@camstack/addon-pipeline 1.2.363 → 1.2.365

package/dist/stream-broker/index.js

@@ -3,12 +3,12 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-CGOb--t-.js");
-const require_node = require("../node-UBMRK8SK.js");
+const require_dist = require("../dist-i4kS_3O7.js");
+const require_node = require("../node-TzgGsCvW.js");
 const require_restream_intent = require("../restream-intent-7uDNqMKs.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
-const require_segment_demux_js = require("../segment-demux-js-PkDP-xQg.js");
+const require_segment_demux_js = require("../segment-demux-js-C9AYdKkD.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 let node_crypto = require("node:crypto");
@@ -3085,6 +3085,68 @@ var RtpPacketizer = class {
 	}
 };
 //#endregion
+//#region src/stream-broker/stream-broker/owned-buffer.ts
+/**
+* Buffers that enter a LONG-LIVED ring own their backing store.
+*
+* Node serves `Buffer.from(...)`, `Buffer.allocUnsafe(n)` and `Buffer.concat`
+* below `Buffer.poolSize >>> 1` (4 KiB) as views of shared 8 KiB pool slabs.
+* That is the right choice for the ingest path — a start code, a 4-byte
+* interleave header, a 1.3 KB RTP packet that is fanned out and forgotten
+* within a tick — and the wrong one for anything RETAINED: a 600-byte NAL kept
+* for 60 s in a clip ring pins its whole slab, and with it every short-lived
+* packet that happened to be allocated beside it. On the hub that held
+* 550–980 MB of ArrayBuffers for ~150–250 MB of payload, and the full GCs the
+* pinned slabs caused ran every 0.2–0.5 s at 40–65 % of a core.
+*
+* The ring byte caps counted payload bytes, so they never saw it. Both rings
+* now pass every entry through {@link detachFromPool} on the way in and
+* account it with {@link backingStoreBytes}, so the cap measures what the
+* entry costs. Short-lived traffic stays pooled.
+*/
+/** True when `buf` is the whole of its ArrayBuffer — nothing else shares it. */
+function ownsBackingStore(buf) {
+	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length;
+}
+/**
+* What retaining `buf` really costs: its own length when it owns its
+* ArrayBuffer, the whole shared slab when it is a view of one.
+*/
+function backingStoreBytes(buf) {
+	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
+}
+/**
+* `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
+* buffer, never by its size: whether a large `allocUnsafe` is pooled is a Node
+* runtime detail), else a copy that does. One copy, never two: a buffer that is
+* already unpooled is returned as-is.
+*/
+function detachFromPool(buf) {
+	if (ownsBackingStore(buf)) return buf;
+	const owned = Buffer.allocUnsafeSlow(buf.length);
+	buf.copy(owned);
+	return owned;
+}
+/**
+* A copy of `src[start, end)` that OWNS its backing store — the shape a reader
+* hands out when the packet it cuts from its socket buffer is going to be
+* retained anyway.
+*
+* Every source video packet is: `captureRtpForPreBuffer` keeps it for the life
+* of a GOP, and the restreamer's keyframe cache keeps the keyframe ones. With
+* the readers cutting packets as `Buffer.from(subarray)` — a pooled view — the
+* ring then had to copy each one a second time to own it: two copies of every
+* packet on the ingest path (measured 15.1 + 14.8 MB/s on the hub's load).
+* Cutting the packet owned up front makes the ring's and the cache's
+* `detachFromPool` an identity, so the packet is copied once and shared by the
+* reader's fan-out, the ring, the cache and every session's write queue.
+*/
+function copyOwned(src, start, end) {
+	const owned = Buffer.allocUnsafeSlow(end - start);
+	src.copy(owned, 0, start, end);
+	return owned;
+}
+//#endregion
 //#region src/stream-broker/rtsp/sdp-builder.ts
 function buildSdp(options) {
 	const { codec, parameterSets, streamName } = options;
@@ -3731,7 +3793,12 @@ var RtspRestreamer = class {
 	* Forwarded directly to all connected RTSP sessions — zero re-packetization.
 	*
 	* @param rtpData Complete RTP packet (header + payload)
-	* @param isKeyframe True if this packet is part of a keyframe access unit
+	* @param isKeyframe True if this packet is part of a keyframe ACCESS UNIT —
+	*   judged per picture by the broker's `RtpAccessUnitTracker`: every
+	*   fragment of a fragmented IDR and a prefix SEI inside the picture carry
+	*   it, not only the packet that completed an IRAP NAL. The keyframe cache
+	*   below collects exactly that run, and the transition into it is the
+	*   once-per-picture `keyframeAuStart` the sessions resume and count on.
