@blockcast/mmt-container 1.0.1 → 2.0.0-main.609e08d7e29f

package/dist/mmtp-container-parser.no-modules.js

@@ -382,14 +382,11 @@ var BlockcastMmt = (() => {
       dataOffset: off + REPAIR_FEC_PID_SIZE
     };
   }
-  function parseMoqRepairFrameWithHeader(frame, header) {
-    return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame, header));
-  }
-  function moqRepairFrameFrom(frame, repairId) {
+  function moqRepairFrameFrom(frame, repairId, checkRsId = true) {
     if (!repairId)
       return null;
     const symbolData = frame.subarray(repairId.dataOffset);
-    if (repairId.rsbLength === 0 || repairId.ssbLength === 0 || repairId.rsId >= repairId.rsbLength || symbolData.length === 0)
+    if (repairId.ssbLength === 0 || checkRsId && repairId.rsId >= repairId.rsbLength || symbolData.length === 0)
       return null;
     return {
       packetId: repairId.packetId,
@@ -400,6 +397,23 @@ var BlockcastMmt = (() => {
       symbolData
     };
   }
+  function admitMmtpRepairObject(packet, header, symbolSize, algorithm) {
+    if (header.packetType !== PACKET_TYPE_REPAIR || header.fecType !== 2)
+      return null;
+    if (header.headerLength !== MMTP_HEADER_SIZE || packet.length !== MMTP_HEADER_SIZE + REPAIR_FEC_PID_SIZE + symbolSize) {
+      return { reject: "repairLength" };
+    }
+    const frame = moqRepairFrameFrom(packet, readRepairFecPayloadIdFields(packet, header), false);
+    if (!frame)
+      return null;
+    if (frame.rsId >= frame.rsbLength)
+      return { frame, reject: "repairRsId" };
+    const blockSymbols = frame.ssbLength + frame.rsbLength;
+    if (algorithm === "reed-solomon" ? blockSymbols > 255 : algorithm === "raptorq" && blockSymbols - 1 > 16777215) {
+      return { frame, reject: "repairSchemeBound" };
+    }
+    return { frame };
+  }
 
   // ../mmt-base/dist/net-constants.js
   var DEFAULT_AMT_RELAY_PORT = 2268;
@@ -477,254 +491,6 @@ var BlockcastMmt = (() => {
     return serial32Precedes(a, b) ? Math.floor(serial32Distance(a, b) / kMax) : 0;
   }
 
-  // ../mmt-base/dist/multicast-catalog.js
-  var ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
-  var UINT32_MAX = 4294967295;
-  var AUTH_MEMBERS = /* @__PURE__ */ new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
-  var KEY_MEMBERS = /* @__PURE__ */ new Set(["kid", "publicKey", "firstEpoch"]);
-  var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
-    "manifestPort",
-    "streamId",
-    "senderAddress",
-    "maxAuthDelayMs",
-    "manifestTimerMs",
-    "manifestTrack"
-  ]);
-  function isObject(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-  }
-  function isNonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-  }
-  function isIntegerIn(value, min, max) {
-    return Number.isSafeInteger(value) && value >= min && value <= max;
-  }
-  function multicastEndpointSource(endpoint) {
-    if (!isObject(endpoint))
-      return void 0;
-    const sourceAddress = endpoint["sourceAddress"];
-    if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress))
-      return void 0;
-    const mode = sourceAddress === void 0 ? "asm" : "ssm";
-    const protocol = endpoint["protocol"];
-    if (protocol !== void 0 && protocol !== mode)
-      return void 0;
-    const auth = endpoint["auth"];
-    const senderAddress = isObject(auth) ? auth["senderAddress"] : void 0;
-    if (mode === "ssm")
-      return senderAddress === void 0 ? { mode, source: sourceAddress } : void 0;
-    if (auth === void 0)
-      return { mode };
-    return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : void 0;
-  }
-  function authIssues(auth) {
-    const base = "$.multicast.auth";
-    const issue = (path, message) => [
-      { code: "multicast_auth", path: `${base}${path}`, message }
-    ];
-    if (!isObject(auth))
-      return issue("", "auth must be an object");
-    const unknown = Object.keys(auth).filter((key) => !AUTH_MEMBERS.has(key));
-    if (unknown.length > 0) {
-      return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
