@camstack/addon-pipeline 1.1.40 → 1.1.42

package/dist/session-decode/decode-worker-child.js

@@ -24,6 +24,19 @@ var FrameSlot = class {
 	*/
 	reserved = null;
 	pendingPull = false;
+	/** Frames dropped by the `minIntervalMs` throttle (never entered the slot). */
+	throttledCount = 0;
+	/** Frames dropped by latest-wins (an unpulled slot frame superseded before delivery). */
+	supersededCount = 0;
+	/**
+	* Total frames this slot has DROPPED before delivery — the sum of the
+	* `minIntervalMs` throttle drops and the latest-wins (drop-older)
+	* supersessions. Read by the decode-worker child for its `framesSkipped`
+	* metric; purely additive, never affects slot behaviour.
+	*/
+	get droppedCount() {
+		return this.throttledCount + this.supersededCount;
+	}
 	/**
 	* Publish a newly decoded frame into the latest-wins slot, freeing
 	* whatever the slot held before (the drop-older half of "latest-wins").
@@ -33,6 +46,7 @@ var FrameSlot = class {
 	*/
 	publish(frame, timestamp, minIntervalMs) {
 		if (minIntervalMs > 0 && this.slot && timestamp - this.slot.timestamp < minIntervalMs) {
+			this.throttledCount++;
 			frame.free();
 			return null;
 		}
@@ -45,6 +59,7 @@ var FrameSlot = class {
 			width: frame.width,
 			height: frame.height
 		};
+		if (previous) this.supersededCount++;
 		previous?.frame.free();
 		if (this.pendingPull) {
 			this.pendingPull = false;
@@ -91,6 +106,27 @@ var FrameSlot = class {
 //#region src/session-decode/decode-worker-child.ts
 /** Re-dial backoff on a transient dial error/EOF (mirrors the decoder's PULL_REDIAL_MS). */
 var REDIAL_MS = 3e3;
+/** How often the worker emits its `framesDecoded/framesSkipped/deliveredFps` line. */
+var METRICS_INTERVAL_MS = 1e4;
+/**
+* The libav GPU scale filter for a hwaccel backend, or `null` when none is
+* known here — those backends fall back to the software crop+scale path.
+* Mirrors `addon-decoder-ffmpeg/src/ffmpeg-args.ts` `gpuScaleFilterForBackend`.
+*/
+function gpuScaleFilterForBackend(backend) {
+	switch (backend) {
+		case "vaapi": return "scale_vaapi";
+		case "qsv": return "scale_qsv";
+		case "cuda":
+		case "nvdec": return "scale_cuda";
+		case "videotoolbox": return "scale_vt";
+		default: return null;
+	}
+}
+/** libav `format` filter target name for the requested detection pixel format. */
+function pixelFilterName(format) {
+	return format === "gray" ? "gray" : "rgb24";
+}
 var _nav = null;
 var _consts = null;
 async function getNodeAv() {
@@ -183,6 +219,45 @@ function resolveResizeTarget(cropWidth, cropHeight, resize) {
 		height: Math.max(1, Math.round(resize.height))
 	};
 }
+/** Whether `region` covers the entire `srcW x srcH` frame (i.e. no real crop). */
+function isFullFrameRegion(region, srcW, srcH) {
+	return region.left === 0 && region.top === 0 && region.width === srcW && region.height === srcH;
+}
+/**
+* Build the libav filtergraph description for the GPU crop+scale path.
+*
+* Full-frame — the ONLY shape the session-decode pump ever asks for (it passes
+* `resize`+`format`, never `crop`, see `session-decode-pump.ts`): scale on the
+* GPU, then `hwdownload` pulls only the small detection-sized surface into
+* system memory + a cheap pixel-convert. This is byte-for-byte the chain the
+* ffmpeg decoder already ships (`addon-decoder-ffmpeg/src/ffmpeg-args.ts`
+* `buildVideoFilter`): `scale_<be>=w=W:h=H,hwdownload,format=nv12,format=<pixel>`.
