@blockcast/mmt-container 2.1.0 → 2.2.0-main.0f6aad7bb803

package/dist/browser-runtime.js

@@ -489,6 +489,8 @@ var PACKET_TYPE_SIGNALING = 2;
 var PACKET_TYPE_REPAIR = 3;
 var MMTP_SIGNALING_PACKET_ID = 0;
 var MMTP_PACKET_ID_MAX = 65535;
+var FEC_CODE_REED_SOLOMON = 1;
+var FEC_CODE_RAPTORQ = 3;
 function parseMMTPHeader(buffer) {
   if (buffer.length < MMTP_HEADER_SIZE) {
     throw new Error(`MMTP packet too small: ${buffer.length} bytes`);
@@ -655,30 +657,26 @@ function isEmptyOrExactLegacyTrailer(payload, start, end) {
   const authLength = view2.getUint16(2, false);
   return start + LEGACY_TRAILER_HEADER_SIZE + authLength === end;
 }
-function resolveDeclaredTrailers(payload, declaredEnd, fecType, options, rapFlag = false) {
+function resolveDeclaredTrailers(payload, declaredEnd, fecType, options) {
   if (declaredEnd > payload.length)
     return null;
   if (options?.skipFecId) {
-    return isEmptyOrExactLegacyTrailer(payload, declaredEnd, payload.length) ? { hasFecId: false, hasOverlayFecId: false } : null;
+    return isEmptyOrExactLegacyTrailer(payload, declaredEnd, payload.length) ? { hasFecId: false } : null;
   }
-  const overlay = options?.overlayDeclared === true && rapFlag;
   if (fecType === 1) {
-    const fecStart = payload.length - sourceFecTrailerSize(overlay);
+    const fecStart = payload.length - SOURCE_FEC_PAYLOAD_ID_SIZE;
     if (fecStart < declaredEnd || !isEmptyOrExactLegacyTrailer(payload, declaredEnd, fecStart)) {
       return null;
     }
-    return { hasFecId: true, hasOverlayFecId: overlay };
+    return { hasFecId: true };
   }
-  if (fecType !== 0 || overlay)
+  if (fecType !== 0)
     return null;
   if (isEmptyOrExactLegacyTrailer(payload, declaredEnd, payload.length)) {
-    return { hasFecId: false, hasOverlayFecId: false };
+    return { hasFecId: false };
   }
   return null;
 }
-function sourceFecTrailerSize(overlay) {
-  return overlay ? 2 * SOURCE_FEC_PAYLOAD_ID_SIZE : SOURCE_FEC_PAYLOAD_ID_SIZE;
-}
 function extractNALUnit(mmtpPacket) {
   const extraction = extractMFUPayload(mmtpPacket);
   if (!extraction)
@@ -737,11 +735,11 @@ function planMfuExtraction(mmtpPacket, options, parsedHeader) {
   if ("rejection" in layoutResult)
     return layoutResult;
   const { layout } = layoutResult;
-  const trailerLayout = resolveDeclaredTrailers(payload, layout.dataEnd, header.fecType, options, header.rapFlag);
+  const trailerLayout = resolveDeclaredTrailers(payload, layout.dataEnd, header.fecType, options);
   if (!trailerLayout) {
     if (!options?.skipFecId && header.fecType === 1) {
       const observed = payload.length - layout.dataEnd;
-      const expected = sourceFecTrailerSize(options?.overlayDeclared === true && header.rapFlag);
+      const expected = SOURCE_FEC_PAYLOAD_ID_SIZE;
       if (observed !== expected) {
         return {
           rejection: {
@@ -776,13 +774,10 @@ function extractPlannedMfu(mmtpPacket, result) {
   const mfuDuHeader = mfuDuHeaderPresent && mpu.timedFlag === 1 ? parseTimedMfuDuHeader(payload, MPU_HEADER_SIZE) : null;
   const itemId = mfuDuHeaderPresent && mpu.timedFlag === 0 ? new DataView(payload.buffer, payload.byteOffset + MPU_HEADER_SIZE, 4).getUint32(0, false) : null;
   const data = payload.subarray(mfuOffset, dataEnd);
-  const trailerStart = mmtpPacket.length - sourceFecTrailerSize(trailerLayout.hasOverlayFecId);
-  const ssIdAt = (offset) => ({
-    ssId: new DataView(mmtpPacket.buffer, mmtpPacket.byteOffset + offset, 4).getUint32(0, false)
-  });
-  const fecPayloadId = trailerLayout.hasFecId ? ssIdAt(trailerStart) : null;
-  const overlayFecPayloadId = trailerLayout.hasOverlayFecId ? ssIdAt(trailerStart + SOURCE_FEC_PAYLOAD_ID_SIZE) : null;
-  return { header, mpu, fragmentType, data, mfuDuHeader, itemId, fecPayloadId, overlayFecPayloadId };
+  const fecPayloadId = trailerLayout.hasFecId ? {
+    ssId: new DataView(mmtpPacket.buffer, mmtpPacket.byteOffset + mmtpPacket.length - SOURCE_FEC_PAYLOAD_ID_SIZE, 4).getUint32(0, false)
+  } : null;
+  return { header, mpu, fragmentType, data, mfuDuHeader, itemId, fecPayloadId };
 }
 function extractTimestamp(mmtpPacket) {
   const { header } = unwrapMMTP(mmtpPacket);
@@ -903,6 +898,50 @@ var NTP_SHORT_BITS = 32;
 var NTP_SHORT_MODULUS = 2 ** NTP_SHORT_BITS;
 var NTP_SHORT_HALF_RANGE = 2 ** (NTP_SHORT_BITS - 1);
 
+// ../mmt-base/dist/signalling.js
+var FEC_CODING_STRUCTURE_ONE_STAGE = 1;
+var SSBG_MODE_1 = 1;
+var RAPTORQ_MAX_SOURCE_SYMBOLS = 56403;
+var REPAIR_SYMBOL_ID_MAX = 16777215;
+var MIN_REPAIR_SYMBOL_SIZE = 14;
+var REED_SOLOMON_MAX_BLOCK = 255;
+function alFecRaptorQFlowConfig(flow) {
+  if (flow.fecCodingStructure !== FEC_CODING_STRUCTURE_ONE_STAGE || flow.repairFlows.length !== 1)
+    return null;
+  if (flow.ssbgMode !== SSBG_MODE_1 || flow.ffsrptsFlag !== 0 || flow.fecPayloadIdMode !== 0)
+    return null;
