@blockcast/mmt-container 2.1.0 → 2.2.0-main.7a01a10f6629

package/dist/browser-runtime.js

@@ -7457,11 +7457,33 @@ var AdaptiveBitrateController = class {
 };
 
 // node_modules/@blockcast/mmt-base/dist/mmtp.js
+var MMTP_HEADER_SIZE2 = 12;
 var MPU_HEADER_SIZE2 = 8;
 var MPU_LENGTH_FIELD_SIZE2 = 2;
 var MPU_HEADER_REMAINDER_SIZE2 = MPU_HEADER_SIZE2 - MPU_LENGTH_FIELD_SIZE2;
 var MMTP_SIGNALING_PACKET_ID2 = 0;
 var MMTP_PACKET_ID_MAX2 = 65535;
+function readMMTPPacketId2(buffer) {
+  if (buffer.length < MMTP_HEADER_SIZE2)
+    return null;
+  const flags = buffer[0];
+  if ((flags >> 6 & 3) !== 0)
+    return null;
+  let offset = MMTP_HEADER_SIZE2;
+  if ((flags & 32) !== 0) {
+    if (offset + 4 > buffer.length)
+      return null;
+    offset += 4;
+  }
+  if ((flags & 2) !== 0) {
+    if (offset + 4 > buffer.length)
+      return null;
+    const length = buffer[offset + 2] << 8 | buffer[offset + 3];
+    if (offset + 4 + length > buffer.length)
+      return null;
+  }
+  return buffer[2] << 8 | buffer[3];
+}
 
 // node_modules/@blockcast/mmt-base/dist/net-constants.js
 var DEFAULT_AMT_RELAY_PORT2 = 2268;
@@ -8447,6 +8469,205 @@ var TransportManager = class {
 };
 var transportManager = new TransportManager();
 
+// node_modules/@blockcast/mmt-transport/dist/multicast-receiver-gateway.js
+var REGISTRY = /* @__PURE__ */ Symbol.for("@blockcast/mmt-transport/native-provider-registry/v1");
+var USER_AGENT_VERIFIED = /* @__PURE__ */ Symbol.for("@blockcast/mmt-transport/user-agent-verified/v1");
+var INTEGRITY_SCHEME = "manifest-ed25519-2";
+var MulticastError = class extends Error {
+  code;
+  constructor(code, message, cause) {
+    super(message, cause === void 0 ? void 0 : { cause });
+    this.name = "MulticastError";
+    this.code = code;
+  }
+};
+function datagramsOf(chunk) {
+  const list = Array.isArray(chunk) ? chunk : chunk?.datagrams ?? [];
+  const out = [];
+  for (const d of list) {
+    const data = d instanceof Uint8Array || d instanceof ArrayBuffer ? d : d?.data;
+    if (data instanceof Uint8Array)
+      out.push(data);
+    else if (data instanceof ArrayBuffer)
+      out.push(new Uint8Array(data));
+  }
+  return out;
+}
+function reasonOf(value) {
+  return typeof value === "object" && value !== null && "reason" in value ? value.reason : value;
+}
+function registry() {
+  const g = globalThis;
+  if (g[REGISTRY] === void 0) {
+    const providers = /* @__PURE__ */ new WeakSet();
+    const byScope = /* @__PURE__ */ new WeakMap();
+    Object.defineProperty(g, REGISTRY, {
+      value: Object.freeze({
+        isProvider: (x) => typeof x === "object" && x !== null && providers.has(x),
+        providerFor: (scope) => {
+          let provider = byScope.get(scope);
+          if (provider === void 0) {
+            provider = createProvider(scope);
+            providers.add(provider);
+            byScope.set(scope, provider);
+          }
+          return provider;
+        }
+      }),
+      writable: false,
+      configurable: false,
+      enumerable: false
+    });
+  }
+  return g[REGISTRY];
+}
+function resolveMulticastGateway(scope = globalThis) {
+  const s = scope;
+  if (typeof s.MulticastReceiver === "function")
+    return registry().providerFor(scope);
+  if (typeof s.multicast?.subscribe === "function")
+    return s.multicast;
+  return void 0;
+}
+function isUserAgentVerifiedGateway(gateway) {
+  return registry().isProvider(gateway);
+}
+function userAgentVerifiedIngress(ingress, gateway) {
+  if (isUserAgentVerifiedGateway(gateway))
+    return { ...ingress, admittedBy: USER_AGENT_VERIFIED };
+  if (!("admittedBy" in ingress))
+    return ingress;
+  const { admittedBy: _, ...rest } = ingress;
+  return rest;
+}
+function unsupported(message, cause) {
+  return new MulticastError("capability-unsupported", message, cause);
+}
+function createProvider(scope) {