+*
+* Sub-region crop — contract-supported but unused on the hot path: the generic
+* `crop` filter offsets plane POINTERS, which corrupts opaque VAAPI/QSV
+* surfaces, so there is no safe GPU crop for those. A real crop is therefore
+* done on the CPU AFTER `hwdownload` (`hwdownload,format=nv12,crop=…,scale=…`).
+* It is correct and never crashes; it just forgoes the GPU win for that rare
+* call — exactly the safety/behaviour trade-off the task calls for.
+*/
+function buildGpuFilterDescription(scaleFilter, region, target, fullFrame, pixel) {
+	if (fullFrame) return `${scaleFilter}=w=${target.width}:h=${target.height},hwdownload,format=nv12,format=${pixel}`;
+	return `hwdownload,format=nv12,crop=${region.width}:${region.height}:${region.left}:${region.top},scale=${target.width}:${target.height},format=${pixel}`;
+}
+/**
+* Copy a single-plane packed frame (rgb24 / gray8 out of the filtergraph) into
+* a tightly-packed `Uint8Array` of `width*channels*height`, stripping libav's
+* row padding (`linesize` ≥ `width*channels`). Keeps the `toBuffer` output
+* contract byte-identical to the software `scaleRoiToBuffer`.
+*/
+function packSinglePlane(plane, linesize, width, height, channels) {
+	const rowBytes = width * channels;
+	const stride = linesize > 0 ? linesize : rowBytes;
+	const out = Buffer.allocUnsafe(rowBytes * height);
+	if (stride === rowBytes) plane.copy(out, 0, 0, rowBytes * height);
+	else for (let row = 0; row < height; row++) plane.copy(out, row * rowBytes, row * stride, row * stride + rowBytes);
+	return out;
+}
 /**
 * The forked child's whole runtime: decode-loop lifecycle, the latest-wins
 * frame slot, and the ROI scaler for `toBuffer`. One instance per process.
@@ -191,6 +266,53 @@ var DecodeWorkerChild = class {
 	nav = null;
 	consts = null;
 	hwContext = null;
+	/**
+	* Reused software scaler + the geometry/format key it was built for.
+	* Building a fresh `SoftwareScaleContext` on EVERY `toBuffer` (24fps)
+	* churned native libav memory unboundedly (a persistent worker grew to
+	* ~10GB/h). Detection uses a stable ROI + resize target, so the scaler is
+	* built once and reused, rebuilt only when the key changes — mirroring the
+	* shared decoder session (`nodeav-decoder-session.ts`, which reuses one
+	* `this.scaler` for the same reason). Disposed in `teardown`.
+	*/
+	scaler = null;
+	scalerKey = "";
+	/** libav GPU scale filter for the resolved hwaccel backend, or null when GPU filtering isn't available. */
+	gpuScaleFilter = null;
+	/**
+	* GPU crop+scale path decision — picked ONCE per session.
+	* - `software`: the decoder downloads every frame to YUV420P system memory and
+	*   `toBuffer` uses the CPU {@link scaler}. This is the original, leak-safe
+	*   behaviour; the default until a HW device + `scale_<be>` filter is found.
+	* - `undecided`: a HW device + GPU scale filter are available; the decoder
+	*   emits GPU surfaces and the FIRST HW frame is probed through the GPU
+	*   filtergraph — success ⇒ `hardware`, any failure ⇒ `software` (re-dial).
+	* - `hardware`: the decoder emits GPU surfaces and `toBuffer` runs the GPU
+	*   crop+scale, downloading only the tiny detection-sized result.
+	*/
+	hwFilterDecision = "software";
+	/** Skip the re-dial backoff when the re-dial is specifically to switch to software. */
+	redialAsSoftware = false;
+	/**
+	* Cached GPU crop+scale filtergraph + the geometry/format key it was built
+	* for — the HW analogue of {@link scaler}/{@link scalerKey}. Rebuilt (old
+	* CLOSED) only when the key changes. Its internal `scale_<be>` OUTPUT hw
+	* frames pool is the leak-prone VAAPI surface pool, so it is closed on EVERY
+	* re-dial ({@link closeInput}) and on teardown — this discipline is what stops
+	* the prior "keeping decoded frames on the GPU leaked the VAAPI surface pool
+	* on every re-dial" incident from recurring.
