@homebridge-plugins/homebridge-eufy-security 5.0.0-beta.4 → 5.0.0-beta.40

package/dist/media/live-stream.js

@@ -1,9 +1,18 @@
-import { LiveStreamStartError } from '@mega-yfue/eufy-sdk';
+import { LiveStreamStartError, StationKeyUnavailableError, StationUnreachableError } from '@mega-yfue/eufy-sdk';
 import { createSocket } from 'node:dgram';
 import { execFile, spawn } from 'node:child_process';
+import { promisify } from 'node:util';
 import { setTimeout as delay } from 'node:timers/promises';
 /** How long a deliberately stopped adaptation process is given to exit before it is killed. */
-export const PROCESS_STOP_GRACE_MS = 2_000;
+const PROCESS_STOP_GRACE_MS = 2_000;
+/** Closes an adaptation process's input and terminates it, killing it if it has not exited within the grace. */
+export function stopProcess(process) {
+    process.stdin?.destroy();
+    process.kill('SIGTERM');
+    const killDeadline = setTimeout(() => process.kill('SIGKILL'), PROCESS_STOP_GRACE_MS);
+    killDeadline.unref?.();
+    process.on('exit', () => clearTimeout(killDeadline));
+}
 /**
  * Whether an adaptation opened for `running` can code what the source announced as `announced`.
  *
@@ -34,7 +43,18 @@ function canCode(running, announced) {
  */
 const MAX_SOURCE_INPUT_REPLACEMENTS = 3;
 const INITIAL_RTCP_GRACE_MS = 15_000;
-const SOURCE_ACQUISITION_DEADLINE_MS = 10_000;
+/**
+ * The longest a session waits for the SDK to hand over a source, after which it cancels the acquisition.
+ *
+ * Reaching a station is inside this wait: an unconnected station is reconnected within it, and a HomeBase
+ * resolves its session before it can start one. The bound is therefore above what reaching a station costs and
+ * below both {@link SOURCE_START_BACKSTOP_MS} and the window a started request is owed an outcome within, so
+ * the acquisition is what this expiry reports.
+ *
+ * Expiry cancels the acquisition. A station serves one media channel, and an uncancelled acquisition holds it
+ * until the SDK's own wait elapses, which refuses every camera behind that station meanwhile.
+ */
+const SOURCE_ACQUISITION_DEADLINE_MS = 25_000;
 const RETURN_AUDIO_BIND_GRACE_MS = 250;
 /**
  * Backstop for a started media session that never produces adapted output. The SDK source owns the
@@ -44,6 +64,20 @@ const RETURN_AUDIO_BIND_GRACE_MS = 250;
  * reports nothing at all.
  */
 export const SOURCE_START_BACKSTOP_MS = 30_000;
+/**
+ * How far the RTP sequence space is advanced for each adaptation a session sends on, in packets.
+ *
+ * One session keeps one SSRC and one SRTP key across a replaced adaptation, and the SRTP packet index is built
+ * from the sequence number — so a replacement that started where FFmpeg would have, at a random base, is read
+ * by the controller as replay half the time and its packets are discarded under a key that still
+ * authenticates. Nothing reports it: the controller goes on acknowledging what it received before, so RTCP
+ * liveness holds while the picture never advances again.
+ *
+ * Advancing instead of restarting keeps the index monotonic. The step is well under half the sequence space,
+ * which is what keeps the receiver's own index estimate correct across the wrap it eventually crosses; a gap
+ * this size reads as loss, which a controller already tolerates.
+ */
+const OUTPUT_SEQUENCE_STEP = 4_096;
 const SOURCE_ACQUISITION_TIMEOUT = Symbol('source-acquisition-timeout');
 /**
  * The bounded reason one SDK source failure reports.
@@ -51,14 +85,30 @@ const SOURCE_ACQUISITION_TIMEOUT = Symbol('source-acquisition-timeout');
  * The SDK stages a start that produced no keyframe by what the source delivered, and a start that carried
  * audio and never a single video frame is the one signature worth naming apart: measured on a real camera
  * that had been switched off, the source accepted the start, delivered audio for the whole warm-up window,
- * and reported `audio-only`. Every other stage is a source error, because nothing else distinguishes it
- * from a transport that failed.
+ * and reported `audio-only`. Any other warm-up that ran out of time is `source-warm-timeout`: the camera answered
+ * and the transport worked, it just sent no usable picture. Everything else is a source error, because nothing
+ * else distinguishes it from a transport that failed.
