@blockcast/mmt-container 2.0.0 → 2.0.1

package/dist/multicast-manager.js

@@ -15864,7 +15864,6 @@ _RistrettoPoint.Fn = /* @__PURE__ */ (() => Fn)();
 var BCPV2_LEAD_BOUND_MS = 5e3;
 var REPLAY_WINDOW = 64n;
 var BUCKET_DEPTH = 64;
-var BUCKET_RATE_PER_MS = 1;
 var hex = (bytes) => Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 function sameBytes(a, b) {
   if (a.byteLength !== b.byteLength)
@@ -15893,6 +15892,10 @@ var BcProvenanceV2Receiver = class {
   verifySig;
   accepted;
   queueLimit;
+  /** Octets a held datagram is charged beyond its payload: the IPv4 or IPv6 plus UDP headers (step 2). */
+  headerOctets;
+  /** Budget refill, tokens per ms: V / 1000 (step 1). */
+  bucketRatePerMs;
   current = null;
   previous = null;
   graceStart = {};
@@ -15938,6 +15941,8 @@ var BcProvenanceV2Receiver = class {
       multicast: this.maxAuthDelayMs * bandwidth / 8e3,
       unicast: (this.maxAuthDelayMs + this.widenMs) * bandwidth / 8e3
     };
+    this.headerOctets = parseBcProvenanceV2Address(cfg.endpoint.groupAddress).byteLength === 16 ? 48 : 28;
+    this.bucketRatePerMs = Math.max(1e3, 1.25 * bandwidth / (8 * 512 * 37)) / 1e3;
     const t = this.now();
     this.buckets = {
       multicast: { tokens: BUCKET_DEPTH, last: t, dropped: 0 },
@@ -16036,7 +16041,7 @@ var BcProvenanceV2Receiver = class {
       arrival: now,
       sent,
       digest: hex(sha2562(bytes)),
-      pairs: record.digests.map((d, i) => ({ digest: hex(d), seq: record.firstSeq + BigInt(i), admitted: false })),
+      pairs: record.digests.map((d, i) => ({ digest: hex(d), epoch, seq: record.firstSeq + BigInt(i), admitted: false })),
       awaitingMulticast: path === "mirror"
     };
     this.verified.set(id, entry);
@@ -16103,12 +16108,12 @@ var BcProvenanceV2Receiver = class {
   digest(datagram) {
     return hex(bcProvenanceV2DatagramDigest(this.cfg.endpoint, datagram));
   }
-  /** Consume the lowest-seq pending entry for `digest`, admitting it. */
+  /** Consume the pending entry for `digest` lowest in (epoch, sequence) order, admitting it. */
   consumePending(digest, now) {
     const list = this.pending.get(digest);
     if (!list?.length)
       return false;
-    list.sort((a, b) => a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0);
+    list.sort((a, b) => a.pair.epoch - b.pair.epoch || (a.pair.seq < b.pair.seq ? -1 : a.pair.seq > b.pair.seq ? 1 : 0));
     const hit = list.shift();
     if (list.length === 0)
       this.pending.delete(digest);
@@ -16117,14 +16122,18 @@ var BcProvenanceV2Receiver = class {
     this.admittedUntil.set(digest, now + this.maxAuthDelayMs + this.leadMs);
     return true;
   }
+  /** A held datagram's charge against its queue: payload plus IP and UDP headers. */
+  charge(held) {
+    return held.datagram.byteLength + this.headerOctets;
+  }
   enqueue(held, path, now) {
-    if (this.holdBytes[path] + held.datagram.byteLength > this.queueLimit[path]) {
+    if (this.holdBytes[path] + this.charge(held) > this.queueLimit[path]) {
       return { verdict: "overflow", admitted: [] };
     }
     held.expiry = now + this.maxAuthDelayMs + (path === "unicast" ? this.widenMs : 0);
     held.order = this.order++;
     this.hold[path].push(held);
-    this.holdBytes[path] += held.datagram.byteLength;
+    this.holdBytes[path] += this.charge(held);
     return { verdict: "held", admitted: [] };
   }
   /** Remove and return the oldest held datagram with `digest`, across both queues. */
@@ -16139,7 +16148,7 @@ var BcProvenanceV2Receiver = class {
     if (!best)
       return void 0;
     const [held] = this.hold[best.path].splice(best.index, 1);
-    this.holdBytes[best.path] -= held.datagram.byteLength;
+    this.holdBytes[best.path] -= this.charge(held);
     return held.datagram;
   }
   dropAdmittedHeld() {
@@ -16147,7 +16156,7 @@ var BcProvenanceV2Receiver = class {
       this.hold[path] = this.hold[path].filter((h) => {
         const keep = h.digest === void 0 || !this.admittedUntil.has(h.digest);
         if (!keep)
-          this.holdBytes[path] -= h.datagram.byteLength;
+          this.holdBytes[path] -= this.charge(h);
         return keep;
       });
     }
@@ -16231,7 +16240,7 @@ var BcProvenanceV2Receiver = class {
   }
   take(path, now) {
     const b = this.buckets[path];
