@blockcast/mmt-container 1.0.1 → 2.0.0-main.609e08d7e29f

package/src/multicast-auth-catalog.ts

@@ -1,7 +1,8 @@
 /**
  * `multicast.auth` and an endpoint's `auth`: bc-provenance version 2, per
- * draft-ramadan-moq-multicast-01 7.2.6 at
- * Blockcast/moqcast-draft@fd962fd73d21ed281b60219c11ea61cc9e4e91c4.
+ * draft-ramadan-moq-multicast-02 7.2.6 at Blockcast/moqcast-draft@5f49172.
+ * Records ride in band on the flow's own `port` (7.2.3); draft -01's separate
+ * record port is gone.
  *
  * The block lives in the `multicast` object, never the root: the root dotted
  * key `"multicast.auth"` was draft -00's (libmmt called its `tracks[]` shape
@@ -15,7 +16,13 @@
  * the transport receivers; this module decodes what they admit.
  */
 
-import { multicastCatalogIssues } from "@blockcast/mmt-base";
+import {
+	BCP_DEFAULT_MANIFEST_TIMER_MS,
+	BCP_DEFAULT_MAX_AUTH_DELAY_MS,
+	canonicalIpAddress,
+	endpointAuthTiming,
+	multicastCatalogIssues,
+} from "@blockcast/mmt-base";
 import { bcProvenanceV2Ctx, type BcProvenanceV2Params, type BcpV2Key } from "@blockcast/mmt-manifest-verify";
 
 export type MulticastAuthScheme = "bc-provenance";
@@ -24,8 +31,8 @@ export type MulticastAuthSig = "ed25519";
 const RAW_ED25519_KEY_LENGTH = 32;
 
 /** Default `maxAuthDelayMs` and `manifestTimerMs` of an endpoint's `auth`. */
-export const DEFAULT_MAX_AUTH_DELAY_MS = 200;
-export const DEFAULT_MANIFEST_TIMER_MS = 20;
+export const DEFAULT_MAX_AUTH_DELAY_MS = BCP_DEFAULT_MAX_AUTH_DELAY_MS;
+export const DEFAULT_MANIFEST_TIMER_MS = BCP_DEFAULT_MANIFEST_TIMER_MS;
 
 const BASE64URL_ALPHABET =
 	"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
@@ -118,15 +125,13 @@ export interface MulticastAuthConfig {
 
 /** An endpoint's `auth` (7.2.6). A protected endpoint also declares `bandwidth`. */
 export interface EndpointAuthConfig {
-	/** Destination port of the record datagrams on the endpoint's `(S, G)`. */
-	manifestPort: number;
 	/** u32 chosen per channel generation. */
 	streamId: number;
 	/** `S` of a protected ASM endpoint; never on SSM. */
 	senderAddress?: string;
-	/** 50..1000, default 200. */
+	/** 50..1000, default 200; a receiver clamps one outside the range. */
 	maxAuthDelayMs?: number;
-	/** At least 1, default 20. */
+	/** At least 1, default 20; a receiver ignores the endpoint below 1. */
 	manifestTimerMs?: number;
 	/** MoQ track mirroring the records. */
 	manifestTrack?: string;
@@ -142,12 +147,13 @@ export function isMulticastAuthConfig(obj: unknown): obj is MulticastAuthConfig
 export interface ResolvedMulticastAuthFlow {
 	/** Index of the endpoint in `multicast.endpoints`. */
 	endpointIndex: number;
-	/** `S`: `sourceAddress` on SSM, `auth.senderAddress` on ASM. */
+	/** `S`: `sourceAddress` on SSM, `auth.senderAddress` on ASM; canonical (`canonicalIpAddress`). */
 	source: string;
+	/** Canonical (`canonicalIpAddress`). */
 	groupAddress: string;
+	/** The flow's port; its records ride in band on it (7.2.3). */
 	port: number;
 	bandwidth: number;
-	manifestPort: number;
 	streamId: number;
 	maxAuthDelayMs: number;
 	manifestTimerMs: number;
@@ -221,15 +227,13 @@ export function resolveMulticastAuthCatalog(
 		}
 		flows.push({
 			endpointIndex,
-			source: (endpoint["sourceAddress"] ?? flowAuth.senderAddress) as string,
-			groupAddress: endpoint["groupAddress"] as string,
+			source: canonicalIpAddress(endpoint["sourceAddress"] ?? flowAuth.senderAddress)!,
+			groupAddress: canonicalIpAddress(endpoint["groupAddress"])!,
 			port: endpoint["port"] as number,
 			bandwidth: endpoint["bandwidth"] as number,
-			manifestPort: flowAuth.manifestPort,
 			streamId: flowAuth.streamId,
-			maxAuthDelayMs: flowAuth.maxAuthDelayMs ?? DEFAULT_MAX_AUTH_DELAY_MS,
-			manifestTimerMs: flowAuth.manifestTimerMs ?? DEFAULT_MANIFEST_TIMER_MS,
-			...(flowAuth.manifestTrack === undefined ? {} : { manifestTrack: flowAuth.manifestTrack }),
+			// Clamped, or the defaults where absent (7.2.6).
+			...endpointAuthTiming(flowAuth),
 			tracks,
 			...(ctx === undefined ? {} : { ctx }),
 		});
@@ -249,46 +253,49 @@ function positiveInteger(value: unknown): number {
 }
 
