@blockcast/mmt-container 1.0.1 → 2.0.0-main.609e08d7e29f

package/dist/multicast-auth-catalog.d.ts

@@ -1,7 +1,8 @@
 /**
  * `multicast.auth` and an endpoint's `auth`: bc-provenance version 2, per
- * draft-ramadan-moq-multicast-01 7.2.6 at
- * Blockcast/moqcast-draft@fd962fd73d21ed281b60219c11ea61cc9e4e91c4.
+ * draft-ramadan-moq-multicast-02 7.2.6 at Blockcast/moqcast-draft@5f49172.
+ * Records ride in band on the flow's own `port` (7.2.3); draft -01's separate
+ * record port is gone.
  *
  * The block lives in the `multicast` object, never the root: the root dotted
  * key `"multicast.auth"` was draft -00's (libmmt called its `tracks[]` shape
@@ -48,15 +49,13 @@ export interface MulticastAuthConfig {
 }
 /** An endpoint's `auth` (7.2.6). A protected endpoint also declares `bandwidth`. */
 export interface EndpointAuthConfig {
-    /** Destination port of the record datagrams on the endpoint's `(S, G)`. */
-    manifestPort: number;
     /** u32 chosen per channel generation. */
     streamId: number;
     /** `S` of a protected ASM endpoint; never on SSM. */
     senderAddress?: string;
-    /** 50..1000, default 200. */
+    /** 50..1000, default 200; a receiver clamps one outside the range. */
     maxAuthDelayMs?: number;
-    /** At least 1, default 20. */
+    /** At least 1, default 20; a receiver ignores the endpoint below 1. */
     manifestTimerMs?: number;
     /** MoQ track mirroring the records. */
     manifestTrack?: string;
@@ -68,12 +67,13 @@ export declare function isMulticastAuthConfig(obj: unknown): obj is MulticastAut
 export interface ResolvedMulticastAuthFlow {
     /** Index of the endpoint in `multicast.endpoints`. */
     endpointIndex: number;
-    /** `S`: `sourceAddress` on SSM, `auth.senderAddress` on ASM. */
+    /** `S`: `sourceAddress` on SSM, `auth.senderAddress` on ASM; canonical (`canonicalIpAddress`). */
     source: string;
+    /** Canonical (`canonicalIpAddress`). */
     groupAddress: string;
+    /** The flow's port; its records ride in band on it (7.2.3). */
     port: number;
     bandwidth: number;
-    manifestPort: number;
     streamId: number;
     maxAuthDelayMs: number;
     manifestTimerMs: number;

package/dist/multicast-auth-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multicast-auth-catalog.d.ts","sourceRoot":"","sources":["../src/multicast-auth-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAgD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE7G,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAIzC,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,yBAAyB,KAAK,CAAC;AAK5C;wCACwC;AACxC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAczD;AAUD;yEACyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAyBxD;AAED;6DAC6D;AAC7D,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAQpE;AAED;2EAC2E;AAC3E,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,gBAAgB,CAAC;IACtB,8DAA8D;IAC9D,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IAClC,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8BAA8B;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;4BAC4B;AAC5B,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAE9E;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACzC,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,2FAA2F;IAC3F,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,+CAA+C;IAC/C,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IACR,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;CAC9C,GACJ,2BAA2B,GAAG,SAAS,CAuDzC;AAmDD;mFACmF;AACnF,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,2BAA2B,EACrC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACX,UAAU,GAAG,SAAS,CAKxB"}
+{"version":3,"file":"multicast-auth-catalog.d.ts","sourceRoot":"","sources":["../src/multicast-auth-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,EAAgD,KAAK,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE7G,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAClD,MAAM,MAAM,gBAAgB,GAAG,SAAS,CAAC;AAIzC,8EAA8E;AAC9E,eAAO,MAAM,yBAAyB,MAAgC,CAAC;AACvE,eAAO,MAAM,yBAAyB,KAAgC,CAAC;AAKvE;wCACwC;AACxC,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAczD;AAUD;yEACyE;AACzE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAyBxD;AAED;6DAC6D;AAC7D,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,CAQpE;AAED;2EAC2E;AAC3E,MAAM,WAAW,gBAAgB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IACnC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,gBAAgB,CAAC;IACtB,8DAA8D;IAC9D,