?? flow.ctx,
+      endpoint: {
+        sourceAddress: flow.source,
+        groupAddress: flow.groupAddress,
+        port: flow.port,
+        manifestPort: flow.manifestPort,
+        streamId: flow.streamId
+      },
+      keys: auth.keys,
+      minEpoch: auth.minEpoch,
+      bandwidth: flow.bandwidth,
+      maxAuthDelayMs: flow.maxAuthDelayMs,
+      manifestTimerMs: flow.manifestTimerMs
+    });
+    this.#router.registerProvenanceFlow(ingress, receiver);
+    this.#hookFailback();
+    const manifest = new MulticastTransport((record) => {
+      if (this.#provenanceJoin?.manifest === manifest) {
+        this.#router.feedProvenanceRecord(ingress.flow, record, "multicast");
+      }
+    });
+    this.#provenanceJoin = { flow: ingress.flow, manifest };
+    const { packetIds: _packetIds, tracks: _tracks, ...path } = media;
+    void manifest.join({ ...path, port: flow.manifestPort }).then((joined) => {
+      if (!joined && this.#provenanceJoin?.manifest === manifest) {
+        console.warn(`[MulticastManager] manifestPort ${flow.groupAddress}:${flow.manifestPort} not joined`, manifest.lastJoinOutcome);
+      }
+    });
+  }
+  /** Un-protect: drop the flow's hold queues (no expiry counted) and leave its manifestPort. */
+  #releaseProvenanceJoin() {
+    const joined = this.#provenanceJoin;
+    if (joined === null) return;
+    this.#provenanceJoin = null;
+    joined.manifest.dispose();
+    this.#router.releaseProvenanceFlow(joined.flow);
   }
   /**
    * Join the selected rung's dedicated repair groups beside the media join
@@ -24653,10 +27609,11 @@ var MulticastManager = class {
     this.#applyRepairOwners(repairOwners);
     for (const endpoint of endpoints) {
       const ingress = {
-        tracks: Object.freeze(endpoint.tracks.map(({ name, packetId }) => Object.freeze({ name, packetId })))
+        tracks: Object.freeze(endpoint.tracks.map(({ name, packetId }) => Object.freeze({ name, packetId }))),
+        ...endpoint.flow === void 0 ? {} : { flow: endpoint.flow }
       };
       const onPacket = (packet) => {
-        if (!released) this.#router.feedPacket(packet, "multicast", void 0, ingress);
+        if (!released) this.#router.feedPacket(packet, "multicast", ingress);
       };
       const fail = (error) => console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
       if (typeof provider === "function") {
@@ -24794,7 +27751,7 @@ var MulticastManager = class {
     for (const track of [...live.tracks, ...request.tracks]) {
       stagedTracks.set(`${track.packetId}\0${track.name}`, track);
     }
-    const stagedIngress = freezeIngress(stagedTracks.values());
+    const stagedIngress = freezeIngress(stagedTracks.values(), live.flow);
     const stagedPacketIds = committedPacketIds === void 0 || livePacketIds === null ? null : /* @__PURE__ */ new Set([...livePacketIds, ...committedPacketIds]);
     const widened = stagedPacketIds !== null && !sameIdSet(stagedPacketIds, livePacketIds);
     const active = {
@@ -24805,7 +27762,7 @@ var MulticastManager = class {
       liveIngress: live,
       livePacketIds,
       widened,
-      committedIngress: freezeIngress(request.tracks),
+      committedIngress: freezeIngress(request.tracks, live.flow),
       committedPacketIds,
       router: null,
       state: "staged"
@@ -24818,7 +27775,7 @@ var MulticastManager = class {
     let widening;
     try {
       if (widened) widening = this.#transport.setPacketIds([...stagedPacketIds]);
-      this.#transport.setContext(stagedIngress);
+      this.#setSwitchIngress(stagedIngress);
     } catch (error) {
       active.router.cancel();
       throw error;
@@ -24839,6 +27796,11 @@ var MulticastManager = class {
       }
     };
   }
+  /** Route a switch's ingress and keep a protected flow's registration in step (7.2.7). */
+  #setSwitchIngress(ingress) {
+    this.#transport.setContext(ingress);
+    if (ingress.flow !== void 0) this.#router.updateProvenanceFlowIngress({ ...ingress, flow: ingress.flow });
+  }
   /** The router committed the staged switch (it already retired `from`). */
   #commitRenditionSwitch(active, commit) {
     if (this.#renditionSwitch !== active) return;
@@ -24846,7 +27808,7 @@ var MulticastManager = class {
     active.state = "committed";
     active.router = null;
     if (this.#transport.joined) {
-      this.#transport.setContext(active.committedIngress);
+      this.#setSwitchIngress(active.committedIngress);
       if (active.committedPacketIds !== void 0) {
         this.#transport.setPacketIds(active.committedPacketIds).catch((error) => {
           console.warn(
@@ -24882,7 +27844,7 @@ var MulticastManager = class {
     active.router = null;
     if (restore) {
