@camstack/addon-pipeline 1.2.361 → 1.2.363

package/dist/stream-broker/index.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-DFGiI5lr.js");
-const require_node = require("../node-CdOP9ELN.js");
+const require_dist = require("../dist-CGOb--t-.js");
+const require_node = require("../node-UBMRK8SK.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
-const require_segment_demux_js = require("../segment-demux-js-Dr3e9r4m.js");
+const require_segment_demux_js = require("../segment-demux-js-PkDP-xQg.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_crypto = require("node:crypto");
@@ -565,6 +565,85 @@ var STREAM_BROKER_RETIRED_ROOT_KEYS = [
 	}
 ];
 //#endregion
+//#region src/stream-broker/live-viewers.ts
+/**
+* WebRTC consumer kinds that are a person (or a person's device) watching.
+* Every other kind (`recording`, `pipeline`, `snapshot`, `warmup`,
+* `derived-broker`, `rtsp-listen`, `unknown`) is the system holding the stream.
+*/
+var VIEWER_CONSUMER_KINDS = new Set([
+	"webrtc-browser",
+	"webrtc-mobile",
+	"webrtc-whep",
+	"alexa",
+	"homekit"
+]);
+function isViewerConsumerKind(kind) {
+	return VIEWER_CONSUMER_KINDS.has(kind);
+}
+/**
+* `User-Agent` prefixes our OWN processes put on their RTSP dials:
+* `recorder/<id>/…` (the writer), `decode/<id>/…` (the detection decode
+* worker), `camstack-…` (the RTSP client an agent's derived broker pulls this
+* restream with), `prebuffer` (the prebuffer hold).
+*/
+var INTERNAL_RESTREAM_AGENT_PREFIXES = [
+	"recorder",
+	"decode",
+	"camstack-",
+	"prebuffer"
+];
+var LOOPBACK_PREFIXES = [
+	"127.",
+	"::1",
+	"::ffff:127.",
+	"[::1]"
+];
+/** True when the peer is this host — the system's own ffmpeg children. */
+function isLoopbackAddr(remoteAddr) {
+	return LOOPBACK_PREFIXES.some((p) => remoteAddr.startsWith(p));
+}
+/**
+* An RTSP restream client from OUTSIDE: playing, and none of
+*  - a declared dial purpose (detection / recording / sentry),
+*  - the muted decoder-loopback path,
+*  - one of our own `User-Agent`s,
+*  - a process on this same host (snapshot, grid compositor, the HomeKit leg —
+*    ffmpeg children that dial the restream over loopback).
+*/
+function isExternalRestreamClient(facts) {
+	if (!facts.playing) return false;
+	if (facts.intent !== null) return false;
+	if (facts.muted) return false;
+	const ua = facts.userAgent;
+	if (ua !== null && INTERNAL_RESTREAM_AGENT_PREFIXES.some((p) => ua.startsWith(p))) return false;
+	if (isLoopbackAddr(facts.remoteAddr)) return false;
+	return true;
+}
+/** Sum several tallies into a new one (inputs are never mutated). */
+function mergeViewerCounts(parts) {
+	const out = /* @__PURE__ */ new Map();
+	for (const part of parts) for (const [deviceId, n] of part) if (n > 0) out.set(deviceId, (out.get(deviceId) ?? 0) + n);
+	return out;
+}
+//#endregion
+//#region src/stream-broker/rtsp/broker-device-id.ts
+/**
+* Parse the numeric deviceId out of a canonical brokerId
+* (`${deviceId}/${camStreamId}` or `${deviceId}/${profile}`). Returns
+* `undefined` for a malformed id — so every device-scoped log line on the RTSP
+* plane can carry `tags.deviceId` without risking a bogus tag value.
+*
+* Every log line about a device carries `tags: { deviceId }`, always the same
+* key and always the numeric id: a miss rate, a media gap or a routing fault is
+* always asked per-camera ("why is 617 worse than 615?"), and a line that omits
+* the tag cannot answer it.
