@blockcast/mmt-container 2.1.0 → 2.2.0-main.73af0eedcbc8

package/src/mmtp-router.ts

@@ -23,6 +23,7 @@ import {
   type MMTPHeader,
   type MoqRepairFrame,
 } from "@blockcast/mmt-base";
+import { USER_AGENT_VERIFIED } from "@blockcast/mmt-transport";
 import type { FECManager, IsoHeldSource, WasmFecDecoder } from "./fec-manager.js";
 import type { IsoPlacedSource, IsoRepairPlacement } from "./iso-block-locator.js";
 import { isMfuReassemblyError } from "./mfu-reassembler.js";
@@ -245,6 +246,14 @@ export interface MmtpIngressContext {
    * the same ingress and `feedPacket` splits them off.
    */
   flow?: string;
+  /**
+   * `USER_AGENT_VERIFIED` when the datagram came from the browser's own
+   * MulticastReceiver, which verified the flow's records itself and delivers
+   * only admitted data (`userAgentVerifiedIngress` in
+   * `@blockcast/mmt-transport`). A protected multicast datagram carrying it
+   * is admitted without a record. Any other value means nothing.
+   */
+  admittedBy?: symbol;
 }
 
 /** One physical stream: an MMTP packet ID and the catalog track it carries. */
@@ -946,6 +955,15 @@ function sourceSymbolEvidence(
   };
 }
 
+/** One protected flow: its 7.2.7 receiver, and the ingress its datagrams arrive with. */
+interface ProvenanceEntry {
+  receiver: BcProvenanceV2Receiver;
+  ingress: MmtpIngressContext;
+  protected?: boolean;
+  /** A datagram the user agent verified admitted the flow (`admittedBy`). */
+  userAgent?: boolean;
+}
+
 export class MmtpRouter {
   readonly #parser: MmtpContainerParser;
   // Source AND FEC-recovered MFU fragments share ONE reassembler — the parser's
@@ -955,10 +973,7 @@ export class MmtpRouter {
   #defaultFecMapper: FecBlockMapper | null;
   #fecMappersByPacketId = new Map<number, FecBlockMapper>();
   /** Protected flows: one 7.2.7 receiver each, and the ingress its datagrams arrive with. */
-  readonly #provenance = new Map<
-    string,
-    { receiver: BcProvenanceV2Receiver; ingress: MmtpIngressContext; protected?: boolean }
-  >();
+  readonly #provenance = new Map<string, ProvenanceEntry>();
   #onFlowProtected: ((flow: string) => void) | null = null;
   #unadmittedListedDrops = 0;
   #unlistedRepairSetAside = 0;
@@ -2329,12 +2344,13 @@ export class MmtpRouter {
     if (!entry) return;
     entry.receiver.release();
     entry.protected = false;
+    entry.userAgent = false;
     // ponytail: drops every governed block's record, not only this flow's; per-flow if joins multiply.
     this.#assistBlocks.clear();
     this.#assistFailures.clear();
   }
 
-  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  /** Packets of a track a protected flow lists, dropped unread: a MoQ copy (duplicate, overflow, or listed by more than one flow) or a multicast source datagram that names no flow, of a track a user-agent-admitted flow lists. */
   get unadmittedListedDropCount(): number {
     return this.#unadmittedListedDrops;
   }
@@ -2384,6 +2400,14 @@ export class MmtpRouter {
     return false;
   }
 
+  /** Whether a protected flow the user agent admitted lists `packetId`. */
+  #userAgentGoverns(packetId: number): boolean {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && entry.userAgent && ingressHasPacketId(entry.ingress, packetId)) return true;
+    }
+    return false;
+  }
+
   /**
    * A MoQ repair symbol no protected flow lists, owned by a source track one
    * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
@@ -2503,7 +2527,7 @@ export class MmtpRouter {
       fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
       fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
       fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-    })) {
+    }, true)) {
       this.#unlistedAssistedRecoveries++;
       this.#assistBlocks.delete(key);
       return;
@@ -3959,6 +3983,15 @@ export class MmtpRouter {
         debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
+      // The user agent verified this datagram against the flow's records
+      // itself, and the records never reach the page: admitted as is. The
+      // flow stays registered, so its MoQ copies are still checked.
+      if (ingress.admittedBy === USER_AGENT_VERIFIED) {
+        this.#noteFlowAdmitted(ingress.flow);
+        protectedFlow.userAgent = true;
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+        return;
+      }
       // Held: released by a record (feedProvenanceRecord) or expired. Duplicate / overflow: dropped.
       const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
       if (verdict === "admitted") {
@@ -3983,6 +4016,18 @@ export class MmtpRouter {
       }
     }
 