-    }
-    if (auth["scheme"] !== "bc-provenance")
-      return issue(".scheme", 'scheme must be "bc-provenance"');
-    if (auth["version"] !== 2)
-      return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
-    if (auth["sig"] !== "ed25519")
-      return issue(".sig", 'sig must be "ed25519"');
-    const keys = auth["keys"];
-    if (!Array.isArray(keys) || keys.length < 1 || keys.length > 4) {
-      return issue(".keys", "keys must be an array of one to four {kid, publicKey, firstEpoch} objects");
-    }
-    const kids = /* @__PURE__ */ new Set();
-    const firstEpochs = /* @__PURE__ */ new Set();
-    for (let index = 0; index < keys.length; index++) {
-      const key = keys[index];
-      const at = `.keys[${index}]`;
-      if (!isObject(key) || Object.keys(key).some((member) => !KEY_MEMBERS.has(member))) {
-        return issue(at, "a key is exactly {kid, publicKey, firstEpoch}");
-      }
-      if (!isIntegerIn(key["kid"], 0, UINT32_MAX))
-        return issue(`${at}.kid`, "kid must be an unsigned 32-bit integer");
-      if (typeof key["publicKey"] !== "string" || !ED25519_PUBLIC_KEY_BASE64URL.test(key["publicKey"])) {
-        return issue(`${at}.publicKey`, "publicKey must be a 32-octet Ed25519 key in canonical unpadded base64url");
-      }
-      if (!isIntegerIn(key["firstEpoch"], 0, UINT32_MAX)) {
-        return issue(`${at}.firstEpoch`, "firstEpoch must be an unsigned 32-bit integer");
-      }
-      if (kids.has(key["kid"]))
-        return issue(`${at}.kid`, `kid ${key["kid"]} is repeated; the catalog holds no key set`);
-      if (firstEpochs.has(key["firstEpoch"])) {
-        return issue(`${at}.firstEpoch`, `firstEpoch ${key["firstEpoch"]} is repeated; the catalog holds no key set`);
-      }
-      kids.add(key["kid"]);
-      firstEpochs.add(key["firstEpoch"]);
-    }
-    if (!isIntegerIn(auth["minEpoch"], 0, UINT32_MAX)) {
-      return issue(".minEpoch", "minEpoch must be an unsigned 32-bit integer");
-    }
-    return [];
-  }
-  function endpointAuthIssue(endpoint, mode, at) {
-    const auth = endpoint["auth"];
-    if (!isObject(auth))
-      return { path: `${at}.auth`, message: "auth must be an object" };
-    const unknown = Object.keys(auth).filter((key) => !ENDPOINT_AUTH_MEMBERS.has(key));
-    if (unknown.length > 0)
-      return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
-    if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
-      return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
-    }
-    if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
-      return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
-    }
-    if (mode === "ssm" && auth["senderAddress"] !== void 0) {
-      return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
-    }
-    if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
-      return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
-    }
-    if (auth["maxAuthDelayMs"] !== void 0 && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1e3)) {
-      return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
-    }
-    if (auth["manifestTimerMs"] !== void 0 && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
-      return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
-    }
-    if (auth["manifestTrack"] !== void 0 && !isNonEmptyString(auth["manifestTrack"])) {
-      return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
-    }
-    if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
-      return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
-    }
-    return void 0;
-  }
-  var CATALOG_NAMESPACE = /* @__PURE__ */ Symbol.for("@blockcast/mmt-base/catalogNamespace");
-  function multicastCatalogIssues(catalog, options = {}) {
-    if (!isObject(catalog))
-      return [];
-    const issues = [];
-    if ("multicast.auth" in catalog) {
-      issues.push({
-        code: "multicast_auth",
-        path: '$["multicast.auth"]',
