@camstack/types 1.2.43 → 1.2.44

package/dist/interfaces/camera-switches.d.ts

@@ -18,6 +18,19 @@
  * | `notifications` | `notificationRules.setDeviceMuted` | `NotificationCenter.evaluateAndEnqueue` returns before any rule is evaluated |
  * | `privacy-mask` | `privacyMask.setMask({ enabled })` → the CAMERA | the camera blanks the masked regions itself; every stream and recording carries the black boxes |
  * | `device-audio` | `privacyMask.setAudioEnabled` → the CAMERA | the camera stops encoding an audio track at all; every consumer sees silent video |
+ * | `broker-audio` | `streamBroker.setDeviceAudioMute` → `DeviceOverride.audioMuted` | `StreamBroker.setAudioMuted` drops the audio plane at the source: no `type:'audio'` packet leaves `fanOutEncoded`, no RTP reaches the restreamer, and the restreamer serves the video-only SDP |
+ *
+ * ## `device-audio` and `broker-audio` are two functions, not two knobs
+ *
+ * They look adjacent and they are not the same control ([D83](../../../../docs/decisions/adr-0083.md)):
+ * `device-audio` writes the CAMERA, so it is hardware privacy — the microphone
+ * genuinely stops, it survives CamStack entirely, and it costs a multi-second
+ * encoder restart on every flip. `broker-audio` writes THIS server, so it is
+ * instant, vendor-independent and reversible without touching the camera, and
+ * a camera that ignores or lacks the ISAPI/Reolink control is still silenced.
+ * D62 forbids a second switch that *disagrees* with the first; these two
+ * cannot disagree, because neither reads the other's store — the camera holds
+ * one, the broker holds the other, and each reports its own fact.
  *
  * ## The two switches whose authority is not on this server
  *
@@ -83,6 +96,7 @@ export declare const CameraSwitchIdSchema: z.ZodEnum<{
     notifications: "notifications";
     "object-detection": "object-detection";
     "device-audio": "device-audio";
+    "broker-audio": "broker-audio";
 }>;
 export type CameraSwitchId = z.infer<typeof CameraSwitchIdSchema>;
 /**
@@ -96,6 +110,10 @@ export type CameraSwitchId = z.infer<typeof CameraSwitchIdSchema>;
  * `object-detection` despite feeding it: a mask blanks REGIONS, so its blast
  * radius is partial, and the "broadest first" rule does not rank a partial
  * control above a whole-function one.
+ *
+ * `broker-audio` sits directly BELOW `device-audio` by the same source-first
+ * rule: the camera's microphone feeds the broker, so silencing the camera
+ * leaves the broker's mute with nothing to suppress; the reverse is not true.
  */
 export declare const CAMERA_SWITCH_ORDER: readonly CameraSwitchId[];
 /**
@@ -119,6 +137,8 @@ export declare const CameraSwitchAuthoritySchema: z.ZodDiscriminatedUnion<[z.Zod
 }, z.core.$strip>, z.ZodObject<{
     kind: z.ZodLiteral<"camera-mask">;
     capName: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"broker-audio-mute">;
 }, z.core.$strip>], "kind">;
 export type CameraSwitchAuthority = z.infer<typeof CameraSwitchAuthoritySchema>;
 /**
@@ -149,6 +169,7 @@ export declare const CameraSwitchSchema: z.ZodObject<{
         notifications: "notifications";
         "object-detection": "object-detection";
         "device-audio": "device-audio";
+        "broker-audio": "broker-audio";
     }>;
     label: z.ZodString;
     costWhenOff: z.ZodString;
@@ -174,6 +195,8 @@ export declare const CameraSwitchSchema: z.ZodObject<{
     }, z.core.$strip>, z.ZodObject<{
         kind: z.ZodLiteral<"camera-mask">;
         capName: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"broker-audio-mute">;
     }, z.core.$strip>], "kind">;
 }, z.core.$strip>;
 export type CameraSwitch = z.infer<typeof CameraSwitchSchema>;
@@ -189,6 +212,7 @@ export declare const CameraSwitchGroupSchema: z.ZodObject<{
             notifications: "notifications";
             "object-detection": "object-detection";
             "device-audio": "device-audio";
+            "broker-audio": "broker-audio";
         }>;
         label: z.ZodString;
         costWhenOff: z.ZodString;
@@ -214,6 +238,8 @@ export declare const CameraSwitchGroupSchema: z.ZodObject<{
         }, z.core.$strip>, z.ZodObject<{
             kind: z.ZodLiteral<"camera-mask">;
             capName: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"broker-audio-mute">;
         }, z.core.$strip>], "kind">;
     }, z.core.$strip>>>;
     fetchedAt: z.ZodNumber;
@@ -305,6 +331,28 @@ export interface CameraSwitchDerivationInput {
      * `null` = the cap is bound to this camera but did not answer.
