@blockcast/mmt-container 1.0.1 → 2.0.0-main.609e08d7e29f

package/dist/multicast-transport.d.ts

@@ -27,6 +27,20 @@ export interface MulticastTransportConfig {
         plpId?: number;
         serviceId?: number;
     };
+    /**
+     * The join is a protected flow (multicast-02 7.2.3): its bc-provenance
+     * records ride in band on this `port`, so a datagram whose first four octets
+     * are "MHM2" passes ahead of the packet_id read and the allow-list, and is
+     * never counted toward a packet_id. On an unprotected join it is an
+     * unparseable MMTP packet, as before.
+     *
+     * A protected join admits only datagrams whose reported sender is the
+     * flow's S (`sourceAddress`, or `senderAddress` on ASM), compared as IP
+     * addresses, before anything hashes them (multicast-02 7.2.7). A datagram
+     * with no reported sender is dropped, and a join that cannot report one
+     * (no S, or an ATSC 3.0 tuner) is declined `invalid-request`.
+     */
+    protected?: boolean;
 }
 export type ResolvedMulticastTransport = 'native' | 'amt';
 /**
@@ -123,7 +137,8 @@ export interface MulticastTransportStats {
      * one (G, port, packet_id); the first sender whose packet is accepted owns
      * the sub-flow until the next join, and every other sender is dropped here,
      * before any gap, duplicate or FEC ledger sees it. A join or a silence
-     * failback releases the lock.
+     * failback releases the lock. On a protected join it also counts every
+     * datagram whose sender is not the flow's S, or is not reported.
      */
     packetsDroppedForeignSender: number;
 }

