@camstack/addon-pipeline 1.1.18 → 1.1.20

package/dist/stream-broker/index.mjs

@@ -1,7 +1,7 @@
 import { t as __require } from "../chunk-BdkLduGY.mjs";
-import { A as nodePin, B as BaseAddon, D as maskUrlCredentials, G as asJsonObject, H as DeviceFeature, I as streamBrokerCapability, Q as parseProfileBrokerId, R as webrtcSessionCapability, U as DeviceType, V as CAM_PROFILE_ORDER, W as EventCategory, X as makeSourceBrokerId, Y as makeProfileBrokerId, c as EncodeProfileSchema, ct as object, dt as union, f as RingBuffer, it as discriminatedUnion, lt as record, m as addonWidgetsSourceCapability, ot as literal, q as createEvent, rt as boolean, st as number, tt as _enum, ut as string, v as cameraStreamsCapability, z as errMsg } from "../dist-CBcVKDyT.mjs";
+import { A as nodePin, B as BaseAddon, D as maskUrlCredentials, G as asJsonObject, H as DeviceFeature, I as streamBrokerCapability, Q as parseProfileBrokerId, R as webrtcSessionCapability, U as DeviceType, V as CAM_PROFILE_ORDER, W as EventCategory, X as makeSourceBrokerId, Y as makeProfileBrokerId, c as EncodeProfileSchema, ct as object, dt as union, f as RingBuffer, it as discriminatedUnion, lt as record, m as addonWidgetsSourceCapability, ot as literal, q as createEvent, rt as boolean, st as number, tt as _enum, ut as string, v as cameraStreamsCapability, z as errMsg } from "../dist-tzhTTRq4.mjs";
 import { t as createFileDataPlaneHandler } from "../model-download-service-C-IHWnXx-3Mmeob3l.mjs";
-import { t as DecodeRuntime } from "../codec-runtime-BsqlEjPi.mjs";
+import { n as logBannerArgs, r as FrameDropper, t as audioEncoderArgs } from "../ffmpeg-args-common-c3p-nWtU.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
@@ -304,6 +304,31 @@ var DecoderSessionProxy = class {
 * broker supplies a `pullModeUrl` and the plane calls `openStream` once the
 * session exists.
 */
+/**
+* Collapse a hierarchical Moleculer nodeID (`hub/child-abc`) to its owning
+* node (`hub`). Frame-plane co-location only cares about the physical node, not
+* which forked child within it hosts the session.
+*/
+function collapseNodeId(nodeId) {
+	const slash = nodeId.indexOf("/");
+	return slash >= 0 ? nodeId.slice(0, slash) : nodeId;
+}
+/**
+* Decide whether a decoder session created on `decoderNodeId` is co-located
+* with the broker whose local node is `brokerNodeId`.
+*
+* The broker's shm frame ring is NODE-LOCAL: a decoder session on any other
+* node can never deliver frame handles to this broker's consumers, so a
+* mis-placed session must be rejected. Both ids are collapsed (`hub/child`→
+* `hub`) before comparison.
+*
+* A `null` `brokerNodeId` means the broker's own node is unknown — enforcement
+* is skipped (legacy behavior, accept any placement).
+*/
+function isDecoderNodeColocated(brokerNodeId, decoderNodeId) {
+	if (brokerNodeId === null) return true;
+	return collapseNodeId(brokerNodeId) === collapseNodeId(decoderNodeId);
+}
 /** Per-subscription handle-queue capacity. A handle is tiny; 64 absorbs a
 *  burst between two `pullFrameHandles` polls without unbounded growth. */
 var HANDLE_QUEUE_CAPACITY = 64;
@@ -320,6 +345,7 @@ var FrameHandlePlane = class {
 	decoderApi;
 	logger;
 	resolveStreamInfo;
+	localNodeId;
 	subscriptions = /* @__PURE__ */ new Map();
 	sessions = /* @__PURE__ */ new Map();
 	disposed = false;
@@ -335,6 +361,7 @@ var FrameHandlePlane = class {
 		this.decoderApi = options.decoderApi;
 		this.logger = options.logger;
 		this.resolveStreamInfo = options.resolveStreamInfo;
+		this.localNodeId = options.localNodeId;
 	}
 	/** Number of active handle subscriptions — surfaced for diagnostics. */
 	get subscriberCount() {
@@ -635,6 +662,22 @@ var FrameHandlePlane = class {
 			...info.numericDeviceId !== void 0 ? { deviceId: info.numericDeviceId } : {},
 			tag: `${info.tag}:shm:${format}`
 		});
+		if (!isDecoderNodeColocated(this.localNodeId, nodeId)) {
+			this.logger?.warn("frame-handle plane: decoder session landed on a non-local node — destroying (shm ring is node-local)", { meta: {
+				format,
+				requestedNode: this.localNodeId,
+				gotNode: nodeId,
+				sessionId
+			} });
+			await this.decoderApi.destroySession({ sessionId }).catch((err) => {
+				this.logger?.warn("frame-handle plane: failed to destroy mis-placed decoder session", { meta: {
+					format,
+					sessionId,
+					error: errMsg(err)
+				} });
+			});
+			return false;
+		}
 		const proxy = new DecoderSessionProxy(this.decoderApi, sessionId);
 		session.proxy = proxy;
 		session.nodeId = nodeId;
@@ -4079,6 +4122,13 @@ var StreamBroker = class StreamBroker {
 	decoderApi;
 	audioCodecApi;
 	logger;
+	/**
+	* This broker's OWN local Moleculer node id, threaded from the manager
+	* (`ctx.kernel.localNodeId`). Passed to the `FrameHandlePlane` so it can
+	* reject decoder sessions that land on a different node (the shm frame ring
+	* is node-local). `null` = unknown → co-location enforcement skipped.