-        message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)'
-      });
-    }
-    const multicast = catalog["multicast"];
-    if (!isObject(multicast))
-      return issues;
-    const protectedCatalog = multicast["auth"] !== void 0;
-    if (protectedCatalog)
-      issues.push(...authIssues(multicast["auth"]));
-    const endpoints = multicast["endpoints"];
-    if (!Array.isArray(endpoints))
-      return issues;
-    const tracks = Array.isArray(catalog["tracks"]) ? catalog["tracks"] : [];
-    const namespaceOf = /* @__PURE__ */ new Map();
-    for (const track of tracks) {
-      if (isObject(track) && typeof track["name"] === "string")
-        namespaceOf.set(track["name"], track["namespace"]);
-    }
-    const tagged = catalog[CATALOG_NAMESPACE];
-    let referenceNamespace = options.catalogNamespace ?? (typeof tagged === "string" ? tagged : void 0);
-    const sources = [];
-    for (let index = 0; index < endpoints.length; index++) {
-      const endpoint = endpoints[index];
-      const at = `$.multicast.endpoints[${index}]`;
-      const fail = (code, path, message) => {
-        issues.push({ code, path, message, endpointIndex: index });
-      };
-      sources.push(void 0);
-      if (!isObject(endpoint)) {
-        fail("multicast_endpoint", at, "endpoint must be an object");
-        continue;
-      }
-      const protocol = endpoint["protocol"];
-      if (protocol !== void 0 && protocol !== "ssm" && protocol !== "asm") {
-        fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
-        continue;
-      }
-      const hasAuth = endpoint["auth"] !== void 0;
-      if (protectedCatalog !== hasAuth) {
-        fail("multicast_endpoint_auth", `${at}.auth`, protectedCatalog ? "every endpoint requires auth when multicast carries auth; a receiver ignores this endpoint" : "auth names no key without multicast.auth; a receiver ignores this endpoint");
-        continue;
-      }
-      const sourceAddress = endpoint["sourceAddress"];
-      if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress)) {
-        fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
-        continue;
-      }
-      const mode = sourceAddress === void 0 ? "asm" : "ssm";
-      if (protocol !== void 0 && protocol !== mode) {
-        fail("multicast_endpoint", `${at}.protocol`, `protocol ${JSON.stringify(protocol)} disagrees with sourceAddress, which selects ${mode}`);
-        continue;
-      }
-      if (!isIntegerIn(endpoint["port"], 1, 65535)) {
-        fail("multicast_endpoint", `${at}.port`, "port must be an integer from 1 to 65535");
-        continue;
-      }
-      if (hasAuth) {
-        const authIssue = endpointAuthIssue(endpoint, mode, at);
-        if (authIssue) {
-          fail("multicast_endpoint_auth", authIssue.path, authIssue.message);
-          continue;
-        }
-      }
-      sources[index] = multicastEndpointSource(endpoint);
-      const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
-      for (let refIndex = 0; refIndex < refs.length; refIndex++) {
-        const ref = refs[refIndex];
-        const name = isObject(ref) ? ref["name"] : ref;
-        if (typeof name !== "string")
-          continue;
-        const namespace = namespaceOf.get(name);
-        if (typeof namespace !== "string")
-          continue;
-        referenceNamespace ?? (referenceNamespace = namespace);
-        if (namespace !== referenceNamespace) {
-          fail("multicast_track", `${at}.tracks[${refIndex}].name`, `track ${JSON.stringify(name)} declares namespace ${JSON.stringify(namespace)}, not the catalog track's ${JSON.stringify(referenceNamespace)}`);
-        }
-      }
-    }
-    const tupleOf = (index) => {
-      const endpoint = endpoints[index];
-      const auth = endpoint["auth"];
-      return {
-        sg: JSON.stringify([sources[index].source ?? null, endpoint["groupAddress"]]),
-        port: endpoint["port"],
-        manifestPort: isObject(auth) ? auth["manifestPort"] : void 0
-      };