+	*/
+	hwFilter = null;
+	hwFilterKey = "";
+	/** Scrypted-style throughput counters (plain integers, no per-frame allocation). */
+	framesDecoded = 0;
+	/** Child-side skips only (HW-guard drops + probe/degrade frees); slot drops add {@link FrameSlot.droppedCount}. */
+	framesSkipped = 0;
+	/** Frames actually handed to the parent as a `frame` reply. */
+	framesDelivered = 0;
+	lastMetricsAt = 0;
+	lastDeliveredSnapshot = 0;
+	metricsTimer = null;
 	demuxer = null;
 	decoder = null;
 	abortController = null;
@@ -243,9 +365,17 @@ var DecodeWorkerChild = class {
 			clearTimeout(this.redialTimer);
 			this.redialTimer = null;
 		}
+		if (this.metricsTimer) {
+			clearInterval(this.metricsTimer);
+			this.metricsTimer = null;
+		}
+		if (this.started) this.logMetrics(true);
 		this.abortController?.abort();
-		this.closeInput();
 		this.frames.free();
+		this.closeInput();
+		this.scaler?.[Symbol.dispose]?.();
+		this.scaler = null;
+		this.scalerKey = "";
 		this.hwContext?.[Symbol.dispose]?.();
 		this.hwContext = null;
 		if (this.pendingPull) {
@@ -253,6 +383,17 @@ var DecodeWorkerChild = class {
 			this.send({ kind: "ended" });
 		}
 	}
+	/** Emit the compact throughput line (window `deliveredFps`); cheap, integer-only. */
+	logMetrics(final) {
+		const now = Date.now();
+		const windowMs = Math.max(1, now - this.lastMetricsAt);
+		const deliveredDelta = this.framesDelivered - this.lastDeliveredSnapshot;
+		const deliveredFps = Math.round(deliveredDelta / windowMs * 1e3 * 10) / 10;
+		const skipped = this.framesSkipped + this.frames.droppedCount;
+		process.stderr.write(`session-decode metrics {framesDecoded:${this.framesDecoded}, framesSkipped:${skipped}, deliveredFps:${deliveredFps}}${final ? " (final)" : ""}\n`);
+		this.lastMetricsAt = now;
+		this.lastDeliveredSnapshot = this.framesDelivered;
+	}
 	handleStart(source, opts) {
 		if (this.started) {
 			process.stderr.write("decode-worker-child: duplicate start ignored\n");
@@ -261,6 +402,9 @@ var DecodeWorkerChild = class {
 		this.started = true;
 		this.sessionFormat = opts.format ?? "rgb";
 		this.minIntervalMs = opts.fps && opts.fps > 0 ? 1e3 / opts.fps : 0;
+		this.lastMetricsAt = Date.now();
+		this.metricsTimer = setInterval(() => this.logMetrics(false), METRICS_INTERVAL_MS);
+		this.metricsTimer.unref?.();
 		this.runDecodeLoop(source.restreamUrl).catch((err) => {
 			this.sendError(`decode-worker-child: decode loop crashed — ${errMessage(err)}`);
 		});
@@ -272,7 +416,7 @@ var DecodeWorkerChild = class {
 		}
 		const reply = this.frames.pull();
 		if (reply) {
-			this.send(this.toFrameReply(reply));
+			this.deliverFrame(reply);
 			return;
 		}
 		this.pendingPull = true;
@@ -285,7 +429,7 @@ var DecodeWorkerChild = class {
 			return;
 		}
 		try {
-			const bytes = this.scaleRoiToBuffer(frame, opts);
+			const bytes = frame.isHwFrame() ? this.hwScaleToBuffer(frame, opts) : this.scaleRoiToBuffer(frame, opts);
 			this.send({
 				kind: "buffer",
 				frameId,
@@ -317,21 +461,29 @@ var DecodeWorkerChild = class {
 				this.closeInput();
 			}
 			if (this.stopped) break;
-			await this.sleep(REDIAL_MS);
+			const skipBackoff = this.redialAsSoftware;
+			this.redialAsSoftware = false;
+			if (!skipBackoff) await this.sleep(REDIAL_MS);
 		}
 	}
 	/**
-	* One dial: open the demuxer, pick the video stream, build a HW/SW decoder
-	* that downloads + normalises frames to YUV420P system memory (so the ROI
-	* scaler always reads plain software planes regardless of hwaccel), and
-	* pump `demuxer.packets → decoder.frames → consumeDecodedFrame` until the
+	* One dial: open the demuxer, pick the video stream, build a HW/SW decoder,
+	* and pump `demuxer.packets → decoder.frames → consumeDecodedFrame` until the
 	* stream ends, errors, or teardown aborts it.