+	*/
+	localNodeId;
 	startedAt = Date.now();
 	nativeClient = null;
 	rfc4571Reader = null;
@@ -4265,11 +4315,12 @@ var StreamBroker = class StreamBroker {
 	static DEFAULT_PRE_BUFFER_SEC = 10;
 	/** Maximum allowed pre-buffer duration in seconds */
 	static MAX_PRE_BUFFER_SEC = 30;
-	constructor(deviceId, decoderApi, logger, audioCodecApi) {
+	constructor(deviceId, decoderApi, logger, audioCodecApi, localNodeId) {
 		this.deviceId = deviceId;
 		this.decoderApi = decoderApi;
 		this.audioCodecApi = audioCodecApi ?? null;
 		this.logger = logger;
+		this.localNodeId = localNodeId ?? null;
 		this.pipeServer = new StreamPipeServer(logger?.child("pipe-server"));
 		this.rtspRestreamer = new RtspRestreamer(deviceId);
 		if (logger) this.rtspRestreamer.setLogger(logger.child("rtsp"));
@@ -5015,7 +5066,8 @@ var StreamBroker = class StreamBroker {
 		this.frameHandlePlane = new FrameHandlePlane({
 			decoderApi: this.decoderApi,
 			logger: this.logger?.child("frame-handle-plane"),
-			resolveStreamInfo: () => this.resolveFrameHandleStreamInfo()
+			resolveStreamInfo: () => this.resolveFrameHandleStreamInfo(),
+			localNodeId: this.localNodeId
 		});
 		return this.frameHandlePlane;
 	}
@@ -6080,6 +6132,10 @@ var RtspSession = class {
 	lastRtpAt = 0;
 	/** Total video RTP bytes written to the socket. */
 	bytesSent = 0;
+	/** Client `User-Agent` (from the first request that carries one). Lets the
+	*  broker panel identify a consumer by purpose — e.g. the recorder sets
+	*  `-user_agent recorder` on its RTSP pull — instead of a bare address. */
+	userAgent = null;
 	/** When true, this session receives video-only (no audio RTP). */
 	muted;
 	constructor(socket, sdp, onClose, muted) {
@@ -6123,6 +6179,7 @@ var RtspSession = class {
 		return {
 			sessionId: this.sessionId,
 			remoteAddr: `${remoteIp}:${remotePort}`,
+			userAgent: this.userAgent,
 			playing: this.isPlaying(),
 			muted: this.muted,
 			connectedAt: this.connectedAt,
@@ -6189,7 +6246,10 @@ var RtspSession = class {
 			const requestText = this.buffer.slice(0, endIdx);
 			this.buffer = this.buffer.slice(endIdx + 4);
 			const request = this.parseRequest(requestText);
-			if (request) this.handleRequest(request);
+			if (request) {
+				if (this.userAgent === null) this.userAgent = request.headers.get("user-agent") ?? null;
+				this.handleRequest(request);
+			}
 		}
 	}
 	parseRequest(text) {
@@ -6581,35 +6641,6 @@ var RtspRestreamProviderImpl = class {
 	}
 };
 //#endregion
-//#region src/stream-broker/stream-broker/ffmpeg-args-common.ts
-var AUDIO_ENCODER_BY_CODEC = {
-	opus: "libopus",
-	aac: "aac",
-	pcmu: "pcm_mulaw",
-	pcma: "pcm_alaw",
-	copy: "copy"
-};
-/**
-* Build the audio-encode args `-c:a <enc> [-b:a Nk] [-ar N] [-ac N]`. Each knob
-* is emitted only when provided, in this fixed order — matching what every
-* broker site already emitted by hand.
-*/
-function audioEncoderArgs(codec, opts = {}) {
-	const args = ["-c:a", AUDIO_ENCODER_BY_CODEC[codec]];
-	if (opts.bitrateKbps !== void 0) args.push("-b:a", `${opts.bitrateKbps}k`);
-	if (opts.sampleRateHz !== void 0) args.push("-ar", String(opts.sampleRateHz));
-	if (opts.channels !== void 0) args.push("-ac", String(opts.channels));
-	return args;
-}
-/** The `-hide_banner -loglevel <level>` preamble every broker ffmpeg site opens with. */
-function logBannerArgs(level) {
-	return [
-		"-hide_banner",
-		"-loglevel",
-		level
-	];
-}
-//#endregion
 //#region src/stream-broker/stream-broker/ffmpeg-invocation.ts
 /** The full set of hwaccel settings (for validation + option surfaces). */
 var FFMPEG_HW_ACCEL_SETTINGS = [
@@ -9639,7 +9670,7 @@ var StreamBrokerManager = class {
 			camStreamId
 		});
 		const source = this.buildSourceFromCamStream(cam);
-		const broker = new StreamBroker(brokerId, this.buildDecoderCapApi(deviceId), brokerLogger, buildAudioCodecCapApi(this.api));
+		const broker = new StreamBroker(brokerId, this.buildDecoderCapApi(deviceId), brokerLogger, buildAudioCodecCapApi(this.api), this.localNodeId);
 		broker.setRestreamers(this.restreamers);
 		this.applyPreBufferConfig(broker, deviceId, camStreamId, cam);
 		if (this.deviceOverrides.get(deviceId)?.streamingDebug) broker.setStreamingDebug(true);
@@ -14274,475 +14305,468 @@ var TimelineSession = class {
 	}
 };
 //#endregion
-//#region src/stream-broker/recorded/segment-demux.ts
+//#region src/stream-broker/recorded/ffmpeg-run-once.ts
 /**
-* Pure selector: map a node-av video `codecId` to its mp4toannexb bitstream
-* filter name and the `AccessUnit.codec` tag. Both BSFs prepend the stream's
-* parameter sets to keyframes (SPS/PPS for H.264; VPS/SPS/PPS for H.265).
+* ffmpeg-run-once — spawn ffmpeg for ONE batch conversion: feed an in-memory
+* input buffer on stdin, collect the whole stdout, resolve when the process
+* exits. Used by the recorded-playback demuxers (`segment-demux`,
+* `segment-audio`) which turn a single self-contained `.m4s` fragment into
+* Annex-B / µ-law bytes in a crash-isolated subprocess (replacing the old
+* in-process `node-av` binding).
