@blockcast/mmt-container 1.0.1 → 2.0.0

package/dist/multicast-input.d.ts

@@ -32,7 +32,7 @@ export interface MulticastEndpointInput {
     readonly relayAddress?: string;
     /** Aggregate bandwidth in bits per second. RECOMMENDED per draft §4.1; REQUIRED with `auth`. */
     readonly bandwidth?: number;
-    /** Protected-flow parameters (draft -01 7.2.6); REQUIRED exactly when `MulticastInput.auth` is set. */
+    /** Protected-flow parameters (draft -02 7.2.6); REQUIRED exactly when `MulticastInput.auth` is set. */
     readonly auth?: EndpointAuthConfig;
 }
 /**
@@ -74,13 +74,13 @@ export type MulticastInputErrorKind = "empty_endpoints"
  | "invalid_endpoints" | "ssm_requires_source"
 /** Input `protocol` "asm" with a `sourceAddress`, which selects SSM. */
  | "protocol_source_mismatch"
-/** `MulticastInput.auth` fails draft -01 7.2.6 (version, keys, a repeated kid or firstEpoch). */
+/** `MulticastInput.auth` fails draft -02 7.2.6 (version, keys, a repeated kid or firstEpoch). */
  | "invalid_multicast_auth"
 /**
- * An endpoint's `auth` fails draft -01 7.2.6: present without
+ * An endpoint's `auth` fails draft -02 7.2.6: present without
  * `MulticastInput.auth` or absent with it, `senderAddress` on SSM or
- * missing on ASM, a timer out of range, no `bandwidth`, or a
- * `manifestPort` that is a port or manifestPort of its `(S, G)`.
+ * missing on ASM, a timer out of range or not an integer, a non-string
+ * `manifestTrack`, or no `bandwidth`.
  */
  | "invalid_endpoint_auth"
 /**

package/dist/multicast-input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multicast-input.d.ts","sourceRoot":"","sources":["../src/multicast-input.ts"],"names":[],"mappings":"AAiEA,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uGAAuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACtD,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAChC,iBAAiB;AACnB;;;;;GAKG;GACD,mBAAmB,GACnB,qBAAqB;AACvB,wEAAwE;GACtE,0BAA0B;AAC5B,iGAAiG;GAC/F,wBAAwB;AAC1B;;;;;GAKG;GACD,uBAAuB;AACzB;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;;GAMG;GACD,uBAAuB;AACzB;;;;;GAKG;GACD,uBAAuB;AACzB;;;GAGG;GACD,uBAAuB;AACzB;;;GAGG;GACD,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,mBAAmB;AACrB;;;;GAIG;GACD,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,CAAC;AAEvB,qBAAa,mBAAoB,SAAQ,KAAK;aAE5B,IAAI,EAAE,uBAAuB;aAC7B,aAAa,EAAE,MAAM,GAAG,IAAI;gBAD5B,IAAI,EAAE,uBAAuB,EAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5C,OAAO,EAAE,MAAM;CAKhB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,sBAAsB,CAsKjF;AA6PD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CACqB,GACzD,sBAAsB,GAAG,SAAS,CAgDpC"}
+{"version":3,"file":"multicast-input.d.ts","sourceRoot":"","sources":["../src/multicast-input.ts"],"names":[],"mappings":"AAoEA,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAE3F;;;;GAIG;AACH,MAAM,MAAM,sBAAsB,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IACrD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,gGAAgG;IAChG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,uGAAuG;IACvG,QAAQ,CAAC,IAAI,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC1D;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IACtD,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACzF,kEAAkE;IAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,uBAAuB,GAChC,iBAAiB;AACnB;;;;;GAKG;GACD,mBAAmB,GACnB,qBAAqB;AACvB,wEAAwE;GACtE,0BAA0B;AAC5B,iGAAiG;GAC/F,wBAAwB;AAC1B;;;;;GAKG;GACD,uBAAuB;AACzB;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;;GAMG;GACD,uBAAuB;AACzB;;;;;GAKG;GACD,uBAAuB;AACzB;;;GAGG;GACD,uBAAuB;AACzB;;;GAGG;GACD,wBAAwB,GACxB,uBAAuB,GACvB,wBAAwB,GACxB