+ */
+function liveSourceFailure(error) {
+    if (!(error instanceof LiveStreamStartError)) {
+        return sourceFailure(error);
+    }
+    if (error.stage === 'audio-only') {
+        return 'source-audio-only';
+    }
+    return error.reason === 'warm-timeout' ? 'source-warm-timeout' : sourceFailure(error);
+}
+/**
+ * Why a source stopped producing, as this domain's bounded vocabulary.
+ *
+ * A station names its own failures apart from the camera's: every camera behind a base that did not connect
+ * fails together, and a sealed start the station gave no key for does not resolve by retrying.
  */
-function sourceFailure(error) {
-    if (error instanceof Error && error.name === 'StationBusyError') {
-        return 'station-busy';
+export function sourceFailure(error) {
+    if (error instanceof StationUnreachableError) {
+        return 'station-unreachable';
     }
-    return error instanceof LiveStreamStartError && error.stage === 'audio-only' ? 'source-audio-only' : 'source-error';
+    return error instanceof StationKeyUnavailableError ? 'station-key-unavailable' : 'source-error';
 }
 /** How many diagnostic lines one adaptation retains, which is what a failure is attributed from. */
 const ADAPTATION_STDERR_TAIL_LINES = 8;
@@ -136,12 +186,14 @@ const FFMPEG_VERSION_BANNER_LENGTH = 120;
  * to know whether this binary can be asked to encode: a missing file, a file that is not executable, one
  * that is not FFmpeg, and one that hangs all mean the same thing to the media that would have used it.
  */
-const probeFfmpegVersion = (path) => new Promise((resolve) => {
-    execFile(path, ['-hide_banner', '-version'], { timeout: FFMPEG_VERSION_PROBE_TIMEOUT_MS, maxBuffer: 64 * 1024, windowsHide: true }, (error, stdout) => {
-        const banner = error ? undefined : stdout.split(/\r?\n/, 1)[0]?.trim().slice(0, FFMPEG_VERSION_BANNER_LENGTH);
-        resolve(banner === undefined || banner === '' ? undefined : banner);
-    });
-});
+const probeFfmpegVersion = async (path) => {
+    const { stdout } = await promisify(execFile)(path, ['-hide_banner', '-version'], {
+        timeout: FFMPEG_VERSION_PROBE_TIMEOUT_MS,
+        maxBuffer: 64 * 1024,
+        windowsHide: true,
+    }).catch(() => ({ stdout: '' }));
+    return stdout.split(/\r?\n/, 1)[0]?.trim().slice(0, FFMPEG_VERSION_BANNER_LENGTH) || undefined;
+};
 /**
  * Resolves the complete identity of one adaptation binary, without opening any media.
  *
@@ -152,6 +204,281 @@ export async function resolveFfmpegIdentity(path, source, probe = probeFfmpegVer
     const version = await probe(path).catch(() => undefined);
     return { path, source, ...(version === undefined ? {} : { version }) };
 }
+/**
+ * Reports what one adaptation process did to `diagnostics`, whether or not the session it belonged to fails for it.
+ *
+ * An audio adaptation is restarted rather than failed and a return-audio one fails only talkback, so without a
+ * report of their own those two exit with no account anywhere of why they stopped. An `output` report carries
+ * nothing but the tail, so it is made only when the process actually wrote something: a silent process that
+ * ended as intended has nothing to attribute.