+*/
+function deviceIdFromBrokerId$1(brokerId) {
+	const parsed = Number(brokerId.split("/")[0]);
+	return Number.isFinite(parsed) ? parsed : void 0;
+}
+//#endregion
 //#region src/shared/ffmpeg-decode-args.ts
 /** Default DRM render node used for the VA-API / QSV hardware decode path. */
 var DEFAULT_VAAPI_RENDER_DEVICE = "/dev/dri/renderD128";
@@ -2613,23 +2692,6 @@ var AnnexBDeframer = class {
 	}
 };
 //#endregion
-//#region src/stream-broker/rtsp/broker-device-id.ts
-/**
-* Parse the numeric deviceId out of a canonical brokerId
-* (`${deviceId}/${camStreamId}` or `${deviceId}/${profile}`). Returns
-* `undefined` for a malformed id — so every device-scoped log line on the RTSP
-* plane can carry `tags.deviceId` without risking a bogus tag value.
-*
-* Every log line about a device carries `tags: { deviceId }`, always the same
-* key and always the numeric id: a miss rate, a media gap or a routing fault is
-* always asked per-camera ("why is 617 worse than 615?"), and a line that omits
-* the tag cannot answer it.
-*/
-function deviceIdFromBrokerId$1(brokerId) {
-	const parsed = Number(brokerId.split("/")[0]);
-	return Number.isFinite(parsed) ? parsed : void 0;
-}
-//#endregion
 //#region src/stream-broker/rtsp/audio/g711-silence.ts
 var SILENCE_BYTE = {
 	/** µ-law digital zero. */
@@ -3601,6 +3663,18 @@ var RtspRestreamer = class {
 		return this.sessions.size;
 	}
 	/**
+	* RTSP clients from OUTSIDE that are playing right now — people with a player
+	* open on the restream, not our recorder, decoder or agents (see
+	* `live-viewers.ts`). Read straight off the live session map and each
+	* session's own `playing && !closed`, so a client that vanished without a
+	* TEARDOWN stops counting the moment its socket closes or errors.
+	*/
+	countExternalViewers() {
+		let n = 0;
+		for (const session of this.sessions.values()) if (isExternalRestreamClient(session.getViewerFacts())) n += 1;
+		return n;
+	}
+	/**
 	* Sessions that count as LIVE INTENT — everything except a sentry dial.
 	*
 	* The split exists so a Frigate-style puller can hold a session open for ever
@@ -4382,6 +4456,21 @@ var RtspSession = class {
 		return this.userAgent;
 	}
 	/**
+	* What the live-viewer count needs to classify this client (see
+	* `live-viewers.ts`). `playing` is `isPlaying()`, which is false once the
+	* socket closed or errored — so an abruptly dropped client stops counting at
+	* the same instant, before the restreamer's own `removeSession` reconcile.
+	*/
+	getViewerFacts() {
+		return {
+			playing: this.isPlaying(),
+			userAgent: this.userAgent,
+			remoteAddr: `${this.socket.remoteAddress ?? "unknown"}:${String(this.socket.remotePort ?? 0)}`,
+			muted: this.muted,
+			intent: this.declaration.intent
+		};
+	}
+	/**
 	* True only for a session that dialed the DETECTION path
 	* (`DETECTION_MUTED_PATH_SUFFIX`). Read by
 	* `RtspRestreamer.servePendingSessionsRtp` to exempt this session from the
@@ -4541,15 +4630,16 @@ var RtspSession = class {
 	*
 	* ## Why sharing the payload is safe, and what would make it unsafe
 	*
-	* The payload buffer handed here is ALREADY retained, by reference, in the
-	* broker's `rtpRing` for the life of a GOP (`captureRtpForPreBuffer` pushes
-	* the same object). A pending `socket.write` cannot outlive that, so the
-	* lifetime requirement this adds is strictly weaker than one the broker
-	* already meets. Its provenance is a private allocation per packet —
+	* The payload buffer handed here is a private allocation per packet —
 	* `Buffer.from(readBuffer.subarray(...))` in `rtsp-client.ts`'s `onData`, for
 	* video and audio alike — never a view of the reader's socket buffer, which
 	* advances on the next read. Nothing in the broker writes into a captured
 	* packet: every mutation in this path targets a freshly allocated buffer.