-    };
-    for (let index = 0; index < endpoints.length; index++) {
-      if (!sources[index])
-        continue;
-      const own = tupleOf(index);
-      const at = `$.multicast.endpoints[${index}]`;
-      if (own.manifestPort !== void 0 && own.manifestPort === own.port) {
-        issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
-        continue;
-      }
-      for (let other = 0; other < endpoints.length; other++) {
-        if (other === index || !sources[other])
-          continue;
-        const peer = tupleOf(other);
-        if (peer.sg !== own.sg)
-          continue;
-        if (peer.port === own.port) {
-          issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
-          break;
-        }
-        if (own.manifestPort !== void 0 && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
-          issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
-          break;
-        }
-      }
-    }
-    return issues;
-  }
-
   // ../mmt-base/dist/fec-catalog.js
   var DEFAULT_SCHEMES = ["reed-solomon", "raptorq"];
   var DEFAULT_PROFILES = ["moq-object-v1", "iso-ssbg1-v1"];
@@ -8061,7 +7827,7 @@ var BlockcastMmt = (() => {
       }
     });
   }
-  function validateCmsfMmtpCatalog(value, options = {}) {
+  function validateCmsfMmtpCatalog(value, _options = {}) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
       catalogError("catalog_object", "$", "catalog must be an object");
     }
@@ -8252,8 +8018,6 @@ var BlockcastMmt = (() => {
         }
       }
     }
-    const [multicastIssue] = multicastCatalogIssues(catalog, options);
-    if (multicastIssue) catalogError(multicastIssue.code, multicastIssue.path, multicastIssue.message);
     validateArchive(catalog);
     return catalog;
   }
@@ -8356,9 +8120,10 @@ var BlockcastMmt = (() => {
   function heldLayerAnchorHorizon(retentionBlocks, k) {
     return retentionBlocks === void 0 || k <= 0 ? HORIZON_CAP : Math.min(HORIZON_CAP, retentionBlocks * k);
   }
-  var _layerNames, _states;
+  var _layerNames, _states, _HeldLayerAdmission_instances, admit_fn;
   var HeldLayerAdmission = class {
     constructor(layers, heldLayers = [0]) {
+      __privateAdd(this, _HeldLayerAdmission_instances);
       __privateAdd(this, _layerNames);
       __privateAdd(this, _states);
       const held = new Set(heldLayers);
@@ -8376,56 +8141,78 @@ var BlockcastMmt = (() => {
      * @returns undefined to admit, `'discard'`, or the fail-closed reason.
      */
     admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
-      if (repairTrackName !== void 0 && !__privateGet(this, _layerNames).has(repairTrackName)) return "discard";
-      const farAhead = sourceFrontier !== void 0 && serial32Precedes(sourceFrontier, ssStart) && serial32Distance(sourceFrontier, ssStart) > horizon;
-      for (const state of __privateGet(this, _states)) {
-        let code;
-        if (farAhead) {
-          if (rsbLength < state.total) {
-            if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
-            else if (state.anchor !== void 0 || state.settled) code = "below_anchored_total";
-          }
-        } else {
-          if (state.newest === void 0 || serial32Precedes(state.newest, ssStart)) state.newest = ssStart;
-          const stale = (s) => serial32Distance(s, state.newest) > horizon;
-          if (state.latestBelow !== void 0 && stale(state.latestBelow)) {
-            delete state.latestBelow;
-            delete state.latestBelowRsb;
+      return __privateMethod(this, _HeldLayerAdmission_instances, admit_fn).call(this, repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, true);
+    }
+    /**
+     * The core-00 7.5 carve-out for a repair object about to be discarded
+     * (RS_ID or scheme bound): whether its own RSB_length, below a held layer's
+     * total on that layer's track or on an anchored block, fails the instance
+     * closed under 7.3.2. Leaves the anchored state as it was: a discarded
+     * object anchors nothing.