 	* @param isParameterSet True if this packet contains SPS/PPS/VPS
 	*/
 	pushRtpPassthrough(rtpData, isKeyframe, isParameterSet) {
@@ -3747,14 +3814,14 @@ var RtspRestreamer = class {
 				this.lastKeyframeRtpBytes = 0;
 			}
 		}
+		if (this.collectingKeyframeRtp && !isKeyframe && !isParameterSet) this.collectingKeyframeRtp = false;
 		if (this.collectingKeyframeRtp) {
 			this.lastKeyframeRtpPackets.push({
-				data: Buffer.from(rtpData),
+				data: detachFromPool(rtpData),
 				marker: rtpPacket.marker
 			});
 			this.lastKeyframeRtpBytes += rtpData.length;
-			if (!isKeyframe && !isParameterSet) this.collectingKeyframeRtp = false;
-			else if (this.lastKeyframeRtpBytes > MAX_KEYFRAME_CACHE_BYTES) {
+			if (this.lastKeyframeRtpBytes > MAX_KEYFRAME_CACHE_BYTES) {
 				this.warnCacheCapExceeded("rtp", this.lastKeyframeRtpBytes, this.lastKeyframeRtpPackets.length);
 				this.lastKeyframeRtpPackets = [];
 				this.lastKeyframeRtpBytes = 0;
@@ -3767,17 +3834,16 @@ var RtspRestreamer = class {
 			if (!session.isPlaying()) continue;
 			this.pendingKeyframe.delete(session.getSessionId());
 		}
-		const keyframeAu = isKeyframe || isParameterSet;
 		for (const session of this.sessions.values()) {
 			const sessionId = session.getSessionId();
 			if (this.activeReplays.get(sessionId)?.enqueue({
 				packet: rtpPacket,
 				prime: false,
-				keyframeAuStart: keyframeAu
+				keyframeAuStart
 			})) continue;
 			if (this.pendingKeyframe.has(sessionId)) continue;
 			if (!session.isPlaying()) continue;
-			this.recordLiveOutcome(session.sendRtp(rtpPacket, false, keyframeAu));
+			this.recordLiveOutcome(session.sendRtp(rtpPacket, false, keyframeAuStart));
 		}
 	}
 	/**
@@ -4353,6 +4419,19 @@ var RtspSession = class {
 	lastRtpAt = 0;
 	/** Total video RTP bytes written to the socket. */
 	bytesSent = 0;
+	/**
+	* The socket is corked for the access unit in progress — see
+	* {@link writeInterleaved}. Cleared by the packet that ends the picture (RTP
+	* marker, or any audio packet) or by the next-tick safety net, whichever
+	* comes first.
+	*/
+	accessUnitCorked = false;
+	/** Flush the access unit in progress. Idempotent: the marker and the safety net both call it. */
+	uncorkAccessUnit = () => {
+		if (!this.accessUnitCorked) return;
+		this.accessUnitCorked = false;
+		this.socket.uncork();
+	};
 	/** Client `User-Agent` (from the first request that carries one). Lets the
 	*  broker panel identify a consumer by purpose — e.g. the recorder sets
 	*  `-user_agent recorder` on its RTSP pull — instead of a bare address. */
@@ -4600,7 +4679,7 @@ var RtspSession = class {
 				return "dropped-backlog";
 			}
 		}
-		this.writeInterleaved(this.tracks[0].rtpChannel, packet.data);
+		this.writeInterleaved(this.tracks[0].rtpChannel, packet.data, packet.marker);
 		this.missedKeyframes = 0;
 		return "written";
 	}
@@ -4609,7 +4688,7 @@ var RtspSession = class {
 		if (!this.playing || this.closed || this.muted) return "not-playing";
 		if (this.tracks.length < 2) return "not-playing";
 		if (this.socket.writableLength > 2097152) return "dropped-backlog";
-		this.writeInterleaved(this.tracks[1].rtpChannel, packet.data);
+		this.writeInterleaved(this.tracks[1].rtpChannel, packet.data, true);
 		return "written";
 	}
 	/**
@@ -4631,14 +4710,13 @@ var RtspSession = class {
 	* ## Why sharing the payload is safe, and what would make it unsafe
 	*
 	* The payload buffer handed here is a private allocation per packet —
-	* `Buffer.from(readBuffer.subarray(...))` in `rtsp-client.ts`'s `onData`, for
-	* video and audio alike — never a view of the reader's socket buffer, which
-	* advances on the next read. Nothing in the broker writes into a captured
-	* packet: every mutation in this path targets a freshly allocated buffer.
-	* (The broker's `rtpRing` keeps its OWN copy of a pooled packet —
-	* `detachFromPool`, so a ring entry never pins a shared pool slab — so the
-	* ring no longer vouches for THIS object's lifetime, and it does not need
-	* to: a pending write holds its own reference, and the rule below is about
+	* `copyOwned(readBuffer, …)` in the readers' `onData`, for video and audio
+	* alike — never a view of the reader's socket buffer, which advances on the
+	* next read. Nothing in the broker writes into a captured packet: every
+	* mutation in this path targets a freshly allocated buffer. (The same object
+	* is what the broker's `rtpRing` and the restreamer's keyframe cache retain —
+	* it owns its backing store, so `detachFromPool` keeps it as is — and that is
+	* fine: a pending write holds its own reference, and the rule below is about
 	* mutation, not retention.)
 	*
 	* The rule to keep: **`socket.write` forbids MUTATION before the write
@@ -4648,18 +4726,36 @@ var RtspSession = class {
 	* queued. Four bytes from the Buffer pool is a pointer bump; the copy this
 	* replaces was ~1.4 KB.
 	*
-	* `cork`/`uncork` keeps the pair a single `writev` syscall, so removing the
-	* copy does not buy an extra write syscall per packet.
+	* ## One cork per ACCESS UNIT, not per packet
+	*
+	* The pair used to be corked and uncorked on its own: one `writev` per RTP
+	* packet per session, so a 4K keyframe fragmented into a hundred packets and
+	* fanned out to three sessions was three hundred syscalls for one picture no
+	* decoder can use before it is whole. The socket is corked on the first write
+	* of an access unit and uncorked by the packet that ENDS it
+	* (`endOfAccessUnit`: the RTP marker on video, every audio packet), so the
+	* picture leaves in one `writev`. A `process.nextTick` safety net uncorks
+	* whatever is still open before the tick yields to I/O — a marker-less camera
+	* or a lost marker degrades to one `writev` per tick, never to a socket held
+	* corked across a read.
+	*
+	* Backpressure sees through the cork: `writableLength` counts corked bytes,
+	* so the `MAX_WRITE_BUFFER` gate, the latch and the missed-keyframe close
+	* (D447) judge exactly what they judged per packet.