+	* (The broker's `rtpRing` keeps its OWN copy of a pooled packet —
+	* `detachFromPool`, so a ring entry never pins a shared pool slab — so the
+	* ring no longer vouches for THIS object's lifetime, and it does not need
+	* to: a pending write holds its own reference, and the rule below is about
+	* mutation, not retention.)
 	*
 	* The rule to keep: **`socket.write` forbids MUTATION before the write
 	* completes, not retention.** So the header, which IS built per call, must
@@ -11206,6 +11296,49 @@ var AudioCodecSession = class {
 	}
 };
 //#endregion
+//#region src/stream-broker/stream-broker/owned-buffer.ts
+/**
+* Buffers that enter a LONG-LIVED ring own their backing store.
+*
+* Node serves `Buffer.from(...)`, `Buffer.allocUnsafe(n)` and `Buffer.concat`
+* below `Buffer.poolSize >>> 1` (4 KiB) as views of shared 8 KiB pool slabs.
+* That is the right choice for the ingest path — a start code, a 4-byte
+* interleave header, a 1.3 KB RTP packet that is fanned out and forgotten
+* within a tick — and the wrong one for anything RETAINED: a 600-byte NAL kept
+* for 60 s in a clip ring pins its whole slab, and with it every short-lived
+* packet that happened to be allocated beside it. On the hub that held
+* 550–980 MB of ArrayBuffers for ~150–250 MB of payload, and the full GCs the
+* pinned slabs caused ran every 0.2–0.5 s at 40–65 % of a core.
+*
+* The ring byte caps counted payload bytes, so they never saw it. Both rings
+* now pass every entry through {@link detachFromPool} on the way in and
+* account it with {@link backingStoreBytes}, so the cap measures what the
+* entry costs. Short-lived traffic stays pooled.
+*/
+/** True when `buf` is the whole of its ArrayBuffer — nothing else shares it. */
+function ownsBackingStore(buf) {
+	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length;
+}
+/**
+* What retaining `buf` really costs: its own length when it owns its
+* ArrayBuffer, the whole shared slab when it is a view of one.
+*/
+function backingStoreBytes(buf) {
+	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
+}
+/**
+* `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
+* buffer, never by its size: whether a large `allocUnsafe` is pooled is a Node
+* runtime detail), else a copy that does. One copy, never two: a buffer that is
+* already unpooled is returned as-is.
+*/
+function detachFromPool(buf) {
+	if (ownsBackingStore(buf)) return buf;
+	const owned = Buffer.allocUnsafeSlow(buf.length);
+	buf.copy(owned);
+	return owned;
+}
+//#endregion
 //#region src/stream-broker/stream-broker/encoded-ring-buffer.ts
 /**
 * Time-based ring buffer for encoded video packets.
@@ -11216,6 +11349,12 @@ var AudioCodecSession = class {
 *
 * The buffer always starts from the most recent keyframe to ensure
 * consumers can decode the returned data.
+*
+* Every entry OWNS its backing store (`owned-buffer.ts`): a sub-stream NAL
+* arrives as a view of a shared 8 KiB pool slab, and a ring that kept it for
+* 60 s pinned the slab and every short-lived packet beside it — the clip
+* rings of ~70 brokers were the largest holder of the hub broker's
+* 550–980 MB of ArrayBuffers. The byte budget charges what an entry pins.
 */
 var EncodedRingBuffer = class {
 	packets = [];
@@ -11247,13 +11386,25 @@ var EncodedRingBuffer = class {
 	getDuration() {
 		return this.maxDurationMs / 1e3;
 	}
-	/** Push a new packet into the buffer and evict expired ones. */
+	/**
+	* Push a new packet into the buffer and evict expired ones.
+	*
+	* A pooled payload is copied into its own allocation on the way in; one
+	* that already owns its ArrayBuffer is stored as-is. The consumers fanned
+	* out from the same packet keep the original, so the copy is the ring's
+	* alone and is freed with it.