 *
-* `h264Id`/`hevcId` are injected (from `node-av/constants`
-* `AV_CODEC_ID_H264`=27 / `AV_CODEC_ID_HEVC`=173) so this is unit-testable
-* without loading the FFmpeg binding. Throws on any other codec.
+* Unlike the live streaming sessions (`decoder-ffmpeg`, `audio-codec-ffmpeg`)
+* this is fire-once: there is no persistent stdin feed. stdin is written and
+* closed up-front so ffmpeg reads the whole fragment, transcodes, flushes, and
+* exits; we buffer stdout and resolve with it.
+*
+* The kill sequence copies the CORRECTED gating from `decoder-ffmpeg`/
+* `audio-codec-ffmpeg`: SIGTERM then escalated SIGKILL gated on
+* `exitCode === null && signalCode === null` (NOT on `child.killed`, which Node
+* sets true after ANY kill() so `!child.killed` never fires → leaked ffmpeg).
 */
-function bsfNameForCodecId(codecId, h264Id, hevcId) {
-	if (codecId === h264Id) return {
-		bsf: "h264_mp4toannexb",
-		codec: "H264"
-	};
-	if (codecId === hevcId) return {
-		bsf: "hevc_mp4toannexb",
-		codec: "H265"
-	};
-	throw new Error(`segment-demux: unsupported video codec id ${codecId} (expected H264=${h264Id} or HEVC=${hevcId})`);
-}
+/** Hard ceiling for one fragment conversion; a ~4 s GOP transcodes in well
+*  under this even on a slow agent. Prevents a wedged ffmpeg from leaking. */
+var RUN_TIMEOUT_MS = 8e3;
+/** Grace period between SIGTERM and the escalated SIGKILL. */
+var KILL_GRACE_MS = 500;
 /**
-* `AV_NOPTS_VALUE` (INT64_MIN) — FFmpeg's sentinel for "no timestamp". A packet
-* carrying this in `pts`/`dts` has no usable presentation time; converting it
-* naively yields a garbage ~-9.2e18 ms.
+* Run ffmpeg once over `input` and resolve with the collected stdout bytes.
+*
+* @throws If ffmpeg cannot be spawned, times out, or exits non-zero (unless
+*   `tolerateNonZeroExit` is set).
 */
-var AV_NOPTS_VALUE$1 = -9223372036854775808n;
-var _navPromise$1 = null;
-var _constsPromise$1 = null;
-function getNodeAv$1() {
-	return _navPromise$1 ??= import("node-av");
-}
-function getConstants$1() {
-	return _constsPromise$1 ??= import("node-av/constants");
-}
-/** Convert a presentation timestamp in stream ticks to milliseconds. */
-function ticksToMs$1(ptsTicks, timeBase) {
-	return Math.round(Number(ptsTicks) * 1e3 * timeBase.num / timeBase.den);
+function runFfmpegOnce(options) {
+	const { ffmpegPath, args, input, tolerateNonZeroExit = false } = options;
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		const stderrTail = [];
+		let settled = false;
+		const child = (() => {
+			try {
+				return spawn(ffmpegPath, [...args]);
+			} catch (err) {
+				reject(/* @__PURE__ */ new Error(`ffmpeg spawn failed: ${errMsg(err)}`));
+				return null;
+			}
+		})();
+		if (child === null) return;
+		const timer = setTimeout(() => {
+			if (settled) return;
+			settle(() => reject(/* @__PURE__ */ new Error("ffmpeg-run-once: timed out")));
+			kill();
+		}, RUN_TIMEOUT_MS);
+		timer.unref?.();
+		const settle = (fn) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			fn();
+		};
+		const kill = () => {
+			try {
+				child.kill("SIGTERM");
+			} catch {}
+			setTimeout(() => {
+				if (child.exitCode === null && child.signalCode === null) try {
+					child.kill("SIGKILL");
+				} catch {}
+			}, KILL_GRACE_MS).unref?.();
+		};
+		child.stdin?.on("error", () => {});
+		child.stdout?.on("data", (chunk) => chunks.push(chunk));
+		child.stderr?.on("data", (data) => {
+			const line = data.toString().trim();
+			if (line) {
+				stderrTail.push(line);
+				if (stderrTail.length > 8) stderrTail.shift();
+			}
+		});
+		child.on("error", (err) => {
+			settle(() => reject(/* @__PURE__ */ new Error(`ffmpeg process error: ${err.message}`)));
+		});
+		child.on("exit", (code, signal) => {
+			const stdout = Buffer.concat(chunks);
+			if (code === 0 || tolerateNonZeroExit) {
+				settle(() => resolve(stdout));
+				return;
+			}
+			settle(() => reject(/* @__PURE__ */ new Error(`ffmpeg exited code=${code} signal=${signal}: ${stderrTail.join(" | ") || "(no stderr)"}`)));
+		});
+		try {
+			child.stdin?.write(Buffer.from(input.buffer, input.byteOffset, input.byteLength));
+			child.stdin?.end();
+		} catch {}
+	});
 }
+//#endregion
+//#region src/stream-broker/recorded/ts-annexb-demux.ts
 /**
-* Demux a self-contained H.264 or H.265 `.m4s` fragment into ordered Annex-B
-* access units.
+* ts-annexb-demux — pure MPEG-TS → ordered Annex-B access units.
 *
-* The video codec is detected from the segment's video stream `codecId`; the
-* matching mp4toannexb bitstream filter prepends parameter sets to every IDR
-* (SPS/PPS for H.264, VPS/SPS/PPS for H.265) — no manual `avcC`/`hvcC` parsing.
-* Each returned {@link AccessUnit} owns a detached copy of the packet bytes —
-* the underlying `node-av` packets are freed before this resolves, so the
-* result is safe to retain. Throws on a non-H.264/H.265 video codec.