 	*
-	* Copied from `nodeav-decoder-session.ts` `pullDialAndDecode` (lines
-	* ~916-996): same demuxer options, same `rescale.pixelFormat: YUV420P`
-	* download-always contract (keeping decoded frames on the GPU leaked the
-	* VAAPI surface pool on every re-dial — see that file's comment), same
-	* `exitOnError: false` bad-frame tolerance.
+	* Two decoder shapes, selected by {@link hwFilterDecision} (picked once per
+	* session):
+	* - HW path (`undecided`/`hardware`): NO `rescale` — the decoder keeps frames
+	*   as GPU surfaces so `toBuffer` can crop+scale them on the GPU and download
+	*   only the small detection-sized result.
+	* - Software path (`software`): `rescale.pixelFormat: YUV420P` forces a
+	*   full-res GPU→system download so the CPU ROI scaler reads plain planes.
+	*   This is the ORIGINAL contract — keeping decoded frames on the GPU leaked
+	*   the VAAPI surface pool on every re-dial (see `nodeav-decoder-session.ts`);
+	*   the HW path avoids that leak by closing its filtergraph + freeing every
+	*   surface on every re-dial/teardown (see {@link closeInput}/{@link teardown}).
+	*
+	* Same demuxer options + `exitOnError: false` bad-frame tolerance throughout.
 	*/
 	async dialAndDecode(nav, C, url) {
 		this.abortController = new AbortController();
@@ -346,9 +498,10 @@ var DecodeWorkerChild = class {
 		this.demuxer = demuxer;
 		const videoStream = demuxer.video();
 		if (!videoStream) throw new Error("decode-worker-child: pull input has no video stream");
+		const wantHwFrames = this.hwContext !== null && this.hwFilterDecision !== "software";
 		const decoder = await nav.Decoder.create(videoStream, {
 			...this.hwContext ? { hardware: this.hwContext } : {},
-			rescale: { pixelFormat: C.AV_PIX_FMT_YUV420P },
+			...wantHwFrames ? {} : { rescale: { pixelFormat: C.AV_PIX_FMT_YUV420P } },
 			exitOnError: false
 		});
 		if (this.stopped) {
@@ -360,24 +513,103 @@ var DecodeWorkerChild = class {
 			if (this.stopped) break;
 			if (!frame) continue;
 			this.consumeDecodedFrame(frame);
+			if (this.redialAsSoftware) break;
 		}
 	}
 	/**
-	* Publish a decoded frame into the latest-wins slot (mirrors Scrypted's
-	* `libav.py:32,50-53` single-slot queue) via `FrameSlot`, which handles
-	* drop-older, the `minIntervalMs` throttle, and resolving a pending `pull`.
+	* Route a decoded frame according to the session's {@link hwFilterDecision}.
+	* On the software path a frame is published straight to the latest-wins slot;
+	* on the HW path the FIRST GPU surface is probed through the GPU filtergraph
+	* to commit (or fall back) the path, then GPU surfaces are published for
+	* `toBuffer` to crop+scale on the GPU. Publishing itself (drop-older, the
+	* `minIntervalMs` throttle, resolving a pending `pull`) is `FrameSlot`'s job.