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,mBAAmB;AACrB;;;;GAIG;GACD,qBAAqB,GACrB,qBAAqB,GACrB,0BAA0B,GAC1B,mBAAmB,GACnB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,CAAC;AAEvB,qBAAa,mBAAoB,SAAQ,KAAK;aAE5B,IAAI,EAAE,uBAAuB;aAC7B,aAAa,EAAE,MAAM,GAAG,IAAI;gBAD5B,IAAI,EAAE,uBAAuB,EAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,EAC5C,OAAO,EAAE,MAAM;CAKhB;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,sBAAsB,CAuLjF;AA6PD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAC/B,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CACqB,GACzD,sBAAsB,GAAG,SAAS,CAgDpC"}

package/dist/multicast-input.js

@@ -15,13 +15,74 @@ var FEC_BLOCK_PROFILES = Object.freeze([
   "iso-ssbg1-v1"
 ]);
 
+// ../mmt-base/dist/ip-address.js
+var DEC_OCTET = /^(?:0|[1-9]\d{0,2})$/;
+var H16 = /^[0-9A-Fa-f]{1,4}$/;
+function parseIpv4(text) {
+  const fields = text.split(".");
+  if (fields.length !== 4)
+    return void 0;
+  const octets = [];
+  for (const field of fields) {
+    if (!DEC_OCTET.test(field))
+      return void 0;
+    const value = Number(field);
+    if (value > 255)
+      return void 0;
+    octets.push(value);
+  }
+  return octets;
+}
+function parseIpv6(text) {
+  const halves = text.split("::");
+  if (halves.length > 2)
+    return void 0;
+  const groupsOf = (part) => part === "" ? [] : part.split(":");
+  const left = groupsOf(halves[0]);
+  const right = halves.length === 2 ? groupsOf(halves[1]) : [];
+  const words = [];
+  const all = [...left, ...right];
+  const last = halves.length === 2 && right.length === 0 ? -1 : all.length - 1;
+  for (let index = 0; index < all.length; index++) {
+    const group = all[index];
+    if (index === last && group.includes(".")) {
+      const v4 = parseIpv4(group);
+      if (!v4)
+        return void 0;
+      words.push([v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]]);
+    } else if (H16.test(group)) {
+      words.push([Number.parseInt(group, 16)]);
+    } else {
+      return void 0;
+    }
+  }
+  const leftWords = words.slice(0, left.length).flat();
+  const rightWords = words.slice(left.length).flat();
+  const missing = 8 - leftWords.length - rightWords.length;
+  if (halves.length === 2 ? missing < 1 : missing !== 0)
+    return void 0;
+  const out = new Uint8Array(16);
+  [...leftWords, ...new Array(missing).fill(0), ...rightWords].forEach((word, index) => {
+    out[index * 2] = word >> 8;
+    out[index * 2 + 1] = word & 255;
+  });
+  return out;
+}
+function parseIpAddressLiteral(text) {
+  if (typeof text !== "string")
+    return void 0;
+  if (text.includes(":"))
+    return parseIpv6(text);
+  const v4 = parseIpv4(text);
+  return v4 ? Uint8Array.from(v4) : void 0;
+}
+
 // ../mmt-base/dist/multicast-catalog.js
 var ED25519_PUBLIC_KEY_BASE64URL = /^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/;
 var UINT32_MAX = 4294967295;
 var AUTH_MEMBERS = /* @__PURE__ */ new Set(["scheme", "version", "sig", "keys", "minEpoch"]);
 var KEY_MEMBERS = /* @__PURE__ */ new Set(["kid", "publicKey", "firstEpoch"]);
 var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
-  "manifestPort",
   "streamId",
   "senderAddress",
   "maxAuthDelayMs",
@@ -31,17 +92,32 @@ var ENDPOINT_AUTH_MEMBERS = /* @__PURE__ */ new Set([
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function isNonEmptyString(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
 function isIntegerIn(value, min, max) {
   return Number.isSafeInteger(value) && value >= min && value <= max;
 }
+var BCP_DEFAULT_MAX_AUTH_DELAY_MS = 200;
+var BCP_DEFAULT_MANIFEST_TIMER_MS = 20;
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function endpointAuthTiming(auth) {