+  if (flow.packetIds.length !== 1)
+    return null;
+  const repair = flow.repairFlows[0];
+  const { fecCodeId, maximumK: k, maximumP: p } = repair;
+  const t = flow.repairSymbolSize;
+  if (t < MIN_REPAIR_SYMBOL_SIZE || k < 1 || p < 1 || k + p - 1 > REPAIR_SYMBOL_ID_MAX)
+    return null;
+  if (fecCodeId === FEC_CODE_RAPTORQ) {
+    if (t % 8 !== 0 || k > RAPTORQ_MAX_SOURCE_SYMBOLS)
+      return null;
+  } else if (fecCodeId === FEC_CODE_REED_SOLOMON) {
+    if (k + p > REED_SOLOMON_MAX_BLOCK)
+      return null;
+  } else {
+    return null;
+  }
+  if (repair.repairFlowId === MMTP_SIGNALING_PACKET_ID || repair.repairFlowId === flow.packetIds[0])
+    return null;
+  return {
+    sourcePacketIds: [...flow.packetIds],
+    repairFlowId: repair.repairFlowId,
+    fecCodeId,
+    ssbgMode: flow.ssbgMode,
+    fecPayloadIdMode: flow.fecPayloadIdMode,
+    repairSymbolSize: t,
+    maximumK: k,
+    maximumP: p,
+    protectionWindowTime: repair.protectionWindowTime,
+    protectionWindowSize: repair.protectionWindowSize
+  };
+}
+
 // ../mmt-base/dist/serial-number.js
 var SERIAL32_SPAN = 4294967296;
 var SERIAL32_HALF = 2147483648;
@@ -7457,11 +7496,33 @@ var AdaptiveBitrateController = class {
 };
 
 // node_modules/@blockcast/mmt-base/dist/mmtp.js
+var MMTP_HEADER_SIZE2 = 12;
 var MPU_HEADER_SIZE2 = 8;
 var MPU_LENGTH_FIELD_SIZE2 = 2;
 var MPU_HEADER_REMAINDER_SIZE2 = MPU_HEADER_SIZE2 - MPU_LENGTH_FIELD_SIZE2;
 var MMTP_SIGNALING_PACKET_ID2 = 0;
 var MMTP_PACKET_ID_MAX2 = 65535;
+function readMMTPPacketId2(buffer) {
+  if (buffer.length < MMTP_HEADER_SIZE2)
+    return null;
+  const flags = buffer[0];
+  if ((flags >> 6 & 3) !== 0)
+    return null;
+  let offset = MMTP_HEADER_SIZE2;
+  if ((flags & 32) !== 0) {
+    if (offset + 4 > buffer.length)
+      return null;
+    offset += 4;
+  }
+  if ((flags & 2) !== 0) {
+    if (offset + 4 > buffer.length)
+      return null;
+    const length = buffer[offset + 2] << 8 | buffer[offset + 3];
+    if (offset + 4 + length > buffer.length)
+      return null;
+  }
+  return buffer[2] << 8 | buffer[3];
+}
 
 // node_modules/@blockcast/mmt-base/dist/net-constants.js
 var DEFAULT_AMT_RELAY_PORT2 = 2268;
@@ -8447,6 +8508,205 @@ var TransportManager = class {
 };
 var transportManager = new TransportManager();
 
+// node_modules/@blockcast/mmt-transport/dist/multicast-receiver-gateway.js
+var REGISTRY = /* @__PURE__ */ Symbol.for("@blockcast/mmt-transport/native-provider-registry/v1");
+var USER_AGENT_VERIFIED = /* @__PURE__ */ Symbol.for("@blockcast/mmt-transport/user-agent-verified/v1");
+var INTEGRITY_SCHEME = "manifest-ed25519-2";
+var MulticastError = class extends Error {
+  code;
+  constructor(code, message, cause) {
+    super(message, cause === void 0 ? void 0 : { cause });
+    this.name = "MulticastError";
+    this.code = code;
+  }
+};
+function datagramsOf(chunk) {
+  const list = Array.isArray(chunk) ? chunk : chunk?.datagrams ?? [];
+  const out = [];
+  for (const d of list) {
+    const data = d instanceof Uint8Array || d instanceof ArrayBuffer ? d : d?.data;
+    if (data instanceof Uint8Array)
+      out.push(data);
+    else if (data instanceof ArrayBuffer)
+      out.push(new Uint8Array(data));
+  }
+  return out;
+}
+function reasonOf(value) {
+  return typeof value === "object" && value !== null && "reason" in value ? value.reason : value;
+}
+function registry() {
+  const g = globalThis;
+  if (g[REGISTRY] === void 0) {
+    const providers = /* @__PURE__ */ new WeakSet();
+    const byScope = /* @__PURE__ */ new WeakMap();
+    Object.defineProperty(g, REGISTRY, {
+      value: Object.freeze({
+        isProvider: (x) => typeof x === "object" && x !== null && providers.has(x),
+        providerFor: (scope) => {
+          let provider = byScope.get(scope);
+          if (provider === void 0) {
+            provider = createProvider(scope);
+            providers.add(provider);
+            byScope.set(scope, provider);
+          }
+          return provider;
+        }
+      }),
+      writable: false,
+      configurable: false,
+      enumerable: false
+    });
+  }
+  return g[REGISTRY];
+}
+function resolveMulticastGateway(scope = globalThis) {
+  const s = scope;
+  if (typeof s.MulticastReceiver === "function")
+    return registry().providerFor(scope);
+  if (typeof s.multicast?.subscribe === "function")
+    return s.multicast;
+  return void 0;
+}
+function isUserAgentVerifiedGateway(gateway) {
+  return registry().isProvider(gateway);
+}
+function userAgentVerifiedIngress(ingress, gateway) {
+  if (isUserAgentVerifiedGateway(gateway))
+    return { ...ingress, admittedBy: USER_AGENT_VERIFIED };
+  if (!("admittedBy" in ingress))
+    return ingress;
+  const { admittedBy: _, ...rest } = ingress;
+  return rest;
+}
+function unsupported(message, cause) {