 	*/
-	writeInterleaved(channel, payload) {
+	writeInterleaved(channel, payload, endOfAccessUnit) {
 		const header = Buffer.allocUnsafe(4);
 		header[0] = 36;
 		header[1] = channel;
 		header.writeUInt16BE(payload.length, 2);
-		this.socket.cork();
+		if (!this.accessUnitCorked) {
+			this.accessUnitCorked = true;
+			this.socket.cork();
+			process.nextTick(this.uncorkAccessUnit);
+		}
 		this.socket.write(header);
 		this.socket.write(payload);
-		this.socket.uncork();
+		if (endOfAccessUnit) this.uncorkAccessUnit();
 		this.lastRtpAt = Date.now();
 		this.bytesSent += 4 + payload.length;
 	}
@@ -10083,7 +10179,7 @@ var Rfc4571Reader = class {
 		while (this.readBuffer.length >= 2) {
 			const length = this.readBuffer.readUInt16BE(0);
 			if (this.readBuffer.length < 2 + length) return;
-			const rtpPacket = Buffer.from(this.readBuffer.subarray(2, 2 + length));
+			const rtpPacket = copyOwned(this.readBuffer, 2, 2 + length);
 			this.readBuffer = this.readBuffer.subarray(2 + length);
 			this.dispatchRtp(rtpPacket);
 		}
@@ -10128,12 +10224,109 @@ function allocAnnexBNal(byteLength) {
 	buf[3] = 1;
 	return buf;
 }
+var NO_PAYLOAD_CLASS = {
+	keyframe: false,
+	parameterSet: false
+};
+function isH265IrapType(type) {
+	return type >= H265_NAL_IRAP_MIN && type <= H265_NAL_IRAP_MAX;
+}
+function isH265ParameterSetType(type) {
+	return type === H265_NAL_VPS || type === H265_NAL_SPS || type === H265_NAL_PPS;
+}
 /** Total byte length of the reassembly fragments, without allocating a closure. */
 function totalFragmentBytes(fragments) {
 	let total = 0;
 	for (const fragment of fragments) total += fragment.length;
 	return total;
 }
+/** H.264: single NAL by its type; STAP-A by every aggregated type; FU-A by the FU header. */
+function classifyH264Payload(payload) {
+	const nalType = payload[0] & 31;
+	if (nalType === H264_NAL_STAP_A) {
+		let keyframe = false;
+		let parameterSet = false;
+		let offset = 1;
+		while (offset + 2 <= payload.length) {
+			const nalSize = payload.readUInt16BE(offset);
+			offset += 2;
+			if (nalSize === 0 || offset + nalSize > payload.length) break;
+			const type = payload[offset] & 31;
+			keyframe ||= type === H264_NAL_IDR;
+			parameterSet ||= type === H264_NAL_SPS || type === H264_NAL_PPS;
+			offset += nalSize;
+		}
+		return {
+			keyframe,
+			parameterSet
+		};
+	}
+	if (nalType === 28) {
+		if (payload.length < 2) return NO_PAYLOAD_CLASS;
+		return {
+			keyframe: (payload[1] & 31) === H264_NAL_IDR,
+			parameterSet: false
+		};
+	}
+	return {
+		keyframe: nalType === H264_NAL_IDR,
+		parameterSet: nalType === H264_NAL_SPS || nalType === H264_NAL_PPS
+	};
+}
+/** H.265: single NAL by its type; AP by every aggregated type; FU by the FU header. */
+function classifyH265Payload(payload) {
+	if (payload.length < 2) return NO_PAYLOAD_CLASS;
+	const nalType = payload[0] >> 1 & 63;
+	if (nalType === H265_NAL_AP) {
+		let keyframe = false;
+		let parameterSet = false;
+		let offset = 2;
+		while (offset + 2 <= payload.length) {
+			const nalSize = payload.readUInt16BE(offset);
+			offset += 2;
+			if (nalSize === 0 || offset + nalSize > payload.length) break;
+			const type = payload[offset] >> 1 & 63;
+			keyframe ||= isH265IrapType(type);
+			parameterSet ||= isH265ParameterSetType(type);
+			offset += nalSize;
+		}
+		return {
+			keyframe,
+			parameterSet
+		};
+	}
+	if (nalType === 49) {
+		if (payload.length < 3) return NO_PAYLOAD_CLASS;
+		return {
+			keyframe: isH265IrapType(payload[2] & 63),
+			parameterSet: false
+		};
+	}
+	return {
+		keyframe: isH265IrapType(nalType),
+		parameterSet: isH265ParameterSetType(nalType)
+	};
+}
+/**
+* Classify one raw RTP packet (12-byte header + payload) by what it carries —
+* the per-packet half of {@link RtpDepacketizer.processPacket}, without the
+* reassembly half. Pure: reads the headers, allocates nothing, keeps no state.
+* `null` for a packet too short to be RTP with a payload.
+*/
+function classifyRtpPacket(codec, rtpData) {
+	if (rtpData.length < 12) return null;
+	const marker = (rtpData[1] & 128) !== 0;
+	const timestamp = rtpData.readUInt32BE(4);
+	const payload = rtpData.subarray(12);
+	if (payload.length === 0) return null;
+	const carried = codec === "h264" ? classifyH264Payload(payload) : classifyH265Payload(payload);
+	return {
+		timestamp,
+		marker,
+		keyframe: carried.keyframe,
+		parameterSet: carried.parameterSet
+	};
+}
 /**
 * RTP → Annex-B NAL depacketizer.
 *
@@ -10173,16 +10366,27 @@ var RtpDepacketizer = class {
 	}
 	/**
 	* Process a raw RTP packet (including 12-byte RTP header).
-	* Emits zero or more complete NAL units via the callback.
+	* Emits zero or more complete NAL units via the callback and returns what
+	* THIS packet carried ({@link RtpPacketClass}) — `null` for a packet too
+	* short to be RTP with a payload.