      */
     readonly privacyMask: PrivacyMaskSwitchState | null;
+    /**
+     * The BROKER's audio-plane policy for this camera, read from the
+     * stream-broker on the device's source-owner node. `null` = the broker did
+     * not answer, which renders no control rather than a control defaulted to
+     * "audio flows".
+     */
+    readonly brokerAudio: BrokerAudioSwitchState | null;
+}
+/** What the stream-broker reported about its audio plane for one camera. */
+export interface BrokerAudioSwitchState {
+    /**
+     * `DeviceOverride.audioMuted` — the broker's own persisted policy. `true`
+     * means the broker drops this camera's audio on every plane it serves.
+     *
+     * There is no `supported` companion, deliberately. Muting a camera that is
+     * currently silent is not a dead control: the policy governs what happens
+     * when sound DOES appear (a camera unmuted at the device, a stream that
+     * only carries audio at night), so it is meaningful to set in advance.
+     * That is the opposite of the privacy mask with zero zones, where flipping
+     * the master enable is provably a no-op until something else changes.
+     */
+    readonly muted: boolean;
 }
 /** What the camera-probed audio switch reported for one camera. */
 export interface DeviceAudioSwitchState {

package/dist/interfaces/stream-broker.d.ts

@@ -208,6 +208,24 @@ export interface BrokerStats {
         readonly channels: number;
         readonly supported: boolean;
     } | null;
+    /**
+     * BROKER-SIDE AUDIO MUTE ([D83](../../../../docs/decisions/adr-0083.md)).
+     * `true` = this broker is deliberately distributing none of the device's
+     * audio, live or recorded. It is what tells a silent camera apart from a
+     * broken one on the stream panel: a broker holding an `audio` descriptor
+     * with `audioMuted: true` is doing exactly what it was asked.
+     *
+     * `audioMutedDropped` counts the audio units the mute threw away since the
+     * current dial — the proof the mute is on the packet path and not merely
+     * persisted.
+     *
+     * NOTE: this interface is the hand-written twin of `BrokerStatsSchema` in
+     * `capabilities/schemas/streaming-shared.ts`. They are not generated from
+     * each other; a field added to one and not the other compiles and then
+     * silently disappears on the wire.
+     */
+    readonly audioMuted?: boolean;
+    readonly audioMutedDropped?: number;
 }
 export interface IStreamBroker {
     readonly deviceId: string;

package/dist/node.d.ts

@@ -8,3 +8,7 @@ export { canonicalDeviceFingerprint, diffExportTargets, resolveExportFingerprint
 export type { DeviceExportShape, ExportDelta, ExportTargetEntry, } from './utils/export-reconciler.js';
 export { FfmpegProcess } from './ffmpeg/process.js';
 export type { FfmpegProcessOptions, FfmpegExit, FfmpegExitClass } from './ffmpeg/process.js';
+export { Fmp4FragmentPlane } from './ffmpeg/fmp4-fragment-plane.js';
+export type { Fmp4CloseReason, Fmp4Packet, Fmp4PrebufferOptions, Fmp4PrebufferStats, Fmp4SubscribeInput, Fmp4SubscriberInfo, Fmp4Subscription, } from './ffmpeg/fmp4-fragment-plane.js';
+export { Fmp4FragmentChild } from './ffmpeg/fmp4-fragment-child.js';
+export type { Fmp4FragmentChildArgs, Fmp4FragmentChildDeps, } from './ffmpeg/fmp4-fragment-child.js';

package/dist/node.js

@@ -21,7 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-const require_canonical_hash = require("./canonical-hash-BcZHRHIx.js");
+const require_fmp4_box_splitter = require("./fmp4-box-splitter-BkWH7O3L.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
@@ -609,7 +609,7 @@ var FilesystemStorageProvider = class {
 */
 function canonicalDeviceFingerprint(shape) {
 	const features = [...new Set(shape.features)].toSorted();
-	return require_canonical_hash.canonicalHash({
+	return require_fmp4_box_splitter.canonicalHash({
 		deviceType: shape.deviceType,
 		features
 	});
@@ -922,12 +922,518 @@ var FfmpegProcess = class {
 	}
 };
 //#endregion
+//#region src/ffmpeg/fmp4-fragment-plane.ts
+/**
+* Fmp4FragmentPlane — a SUBSCRIBABLE fragmented-MP4 plane, fed by one
+* {@link import('./fmp4-box-splitter.js').Fmp4BoxSplitter}.