package/dist/multicast-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multicast-transport.d.ts","sourceRoot":"","sources":["../src/multicast-transport.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AAOjC,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC7C,qFAAqF;IACrF,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAClE;AAED,MAAM,MAAM,0BAA0B,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0BAA0B,GAClC,UAAU,GACV,aAAa,GACb,YAAY,GACZ,iBAAiB,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,sBAAsB,CAAA;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,0BAA0B,CAAA;CACpD,CAAA;AAEL;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,6BAA6B,EAAE,MAAM,CAAA;IACrC,uFAAuF;IACvF,yBAAyB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAA;IAC/B;;;;;;;OAOG;IACH,2BAA2B,EAAE,MAAM,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAA;CACxE;AA2HD,qBAAa,kBAAkB,CAAC,cAAc,GAAG,KAAK;;IAkFpD;;;;OAIG;gBAED,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,IAAI,EAChE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,sBAAsB,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;KAAO;IAOzF,MAAM,CAAC,WAAW,IAAI,OAAO;IAIvB,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAmQxF;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IAQlG,YAAY,IAAI,IAAI;IAKpB,YAAY,IAAI,IAAI;IAKpB,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAI/D;;;OAGG;IACH,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAIjE,kEAAkE;IAClE,IAAI,QAAQ,IAAI,uBAAuB,GAAG,SAAS,CAElD;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIrC,4EAA4E;IAC5E,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBlD,IAAI,KAAK,IAAI,uBAAuB,CAEnC;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,eAAe,IAAI,oBAAoB,GAAG,SAAS,CAEtD;IAED;;;;OAIG;IACH,IAAI,SAAS,IAAI,kBAAkB,CAKlC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM;IAQjE;;;;OAIG;IACH,IAAI,gBAAgB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAElD;IAED;;;;;;OAMG;IACH,IAAI,qBAAqB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE/C;IAED;;;;;OAKG;IACH,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,uEAAuE;IACvE,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,gFAAgF;IAChF,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;OAGG;IACH,IAAI,OAAO,IAAI,cAAc,GAAG,SAAS,CAExC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAE1C;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAyEzD,IAAI,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE9D;IAED,OAAO,IAAI,IAAI;CA0KhB"}
+{"version":3,"file":"multicast-transport.d.ts","sourceRoot":"","sources":["../src/multicast-transport.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAIL,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAA;AASjC,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kGAAkG;IAClG,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAA;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC7C,qFAAqF;IACrF,KAAK,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjE;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,MAAM,0BAA0B,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAA;AAEpE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,0BAA0B,GAClC,UAAU,GACV,aAAa,GACb,YAAY,GACZ,iBAAiB,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,sBAAsB,CAAA;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GACrB;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;IAClB,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,0BAA0B,CAAA;CACpD,CAAA;AAEL;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,6BAA6B,EAAE,MAAM,CAAA;IACrC,uFAAuF;IACvF,yBAAyB,EAAE,MAAM,CAAA;IACjC;;;;;OAKG;IACH,uBAAuB,EAAE,MAAM,CAAA;IAC/B;;;;;;;;OAQG;IACH,2BAA2B,EAAE,MAAM,CAAA;CACpC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC,CAAA;CACxE;AAkID,qBAAa,kBAAkB,CAAC,cAAc,GAAG,KAAK;;IAuFpD;;;;OAIG;gBAED,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,IAAI,EAChE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,sBAAsB,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;KAAO;IAOzF,MAAM,CAAC,WAAW,IAAI,OAAO;IAIvB,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAkRxF;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,WAAW,GAAG,UAAU,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI;IASlG,YAAY,IAAI,IAAI;IAKpB,YAAY,IAAI,IAAI;IAKpB,UAAU,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIhC,UAAU,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAI/D;;;OAGG;IACH,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI;IAIjE,kEAAkE;IAClE,IAAI,QAAQ,IAAI,uBAAuB,GAAG,SAAS,CAElD;IAED;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI;IAIrC,4EAA4E;IAC5E,IAAI,aAAa,IAAI,OAAO,CAE3B;IAED,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAuBlD,IAAI,KAAK,IAAI,uBAAuB,CAEnC;IAED;;;;;;;;;;;;;;OAcG;IACH,IAAI,eAAe,IAAI,oBAAoB,GAAG,SAAS,CAEtD;IAED;;;;OAIG;IACH,IAAI,SAAS,IAAI,kBAAkB,CAKlC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,yBAAyB,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,MAAM;IAQjE;;;;OAIG;IACH,IAAI,gBAAgB,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAElD;IAED;;;;;;OAMG;IACH,IAAI,qBAAqB,IAAI,WAAW,CAAC,MAAM,CAAC,CAE/C;IAED;;;;;OAKG;IACH,IAAI,sBAAsB,IAAI,MAAM,CAEnC;IAED,uEAAuE;IACvE,IAAI,MAAM,IAAI,MAAM,GAAG,SAAS,CAE/B;IAED,gFAAgF;IAChF,IAAI,MAAM,IAAI,OAAO,CAEpB;IAED;;;OAGG;IACH,IAAI,OAAO,IAAI,cAAc,GAAG,SAAS,CAExC;IAED;;;OAGG;IACH,IAAI,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAE1C;IAED;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IASzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,YAAY,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAyEzD,IAAI,iBAAiB,IAAI,0BAA0B,GAAG,SAAS,CAE9D;IAED,OAAO,IAAI,IAAI;CAgMhB"}

package/dist/multicast-transport.js

@@ -1263,6 +1263,9 @@ var AMTGatewayManager = class {
    */
   async subscribe(config) {
     const { key } = config;
+    if (config.protected) {
+      throw new Error("AMTGatewayManager refuses a protected join: it reports no per-datagram sender (multicast-02 7.2.7)");
+    }
     const keyStr = this.getKeyString(key);
     if (this.subscriptions.has(keyStr)) {
       console.log(`[AMT] Reusing existing subscription to ${keyStr}`);
@@ -1437,6 +1440,73 @@ var FEC_BLOCK_PROFILES2 = Object.freeze([
   "iso-ssbg1-v1"
 ]);
 