 	*/
 	processPacket(rtpData) {
-		if (rtpData.length < 12) return;
-		const marker = (rtpData[1] & 128) !== 0;
-		const timestamp = rtpData.readUInt32BE(4);
+		const carried = this.classifyPacket(rtpData);
+		if (carried === null) return null;
 		const payload = rtpData.subarray(12);
-		if (payload.length === 0) return;
-		if (this.codec === "h264") this.processH264(payload, timestamp, marker);
-		else this.processH265(payload, timestamp, marker);
+		if (this.codec === "h264") this.processH264(payload, carried.timestamp, carried.marker);
+		else this.processH265(payload, carried.timestamp, carried.marker);
+		return carried;
+	}
+	/**
+	* What this packet CARRIES, and nothing else: no NAL is reassembled, no buffer
+	* allocated, no reassembly state touched. The same verdict `processPacket`
+	* returns, for a broker whose Annex-B plane has no consumer — the source-RTP
+	* ring, the restreamer's keyframe cache and the stats need exactly this and
+	* none of the copies.
+	*/
+	classifyPacket(rtpData) {
+		return classifyRtpPacket(this.codec, rtpData);
 	}
 	processH264(payload, timestamp, marker) {
 		const nalType = payload[0] & 31;
@@ -10328,6 +10532,140 @@ var RtpDepacketizer = class {
 	}
 };
 //#endregion
+//#region src/stream-broker/rtsp/rtp-access-unit-tracker.ts
+/**
+* Tracks access-unit membership across the source RTP packets of ONE stream.
+*
+* The RTSP restreamer forwards source RTP untouched and must know, per
+* packet, whether it is part of a keyframe picture: that is what its keyframe
+* cache collects and what a backlog-latched session resumes on. The
+* depacketizer can only say so about a NAL that COMPLETED, so the fragments of
+* a fragmented IDR before the last one, and a prefix SEI between the parameter
+* sets and the slice, were reported as plain packets: the cache latch closed
+* on them and re-opened on the final fragment, and a backlogged session
+* counted every IRAP slice as a missed keyframe. Here a packet is classified
+* by what it carries ({@link RtpPacketClass}) and the verdict is carried
+* across the whole picture, bounded by the RTP timestamp and marker bit.
+*
+* A parameter-set-only run is not a picture: a camera that stamps SPS/PPS
+* with the previous timestamp still announces ONE keyframe, so the keyframe
+* verdict carries over into the slice that follows instead of starting twice.
+*/
+var RtpAccessUnitTracker = class {
+	timestamp = -1;
+	previousMarker = true;
+	keyframeAu = false;
+	/** The picture in progress has received something other than a parameter set. */
+	pictureSeen = false;
+	classify(packet) {
+		const auStart = this.previousMarker || packet.timestamp !== this.timestamp;
+		if (auStart && this.pictureSeen) this.keyframeAu = false;
+		if (auStart) this.pictureSeen = false;
+		this.timestamp = packet.timestamp;
+		this.previousMarker = packet.marker;
+		const keyframeContent = packet.keyframe || packet.parameterSet;
+		const keyframeAuStart = keyframeContent && !this.keyframeAu;
+		if (keyframeContent) this.keyframeAu = true;
+		const pictureStart = !packet.parameterSet && !this.pictureSeen;
+		if (!packet.parameterSet) this.pictureSeen = true;
+		return {
+			auStart,
+			keyframeAu: this.keyframeAu,
+			keyframeAuStart,
+			pictureStart,
+			parameterSet: packet.parameterSet
+		};
+	}
+	/** A redial re-bases the clock; nothing carries over. */
+	reset() {
+		this.timestamp = -1;
+		this.previousMarker = true;
+		this.keyframeAu = false;
+		this.pictureSeen = false;
+	}
+};
+//#endregion
+//#region src/stream-broker/stream-broker/access-unit-assembler.ts
+/**
+* Groups depacketized NALs into ACCESS UNITS — one per picture.
+*
+* The broker's `EncodedPacket` is one access unit, and every consumer judges it
+* that way: `keyframe` gates where a clip ring widens to, where a late joiner
+* can start, how the pre-roll window is cut; the stats count it as one picture
+* and time the GOP from one `keyframe` to the next. A multi-slice camera (a
+* Hikvision G2 main stream is 3 slices per picture) used to hand each slice —
+* and each prefix SEI — down as its own "frame": 75 input fps on a 25 fps
+* camera, an 8–34 ms "GOP", a clip ring that widened to the LAST IRAP slice
+* (a third of the picture, without its parameter sets), and a prefix SEI that
+* inherited the welded VPS/SPS/PPS instead of the IDR.
+*
+* Boundary rule (RFC 3550 / 6184 / 7798): the RTP marker bit closes the
+* picture it ends — flushed on the spot, so a single-slice stream pays no
+* latency — and a timestamp change closes the one before it, for cameras that
+* never set the marker. Parameter sets are held and welded onto the picture
+* that follows them, so a keyframe access unit is self-contained
+* (VPS/SPS/PPS + IDR) exactly as before; a prefix SEI stays inside its
+* picture and is never a frame of its own.