+*
+* ## Why a plane and not a callback
+*
+* The operator's requirement for HKSV was explicit: the live fMP4 source built
+* for it must be **dual-use**, so a HomeKit-triggered recording also lands in
+* CamStack as an additional videoclip source alongside the recorder and the NC
+* clip ring — *one fragmenter, two consumers; do not build an HKSV-only pipe*
+* (`docs/roadmap.md` item 4b). A single-callback pipe makes the second consumer
+* a second ffmpeg child of the same camera. So this is the same shape the
+* broker's other multi-consumer surfaces already have
+* (`AudioChunkPlane`, the push packet plane): N independent subscriptions over
+* one producer.
+*
+* **Nothing consumes it yet.** Phase 4 brings the HKSV delegate and phase 4b the
+* clip source; both are named here so the seam is not re-invented, and neither
+* is built.
+*
+* ## The init segment is RETAINED
+*
+* A subscriber that attaches mid-stream — the clip consumer joining an already
+* running HKSV session, which is the whole dual-use case — receives the
+* retained `ftyp`+`moov` as its first packet and then live fragments. Without
+* retention its fragments are undecodable and the failure looks like a codec
+* problem.
+*
+* ## A slow subscriber is CLOSED, never silently gapped
+*
+* `AudioChunkPlane` drops its oldest chunk on overflow, which for audio costs a
+* click. An fMP4 stream with a hole is not a shorter clip, it is a corrupt one:
+* `moof` sequence numbers jump, the consumer's demuxer desynchronises, and HKSV
+* shows a clip that fails to play with nothing anywhere saying why. So a
+* subscription whose queue overflows is ENDED with a reason, loudly, and the
+* other subscriptions are untouched.
+*
+* ## The PREBUFFER (phase 3)
+*
+* HKSV asks for context BEFORE the trigger — `CameraRecordingOptions.prebufferLength`
+* is a HAP-mandated minimum of 4000 ms — and a subscriber that attaches at the
+* motion edge has none. So the plane optionally retains the last few fragments
+* and replays them to a subscriber that asks for them.
+*
+* Three things this ring gets right, each of which is a measured fact rather
+* than a preference (see [D84](../../../../docs/decisions/adr-0084.md)):
+*
+*  - **It is bounded by TIME *and* BYTES.** On the live fleet a 720p copy
+*    fragment is ~255 KB and a 4K one is ~6.35 MB — a 25× spread over the same
+*    window. A time-only bound is a per-camera RAM figure nobody can predict.
+*  - **The window is measured on ARRIVAL, not parsed from `tfdt`.** The
+*    splitter deliberately never computes a fragment's duration (a second
+*    opinion about a fact the muxer owns), and a prebuffer cares about how long
+*    ago the bytes turned up, which is exactly what arrival time answers.
+*  - **A replay is not backlog.** A subscriber taking N retained fragments gets
+*    its queue capacity raised by N for them, because closing a subscriber as a
+*    slow consumer for the prebuffer it explicitly asked for would be the
+*    stupidest possible failure — and, with `DEFAULT_QUEUE_CAPACITY` of 4 and a
+*    ring of 4, the guaranteed one.