+* Companion to {@link demuxSegmentToAnnexB}: `segment-demux` runs one `.m4s`
+* fragment through `ffmpeg -c:v copy -f mpegts` (crash-isolated subprocess,
+* replacing the old in-process `node-av` demux) and hands the resulting
+* transport stream here to be split back into per-frame access units.
 *
-* @param bytes - The full `.m4s` fragment (one moov + one IDR-led GOP).
-* @returns Access units in source presentation order, each tagged with its codec.
+* Why MPEG-TS as the intermediate container:
+*   - it preserves EXACTLY the two things the recorded-playback feeder needs
+*     that a raw Annex-B elementary stream (`-f h264/hevc`) throws away — the
+*     per-frame presentation timestamp (PES `PTS`, 90 kHz) and the frame
+*     boundaries (one video PES per access unit, marked by `payload_unit_start`);
+*   - the ffmpeg mpegts muxer FUSES the parameter sets onto every random-access
+*     point exactly like the `h264/hevc_mp4toannexb` bitstream filter did — the
+*     IDR PES carries `AUD` + `VPS/SPS/PPS` (H.265) or `AUD` + `SPS/PPS`
+*     (H.264) ahead of the IDR slice — so no explicit BSF is needed and the
+*     downstream pusher's "one AU per frame, params on keyframes" contract holds;
+*   - the codec is read straight from the PMT `stream_type` (`0x1B` → H.264,
+*     `0x24` → H.265), so no separate probe pass is required.
+*
+* This module is intentionally pure (a `Uint8Array` in, access units out) so it
+* unit-tests against a committed `.ts` fixture with no ffmpeg/native binding.
 */
-async function demuxSegmentToAnnexB(bytes) {
-	const nav = await getNodeAv$1();
-	const C = await getConstants$1();
-	const input = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	const demuxer = await nav.Demuxer.open(input);
-	let bsf = null;
-	try {
-		const videoStream = demuxer.video() ?? demuxer.findBestStream(C.AVMEDIA_TYPE_VIDEO);
-		if (!videoStream) throw new Error("segment-demux: no video stream found in fragment");
-		const timeBase = videoStream.timeBase;
-		const { bsf: bsfName, codec } = bsfNameForCodecId(videoStream.codecpar.codecId, C.AV_CODEC_ID_H264, C.AV_CODEC_ID_HEVC);
-		bsf = nav.BitStreamFilterAPI.create(bsfName, videoStream);
-		const accessUnits = [];
-		for await (const packet of bsf.packets(demuxer.packets(videoStream.index))) {
-			if (packet === null) break;
-			try {
-				const data = packet.data;
-				if (data && data.length > 0) {
-					const copy = new Uint8Array(data.length);
-					copy.set(data);
-					const rawPts = packet.pts !== AV_NOPTS_VALUE$1 ? packet.pts : packet.dts !== AV_NOPTS_VALUE$1 ? packet.dts : 0n;
-					accessUnits.push({
-						data: copy,
-						ptsMs: ticksToMs$1(rawPts, timeBase),
-						keyframe: packet.isKeyframe,
-						codec
-					});
-				}
-			} finally {
-				packet.free();
+/** MPEG-TS transport packet size. */
+var TS_PACKET_SIZE = 188;
+/** Transport packet sync byte. */
+var TS_SYNC_BYTE = 71;
+/** The PAT always lives on PID 0. */
+var PAT_PID = 0;
+/** PMT `stream_type` for H.264 (AVC) video. */
+var STREAM_TYPE_H264 = 27;
+/** PMT `stream_type` for H.265 (HEVC) video. */
+var STREAM_TYPE_H265 = 36;
+/** Map a PMT `stream_type` to the AccessUnit codec tag, or null if not video. */
+function codecForStreamType(streamType) {
+	if (streamType === STREAM_TYPE_H264) return "H264";
+	if (streamType === STREAM_TYPE_H265) return "H265";
+	return null;
+}
+/**
+* Detect whether an Annex-B access unit is a keyframe by scanning its NAL units:
+* H.264 IDR (type 5) or H.265 IRAP (types 16–21). Mirrors
+* `AnnexBDeframer.isKeyframeNal`; params/AUD NALs ahead of the slice are ignored.
+*/
+function isKeyframeAccessUnit(au, codec) {
+	for (const nalStart of iterateNalStarts(au)) {
+		const header = au[nalStart];
+		if (header === void 0) continue;
+		if (codec === "H264") {
+			if ((header & 31) === 5) return true;
+		} else {
+			const type = header >> 1 & 63;
+			if (type >= 16 && type <= 21) return true;
+		}
+	}
+	return false;
+}
+/**
+* Yield the byte offset of the FIRST byte of each NAL unit (i.e. just past its
+* Annex-B start code, `00 00 01` or `00 00 00 01`) in `buf`.
+*/
+function* iterateNalStarts(buf) {
+	const len = buf.length;
+	let i = 0;
+	while (i + 2 < len) {
+		if (buf[i] === 0 && buf[i + 1] === 0) {
+			if (buf[i + 2] === 1) {
+				yield i + 3;
+				i += 3;
+				continue;
+			}
+			if (buf[i + 2] === 0 && buf[i + 3] === 1) {
+				yield i + 4;
+				i += 4;
+				continue;
 			}
 		}
-		return accessUnits;
-	} finally {
-		bsf?.close();
-		await demuxer.close();
+		i++;
 	}
 }
+/**
+* Read the 33-bit PES `PTS` (or DTS) from the 5 bytes at `off` and return it in
+* 90 kHz ticks. The layout interleaves marker bits every byte
+* (`0010 PPP1 PPPPPPPP PPPPPPP1 PPPPPPPP PPPPPPP1`).
