@blockcast/mmt-container 1.0.1 → 2.0.0-main.609e08d7e29f

package/dist/no-modules.js

@@ -319,14 +319,11 @@ function readRepairFecPayloadIdFields(mmtpPacket, parsedHeader) {
     dataOffset: off + REPAIR_FEC_PID_SIZE
   };
 }
-function parseMoqRepairFrameWithHeader(frame, header) {
-  return moqRepairFrameFrom(frame, readRepairFecPayloadIdFields(frame, header));
-}
-function moqRepairFrameFrom(frame, repairId) {
+function moqRepairFrameFrom(frame, repairId, checkRsId = true) {
   if (!repairId)
     return null;
   const symbolData = frame.subarray(repairId.dataOffset);
-  if (repairId.rsbLength === 0 || repairId.ssbLength === 0 || repairId.rsId >= repairId.rsbLength || symbolData.length === 0)
+  if (repairId.ssbLength === 0 || checkRsId && repairId.rsId >= repairId.rsbLength || symbolData.length === 0)
     return null;
   return {
     packetId: repairId.packetId,
@@ -337,6 +334,23 @@ function moqRepairFrameFrom(frame, repairId) {
     symbolData
   };
 }
+function admitMmtpRepairObject(packet, header, symbolSize, algorithm) {
+  if (header.packetType !== PACKET_TYPE_REPAIR || header.fecType !== 2)
+    return null;
+  if (header.headerLength !== MMTP_HEADER_SIZE || packet.length !== MMTP_HEADER_SIZE + REPAIR_FEC_PID_SIZE + symbolSize) {
+    return { reject: "repairLength" };
+  }
+  const frame = moqRepairFrameFrom(packet, readRepairFecPayloadIdFields(packet, header), false);
+  if (!frame)
+    return null;
+  if (frame.rsId >= frame.rsbLength)
+    return { frame, reject: "repairRsId" };
+  const blockSymbols = frame.ssbLength + frame.rsbLength;
+  if (algorithm === "reed-solomon" ? blockSymbols > 255 : algorithm === "raptorq" && blockSymbols - 1 > 16777215) {
+    return { frame, reject: "repairSchemeBound" };
+  }
+  return { frame };
+}
 
 // ../mmt-base/dist/net-constants.js
 var DEFAULT_AMT_RELAY_PORT = 2268;
@@ -414,254 +428,6 @@ function isoBlocksBehindLowerBound(a, b, kMax) {
   return serial32Precedes(a, b) ? Math.floor(serial32Distance(a, b) / kMax) : 0;
 }
 
-// ../mmt-base/dist/multicast-catalog.js
-var ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
-var UINT32_MAX = 4294967295;
-var AUTH_MEMBERS = /* @__PURE__ */ new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
-var KEY_MEMBERS = /* @__PURE__ */ new Set(["kid", "publicKey", "firstEpoch"]);
-var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
-  "manifestPort",
-  "streamId",
-  "senderAddress",
-  "maxAuthDelayMs",
-  "manifestTimerMs",
-  "manifestTrack"
-]);
-function isObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-function isIntegerIn(value, min, max) {
-  return Number.isSafeInteger(value) && value >= min && value <= max;
-}
-function multicastEndpointSource(endpoint) {
-  if (!isObject(endpoint))
-    return void 0;
-  const sourceAddress = endpoint["sourceAddress"];
-  if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress))
-    return void 0;
-  const mode = sourceAddress === void 0 ? "asm" : "ssm";
-  const protocol = endpoint["protocol"];
-  if (protocol !== void 0 && protocol !== mode)
-    return void 0;
-  const auth = endpoint["auth"];
-  const senderAddress = isObject(auth) ? auth["senderAddress"] : void 0;
-  if (mode === "ssm")
-    return senderAddress === void 0 ? { mode, source: sourceAddress } : void 0;
-  if (auth === void 0)
-    return { mode };
-  return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : void 0;
-}
-function authIssues(auth) {
-  const base = "$.multicast.auth";
-  const issue = (path, message) => [
-    { code: "multicast_auth", path: `${base}${path}`, message }
-  ];
-  if (!isObject(auth))
-    return issue("", "auth must be an object");