+  const record = isObject(auth) ? auth : {};
+  const delay = record["maxAuthDelayMs"];
+  const timer = record["manifestTimerMs"];
+  const track = record["manifestTrack"];
+  const maxAuthDelayMs = !isFiniteNumber(delay) ? BCP_DEFAULT_MAX_AUTH_DELAY_MS : delay < 50 ? 50 : delay > 1e3 ? 1e3 : Number.isInteger(delay) ? delay : BCP_DEFAULT_MAX_AUTH_DELAY_MS;
+  const manifestTimerMs = !isFiniteNumber(timer) ? BCP_DEFAULT_MANIFEST_TIMER_MS : timer < 1 || Number.isSafeInteger(timer) ? timer : BCP_DEFAULT_MANIFEST_TIMER_MS;
+  return {
+    maxAuthDelayMs,
+    manifestTimerMs,
+    ...typeof track === "string" && track.length > 0 ? { manifestTrack: track } : {}
+  };
+}
 function multicastEndpointSource(endpoint) {
   if (!isObject(endpoint))
     return void 0;
   const sourceAddress = endpoint["sourceAddress"];
-  if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress))
+  if (sourceAddress !== void 0 && !parseIpAddressLiteral(sourceAddress))
     return void 0;
   const mode = sourceAddress === void 0 ? "asm" : "ssm";
   const protocol = endpoint["protocol"];
@@ -53,7 +129,7 @@ function multicastEndpointSource(endpoint) {
     return senderAddress === void 0 ? { mode, source: sourceAddress } : void 0;
   if (auth === void 0)
     return { mode };
-  return isNonEmptyString(senderAddress) ? { mode, source: senderAddress } : void 0;
+  return parseIpAddressLiteral(senderAddress) ? { mode, source: senderAddress } : void 0;
 }
 function authIssues(auth) {
   const base = "$.multicast.auth";
@@ -64,12 +140,12 @@ function authIssues(auth) {
     return issue("", "auth must be an object");
   const unknown = Object.keys(auth).filter((key) => !AUTH_MEMBERS.has(key));
   if (unknown.length > 0) {
-    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -01 7.2.6 defines scheme, version, sig, keys and minEpoch`);
+    return issue("", `auth has unknown member(s) ${unknown.join(", ")}; draft -02 7.2.6 defines scheme, version, sig, keys and minEpoch`);
   }
   if (auth["scheme"] !== "bc-provenance")
     return issue(".scheme", 'scheme must be "bc-provenance"');
   if (auth["version"] !== 2)
-    return issue(".version", "version must be 2 (bc-provenance version 2, draft -01 7.2)");
+    return issue(".version", "version must be 2 (bc-provenance version 2, draft -02 7.2)");
   if (auth["sig"] !== "ed25519")
     return issue(".sig", 'sig must be "ed25519"');
   const keys = auth["keys"];
@@ -112,26 +188,17 @@ function endpointAuthIssue(endpoint, mode, at) {
   const unknown = Object.keys(auth).filter((key) => !ENDPOINT_AUTH_MEMBERS.has(key));
   if (unknown.length > 0)
     return { path: `${at}.auth`, message: `auth has unknown member(s) ${unknown.join(", ")}` };
-  if (!isIntegerIn(auth["manifestPort"], 1, 65535)) {
-    return { path: `${at}.auth.manifestPort`, message: "manifestPort must be an integer from 1 to 65535" };
-  }
   if (!isIntegerIn(auth["streamId"], 0, UINT32_MAX)) {
     return { path: `${at}.auth.streamId`, message: "streamId must be an unsigned 32-bit integer" };
   }
   if (mode === "ssm" && auth["senderAddress"] !== void 0) {
     return { path: `${at}.auth.senderAddress`, message: "senderAddress must not appear on an SSM endpoint; S is sourceAddress" };
   }
-  if (mode === "asm" && !isNonEmptyString(auth["senderAddress"])) {
-    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress" };
+  if (mode === "asm" && !parseIpAddressLiteral(auth["senderAddress"])) {
+    return { path: `${at}.auth.senderAddress`, message: "a protected ASM endpoint requires senderAddress, an RFC 3986 IP address literal" };
   }