 	*/
 	consumeDecodedFrame(frame) {
-		if (frame.isHwFrame()) {
+		this.framesDecoded++;
+		if (this.hwFilterDecision === "software") {
+			if (frame.isHwFrame()) {
+				this.framesSkipped++;
+				frame.free();
+				return;
+			}
+			this.publishFrame(frame);
+			return;
+		}
+		if (!frame.isHwFrame()) {
+			this.framesSkipped++;
 			frame.free();
+			this.degradeToSoftware();
 			return;
 		}
+		if (this.hwFilterDecision === "undecided") {
+			if (!this.probeHwFilter(frame)) {
+				this.framesSkipped++;
+				frame.free();
+				this.degradeToSoftware();
+				return;
+			}
+			this.hwFilterDecision = "hardware";
+			process.stderr.write(`decode-worker-child: GPU crop+scale path active (${this.gpuScaleFilter})\n`);
+		}
+		this.publishFrame(frame);
+	}
+	/** Publish to the latest-wins slot; deliver immediately if a `pull` is pending. */
+	publishFrame(frame) {
 		const reply = this.frames.publish(frame, Date.now(), this.minIntervalMs);
 		if (reply) {
 			this.pendingPull = false;
-			this.send(this.toFrameReply(reply));
+			this.deliverFrame(reply);
+		}
+	}
+	/** Send a `frame` reply to the parent and count it toward `deliveredFps`. */
+	deliverFrame(reply) {
+		this.framesDelivered++;
+		this.send(this.toFrameReply(reply));
+	}
+	/**
+	* One-shot GPU-filter capability probe on the FIRST decoded HW frame: build a
+	* no-op `scale_<be>=iw:ih,hwdownload,format=nv12` graph and push the frame
+	* through it. A frame out ⇒ the driver supports GPU crop+scale for this
+	* session; any throw / empty output ⇒ fall back to software. The probe graph
+	* and its output frames are freed here regardless of outcome, so no surface
+	* leaks out of the probe. The input `frame` keeps its own ref (buffersrc only
+	* ref'd it) and is published by the caller on success.
+	*/
+	probeHwFilter(frame) {
+		const nav = this.nav;
+		const scaleFilter = this.gpuScaleFilter;
+		if (!nav || !scaleFilter || !this.hwContext) return false;
+		let filter = null;
+		try {
+			filter = nav.FilterAPI.create(`${scaleFilter}=w=iw:h=ih,hwdownload,format=nv12`, { hardware: this.hwContext });
+			const outputs = filter.processAllSync(frame);
+			const ok = outputs.length > 0;
+			for (const out of outputs) out.free();
+			return ok;
+		} catch (err) {
+			process.stderr.write(`decode-worker-child: GPU filter probe failed — using software decode: ${errMessage(err)}\n`);
+			return false;
+		} finally {
+			filter?.close();
 		}
 	}
+	/**
+	* Abandon the GPU filter path for the rest of the session: close the
+	* filtergraph (freeing its GPU surface pool), mark the decision `software`,
+	* and abort the current HW dial so the decode loop re-dials with a YUV420P
+	* rescale. Called from the probe path AND from a runtime `toBuffer` GPU-filter
+	* failure, so a surprising driver/format error never leaves the session
+	* silently producing no usable frames. Idempotent.