+  return new MulticastError("capability-unsupported", message, cause);
+}
+function createProvider(scope) {
+  const Receiver = scope.MulticastReceiver;
+  let gate = null;
+  return {
+    capabilities: () => Promise.resolve({ consumeModes: ["bytes"] }),
+    subscribe: async (config) => {
+      const c = config;
+      if (c.consume !== "bytes")
+        throw unsupported(`consume mode ${String(c.consume)} is not supported`);
+      const origin = c.origin ?? "ip-multicast";
+      if (origin !== "ip-multicast" && !(origin === "amt" && c.discovery === "driad")) {
+        throw unsupported(`origin ${String(origin)} is not supported by MulticastReceiver`);
+      }
+      if (c.relay !== void 0)
+        throw unsupported("MulticastReceiver picks its own AMT relay");
+      if (!c.source)
+        throw unsupported("MulticastReceiver needs an SSM source");
+      if (c.senderAddress !== void 0 && c.senderAddress !== c.source) {
+        throw unsupported("MulticastReceiver filters by source only");
+      }
+      const options = { sourceAddress: c.source, groupAddress: c.group, localPort: c.port };
+      if (gate !== null)
+        await gate;
+      let rx;
+      try {
+        rx = new Receiver(options);
+      } catch (error) {
+        throw unsupported("MulticastReceiver refused the request", error);
+      }
+      const opened = rx.opened;
+      if (gate === null)
+        gate = opened.then(() => void 0, () => void 0);
+      return openSubscription(rx, opened, options, c.packetIds);
+    }
+  };
+}
+async function openSubscription(rx, openedPromise, options, packetIds) {
+  let opened;
+  try {
+    opened = await openedPromise;
+  } catch (error) {
+    throw new MulticastError("subscription-failed", "MulticastReceiver did not open", error);
+  }
+  if (rx.integrityScheme !== INTEGRITY_SCHEME) {
+    await rx.close();
+    throw unsupported(`integrity scheme ${String(rx.integrityScheme)} is not ${INTEGRITY_SCHEME}`);
+  }
+  const events = new EventTarget();
+  let state = "connected";
+  let filter = packetIds?.length ? new Set(packetIds) : null;
+  let closing = false;
+  const setState = (next) => {
+    if (state === next)
+      return;
+    state = next;
+    events.dispatchEvent(new CustomEvent("state", { detail: next }));
+  };
+  const sourceAddress = options.sourceAddress;
+  const subscription = {
+    id: `${options.sourceAddress}|${options.groupAddress}|${options.localPort}`,
+    get state() {
+      return state;
+    },
+    delivery: "datagram",
+    eventTypes: Object.freeze(["bytes", "packets", "state", "error"]),
+    setPacketIds(ids) {
+      filter = ids.length ? new Set(ids) : null;
+    },
+    addEventListener: events.addEventListener.bind(events),
+    removeEventListener: events.removeEventListener.bind(events),
+    async unsubscribe() {
+      closing = true;
+      await rx.close();
+      setState("closed");
+    }
+  };
+  void (async () => {
+    const reader = opened.readable.getReader();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done)
+          break;
+        const packets = [];
+        for (const data of datagramsOf(value)) {
+          if (filter !== null) {
+            const id = readMMTPPacketId2(data);
+            if (id === null || !filter.has(id))
+              continue;
+          }
+          const copy = data.slice().buffer;
+          packets.push(copy);
+          events.dispatchEvent(Object.assign(new CustomEvent("bytes", { detail: copy }), { sourceAddress }));
+        }
+        if (packets.length > 0)
+          events.dispatchEvent(new CustomEvent("packets", { detail: packets }));
+      }
+    } catch {
+    }
+  })();
+  void rx.closed.then((value) => {
+    const reason = reasonOf(value);
+    if (!closing) {
+      if (reason === "consent-withdrawn") {
+        events.dispatchEvent(new CustomEvent("error", {
+          detail: new MulticastError("origin-not-trusted", "multicast consent withdrawn")
+        }));
+      } else if (reason === "oversubscribed" || reason === "network") {
+        events.dispatchEvent(new CustomEvent("error", {
+          detail: new MulticastError("subscription-failed", `MulticastReceiver closed: ${reason}`)
+        }));
+      }
+    }
+    setState("closed");
+  }, (error) => {
+    if (!closing) {
+      events.dispatchEvent(new CustomEvent("error", {
+        detail: new MulticastError("subscription-failed", "MulticastReceiver failed", error)
+      }));
+    }
+    setState("closed");
+  });
+  return subscription;
+}
+
 // node_modules/@blockcast/mmt-transport/dist/moqt-priority.js
 var MAX_MOQT_PRIORITY = 255;
 function moqtPriority(value, field) {
@@ -8733,9 +8993,9 @@ function validateTemplatePair(mediaUriTemplate, mediaObjectTemplate, path) {
 }
 function validateMmtpDashTemplate(template, path) {