+*
+* ## `isLast`
+*
+* hap-nodejs requires the delegate to mark exactly one `RecordingPacket` with
+* `isLast` — a generator that finishes without it produces the twelve-second
+* timeout loop [D50](../../../../../docs/decisions/adr-0050.md) deleted. The
+* plane therefore computes it at DELIVERY time: a packet is last when the plane
+* has ended and nothing remains queued behind it. A subscription that ends
+* having delivered NOTHING says so through {@link Fmp4Subscription.delivered};
+* the future delegate must not open an HDS stream it cannot feed.
+*/
+var DEFAULT_QUEUE_CAPACITY = 4;
+var Fmp4FragmentPlane = class {
+	logger;
+	prebuffer;
+	now;
+	subscriptions = /* @__PURE__ */ new Map();
+	/** The last init unit seen, handed to every later subscriber. */
+	retainedInit = null;
+	ended = false;
+	/** Oldest first. Empty unless {@link Fmp4PrebufferOptions} was supplied. */
+	ring = [];
+	ringBytes = 0;
+	constructor(logger, prebuffer, now = Date.now) {
+		this.logger = logger;
+		this.prebuffer = prebuffer;
+		this.now = now;
+	}
+	get subscriberCount() {
+		return this.subscriptions.size;
+	}
+	/** True once {@link end} has been called — no further units are accepted. */
+	get isEnded() {
+		return this.ended;
+	}
+	/** What the prebuffer ring holds right now. All zeroes when disabled. */
+	prebufferStats() {
+		const oldest = this.ring[0];
+		return {
+			fragments: this.ring.length,
+			bytes: this.ringBytes,
+			spanMs: oldest === void 0 ? 0 : this.now() - oldest.arrivedAt
+		};
+	}
+	subscribe(input) {
+		const replay = input.withPrebuffer === true ? this.trimmedRing() : [];
+		const requested = Math.max(1, input.queueCapacity ?? DEFAULT_QUEUE_CAPACITY);
+		const sub = {
+			id: `fmp4-${(0, node_crypto.randomUUID)()}`,
+			tag: input.tag,
+			subscribedAt: this.now(),
+			capacity: requested + replay.length,
+			queue: [],
+			delivered: 0,
+			closedReason: null,
+			wake: null,
+			iterating: false
+		};
+		this.subscriptions.set(sub.id, sub);
+		if (this.retainedInit !== null) this.enqueue(sub, this.retainedInit);
+		for (const retained of replay) this.enqueue(sub, retained.unit);
+		if (this.ended) this.closeSubscription(sub, "ended");
+		this.logger?.info("fmp4 plane: subscribed", { meta: {
+			subscriptionId: sub.id,
+			tag: sub.tag,
+			hasRetainedInit: this.retainedInit !== null,
+			prebufferFragments: replay.length,
+			prebufferBytes: replay.reduce((n, r) => n + r.unit.data.length, 0)
+		} });
+		return this.facade(sub);
+	}
+	/**
+	* Fan one splitter unit out. An `init` REPLACES the retained one — ffmpeg
+	* emits exactly one per child, and a second means the child was respawned, in
+	* which case the old one describes a stream that no longer exists.
+	*/
+	publish(unit) {
+		if (this.ended) return;
+		if (unit.kind === "init") {
+			this.retainedInit = unit;
+			this.ring.length = 0;
+			this.ringBytes = 0;
+		} else this.retain(unit);
+		for (const sub of this.subscriptions.values()) {
+			if (sub.closedReason !== null) continue;
+			this.enqueue(sub, unit);
+		}
+	}
+	/**
+	* The producer stopped. Every subscriber drains what it holds; its final
+	* packet carries `isLast`, and its generator then completes.