-  const unknown = Object.keys(auth).filter((key) => !AUTH_MEMBERS.has(key));
-  if (unknown.length > 0) {
-    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
-  }
-  if (auth["scheme"] !== "bc-provenance")
-    return issue(".scheme", 'scheme must be "bc-provenance"');
-  if (auth["version"] !== 2)
-    return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
-  if (auth["sig"] !== "ed25519")
-    return issue(".sig", 'sig must be "ed25519"');
-  const keys = auth["keys"];
-  if (!Array.isArray(keys) || keys.length < 1 || keys.length > 4) {
-    return issue(".keys", "keys must be an array of one to four {kid, publicKey, firstEpoch} objects");
-  }
-  const kids = /* @__PURE__ */ new Set();
-  const firstEpochs = /* @__PURE__ */ new Set();
-  for (let index = 0; index < keys.length; index++) {
-    const key = keys[index];
-    const at = `.keys[${index}]`;
-    if (!isObject(key) || Object.keys(key).some((member) => !KEY_MEMBERS.has(member))) {
-      return issue(at, "a key is exactly {kid, publicKey, firstEpoch}");
-    }
-    if (!isIntegerIn(key["kid"], 0, UINT32_MAX))
-      return issue(`${at}.kid`, "kid must be an unsigned 32-bit integer");
-    if (typeof key["publicKey"] !== "string" || !ED25519_PUBLIC_KEY_BASE64URL.test(key["publicKey"])) {
-      return issue(`${at}.publicKey`, "publicKey must be a 32-octet Ed25519 key in canonical unpadded base64url");
-    }
-    if (!isIntegerIn(key["firstEpoch"], 0, UINT32_MAX)) {
-      return issue(`${at}.firstEpoch`, "firstEpoch must be an unsigned 32-bit integer");
-    }
-    if (kids.has(key["kid"]))
-      return issue(`${at}.kid`, `kid ${key["kid"]} is repeated; the catalog holds no key set`);
-    if (firstEpochs.has(key["firstEpoch"])) {
-      return issue(`${at}.firstEpoch`, `firstEpoch ${key["firstEpoch"]} is repeated; the catalog holds no key set`);
-    }
-    kids.add(key["kid"]);
-    firstEpochs.add(key["firstEpoch"]);
-  }
-  if (!isIntegerIn(auth["minEpoch"], 0, UINT32_MAX)) {
-    return issue(".minEpoch", "minEpoch must be an unsigned 32-bit integer");
-  }
-  return [];
-}
-function endpointAuthIssue(endpoint, mode, at) {
-  const auth = endpoint["auth"];
-  if (!isObject(auth))
-    return { path: `${at}.auth`, message: "auth must be an object" };
-  const unknown = Object.keys(auth).filter((key) => !ENDPOINT_AUTH_MEMBERS.has(key));
-  if (unknown.length > 0)
-    return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
-  if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
-    return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
-  }
-  if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
-    return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
-  }
-  if (mode === "ssm" && auth["senderAddress"] !== void 0) {
-    return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
-  }
-  if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
-    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
-  }
-  if (auth["maxAuthDelayMs"] !== void 0 && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1e3)) {
-    return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
-  }
-  if (auth["manifestTimerMs"] !== void 0 && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
-  }
-  if (auth["manifestTrack"] !== void 0 && !isNonEmptyString(auth["manifestTrack"])) {
-    return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
-  }
-  if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
-  }
-  return void 0;
-}
-var CATALOG_NAMESPACE = /* @__PURE__ */ Symbol.for("@blockcast/mmt-base/catalogNamespace");
-function multicastCatalogIssues(catalog, options = {}) {
-  if (!isObject(catalog))