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,oFAAoF;AACpF,MAAM,WAAW,kBAAkB;IAClC,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;4BAC4B;AAC5B,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,mBAAmB,CAE9E;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACzC,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,2FAA2F;IAC3F,GAAG,CAAC,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC3C,+CAA+C;IAC/C,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,yBAAyB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IACR,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;CAC9C,GACJ,2BAA2B,GAAG,SAAS,CAqDzC;AAsDD;mFACmF;AACnF,wBAAgB,mBAAmB,CAClC,QAAQ,EAAE,2BAA2B,EACrC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACX,UAAU,GAAG,SAAS,CAKxB"}

package/dist/multicast-auth-catalog.js

@@ -13,13 +13,98 @@ var FEC_BLOCK_PROFILES = Object.freeze([
   "iso-ssbg1-v1"
 ]);
 
+// ../mmt-base/dist/ip-address.js
+var DEC_OCTET = /^(?:0|[1-9]\d{0,2})$/;
+var H16 = /^[0-9A-Fa-f]{1,4}$/;
+function parseIpv4(text2) {
+  const fields = text2.split(".");
+  if (fields.length !== 4)
+    return void 0;
+  const octets = [];
+  for (const field of fields) {
+    if (!DEC_OCTET.test(field))
+      return void 0;
+    const value = Number(field);
+    if (value > 255)
+      return void 0;
+    octets.push(value);
+  }
+  return octets;
+}
+function parseIpv6(text2) {
+  const halves = text2.split("::");
+  if (halves.length > 2)
+    return void 0;
+  const groupsOf = (part) => part === "" ? [] : part.split(":");
+  const left = groupsOf(halves[0]);
+  const right = halves.length === 2 ? groupsOf(halves[1]) : [];
+  const words = [];
+  const all = [...left, ...right];
+  const last = halves.length === 2 && right.length === 0 ? -1 : all.length - 1;
+  for (let index = 0; index < all.length; index++) {
+    const group = all[index];
+    if (index === last && group.includes(".")) {
+      const v4 = parseIpv4(group);
+      if (!v4)
+        return void 0;
+      words.push([v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]]);
+    } else if (H16.test(group)) {
+      words.push([Number.parseInt(group, 16)]);
+    } else {
+      return void 0;
+    }
+  }
+  const leftWords = words.slice(0, left.length).flat();
+  const rightWords = words.slice(left.length).flat();
+  const missing = 8 - leftWords.length - rightWords.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0)
+    return void 0;
+  const out = new Uint8Array(16);
+  [...leftWords, ...new Array(missing).fill(0), ...rightWords].forEach((word, index) => {
+    out[index * 2] = word >> 8;
+    out[index * 2 + 1] = word & 255;
+  });
+  return out;
+}
+function parseIpAddressLiteral(text2) {
+  if (typeof text2 !== "string")
+    return void 0;
+  if (text2.includes(":"))
+    return parseIpv6(text2);
+  const v4 = parseIpv4(text2);
+  return v4 ? Uint8Array.from(v4) : void 0;
+}
+function canonicalIpAddress(text2) {
+  const bytes = parseIpAddressLiteral(text2);
+  if (!bytes)
+    return void 0;
+  if (bytes.length === 4)
+    return bytes.join(".");
+  const words = Array.from({ length: 8 }, (_, index) => bytes[index * 2] << 8 | bytes[index * 2 + 1]);
+  let bestStart = -1;
+  let bestLength = 1;
+  for (let start = 0; start < 8; ) {
+    let end = start;
+    while (end < 8 && words[end] === 0)
+      end++;
+    if (end - start > bestLength) {
+      bestStart = start;
+      bestLength = end - start;
+    }
+    start = end === start ? start + 1 : end;
+  }
+  const hex = words.map((word) => word.toString(16));
+  if (bestStart < 0)
+    return hex.join(":");
+  return `${hex.slice(0, bestStart).join(":")}::${hex.slice(bestStart + bestLength).join(":")}`;
+}
+
 // ../mmt-base/dist/multicast-catalog.js
 var ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
 var UINT32_MAX = 4294967295;
 var AUTH_MEMBERS = /* @__PURE__ */ new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
 var KEY_MEMBERS = /* @__PURE__ */ new Set(["kid", "publicKey", "firstEpoch"]);
 var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
-  "manifestPort",
   "streamId",
   "senderAddress",
   "maxAuthDelayMs",
@@ -29,17 +114,32 @@ var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
 function isIntegerIn(value, min, max) {
   return Number.isSafeInteger(value) && value >= min && value <= max;
 }
+var BCP_DEFAULT_MAX_AUTH_DELAY_MS = 200;
+var BCP_DEFAULT_MANIFEST_TIMER_MS = 20;
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function endpointAuthTiming(auth) {