+	*/
+	degradeToSoftware() {
+		if (this.hwFilterDecision === "software") return;
+		this.hwFilterDecision = "software";
+		this.redialAsSoftware = true;
+		this.hwFilter?.close();
+		this.hwFilter = null;
+		this.hwFilterKey = "";
+		this.abortController?.abort();
+	}
 	toFrameReply(reply) {
 		return {
 			kind: "frame",
@@ -417,34 +649,114 @@ var DecodeWorkerChild = class {
 		const ySlice = yPlane.subarray(region.top * yStride + region.left);
 		const uSlice = uPlane.subarray(region.top / 2 * cStride + region.left / 2);
 		const vSlice = vPlane.subarray(region.top / 2 * cStride + region.left / 2);
+		const scaler = this.ensureScaler(nav, C, region.width, region.height, target.width, target.height, dstFmt);
+		const dstStride = target.width * channels;
+		const dstBuffer = Buffer.allocUnsafe(dstStride * target.height);
+		const scaledHeight = scaler.scaleSync([
+			ySlice,
+			uSlice,
+			vSlice
+		], [
+			yStride,
+			cStride,
+			cStride
+		], 0, region.height, [dstBuffer], [dstStride]);
+		if (scaledHeight < 0) throw new Error(`sws_scale failed: ${scaledHeight}`);
+		if (scaledHeight !== target.height) throw new Error(`scaler produced ${scaledHeight} of ${target.height} rows`);
+		return dstBuffer;
+	}
+	/**
+	* Build-once / reuse the {@link NavScaler} for a given src+dst geometry and
+	* dst format. Rebuilt (old disposed) only when the key changes — detection's
+	* ROI + resize target are stable, so this is a per-worker singleton in the
+	* steady state. Replaces the previous per-frame `new SoftwareScaleContext()`
+	* that leaked native libav memory at frame rate. Synchronous + single-thread
+	* (Node), so no epoch/race guard is needed (unlike the async shared session).
+	*/
+	ensureScaler(nav, C, srcW, srcH, dstW, dstH, dstFmt) {
+		const key = `${srcW}x${srcH}->${dstW}x${dstH}:${dstFmt}`;
+		const cached = this.scaler;
+		if (cached && key === this.scalerKey) return cached;
+		this.scaler?.[Symbol.dispose]?.();
+		this.scaler = null;
+		this.scalerKey = "";
 		const scaler = new nav.SoftwareScaleContext();
-		try {
-			scaler.getContext(region.width, region.height, C.AV_PIX_FMT_YUV420P, target.width, target.height, dstFmt, C.SWS_FAST_BILINEAR);
-			const initRet = scaler.initContext();
-			if (initRet < 0) throw new Error(`sws_init_context failed: ${initRet}`);
-			const dstStride = target.width * channels;
-			const dstBuffer = Buffer.allocUnsafe(dstStride * target.height);
-			const scaledHeight = scaler.scaleSync([
-				ySlice,
-				uSlice,
-				vSlice
-			], [
-				yStride,
-				cStride,
-				cStride
-			], 0, region.height, [dstBuffer], [dstStride]);
-			if (scaledHeight < 0) throw new Error(`sws_scale failed: ${scaledHeight}`);
-			if (scaledHeight !== target.height) throw new Error(`scaler produced ${scaledHeight} of ${target.height} rows`);
-			return dstBuffer;
-		} finally {
+		scaler.getContext(srcW, srcH, C.AV_PIX_FMT_YUV420P, dstW, dstH, dstFmt, C.SWS_FAST_BILINEAR);
+		const initRet = scaler.initContext();
+		if (initRet < 0) {
 			scaler[Symbol.dispose]?.();
+			throw new Error(`sws_init_context failed: ${initRet}`);
 		}
+		this.scaler = scaler;
+		this.scalerKey = key;
+		return scaler;
+	}
+	/**
+	* GPU crop+scale `toBuffer`: run the retained GPU surface through the cached
+	* GPU filtergraph (`scale_<be>→hwdownload→format` for the full-frame case),
+	* pulling ONLY the small detection-sized result into system memory, then pack
+	* it into the tightly-packed output buffer. On any GPU-filter failure,
+	* {@link degradeToSoftware} flips the whole session to the CPU path (via a
+	* re-dial) and this call rethrows so the pump drops just this one frame.
+	*
+	* Surface lifecycle: the input GPU surface is owned by {@link frames} (freed
+	* by the slot lifecycle) — `processAllSync` only ref's it. Every OUTPUT frame
+	* the filtergraph returns is freed here in the `finally`.