-    return [];
-  const issues = [];
-  if ("multicast.auth" in catalog) {
-    issues.push({
-      code: "multicast_auth",
-      path: '$["multicast.auth"]',
-      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)'
-    });
-  }
-  const multicast = catalog["multicast"];
-  if (!isObject(multicast))
-    return issues;
-  const protectedCatalog = multicast["auth"] !== void 0;
-  if (protectedCatalog)
-    issues.push(...authIssues(multicast["auth"]));
-  const endpoints = multicast["endpoints"];
-  if (!Array.isArray(endpoints))
-    return issues;
-  const tracks = Array.isArray(catalog["tracks"]) ? catalog["tracks"] : [];
-  const namespaceOf = /* @__PURE__ */ new Map();
-  for (const track of tracks) {
-    if (isObject(track) && typeof track["name"] === "string")
-      namespaceOf.set(track["name"], track["namespace"]);
-  }
-  const tagged = catalog[CATALOG_NAMESPACE];
-  let referenceNamespace = options.catalogNamespace ?? (typeof tagged === "string" ? tagged : void 0);
-  const sources = [];
-  for (let index = 0; index < endpoints.length; index++) {
-    const endpoint = endpoints[index];
-    const at = `$.multicast.endpoints[${index}]`;
-    const fail = (code, path, message) => {
-      issues.push({ code, path, message, endpointIndex: index });
-    };
-    sources.push(void 0);
-    if (!isObject(endpoint)) {
-      fail("multicast_endpoint", at, "endpoint must be an object");
-      continue;
-    }
-    const protocol = endpoint["protocol"];
-    if (protocol !== void 0 && protocol !== "ssm" && protocol !== "asm") {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
-      continue;
-    }
-    const hasAuth = endpoint["auth"] !== void 0;
-    if (protectedCatalog !== hasAuth) {
-      fail("multicast_endpoint_auth", `${at}.auth`, protectedCatalog ? "every endpoint requires auth when multicast carries auth; a receiver ignores this endpoint" : "auth names no key without multicast.auth; a receiver ignores this endpoint");
-      continue;
-    }
-    const sourceAddress = endpoint["sourceAddress"];
-    if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress)) {
-      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
-      continue;
-    }
-    const mode = sourceAddress === void 0 ? "asm" : "ssm";
-    if (protocol !== void 0 && protocol !== mode) {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol ${JSON.stringify(protocol)} disagrees with sourceAddress, which selects ${mode}`);
-      continue;
-    }
-    if (!isIntegerIn(endpoint["port"], 1, 65535)) {
-      fail("multicast_endpoint", `${at}.port`, "port must be an integer from 1 to 65535");
-      continue;
-    }
-    if (hasAuth) {
-      const authIssue = endpointAuthIssue(endpoint, mode, at);
-      if (authIssue) {
-        fail("multicast_endpoint_auth", authIssue.path, authIssue.message);
-        continue;
-      }
-    }
-    sources[index] = multicastEndpointSource(endpoint);
-    const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
-    for (let refIndex = 0; refIndex < refs.length; refIndex++) {
-      const ref = refs[refIndex];
-      const name = isObject(ref) ? ref["name"] : ref;
-      if (typeof name !== "string")
-        continue;
-      const namespace = namespaceOf.get(name);
-      if (typeof namespace !== "string")
-        continue;
-      referenceNamespace ??= namespace;
-      if (namespace !== referenceNamespace) {
-        fail("multicast_track", `${at}.tracks[${refIndex}].name`, `track ${JSON.stringify(name)} declares namespace ${JSON.stringify(namespace)}, not the catalog track's ${JSON.stringify(referenceNamespace)}`);
-      }
-    }
-  }