+*/
+function readPts33(buf, off) {
+	const b0 = buf[off] ?? 0;
+	const b1 = buf[off + 1] ?? 0;
+	const b2 = buf[off + 2] ?? 0;
+	const b3 = buf[off + 3] ?? 0;
+	const b4 = buf[off + 4] ?? 0;
+	const hi = b0 >> 1 & 7;
+	const mid = b1 << 7 | b2 >> 1;
+	const lo = b3 << 7 | b4 >> 1;
+	return hi * 1073741824 + mid * 32768 + lo;
+}
+/** Locate the payload offset within a TS packet, skipping any adaptation field. */
+function payloadOffset(pkt, base) {
+	const adaptationFieldControl = pkt[base + 3] >> 4 & 3;
+	let off = base + 4;
+	if (adaptationFieldControl & 2) off += 1 + pkt[off];
+	return off;
+}
+/** Whether a TS packet's adaptation_field_control indicates a payload is present. */
+function hasPayload(pkt, base) {
+	const afc = pkt[base + 3] >> 4 & 3;
+	return afc === 1 || afc === 3;
+}
+/** Parse the PAT payload → the first program's PMT PID. */
+function parsePatForPmtPid(payload) {
+	const p = 1 + payload[0] + 8;
+	if (p + 3 >= payload.length) return null;
+	return (payload[p + 2] & 31) << 8 | payload[p + 3];
+}
+/** Parse the PMT payload → the first H.264/H.265 elementary stream's PID + codec. */
+function parsePmt(payload) {
+	const p = 1 + payload[0];
+	const sectionLength = (payload[p + 1] & 15) << 8 | payload[p + 2];
+	const programInfoLength = (payload[p + 10] & 15) << 8 | payload[p + 11];
+	let es = p + 12 + programInfoLength;
+	const sectionEnd = p + 3 + sectionLength - 4;
+	while (es + 4 < sectionEnd && es + 4 < payload.length) {
+		const streamType = payload[es];
+		const elementaryPid = (payload[es + 1] & 31) << 8 | payload[es + 2];
+		const esInfoLength = (payload[es + 3] & 15) << 8 | payload[es + 4];
+		const codec = codecForStreamType(streamType);
+		if (codec !== null) return {
+			videoPid: elementaryPid,
+			codec
+		};
+		es += 5 + esInfoLength;
+	}
+	return null;
+}
+/** Split one reassembled PES packet into its Annex-B elementary-stream payload
+*  and 90 kHz PTS (null when the PES carries no PTS flag). */
+function splitPes(pes) {
+	if (pes.length < 9 || pes[0] !== 0 || pes[1] !== 0 || pes[2] !== 1) return null;
+	const ptsDtsFlags = pes[7] >> 6 & 3;
+	const headerDataLength = pes[8];
+	return {
+		es: pes.subarray(9 + headerDataLength),
+		pts: ptsDtsFlags & 2 ? readPts33(pes, 9) : null
+	};
+}
+/**
+* Demux an MPEG-TS byte stream (as produced by `ffmpeg -c:v copy -f mpegts`)
+* into ordered Annex-B access units, one per video PES.
+*
+* @param ts - The full transport stream.
+* @returns The detected codec and its access units in transport (decode) order.
+* @throws If no H.264/H.265 video elementary stream is present.
+*/
+function demuxMpegTsToAnnexB(ts) {
+	let pmtPid = null;
+	let pmt = null;
+	for (let i = 0; i + TS_PACKET_SIZE <= ts.length; i += TS_PACKET_SIZE) {
+		const pkt = ts.subarray(i, i + TS_PACKET_SIZE);
+		if (pkt[0] !== TS_SYNC_BYTE) continue;
+		const pid = (pkt[1] & 31) << 8 | pkt[2];
+		if (!((pkt[1] & 64) !== 0) || !hasPayload(pkt, 0)) continue;
+		const payload = pkt.subarray(payloadOffset(pkt, 0));
+		if (pid === PAT_PID) pmtPid ??= parsePatForPmtPid(payload);
+		else if (pmtPid !== null && pid === pmtPid && pmt === null) pmt = parsePmt(payload);
+	}
+	if (pmt === null) throw new Error("ts-annexb-demux: no H.264/H.265 video stream found in transport stream");
+	const { videoPid, codec } = pmt;
+	const accessUnits = [];
+	let current = null;
+	const finalize = () => {
+		if (current === null) return;
+		const pes = current.length === 1 ? current[0] : concat(current);
+		current = null;
+		const split = splitPes(pes);
+		if (split === null || split.es.length === 0) return;
+		const data = new Uint8Array(split.es.length);
+		data.set(split.es);
+		accessUnits.push({
+			data,
+			ptsMs: split.pts === null ? 0 : Math.round(split.pts / 90),
+			keyframe: isKeyframeAccessUnit(data, codec)
+		});
+	};
+	for (let i = 0; i + TS_PACKET_SIZE <= ts.length; i += TS_PACKET_SIZE) {
+		const pkt = ts.subarray(i, i + TS_PACKET_SIZE);
+		if (pkt[0] !== TS_SYNC_BYTE) continue;
+		if (((pkt[1] & 31) << 8 | pkt[2]) !== videoPid) continue;
+		if (!hasPayload(pkt, 0)) continue;
+		const payloadStart = (pkt[1] & 64) !== 0;
+		const payload = pkt.subarray(payloadOffset(pkt, 0));
+		if (payloadStart) {
+			finalize();
+			current = [Uint8Array.from(payload)];
+		} else if (current !== null) current.push(Uint8Array.from(payload));
+	}
+	finalize();
+	return {
+		codec,
+		accessUnits
+	};
+}
+/** Concatenate TS payload fragments into one contiguous PES buffer. */
+function concat(parts) {
+	let total = 0;
+	for (const p of parts) total += p.length;
+	const out = new Uint8Array(total);
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.length;
+	}
+	return out;
+}
 //#endregion
-//#region src/stream-broker/recorded/pcm-to-mulaw.ts
+//#region src/stream-broker/recorded/segment-demux.ts
 /**
-* G.711 µ-law (PCMU) encode — pure, no native deps.