+    // A multicast datagram that names no flow is unverified. Of a track a
+    // user-agent-admitted flow lists it would feed that flow's live decoder,
+    // whose recoveries are kept without a record (#routeVerifiedFecSymbols):
+    // its source is dropped here and its repair set aside below, as for
+    // unlisted MoQ. Under a record-only flow it is read as before: those
+    // recoveries still need a record.
+    const flowless = source === "multicast" && !manifestAdmitted && ingress?.flow === undefined;
+    if (flowless && !info.isRepair && this.#userAgentGoverns(info.packetId)) {
+      this.#unadmittedListedDrops++;
+      return;
+    }
+
     if (info.isRepair) {
       // Repair packet — per ISO 23008-1 §C.5.3, carries (SS_Start, SSB_length, RS_ID).
       // Read from the header parsed above rather than parsing it again
@@ -4003,9 +4048,10 @@ export class MmtpRouter {
         );
         if (!repair) return;
         if (ownerPacketId != null && this.#fecManager) {
-          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast).
+          // An unadmitted MoQ symbol reaching here is unlisted (#admitUnicast);
+          // a flow-less multicast one is unverified.
           if (
-            source === "moq" && !manifestAdmitted &&
+            ((flowless && this.#userAgentGoverns(ownerPacketId)) || (source === "moq" && !manifestAdmitted)) &&
             this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)
           ) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
@@ -4950,6 +4996,7 @@ export class MmtpRouter {
     ownerPacketId?: number,
     catalogTrackName?: string,
     complete?: () => void,
+    assisted = false,
   ): boolean {
     // MMTP path: use processFecBlock for MMTP-wrapped recovery.
     // Recovered symbols are individual MMTP packets that may be fragments
@@ -4974,7 +5021,7 @@ export class MmtpRouter {
       ownerPacketId,
       blockProfile,
     });
-    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted);
   }
 
   /**
@@ -4987,6 +5034,19 @@ export class MmtpRouter {
    * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
    * open, so it reaches its FEC deadline and fails by class. Always true
    * outside a protected flow.
+   *
+   * On a flow the user agent admitted, the live decoder's recoveries are kept
+   * without a record: while the flow is protected that decoder takes only
+   * symbols the user agent or a record verified (a flow-less multicast
+   * datagram of a listed track is dropped or set aside in #processMMTP), so
+   * what it recovers is as verified as they are. An `assisted` (scratch-decoder) recovery mixes in
+   * unlisted MoQ repair and still needs a record.
+   * ponytail: per-flow flag; per-block provenance only if a protected flow
+   * ever mixes verified and unverified live inputs.
+   * ponytail: a worker frame computed before the protection reset can still
+   * arrive after it (frames carry no epoch); its inputs are MoQ copies read
+   * and played before protection, so it admits nothing new. Drop pre-reset
+   * frames by epoch only if pre-protection input ever matters.
    */
   #routeVerifiedFecSymbols(
     blockId: number,
@@ -4994,8 +5054,11 @@ export class MmtpRouter {
     ownerPacketId?: number,
     catalogTrackName?: string,
     complete?: () => void,
+    assisted = false,
   ): boolean {
-    const receiver = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const entry = ownerPacketId == null ? undefined : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const receiver = entry === undefined || entry === "ambiguous" ? entry : entry.receiver;
+    const userAgent = !assisted && entry !== undefined && entry !== "ambiguous" && entry.protected === true && entry.userAgent === true;
     let recovered = true;
     if (receiver) {
       const parsed = this.#stream(ownerPacketId!, catalogTrackName).duplicates.parsedSymbols;
@@ -5008,6 +5071,8 @@ export class MmtpRouter {
           let admitted = false;
           if (receiver === "ambiguous") {
             this.#ambiguousRecoveredDrops++;
+          } else if (userAgent) {
+            admitted = true;
           } else {
             const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
             wire.set(sym.rawSymbol);
@@ -5033,7 +5098,7 @@ export class MmtpRouter {
   #provenanceFor(
     packetId: number,
     catalogTrackName: string | undefined,
-  ): BcProvenanceV2Receiver | "ambiguous" | undefined {
+  ): ProvenanceEntry | "ambiguous" | undefined {
     // A caller that names no track matches every name the packet id was admitted under.
     const byName = this.#provenanceStreamFlow.get(packetId);
     const flows = new Set(
@@ -5042,12 +5107,12 @@ export class MmtpRouter {
         : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)!] : [],
     );
     if (flows.size > 1) return "ambiguous";
-    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
-    let match: BcProvenanceV2Receiver | undefined;
-    for (const { receiver, ingress } of this.#provenance.values()) {
-      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
+    for (const bound of flows) return this.#provenance.get(bound) ?? "ambiguous";
+    let match: ProvenanceEntry | undefined;
+    for (const entry of this.#provenance.values()) {
+      if (entry.ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === undefined || t.name === catalogTrackName))) {
         if (match) return "ambiguous";
-        match = receiver;
+        match = entry;
       }
     }
     return match;