+  const record = isObject(auth) ? auth : {};
+  const delay = record["maxAuthDelayMs"];
+  const timer = record["manifestTimerMs"];
+  const track = record["manifestTrack"];
+  const maxAuthDelayMs = !isFiniteNumber(delay) ? BCP_DEFAULT_MAX_AUTH_DELAY_MS : delay < 50 ? 50 : delay > 1e3 ? 1e3 : Number.isInteger(delay) ? delay : BCP_DEFAULT_MAX_AUTH_DELAY_MS;
+  const manifestTimerMs = !isFiniteNumber(timer) ? BCP_DEFAULT_MANIFEST_TIMER_MS : timer < 1 || Number.isSafeInteger(timer) ? timer : BCP_DEFAULT_MANIFEST_TIMER_MS;
+  return {
+    maxAuthDelayMs,
+    manifestTimerMs,
+    ...typeof track === "string" && track.length > 0 ? { manifestTrack: track } : {}
+  };
+}
 function multicastEndpointSource(endpoint) {
   if (!isObject(endpoint))
     return void 0;
   const sourceAddress = endpoint["sourceAddress"];
-  if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress))
+  if (sourceAddress !== void 0 && !parseIpAddressLiteral(sourceAddress))
     return void 0;
   const mode = sourceAddress === void 0 ? "asm" : "ssm";
   const protocol = endpoint["protocol"];
@@ -51,7 +151,7 @@ function multicastEndpointSource(endpoint) {
     return senderAddress === void 0 ? { mode, source: sourceAddress } : void 0;
   if (auth === void 0)
     return { mode };
-  return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : void 0;
+  return parseIpAddressLiteral(senderAddress) ? { mode, source: senderAddress } : void 0;
 }
 function authIssues(auth) {
   const base = "$.multicast.auth";
@@ -62,12 +162,12 @@ function authIssues(auth) {
     return issue("", "auth must be an object");
   const unknown = Object.keys(auth).filter((key) => !AUTH_MEMBERS.has(key));
   if (unknown.length > 0) {
-    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
+    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -02 7.2.6 defines scheme, version, sig, keys and minEpoch`);
   }
   if (auth["scheme"] !== "bc-provenance")
     return issue(".scheme", 'scheme must be "bc-provenance"');
   if (auth["version"] !== 2)
-    return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
+    return issue(".version", "version must be 2 (bc-provenance version 2, draft -02 7.2)");
   if (auth["sig"] !== "ed25519")
     return issue(".sig", 'sig must be "ed25519"');
   const keys = auth["keys"];
@@ -110,26 +210,17 @@ function endpointAuthIssue(endpoint, mode, at) {
   const unknown = Object.keys(auth).filter((key) => !ENDPOINT_AUTH_MEMBERS.has(key));
   if (unknown.length > 0)
     return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
-  if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
-    return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
-  }
   if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
     return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
   }
   if (mode === "ssm" && auth["senderAddress"] !== void 0) {
     return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
   }
-  if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
-    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
+  if (mode === "asm" && !parseIpAddressLiteral(auth["senderAddress"])) {
+    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress, an RFC 3986 IP address literal" };
   }
-  if (auth["maxAuthDelayMs"] !== void 0 && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1e3)) {
-    return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
-  }
-  if (auth["manifestTimerMs"] !== void 0 && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
-  }
-  if (auth["manifestTrack"] !== void 0 && !isNonEmptyString(auth["manifestTrack"])) {
-    return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
+  if (endpointAuthTiming(auth).manifestTimerMs < 1) {
+    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be at least 1" };
   }
   if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
     return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
@@ -145,7 +236,7 @@ function multicastCatalogIssues(catalog, options = {}) {
     issues.push({
       code: "multicast_auth",
       path: '$["multicast.auth"]',
-      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)'
+      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -02 7.2.6)'
     });
   }
   const multicast = catalog["multicast"];
@@ -179,7 +270,7 @@ function multicastCatalogIssues(catalog, options = {}) {
     }
     const protocol = endpoint["protocol"];
     if (protocol !== void 0 && protocol !== "ssm" && protocol !== "asm") {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