-  if (auth["maxAuthDelayMs"] !== void 0 && !isIntegerIn(auth["maxAuthDelayMs"], 50, 1e3)) {
-    return { path: `${at}.auth.maxAuthDelayMs`, message: "maxAuthDelayMs must be an integer from 50 to 1000" };
-  }
-  if (auth["manifestTimerMs"] !== void 0 && !isIntegerIn(auth["manifestTimerMs"], 1, Number.MAX_SAFE_INTEGER)) {
-    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be an integer of at least 1" };
-  }
-  if (auth["manifestTrack"] !== void 0 && !isNonEmptyString(auth["manifestTrack"])) {
-    return { path: `${at}.auth.manifestTrack`, message: "manifestTrack must be a non-empty string" };
+  if (endpointAuthTiming(auth).manifestTimerMs < 1) {
+    return { path: `${at}.auth.manifestTimerMs`, message: "manifestTimerMs must be at least 1" };
   }
   if (!isIntegerIn(endpoint["bandwidth"], 1, Number.MAX_SAFE_INTEGER)) {
     return { path: `${at}.bandwidth`, message: "a protected endpoint requires bandwidth, which bounds the receiver's hold queues" };
@@ -147,7 +214,7 @@ function multicastCatalogIssues(catalog, options = {}) {
     issues.push({
       code: "multicast_auth",
       path: '$["multicast.auth"]',
-      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -01 7.2.6)'
+      message: 'the root "multicast.auth" key is retired; declare auth as multicast.auth (draft -02 7.2.6)'
     });
   }
   const multicast = catalog["multicast"];
@@ -181,7 +248,7 @@ function multicastCatalogIssues(catalog, options = {}) {
     }
     const protocol = endpoint["protocol"];
     if (protocol !== void 0 && protocol !== "ssm" && protocol !== "asm") {
-      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -01 4.2)`);
+      fail("multicast_endpoint", `${at}.protocol`, `protocol must be "ssm" or "asm"; a bearer such as ${JSON.stringify(protocol)} is a networkSource entry (draft -02 4.2)`);
       continue;
     }
     const hasAuth = endpoint["auth"] !== void 0;
@@ -190,8 +257,18 @@ function multicastCatalogIssues(catalog, options = {}) {
       continue;
     }
     const sourceAddress = endpoint["sourceAddress"];
-    if (sourceAddress !== void 0 && !isNonEmptyString(sourceAddress)) {
-      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be a non-empty string");
+    const sourceBytes = sourceAddress === void 0 ? void 0 : parseIpAddressLiteral(sourceAddress);
+    if (sourceAddress !== void 0 && !sourceBytes) {
+      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress must be an RFC 3986 IPv4address or IPv6address literal");
+      continue;
+    }
+    const groupBytes = parseIpAddressLiteral(endpoint["groupAddress"]);
+    if (!groupBytes) {
+      fail("multicast_endpoint", `${at}.groupAddress`, "groupAddress must be an RFC 3986 IPv4address or IPv6address literal");
+      continue;
+    }
+    if (sourceBytes && sourceBytes.length !== groupBytes.length) {
+      fail("multicast_endpoint", `${at}.sourceAddress`, "sourceAddress and groupAddress are of different address families");
       continue;
     }
     const mode = sourceAddress === void 0 ? "asm" : "ssm";
@@ -210,7 +287,13 @@ function multicastCatalogIssues(catalog, options = {}) {
         continue;
       }
     }
-    sources[index] = multicastEndpointSource(endpoint);
+    const source = multicastEndpointSource(endpoint);
+    const senderBytes = source?.mode === "asm" && source.source !== void 0 ? parseIpAddressLiteral(source.source) : void 0;
+    if (senderBytes && senderBytes.length !== groupBytes.length) {
+      fail("multicast_endpoint_auth", `${at}.auth.senderAddress`, "senderAddress and groupAddress are of different address families");
+      continue;
+    }
+    sources[index] = source;