+*/
+var AccessUnitAssembler = class {
+	onAccessUnit;
+	/** Parameter sets seen since the last picture closed; welded onto the next one. */
+	pendingParamNals = [];
+	/** NALs of the picture in progress (parameter sets first when welded). */
+	pictureNals = [];
+	pictureTimestamp = 0;
+	pictureKeyframe = false;
+	constructor(onAccessUnit) {
+		this.onAccessUnit = onAccessUnit;
+	}
+	push(depacketized) {
+		const { annexB, keyframe, parameterSet, timestamp, marker } = depacketized;
+		if (this.pictureNals.length > 0 && timestamp !== this.pictureTimestamp) this.flush();
+		if (parameterSet) {
+			this.pendingParamNals.push(annexB);
+			return;
+		}
+		if (this.pictureNals.length === 0) {
+			this.pictureTimestamp = timestamp;
+			this.pictureKeyframe = false;
+		}
+		if (this.pendingParamNals.length > 0) {
+			for (const paramNal of this.pendingParamNals) this.pictureNals.push(paramNal);
+			this.pendingParamNals = [];
+			this.pictureKeyframe = true;
+		}
+		this.pictureNals.push(annexB);
+		if (keyframe) this.pictureKeyframe = true;
+		if (marker) this.flush();
+	}
+	/**
+	* Emit the picture in progress, if any. Called on the marker bit, on a
+	* timestamp change, and by the broker when the stream stops or redials so
+	* the last picture of a marker-less stream is not lost.
+	*/
+	flush() {
+		if (this.pictureNals.length === 0) return;
+		const nals = this.pictureNals;
+		const timestamp = this.pictureTimestamp;
+		const keyframe = this.pictureKeyframe;
+		this.pictureNals = [];
+		this.pictureKeyframe = false;
+		const annexB = nals.length === 1 ? nals[0] : Buffer.concat(nals);
+		this.onAccessUnit({
+			annexB,
+			timestamp,
+			keyframe
+		});
+	}
+	/** Drop everything held — a redial re-bases the clock, nothing carries over. */
+	reset() {
+		this.pendingParamNals = [];
+		this.pictureNals = [];
+		this.pictureTimestamp = 0;
+		this.pictureKeyframe = false;
+	}
+};
+//#endregion
 //#region src/stream-broker/rtsp/rtsp-client.ts
 var DEFAULT_CONNECT_TIMEOUT_MS = 1e4;
 var DEFAULT_KEEPALIVE_INTERVAL_MS = 3e4;
@@ -10560,7 +10898,7 @@ var NativeRtspClient = class {
 			const channel = this.readBuffer[1];
 			const length = this.readBuffer.readUInt16BE(2);
 			if (this.readBuffer.length < 4 + length) return;
-			const payload = Buffer.from(this.readBuffer.subarray(4, 4 + length));
+			const payload = copyOwned(this.readBuffer, 4, 4 + length);
 			this.readBuffer = this.readBuffer.subarray(4 + length);
 			this.handleInterleavedPacket(channel, payload);
 		} else {
@@ -11296,49 +11634,6 @@ var AudioCodecSession = class {
 	}
 };
 //#endregion
-//#region src/stream-broker/stream-broker/owned-buffer.ts
-/**
-* Buffers that enter a LONG-LIVED ring own their backing store.
-*
-* Node serves `Buffer.from(...)`, `Buffer.allocUnsafe(n)` and `Buffer.concat`
-* below `Buffer.poolSize >>> 1` (4 KiB) as views of shared 8 KiB pool slabs.
-* That is the right choice for the ingest path — a start code, a 4-byte
-* interleave header, a 1.3 KB RTP packet that is fanned out and forgotten
-* within a tick — and the wrong one for anything RETAINED: a 600-byte NAL kept
-* for 60 s in a clip ring pins its whole slab, and with it every short-lived
-* packet that happened to be allocated beside it. On the hub that held
-* 550–980 MB of ArrayBuffers for ~150–250 MB of payload, and the full GCs the
-* pinned slabs caused ran every 0.2–0.5 s at 40–65 % of a core.
-*
-* The ring byte caps counted payload bytes, so they never saw it. Both rings
-* now pass every entry through {@link detachFromPool} on the way in and
-* account it with {@link backingStoreBytes}, so the cap measures what the
-* entry costs. Short-lived traffic stays pooled.
-*/
-/** True when `buf` is the whole of its ArrayBuffer — nothing else shares it. */
-function ownsBackingStore(buf) {
-	return buf.byteOffset === 0 && buf.buffer.byteLength === buf.length;
-}
-/**
-* What retaining `buf` really costs: its own length when it owns its
-* ArrayBuffer, the whole shared slab when it is a view of one.
-*/
-function backingStoreBytes(buf) {
-	return ownsBackingStore(buf) ? buf.length : buf.buffer.byteLength;
-}
-/**
-* `buf` itself when it already owns its ArrayBuffer (decided by inspecting the
-* buffer, never by its size: whether a large `allocUnsafe` is pooled is a Node
-* runtime detail), else a copy that does. One copy, never two: a buffer that is
-* already unpooled is returned as-is.
-*/
-function detachFromPool(buf) {
-	if (ownsBackingStore(buf)) return buf;
-	const owned = Buffer.allocUnsafeSlow(buf.length);
-	buf.copy(owned);
-	return owned;
-}
-//#endregion
 //#region src/stream-broker/stream-broker/encoded-ring-buffer.ts
 /**
 * Time-based ring buffer for encoded video packets.
@@ -12278,9 +12573,6 @@ var StreamBroker = class StreamBroker {
 	*/
 	ffmpegBinaryPathSource = () => null;
 	rtpDepacketizer = null;
-	/** Flag-only depacketizer for the `push-rtp` source-RTP pre-buffer path
-	*  (sets keyframe/param-set flags without re-emitting AnnexB packets). */
-	pushRtpFlagDepacketizer = null;
 	audioRtpDecoder = null;
 	audioCodecSession = null;
 	/**
@@ -12648,10 +12940,24 @@ var StreamBroker = class StreamBroker {
 	*  log alongside `audioRtpSeen`, so a wake-up cycle that brings audio
 	*  back but never video is observable from the structured logs. */
 	videoRtpSeen = 0;
-	/** Tracking flags set synchronously by the RTP depacketizer callback. */
+	/**
+	* What the source RTP packet being handled CARRIES (keyframe / parameter-set
+	* content, read from its payload headers by `classifyRtpPacket`) — the flags
+	* `captureRtpForPreBuffer` reads. Per packet, not per completed NAL: every
+	* fragment of a fragmented IDR carries them, and the ring marks one keyframe
+	* AU for the lot.