+  const Receiver = scope.MulticastReceiver;
+  let gate = null;
+  return {
+    capabilities: () => Promise.resolve({ consumeModes: ["bytes"] }),
+    subscribe: async (config) => {
+      const c = config;
+      if (c.consume !== "bytes")
+        throw unsupported(`consume mode ${String(c.consume)} is not supported`);
+      const origin = c.origin ?? "ip-multicast";
+      if (origin !== "ip-multicast" && !(origin === "amt" && c.discovery === "driad")) {
+        throw unsupported(`origin ${String(origin)} is not supported by MulticastReceiver`);
+      }
+      if (c.relay !== void 0)
+        throw unsupported("MulticastReceiver picks its own AMT relay");
+      if (!c.source)
+        throw unsupported("MulticastReceiver needs an SSM source");
+      if (c.senderAddress !== void 0 && c.senderAddress !== c.source) {
+        throw unsupported("MulticastReceiver filters by source only");
+      }
+      const options = { sourceAddress: c.source, groupAddress: c.group, localPort: c.port };
+      if (gate !== null)
+        await gate;
+      let rx;
+      try {
+        rx = new Receiver(options);
+      } catch (error) {
+        throw unsupported("MulticastReceiver refused the request", error);
+      }
+      const opened = rx.opened;
+      if (gate === null)
+        gate = opened.then(() => void 0, () => void 0);
+      return openSubscription(rx, opened, options, c.packetIds);
+    }
+  };
+}
+async function openSubscription(rx, openedPromise, options, packetIds) {
+  let opened;
+  try {
+    opened = await openedPromise;
+  } catch (error) {
+    throw new MulticastError("subscription-failed", "MulticastReceiver did not open", error);
+  }
+  if (rx.integrityScheme !== INTEGRITY_SCHEME) {
+    await rx.close();
+    throw unsupported(`integrity scheme ${String(rx.integrityScheme)} is not ${INTEGRITY_SCHEME}`);
+  }
+  const events = new EventTarget();
+  let state = "connected";
+  let filter = packetIds?.length ? new Set(packetIds) : null;
+  let closing = false;
+  const setState = (next) => {
+    if (state === next)
+      return;
+    state = next;
+    events.dispatchEvent(new CustomEvent("state", { detail: next }));
+  };
+  const sourceAddress = options.sourceAddress;
+  const subscription = {
+    id: `${options.sourceAddress}|${options.groupAddress}|${options.localPort}`,
+    get state() {
+      return state;
+    },
+    delivery: "datagram",
+    eventTypes: Object.freeze(["bytes", "packets", "state", "error"]),
+    setPacketIds(ids) {
+      filter = ids.length ? new Set(ids) : null;
+    },
+    addEventListener: events.addEventListener.bind(events),
+    removeEventListener: events.removeEventListener.bind(events),
+    async unsubscribe() {
+      closing = true;
+      await rx.close();
+      setState("closed");
+    }
+  };
+  void (async () => {
+    const reader = opened.readable.getReader();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done)
+          break;
+        const packets = [];
+        for (const data of datagramsOf(value)) {
+          if (filter !== null) {
+            const id = readMMTPPacketId2(data);
+            if (id === null || !filter.has(id))
+              continue;
+          }
+          const copy = data.slice().buffer;
+          packets.push(copy);
+          events.dispatchEvent(Object.assign(new CustomEvent("bytes", { detail: copy }), { sourceAddress }));
+        }
+        if (packets.length > 0)
+          events.dispatchEvent(new CustomEvent("packets", { detail: packets }));
+      }
+    } catch {
+    }
+  })();
+  void rx.closed.then((value) => {
+    const reason = reasonOf(value);
+    if (!closing) {
+      if (reason === "consent-withdrawn") {
+        events.dispatchEvent(new CustomEvent("error", {
+          detail: new MulticastError("origin-not-trusted", "multicast consent withdrawn")
+        }));