-  const tupleOf = (index) => {
-    const endpoint = endpoints[index];
-    const auth = endpoint["auth"];
-    return {
-      sg: JSON.stringify([sources[index].source ?? null, endpoint["groupAddress"]]),
-      port: endpoint["port"],
-      manifestPort: isObject(auth) ? auth["manifestPort"] : void 0
-    };
-  };
-  for (let index = 0; index < endpoints.length; index++) {
-    if (!sources[index])
-      continue;
-    const own = tupleOf(index);
-    const at = `$.multicast.endpoints[${index}]`;
-    if (own.manifestPort !== void 0 && own.manifestPort === own.port) {
-      issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
-      continue;
-    }
-    for (let other = 0; other < endpoints.length; other++) {
-      if (other === index || !sources[other])
-        continue;
-      const peer = tupleOf(other);
-      if (peer.sg !== own.sg)
-        continue;
-      if (peer.port === own.port) {
-        issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
-        break;
-      }
-      if (own.manifestPort !== void 0 && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
-        issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
-        break;
-      }
-    }
-  }
-  return issues;
-}
-
 // ../mmt-base/dist/fec-catalog.js
 var DEFAULT_SCHEMES = ["reed-solomon", "raptorq"];
 var DEFAULT_PROFILES = ["moq-object-v1", "iso-ssbg1-v1"];
@@ -7962,7 +7728,7 @@ function validateNetworkSourceRelays(sources, path) {
     }
   });
 }
-function validateCmsfMmtpCatalog(value, options = {}) {
+function validateCmsfMmtpCatalog(value, _options = {}) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     catalogError("catalog_object", "$", "catalog must be an object");
   }
@@ -8153,8 +7919,6 @@ function validateCmsfMmtpCatalog(value, options = {}) {
       }
     }
   }
-  const [multicastIssue] = multicastCatalogIssues(catalog, options);
-  if (multicastIssue) catalogError(multicastIssue.code, multicastIssue.path, multicastIssue.message);
   validateArchive(catalog);
   return catalog;
 }
@@ -8233,6 +7997,9 @@ var HeldLayerAdmission = class {
    * @returns undefined to admit, `'discard'`, or the fail-closed reason.
    */
   admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
+    return this.#admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, true);
+  }
+  #admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, retroactive) {
     if (repairTrackName !== void 0 && !this.#layerNames.has(repairTrackName)) return "discard";
     const farAhead = sourceFrontier !== void 0 && serial32Precedes(sourceFrontier, ssStart) && serial32Distance(sourceFrontier, ssStart) > horizon;
     for (const state of this.#states) {
@@ -8260,7 +8027,7 @@ var HeldLayerAdmission = class {
           }
         } else if (!state.settled && !stale(ssStart)) {
           if (state.anchor === void 0 || serial32Precedes(ssStart, state.anchor)) state.anchor = ssStart;
-          if (state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
+          if (retroactive && state.latestBelow !== void 0 && !serial32Precedes(state.latestBelow, state.anchor)) {
             code = "below_anchored_total";
             ssStart = state.latestBelow;
             rsbLength = state.latestBelowRsb;
@@ -8280,6 +8047,24 @@ var HeldLayerAdmission = class {
     }
     return void 0;
   }
+  /**
+   * The core-00 7.5 carve-out for a repair object about to be discarded
+   * (RS_ID or scheme bound): whether its own RSB_length, below a held layer's
+   * total on that layer's track or on an anchored block, fails the instance
+   * closed under 7.3.2. Leaves the anchored state as it was: a discarded
+   * object anchors nothing.