+	*/
 	_lastNalKeyframe = false;
 	_lastNalParamSet = false;
 	/**
+	* Whether the Annex-B plane (NAL reassembly + access-unit assembly →
+	* `EncodedPacket`) is being BUILT for this stream. False while nothing
+	* consumes it: the source-RTP path then classifies each packet and copies
+	* nothing. Armed at the next keyframe access unit once a consumer attaches
+	* (`needsAnnexBPlane`), so the first packet it emits is decodable.
+	*/
+	annexBPlaneActive = false;
+	/**
 	* Source-RTP pre-buffer: a ring of raw source RTP packets trimmed to
 	* begin at the most recent keyframe access unit — i.e. the current GOP so
 	* far. A late-joining WebRTC viewer on the repacketizer path replays this
@@ -13153,7 +13459,7 @@ var StreamBroker = class StreamBroker {
 		this.rtspRestreamer.destroy();
 		this.preBuffer.clear();
 		this.clipBuffer?.clear();
-		this.pendingParamNals = [];
+		this.annexBAssembler.reset();
 		this.encodedCallbacks.clear();
 		this.audioChunkPlane.dispose();
 	}
@@ -13616,7 +13922,7 @@ var StreamBroker = class StreamBroker {
 		this.reconcilePrestreamWindow();
 		this.preBuffer.clear();
 		this.clipBuffer?.clear();
-		this.pendingParamNals = [];
+		this.annexBAssembler.reset();
 		this.rtspRestreamer.resetStreamState();
 		this.totalBytes = 0;
 		this.bytesInWindow = 0;
@@ -13727,26 +14033,7 @@ var StreamBroker = class StreamBroker {
 				return;
 			}
 		}
-		if (packet.type === "video") {
-			this.packetCount++;
-			this.totalBytes += packet.data.length;
-			this.bytesInWindow += packet.data.length;
-			this.packetsInWindow++;
-			this.lastPacketAt = Date.now();
-			const now = Date.now();
-			const windowMs = now - this.windowStartMs;
-			if (windowMs >= 2e3) {
-				this.bitrateKbps = Math.round(this.bytesInWindow * 8 / windowMs);
-				this.encodedInputFps = this.packetsInWindow / windowMs * 1e3;
-				this.bytesInWindow = 0;
-				this.packetsInWindow = 0;
-				this.windowStartMs = now;
-			}
-			if (packet.keyframe) {
-				if (this.lastKeyframeMs > 0) this.idrIntervalMs = now - this.lastKeyframeMs;
-				this.lastKeyframeMs = now;
-			}
-		}
+		if (packet.type === "video" && this.rtpDepacketizer === null) this.recordVideoStats(packet.data.length, true, packet.keyframe);
 		if (packet.type === "video" && !this.isRtpSource()) this.preBuffer.push(packet);
 		if (packet.type === "video" && this.clipBuffer && packet.isPlaceholder !== true) this.clipBuffer.push(packet);
 		this.fanOutEncoded(packet);
@@ -13937,8 +14224,8 @@ var StreamBroker = class StreamBroker {
 					index: auStart,
 					ts: auPacket.readUInt32BE(4)
 				});
+				this.trimRtpRingToPreRollWindow();
 			}
-			this.trimRtpRingToPreRollWindow();
 			this.rtpRingHasKeyframe = true;
 		}
 		this.rtpRingPrevMarker = marker;
@@ -14207,10 +14494,10 @@ var StreamBroker = class StreamBroker {
 	*
 	* `push-rtp` providers deliver AnnexB-equivalents separately via
 	* `pushEncodedPacket()` (see `IStreamBroker` contract) — so this path
-	* does NOT re-emit EncodedPackets; it only derives the per-packet
-	* keyframe/param-set flags the pre-buffer capture needs (via a
-	* flag-only depacketizer that never touches the AnnexB plane), keeping
-	* the AnnexB consumers (pipe, restreamer) single-fed by the provider.
+	* does NOT re-emit EncodedPackets; it only classifies each packet for the
+	* keyframe/param-set flags the pre-buffer capture needs
+	* (`classifyRtpPacket`, no reassembly), keeping the AnnexB consumers
+	* (pipe, restreamer) single-fed by the provider.
 	*
 	* The pre-buffer is captured even with zero subscribers attached — a
 	* viewer that connects mid-GOP must be able to replay the GOP that
@@ -14220,9 +14507,9 @@ var StreamBroker = class StreamBroker {
 	pushVideoRtp(rtpData) {
 		if (this.stopping) return;
 		this.kickRtpActivityWatchdog();
-		this._lastNalKeyframe = false;
-		this._lastNalParamSet = false;
-		this.ensurePushRtpFlagDepacketizer().processPacket(rtpData);
+		const carried = classifyRtpPacket(this.detectedCodec === "h265" ? "h265" : "h264", rtpData);
+		this._lastNalKeyframe = carried?.keyframe ?? false;
+		this._lastNalParamSet = carried?.parameterSet ?? false;
 		this.captureRtpForPreBuffer(rtpData);
 		if (this.rtpVideoCallbacks.size === 0) return;
 		for (const [cb, entry] of this.rtpVideoCallbacks) try {
@@ -14232,27 +14519,6 @@ var StreamBroker = class StreamBroker {
 			this.logger?.warn("rtp video subscriber threw", { meta: { error: require_dist.errMsg(err) } });
 		}
 	}
-	/**
-	* Lazily build a flag-only RTP depacketizer for the `push-rtp` source
-	* path. Unlike the native reader's depacketizer (which emits AnnexB
-	* EncodedPackets via `handleDepacketizedNal`), this callback ONLY sets
-	* `_lastNalKeyframe`/`_lastNalParamSet` — the push provider owns the
-	* AnnexB plane through `pushEncodedPacket`, so re-emitting here would
-	* double-feed the pipe/restreamer. push-rtp has no SDP `onVideoTrack`,
-	* so the codec comes from the source declaration (`detectedCodec`, seeded
-	* in `start()`). Dropped on teardown (`resetRtpPipeline`) so a redial
-	* starts with clean FU reassembly state.