+      } else if (reason === "oversubscribed" || reason === "network") {
+        events.dispatchEvent(new CustomEvent("error", {
+          detail: new MulticastError("subscription-failed", `MulticastReceiver closed: ${reason}`)
+        }));
+      }
+    }
+    setState("closed");
+  }, (error) => {
+    if (!closing) {
+      events.dispatchEvent(new CustomEvent("error", {
+        detail: new MulticastError("subscription-failed", "MulticastReceiver failed", error)
+      }));
+    }
+    setState("closed");
+  });
+  return subscription;
+}
+
 // node_modules/@blockcast/mmt-transport/dist/moqt-priority.js
 var MAX_MOQT_PRIORITY = 255;
 function moqtPriority(value, field) {
@@ -8733,9 +8954,9 @@ function validateTemplatePair(mediaUriTemplate, mediaObjectTemplate, path) {
 }
 function validateMmtpDashTemplate(template, path) {
   const variables = [...template.matchAll(TEMPLATE_VARIABLE)].map((match) => match[1]);
-  const unsupported = variables.find((variable) => variable !== "Number" && variable !== "RepresentationID");
-  if (unsupported !== void 0) {
-    throw new Error(`${path} contains unsupported MMTP-backed DASH template variable $${unsupported}$`);
+  const unsupported2 = variables.find((variable) => variable !== "Number" && variable !== "RepresentationID");
+  if (unsupported2 !== void 0) {
+    throw new Error(`${path} contains unsupported MMTP-backed DASH template variable $${unsupported2}$`);
   }
   if (variables.filter((variable) => variable === "Number").length !== 1) {
     throw new Error(`${path} must contain exactly one $Number$ for MMTP-backed DASH`);
@@ -17098,17 +17319,17 @@ var FECManager = class _FECManager {
 
 // src/mfu-reassembly-policy.ts
 function validateReliableMoqOptionShape(value) {
-  const unsupported = Object.keys(value).filter(
+  const unsupported2 = Object.keys(value).filter(
     (key) => key !== "transport" && key !== "startsAtRandomAccessGroup"
   );
-  if (unsupported.length > 0) {
-    if (unsupported.includes("maxRacingGroups")) {
+  if (unsupported2.length > 0) {
+    if (unsupported2.includes("maxRacingGroups")) {
       throw new Error(
         "[MFU reassembly] maxRacingGroups was removed; reliable MoQ completion is transport-owned"
       );
     }
     throw new Error(
-      `[MFU reassembly] unsupported reliable MoQ option(s): ${unsupported.join(", ")}`
+      `[MFU reassembly] unsupported reliable MoQ option(s): ${unsupported2.join(", ")}`
     );
   }
   const startsAtRandomAccessGroup = value["startsAtRandomAccessGroup"];
@@ -17152,12 +17373,12 @@ function assertValidMfuReassemblyPolicy(policy) {
     return;
   }
   if (value["transport"] === "datagram") {
-    const unsupported = Object.keys(value).filter(
+    const unsupported2 = Object.keys(value).filter(
       (key) => key !== "transport" && key !== "deadlineMs"
     );
-    if (unsupported.length > 0) {
+    if (unsupported2.length > 0) {
       throw new Error(
-        `[MFU reassembly] unsupported datagram option(s): ${unsupported.join(", ")}`
+        `[MFU reassembly] unsupported datagram option(s): ${unsupported2.join(", ")}`
       );
     }
     assertValidDatagramDeadline(value["deadlineMs"]);
@@ -23579,10 +23800,11 @@ var MmtpRouter = class {
     if (!entry) return;
     entry.receiver.release();
     entry.protected = false;
+    entry.userAgent = false;
     this.#assistBlocks.clear();
     this.#assistFailures.clear();
   }
-  /** MoQ packets of a track a protected flow lists, dropped on its unicast path: duplicate, overflow, or listed by more than one flow. */
+  /** Packets of a track a protected flow lists, dropped unread: a MoQ copy (duplicate, overflow, or listed by more than one flow) or a multicast source datagram that names no flow, of a track a user-agent-admitted flow lists. */
   get unadmittedListedDropCount() {
     return this.#unadmittedListedDrops;
   }
@@ -23623,6 +23845,13 @@ var MmtpRouter = class {