+     */
+    failsClosed(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
+      const saved = __privateGet(this, _states).map((state) => ({ ...state }));
+      try {
+        const verdict = __privateMethod(this, _HeldLayerAdmission_instances, admit_fn).call(this, repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, false);
+        return typeof verdict === "object" ? verdict : void 0;
+      } finally {
+        saved.forEach((state, i) => {
+          __privateGet(this, _states)[i] = state;
+        });
+      }
+    }
+  };
+  _layerNames = new WeakMap();
+  _states = new WeakMap();
+  _HeldLayerAdmission_instances = new WeakSet();
+  admit_fn = function(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, retroactive) {
+    if (repairTrackName !== void 0 && !__privateGet(this, _layerNames).has(repairTrackName)) return "discard";
+    const farAhead = sourceFrontier !== void 0 && serial32Precedes(sourceFrontier, ssStart) && serial32Distance(sourceFrontier, ssStart) > horizon;
+    for (const state of __privateGet(this, _states)) {
+      let code;
+      if (farAhead) {
+        if (rsbLength < state.total) {
+          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+          else if (state.anchor !== void 0 || state.settled) code = "below_anchored_total";
+        }
+      } else {
+        if (state.newest === void 0 || serial32Precedes(state.newest, ssStart)) state.newest = ssStart;
+        const stale = (s) => serial32Distance(s, state.newest) > horizon;
+        if (state.latestBelow !== void 0 && stale(state.latestBelow)) {
+          delete state.latestBelow;
+          delete state.latestBelowRsb;
+        }
+        if (state.anchor !== void 0 && stale(state.anchor)) state.settled = true;
+        if (rsbLength < state.total) {
+          if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
+          else if (stale(ssStart)) continue;
+          else if (state.settled || state.anchor !== void 0 && !serial32Precedes(ssStart, state.anchor)) code = "below_anchored_total";
+          else if (state.latestBelow === void 0 || serial32Precedes(state.latestBelow, ssStart)) {
+            state.latestBelow = ssStart;
+            state.latestBelowRsb = rsbLength;
           }
-          if (state.anchor !== void 0 && stale(state.anchor)) state.settled = true;
-          if (rsbLength < state.total) {
-            if (state.layer > 0 && repairTrackName === state.repairTrackName) code = "below_own_track_total";
-            else if (stale(ssStart)) continue;
-            else if (state.settled || state.anchor !== void 0 && !serial32Precedes(ssStart, state.anchor)) code = "below_anchored_total";
-            else if (state.latestBelow === void 0 || serial32Precedes(state.latestBelow, ssStart)) {
-              state.latestBelow = ssStart;
-              state.latestBelowRsb = rsbLength;
-            }
-          } else if (!state.settled && !stale(ssStart)) {
-            if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
-            if (state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
-              code = "below_anchored_total";
-              ssStart = state.latestBelow;
-              rsbLength = state.latestBelowRsb;
-            }
+        } else if (!state.settled && !stale(ssStart)) {
+          if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
+          if (retroactive && state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
+            code = "below_anchored_total";
+            ssStart = state.latestBelow;
+            rsbLength = state.latestBelowRsb;
           }
         }
-        if (code !== void 0) {
-          return {
-            code,
-            layer: state.layer,
-            total: state.total,
-            rsbLength,
-            ssStart,
-            ...state.anchor === void 0 ? {} : { anchor: state.anchor }
-          };
-        }
       }
-      return void 0;
+      if (code !== void 0) {
+        return {
+          code,
+          layer: state.layer,