 /**
- * `params_hash` inputs (7.2.4): the catalog entry of the endpoint's
- * lowest-`packetId` media track or, for a repair-only endpoint, of the source
- * its lowest-`packetId` repair track repairs (`depends`, else the track whose
- * `fec.repairTrack` names it). A timescale or group duration that does not
- * resolve to an integer tick count is `0`.
+ * `params_hash` inputs (multicast-02 7.2.4): the catalog entry of the
+ * endpoint's lowest-`packetId` media track or, for a repair-only endpoint, of
+ * the source its lowest-`packetId` repair track repairs (its `source`, else
+ * the track one of whose `fec` instances names it as `repairTrack`). A
+ * timescale or group duration that does not resolve to an integer tick count
+ * is `0`. An instance naming the reserved scheme "none" (fec-core-00 15.2)
+ * has no params_hash, so its endpoint is ignored like one with no entry.
  */
 function ctxParams(
 	catalogTracks: Array<Record<string, unknown>>,
 	listed: Array<{ name: string; packetId: number }>,
 ): BcProvenanceV2Params | undefined {
 	const byName = new Map(catalogTracks.map((track) => [track["name"], track]));
+	const instancesOf = (track: Record<string, unknown>): Array<Record<string, unknown>> =>
+		Array.isArray(track["fec"]) ? (track["fec"] as unknown[]).filter((f): f is Record<string, unknown> => typeof f === "object" && f !== null) : [];
 	const ordered = [...listed].sort((a, b) => a.packetId - b.packetId).map(({ name }) => byName.get(name));
 	let entry = ordered.find((track) => track !== undefined && track["packaging"] !== "fec-repair");
 	if (entry === undefined) {
 		const repair = ordered.find((track) => track !== undefined);
 		if (repair === undefined) return undefined;
-		const depends = repair["depends"];
-		entry = Array.isArray(depends) && depends.length === 1
-			? byName.get(depends[0])
-			: catalogTracks.find((track) => (track["fec"] as Record<string, unknown> | undefined)?.["repairTrack"] === repair["name"]);
+		entry = typeof repair["source"] === "string"
+			? byName.get(repair["source"])
+			: catalogTracks.find((track) => instancesOf(track).some((f) => f["repairTrack"] === repair["name"]));
 		if (entry === undefined) return undefined;
 	}
+	const instances = instancesOf(entry);
+	if (instances.some((f) => f["scheme"] === "none")) return undefined;
 	const timescale = positiveInteger(entry["timescale"]);
 	const ms = positiveInteger(entry["groupDurationMs"]);
 	const groupDurationTicks = positiveInteger(entry["groupDurationTicks"]) ||
 		positiveInteger(timescale && (ms * timescale) % 1000 === 0 ? (ms * timescale) / 1000 : 0);
-	const fec = entry["fec"] as Record<string, unknown> | undefined;
 	return {
 		codec: typeof entry["codec"] === "string" ? entry["codec"] : "",
 		timescale,
 		groupDurationTicks,
-		...(fec === undefined || fec === null ? {} : {
-			fec: {
-				algorithm: typeof fec["algorithm"] === "string" ? fec["algorithm"] : "",
-				sourceSymbols: positiveInteger(fec["sourceSymbols"]),
-				repairSymbols: positiveInteger(fec["repairSymbols"]),
-				symbolSize: positiveInteger(fec["symbolSize"]),
-				interleaveDepthMs: positiveInteger(fec["interleaveDepthMs"]),
-			},
-		}),
+		fec: instances.map((f) => ({
+			instanceId: typeof f["instanceId"] === "number" ? f["instanceId"] : 0,
+			scheme: typeof f["scheme"] === "string" ? f["scheme"] : "",
+			sourceSymbols: positiveInteger(f["sourceSymbols"]),
+			repairSymbols: positiveInteger(f["repairSymbols"]),
+			symbolSize: positiveInteger(f["symbolSize"]),
+			interleaveDepthMs: positiveInteger(f["interleaveDepthMs"]),
+		})),
 	};
 }
 