   const variables = [...template.matchAll(TEMPLATE_VARIABLE)].map((match) => match[1]);
-  const unsupported = variables.find((variable) => variable !== "Number" && variable !== "RepresentationID");
-  if (unsupported !== void 0) {
-    throw new Error(`${path} contains unsupported MMTP-backed DASH template variable $${unsupported}$`);
+  const unsupported2 = variables.find((variable) => variable !== "Number" && variable !== "RepresentationID");
+  if (unsupported2 !== void 0) {
+    throw new Error(`${path} contains unsupported MMTP-backed DASH template variable $${unsupported2}$`);
   }
   if (variables.filter((variable) => variable === "Number").length !== 1) {
     throw new Error(`${path} must contain exactly one $Number$ for MMTP-backed DASH`);
@@ -17098,17 +17358,17 @@ var FECManager = class _FECManager {
 
 // src/mfu-reassembly-policy.ts
 function validateReliableMoqOptionShape(value) {
-  const unsupported = Object.keys(value).filter(
+  const unsupported2 = Object.keys(value).filter(
     (key) => key !== "transport" && key !== "startsAtRandomAccessGroup"
   );
-  if (unsupported.length > 0) {
-    if (unsupported.includes("maxRacingGroups")) {
+  if (unsupported2.length > 0) {
+    if (unsupported2.includes("maxRacingGroups")) {
       throw new Error(
         "[MFU reassembly] maxRacingGroups was removed; reliable MoQ completion is transport-owned"
       );
     }
     throw new Error(
-      `[MFU reassembly] unsupported reliable MoQ option(s): ${unsupported.join(", ")}`
+      `[MFU reassembly] unsupported reliable MoQ option(s): ${unsupported2.join(", ")}`
     );
   }
   const startsAtRandomAccessGroup = value["startsAtRandomAccessGroup"];
@@ -17152,12 +17412,12 @@ function assertValidMfuReassemblyPolicy(policy) {
     return;
   }
   if (value["transport"] === "datagram") {
-    const unsupported = Object.keys(value).filter(
+    const unsupported2 = Object.keys(value).filter(
       (key) => key !== "transport" && key !== "deadlineMs"
     );
-    if (unsupported.length > 0) {
+    if (unsupported2.length > 0) {
       throw new Error(
-        `[MFU reassembly] unsupported datagram option(s): ${unsupported.join(", ")}`
+        `[MFU reassembly] unsupported datagram option(s): ${unsupported2.join(", ")}`
       );
     }
     assertValidDatagramDeadline(value["deadlineMs"]);
@@ -23579,10 +23839,11 @@ var MmtpRouter = class {
     if (!entry) return;
     entry.receiver.release();
     entry.protected = false;
+    entry.userAgent = false;
     this.#assistBlocks.clear();
     this.#assistFailures.clear();
   }
-  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  /** Packets of a track a protected flow lists, dropped unread: a MoQ copy (duplicate, overflow, or listed by more than one flow) or a multicast source datagram that names no flow, of a track a user-agent-admitted flow lists. */
   get unadmittedListedDropCount() {
     return this.#unadmittedListedDrops;
   }
@@ -23623,6 +23884,13 @@ var MmtpRouter = class {
     }
     return false;
   }
+  /** Whether a protected flow the user agent admitted lists `packetId`. */
+  #userAgentGoverns(packetId) {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && entry.userAgent && ingressHasPacketId(entry.ingress, packetId)) return true;
+    }
+    return false;
+  }
   /**
    * A MoQ repair symbol no protected flow lists, owned by a source track one
    * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
@@ -23713,7 +23981,7 @@ var MmtpRouter = class {
       fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
       fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
       fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-    })) {
+    }, true)) {
       this.#unlistedAssistedRecoveries++;
       this.#assistBlocks.delete(key);
       return;
@@ -24869,6 +25137,12 @@ var MmtpRouter = class {
         debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
+      if (ingress.admittedBy === USER_AGENT_VERIFIED) {
+        this.#noteFlowAdmitted(ingress.flow);
+        protectedFlow.userAgent = true;
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+        return;
+      }
       const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
       if (verdict === "admitted") {
         this.#noteFlowAdmitted(ingress.flow);
@@ -24886,6 +25160,11 @@ var MmtpRouter = class {
         return;
       }
     }
+    const flowless = source === "multicast" && !manifestAdmitted && ingress?.flow === void 0;
+    if (flowless && !info.isRepair && this.#userAgentGoverns(info.packetId)) {
+      this.#unadmittedListedDrops++;
+      return;
+    }
     if (info.isRepair) {
       const overlay = this.#overlayRepairTarget(info.packetId, catalogTrackNameForPacket(ingress, info.packetId));
       if (overlay !== void 0) {
@@ -24903,7 +25182,7 @@ var MmtpRouter = class {
       );
       if (!repair) return;