       if (this.#transport.joined) {
-        this.#transport.setContext(active.liveIngress);
+        this.#setSwitchIngress(active.liveIngress);
         if (active.widened && active.livePacketIds !== null) {
           this.#transport.setPacketIds([...active.livePacketIds]).catch((error) => {
             console.warn(
@@ -25268,6 +28230,7 @@ var MulticastManager = class {
     if (reason === "rtt-unmeasured") stats.repairsSkippedRttUnmeasured++;
     else if (reason === "rtt-exceeds-budget") stats.repairsSkippedRttExceedsBudget++;
     else if (reason === "range-no-anchor") stats.repairsSkippedRangeNoAnchor++;
+    else if (reason === "group-cannot-complete") stats.repairsSkippedGroupCannotComplete++;
     else stats.repairsSkippedPresentationDelayUnavailable++;
     stats.lastRepairSkip = {
       reason,
@@ -25463,11 +28426,15 @@ var MulticastManager = class {
     this.#trackResetObservers.clear();
     this.#repairLifecycleObservers.clear();
     this.#transport.dispose();
+    this.#releaseProvenanceJoin();
     for (const release of [...this.#repairReleases.keys()]) release();
     this.#router.dispose();
     this.#fec.dispose();
   }
 };
+function multicastProvenanceFlowKey(flow) {
+  return JSON.stringify([flow.source, flow.groupAddress, flow.port]);
+}
 
 // src/fec-worker-setup.ts
 async function setupFecWorkerForTrack(opts) {
@@ -27279,6 +30246,9 @@ var MmtpFecSession = class {
   /** The newest SS_ID when the remembered SS_IDs were last pruned. */
   #prunedAt;
   #repairPacketId;
+  #newestSource;
+  #heldLayers;
+  #anchorHorizon;
   #stats = {
     sourceSymbols: 0,
     repairSymbols: 0,
@@ -27291,11 +30261,12 @@ var MmtpFecSession = class {
     dropped: {},
     sourceSymbolsByPath: { moq: 0, multicast: 0 },
     repairSymbolsByPath: { moq: 0, multicast: 0 },
-    mixedPath: { clean: 0, recovered: 0, failed: 0, released: 0 }
+    mixedPath: { clean: 0, recovered: 0, failed: 0, released: 0 },
+    failClosed: null
   };
   /**
    * @throws when the catalog block lacks or misstates a field the session
-   *   needs: the block profile, K, T, `interleaveDepthMs` or
+   *   needs: the block profile, K, P_0 (`repairSymbols`), T, `interleaveDepthMs` or
    *   `reorderToleranceMs`. None is defaulted.
    */
   constructor(config) {
@@ -27309,6 +30280,7 @@ var MmtpFecSession = class {
     }
     this.algorithm = fec.algorithm === "reed-solomon" ? "reed-solomon" : "raptorq";
     this.sourceSymbols = requirePositiveInteger(fec.sourceSymbols, "fec.sourceSymbols");
+    this.repairSymbols = requirePositiveInteger(fec.repairSymbols, "fec.repairSymbols");
     this.symbolSize = requirePositiveInteger(fec.symbolSize, "fec.symbolSize");
     const interleaveDepthMs = requireNumber(fec.interleaveDepthMs, "fec.interleaveDepthMs");
     const reorderToleranceMs = requireNumber(fec.reorderToleranceMs, "fec.reorderToleranceMs");
@@ -27316,6 +30288,18 @@ var MmtpFecSession = class {
       fecBlockBudgetMs(interleaveDepthMs, reorderToleranceMs),
       interleaveDepthMs
     );
+    this.#heldLayers = new HeldLayerAdmission(
+      config.repairLayers ?? [
+        {
+          layer: 0,
+          repairTrackName: typeof fec.repairTrack === "string" ? fec.repairTrack : "",
+          rsIdOffset: 0,
+          repairSymbols: this.repairSymbols
+        }
+      ],
+      config.heldLayers
+    );
+    this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols);
     if (typeof config.Decoder !== "function") {
       throw new Error("MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required");
     }
@@ -27338,7 +30322,8 @@ var MmtpFecSession = class {
       dropped: { ...this.#stats.dropped },
       sourceSymbolsByPath: { ...this.#stats.sourceSymbolsByPath },
       repairSymbolsByPath: { ...this.#stats.repairSymbolsByPath },
-      mixedPath: { ...this.#stats.mixedPath }
+      mixedPath: { ...this.#stats.mixedPath },
+      failClosed: this.#stats.failClosed && { ...this.#stats.failClosed }
     };
   }
   /**
@@ -27363,6 +30348,7 @@ var MmtpFecSession = class {
     this.#stats.sourceSymbols++;
     this.#stats.sourceSymbolsByPath[path]++;
     this.#noteNewest(ssId);
+    if (this.#newestSource === void 0 || serial32Precedes(this.#newestSource, ssId)) this.#newestSource = ssId;
     const start = this.#blockStartOf(ssId);
     const block = start === void 0 ? void 0 : this.#blocks.get(start);
     if (block) {
@@ -27391,14 +30377,17 @@ var MmtpFecSession = class {
    * Feeds one object of the repair track: a whole MMTP repair packet (ISO/IEC
    * 23008-1 C.5.3). A repair track carries one repair flow, so the first
    * repair packet fixes its packet ID and a packet of any other is refused.