+	*/
 	push(packet) {
-		this.packets.push(packet);
-		this.bytes += packet.data.length;
+		const data = detachFromPool(packet.data);
+		const stored = data === packet.data ? packet : {
+			...packet,
+			data
+		};
+		this.packets.push(stored);
+		this.bytes += backingStoreBytes(data);
 		this.evict();
 	}
-	/** What the retained window currently costs, in bytes. */
+	/** What the retained window currently costs, in bytes of backing store. */
 	getBufferedBytes() {
 		return this.bytes;
 	}
@@ -11331,14 +11482,14 @@ var EncodedRingBuffer = class {
 		let removeCount = 0;
 		while (removeCount < this.packets.length && (this.packets[removeCount].pts < cutoff || this.packets[removeCount].pts > newest)) removeCount++;
 		if (removeCount > 0) {
-			for (let i = 0; i < removeCount; i++) this.bytes -= this.packets[i].data.length;
+			for (let i = 0; i < removeCount; i++) this.bytes -= backingStoreBytes(this.packets[i].data);
 			this.packets.splice(0, removeCount);
 		}
 		if (this.maxBytes > 0 && this.bytes > this.maxBytes) {
 			this.clampedByBytes = true;
 			let dropped = 0;
 			while (dropped < this.packets.length && this.bytes > this.maxBytes) {
-				this.bytes -= this.packets[dropped].data.length;
+				this.bytes -= backingStoreBytes(this.packets[dropped].data);
 				dropped++;
 			}
 			if (dropped > 0) this.packets.splice(0, dropped);
@@ -13774,8 +13925,9 @@ var StreamBroker = class StreamBroker {
 	captureRtpForPreBuffer(rtpData) {
 		const marker = rtpData.length > 1 && (rtpData[1] & 128) !== 0;
 		if (this.rtpRingPrevMarker || this.rtpRing.length === 0) this.rtpRingCurAuStart = this.rtpRing.length;
-		this.rtpRing.push(rtpData);
-		this.rtpRingBytes += rtpData.length;
+		const owned = detachFromPool(rtpData);
+		this.rtpRing.push(owned);
+		this.rtpRingBytes += backingStoreBytes(owned);
 		if (this._lastNalParamSet || this._lastNalKeyframe) {
 			const auStart = this.rtpRingCurAuStart;
 			const lastMark = this.rtpRingKeyframeMarks[this.rtpRingKeyframeMarks.length - 1];
@@ -13953,18 +14105,18 @@ var StreamBroker = class StreamBroker {
 			this.reportPreRollClamp(budget, retentionMs);
 			const historyEnd = this.rtpRingKeyframeMarks[this.rtpRingKeyframeMarks.length - 1].index;
 			let retained = 0;
-			for (let i = cut; i < historyEnd; i++) retained += this.rtpRing[i].length;
+			for (let i = cut; i < historyEnd; i++) retained += backingStoreBytes(this.rtpRing[i]);
 			let markIdx = this.rtpRingKeyframeMarks.findIndex((m) => m.index === cut);
 			while (retained > budget.bytes && markIdx >= 0 && markIdx < this.rtpRingKeyframeMarks.length - 1) {
 				const nextCut = this.rtpRingKeyframeMarks[markIdx + 1].index;
-				for (let i = cut; i < nextCut; i++) retained -= this.rtpRing[i].length;
+				for (let i = cut; i < nextCut; i++) retained -= backingStoreBytes(this.rtpRing[i]);
 				cut = nextCut;
 				markIdx++;
 			}
 		}
 		if (cut <= 0) return;
 		const dropped = this.rtpRing.splice(0, cut);
-		for (const b of dropped) this.rtpRingBytes -= b.length;
+		for (const b of dropped) this.rtpRingBytes -= backingStoreBytes(b);
 		this.rtpRingKeyframeMarks = this.rtpRingKeyframeMarks.filter((mark) => mark.index >= cut).map((mark) => ({
 			index: mark.index - cut,
 			ts: mark.ts
@@ -14255,6 +14407,13 @@ var StreamBroker = class StreamBroker {
 	getLocalStreamUrl() {
 		return this.pipeServer.getUrl();
 	}
+	/**
+	* External RTSP restream clients playing on this broker right now — the
+	* restream half of the per-camera live-viewer count (`live-viewers.ts`).