+   */
+  failsClosed(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier) {
+    const saved = this.#states.map((state) => ({ ...state }));
+    try {
+      const verdict = this.#admit(repairTrackName, ssStart, rsbLength, horizon, sourceFrontier, false);
+      return typeof verdict === "object" ? verdict : void 0;
+    } finally {
+      saved.forEach((state, i) => {
+        this.#states[i] = state;
+      });
+    }
+  }
 };
 
 // src/mmtp-fec-session.ts
@@ -8450,18 +8235,29 @@ var MmtpFecSession = class {
     } catch {
       return this.#drop("repair:malformed");
     }
-    const frame = parseMoqRepairFrameWithHeader(packet, header);
-    if (!frame) return this.#drop("repair:malformed");
-    if (this.#repairPacketId === void 0) {
-      this.#repairPacketId = frame.packetId;
-    } else if (frame.packetId !== this.#repairPacketId) {
+    const admission = admitMmtpRepairObject(packet, header, this.symbolSize, this.algorithm);
+    if (!admission) return this.#drop("repair:malformed");
+    if (!("frame" in admission)) return this.#drop("repair:length");
+    const frame = admission.frame;
+    if (this.#repairPacketId !== void 0 && frame.packetId !== this.#repairPacketId) {
       return this.#drop("repair:foreign-packet-id");
     }
-    if (frame.symbolData.byteLength !== this.symbolSize) return this.#drop("repair:symbol-size");
-    if (frame.ssbLength > this.sourceSymbols) return this.#drop("repair:ssb-length");
-    if (this.algorithm === "reed-solomon" && frame.ssbLength + frame.rsbLength > 255) {
-      return this.#drop("repair:rs-block-length");
+    if (admission.reject) {
+      const verdict2 = this.#heldLayers.failsClosed(
+        repairTrackName,
+        frame.ssStart,
+        frame.rsbLength,
+        this.#anchorHorizon,
+        this.#newestSource
+      );
+      if (verdict2) {
+        this.#stats.failClosed = verdict2;
+        return this.#drop("repair:fail-closed");
+      }
+      return this.#drop(admission.reject === "repairRsId" ? "repair:rs-id" : "repair:scheme-bound");
     }
+    this.#repairPacketId ??= frame.packetId;
+    if (frame.ssbLength > this.sourceSymbols) return this.#drop("repair:ssb-length");
     const verdict = this.#heldLayers.admit(
       repairTrackName,
       frame.ssStart,
@@ -8736,8 +8532,8 @@ function u32(v) {
 }
 var KEYFRAME_FLAGS = 33554432;
 var DELTA_FLAGS = 16842752;
-var UINT32_MAX2 = 4294967295;
-var MAX_TRACK_ID = UINT32_MAX2 - 1;
+var UINT32_MAX = 4294967295;
+var MAX_TRACK_ID = UINT32_MAX - 1;
 var INT32_MIN = -2147483648;
 var INT32_MAX = 2147483647;
 function assertTrackId(trackId, label) {
@@ -8746,8 +8542,8 @@ function assertTrackId(trackId, label) {
   }
 }
 function assertTimescale(timescale, label) {
-  if (!Number.isInteger(timescale) || timescale <= 0 || timescale > UINT32_MAX2) {
-    throw new RangeError(`${label} must be an integer in 1..${UINT32_MAX2}, got ${timescale}`);
+  if (!Number.isInteger(timescale) || timescale <= 0 || timescale > UINT32_MAX) {
+    throw new RangeError(`${label} must be an integer in 1..${UINT32_MAX}, got ${timescale}`);
   }
 }
 function assertCompositionTimeOffsets(samples) {
@@ -10060,6 +9856,11 @@ function parseIpv6(address) {
   const [leftText, rightText = ""] = address.split("::");
   const left = leftText ? leftText.split(":") : [];
   const right = rightText ? rightText.split(":") : [];
+  const tail = compressed ? right : left;
+  if (tail.length > 0 && tail[tail.length - 1].includes(".")) {
+    const v4 = parseIpv4(tail.pop());
+    tail.push((v4[0] << 8 | v4[1]).toString(16), (v4[2] << 8 | v4[3]).toString(16));
+  }
   if (left.some((group) => group.includes(".")) || right.some((group) => group.includes("."))) {