       if (ownerPacketId != null && this.#fecManager) {
-        if (source === "moq" && !manifestAdmitted && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)) return;
+        if ((flowless && this.#userAgentGoverns(ownerPacketId) || source === "moq" && !manifestAdmitted) && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
         const count = this.#repairPidCounts[info.packetId];
         if (count <= 2 || count % 500 === 0) {
@@ -25482,7 +25761,7 @@ var MmtpRouter = class {
   }
   // ── Private: FEC recovery routing ───────────────────────────────
   /** Route WASM-recovered block through appropriate path based on container kind. */
-  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName, complete) {
+  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName, complete, assisted = false) {
     const packetSymbolSize = this.#symbolSizeForPacket(ownerPacketId);
     if (ownerPacketId === void 0) {
       throw new Error("[MmtpRouter] a recovered FEC block needs its owner packetId to read its fec.blockProfile");
@@ -25499,7 +25778,7 @@ var MmtpRouter = class {
       ownerPacketId,
       blockProfile
     });
-    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted);
   }
   /**
    * A recovered source packet of a protected flow is admitted on its own
@@ -25511,9 +25790,24 @@ var MmtpRouter = class {
    * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
    * open, so it reaches its FEC deadline and fails by class. Always true
    * outside a protected flow.
-   */
-  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete) {
-    const receiver = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+   *
+   * On a flow the user agent admitted, the live decoder's recoveries are kept
+   * without a record: while the flow is protected that decoder takes only
+   * symbols the user agent or a record verified (a flow-less multicast
+   * datagram of a listed track is dropped or set aside in #processMMTP), so
+   * what it recovers is as verified as they are. An `assisted` (scratch-decoder) recovery mixes in
+   * unlisted MoQ repair and still needs a record.
+   * ponytail: per-flow flag; per-block provenance only if a protected flow
+   * ever mixes verified and unverified live inputs.
+   * ponytail: a worker frame computed before the protection reset can still
+   * arrive after it (frames carry no epoch); its inputs are MoQ copies read
+   * and played before protection, so it admits nothing new. Drop pre-reset
+   * frames by epoch only if pre-protection input ever matters.
+   */
+  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted = false) {
+    const entry = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const receiver = entry === void 0 || entry === "ambiguous" ? entry : entry.receiver;
+    const userAgent = !assisted && entry !== void 0 && entry !== "ambiguous" && entry.protected === true && entry.userAgent === true;
     let recovered = true;
     if (receiver) {
       const parsed = this.#stream(ownerPacketId, catalogTrackName).duplicates.parsedSymbols;
@@ -25525,6 +25819,8 @@ var MmtpRouter = class {
           let admitted = false;
           if (receiver === "ambiguous") {
             this.#ambiguousRecoveredDrops++;
+          } else if (userAgent) {
+            admitted = true;
           } else {
             const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
             wire.set(sym.rawSymbol);
@@ -25552,12 +25848,12 @@ var MmtpRouter = class {
       catalogTrackName === void 0 || !byName ? byName?.values() : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)] : []
     );
     if (flows.size > 1) return "ambiguous";
-    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound) ?? "ambiguous";
     let match;
-    for (const { receiver, ingress } of this.#provenance.values()) {
-      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
+    for (const entry of this.#provenance.values()) {
+      if (entry.ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
         if (match) return "ambiguous";
-        match = receiver;
+        match = entry;
       }
     }
     return match;
@@ -26339,11 +26635,8 @@ function providerErrorOf(error) {
   return Object.freeze(typeof code === "string" ? { name, message, code } : { name, message });
 }
 var MAX_TRACKED_DROPPED_PIDS = 16;
-function getMulticastGlobals() {
-  return globalThis;
-}
 function hasMulticastGateway() {
-  return typeof getMulticastGlobals().multicast?.subscribe === "function";
+  return typeof resolveMulticastGateway()?.subscribe === "function";
 }
 function senderOf(event) {
   const sourceAddress = event.sourceAddress;
@@ -26435,6 +26728,9 @@ var MulticastTransport = class {
   // listener closure, so an in-place admission change (setContext) applies
   // from the next packet on without rejoining.