+	*/
+	end(reason = "producer ended") {
+		if (this.ended) return;
+		this.ended = true;
+		this.logger?.info("fmp4 plane: ended", { meta: {
+			reason,
+			subscribers: this.subscriptions.size
+		} });
+		for (const sub of this.subscriptions.values()) if (sub.closedReason === null) this.closeSubscription(sub, "ended");
+	}
+	listSubscribers() {
+		return [...this.subscriptions.values()].map((s) => ({
+			tag: s.tag,
+			subscribedAt: s.subscribedAt,
+			delivered: s.delivered,
+			closedReason: s.closedReason
+		}));
+	}
+	/** End and forget everything. Idempotent. */
+	dispose() {
+		this.end("disposed");
+		this.subscriptions.clear();
+		this.retainedInit = null;
+		this.ring.length = 0;
+		this.ringBytes = 0;
+	}
+	/**
+	* Add one fragment to the ring and evict from the front until BOTH bounds
+	* hold. Eviction is oldest-first, which is the one place in this file where
+	* dropping is correct: the ring is context, not stream — nobody is mid-decode
+	* on it, and a subscriber only ever receives a contiguous tail of it.
+	*/
+	retain(unit) {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return;
+		const arrivedAt = this.now();
+		this.ring.push({
+			unit,
+			arrivedAt
+		});
+		this.ringBytes += unit.data.length;
+		const cutoff = arrivedAt - prebuffer.windowMs;
+		while (this.ring.length > 0) {
+			const oldest = this.ring[0];
+			if (oldest === void 0) break;
+			const tooOld = oldest.arrivedAt < cutoff;
+			const tooBig = this.ringBytes > prebuffer.maxBytes;
+			if (!tooOld && !tooBig || this.ring.length === 1) break;
+			this.ring.shift();
+			this.ringBytes -= oldest.unit.data.length;
+		}
+	}
+	/**
+	* The ring as a subscriber should receive it — window applied AT SUBSCRIBE
+	* time, not only at publish time. A camera that went quiet keeps its last
+	* fragment in the ring indefinitely (see the never-evict-the-newest rule),
+	* and replaying a 40-second-old fragment as "prebuffer" would put stale video
+	* at the head of a clip iOS presents as the moment of the event.
+	*/
+	trimmedRing() {
+		const prebuffer = this.prebuffer;
+		if (prebuffer === void 0) return [];
+		const cutoff = this.now() - prebuffer.windowMs;
+		return this.ring.filter((r) => r.arrivedAt >= cutoff);
+	}
+	enqueue(sub, unit) {
+		if (sub.queue.length >= sub.capacity) {
+			this.logger?.warn("fmp4 plane: subscriber fell behind — CLOSING it rather than gapping it", { meta: {
+				subscriptionId: sub.id,
+				tag: sub.tag,
+				capacity: sub.capacity,
+				delivered: sub.delivered
+			} });
+			this.closeSubscription(sub, "slow-consumer");
+			return;
+		}
+		sub.queue.push({
+			kind: unit.kind,
+			data: unit.data,
+			sequence: unit.sequence,
+			isLast: false
+		});
+		this.wake(sub);
+	}
+	closeSubscription(sub, reason) {
+		if (sub.closedReason !== null) return;
+		sub.closedReason = reason;
+		if (reason === "slow-consumer") sub.queue.length = 0;
+		this.wake(sub);
+	}
+	wake(sub) {
+		const resume = sub.wake;
+		sub.wake = null;
+		resume?.();
+	}
+	facade(sub) {
+		const plane = this;
+		return {
+			id: sub.id,
+			tag: sub.tag,
+			get delivered() {
+				return sub.delivered;
+			},
+			get closedReason() {
+				return sub.closedReason;
+			},
+			packets: () => plane.iterate(sub),
+			release: () => {
+				plane.closeSubscription(sub, "released");
+				plane.subscriptions.delete(sub.id);
+			}
+		};
+	}
+	async *iterate(sub) {
+		if (sub.iterating) throw new Error(`fmp4 plane: subscription ${sub.tag} is already being consumed — take a second subscription`);
+		sub.iterating = true;
+		for (;;) {
+			const next = sub.queue.shift();