+// ../mmt-base/dist/ip-address.js
+var DEC_OCTET = /^(?:0|[1-9]\d{0,2})$/;
+var H16 = /^[0-9A-Fa-f]{1,4}$/;
+function parseIpv4(text2) {
+  const fields = text2.split(".");
+  if (fields.length !== 4)
+    return void 0;
+  const octets = [];
+  for (const field of fields) {
+    if (!DEC_OCTET.test(field))
+      return void 0;
+    const value = Number(field);
+    if (value > 255)
+      return void 0;
+    octets.push(value);
+  }
+  return octets;
+}
+function parseIpv6(text2) {
+  const halves = text2.split("::");
+  if (halves.length > 2)
+    return void 0;
+  const groupsOf = (part) => part === "" ? [] : part.split(":");
+  const left = groupsOf(halves[0]);
+  const right = halves.length === 2 ? groupsOf(halves[1]) : [];
+  const words = [];
+  const all = [...left, ...right];
+  const last = halves.length === 2 && right.length === 0 ? -1 : all.length - 1;
+  for (let index = 0; index < all.length; index++) {
+    const group = all[index];
+    if (index === last && group.includes(".")) {
+      const v4 = parseIpv4(group);
+      if (!v4)
+        return void 0;
+      words.push([v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]]);
+    } else if (H16.test(group)) {
+      words.push([Number.parseInt(group, 16)]);
+    } else {
+      return void 0;
+    }
+  }
+  const leftWords = words.slice(0, left.length).flat();
+  const rightWords = words.slice(left.length).flat();
+  const missing = 8 - leftWords.length - rightWords.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0)
+    return void 0;
+  const out = new Uint8Array(16);
+  [...leftWords, ...new Array(missing).fill(0), ...rightWords].forEach((word, index) => {
+    out[index * 2] = word >> 8;
+    out[index * 2 + 1] = word & 255;
+  });
+  return out;
+}
+function parseIpAddressLiteral2(text2) {
+  if (typeof text2 !== "string")
+    return void 0;
+  if (text2.includes(":"))
+    return parseIpv6(text2);
+  const v4 = parseIpv4(text2);
+  return v4 ? Uint8Array.from(v4) : void 0;
+}
+function sameIpAddress(a, b) {
+  const x = parseIpAddressLiteral2(a);
+  const y = parseIpAddressLiteral2(b);
+  return x !== void 0 && y !== void 0 && x.length === y.length && x.every((octet, index) => octet === y[index]);
+}
+
 // ../mmt-base/dist/fec-bindings.js
 var RUNTIME_FEC_RECEIVER2 = Object.freeze({
   schemes: Object.freeze(["raptorq", "reed-solomon"]),
@@ -1444,6 +1514,17 @@ var RUNTIME_FEC_RECEIVER2 = Object.freeze({
   overlays: true
 });
 