   #context = void 0;
+  #deliveredContext = void 0;
+  /** The live join's gateway, when it is the user agent's MulticastReceiver provider. */
+  #userAgentGateway = void 0;
   // The live join's provider-side filter. An in-place widening must reach it,
   // or the provider never delivers the new ID; null without a live join.
   #providerFilter = null;
@@ -26471,7 +26767,7 @@ var MulticastTransport = class {
     this.#dataPlaneLive = false;
     this.#sender = void 0;
     if (this.#disposed) return this.#declined(generation, "disposed");
-    const gateway = this.#gateway ?? getMulticastGlobals().multicast;
+    const gateway = this.#gateway ?? resolveMulticastGateway();
     if (typeof gateway?.subscribe !== "function") {
       console.warn("[MulticastTransport] Multicast API not available");
       return this.#declined(generation, "unavailable");
@@ -26487,15 +26783,16 @@ var MulticastTransport = class {
       console.log(
         `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress ?? config.senderAddress ?? "*"}, ${config.groupAddress}, ${config.port})`
       );
+      const userAgent = isUserAgentVerifiedGateway(gateway);
       const subscribeConfig = toWindowMulticastSubscribeConfig({
         source: config.sourceAddress,
         senderAddress: config.senderAddress,
         group: config.groupAddress,
         port: config.port,
-        mode: config.mode,
-        amtRelay: config.amtRelay,
-        amtRelayPort: config.amtRelayPort,
-        amtDiscovery: config.amtDiscovery,
+        mode: userAgent ? "native" : config.mode,
+        amtRelay: userAgent ? void 0 : config.amtRelay,
+        amtRelayPort: userAgent ? void 0 : config.amtRelayPort,
+        amtDiscovery: userAgent ? void 0 : config.amtDiscovery,
         packetIds: config.packetIds,
         tracks: config.tracks,
         atsc3: config.atsc3
@@ -26541,7 +26838,8 @@ var MulticastTransport = class {
         acknowledgedUpdate: 0,
         inFlight: 0
       };
-      this.#context = context;
+      this.#userAgentGateway = userAgent ? gateway : void 0;
+      this.#setContext(context);
       if (packetIds) {
         for (const packetId of packetIds) {
           if (!this.#acceptedBytesByPacketId.has(packetId)) {
@@ -26549,7 +26847,7 @@ var MulticastTransport = class {
           }
         }
       }
-      this.#resolvedTransport = subscribeConfig.origin === "amt" ? "amt" : "native";
+      this.#resolvedTransport = userAgent ? "user-agent" : subscribeConfig.origin === "amt" ? "amt" : "native";
       const delivery = subscription.delivery ?? "datagram";
       if (delivery !== "datagram" && delivery !== "ordered-relay") {
         throw new Error(
@@ -26630,7 +26928,7 @@ var MulticastTransport = class {
     }
     if (!this.#acceptPacket(packet, sourceAddress)) return false;
     const liveness = !this.#isRecordCandidate(packet);
-    this.#onPacket(packet, this.#context);
+    this.#onPacket(packet, this.#deliveredContext);
     return liveness;
   }
   #isRecordCandidate(packet) {
@@ -26841,8 +27139,10 @@ var MulticastTransport = class {
     return this.#subscription !== null;
   }
   /**
-   * What the live join delivers with every accepted packet (the join's
-   * `context`, or the last setContext), or undefined without a live join.
+   * The live join's context as the caller gave it (the join's `context`, or
+   * the last setContext), or undefined without a live join. On a native
+   * provider each accepted packet is delivered with a marked copy of it
+   * (`userAgentVerifiedIngress`); this getter never carries the mark.
    */
   get context() {
     return this.#context;
@@ -26866,7 +27166,16 @@ var MulticastTransport = class {
         "[MulticastTransport] setContext needs a live join; join() carries the first context"
       );
     }
+    this.#setContext(context);
+  }
+  /**
+   * The join's context, and what the subscription delivers with each packet:
+   * marked admitted by the user agent when the gateway is its native
+   * MulticastReceiver provider. feedPacket never marks.
+   */
+  #setContext(context) {
     this.#context = context;
+    this.#deliveredContext = this.#userAgentGateway !== void 0 && typeof context === "object" && context !== null ? userAgentVerifiedIngress(context, this.#userAgentGateway) : context;
   }
   /**
    * Replace the live join's packet-ID allow-list in place, without rejoining.
@@ -26998,6 +27307,8 @@ var MulticastTransport = class {
     this.#matchedSource = void 0;
     this.#providerFilter = null;
     this.#context = void 0;
+    this.#deliveredContext = void 0;
+    this.#userAgentGateway = void 0;
     this.#withdrawnPacketIds.clear();
   }
   /** The ingress filter; an accepted packet is counted here, once. */
@@ -28350,8 +28661,17 @@ var MulticastManager = class {
    * repair roles and owners are registered here; in-band owners stay the
    * caller's. Joining is best effort: a group that fails to join is logged
    * and leaves the media join as it was.
-   */
-  joinRepairEndpoints(endpoints, provider) {
+   *
+   * `options.gateway` names the gateway a subscribe callback reads through.
+   * When it is the browser's own MulticastReceiver provider, the callback's
+   * packets are fed as admitted by the user agent
+   * (`userAgentVerifiedIngress`); nothing the callback passes can mark them.
+   * The mark rests on this statement, not on the data path: every packet the
+   * callback delivers must come from a subscription opened on
+   * `options.gateway`. A callback that also merges another source (a MoQ or
+   * WebSocket repair feed) must not name a native provider here.