     }
     return false;
   }
+  /** Whether a protected flow the user agent admitted lists `packetId`. */
+  #userAgentGoverns(packetId) {
+    for (const entry of this.#provenance.values()) {
+      if (entry.protected && entry.userAgent && ingressHasPacketId(entry.ingress, packetId)) return true;
+    }
+    return false;
+  }
   /**
    * A MoQ repair symbol no protected flow lists, owned by a source track one
    * does: its FEC instance is governed (7.2.7 step 2) and takes only admitted
@@ -23713,7 +23942,7 @@ var MmtpRouter = class {
       fec.cancelBlockTimeout(blockStart, ownerPacketId, catalogTrackName);
       fec.countRecovery(ownerPacketId, blockStart, catalogTrackName);
       fec.markBlockCompleted(blockStart, ownerPacketId, catalogTrackName);
-    })) {
+    }, true)) {
       this.#unlistedAssistedRecoveries++;
       this.#assistBlocks.delete(key);
       return;
@@ -24869,6 +25098,12 @@ var MmtpRouter = class {
         debugRouter(`[MmtpRouter] Dropping multicast packet pid=${info.packetId}: flow ${ingress.flow} has no receiver`);
         return;
       }
+      if (ingress.admittedBy === USER_AGENT_VERIFIED) {
+        this.#noteFlowAdmitted(ingress.flow);
+        protectedFlow.userAgent = true;
+        this.#processMMTP(packet, source, true, ingress, overlapCopy);
+        return;
+      }
       const { verdict } = protectedFlow.receiver.onDatagram(packet, "multicast");
       if (verdict === "admitted") {
         this.#noteFlowAdmitted(ingress.flow);
@@ -24886,6 +25121,11 @@ var MmtpRouter = class {
         return;
       }
     }
+    const flowless = source === "multicast" && !manifestAdmitted && ingress?.flow === void 0;
+    if (flowless && !info.isRepair && this.#userAgentGoverns(info.packetId)) {
+      this.#unadmittedListedDrops++;
+      return;
+    }
     if (info.isRepair) {
       const overlay = this.#overlayRepairTarget(info.packetId, catalogTrackNameForPacket(ingress, info.packetId));
       if (overlay !== void 0) {
@@ -24903,7 +25143,7 @@ var MmtpRouter = class {
       );
       if (!repair) return;
       if (ownerPacketId != null && this.#fecManager) {
-        if (source === "moq" && !manifestAdmitted && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)) return;
+        if ((flowless && this.#userAgentGoverns(ownerPacketId) || source === "moq" && !manifestAdmitted) && this.#setAsideUnlistedRepair(ownerPacketId, catalogTrackNameForPacket(ingress, ownerPacketId), repair)) return;
         this.#repairPidCounts[info.packetId] = (this.#repairPidCounts[info.packetId] || 0) + 1;
         const count = this.#repairPidCounts[info.packetId];
         if (count <= 2 || count % 500 === 0) {
@@ -25482,7 +25722,7 @@ var MmtpRouter = class {
   }
   // ── Private: FEC recovery routing ───────────────────────────────
   /** Route WASM-recovered block through appropriate path based on container kind. */
-  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName, complete) {
+  #routeRecoveredBlock(blockId, recovered, ownerPacketId, catalogTrackName, complete, assisted = false) {
     const packetSymbolSize = this.#symbolSizeForPacket(ownerPacketId);
     if (ownerPacketId === void 0) {
       throw new Error("[MmtpRouter] a recovered FEC block needs its owner packetId to read its fec.blockProfile");
@@ -25499,7 +25739,7 @@ var MmtpRouter = class {
       ownerPacketId,
       blockProfile
     });
-    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete);
+    return this.#routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted);
   }
   /**
    * A recovered source packet of a protected flow is admitted on its own
@@ -25511,9 +25751,24 @@ var MmtpRouter = class {
    * recovered packets is refused is unrecovered (7.2.7): its caller leaves it
    * open, so it reaches its FEC deadline and fails by class. Always true
    * outside a protected flow.