+      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -02 4.2)`);
       continue;
     }
     const hasAuth = endpoint["auth"] !== void 0;
@@ -188,8 +279,18 @@ function multicastCatalogIssues(catalog, options = {}) {
       continue;
     }
     const sourceAddress = endpoint["sourceAddress"];
-    if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress)) {
-      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
+    const sourceBytes = sourceAddress === void 0 ? void 0 : parseIpAddressLiteral(sourceAddress);
+    if (sourceAddress !== void 0 && !sourceBytes) {
+      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be an RFC 3986 IPv4address or IPv6address literal");
+      continue;
+    }
+    const groupBytes = parseIpAddressLiteral(endpoint["groupAddress"]);
+    if (!groupBytes) {
+      fail("multicast_endpoint", `${at}.groupAddress`, "groupAddress must be an RFC 3986 IPv4address or IPv6address literal");
+      continue;
+    }
+    if (sourceBytes && sourceBytes.length !== groupBytes.length) {
+      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress and groupAddress are of different address families");
       continue;
     }
     const mode = sourceAddress === void 0 ? "asm" : "ssm";
@@ -208,7 +309,13 @@ function multicastCatalogIssues(catalog, options = {}) {
         continue;
       }
     }
-    sources[index] = multicastEndpointSource(endpoint);
+    const source = multicastEndpointSource(endpoint);
+    const senderBytes = source?.mode === "asm" && source.source !== void 0 ? parseIpAddressLiteral(source.source) : void 0;
+    if (senderBytes && senderBytes.length !== groupBytes.length) {
+      fail("multicast_endpoint_auth", `${at}.auth.senderAddress`, "senderAddress and groupAddress are of different address families");
+      continue;
+    }
+    sources[index] = source;
     const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
     for (let refIndex = 0; refIndex < refs.length; refIndex++) {
       const ref = refs[refIndex];
@@ -224,38 +331,23 @@ function multicastCatalogIssues(catalog, options = {}) {
       }
     }
   }
+  const addressKey = (text2) => {
+    const bytes = text2 === void 0 ? void 0 : parseIpAddressLiteral(text2);
+    return bytes ? `${bytes.length}:${bytes.join(".")}` : "-";
+  };
   const tupleOf = (index) => {
     const endpoint = endpoints[index];
-    const auth = endpoint["auth"];
-    return {
-      sg: JSON.stringify([sources[index].source ?? null, endpoint["groupAddress"]]),
-      port: endpoint["port"],
-      manifestPort: isObject(auth) ? auth["manifestPort"] : void 0
-    };
+    return `${addressKey(sources[index].source)}|${addressKey(endpoint["groupAddress"])}|${endpoint["port"]}`;
   };
   for (let index = 0; index < endpoints.length; index++) {
     if (!sources[index])
       continue;
     const own = tupleOf(index);
-    const at = `$.multicast.endpoints[${index}]`;
-    if (own.manifestPort !== void 0 && own.manifestPort === own.port) {
-      issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
-      continue;
-    }
     for (let other = 0; other < endpoints.length; other++) {
-      if (other === index || !sources[other])
-        continue;
-      const peer = tupleOf(other);
-      if (peer.sg !== own.sg)
+      if (other === index || !sources[other] || tupleOf(other) !== own)
         continue;
-      if (peer.port === own.port) {
-        issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
-        break;
-      }
-      if (own.manifestPort !== void 0 && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
-        issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
-        break;
-      }
+      issues.push({ code: "multicast_endpoint", path: `$.multicast.endpoints[${index}].port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
+      break;
     }
   }
   return issues;
@@ -620,17 +712,23 @@ function lp16(value) {
   return concat([u16(bytes.byteLength), bytes]);
 }
 function bcProvenanceV2ParamsHash(params) {
-  const fec = params.fec;
+  const fec = [...params.fec ?? []].sort((a, b) => (a.instanceId ?? 0) - (b.instanceId ?? 0));
+  if (fec.some((instance) => instance.scheme === "none")) {
+    throw new Error('FEC scheme "none" is reserved (fec-core-00 15.2)');
+  }
+  const tuples = fec.length === 0 ? [lp16("none"), u32(0), u32(0), u32(0), u32(0)] : fec.flatMap((instance) => [
+    lp16(instance.scheme),
+    u32(instance.sourceSymbols),