-	*/
-	ensurePushRtpFlagDepacketizer() {
-		if (!this.pushRtpFlagDepacketizer) {
-			const codec = this.detectedCodec === "h265" ? "h265" : "h264";
-			this.pushRtpFlagDepacketizer = new RtpDepacketizer(codec, ({ keyframe, parameterSet }) => {
-				if (keyframe) this._lastNalKeyframe = true;
-				if (parameterSet) this._lastNalParamSet = true;
-			});
-		}
-		return this.pushRtpFlagDepacketizer;
-	}
 	/** Toggle the per-device streaming debug flag. */
 	setStreamingDebug(enabled) {
 		this.streamingDebug = enabled;
@@ -14695,10 +14961,18 @@ var StreamBroker = class StreamBroker {
 					seq: this.videoRtpSeen,
 					bytes: rtpData.length
 				} });
-				this._lastNalKeyframe = false;
-				this._lastNalParamSet = false;
-				this.rtpDepacketizer?.processPacket(rtpData);
-				this.rtspRestreamer.pushRtpPassthrough(rtpData, this._lastNalKeyframe, this._lastNalParamSet);
+				const wantPlane = this.needsAnnexBPlane();
+				if (!wantPlane && this.annexBPlaneActive) this.idleAnnexBPlane();
+				const carried = this.annexBPlaneActive ? this.rtpDepacketizer?.processPacket(rtpData) ?? null : this.rtpDepacketizer?.classifyPacket(rtpData) ?? null;
+				this._lastNalKeyframe = carried?.keyframe ?? false;
+				this._lastNalParamSet = carried?.parameterSet ?? false;
+				const auFlags = carried ? this.rtpAuTracker.classify(carried) : null;
+				if (wantPlane && !this.annexBPlaneActive && auFlags?.keyframeAuStart === true) {
+					this.armAnnexBPlane();
+					this.rtpDepacketizer?.processPacket(rtpData);
+				}
+				if (auFlags) this.recordVideoStats(rtpData.length, auFlags.pictureStart, auFlags.keyframeAu);
+				this.rtspRestreamer.pushRtpPassthrough(rtpData, auFlags?.keyframeAu ?? false, auFlags?.parameterSet ?? false);
 				this.captureRtpForPreBuffer(rtpData);
 				if (this.rtpVideoCallbacks.size > 0) for (const [cb, entry] of this.rtpVideoCallbacks) try {
 					cb(rtpData);
@@ -14894,51 +15168,116 @@ var StreamBroker = class StreamBroker {
 	* RTSP restreamer's pushRtpPassthrough.
 	*/
 	/**
-	* Pending parameter-set NALs (SPS/PPS for H.264, VPS/SPS/PPS for H.265).
-	* Cameras emit these as separate RTP packets before the IDR/IRAP frame.
-	* We buffer them here and prepend to the next VCL NAL so downstream
-	* consumers (WebRTC, prebuffer, restream) receive complete access units
-	* with a single `EncodedPacket` that contains SPS+PPS+IDR together.
+	* Groups the depacketizer's NALs into access units — ONE `EncodedPacket`
+	* per picture, parameter sets welded onto the keyframe picture they
+	* precede. See `access-unit-assembler.ts` for the boundary rule and the
+	* per-NAL emit it replaced.
 	*/
-	pendingParamNals = [];
+	annexBAssembler = new AccessUnitAssembler((accessUnit) => this.emitAccessUnit(accessUnit));
+	/** Access-unit membership of the source RTP packets, for the restreamer's flags. */
+	rtpAuTracker = new RtpAccessUnitTracker();
 	/**
 	* handleDepacketizedNal receives individual NALs from the RTP depacketizer
-	* and emits them as EncodedPackets.
-	*
-	* Parameter-set NALs (SPS/PPS type 7/8 for H.264, VPS/SPS/PPS type 32/33/34
-	* for H.265) are buffered and prepended to the next VCL NAL (slice/IDR).
-	* This guarantees every keyframe EncodedPacket is a self-contained access
-	* unit that a decoder can initialise from — critical for WebRTC (Chrome
-	* can't decode an IDR without preceding SPS/PPS).
+	* and hands them to the access-unit assembler, which emits one
+	* `EncodedPacket` per PICTURE (`emitAccessUnit`) — never per NAL. A
+	* multi-slice IDR, its parameter sets and its prefix SEI are one keyframe
+	* packet; three P slices are one P packet.
 	*
-	* The RTSP restreamer handles its own RTP passthrough separately and is
-	* not affected by this merging.
+	* The RTSP restreamer forwards source RTP separately (`onVideoRtp`) and is
+	* not fed from here.