-   */
-  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete) {
-    const receiver = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+   *
+   * On a flow the user agent admitted, the live decoder's recoveries are kept
+   * without a record: while the flow is protected that decoder takes only
+   * symbols the user agent or a record verified (a flow-less multicast
+   * datagram of a listed track is dropped or set aside in #processMMTP), so
+   * what it recovers is as verified as they are. An `assisted` (scratch-decoder) recovery mixes in
+   * unlisted MoQ repair and still needs a record.
+   * ponytail: per-flow flag; per-block provenance only if a protected flow
+   * ever mixes verified and unverified live inputs.
+   * ponytail: a worker frame computed before the protection reset can still
+   * arrive after it (frames carry no epoch); its inputs are MoQ copies read
+   * and played before protection, so it admits nothing new. Drop pre-reset
+   * frames by epoch only if pre-protection input ever matters.
+   */
+  #routeVerifiedFecSymbols(blockId, result, ownerPacketId, catalogTrackName, complete, assisted = false) {
+    const entry = ownerPacketId == null ? void 0 : this.#provenanceFor(ownerPacketId, catalogTrackName);
+    const receiver = entry === void 0 || entry === "ambiguous" ? entry : entry.receiver;
+    const userAgent = !assisted && entry !== void 0 && entry !== "ambiguous" && entry.protected === true && entry.userAgent === true;
     let recovered = true;
     if (receiver) {
       const parsed = this.#stream(ownerPacketId, catalogTrackName).duplicates.parsedSymbols;
@@ -25525,6 +25780,8 @@ var MmtpRouter = class {
           let admitted = false;
           if (receiver === "ambiguous") {
             this.#ambiguousRecoveredDrops++;
+          } else if (userAgent) {
+            admitted = true;
           } else {
             const wire = new Uint8Array(sym.rawSymbol.byteLength + 4);
             wire.set(sym.rawSymbol);
@@ -25552,12 +25809,12 @@ var MmtpRouter = class {
       catalogTrackName === void 0 || !byName ? byName?.values() : byName.has(catalogTrackName) ? [byName.get(catalogTrackName)] : []
     );
     if (flows.size > 1) return "ambiguous";
-    for (const bound of flows) return this.#provenance.get(bound)?.receiver ?? "ambiguous";
+    for (const bound of flows) return this.#provenance.get(bound) ?? "ambiguous";
     let match;
-    for (const { receiver, ingress } of this.#provenance.values()) {
-      if (ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
+    for (const entry of this.#provenance.values()) {
+      if (entry.ingress.tracks.some((t) => t.packetId === packetId && (catalogTrackName === void 0 || t.name === catalogTrackName))) {
         if (match) return "ambiguous";
-        match = receiver;
+        match = entry;
       }
     }
     return match;
@@ -26339,11 +26596,8 @@ function providerErrorOf(error) {
   return Object.freeze(typeof code === "string" ? { name, message, code } : { name, message });
 }
 var MAX_TRACKED_DROPPED_PIDS = 16;
-function getMulticastGlobals() {
-  return globalThis;
-}
 function hasMulticastGateway() {
-  return typeof getMulticastGlobals().multicast?.subscribe === "function";
+  return typeof resolveMulticastGateway()?.subscribe === "function";
 }
 function senderOf(event) {
   const sourceAddress = event.sourceAddress;
@@ -26435,6 +26689,9 @@ var MulticastTransport = class {
   // listener closure, so an in-place admission change (setContext) applies
   // from the next packet on without rejoining.