package/src/multicast-manager.ts

@@ -50,7 +50,11 @@ import {
   type StreamSwitchCommit,
   type TrackPacketCallback,
 } from "./mmtp-router.js";
-import { isMulticastTrackPacketId, type WindowMulticastGateway } from "@blockcast/mmt-transport";
+import {
+  isMulticastTrackPacketId,
+  userAgentVerifiedIngress,
+  type WindowMulticastGateway,
+} from "@blockcast/mmt-transport";
 import {
   MulticastTransport,
   type MulticastFailbackReason,
@@ -94,6 +98,8 @@ export interface MulticastRepairEndpoint {
   mode?: string;
   amtRelay?: string;
   amtRelayPort?: number;
+  /** The media join's `'driad'` discovery (no relay pinned), carried so the repair group rides the same relay. */
+  amtDiscovery?: 'driad';
   /** The repair packet IDs this group carries. */
   packetIds: number[];
   /** Each repair packet ID bound to the media packet ID it repairs. */
@@ -2353,10 +2359,20 @@ export class MulticastManager {
    * repair roles and owners are registered here; in-band owners stay the
    * caller's. Joining is best effort: a group that fails to join is logged
    * and leaves the media join as it was.
+   *
+   * `options.gateway` names the gateway a subscribe callback reads through.
+   * When it is the browser's own MulticastReceiver provider, the callback's
+   * packets are fed as admitted by the user agent
+   * (`userAgentVerifiedIngress`); nothing the callback passes can mark them.
+   * The mark rests on this statement, not on the data path: every packet the
+   * callback delivers must come from a subscription opened on
+   * `options.gateway`. A callback that also merges another source (a MoQ or
+   * WebSocket repair feed) must not name a native provider here.
    */
   joinRepairEndpoints(
     endpoints: readonly MulticastRepairEndpoint[],
     provider?: WindowMulticastGateway | MulticastRepairSubscribe,
+    options?: { gateway?: WindowMulticastGateway },
   ): () => void {
     const releases: Array<() => void> = [];
     let released = false;
@@ -2382,22 +2398,26 @@ export class MulticastManager {
         ...(endpoint.flow === undefined ? {} : { flow: endpoint.flow }),
       };
       let sender: string | undefined;
-      const onPacket = (packet: Uint8Array, sourceAddress?: string) => {
+      const feed = (packet: Uint8Array, sourceAddress: string | undefined, ingressToFeed: MmtpIngressContext) => {
         if (released) return;
         // The media join's sender owns the repair too; this group's own first
         // sender stands in only until the media join has one.
         if (sourceAddress !== undefined && !sameDatagramSource(sourceAddress, this.#transport.sender ?? (sender ??= sourceAddress))) return;
-        this.#router.feedPacket(packet, "multicast", ingress);
+        this.#router.feedPacket(packet, "multicast", ingressToFeed);
       };
       const fail = (error: unknown) =>
         console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
       if (typeof provider === "function") {
+        const marked = userAgentVerifiedIngress(ingress, options?.gateway);
+        const onPacket = (packet: Uint8Array, sourceAddress?: string) => feed(packet, sourceAddress, marked);
         Promise.resolve()
           .then(() => provider(endpoint, onPacket))
           .then((release) => (released ? safely(release) : releases.push(release)), fail);
         continue;
       }
-      const transport = new MulticastTransport((packet) => onPacket(packet), {
+      // The transport marks what it delivers when its gateway is the user
+      // agent's MulticastReceiver provider; feedPacket would not.
+      const transport = new MulticastTransport<MmtpIngressContext>((packet, delivered) => feed(packet, undefined, delivered ?? ingress), {
         gateway: provider,
         lockedTo: () => this.#transport.sender,
       });
@@ -2409,11 +2429,12 @@ export class MulticastManager {
         mode: endpoint.mode as MulticastEndpointConfig["mode"],
         amtRelay: endpoint.amtRelay,
         amtRelayPort: endpoint.amtRelayPort ?? (endpoint.amtRelay?.trim() ? DEFAULT_AMT_RELAY_PORT : undefined),
+        amtDiscovery: endpoint.amtDiscovery,
         packetIds: endpoint.packetIds,
         tracks: endpoint.tracks.map(({ name, packetId }) => ({ name, packetId })),
         // A protected repair group's records ride in band on its port (7.2.3).
         ...(endpoint.flow === undefined ? {} : { protected: true }),
-      }).then((joined) => {
+      }, ingress).then((joined) => {
         if (!joined && !released) fail(transport.lastJoinOutcome);
       });
     }