+          total: state.total,
+          rsbLength,
+          ssStart,
+          ...state.anchor === void 0 ? {} : { anchor: state.anchor }
+        };
+      }
     }
+    return void 0;
   };
-  _layerNames = new WeakMap();
-  _states = new WeakMap();
 
   // src/mmtp-fec-session.ts
   var PATH_BITS = { moq: 1, multicast: 2 };
@@ -8597,18 +8384,29 @@ var BlockcastMmt = (() => {
       } catch {
         return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:malformed");
       }
-      const frame = parseMoqRepairFrameWithHeader(packet, header);
-      if (!frame) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:malformed");
-      if (__privateGet(this, _repairPacketId) === void 0) {
-        __privateSet(this, _repairPacketId, frame.packetId);
-      } else if (frame.packetId !== __privateGet(this, _repairPacketId)) {
+      const admission = admitMmtpRepairObject(packet, header, this.symbolSize, this.algorithm);
+      if (!admission) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:malformed");
+      if (!("frame" in admission)) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:length");
+      const frame = admission.frame;
+      if (__privateGet(this, _repairPacketId) !== void 0 && frame.packetId !== __privateGet(this, _repairPacketId)) {
         return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:foreign-packet-id");
       }
-      if (frame.symbolData.byteLength !== this.symbolSize) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:symbol-size");
-      if (frame.ssbLength > this.sourceSymbols) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:ssb-length");
-      if (this.algorithm === "reed-solomon" && frame.ssbLength + frame.rsbLength > 255) {
-        return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:rs-block-length");
+      if (admission.reject) {
+        const verdict2 = __privateGet(this, _heldLayers).failsClosed(
+          repairTrackName,
+          frame.ssStart,
+          frame.rsbLength,
+          __privateGet(this, _anchorHorizon),
+          __privateGet(this, _newestSource)
+        );
+        if (verdict2) {
+          __privateGet(this, _stats3).failClosed = verdict2;
+          return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:fail-closed");
+        }
+        return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, admission.reject === "repairRsId" ? "repair:rs-id" : "repair:scheme-bound");
       }
+      __privateGet(this, _repairPacketId) ?? __privateSet(this, _repairPacketId, frame.packetId);
+      if (frame.ssbLength > this.sourceSymbols) return __privateMethod(this, _MmtpFecSession_instances, drop_fn2).call(this, "repair:ssb-length");
       const verdict = __privateGet(this, _heldLayers).admit(
         repairTrackName,
         frame.ssStart,
@@ -8895,8 +8693,8 @@ var BlockcastMmt = (() => {
   }
   var KEYFRAME_FLAGS = 33554432;
   var DELTA_FLAGS = 16842752;
-  var UINT32_MAX2 = 4294967295;
-  var MAX_TRACK_ID = UINT32_MAX2 - 1;
+  var UINT32_MAX = 4294967295;
+  var MAX_TRACK_ID = UINT32_MAX - 1;
   var INT32_MIN = -2147483648;
   var INT32_MAX = 2147483647;
   function assertTrackId(trackId, label) {
@@ -8905,8 +8703,8 @@ var BlockcastMmt = (() => {
     }
   }
   function assertTimescale(timescale, label) {
-    if (!Number.isInteger(timescale) || timescale <= 0 || timescale > UINT32_MAX2) {
-      throw new RangeError(`${label} must be an integer in 1..${UINT32_MAX2}, got ${timescale}`);
+    if (!Number.isInteger(timescale) || timescale <= 0 || timescale > UINT32_MAX) {
+      throw new RangeError(`${label} must be an integer in 1..${UINT32_MAX}, got ${timescale}`);
     }
   }
   function assertCompositionTimeOffsets(samples) {
@@ -10237,6 +10035,11 @@ var BlockcastMmt = (() => {
     const [leftText, rightText = ""] = address.split("::");
     const left = leftText ? leftText.split(":") : [];
     const right = rightText ? rightText.split(":") : [];
+    const tail = compressed ? right : left;