   #context = void 0;
+  #deliveredContext = void 0;
+  /** The live join's gateway, when it is the user agent's MulticastReceiver provider. */
+  #userAgentGateway = void 0;
   // The live join's provider-side filter. An in-place widening must reach it,
   // or the provider never delivers the new ID; null without a live join.
   #providerFilter = null;
@@ -26471,7 +26728,7 @@ var MulticastTransport = class {
     this.#dataPlaneLive = false;
     this.#sender = void 0;
     if (this.#disposed) return this.#declined(generation, "disposed");
-    const gateway = this.#gateway ?? getMulticastGlobals().multicast;
+    const gateway = this.#gateway ?? resolveMulticastGateway();
     if (typeof gateway?.subscribe !== "function") {
       console.warn("[MulticastTransport] Multicast API not available");
       return this.#declined(generation, "unavailable");
@@ -26487,15 +26744,16 @@ var MulticastTransport = class {
       console.log(
         `[MulticastTransport] window.multicast.subscribe(${config.sourceAddress ?? config.senderAddress ?? "*"}, ${config.groupAddress}, ${config.port})`
       );
+      const userAgent = isUserAgentVerifiedGateway(gateway);
       const subscribeConfig = toWindowMulticastSubscribeConfig({
         source: config.sourceAddress,
         senderAddress: config.senderAddress,
         group: config.groupAddress,
         port: config.port,
-        mode: config.mode,
-        amtRelay: config.amtRelay,
-        amtRelayPort: config.amtRelayPort,
-        amtDiscovery: config.amtDiscovery,
+        mode: userAgent ? "native" : config.mode,
+        amtRelay: userAgent ? void 0 : config.amtRelay,
+        amtRelayPort: userAgent ? void 0 : config.amtRelayPort,
+        amtDiscovery: userAgent ? void 0 : config.amtDiscovery,
         packetIds: config.packetIds,
         tracks: config.tracks,
         atsc3: config.atsc3
@@ -26541,7 +26799,8 @@ var MulticastTransport = class {
         acknowledgedUpdate: 0,
         inFlight: 0
       };
-      this.#context = context;
+      this.#userAgentGateway = userAgent ? gateway : void 0;
+      this.#setContext(context);
       if (packetIds) {
         for (const packetId of packetIds) {
           if (!this.#acceptedBytesByPacketId.has(packetId)) {
@@ -26549,7 +26808,7 @@ var MulticastTransport = class {
           }
         }
       }
-      this.#resolvedTransport = subscribeConfig.origin === "amt" ? "amt" : "native";
+      this.#resolvedTransport = userAgent ? "user-agent" : subscribeConfig.origin === "amt" ? "amt" : "native";
       const delivery = subscription.delivery ?? "datagram";
       if (delivery !== "datagram" && delivery !== "ordered-relay") {
         throw new Error(
@@ -26630,7 +26889,7 @@ var MulticastTransport = class {
     }
     if (!this.#acceptPacket(packet, sourceAddress)) return false;
     const liveness = !this.#isRecordCandidate(packet);
-    this.#onPacket(packet, this.#context);
+    this.#onPacket(packet, this.#deliveredContext);
     return liveness;
   }
   #isRecordCandidate(packet) {
@@ -26841,8 +27100,10 @@ var MulticastTransport = class {
     return this.#subscription !== null;
   }
   /**
-   * What the live join delivers with every accepted packet (the join's
-   * `context`, or the last setContext), or undefined without a live join.
+   * The live join's context as the caller gave it (the join's `context`, or
+   * the last setContext), or undefined without a live join. On a native
+   * provider each accepted packet is delivered with a marked copy of it
+   * (`userAgentVerifiedIngress`); this getter never carries the mark.