+// ../mmt-manifest-verify/dist/bc-provenance-v2.js
+var BCPV2_HEADER_LENGTH = 68;
+var BCPV2_SIGNATURE_LENGTH = 64;
+var BCPV2_MIN_RECORD_LENGTH = BCPV2_HEADER_LENGTH + 32 + BCPV2_SIGNATURE_LENGTH;
+var text = new TextEncoder();
+var MAGIC = Uint8Array.from([77, 72, 77, 50]);
+function isBcpV2RecordCandidate(datagram) {
+  return datagram.byteLength >= 4 && datagram[0] === MAGIC[0] && datagram[1] === MAGIC[1] && datagram[2] === MAGIC[2] && datagram[3] === MAGIC[3];
+}
+var SIGNING_DOMAIN = text.encode("mcast-manifest-v2\0");
+
 // src/multicast-transport.ts
 var JOIN_SUCCEEDED = Object.freeze({ ok: true });
 function providerErrorOf(error) {
@@ -1545,6 +1626,11 @@ var MulticastTransport = class {
   // per packet once a count outgrows the small-integer range.
   #acceptedBytesByPacketId = /* @__PURE__ */ new Map();
   #packetIds = null;
+  #protected = false;
+  // A protected join's S, and the last sender spelling that matched it, so a
+  // matching sender parses once per spelling rather than per datagram.
+  #protectedSource = void 0;
+  #matchedSource = void 0;
   // The sender S this join's accepted packets came from, once known; see
   // packetsDroppedForeignSender. Cleared by every join and by a silence
   // failback, so a replacement publisher is not locked out.
@@ -1596,6 +1682,11 @@ var MulticastTransport = class {
       return this.#declined(generation, "unavailable");
     }
     let failure = "invalid-request";
+    const protectedSource = config.protected === true ? config.sourceAddress ?? config.senderAddress : void 0;
+    if (config.protected === true && (protectedSource === void 0 || config.atsc3)) {
+      console.warn("[MulticastTransport] protected join refused: the path reports no per-datagram sender to check against S");
+      return this.#declined(generation, "invalid-request");
+    }
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null;
       console.log(
@@ -1631,7 +1722,7 @@ var MulticastTransport = class {
       this.#subscription = subscription;
       const live = () => !this.#disposed && generation === this.#joinGeneration;
       const anySource = !config.sourceAddress && !config.senderAddress && !config.atsc3;
-      const packetListener = !anySource && subscriptionDeliversPacketBatches(subscription) ? {
+      const packetListener = !anySource && protectedSource === void 0 && subscriptionDeliversPacketBatches(subscription) ? {
         type: "packets",
         listener: (event) => {
           if (!live()) return;
@@ -1646,6 +1737,9 @@ var MulticastTransport = class {
       };
       this.#packetListener = packetListener;
       this.#packetIds = packetIds;
+      this.#protected = config.protected === true;
+      this.#protectedSource = protectedSource;
+      this.#matchedSource = void 0;
       this.#providerFilter = {
         acknowledged: packetIds,
         sent: 0,
@@ -1730,7 +1824,8 @@ var MulticastTransport = class {
   }
   /**
    * One packet from the subscription: filter, count, and hand it to the
-   * callback. Returns whether it was delivered; the caller notes liveness.
+   * callback. Returns whether it was delivered as liveness (a delivered record
+   * candidate is not); the caller notes liveness.
    */
   #deliver(detail, sourceAddress) {
     const packet = normalizeBytesEventDetail(detail);
@@ -1739,8 +1834,12 @@ var MulticastTransport = class {
       return false;
     }
     if (!this.#acceptPacket(packet, sourceAddress)) return false;
+    const liveness = !this.#isRecordCandidate(packet);
     this.#onPacket(packet, this.#context);
-    return true;
+    return liveness;
+  }
+  #isRecordCandidate(packet) {
+    return this.#protected && isBcpV2RecordCandidate(packet);
   }
   /**
    * One `packets` event. Each packet is delivered as a `bytes` event would
@@ -1788,8 +1887,9 @@ var MulticastTransport = class {
     if (this.#disposed) return;
     const packet = data instanceof Uint8Array ? data : new Uint8Array(data);
     if (!this.#acceptPacket(packet, sourceAddress)) return;
+    const liveness = !this.#isRecordCandidate(packet);
     this.#onPacket(packet, context);
-    this.#resetWatchdog();
+    if (liveness) this.#resetWatchdog();
   }
   confirmVideo() {
     this.#videoConfirmed = true;
@@ -2098,17 +2198,32 @@ var MulticastTransport = class {
     this.#resolvedTransport = void 0;
     this.#delivery = void 0;
     this.#packetIds = null;
+    this.#protected = false;
+    this.#protectedSource = void 0;
+    this.#matchedSource = void 0;
     this.#providerFilter = null;
     this.#context = void 0;
     this.#withdrawnPacketIds.clear();
   }
   /** The ingress filter; an accepted packet is counted here, once. */
   #acceptPacket(packet, sourceAddress) {
-    const owner = this.#lockedTo?.() ?? this.#sender;
+    const source = this.#protectedSource;
+    if (source !== void 0 && (sourceAddress === void 0 || sourceAddress !== this.#matchedSource)) {
+      if (sourceAddress === void 0 || !sameIpAddress(sourceAddress, source)) {
+        this.#stats.packetsDroppedForeignSender++;
+        return false;
+      }
+      this.#matchedSource = sourceAddress;
+    }
+    const owner = source === void 0 ? this.#lockedTo?.() ?? this.#sender : void 0;
     if (sourceAddress !== void 0 && owner !== void 0 && sourceAddress !== owner) {
       this.#stats.packetsDroppedForeignSender++;
       return false;
     }
+    if (this.#isRecordCandidate(packet)) {
+      this.#countAccepted(packet, null, void 0);
+      return true;
+    }
     const packetId = readMMTPPacketId(packet);
     if (packetId === null) {
       if (!this.#packetIds) {