package/src/multicast-transport.ts

@@ -6,7 +6,10 @@
 
 import {
   isMulticastTrackPacketId,
+  isUserAgentVerifiedGateway,
+  resolveMulticastGateway,
   subscriptionDeliversPacketBatches,
+  userAgentVerifiedIngress,
   toWindowMulticastSubscribeConfig,
   type WindowMulticastDelivery,
   type WindowMulticastGateway,
@@ -52,7 +55,13 @@ export interface MulticastTransportConfig {
   protected?: boolean
 }
 
-export type ResolvedMulticastTransport = 'native' | 'amt'
+/**
+ * The leg a join resolved to. `'user-agent'`: the browser's own
+ * `MulticastReceiver` delivers it, which picks native or AMT itself and does
+ * not say which. CMCD has no user-agent value, so a caller reports a
+ * `'user-agent'` join as `'native'` (`TransportSnapshot.transport`).
+ */
+export type ResolvedMulticastTransport = 'native' | 'amt' | 'user-agent'
 
 /**
  * Why a joined transport handed control back to MoQ.
@@ -211,16 +220,8 @@ function providerErrorOf(error: unknown): MulticastJoinProviderError | undefined
  */
 const MAX_TRACKED_DROPPED_PIDS = 16
 
-type MulticastGlobals = typeof globalThis & {
-  multicast?: WindowMulticastGateway
-}
-
-function getMulticastGlobals(): MulticastGlobals {
-  return globalThis as MulticastGlobals
-}
-
 function hasMulticastGateway(): boolean {
-  return typeof getMulticastGlobals().multicast?.subscribe === 'function'
+  return typeof resolveMulticastGateway()?.subscribe === 'function'
 }
 
 /**
@@ -371,6 +372,9 @@ export class MulticastTransport<TPacketContext = never> {
   // listener closure, so an in-place admission change (setContext) applies
   // from the next packet on without rejoining.
   #context: TPacketContext | undefined = undefined
+  #deliveredContext: TPacketContext | undefined = undefined
+  /** The live join's gateway, when it is the user agent's MulticastReceiver provider. */
+  #userAgentGateway: WindowMulticastGateway | undefined = undefined
   // The live join's provider-side filter. An in-place widening must reach it,
   // or the provider never delivers the new ID; null without a live join.
   #providerFilter: ProviderFilter | null = null
@@ -415,7 +419,7 @@ export class MulticastTransport<TPacketContext = never> {
     this.#sender = undefined
 