    */
   get context() {
     return this.#context;
@@ -26866,7 +27127,16 @@ var MulticastTransport = class {
         "[MulticastTransport] setContext needs a live join; join() carries the first context"
       );
     }
+    this.#setContext(context);
+  }
+  /**
+   * The join's context, and what the subscription delivers with each packet:
+   * marked admitted by the user agent when the gateway is its native
+   * MulticastReceiver provider. feedPacket never marks.
+   */
+  #setContext(context) {
     this.#context = context;
+    this.#deliveredContext = this.#userAgentGateway !== void 0 && typeof context === "object" && context !== null ? userAgentVerifiedIngress(context, this.#userAgentGateway) : context;
   }
   /**
    * Replace the live join's packet-ID allow-list in place, without rejoining.
@@ -26998,6 +27268,8 @@ var MulticastTransport = class {
     this.#matchedSource = void 0;
     this.#providerFilter = null;
     this.#context = void 0;
+    this.#deliveredContext = void 0;
+    this.#userAgentGateway = void 0;
     this.#withdrawnPacketIds.clear();
   }
   /** The ingress filter; an accepted packet is counted here, once. */
@@ -28350,8 +28622,17 @@ var MulticastManager = class {
    * repair roles and owners are registered here; in-band owners stay the
    * caller's. Joining is best effort: a group that fails to join is logged
    * and leaves the media join as it was.
-   */
-  joinRepairEndpoints(endpoints, provider) {
+   *
+   * `options.gateway` names the gateway a subscribe callback reads through.
+   * When it is the browser's own MulticastReceiver provider, the callback's
+   * packets are fed as admitted by the user agent
+   * (`userAgentVerifiedIngress`); nothing the callback passes can mark them.
+   * The mark rests on this statement, not on the data path: every packet the
+   * callback delivers must come from a subscription opened on
+   * `options.gateway`. A callback that also merges another source (a MoQ or
+   * WebSocket repair feed) must not name a native provider here.
+   */
+  joinRepairEndpoints(endpoints, provider, options) {
     const releases = [];
     let released = false;
     const safely = (each) => {
@@ -28373,17 +28654,19 @@ var MulticastManager = class {
         ...endpoint.flow === void 0 ? {} : { flow: endpoint.flow }
       };
       let sender;
-      const onPacket = (packet, sourceAddress) => {
+      const feed = (packet, sourceAddress, ingressToFeed) => {
         if (released) return;
         if (sourceAddress !== void 0 && !sameDatagramSource(sourceAddress, this.#transport.sender ?? (sender ??= sourceAddress))) return;
-        this.#router.feedPacket(packet, "multicast", ingress);
+        this.#router.feedPacket(packet, "multicast", ingressToFeed);
       };
       const fail = (error) => console.warn(`[MulticastManager] repair group ${endpoint.group}:${endpoint.port} not joined`, error);
       if (typeof provider === "function") {
+        const marked = userAgentVerifiedIngress(ingress, options?.gateway);
+        const onPacket = (packet, sourceAddress) => feed(packet, sourceAddress, marked);
         Promise.resolve().then(() => provider(endpoint, onPacket)).then((release2) => released ? safely(release2) : releases.push(release2), fail);
         continue;
       }
-      const transport = new MulticastTransport((packet) => onPacket(packet), {
+      const transport = new MulticastTransport((packet, delivered) => feed(packet, void 0, delivered ?? ingress), {
         gateway: provider,
         lockedTo: () => this.#transport.sender
       });
@@ -28399,7 +28682,7 @@ var MulticastManager = class {
         tracks: endpoint.tracks.map(({ name, packetId }) => ({ name, packetId })),
         // A protected repair group's records ride in band on its port (7.2.3).
         ...endpoint.flow === void 0 ? {} : { protected: true }
-      }).then((joined) => {
+      }, ingress).then((joined) => {
         if (!joined && !released) fail(transport.lastJoinOutcome);
       });
     }