+			if (next === void 0) {
+				if (sub.closedReason !== null) return;
+				await new Promise((resolve) => {
+					sub.wake = resolve;
+				});
+				continue;
+			}
+			const isLast = sub.closedReason === "ended" && sub.queue.length === 0;
+			sub.delivered += 1;
+			yield {
+				...next,
+				isLast
+			};
+			if (isLast) return;
+		}
+	}
+};
+//#endregion
+//#region src/ffmpeg/fmp4-fragment-child.ts
+var DEFAULT_FIRST_UNIT_TIMEOUT_MS = 12e3;
+/** Heartbeat cadence — ~2 minutes of 4 s fragments. */
+var FRAGMENT_LOG_EVERY = 30;
+var Fmp4FragmentChild = class {
+	deps;
+	args;
+	child = null;
+	splitter = new require_fmp4_box_splitter.Fmp4BoxSplitter();
+	stopped = false;
+	unitsOut = 0;
+	activeHwAccel = null;
+	constructor(deps, args) {
+		this.deps = deps;
+		this.args = args;
+	}
+	/** Spawn, and resolve once the INIT segment has been cut out of stdout. */
+	async start() {
+		const requested = this.args.invocation.decodeHwAccel;
+		this.activeHwAccel = requested;
+		try {
+			await this.spawnAttempt(requested);
+			return;
+		} catch (err) {
+			if (this.stopped) throw err;
+			if (requested === null || require_fmp4_box_splitter.isSoftwareDecode(requested)) throw err;
+			this.deps.logger.warn("fmp4 fragment child: hardware decode produced NO fragment — retrying in SOFTWARE", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					decodeHwAccel: requested,
+					error: require_err_msg.errMsg(err)
+				}
+			});
+			this.killChild();
+			this.splitter = new require_fmp4_box_splitter.Fmp4BoxSplitter();
+			this.activeHwAccel = null;
+			await this.spawnAttempt(null);
+		}
+	}
+	/** The backend the child ACTUALLY ran with — `null` for software. */
+	activeDecodeHwAccel() {
+		const value = this.activeHwAccel;
+		return value === null || value === "none" || value === "copy" ? null : value;
+	}
+	/** Kill ffmpeg and end the plane. Idempotent. */
+	async stop() {
+		if (this.stopped) return;
+		this.stopped = true;
+		this.killChild();
+		this.args.plane.end("the fragment child stopped");
+	}
+	spawnAttempt(decodeHwAccel) {
+		const args = require_fmp4_box_splitter.buildFfmpegArgs({
+			...this.args.invocation,
+			decodeHwAccel,
+			sink: {
+				kind: "stdout",
+				container: "mp4",
+				fragmentMs: this.args.fragmentMs
+			}
+		});
+		this.deps.logger.info("fmp4 fragment child: spawning ffmpeg", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				fragmentMs: this.args.fragmentMs,
+				decodeHwAccel: decodeHwAccel ?? "software",
+				argv: args.join(" ")
+			}
+		});
+		return new Promise((resolve, reject) => {
+			const child = this.deps.spawnFn(this.deps.ffmpegBinaryPath, args, { stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			] });
+			this.child = child;
+			let settled = false;
+			/**
+			* This attempt FAILED. Set before the kill, because SIGTERM makes the
+			* child exit and that exit must not be reported as a death: the retry —
+			* or the caller's rejection — already owns what happens next. Without it
+			* the timeout path ends the plane the software retry is about to fill,
+			* and the consumer sees a stream that stopped for no reason. A "which
+			* spawn is current" counter does NOT cover this: the retry has not been
+			* spawned when the kill's exit arrives.
+			*/
+			let failed = false;
+			/**
+			* This attempt is still the live producer: it has not failed (a failure
+			* hands ownership to the retry, or to the caller's rejection) and nothing
+			* has stopped the child. Those two cover every way an attempt stops being
+			* current — `start` only respawns after a rejection.