     throw new Error(`invalid IPv6 address ${address}`);
   }
@@ -10082,7 +9883,7 @@ function parseBcProvenanceV2Address(address) {
   return parseIpv4(address);
 }
 function endpointBytes(endpoint) {
-  if (!validPort(endpoint.port) || !validPort(endpoint.manifestPort) || !validU32(endpoint.streamId)) {
+  if (!validPort(endpoint.port) || !validU32(endpoint.streamId)) {
     throw new Error("invalid BCPV2 endpoint");
   }
   const source = parseBcProvenanceV2Address(endpoint.sourceAddress);
@@ -10142,7 +9943,7 @@ function bcProvenanceV2SignedMessage(record, endpoint) {
   offset += source.byteLength;
   prefix.set(group, offset);
   offset += group.byteLength;
-  prefix.set(u16(endpoint.manifestPort), offset);
+  prefix.set(u16(endpoint.port), offset);
   const message = new Uint8Array(prefix.byteLength + record.body.byteLength);
   message.set(prefix);
   message.set(record.body, prefix.byteLength);
@@ -11653,7 +11454,6 @@ _RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
 var BCPV2_LEAD_BOUND_MS = 5e3;
 var REPLAY_WINDOW = 64n;
 var BUCKET_DEPTH = 64;
-var BUCKET_RATE_PER_MS = 1;
 var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 function sameBytes(a, b) {
   if (a.byteLength !== b.byteLength)
@@ -11682,6 +11482,10 @@ var BcProvenanceV2Receiver = class {
   verifySig;
   accepted;
   queueLimit;
+  /** Octets a held datagram is charged beyond its payload: the IPv4 or IPv6 plus UDP headers (step 2). */
+  headerOctets;
+  /** Budget refill, tokens per ms: V / 1000 (step 1). */
+  bucketRatePerMs;
   current = null;
   previous = null;
   graceStart = {};
@@ -11697,10 +11501,12 @@ var BcProvenanceV2Receiver = class {
   order = 0;
   buckets;
   constructor(cfg) {
-    this.maxAuthDelayMs = cfg.maxAuthDelayMs ?? 200;
-    this.manifestTimerMs = cfg.manifestTimerMs ?? 20;
-    if (!(this.maxAuthDelayMs >= 50 && this.maxAuthDelayMs <= 1e3) || !(this.manifestTimerMs >= 1)) {
-      throw new Error("BCPV2 endpoint ignored: maxAuthDelayMs or manifestTimerMs out of range");
+    const delay = cfg.maxAuthDelayMs;
+    this.maxAuthDelayMs = typeof delay !== "number" || !Number.isFinite(delay) ? 200 : delay < 50 ? 50 : delay > 1e3 ? 1e3 : Number.isInteger(delay) ? delay : 200;
+    const timer = cfg.manifestTimerMs;
+    this.manifestTimerMs = typeof timer !== "number" || !Number.isFinite(timer) ? 20 : timer < 1 || Number.isInteger(timer) ? timer : 20;
+    if (!(this.manifestTimerMs >= 1)) {
+      throw new Error("BCPV2 endpoint ignored: manifestTimerMs below 1");
     }
     if (!(cfg.bandwidth > 0))
       throw new Error("BCPV2 endpoint ignored: protected endpoint without bandwidth");
@@ -11725,6 +11531,8 @@ var BcProvenanceV2Receiver = class {
       multicast: this.maxAuthDelayMs * bandwidth / 8e3,
       unicast: (this.maxAuthDelayMs + this.widenMs) * bandwidth / 8e3
     };
+    this.headerOctets = parseBcProvenanceV2Address(cfg.endpoint.groupAddress).byteLength === 16 ? 48 : 28;
+    this.bucketRatePerMs = Math.max(1e3, 1.25 * bandwidth / (8 * 512 * 37)) / 1e3;
     const t = this.now();
     this.buckets = {
       multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
@@ -11740,7 +11548,7 @@ var BcProvenanceV2Receiver = class {
       return 0;
     return this.lead ?? BCPV2_LEAD_BOUND_MS;
   }
-  /** Step 1: a record datagram on `manifestPort`, or a record object of the manifest track. */
+  /** Step 1: a record datagram on `port`, or a record object of the manifest track. */
   onRecord(bytes, path) {
     const now = this.now();
     this.expire(now);
@@ -11823,7 +11631,7 @@ var BcProvenanceV2Receiver = class {
       arrival: now,
       sent,
       digest: hex(sha2562(bytes)),