 	*/
 	handleDepacketizedNal(depacketized) {
-		const { nal, keyframe, parameterSet, timestamp } = depacketized;
-		const codec = this.detectedCodec ?? "h264";
-		if (keyframe) this._lastNalKeyframe = true;
-		if (parameterSet) this._lastNalParamSet = true;
-		const isH264 = codec === "h264";
-		const nalType = isH264 ? nal[0] & 31 : (nal[0] & 126) >> 1;
-		if (isH264 ? nalType === 7 || nalType === 8 : nalType === 32 || nalType === 33 || nalType === 34) {
-			this.pendingParamNals.push(depacketized.annexB);
-			return;
+		this.annexBAssembler.push(depacketized);
+	}
+	/**
+	* Does anything consume the Annex-B plane right now? An encoded subscriber
+	* (WebRTC Annex-B, fragments, a decode session), a pipe client, a clip ring
+	* (it retains access units continuously, so it needs them built even with
+	* nobody attached), or a restreamer still in Annex-B mode (no camera SDP yet).
+	* The RTSP restream and the WebRTC RTP path are served from the source RTP
+	* and never count. Cheap — four field reads — because it runs per packet.
+	*/
+	needsAnnexBPlane() {
+		return this.encodedCallbacks.size > 0 || this.clipBuffer !== null || this.pipeServer.getClientCount() > 0 || !this.rtspRestreamer.rtpPassthroughMode;
+	}
+	/** The consumers that want the plane, for the arm/idle lines. */
+	annexBPlaneConsumers() {
+		return {
+			encodedSubscribers: this.encodedCallbacks.size,
+			clipRing: this.clipBuffer !== null,
+			pipeClients: this.pipeServer.getClientCount(),
+			restreamerAnnexB: !this.rtspRestreamer.rtpPassthroughMode
+		};
+	}
+	/**
+	* Start building access units from the keyframe AU the current packet opens.
+	* The depacketizer and the assembler are clean here (reset when the plane
+	* went idle, or never used), so nothing stale precedes that keyframe.
+	*/
+	armAnnexBPlane() {
+		this.annexBPlaneActive = true;
+		this.logger?.info("annex-b plane armed at a keyframe access unit", {
+			tags: { deviceId: this.numericDeviceId },
+			meta: this.annexBPlaneConsumers()
+		});
+	}
+	/**
+	* Stop building access units: the last consumer left. The picture in
+	* progress is dropped, not flushed — there is nobody to hand it to, and a
+	* partial picture must never reach the next consumer's clean start. Logged,
+	* once per transition: a plane that is idle on purpose must not read as a
+	* stream that stopped.
+	*/
+	idleAnnexBPlane() {
+		this.annexBPlaneActive = false;
+		this.rtpDepacketizer?.reset();
+		this.annexBAssembler.reset();
+		this.logger?.info("annex-b plane idle — no consumer, NAL reassembly skipped", { tags: { deviceId: this.numericDeviceId } });
+	}
+	/**
+	* One place for the input stats, fed from whichever path owns the pictures:
+	* the source RTP packets while the native reader is up (`onVideoRtp`), the
+	* `EncodedPacket`s otherwise (`pushEncodedPacket`). `bytes` accumulate per
+	* call; `inputFps`, `packetCount` and the IDR interval advance once per
+	* picture — the window is closed on a picture start so a window of N frames
+	* reads N, exactly as it did when every call was one access unit.
+	*/
+	recordVideoStats(bytes, pictureStart, keyframe) {
+		this.totalBytes += bytes;
+		this.bytesInWindow += bytes;
+		if (!pictureStart) return;
+		this.packetCount++;
+		this.packetsInWindow++;
+		const now = Date.now();
+		this.lastPacketAt = now;
+		const windowMs = now - this.windowStartMs;
+		if (windowMs >= 2e3) {
+			this.bitrateKbps = Math.round(this.bytesInWindow * 8 / windowMs);
+			this.encodedInputFps = this.packetsInWindow / windowMs * 1e3;
+			this.bytesInWindow = 0;
+			this.packetsInWindow = 0;
+			this.windowStartMs = now;
 		}
-		const hadParamSets = this.pendingParamNals.length > 0;
-		let annexBData;
-		if (hadParamSets) {
-			this.pendingParamNals.push(depacketized.annexB);
-			annexBData = Buffer.concat(this.pendingParamNals);
-			this.pendingParamNals = [];
-		} else annexBData = depacketized.annexB;
-		const pts = Math.floor(timestamp / 90);
+		if (keyframe) {
+			if (this.lastKeyframeMs > 0) this.idrIntervalMs = now - this.lastKeyframeMs;
+			this.lastKeyframeMs = now;
+		}
+	}
+	/**
+	* One assembled access unit → one `EncodedPacket` for every Annex-B
+	* consumer (prebuffer, clip ring, pipe, WebRTC). A keyframe packet is
+	* self-contained (VPS/SPS/PPS + every IDR slice), which is what a decoder
+	* initialises from and what a clip or a pre-roll window may start at.
+	*/
+	emitAccessUnit(accessUnit) {
+		const codec = this.detectedCodec ?? "h264";
+		const pts = Math.floor(accessUnit.timestamp / 90);
 		const packet = {
 			type: "video",
-			data: annexBData,
+			data: accessUnit.annexB,
 			pts,
 			dts: pts,
-			keyframe: keyframe || hadParamSets,
+			keyframe: accessUnit.keyframe,
 			codec
 		};
 		this.pushEncodedPacket(packet);
@@ -15342,10 +15681,10 @@ var StreamBroker = class StreamBroker {
 			this.rtpDepacketizer.reset();
 			this.rtpDepacketizer = null;
 		}
-		if (this.pushRtpFlagDepacketizer) {
-			this.pushRtpFlagDepacketizer.reset();
-			this.pushRtpFlagDepacketizer = null;
-		}
+		this.annexBAssembler.flush();
+		this.annexBAssembler.reset();
+		this.rtpAuTracker.reset();
+		this.annexBPlaneActive = false;
 		this.resetRtpPreBuffer();
 		if (this.audioRtpDecoder) {
 			this.audioRtpDecoder.flush();