+			*/
+			const isCurrent = () => !this.stopped && !failed;
+			const timeoutMs = this.deps.firstUnitTimeoutMs ?? DEFAULT_FIRST_UNIT_TIMEOUT_MS;
+			const settle = (fail) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				if (fail) {
+					failed = true;
+					reject(fail);
+				} else resolve();
+			};
+			const timer = setTimeout(() => {
+				settle(/* @__PURE__ */ new Error(`fmp4 fragment child: no fragment within ${timeoutMs}ms`));
+				this.killChild();
+			}, timeoutMs);
+			timer.unref?.();
+			child.stdout?.on("data", (chunk) => {
+				for (const unit of this.splitter.push(chunk)) {
+					this.unitsOut += 1;
+					this.args.plane.publish(unit);
+					if (unit.kind === "init") {
+						this.deps.logger.info("fmp4 fragment child: INIT segment cut", {
+							tags: { deviceId: this.args.deviceId },
+							meta: {
+								sourceId: this.args.sourceId,
+								bytes: unit.data.length
+							}
+						});
+						settle();
+					} else if (this.unitsOut % FRAGMENT_LOG_EVERY === 0) this.deps.logger.info("fmp4 fragment child: fragments still flowing", {
+						tags: { deviceId: this.args.deviceId },
+						meta: {
+							sourceId: this.args.sourceId,
+							unitsOut: this.unitsOut,
+							bytes: unit.data.length,
+							subscribers: this.args.plane.subscriberCount
+						}
+					});
+				}
+				const fault = this.splitter.fault;
+				if (fault !== null) this.onFault(fault, settled, isCurrent(), settle);
+			});
+			child.stderr?.setEncoding("utf8");
+			child.stderr?.on("data", (line) => {
+				this.deps.logger.debug("fmp4 fragment child ffmpeg", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						line: line.trim()
+					}
+				});
+			});
+			child.once("error", (err) => {
+				if (!settled) {
+					settle(err);
+					return;
+				}
+				if (!isCurrent()) return;
+				this.args.plane.end("the fragment child errored");
+				this.deps.onChildExit?.(err);
+			});
+			child.once("exit", (code, signal) => {
+				if (!settled) {
+					settle(/* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited before any fragment (code=${code} signal=${signal})`));
+					return;
+				}
+				if (!isCurrent()) return;
+				const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ffmpeg exited while live (code=${code} signal=${signal})`);
+				this.deps.logger.warn("fmp4 fragment child: ffmpeg exited while live", {
+					tags: { deviceId: this.args.deviceId },
+					meta: {
+						sourceId: this.args.sourceId,
+						code,
+						signal,
+						unitsOut: this.unitsOut
+					}
+				});
+				this.args.plane.end("the fragment child exited");
+				this.deps.onChildExit?.(error);
+			});
+		});
+	}
+	/**
+	* The byte stream stopped being splittable. Not recoverable — the splitter
+	* cannot resynchronise mid-box — so the child is a corpse and every consumer
+	* has to be told, loudly, with the reason.
+	*/
+	onFault(reason, wasLive, current, settle) {
+		const error = /* @__PURE__ */ new Error(`fmp4 fragment child: ${reason}`);
+		this.deps.logger.error("fmp4 fragment child: the ffmpeg output stopped parsing as fMP4", {
+			tags: { deviceId: this.args.deviceId },
+			meta: {
+				sourceId: this.args.sourceId,
+				unitsOut: this.unitsOut,
+				interstitial: this.splitter.discardedInterstitialTypes,
+				reason
+			}
+		});
+		this.killChild();
+		settle(error);
+		if (wasLive && current) {
+			this.args.plane.end("the fragment child produced unsplittable output");
+			this.deps.onChildExit?.(error);
+		}
+	}
+	killChild() {
+		const child = this.child;
+		this.child = null;
+		if (child && !child.killed) try {
+			child.kill("SIGTERM");
+		} catch (err) {
+			this.deps.logger.warn("fmp4 fragment child: kill error", {
+				tags: { deviceId: this.args.deviceId },
+				meta: {
+					sourceId: this.args.sourceId,
+					error: require_err_msg.errMsg(err)
+				}
+			});
+		}
+	}
+};
+//#endregion
 exports.FfmpegProcess = FfmpegProcess;
 exports.FilesystemStorageProvider = FilesystemStorageProvider;
+exports.Fmp4FragmentChild = Fmp4FragmentChild;
+exports.Fmp4FragmentPlane = Fmp4FragmentPlane;
 exports.PYTHON_VERSION = PYTHON_VERSION;
 exports.buildBinaryPath = buildBinaryPath;
 exports.canonicalDeviceFingerprint = canonicalDeviceFingerprint;
-exports.canonicalHash = require_canonical_hash.canonicalHash;
+exports.canonicalHash = require_fmp4_box_splitter.canonicalHash;
 exports.diffExportTargets = diffExportTargets;
 exports.downloadBinary = downloadBinary;
 exports.ensureBinary = ensureBinary;