package/src/multicast-input.ts

@@ -36,10 +36,13 @@ declare const process: { env: Record<string, string | undefined> } | undefined;
  *     per-endpoint `relayAddress` input is LIFTED into the AMT entry.
  *   - Native "ssm" | "asm" requires no `networkSource` entry: a native join
  *     describes no alternate bearer (BLO-37926).
- *   - `auth` (catalog) and endpoint `auth` follow draft -01 7.2.6 through the
+ *   - `auth` (catalog) and endpoint `auth` follow draft -02 7.2.6 through the
  *     shared `multicastCatalogIssues` of `@blockcast/mmt-base`: all or
- *     nothing, `senderAddress` on ASM only, bandwidth required, and
- *     `(S, G, manifestPort)` clear of every port of its `(S, G)`.
+ *     nothing, `senderAddress` on ASM only, bandwidth required, addresses
+ *     RFC 3986 IP literals, and one endpoint per `(S, G, port)` (the flow's
+ *     records ride in band on its `port`, 7.2.3). A receiver clamps a
+ *     `maxAuthDelayMs` outside 50..1000; this emitter never writes one, nor a
+ *     non-integer timer or a non-string `manifestTrack`.
  *   - groupAddress is a valid IPv4 multicast group (224.0.0.0/4)
  *     or IPv6 multicast group (ff00::/8)
  *   - SSM groupAddress MUST be in 232.0.0.0/8 (IPv4) or ff3x::/32 (IPv6),
@@ -105,7 +108,7 @@ export interface MulticastEndpointInput {
 	readonly relayAddress?: string;
 	/** Aggregate bandwidth in bits per second. RECOMMENDED per draft §4.1; REQUIRED with `auth`. */
 	readonly bandwidth?: number;
-	/** Protected-flow parameters (draft -01 7.2.6); REQUIRED exactly when `MulticastInput.auth` is set. */
+	/** Protected-flow parameters (draft -02 7.2.6); REQUIRED exactly when `MulticastInput.auth` is set. */
 	readonly auth?: EndpointAuthConfig;
 }
 