+	*/
+	hwScaleToBuffer(frame, opts) {
+		try {
+			const region = resolveCropRegion(frame.width, frame.height, opts?.crop);
+			const target = resolveResizeTarget(region.width, region.height, opts?.resize);
+			const format = opts?.format ?? this.sessionFormat;
+			const channels = format === "gray" ? 1 : 3;
+			const outputs = this.ensureHwFilter(region, target, frame.width, frame.height, format).processAllSync(frame);
+			const first = outputs[0];
+			if (!first) throw new Error("GPU filtergraph produced no frame");
+			try {
+				const plane = first.data?.[0];
+				if (!plane) throw new Error("GPU filtergraph frame missing packed plane data");
+				return packSinglePlane(plane, first.linesize[0] ?? 0, target.width, target.height, channels);
+			} finally {
+				for (const out of outputs) out.free();
+			}
+		} catch (err) {
+			this.degradeToSoftware();
+			throw err instanceof Error ? err : new Error(errMessage(err));
+		}
+	}
+	/**
+	* Build-once / reuse the GPU crop+scale {@link NavFilterApi} for a given crop
+	* region + resize target + pixel format — the HW analogue of
+	* {@link ensureScaler}. Rebuilt (old CLOSED, freeing its GPU surface pool)
+	* only when the key changes; detection's ROI + resize target are stable, so
+	* this is a per-worker singleton in the steady state.
+	*/
+	ensureHwFilter(region, target, srcW, srcH, format) {
+		const nav = this.nav;
+		const scaleFilter = this.gpuScaleFilter;
+		if (!nav || !scaleFilter || !this.hwContext) throw new Error("decode-worker-child: GPU filter requested without a HW context");
+		const fullFrame = isFullFrameRegion(region, srcW, srcH);
+		const pixel = pixelFilterName(format);
+		const key = `${region.left},${region.top},${region.width},${region.height}->${target.width}x${target.height}:${pixel}`;
+		const cached = this.hwFilter;
+		if (cached && key === this.hwFilterKey) return cached;
+		this.hwFilter?.close();
+		this.hwFilter = null;
+		this.hwFilterKey = "";
+		const description = buildGpuFilterDescription(scaleFilter, region, target, fullFrame, pixel);
+		const filter = nav.FilterAPI.create(description, { hardware: this.hwContext });
+		this.hwFilter = filter;
+		this.hwFilterKey = key;
+		return filter;
 	}
 	/**
 	* Resolve the HW context ONCE (reused across every re-dial, freed in
 	* `teardown`). Tries the platform's ordered candidate list; the first
 	* `HardwareContext.create` that succeeds wins; every failure falls through
-	* to software decode (`hardware` omitted from `Decoder.create`).
+	* to software decode (`hardware` omitted from `Decoder.create`). When a GPU
+	* device is found, the session becomes a GPU crop+scale CANDIDATE
+	* (`hwFilterDecision = 'undecided'`) only if a `scale_<be>` filter exists for
+	* that backend — otherwise it stays on the software path.
 	*/
 	async ensureHwContext(nav, C) {
 		for (const backend of candidateBackends()) {
@@ -456,6 +768,8 @@ var DecodeWorkerChild = class {
 				continue;
 			}
 			this.hwContext = hw;
+			this.gpuScaleFilter = gpuScaleFilterForBackend(backend);
+			this.hwFilterDecision = this.gpuScaleFilter !== null ? "undecided" : "software";
 			return;
 		}
 		process.stderr.write("decode-worker-child: no hwaccel backend available — using software decode\n");
@@ -469,8 +783,18 @@ var DecodeWorkerChild = class {
 			}, ms);
 		});
 	}
-	/** Dispose the CURRENT dial's demuxer + decoder (the HW context is reused across dials). */
+	/**
+	* Dispose the CURRENT dial's demuxer + decoder (the HW *device* context is
+	* reused across dials). The GPU filtergraph is closed FIRST: it references the
+	* decoder's per-dial `hw_frames_ctx` AND owns the `scale_<be>` OUTPUT surface
+	* pool, so freeing it before the decoder is what stops re-dials from
+	* accumulating VAAPI surfaces (the exact prior leak). It is rebuilt lazily on
+	* the next dial's first `toBuffer`.
+	*/
 	closeInput() {
+		this.hwFilter?.close();
+		this.hwFilter = null;
+		this.hwFilterKey = "";
 		this.decoder?.[Symbol.dispose]?.();
 		this.decoder = null;
 		this.demuxer?.[Symbol.dispose]?.();