-   * `path` is where it was received, as for addSource().
+   * `path` is where it was received, as for addSource(). `repairTrackName`
+   * is the repair track it was received on, for the 6.3.9 own-track rule; a
+   * track the layers do not list is refused as `repair:unlisted-track`.
    *
    * @returns the protected packets this repair symbol recovered, as for
    *   addSource().
    */
-  addRepair(packet, path = "moq") {
+  addRepair(packet, path = "moq", repairTrackName) {
     const decoder = this.#decoder;
     if (!decoder) return this.#drop("repair:released");
+    if (this.#stats.failClosed) return this.#drop("repair:fail-closed");
     const pathBit = PATH_BITS[path];
     if (!pathBit) return this.#drop("repair:unknown-path");
     let header;
@@ -27419,6 +30408,18 @@ var MmtpFecSession = class {
     if (this.algorithm === "reed-solomon" && frame.ssbLength + frame.rsbLength > 255) {
       return this.#drop("repair:rs-block-length");
     }
+    const verdict = this.#heldLayers.admit(
+      repairTrackName,
+      frame.ssStart,
+      frame.rsbLength,
+      this.#anchorHorizon,
+      this.#newestSource
+    );
+    if (verdict === "discard") return this.#drop("repair:unlisted-track");
+    if (verdict !== void 0) {
+      this.#stats.failClosed = verdict;
+      return this.#drop("repair:fail-closed");
+    }
     const start = frame.ssStart;
     let block = this.#blocks.get(start);
     if (block && block.ssbLength !== frame.ssbLength) return this.#drop("repair:conflicting-ssb-length");
@@ -27638,6 +30639,7 @@ function wireRepairFetch(mc, opts) {
   if (opts.rangeTransport !== void 0 && (typeof opts.repairEpochReference !== "function" || !mc.onUndelimitedLoss || !mc.closeIsoHoles)) {
     throw new Error("[RepairFetch] rangeTransport needs repairEpochReference and a host that reports undelimited losses");
   }
+  mc.setUnicastRepair?.(true);
   const entries = /* @__PURE__ */ new Map();
   const warnedNoTarget = /* @__PURE__ */ new Set();
   let disposed = false;
@@ -27689,12 +30691,13 @@ function wireRepairFetch(mc, opts) {
   const admit = (entry, now) => {
     const budgetMs = entry.deadlineAt - now;
     const rttMs = readRtt();
-    if (rttMs !== null && rttMs < budgetMs) return rttMs;
+    const reason = !entry.range && !groupCanComplete(entry.sbn, entry.packetId, entry.catalogTrackName) ? "group-cannot-complete" : rttMs === null ? "rtt-unmeasured" : rttMs < budgetMs ? null : "rtt-exceeds-budget";
+    if (reason === null) return rttMs;
     retire(entry);
     releaseHold(entry);
     clearEntry(entry);
     mc.noteRepairSkipped(
-      rttMs === null ? "rtt-unmeasured" : "rtt-exceeds-budget",
+      reason,
       { rttMs, budgetMs, priority: entry.priority },
       entry.sbn,
       entry.packetId,
@@ -28123,6 +31126,7 @@ function wireRepairFetch(mc, opts) {
   }
   return () => {
     disposed = true;
+    mc.setUnicastRepair?.(false);
     removeResetObserver();
     removeLifecycleObserver();
     for (const entry of [...entries.values()]) {
@@ -28332,4 +31336,16 @@ export {
   wireRepairFetch,
   wrapAdtsFrame
 };
+/*! Bundled license information:
+
+@noble/hashes/esm/utils.js:
+  (*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+
+@noble/curves/esm/utils.js:
+@noble/curves/esm/abstract/modular.js:
+@noble/curves/esm/abstract/curve.js:
+@noble/curves/esm/abstract/edwards.js:
+@noble/curves/esm/ed25519.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+*/
 //# sourceMappingURL=browser-runtime.js.map