-    b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * BUCKET_RATE_PER_MS);
+    b.tokens = Math.min(BUCKET_DEPTH, b.tokens + (now - b.last) * this.bucketRatePerMs);
     b.last = now;
     if (b.tokens < 1) {
       b.dropped++;
@@ -16245,7 +16254,7 @@ var BcProvenanceV2Receiver = class {
       this.hold[path] = this.hold[path].filter((h) => {
         if (h.expiry > now)
           return true;
-        this.holdBytes[path] -= h.datagram.byteLength;
+        this.holdBytes[path] -= this.charge(h);
         this.expired[path]++;
         return false;
       });
@@ -20863,6 +20872,9 @@ var AMTGatewayManager = class {
    */
   async subscribe(config) {
     const { key } = config;
+    if (config.protected) {
+      throw new Error("AMTGatewayManager refuses a protected join: it reports no per-datagram sender (multicast-02 7.2.7)");
+    }
     const keyStr = this.getKeyString(key);
     if (this.subscriptions.has(keyStr)) {
       console.log(`[AMT] Reusing existing subscription to ${keyStr}`);
@@ -21100,6 +21112,10 @@ var MulticastTransport = class {
   #acceptedBytesByPacketId = /* @__PURE__ */ new Map();
   #packetIds = null;
   #protected = false;
+  // A protected join's S, and the last sender spelling that matched it, so a
+  // matching sender parses once per spelling rather than per datagram.
+  #protectedSource = void 0;
+  #matchedSource = void 0;
   // The sender S this join's accepted packets came from, once known; see
   // packetsDroppedForeignSender. Cleared by every join and by a silence
   // failback, so a replacement publisher is not locked out.
@@ -21151,6 +21167,11 @@ var MulticastTransport = class {
       return this.#declined(generation, "unavailable");
     }
     let failure = "invalid-request";
+    const protectedSource = config.protected === true ? config.sourceAddress ?? config.senderAddress : void 0;
+    if (config.protected === true && (protectedSource === void 0 || config.atsc3)) {
+      console.warn("[MulticastTransport] protected join refused: the path reports no per-datagram sender to check against S");
+      return this.#declined(generation, "invalid-request");
+    }
     try {
       const packetIds = config.packetIds?.length ? new Set(config.packetIds) : null;
       console.log(
@@ -21186,7 +21207,7 @@ var MulticastTransport = class {
       this.#subscription = subscription;
       const live = () => !this.#disposed && generation === this.#joinGeneration;
       const anySource = !config.sourceAddress && !config.senderAddress && !config.atsc3;
-      const packetListener = !anySource && subscriptionDeliversPacketBatches(subscription) ? {
+      const packetListener = !anySource && protectedSource === void 0 && subscriptionDeliversPacketBatches(subscription) ? {
         type: "packets",
         listener: (event) => {
           if (!live()) return;
@@ -21202,6 +21223,8 @@ var MulticastTransport = class {
       this.#packetListener = packetListener;
       this.#packetIds = packetIds;
       this.#protected = config.protected === true;
+      this.#protectedSource = protectedSource;
+      this.#matchedSource = void 0;
       this.#providerFilter = {
         acknowledged: packetIds,
         sent: 0,
@@ -21661,13 +21684,23 @@ var MulticastTransport = class {
     this.#delivery = void 0;
     this.#packetIds = null;
     this.#protected = false;
+    this.#protectedSource = void 0;
+    this.#matchedSource = void 0;
     this.#providerFilter = null;
     this.#context = void 0;
     this.#withdrawnPacketIds.clear();
   }
   /** The ingress filter; an accepted packet is counted here, once. */
   #acceptPacket(packet, sourceAddress) {
-    const owner = this.#lockedTo?.() ?? this.#sender;
+    const source = this.#protectedSource;
+    if (source !== void 0 && (sourceAddress === void 0 || sourceAddress !== this.#matchedSource)) {
+      if (sourceAddress === void 0 || !sameIpAddress(sourceAddress, source)) {
+        this.#stats.packetsDroppedForeignSender++;
+        return false;
+      }
+      this.#matchedSource = sourceAddress;
+    }
+    const owner = source === void 0 ? this.#lockedTo?.() ?? this.#sender : void 0;
     if (sourceAddress !== void 0 && owner !== void 0 && sourceAddress !== owner) {
       this.#stats.packetsDroppedForeignSender++;
       return false;