+   */
+  joinRepairEndpoints(endpoints, provider, options) {
     const releases = [];
     let released = false;
     const safely = (each) => {
@@ -28373,17 +28693,19 @@ var MulticastManager = class {
         ...endpoint.flow === void 0 ? {} : { flow: endpoint.flow }
       };
       let sender;
-      const onPacket = (packet, sourceAddress) => {
+      const feed = (packet, sourceAddress, ingressToFeed) => {
         if (released) return;
         if (sourceAddress !== void 0 && !sameDatagramSource(sourceAddress, this.#transport.sender ?? (sender ??= sourceAddress))) return;
-        this.#router.feedPacket(packet, "multicast", ingress);
+        this.#router.feedPacket(packet, "multicast", ingressToFeed);
       };
       const fail = (error) => console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
       if (typeof provider === "function") {
+        const marked = userAgentVerifiedIngress(ingress, options?.gateway);
+        const onPacket = (packet, sourceAddress) => feed(packet, sourceAddress, marked);
         Promise.resolve().then(() => provider(endpoint, onPacket)).then((release2) => released ? safely(release2) : releases.push(release2), fail);
         continue;
       }
-      const transport = new MulticastTransport((packet) => onPacket(packet), {
+      const transport = new MulticastTransport((packet, delivered) => feed(packet, void 0, delivered ?? ingress), {
         gateway: provider,
         lockedTo: () => this.#transport.sender
       });
@@ -28395,11 +28717,12 @@ var MulticastManager = class {
         mode: endpoint.mode,
         amtRelay: endpoint.amtRelay,
         amtRelayPort: endpoint.amtRelayPort ?? (endpoint.amtRelay?.trim() ? DEFAULT_AMT_RELAY_PORT : void 0),
+        amtDiscovery: endpoint.amtDiscovery,
         packetIds: endpoint.packetIds,
         tracks: endpoint.tracks.map(({ name, packetId }) => ({ name, packetId })),
         // A protected repair group's records ride in band on its port (7.2.3).
         ...endpoint.flow === void 0 ? {} : { protected: true }
-      }).then((joined) => {
+      }, ingress).then((joined) => {
         if (!joined && !released) fail(transport.lastJoinOutcome);
       });
     }
@@ -31170,12 +31493,12 @@ function moqtPriority2(value) {
 function catalogRepairTarget(catalog, source) {
   const binding = bindingOf(catalog, source);
   if (binding?.status !== "ok" || !(binding.base.interleaveDepthMs ?? 0)) return null;
-  const layerZero = binding.layers[0];
+  const layerZero2 = binding.layers[0];
   const m = /^\/tracks\/(\d+)$/.exec(binding.pointer);
   const tracks = catalog.tracks;
   const entry = m && Array.isArray(tracks) ? tracks[Number(m[1])] : void 0;
   const sourcePriority = entry ? moqtPriority2(entry["priority"]) : null;
-  return { repairTrack: layerZero.repairTrackName, sourcePriority, repairPriority: layerZero.priority };
+  return { repairTrack: layerZero2.repairTrackName, sourcePriority, repairPriority: layerZero2.priority };
 }
 function numericField(value) {
   const n = typeof value === "number" ? value : typeof value === "string" ? Number(value) : Number.NaN;
@@ -31257,7 +31580,14 @@ function resolveCatalogTrackFec(catalog, tracks) {
 var PATH_BITS = { moq: 1, multicast: 2 };
 var MIXED_PATHS = PATH_BITS.moq | PATH_BITS.multicast;
 var MmtpFecSession = class {
+  /** P_0 = B_0, the held total every repair packet is checked against. */
+  get repairSymbols() {
+    return this.#repairSymbols;
+  }
   #decoder;
+  #repairSymbols;
+  /** The message entry a catalog-less session was built from; undefined under a catalog. */
+  #message;
   /** Blocks a repair has defined and that are not settled yet, by SS_Start. */
   #blocks = /* @__PURE__ */ new Map();
   /** SS_Starts of settled blocks, so a later repair for one is refused. */
@@ -31295,6 +31625,24 @@ var MmtpFecSession = class {
    *   `interleaveDepthMs` or `reorderToleranceMs`. None is defaulted.