@@ -148,13 +151,13 @@ export type MulticastInputErrorKind =
 	| "ssm_requires_source"
 	/** Input `protocol` "asm" with a `sourceAddress`, which selects SSM. */
 	| "protocol_source_mismatch"
-	/** `MulticastInput.auth` fails draft -01 7.2.6 (version, keys, a repeated kid or firstEpoch). */
+	/** `MulticastInput.auth` fails draft -02 7.2.6 (version, keys, a repeated kid or firstEpoch). */
 	| "invalid_multicast_auth"
 	/**
-	 * An endpoint's `auth` fails draft -01 7.2.6: present without
+	 * An endpoint's `auth` fails draft -02 7.2.6: present without
 	 * `MulticastInput.auth` or absent with it, `senderAddress` on SSM or
-	 * missing on ASM, a timer out of range, no `bandwidth`, or a
-	 * `manifestPort` that is a port or manifestPort of its `(S, G)`.
+	 * missing on ASM, a timer out of range or not an integer, a non-string
+	 * `manifestTrack`, or no `bandwidth`.
 	 */
 	| "invalid_endpoint_auth"
 	/**
@@ -390,6 +393,23 @@ export function multicastFromConfig(input: MulticastInput): MulticastCatalogConf
 		const where = issue.endpointIndex === undefined ? "" : `endpoint[${issue.endpointIndex}] `;
 		throw new MulticastInputError(kind, issue.endpointIndex ?? null, `${where}${issue.path.replace("$.multicast.", "")}: ${issue.message}`);
 	}
+	// What a receiver clamps or reads as absent (7.2.6) a publisher still never emits.
+	endpoints.forEach((ep, idx) => {
+		const auth = (ep as { auth?: Record<string, unknown> }).auth;
+		if (auth === undefined) return;
+		const delay = auth["maxAuthDelayMs"];
+		const timer = auth["manifestTimerMs"];
+		const track = auth["manifestTrack"];
+		const bad =
+			delay !== undefined && !(Number.isSafeInteger(delay) && (delay as number) >= 50 && (delay as number) <= 1000)
+				? "maxAuthDelayMs must be an integer from 50 to 1000"
+				: timer !== undefined && !(Number.isSafeInteger(timer) && (timer as number) >= 1)
+					? "manifestTimerMs must be an integer of at least 1"
+					: track !== undefined && !(typeof track === "string" && track.length > 0)
+						? "manifestTrack must be a non-empty string"
+						: undefined;
+		if (bad) throw new MulticastInputError("invalid_endpoint_auth", idx, `endpoint[${idx}] auth: ${bad}`);
+	});
 
 	if (input.enabled !== undefined) out.enabled = input.enabled;
 	if (input.version !== undefined) out.version = input.version;

package/src/multicast-manager.ts

@@ -8,7 +8,7 @@
  * - MulticastTransport — SSM join/socket/watchdog
  */
 
-import { parseFecBlockProfile, resolveFecBindings, type FecBlockProfile, type FecSourceBinding } from "@blockcast/mmt-base";
+import { canonicalIpAddress, parseFecBlockProfile, resolveFecBindings, sameIpAddress, type FecBlockProfile, type FecSourceBinding } from "@blockcast/mmt-base";
 import {
   FECManager,
   MIN_INTERLEAVE_DEPTH_MS,
@@ -117,10 +117,11 @@ export type MulticastRepairSubscribe = (
 ) => (() => void) | Promise<() => void>;
 
 /**
- * A protected endpoint's join (draft -01 7.2.7): the keys and flow
+ * A protected endpoint's join (draft -02 7.2.7): the keys and flow
  * `resolveMulticastAuthCatalog` resolved for it. The join registers the flow
- * with the router and subscribes `manifestPort` on the same `(S, G)` beside
- * the media, so every media datagram is admitted by a record before it is read.
+ * with the router; its records ride in band on the media `port` (7.2.3) and
+ * the router splits them off, so every media datagram is admitted by a record
+ * before it is read. No second subscription is opened.
  */
 export interface MulticastProvenanceJoin {
   auth: Pick<ResolvedMulticastAuthConfig, "keys" | "minEpoch">;
@@ -1269,8 +1270,8 @@ export class MulticastManager {
   readonly #router: MmtpRouter;
   #hostMfuTimeoutMs: number | null;
   readonly #transport: MulticastTransport<MmtpIngressContext>;
-  /** The protected flow of the current join and its manifestPort subscription. */
-  #provenanceJoin: { flow: string; manifest: MulticastTransport } | null = null;
+  /** The protected flow of the current join. */
+  #provenanceJoin: { flow: string } | null = null;
   #onFailback: ((reason: MulticastFailbackReason) => void) | null = null;
   #failbackHooked = false;
   /** Live joinRepairEndpoints() releases → the repair owners they registered,
@@ -2127,10 +2128,11 @@ export class MulticastManager {
 