     if (this.#disposed) return this.#declined(generation, 'disposed')
-    const gateway = this.#gateway ?? getMulticastGlobals().multicast
+    const gateway = this.#gateway ?? resolveMulticastGateway()
     if (typeof gateway?.subscribe !== 'function') {
       console.warn('[MulticastTransport] Multicast API not available')
       return this.#declined(generation, 'unavailable')
@@ -435,15 +439,18 @@ export class MulticastTransport<TPacketContext = never> {
       console.log(
         `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress ?? config.senderAddress ?? '*'}, ${config.groupAddress}, ${config.port})`,
       )
+      // The browser's MulticastReceiver picks native or AMT, and the relay,
+      // itself: ask it for the group only.
+      const userAgent = isUserAgentVerifiedGateway(gateway)
       const subscribeConfig = toWindowMulticastSubscribeConfig({
         source: config.sourceAddress,
         senderAddress: config.senderAddress,
         group: config.groupAddress,
         port: config.port,
-        mode: config.mode,
-        amtRelay: config.amtRelay,
-        amtRelayPort: config.amtRelayPort,
-        amtDiscovery: config.amtDiscovery,
+        mode: userAgent ? 'native' : config.mode,
+        amtRelay: userAgent ? undefined : config.amtRelay,
+        amtRelayPort: userAgent ? undefined : config.amtRelayPort,
+        amtDiscovery: userAgent ? undefined : config.amtDiscovery,
         packetIds: config.packetIds,
         tracks: config.tracks,
         atsc3: config.atsc3,
@@ -506,7 +513,8 @@ export class MulticastTransport<TPacketContext = never> {
         acknowledgedUpdate: 0,
         inFlight: 0,
       }
-      this.#context = context
+      this.#userAgentGateway = userAgent ? gateway : undefined
+      this.#setContext(context)
       // Seed the allow-list's counters so accepted packets never insert. An
       // id already counted by an earlier join keeps its count: the counters
       // are cumulative across rejoins, as bytesReceived is.
@@ -521,7 +529,7 @@ export class MulticastTransport<TPacketContext = never> {
       // gateway no longer exposes a mutable transport/transportchange
       // surface, so assign this only after subscribe() has resolved and the
       // returned subscription has passed the event-surface check above.
-      this.#resolvedTransport = subscribeConfig.origin === 'amt' ? 'amt' : 'native'
+      this.#resolvedTransport = userAgent ? 'user-agent' : subscribeConfig.origin === 'amt' ? 'amt' : 'native'
       // The provider alone knows whether its packets are independent
       // datagrams or an ordered relay of one socket; undeclared promises no
       // ordering. Announce it before the listener can deliver a packet. A
@@ -630,7 +638,7 @@ export class MulticastTransport<TPacketContext = never> {
     // Read per packet: a callback that changes the admission (an in-place
     // rendition switch committing on this very packet) takes effect from the
     // next packet, including the rest of a batch.
-    this.#onPacket(packet, this.#context)
+    this.#onPacket(packet, this.#deliveredContext)
     return liveness
   }
 
@@ -872,8 +880,10 @@ export class MulticastTransport<TPacketContext = never> {
   }
 
   /**
-   * What the live join delivers with every accepted packet (the join's
-   * `context`, or the last setContext), or undefined without a live join.
+   * The live join's context as the caller gave it (the join's `context`, or
+   * the last setContext), or undefined without a live join. On a native
+   * provider each accepted packet is delivered with a marked copy of it
+   * (`userAgentVerifiedIngress`); this getter never carries the mark.
    */
   get context(): TPacketContext | undefined {
     return this.#context
@@ -899,7 +909,19 @@ export class MulticastTransport<TPacketContext = never> {
         '[MulticastTransport] setContext needs a live join; join() carries the first context',
       )
     }
+    this.#setContext(context)
+  }
+
+  /**
+   * The join's context, and what the subscription delivers with each packet:
+   * marked admitted by the user agent when the gateway is its native
+   * MulticastReceiver provider. feedPacket never marks.
+   */
+  #setContext(context: TPacketContext | undefined): void {
     this.#context = context
+    this.#deliveredContext = this.#userAgentGateway !== undefined && typeof context === 'object' && context !== null
+      ? userAgentVerifiedIngress(context, this.#userAgentGateway)
+      : context
   }
 
   /**
@@ -1040,6 +1062,8 @@ export class MulticastTransport<TPacketContext = never> {
     this.#matchedSource = undefined
     this.#providerFilter = null
     this.#context = undefined
+    this.#deliveredContext = undefined
+    this.#userAgentGateway = undefined
     this.#withdrawnPacketIds.clear()
   }