     const refs = Array.isArray(endpoint["tracks"]) ? endpoint["tracks"] : [];
     for (let refIndex = 0; refIndex < refs.length; refIndex++) {
       const ref = refs[refIndex];
@@ -226,38 +309,23 @@ function multicastCatalogIssues(catalog, options = {}) {
       }
     }
   }
+  const addressKey = (text) => {
+    const bytes = text === void 0 ? void 0 : parseIpAddressLiteral(text);
+    return bytes ? `${bytes.length}:${bytes.join(".")}` : "-";
+  };
   const tupleOf = (index) => {
     const endpoint = endpoints[index];
-    const auth = endpoint["auth"];
-    return {
-      sg: JSON.stringify([sources[index].source ?? null, endpoint["groupAddress"]]),
-      port: endpoint["port"],
-      manifestPort: isObject(auth) ? auth["manifestPort"] : void 0
-    };
+    return `${addressKey(sources[index].source)}|${addressKey(endpoint["groupAddress"])}|${endpoint["port"]}`;
   };
   for (let index = 0; index < endpoints.length; index++) {
     if (!sources[index])
       continue;
     const own = tupleOf(index);
-    const at = `$.multicast.endpoints[${index}]`;
-    if (own.manifestPort !== void 0 && own.manifestPort === own.port) {
-      issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: "manifestPort must differ from the endpoint's own port", endpointIndex: index });
-      continue;
-    }
     for (let other = 0; other < endpoints.length; other++) {
-      if (other === index || !sources[other])
+      if (other === index || !sources[other] || tupleOf(other) !== own)
         continue;
-      const peer = tupleOf(other);
-      if (peer.sg !== own.sg)
-        continue;
-      if (peer.port === own.port) {
-        issues.push({ code: "multicast_endpoint", path: `${at}.port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
-        break;
-      }
-      if (own.manifestPort !== void 0 && (own.manifestPort === peer.port || own.manifestPort === peer.manifestPort)) {
-        issues.push({ code: "multicast_endpoint_auth", path: `${at}.auth.manifestPort`, message: `manifestPort is a port or manifestPort of endpoint ${other} on the same (S, G)`, endpointIndex: index });
-        break;
-      }
+      issues.push({ code: "multicast_endpoint", path: `$.multicast.endpoints[${index}].port`, message: `(S, G, port) is shared with endpoint ${other}; one endpoint object per multicast tuple`, endpointIndex: index });
+      break;
     }
   }
   return issues;
@@ -357,6 +425,15 @@ function multicastFromConfig(input) {
     const where = issue.endpointIndex === void 0 ? "" : `endpoint[${issue.endpointIndex}] `;
     throw new MulticastInputError(kind, issue.endpointIndex ?? null, `${where}${issue.path.replace("$.multicast.", "")}: ${issue.message}`);
   }
+  endpoints.forEach((ep, idx) => {
+    const auth = ep.auth;
+    if (auth === void 0) return;
+    const delay = auth["maxAuthDelayMs"];
+    const timer = auth["manifestTimerMs"];
+    const track = auth["manifestTrack"];
+    const bad = delay !== void 0 && !(Number.isSafeInteger(delay) && delay >= 50 && delay <= 1e3) ? "maxAuthDelayMs must be an integer from 50 to 1000" : timer !== void 0 && !(Number.isSafeInteger(timer) && timer >= 1) ? "manifestTimerMs must be an integer of at least 1" : track !== void 0 && !(typeof track === "string" && track.length > 0) ? "manifestTrack must be a non-empty string" : void 0;
+    if (bad) throw new MulticastInputError("invalid_endpoint_auth", idx, `endpoint[${idx}] auth: ${bad}`);
+  });
   if (input.enabled !== void 0) out.enabled = input.enabled;
   if (input.version !== void 0) out.version = input.version;
   if (input.validUntil !== void 0) out.validUntil = input.validUntil;