   async join(config: MulticastEndpointConfig): Promise<boolean> {
     const provenanceFlow = config.provenance?.flow;
+    // Addresses compare as IP addresses, never as strings (multicast-02 7.2.6).
     if (
       provenanceFlow !== undefined &&
-      ((config.sourceAddress ?? config.senderAddress) !== provenanceFlow.source ||
-        config.groupAddress !== provenanceFlow.groupAddress ||
+      (!sameIpAddress(config.sourceAddress ?? config.senderAddress, provenanceFlow.source) ||
+        !sameIpAddress(config.groupAddress, provenanceFlow.groupAddress) ||
         config.port !== provenanceFlow.port)
     ) {
       throw new RangeError(
@@ -2210,28 +2212,26 @@ export class MulticastManager {
       amtDiscovery: config.amtDiscovery,
       packetIds: config.packetIds,
       tracks: catalogTracks?.map(({ name, packetId }) => ({ name, packetId })),
+      ...(provenance === undefined ? {} : { protected: true }),
     };
-    if (provenance !== undefined) this.#joinProvenance(provenance, ingress as MmtpIngressContext & { flow: string }, transportConfig);
+    if (provenance !== undefined) this.#joinProvenance(provenance, ingress as MmtpIngressContext & { flow: string });
     const protectedJoin = this.#provenanceJoin;
     const joined = await (ingress === undefined
       ? this.#transport.join(transportConfig)
       : this.#transport.join(transportConfig, ingress));
-    // No media: leave the manifest subscription and release the flow now, not at the next join.
+    // No media: release the flow now, not at the next join.
     if (!joined && protectedJoin !== null && this.#provenanceJoin === protectedJoin) this.#releaseProvenanceJoin();
     return joined;
   }
 
   /**
-   * Register the protected flow and subscribe its `manifestPort` on the same
-   * `(S, G)` with its own listener (draft -01 7.2.7), so records reach the
-   * flow's receiver and media datagrams are held until one admits them. A
-   * manifest subscription that fails to join admits nothing: the media is
-   * held and expires, never read unauthenticated.
+   * Register the protected flow (draft -02 7.2.7). Its records arrive in band
+   * on the media join (7.2.3), where the router splits them off on "MHM2" and
+   * feeds the flow's receiver; media datagrams are held until one admits them.
    */
   #joinProvenance(
     provenance: MulticastProvenanceJoin,
     ingress: MmtpIngressContext & { flow: string },
-    media: MulticastTransportConfig,
   ): void {
     const { flow, auth } = provenance;
     const receiver = new BcProvenanceV2Receiver({
@@ -2243,7 +2243,6 @@ export class MulticastManager {
         sourceAddress: flow.source,
         groupAddress: flow.groupAddress,
         port: flow.port,
-        manifestPort: flow.manifestPort,
         streamId: flow.streamId,
       },
       keys: auth.keys,
@@ -2254,26 +2253,14 @@ export class MulticastManager {
     });
     this.#router.registerProvenanceFlow(ingress, receiver);
     this.#hookFailback();
-    const manifest = new MulticastTransport((record) => {
-      if (this.#provenanceJoin?.manifest === manifest) {
-        this.#router.feedProvenanceRecord(ingress.flow, record, "multicast");
-      }
-    });
-    this.#provenanceJoin = { flow: ingress.flow, manifest };
-    const { packetIds: _packetIds, tracks: _tracks, ...path } = media;
-    void manifest.join({ ...path, port: flow.manifestPort }).then((joined) => {
-      if (!joined && this.#provenanceJoin?.manifest === manifest) {
-        console.warn(`[MulticastManager] manifestPort ${flow.groupAddress}:${flow.manifestPort} not joined`, manifest.lastJoinOutcome);
-      }
-    });
+    this.#provenanceJoin = { flow: ingress.flow };
   }
 