+* segment-demux — turn one self-contained `.m4s` fragment (a Buffer) into
+* ordered Annex-B access units. Codec-agnostic: handles BOTH H.264 and H.265
+* recordings (the recorder is `-c:v copy` passthrough, so an H.264 camera
+* produces H.264 recordings and an H.265 camera produces H.265 recordings).
 *
-* The WebRTC audio sender negotiates `audio/PCMU` (8 kHz). Recorded audio is
-* stored as AAC, decoded to 8 kHz mono signed-16 PCM, then companded to µ-law
-* here for the same wire format the live path uses.
+* The recorder writes self-contained fragments: each `.m4s` carries its own
+* `moov` (and thus its own `avcC`/`hvcC` parameter sets) plus exactly one
+* IDR-led GOP (~4s). To replay one over a push pipeline we need the bytes as
+* Annex-B access units with parameter sets prepended to every IDR (SPS/PPS for
+* H.264; VPS/SPS/PPS for H.265) and each unit tagged with its source PTS.
 *
-* Standard ITU-T G.711 µ-law: bias 0x84, clip 32635, exponent table.
+* Implementation: run the fragment through `ffmpeg -c:v copy -f mpegts` (a
+* crash-isolated subprocess — this replaced the old in-process `node-av`
+* demux + `h264/hevc_mp4toannexb` BSF, which could SIGBUS the whole broker on
+* a fragile stream), then split the transport stream back into access units
+* with {@link demuxMpegTsToAnnexB}. The mpegts muxer fuses the parameter sets
+* onto every IDR exactly like the mp4toannexb BSF did, preserves the per-frame
+* PTS (PES 90 kHz), and exposes the codec via the PMT `stream_type` — so no
+* explicit bitstream filter and no separate probe pass are needed. See
+* `ts-annexb-demux.ts` for the container-choice rationale.
 */
-var BIAS = 132;
-var CLIP = 32635;
-var EXP_LUT = [
-	0,
-	0,
-	1,
-	1,
-	2,
-	2,
-	2,
-	2,
-	3,
-	3,
-	3,
-	3,
-	3,
-	3,
-	3,
-	3,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	4,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	5,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	6,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7,
-	7
+/**
+* ffmpeg arguments to remux one `.m4s` fragment (read from stdin) into an
+* Annex-B MPEG-TS on stdout. `-c:v copy` = no re-encode; the mpegts muxer does
+* the mp4→annexb conversion and fuses parameter sets onto every IDR. `-an`
+* drops audio (handled separately by `segment-audio`). Exported for the spec.
+*/
+var SEGMENT_DEMUX_FFMPEG_ARGS = [
+	"-hide_banner",
+	"-loglevel",
+	"error",
+	"-i",
+	"pipe:0",
+	"-map",
+	"0:v:0",
+	"-c:v",
+	"copy",
+	"-an",
+	"-f",
+	"mpegts",
+	"pipe:1"
 ];
-/** Compand one signed 16-bit linear PCM sample to an 8-bit µ-law byte. */
-function linearToMuLaw(sample) {
-	let s = sample;
-	const sign = s >> 8 & 128;
-	if (sign !== 0) s = -s;
-	if (s > CLIP) s = CLIP;
-	s += BIAS;
-	const exponent = EXP_LUT[s >> 7 & 255];
-	const mantissa = s >> exponent + 3 & 15;
-	return ~(sign | exponent << 4 | mantissa) & 255;
-}
 /**
-* Encode interleaved signed-16 little-endian PCM (mono) to µ-law bytes.
-* One output byte per input sample.
+* Demux a self-contained H.264 or H.265 `.m4s` fragment into ordered Annex-B
+* access units.
+*
+* The video codec is detected from the transport stream's PMT `stream_type`;
+* the mpegts muxer fuses parameter sets onto every IDR (SPS/PPS for H.264,
+* VPS/SPS/PPS for H.265). Each returned {@link AccessUnit} owns a detached copy
+* of the bytes. Throws on a non-H.264/H.265 stream or a failed conversion.
+*
+* @param bytes - The full `.m4s` fragment (one moov + one IDR-led GOP).
+* @param ffmpegPath - ffmpeg binary path (defaults to PATH `ffmpeg`).
+* @returns Access units in source presentation order, each tagged with its codec.
 */
-function encodeMuLaw(pcmS16le) {
-	const view = new DataView(pcmS16le.buffer, pcmS16le.byteOffset, pcmS16le.byteLength);
-	const n = pcmS16le.byteLength >> 1;
-	const out = new Uint8Array(n);
-	for (let i = 0; i < n; i++) out[i] = linearToMuLaw(view.getInt16(i * 2, true));
-	return out;
+async function demuxSegmentToAnnexB(bytes, ffmpegPath = "ffmpeg") {
+	const { codec, accessUnits } = demuxMpegTsToAnnexB(await runFfmpegOnce({
+		ffmpegPath,
+		args: SEGMENT_DEMUX_FFMPEG_ARGS,
+		input: bytes
+	}));
+	return accessUnits.map((au) => ({
+		data: au.data,
+		ptsMs: au.ptsMs,
+		keyframe: au.keyframe,
+		codec
+	}));
 }
 //#endregion
 //#region src/stream-broker/recorded/segment-audio.ts
 /**
-* segment-audio — turn one `.m4s` fragment's AAC audio into 8 kHz µ-law (PCMU)
+* segment-audio — turn one `.m4s` fragment's audio into 8 kHz µ-law (PCMU)
 * access units, matching the WebRTC audio sender's negotiated codec
 * (`audio/PCMU`, 8 kHz, PT 0 — see session.ts). Recorded audio is stored as AAC
-* (the recorder transcodes every camera's audio to AAC); WebRTC speaks PCMU, so
-* we decode AAC → 8 kHz mono s16 PCM (via the in-process `DecodeRuntime`, the
-* same one the live audio-codec path uses) then compand to µ-law here.