+	*/
+	countExternalRestreamViewers() {
+		return this.rtspRestreamer.countExternalViewers();
+	}
 	/** Get the RTSP restreamer instance (for RtspListenServer registration) */
 	getRtspRestreamer() {
 		return this.rtspRestreamer;
@@ -14297,11 +14456,15 @@ var StreamBroker = class StreamBroker {
 		if (clamped === this.clipRetentionSec) return;
 		const previous = this.clipRetentionSec;
 		this.clipRetentionSec = clamped;
-		this.logger?.info(clamped === 0 ? "Clip retention off" : "Clip retention set", { meta: {
-			seconds: clamped,
-			requested: seconds,
-			previousSeconds: previous
-		} });
+		this.logger?.info(clamped === 0 ? "Clip retention off" : "Clip retention set", {
+			tags: { deviceId: this.numericDeviceId },
+			meta: {
+				seconds: clamped,
+				requested: seconds,
+				previousSeconds: previous,
+				capBytes: StreamBroker.CLIP_RING_MAX_BYTES
+			}
+		});
 		if (clamped === 0) {
 			this.clipBuffer = null;
 			return;
@@ -18875,6 +19038,25 @@ var StreamBrokerManager = class StreamBrokerManager {
 		};
 		return broker.listClients();
 	}
+	/**
+	* People watching each camera live right now (cap `getLiveViewerCounts`).
+	* Two planes, one definition (`live-viewers.ts`): the WebRTC server's live
+	* viewer sessions plus every broker's external RTSP restream clients, summed
+	* per camera over all of its profile brokers. Both are read off live session
+	* maps — no stored counter — so an ended session cannot be left counted.
+	*/
+	async getLiveViewerCounts() {
+		const rtsp = /* @__PURE__ */ new Map();
+		for (const [brokerId, broker] of this.brokers) {
+			const n = broker.countExternalRestreamViewers();
+			const deviceId = deviceIdFromBrokerId$1(brokerId);
+			if (n > 0 && deviceId !== void 0) rtsp.set(deviceId, (rtsp.get(deviceId) ?? 0) + n);
+		}
+		return [...mergeViewerCounts([this.webrtcServer?.countLiveViewers() ?? /* @__PURE__ */ new Map(), rtsp])].map(([deviceId, viewers]) => ({
+			deviceId,
+			viewers
+		})).sort((a, b) => a.deviceId - b.deviceId);
+	}
 	async killClient(input) {
 		const broker = this.brokers.get(input.brokerId);
 		if (!broker) return { killed: false };
@@ -34733,6 +34915,7 @@ var BrokerWebrtcServer = class {
 		});
 		const entry = {
 			session,
+			consumerKind: baseAttribution.kind,
 			brokerId,
 			unsubBroker,
 			unsubRtp,
@@ -35159,6 +35342,29 @@ var BrokerWebrtcServer = class {
 	getSessionCount() {
 		return this.sessions.size;
 	}
+	/**
+	* People watching LIVE through this server, per camera (`live-viewers.ts`):
+	* sessions of a viewer kind whose track is on the live edge. A session on a
+	* recorded playhead is not watching live; the system's own subscriptions
+	* (warm-up, linger ghost, egress-transcode legs) are never a SESSION here, so
+	* they cannot count.
+	*
+	* Derived from `this.sessions` at call time, the map `cleanupSession`
+	* maintains for every teardown path (explicit close, ICE failure, the peer
+	* vanishing — all end in `session.onClosed`), so there is no second counter
+	* that could leak.
+	*/
+	countLiveViewers() {
+		const counts = /* @__PURE__ */ new Map();
+		for (const entry of this.sessions.values()) {
+			if (!isViewerConsumerKind(entry.consumerKind)) continue;
+			if ((entry.timeline?.currentMode ?? "live") !== "live") continue;
+			const deviceId = deviceIdFromBrokerId(entry.brokerId);
+			if (deviceId === void 0) continue;
+			counts.set(deviceId, (counts.get(deviceId) ?? 0) + 1);
+		}
+		return counts;
+	}
 	/** Live signaling state for a session — used by the webrtc-session
 	*  provider's getSessionState. Returns a null pending when unknown. */
 	getSessionRenegotiationState(sessionId) {