-  /** Un-protect: drop the flow's hold queues (no expiry counted) and leave its manifestPort. */
+  /** Un-protect: drop the flow's hold queues (no expiry counted). */
   #releaseProvenanceJoin(): void {
     const joined = this.#provenanceJoin;
     if (joined === null) return;
     this.#provenanceJoin = null;
-    joined.manifest.dispose();
     this.#router.releaseProvenanceFlow(joined.flow);
   }
 
@@ -2316,7 +2303,7 @@ export class MulticastManager {
         if (released) return;
         // The media join's sender owns the repair too; this group's own first
         // sender stands in only until the media join has one.
-        if (sourceAddress !== undefined && sourceAddress !== (this.#transport.sender ?? (sender ??= sourceAddress))) return;
+        if (sourceAddress !== undefined && !sameDatagramSource(sourceAddress, this.#transport.sender ?? (sender ??= sourceAddress))) return;
         this.#router.feedPacket(packet, "multicast", ingress);
       };
       const fail = (error: unknown) =>
@@ -2341,6 +2328,8 @@ export class MulticastManager {
         amtRelayPort: endpoint.amtRelayPort ?? (endpoint.amtRelay?.trim() ? DEFAULT_AMT_RELAY_PORT : undefined),
         packetIds: endpoint.packetIds,
         tracks: endpoint.tracks.map(({ name, packetId }) => ({ name, packetId })),
+        // A protected repair group's records ride in band on its port (7.2.3).
+        ...(endpoint.flow === undefined ? {} : { protected: true }),
       }).then((joined) => {
         if (!joined && !released) fail(transport.lastJoinOutcome);
       });
@@ -3395,7 +3384,22 @@ export class MulticastManager {
 const repairFetchHost = (manager: MulticastManager): RepairFetchHost => manager;
 void repairFetchHost;
 
-/** The router's key of a protected flow: its `(S, G, port)`. */
+/**
+ * The router's key of a protected flow: its `(S, G, port)`, with S and G in
+ * canonical form (`canonicalIpAddress`), so two spellings of one address key
+ * one flow (multicast-02 7.2.6). Resolved flows already carry canonical
+ * addresses, so `JSON.stringify([source, groupAddress, port])` of one is this
+ * key; text that is not an address literal is kept as given.
+ */
 export function multicastProvenanceFlowKey(flow: Pick<ResolvedMulticastAuthFlow, "source" | "groupAddress" | "port">): string {
-  return JSON.stringify([flow.source, flow.groupAddress, flow.port]);
+  return JSON.stringify([
+    canonicalIpAddress(flow.source) ?? flow.source,
+    canonicalIpAddress(flow.groupAddress) ?? flow.groupAddress,
+    flow.port,
+  ]);
+}
+
+/** Datagram sources compared as IP addresses; spelling a provider does not parse falls back to equality. */
+function sameDatagramSource(a: string, b: string): boolean {
+  return a === b || sameIpAddress(a, b);
 }

package/src/multicast-transport.ts

@@ -16,7 +16,9 @@ import {
   MMTP_PACKET_ID_MAX,
   MMTP_SIGNALING_PACKET_ID,
   readMMTPPacketId,
+  sameIpAddress,
 } from '@blockcast/mmt-base'
+import { isBcpV2RecordCandidate } from '@blockcast/mmt-manifest-verify'
 
 export interface MulticastTransportConfig {
   /** SSM source; omitted on ASM. */
@@ -34,6 +36,20 @@ export interface MulticastTransportConfig {
   tracks?: { name: string; packetId: number }[]
   /** ATSC 3.0 tuning (`catalogAtsc3NetworkSource`); when set the join is the tuner. */
   atsc3?: { frequency: number; plpId?: number; serviceId?: number }
+  /**
+   * The join is a protected flow (multicast-02 7.2.3): its bc-provenance
+   * records ride in band on this `port`, so a datagram whose first four octets
+   * are "MHM2" passes ahead of the packet_id read and the allow-list, and is
+   * never counted toward a packet_id. On an unprotected join it is an
+   * unparseable MMTP packet, as before.
+   *
+   * A protected join admits only datagrams whose reported sender is the
+   * flow's S (`sourceAddress`, or `senderAddress` on ASM), compared as IP
+   * addresses, before anything hashes them (multicast-02 7.2.7). A datagram
+   * with no reported sender is dropped, and a join that cannot report one
+   * (no S, or an ATSC 3.0 tuner) is declined `invalid-request`.
+   */
+  protected?: boolean
 }
 