+* (the recorder transcodes every camera's audio to AAC); WebRTC speaks PCMU.
 *
-* Output: 20 ms (160-sample) PCMU frames with segment-relative `ptsMs`, ready to
-* push on the session's audio sender alongside the recorded video.
+* Implementation: run the fragment through
+* `ffmpeg -vn -ar 8000 -ac 1 -c:a pcm_mulaw -f mulaw` (a crash-isolated
+* subprocess — this replaced the old in-process `node-av` `DecodeRuntime`
+* decode + hand-rolled µ-law companding). ffmpeg decodes the AAC, resamples to
+* 8 kHz mono, and companded µ-law bytes come out on stdout; we slice them into
+* fixed 20 ms (160-sample) PCMU frames here.
 *
-* Best-effort by contract: returns [] when the fragment has no usable audio, and
-* the caller swallows throws — recorded audio must NEVER block recorded video.
+* Output: 20 ms PCMU frames with segment-relative `ptsMs`, ready to push on the
+* session's audio sender alongside the recorded video.
+*
+* Best-effort by contract: returns [] when the fragment has no usable audio
+* (ffmpeg exits non-zero → tolerated, empty output), and the caller swallows
+* throws — recorded audio must NEVER block recorded video.
 */
 /** PCMU target: 8 kHz mono, 160 samples (20 ms) per RTP frame. */
-var TARGET_RATE = 8e3;
 var FRAME_SAMPLES = 160;
 var FRAME_MS = 20;
-/** FFmpeg's "no timestamp" sentinel (INT64_MIN). */
-var AV_NOPTS_VALUE = -9223372036854775808n;
-var _navPromise = null;
-var _constsPromise = null;
-var getNodeAv = () => _navPromise ??= import("node-av");
-var getConstants = () => _constsPromise ??= import("node-av/constants");
-function ticksToMs(pts, tb) {
-	return Math.round(Number(pts) * 1e3 * tb.num / tb.den);
+/**
+* ffmpeg arguments to decode one `.m4s` fragment's audio (read from stdin) into
+* raw 8 kHz mono µ-law bytes on stdout. `-vn` drops video (handled by
+* `segment-demux`); `-c:a pcm_mulaw -f mulaw` companded output = one byte per
+* 8 kHz sample. Exported for the spec.
+*/
+var SEGMENT_AUDIO_FFMPEG_ARGS = [
+	"-hide_banner",
+	"-loglevel",
+	"error",
+	"-i",
+	"pipe:0",
+	"-vn",
+	"-map",
+	"0:a:0",
+	"-ar",
+	"8000",
+	"-ac",
+	"1",
+	"-c:a",
+	"pcm_mulaw",
+	"-f",
+	"mulaw",
+	"pipe:1"
+];
+/**
+* Slice a contiguous 8 kHz µ-law byte stream (one byte per sample) into fixed
+* 160-sample (20 ms) PCMU frames, dropping any trailing partial frame. `ptsMs`
+* is derived from the running frame index — audio is continuous 8 kHz, and each
+* recorded segment re-anchors its own timeline downstream, so the frames start
+* at 0 (segment-relative). Pure, so it unit-tests without ffmpeg.
+*/
+function sliceMuLawToPcmuFrames(mulaw) {
+	const out = [];
+	for (let off = 0, idx = 0; off + FRAME_SAMPLES <= mulaw.length; off += FRAME_SAMPLES, idx++) out.push({
+		data: mulaw.slice(off, off + FRAME_SAMPLES),
+		ptsMs: idx * FRAME_MS
+	});
+	return out;
 }
 /**
-* Demux + transcode one fragment's AAC audio into PCMU access units. Returns []
-* when there is no usable audio stream (the fragment is video-only, or carries a
-* non-AAC audio codec we don't expect from the recorder).
+* Decode + resample one fragment's audio into PCMU access units. Returns []
+* when there is no usable audio stream (video-only fragment, or a codec ffmpeg
+* can't decode) — ffmpeg exits non-zero, which is tolerated as empty output.
+*
+* @param bytes - The full `.m4s` fragment.
+* @param ffmpegPath - ffmpeg binary path (defaults to PATH `ffmpeg`).