-      pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+      pairs: record.digests.map((d, i) => ({ digest: hex(d), epoch, seq: record.firstSeq + BigInt(i), admitted: false })),
       awaitingMulticast: path === "mirror"
     };
     this.verified.set(id, entry);
@@ -11890,12 +11698,12 @@ var BcProvenanceV2Receiver = class {
   digest(datagram) {
     return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
   }
-  /** Consume the lowest-seq pending entry for `digest`, admitting it. */
+  /** Consume the pending entry for `digest` lowest in (epoch, sequence) order, admitting it. */
   consumePending(digest, now) {
     const list = this.pending.get(digest);
     if (!list?.length)
       return false;
-    list.sort((a, b) => a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0);
+    list.sort((a, b) => a.pair.epoch - b.pair.epoch || (a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0));
     const hit = list.shift();
     if (list.length === 0)
       this.pending.delete(digest);
@@ -11904,14 +11712,18 @@ var BcProvenanceV2Receiver = class {
     this.admittedUntil.set(digest, now + this.maxAuthDelayMs + this.leadMs);
     return true;
   }
+  /** A held datagram's charge against its queue: payload plus IP and UDP headers. */
+  charge(held) {
+    return held.datagram.byteLength + this.headerOctets;
+  }
   enqueue(held, path, now) {
-    if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+    if (this.holdBytes[path] + this.charge(held) > this.queueLimit[path]) {
       return { verdict: "overflow", admitted: [] };
     }
     held.expiry = now + this.maxAuthDelayMs + (path === "unicast" ? this.widenMs : 0);
     held.order = this.order++;
     this.hold[path].push(held);
-    this.holdBytes[path] += held.datagram.byteLength;
+    this.holdBytes[path] += this.charge(held);
     return { verdict: "held", admitted: [] };
   }
   /** Remove and return the oldest held datagram with `digest`, across both queues. */
@@ -11926,7 +11738,7 @@ var BcProvenanceV2Receiver = class {
     if (!best)
       return void 0;
     const [held] = this.hold[best.path].splice(best.index, 1);
-    this.holdBytes[best.path] -= held.datagram.byteLength;
+    this.holdBytes[best.path] -= this.charge(held);
     return held.datagram;
   }
   dropAdmittedHeld() {
@@ -11934,7 +11746,7 @@ var BcProvenanceV2Receiver = class {
       this.hold[path] = this.hold[path].filter((h) => {
         const keep = h.digest === void 0 || !this.admittedUntil.has(h.digest);
         if (!keep)
-          this.holdBytes[path] -= h.datagram.byteLength;
+          this.holdBytes[path] -= this.charge(h);
         return keep;
       });
     }
@@ -12018,7 +11830,7 @@ var BcProvenanceV2Receiver = class {
   }
   take(path, now) {
     const b = this.buckets[path];
-    b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+    b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * this.bucketRatePerMs);
     b.last = now;
     if (b.tokens < 1) {
       b.dropped++;
@@ -12032,7 +11844,7 @@ var BcProvenanceV2Receiver = class {
       this.hold[path] = this.hold[path].filter((h) => {
         if (h.expiry > now)
           return true;
-        this.holdBytes[path] -= h.datagram.byteLength;
+        this.holdBytes[path] -= this.charge(h);
         this.expired[path]++;
         return false;
       });
@@ -12064,7 +11876,7 @@ var BcProvenanceV2Receiver = class {
   }
   /**
    * Retire verified entries below their arrival path's replay floor, keeping a mirrored entry
-   * while the freshness check would still pass its copy on `manifestPort`.
+   * while the freshness check would still pass its copy on `port`.
    * ponytail: linear scan per record; index by (kid, epoch) if retained sets grow past a few thousand.
    */
   prune(now) {