 export type ResolvedMulticastTransport = 'native' | 'amt'
@@ -139,7 +155,8 @@ export interface MulticastTransportStats {
    * one (G, port, packet_id); the first sender whose packet is accepted owns
    * the sub-flow until the next join, and every other sender is dropped here,
    * before any gap, duplicate or FEC ledger sees it. A join or a silence
-   * failback releases the lock.
+   * failback releases the lock. On a protected join it also counts every
+   * datagram whose sender is not the flow's S, or is not reported.
    */
   packetsDroppedForeignSender: number
 }
@@ -206,7 +223,14 @@ function hasMulticastGateway(): boolean {
   return typeof getMulticastGlobals().multicast?.subscribe === 'function'
 }
 
-/** The `bytes` event's sender (multicast-contract 1.3.0); undefined when unknown. */
+/**
+ * The `bytes` event's sender (multicast-contract 1.3.0); undefined when unknown.
+ *
+ * The provider filters (S, G, port) and owns the multicast-02 7.2.7
+ * destination MUST: the event carries no destination address, so libmmt
+ * cannot discard a datagram whose IP destination is not G (pim BLO-51627).
+ * On a protected flow libmmt checks the sender itself, against S.
+ */
 function senderOf(event: CustomEvent<unknown>): string | undefined {
   const sourceAddress = (event as { sourceAddress?: unknown }).sourceAddress
   return typeof sourceAddress === 'string' ? sourceAddress : undefined
@@ -333,6 +357,11 @@ export class MulticastTransport<TPacketContext = never> {
   // per packet once a count outgrows the small-integer range.
   readonly #acceptedBytesByPacketId = new Map<number, { bytes: number }>()
   #packetIds: ReadonlySet<number> | null = null
+  #protected = false
+  // A protected join's S, and the last sender spelling that matched it, so a
+  // matching sender parses once per spelling rather than per datagram.
+  #protectedSource: string | undefined = undefined
+  #matchedSource: string | undefined = undefined
   // The sender S this join's accepted packets came from, once known; see
   // packetsDroppedForeignSender. Cleared by every join and by a silence
   // failback, so a replacement publisher is not locked out.
@@ -396,6 +425,11 @@ export class MulticastTransport<TPacketContext = never> {
     // failure before it runs, so the catch classifies a decline by where the
     // join stopped, never by what the error says.
     let failure: MulticastJoinDeclineReason = 'invalid-request'
+    const protectedSource = config.protected === true ? config.sourceAddress ?? config.senderAddress : undefined
+    if (config.protected === true && (protectedSource === undefined || config.atsc3)) {
+      console.warn('[MulticastTransport] protected join refused: the path reports no per-datagram sender to check against S')
+      return this.#declined(generation, 'invalid-request')
+    }
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null
       console.log(
@@ -444,8 +478,9 @@ export class MulticastTransport<TPacketContext = never> {
       // costs batching on every any-source join, including one on a pre-1.3.0
       // provider that sends no sender and so gets no lock for it; keep it
       // unless the provider can say it carries the sender.
+      // A protected join checks every datagram's sender, so it listens to `bytes` too.
       const anySource = !config.sourceAddress && !config.senderAddress && !config.atsc3
-      const packetListener: PacketListener = !anySource && subscriptionDeliversPacketBatches(subscription)
+      const packetListener: PacketListener = !anySource && protectedSource === undefined && subscriptionDeliversPacketBatches(subscription)
         ? {
             type: 'packets',
             listener: (event) => {
@@ -462,6 +497,9 @@ export class MulticastTransport<TPacketContext = never> {
           }
       this.#packetListener = packetListener
       this.#packetIds = packetIds
+      this.#protected = config.protected === true
+      this.#protectedSource = protectedSource
+      this.#matchedSource = undefined
       this.#providerFilter = {
         acknowledged: packetIds,
         sent: 0,
@@ -578,7 +616,8 @@ export class MulticastTransport<TPacketContext = never> {
 