 */
-async function demuxSegmentToPcmu(bytes) {
-	const nav = await getNodeAv();
-	const C = await getConstants();
-	const input = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	const demuxer = await nav.Demuxer.open(input);
-	let decode = null;
-	try {
-		const stream = demuxer.audio() ?? demuxer.findBestStream(C.AVMEDIA_TYPE_AUDIO);
-		if (!stream) return [];
-		const cp = stream.codecpar;
-		const codecName = cp.codecId === C.AV_CODEC_ID_AAC ? "aac" : cp.codecId === C.AV_CODEC_ID_AAC_LATM ? "aac_latm" : null;
-		if (codecName === null) return [];
-		const sourceChannels = cp.channelLayout?.nbChannels ?? cp.channels ?? 1;
-		decode = DecodeRuntime.create({
-			codec: codecName,
-			sourceSampleRate: cp.sampleRate,
-			sourceChannels,
-			extraData: cp.extradata ? new Uint8Array(cp.extradata) : void 0,
-			targetSampleRate: TARGET_RATE,
-			targetChannels: 1,
-			targetFormat: "s16le"
-		});
-		let baseMs = null;
-		const muLaw = [];
-		for await (const packet of demuxer.packets(stream.index)) {
-			if (packet === null) break;
-			try {
-				const data = packet.data;
-				if (data && data.length > 0) {
-					if (baseMs === null && packet.pts !== AV_NOPTS_VALUE) baseMs = ticksToMs(packet.pts, stream.timeBase);
-					for (const pcm of decode.decode(data)) {
-						const enc = encodeMuLaw(pcm.data);
-						for (let i = 0; i < enc.length; i++) muLaw.push(enc[i]);
-					}
-				}
-			} finally {
-				packet.free();
-			}
-		}
-		if (muLaw.length === 0) return [];
-		const base = baseMs ?? 0;
-		const out = [];
-		for (let off = 0, idx = 0; off + FRAME_SAMPLES <= muLaw.length; off += FRAME_SAMPLES, idx++) out.push({
-			data: Uint8Array.from(muLaw.slice(off, off + FRAME_SAMPLES)),
-			ptsMs: base + idx * FRAME_MS
-		});
-		return out;
-	} finally {
-		decode?.close();
-		await demuxer.close();
-	}
+async function demuxSegmentToPcmu(bytes, ffmpegPath = "ffmpeg") {
+	const mulaw = await runFfmpegOnce({
+		ffmpegPath,
+		args: SEGMENT_AUDIO_FFMPEG_ARGS,
+		input: bytes,
+		tolerateNonZeroExit: true
+	});
+	if (mulaw.length === 0) return [];
+	return sliceMuLawToPcmuFrames(mulaw);
 }
 //#endregion
 //#region src/stream-broker/webrtc/broker-webrtc-server.ts
@@ -14927,6 +14951,7 @@ var BrokerWebrtcServer = class {
 	resolveTranscodeDecodeHwAccelFn;
 	locateRecordedSegment;
 	readRecordedSegmentBytes;
+	resolveFfmpegPath;
 	/** Cached decode-hwaccel backend for transcode feeds (resolved once). */
 	transcodeDecodeHwAccel = void 0;
 	/** brokerId → IStreamBroker reference. Set by the broker manager on registration. */
@@ -14970,6 +14995,7 @@ var BrokerWebrtcServer = class {
 		this.resolveTranscodeDecodeHwAccelFn = options.resolveTranscodeDecodeHwAccel;
 		this.locateRecordedSegment = options.locateRecordedSegment;
 		this.readRecordedSegmentBytes = options.readRecordedSegmentBytes;
+		this.resolveFfmpegPath = options.resolveFfmpegPath;
 	}
 	/**
 	* Resolve (once, cached) the decode-hwaccel backend for transcode feeds.
@@ -15485,6 +15511,7 @@ var BrokerWebrtcServer = class {
 		session.onClosed = () => this.cleanupSession(sessionId);
 		const locateRecorded = this.locateRecordedSegment;
 		const readRecorded = this.readRecordedSegmentBytes;
+		const resolveFfmpeg = this.resolveFfmpegPath;
 		if (locateRecorded && readRecorded) {
 			let timeline;
 			timeline = new TimelineSession({
@@ -15495,8 +15522,8 @@ var BrokerWebrtcServer = class {
 					profile,
 					locate: locateRecorded,
 					readBytes: readRecorded,
-					demux: demuxSegmentToAnnexB,
-					demuxAudio: demuxSegmentToPcmu,
+					demux: (b) => demuxSegmentToAnnexB(b, resolveFfmpeg?.()),
+					demuxAudio: (b) => demuxSegmentToPcmu(b, resolveFfmpeg?.()),
 					sink: {
 						pushAccessUnit: (data, ts, codec) => session.pushRecordedAccessUnit(data, ts, codec),
 						pushAudioPcmu: (pcmu, ts) => session.writeRecordedAudio(Buffer.from(pcmu), ts)
@@ -16257,6 +16284,10 @@ var BROKER_METRICS_HEARTBEAT_MS = 3e4;
 var PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS = 6e4;
 var StreamBrokerAddon = class extends BaseAddon {
 	brokerManager = null;
+	/** ffmpeg binary path from the `ffmpeg` config section, mirrored here so the
+	*  recorded-playback demuxers (segment-demux/segment-audio) spawn the same
+	*  configured binary as the transcode egress. Kept in sync by loadFfmpegConfig. */
+	ffmpegBinaryPath = "ffmpeg";
 	metricsSnapshotTimer = null;
 	catalogReconcileTimer = null;
 	/** Kept so onShutdown can close every live PeerConnection — releasing
@@ -16317,6 +16348,7 @@ var StreamBrokerAddon = class extends BaseAddon {
 				hwAccel,
 				threadCount
 			});
+			this.ffmpegBinaryPath = binaryPath;
 			this.ctx.logger.info("Loaded ffmpeg config", { meta: {
 				binaryPath,
 				hwAccel,
@@ -16579,7 +16611,8 @@ var StreamBrokerAddon = class extends BaseAddon {
 			},
 			resolveTranscodeDecodeHwAccel: () => this.resolveTranscodeDecodeHwAccel(),
 			locateRecordedSegment: (args) => this.ctx.api.recording.locateSegment.query(args),
-			readRecordedSegmentBytes: async (args) => (await this.ctx.api.recording.readSegmentBytes.query(args)).data
+			readRecordedSegmentBytes: async (args) => (await this.ctx.api.recording.readSegmentBytes.query(args)).data,
+			resolveFfmpegPath: () => this.ffmpegBinaryPath
 		});
 		this.brokerManager.setWebrtcServer(webrtcServer);
 		this.webrtcServer = webrtcServer;
@@ -16863,27 +16896,6 @@ var StreamBrokerAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-//#region src/stream-broker/stream-broker/frame-dropper.ts
-var FrameDropper = class {
-	intervalMs;
-	lastPassedAt = -Infinity;
-	constructor(maxFps) {
-		this.intervalMs = maxFps > 0 ? 1e3 / maxFps : 0;
-	}
-	shouldKeep() {
-		if (this.intervalMs === 0) return true;
-		const now = Date.now();
-		if (now - this.lastPassedAt >= this.intervalMs) {
-			this.lastPassedAt = now;
-			return true;
-		}
-		return false;
-	}
-	setMaxFps(maxFps) {
-		this.intervalMs = maxFps > 0 ? 1e3 / maxFps : 0;
-	}
-};
-//#endregion
 //#region src/stream-broker/stream-broker/ffmpeg-decoder-session.ts
 /** Minimal no-op logger for default parameter */
 var noopLogger = {