    */
   constructor(config) {
+    if (config && "alFecFlow" in config) {
+      const message = alFecRaptorQFlowConfig(config.alFecFlow);
+      if (!message) {
+        throw new Error("MmtpFecSession: the AL-FEC entry is outside draft-ramadan-moq-mmt-02 8.3 (iso-ssbg1-v1)");
+      }
+      this.#message = message;
+      this.blockProfile = parseFecBlockProfile("iso-ssbg1-v1", "alFecFlow");
+      this.algorithm = message.fecCodeId === FEC_CODE_RAPTORQ ? "raptorq" : "reed-solomon";
+      this.sourceSymbols = message.maximumK;
+      this.#repairSymbols = message.maximumP;
+      this.symbolSize = message.repairSymbolSize;
+      this.retentionBlocks = requirePositiveInteger(config.retentionBlocks, "retentionBlocks");
+      this.#repairPacketId = message.repairFlowId;
+      this.#heldLayers = layerZero(message.maximumP);
+      this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols);
+      this.#decoder = buildDecoder(config.Decoder, this);
+      return;
+    }
     const fec = config?.fec;
     if (!fec || typeof fec !== "object") {
       throw new Error("MmtpFecSession: the catalog fec instance is required");
@@ -31305,7 +31653,7 @@ var MmtpFecSession = class {
     }
     this.algorithm = fec.scheme;
     this.sourceSymbols = requirePositiveInteger(fec.sourceSymbols, "fec.sourceSymbols");
-    this.repairSymbols = requirePositiveInteger(fec.repairSymbols, "fec.repairSymbols");
+    this.#repairSymbols = requirePositiveInteger(fec.repairSymbols, "fec.repairSymbols");
     this.symbolSize = requirePositiveInteger(fec.symbolSize, "fec.symbolSize");
     const interleaveDepthMs = requireNumber(fec.interleaveDepthMs, "fec.interleaveDepthMs");
     const reorderToleranceMs = requireNumber(fec.reorderToleranceMs, "fec.reorderToleranceMs");
@@ -31325,17 +31673,30 @@ var MmtpFecSession = class {
       config.heldLayers
     );
     this.#anchorHorizon = heldLayerAnchorHorizon(this.retentionBlocks, this.sourceSymbols);
-    if (typeof config.Decoder !== "function") {
-      throw new Error("MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required");
-    }
-    const decoder = new config.Decoder(this.retentionBlocks, this.blockProfile, this.algorithm);
-    try {
-      decoder.configure_params(this.sourceSymbols, this.symbolSize);
-    } catch (error) {
-      decoder.free();
-      throw error;
-    }
-    this.#decoder = decoder;
+    this.#decoder = buildDecoder(config.Decoder, this);
+  }
+  /**
+   * A later version of the AL-FEC message, catalog-less sessions only. A
+   * maximum_p_for_repair_flow above the held total raises it (`raised`): the
+   * anchored check restarts at the new total, so a block generated under the
+   * previous one stays valid before the first block carrying the new total
+   * (fec-core-00 7.3.2, mmt-02 8.3). A field at or below it changes nothing
+   * (`unchanged`): no publisher lowers it, and the check catches a wire that
+   * does. An entry with another asset, repair flow, code point, K or T, or
+   * one outside 8.3, is `refused`: that is a new source encoding, which needs
+   * a new session. A latched fail-closed stays latched either way.
+   */
+  updateAlFecFlow(flow) {
+    const held = this.#message;
+    if (!held) throw new Error("MmtpFecSession: updateAlFecFlow() needs a session built from an AL-FEC entry");
+    const next = alFecRaptorQFlowConfig(flow);
+    if (!next || next.sourcePacketIds[0] !== held.sourcePacketIds[0] || next.repairFlowId !== held.repairFlowId || next.fecCodeId !== held.fecCodeId || next.maximumK !== held.maximumK || next.repairSymbolSize !== held.repairSymbolSize) {
+      return "refused";
+    }
+    if (next.maximumP <= this.#repairSymbols) return "unchanged";
+    this.#repairSymbols = next.maximumP;
+    this.#heldLayers = layerZero(next.maximumP);
+    return "raised";
   }
   /** True once release() ran. */
   get released() {
@@ -31430,7 +31791,7 @@ var MmtpFecSession = class {
     }
     if (admission.reject) {
       const verdict2 = this.#heldLayers.failsClosed(
-        repairTrackName,
+        this.#trackFor(repairTrackName),
         frame.ssStart,
         frame.rsbLength,
         this.#anchorHorizon,
@@ -31445,7 +31806,7 @@ var MmtpFecSession = class {
     this.#repairPacketId ??= frame.packetId;
     if (frame.ssbLength > this.sourceSymbols) return this.#drop("repair:ssb-length");
     const verdict = this.#heldLayers.admit(
-      repairTrackName,
+      this.#trackFor(repairTrackName),
       frame.ssStart,
       frame.rsbLength,
       this.#anchorHorizon,
@@ -31504,6 +31865,10 @@ var MmtpFecSession = class {
     decoder.free();
     return true;
   }
+  /** Catalog-less: layer 0 has no own-track clause (mmt-02 8.3), so no track name is judged. */
+  #trackFor(repairTrackName) {
+    return this.#message ? void 0 : repairTrackName;
+  }
   #drop(reason) {
     this.#stats.dropped[reason] = (this.#stats.dropped[reason] ?? 0) + 1;
     return [];
@@ -31625,6 +31990,22 @@ var MmtpFecSession = class {
     }
   }
 };
+function layerZero(total) {
+  return new HeldLayerAdmission([{ layer: 0, repairTrackName: "", rsIdOffset: 0, repairSymbols: total }]);
+}
+function buildDecoder(Decoder, session) {
+  if (typeof Decoder !== "function") {
+    throw new Error("MmtpFecSession: a decoder constructor (wasm_bindgen.MmtFecDecoder) is required");
+  }
+  const decoder = new Decoder(session.retentionBlocks, session.blockProfile, session.algorithm);
+  try {
+    decoder.configure_params(session.sourceSymbols, session.symbolSize);
+  } catch (error) {
+    decoder.free();
+    throw error;
+  }
+  return decoder;
+}
 function requirePositiveInteger(value, path) {
   if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
     throw new Error(`MmtpFecSession: ${path} must be a positive integer (got ${String(value)})`);