   /**
    * One packet from the subscription: filter, count, and hand it to the
-   * callback. Returns whether it was delivered; the caller notes liveness.
+   * callback. Returns whether it was delivered as liveness (a delivered record
+   * candidate is not); the caller notes liveness.
    */
   #deliver(detail: unknown, sourceAddress?: string): boolean {
     const packet = normalizeBytesEventDetail(detail)
@@ -587,11 +626,16 @@ export class MulticastTransport<TPacketContext = never> {
       return false
     }
     if (!this.#acceptPacket(packet, sourceAddress)) return false
+    const liveness = !this.#isRecordCandidate(packet)
     // Read per packet: a callback that changes the admission (an in-place
     // rendition switch committing on this very packet) takes effect from the
     // next packet, including the rest of a batch.
     this.#onPacket(packet, this.#context)
-    return true
+    return liveness
+  }
+
+  #isRecordCandidate(packet: Uint8Array): boolean {
+    return this.#protected && isBcpV2RecordCandidate(packet)
   }
 
   /**
@@ -647,8 +691,9 @@ export class MulticastTransport<TPacketContext = never> {
     if (this.#disposed) return
     const packet = data instanceof Uint8Array ? data : new Uint8Array(data)
     if (!this.#acceptPacket(packet, sourceAddress)) return
+    const liveness = !this.#isRecordCandidate(packet)
     this.#onPacket(packet, context)
-    this.#resetWatchdog()
+    if (liveness) this.#resetWatchdog()
   }
 
   confirmVideo(): void {
@@ -990,6 +1035,9 @@ export class MulticastTransport<TPacketContext = never> {
     this.#resolvedTransport = undefined
     this.#delivery = undefined
     this.#packetIds = null
+    this.#protected = false
+    this.#protectedSource = undefined
+    this.#matchedSource = undefined
     this.#providerFilter = null
     this.#context = undefined
     this.#withdrawnPacketIds.clear()
@@ -997,12 +1045,31 @@ export class MulticastTransport<TPacketContext = never> {
 
   /** The ingress filter; an accepted packet is counted here, once. */
   #acceptPacket(packet: Uint8Array, sourceAddress?: string): boolean {
+    const source = this.#protectedSource
+    if (source !== undefined && (sourceAddress === undefined || sourceAddress !== this.#matchedSource)) {
+      if (sourceAddress === undefined || !sameIpAddress(sourceAddress, source)) {
+        this.#stats.packetsDroppedForeignSender++
+        return false
+      }
+      this.#matchedSource = sourceAddress
+    }
     // Absent means unknown (a pre-1.3.0 provider, a tuner): never a new sender.
-    const owner = this.#lockedTo?.() ?? this.#sender
+    // A protected flow's S check above replaces the first-seen lock, which
+    // compares spellings and would refuse S written another way.
+    const owner = source === undefined ? this.#lockedTo?.() ?? this.#sender : undefined
     if (sourceAddress !== undefined && owner !== undefined && sourceAddress !== owner) {
       this.#stats.packetsDroppedForeignSender++
       return false
     }
+    // A record candidate of a protected flow carries no packet_id: the router
+    // splits it off before anything parses it (7.2.7). Step 1 has not run on
+    // it yet, so it neither takes the sender lock nor counts as liveness
+    // (#isRecordCandidate, #deliver): records alone must not hold off
+    // silence failback.
+    if (this.#isRecordCandidate(packet)) {
+      this.#countAccepted(packet, null, undefined)
+      return true
+    }
     // This early read is intentional: rejected PIDs must not affect page
     // delivery, receive statistics, or the failback liveness watchdog. It
     // refuses exactly what parseMMTPHeader refuses but builds no header