+    if (tail.length > 0 && tail[tail.length - 1].includes(".")) {
+      const v4 = parseIpv4(tail.pop());
+      tail.push((v4[0] << 8 | v4[1]).toString(16), (v4[2] << 8 | v4[3]).toString(16));
+    }
     if (left.some((group) => group.includes(".")) || right.some((group) => group.includes("."))) {
       throw new Error(`invalid IPv6 address ${address}`);
     }
@@ -10259,7 +10062,7 @@ var BlockcastMmt = (() => {
     return parseIpv4(address);
   }
   function endpointBytes(endpoint) {
-    if (!validPort(endpoint.port) || !validPort(endpoint.manifestPort) || !validU32(endpoint.streamId)) {
+    if (!validPort(endpoint.port) || !validU32(endpoint.streamId)) {
       throw new Error("invalid BCPV2 endpoint");
     }
     const source = parseBcProvenanceV2Address(endpoint.sourceAddress);
@@ -10319,7 +10122,7 @@ var BlockcastMmt = (() => {
     offset += source.byteLength;
     prefix.set(group, offset);
     offset += group.byteLength;
-    prefix.set(u16(endpoint.manifestPort), offset);
+    prefix.set(u16(endpoint.port), offset);
     const message = new Uint8Array(prefix.byteLength + record.body.byteLength);
     message.set(prefix);
     message.set(record.body, prefix.byteLength);
@@ -11830,7 +11633,6 @@ var BlockcastMmt = (() => {
   var BCPV2_LEAD_BOUND_MS = 5e3;
   var REPLAY_WINDOW = 64n;
   var BUCKET_DEPTH = 64;
-  var BUCKET_RATE_PER_MS = 1;
   var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
   function sameBytes(a, b) {
     if (a.byteLength !== b.byteLength)
@@ -11860,6 +11662,10 @@ var BlockcastMmt = (() => {
       __publicField(this, "verifySig");
       __publicField(this, "accepted");
       __publicField(this, "queueLimit");
+      /** Octets a held datagram is charged beyond its payload: the IPv4 or IPv6 plus UDP headers (step 2). */
+      __publicField(this, "headerOctets");
+      /** Budget refill, tokens per ms: V / 1000 (step 1). */
+      __publicField(this, "bucketRatePerMs");
       __publicField(this, "current", null);
       __publicField(this, "previous", null);
       __publicField(this, "graceStart", {});
@@ -11874,10 +11680,12 @@ var BlockcastMmt = (() => {
       __publicField(this, "holdBytes", { multicast: 0, unicast: 0 });
       __publicField(this, "order", 0);
       __publicField(this, "buckets");
-      this.maxAuthDelayMs = cfg.maxAuthDelayMs ?? 200;
-      this.manifestTimerMs = cfg.manifestTimerMs ?? 20;
-      if (!(this.maxAuthDelayMs >= 50 && this.maxAuthDelayMs <= 1e3) || !(this.manifestTimerMs >= 1)) {
-        throw new Error("BCPV2 endpoint ignored: maxAuthDelayMs or manifestTimerMs out of range");
+      const delay = cfg.maxAuthDelayMs;
+      this.maxAuthDelayMs = typeof delay !== "number" || !Number.isFinite(delay) ? 200 : delay < 50 ? 50 : delay > 1e3 ? 1e3 : Number.isInteger(delay) ? delay : 200;
+      const timer = cfg.manifestTimerMs;
+      this.manifestTimerMs = typeof timer !== "number" || !Number.isFinite(timer) ? 20 : timer < 1 || Number.isInteger(timer) ? timer : 20;
+      if (!(this.manifestTimerMs >= 1)) {
+        throw new Error("BCPV2 endpoint ignored: manifestTimerMs below 1");
       }
       if (!(cfg.bandwidth > 0))
         throw new Error("BCPV2 endpoint ignored: protected endpoint without bandwidth");
@@ -11902,6 +11710,8 @@ var BlockcastMmt = (() => {
         multicast: this.maxAuthDelayMs * bandwidth / 8e3,
         unicast: (this.maxAuthDelayMs + this.widenMs) * bandwidth / 8e3
       };
+      this.headerOctets = parseBcProvenanceV2Address(cfg.endpoint.groupAddress).byteLength === 16 ? 48 : 28;
+      this.bucketRatePerMs = Math.max(1e3, 1.25 * bandwidth / (8 * 512 * 37)) / 1e3;
       const t = this.now();
       this.buckets = {
         multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
@@ -11917,7 +11727,7 @@ var BlockcastMmt = (() => {
         return 0;
       return this.lead ?? BCPV2_LEAD_BOUND_MS;
     }
-    /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+    /** Step 1: a record datagram on `port`, or a record object of the manifest track. */