+    u32(instance.repairSymbols),
+    u32(instance.symbolSize),
+    u32(instance.interleaveDepthMs ?? 0)
+  ]);
   return sha2562(concat([
     text.encode("BCPV2-params"),
     lp16(params.codec),
     u32(params.timescale),
     u32(params.groupDurationTicks),
-    lp16(fec ? fec.algorithm : "none"),
-    u32(fec?.sourceSymbols ?? 0),
-    u32(fec?.repairSymbols ?? 0),
-    u32(fec?.symbolSize ?? 0),
-    u32(fec?.interleaveDepthMs ?? 0)
+    ...tuples
   ]));
 }
 function bcProvenanceV2Ctx(namespace, packetIds, params) {
@@ -649,8 +747,8 @@ function bcProvenanceV2Ctx(namespace, packetIds, params) {
 
 // src/multicast-auth-catalog.ts
 var RAW_ED25519_KEY_LENGTH = 32;
-var DEFAULT_MAX_AUTH_DELAY_MS = 200;
-var DEFAULT_MANIFEST_TIMER_MS = 20;
+var DEFAULT_MAX_AUTH_DELAY_MS = BCP_DEFAULT_MAX_AUTH_DELAY_MS;
+var DEFAULT_MANIFEST_TIMER_MS = BCP_DEFAULT_MANIFEST_TIMER_MS;
 var BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
 function encodeBase64Url(bytes) {
   let output = "";
@@ -746,15 +844,13 @@ function resolveMulticastAuthCatalog(catalog, options = {}) {
     }
     flows.push({
       endpointIndex,
-      source: endpoint["sourceAddress"] ?? flowAuth.senderAddress,
-      groupAddress: endpoint["groupAddress"],
+      source: canonicalIpAddress(endpoint["sourceAddress"] ?? flowAuth.senderAddress),
+      groupAddress: canonicalIpAddress(endpoint["groupAddress"]),
       port: endpoint["port"],
       bandwidth: endpoint["bandwidth"],
-      manifestPort: flowAuth.manifestPort,
       streamId: flowAuth.streamId,
-      maxAuthDelayMs: flowAuth.maxAuthDelayMs ?? DEFAULT_MAX_AUTH_DELAY_MS,
-      manifestTimerMs: flowAuth.manifestTimerMs ?? DEFAULT_MANIFEST_TIMER_MS,
-      ...flowAuth.manifestTrack === void 0 ? {} : { manifestTrack: flowAuth.manifestTrack },
+      // Clamped, or the defaults where absent (7.2.6).
+      ...endpointAuthTiming(flowAuth),
       tracks,
       ...ctx === void 0 ? {} : { ctx }
     });
@@ -770,32 +866,32 @@ function positiveInteger(value) {
 }
 function ctxParams(catalogTracks, listed) {
   const byName = new Map(catalogTracks.map((track) => [track["name"], track]));
+  const instancesOf = (track) => Array.isArray(track["fec"]) ? track["fec"].filter((f) => typeof f === "object" && f !== null) : [];
   const ordered = [...listed].sort((a, b) => a.packetId - b.packetId).map(({ name }) => byName.get(name));
   let entry = ordered.find((track) => track !== void 0 && track["packaging"] !== "fec-repair");
   if (entry === void 0) {
     const repair = ordered.find((track) => track !== void 0);
     if (repair === void 0) return void 0;
-    const depends = repair["depends"];
-    entry = Array.isArray(depends) && depends.length === 1 ? byName.get(depends[0]) : catalogTracks.find((track) => track["fec"]?.["repairTrack"] === repair["name"]);
+    entry = typeof repair["source"] === "string" ? byName.get(repair["source"]) : catalogTracks.find((track) => instancesOf(track).some((f) => f["repairTrack"] === repair["name"]));
     if (entry === void 0) return void 0;
   }
+  const instances = instancesOf(entry);
+  if (instances.some((f) => f["scheme"] === "none")) return void 0;
   const timescale = positiveInteger(entry["timescale"]);
   const ms = positiveInteger(entry["groupDurationMs"]);
   const groupDurationTicks = positiveInteger(entry["groupDurationTicks"]) || positiveInteger(timescale && ms * timescale % 1e3 === 0 ? ms * timescale / 1e3 : 0);
-  const fec = entry["fec"];
   return {
     codec: typeof entry["codec"] === "string" ? entry["codec"] : "",
     timescale,
     groupDurationTicks,
-    ...fec === void 0 || fec === null ? {} : {
-      fec: {
-        algorithm: typeof fec["algorithm"] === "string" ? fec["algorithm"] : "",
-        sourceSymbols: positiveInteger(fec["sourceSymbols"]),
-        repairSymbols: positiveInteger(fec["repairSymbols"]),
-        symbolSize: positiveInteger(fec["symbolSize"]),
-        interleaveDepthMs: positiveInteger(fec["interleaveDepthMs"])
-      }
-    }
+    fec: instances.map((f) => ({
+      instanceId: typeof f["instanceId"] === "number" ? f["instanceId"] : 0,
+      scheme: typeof f["scheme"] === "string" ? f["scheme"] : "",
+      sourceSymbols: positiveInteger(f["sourceSymbols"]),
+      repairSymbols: positiveInteger(f["repairSymbols"]),
+      symbolSize: positiveInteger(f["symbolSize"]),
+      interleaveDepthMs: positiveInteger(f["interleaveDepthMs"])
+    }))
   };
 }
 function multicastAuthKeyFor(resolved, kid, epoch) {