     onRecord(bytes, path) {
       var _a;
       const now = this.now();
@@ -12001,7 +11811,7 @@ var BlockcastMmt = (() => {
         arrival: now,
         sent,
         digest: hex(sha2562(bytes)),
-        pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+        pairs: record.digests.map((d, i) => ({ digest: hex(d), epoch, seq: record.firstSeq + BigInt(i), admitted: false })),
         awaitingMulticast: path === "mirror"
       };
       this.verified.set(id, entry);
@@ -12068,12 +11878,12 @@ var BlockcastMmt = (() => {
     digest(datagram) {
       return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
     }
-    /** Consume the lowest-seq pending entry for `digest`, admitting it. */
+    /** Consume the pending entry for `digest` lowest in (epoch, sequence) order, admitting it. */
     consumePending(digest, now) {
       const list = this.pending.get(digest);
       if (!list?.length)
         return false;
-      list.sort((a, b) => a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0);
+      list.sort((a, b) => a.pair.epoch - b.pair.epoch || (a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0));
       const hit = list.shift();
       if (list.length === 0)
         this.pending.delete(digest);
@@ -12082,14 +11892,18 @@ var BlockcastMmt = (() => {
       this.admittedUntil.set(digest, now + this.maxAuthDelayMs + this.leadMs);
       return true;
     }
+    /** A held datagram's charge against its queue: payload plus IP and UDP headers. */
+    charge(held) {
+      return held.datagram.byteLength + this.headerOctets;
+    }
     enqueue(held, path, now) {
-      if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+      if (this.holdBytes[path] + this.charge(held) > this.queueLimit[path]) {
         return { verdict: "overflow", admitted: [] };
       }
       held.expiry = now + this.maxAuthDelayMs + (path === "unicast" ? this.widenMs : 0);
       held.order = this.order++;
       this.hold[path].push(held);
-      this.holdBytes[path] += held.datagram.byteLength;
+      this.holdBytes[path] += this.charge(held);
       return { verdict: "held", admitted: [] };
     }
     /** Remove and return the oldest held datagram with `digest`, across both queues. */
@@ -12104,7 +11918,7 @@ var BlockcastMmt = (() => {
       if (!best)
         return void 0;
       const [held] = this.hold[best.path].splice(best.index, 1);
-      this.holdBytes[best.path] -= held.datagram.byteLength;
+      this.holdBytes[best.path] -= this.charge(held);
       return held.datagram;
     }
     dropAdmittedHeld() {
@@ -12112,7 +11926,7 @@ var BlockcastMmt = (() => {
         this.hold[path] = this.hold[path].filter((h) => {
           const keep = h.digest === void 0 || !this.admittedUntil.has(h.digest);
           if (!keep)
-            this.holdBytes[path] -= h.datagram.byteLength;
+            this.holdBytes[path] -= this.charge(h);
           return keep;
         });
       }
@@ -12197,7 +12011,7 @@ var BlockcastMmt = (() => {
     }
     take(path, now) {
       const b = this.buckets[path];
-      b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+      b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * this.bucketRatePerMs);
       b.last = now;
       if (b.tokens < 1) {
         b.dropped++;
@@ -12211,7 +12025,7 @@ var BlockcastMmt = (() => {
         this.hold[path] = this.hold[path].filter((h) => {
           if (h.expiry > now)
             return true;
-          this.holdBytes[path] -= h.datagram.byteLength;
+          this.holdBytes[path] -= this.charge(h);
           this.expired[path]++;
           return false;
         });
@@ -12243,7 +12057,7 @@ var BlockcastMmt = (() => {
     }
     /**
      * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
-     * while the freshness check would still pass its copy on `manifestPort`.
+     * while the freshness check would still pass its copy on `port`.
      * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
      */
     prune(now) {