+ */
+export function adaptationReporter(diagnostics) {
+    return (role, event, stderr, code, signal, extras) => {
+        const tail = stderr.tail();
+        if (event === 'output' && tail.length === 0) {
+            return;
+        }
+        diagnostics?.report({
+            role,
+            event,
+            ...(typeof code === 'number' ? { code } : {}),
+            ...(typeof signal === 'string' ? { signal } : {}),
+            ...extras,
+            ...(tail.length ? { stderr: tail } : {}),
+        });
+    };
+}
+/** The `libx264` constant rate factor a live adaptation codes at when the negotiated bit rate is ignored. */
+const CONSTANT_QUALITY_CRF = 23;
+/** `libx264`'s profile, level, speed and pixel format, shared by its rate-capped and constant-quality forms. */
+function libx264Arguments(selection) {
+    return [
+        '-preset',
+        'superfast',
+        '-tune',
+        'zerolatency',
+        '-profile:v',
+        selection.profile,
+        '-level:v',
+        selection.level,
+        '-pix_fmt',
+        'yuv420p',
+    ];
+}
+/** The software encoder every selection no qualified hardware encoder serves is coded by. */
+const LIBX264 = {
+    name: 'libx264',
+    args: (selection, kbps) => [...libx264Arguments(selection), '-b:v', kbps, '-maxrate', kbps, '-bufsize', kbps],
+};
+/** `libx264` at {@link CONSTANT_QUALITY_CRF} with no rate control, which no hardware encoder replaces. */
+const CONSTANT_QUALITY = {
+    name: 'libx264',
+    args: (selection) => [...libx264Arguments(selection), '-crf', String(CONSTANT_QUALITY_CRF)],
+};
+/** The H.264 `profile_idc` of each negotiable profile. */
+const PROFILE_IDC = { baseline: 66, main: 77, high: 100 };
+/**
+ * The hardware encoders a selection may be served by, in order of preference, each with the hosts whose
+ * binary may carry it.
+ *
+ * Each states profile, level and rate control in its own encoder's spelling, with B-frames off and its
+ * lowest-latency mode, as docs/reference/hardware-encoder-viability.md records them. None is used for a
+ * selection until {@link FfmpegLiveMedia.qualify} has proven it against that selection.
+ */
+const HARDWARE_ENCODERS = [
+    {
+        name: 'h264_videotoolbox',
+        triedOn: (host) => host.platform === 'darwin',
+        args: (selection, kbps) => [
+            '-profile:v',
+            selection.profile,
+            '-level:v',
+            selection.level,
+            '-realtime',
+            '1',
+            '-prio_speed',
+            '1',
+            '-bf',
+            '0',
+            '-pix_fmt',
+            'yuv420p',
+            '-b:v',
+            kbps,
+            '-maxrate',
+            kbps,
+        ],
+    },
+    {
+        name: 'h264_qsv',
+        triedOn: (host) => host.platform === 'win32' || host.configured,
+        args: (selection, kbps) => [
+            '-profile:v',
+            selection.profile,
+            '-level:v',
+            selection.level.replace('.', ''),
+            '-pix_fmt',
+            'nv12',
+            '-bf',
+            '0',
+            '-look_ahead',
+            '0',
+            '-async_depth',
+            '1',
+            '-b:v',
+            kbps,
+            '-maxrate',
+            kbps,
+        ],
+    },
+    {
+        name: 'h264_nvenc',
+        triedOn: (host) => host.configured,
+        args: (selection, kbps) => [
+            '-profile:v',
+            selection.profile,
+            '-level:v',
+            selection.level,
+            '-preset',
+            'p1',
+            '-tune',
+            'ull',
+            '-zerolatency',
+            '1',
+            '-bf',
+            '0',
+            '-pix_fmt',
+            'yuv420p',
+            '-rc',
+            'cbr',
+            '-b:v',
+            kbps,
+            '-maxrate',
+            kbps,
+            '-bufsize',
+            kbps,
+        ],
+    },
+    {
+        name: 'h264_amf',
+        triedOn: (host) => host.platform === 'linux' && host.arch === 'x64',
+        args: (selection, kbps) => [
+            '-profile:v',
+            selection.profile === 'baseline' ? 'constrained_baseline' : selection.profile,
+            '-level:v',
+            selection.level,
+            '-usage',
+            'ultralowlatency',
+            '-bf',
+            '0',
+            '-pix_fmt',
+            'yuv420p',
+            '-b:v',
+            kbps,
+            '-maxrate',
+            kbps,
+            '-bufsize',
+            kbps,
+        ],
+    },
+    {
+        name: 'h264_vaapi',
+        triedOn: (host) => host.platform === 'linux' && host.configured,
+        upload: ',format=nv12,hwupload',
+        args: (selection, kbps) => [
+            '-vaapi_device',
+            '/dev/dri/renderD128',
+            '-profile:v',
+            selection.profile === 'baseline' ? 'constrained_baseline' : selection.profile,
+            '-level:v',
+            selection.level,
+            '-bf',
+            '0',
+            '-async_depth',
+            '1',
+            '-b:v',
+            kbps,
+            '-maxrate',
+            kbps,
+        ],
+    },
+    {
+        name: 'h264_v4l2m2m',
+        triedOn: (host) => host.platform === 'linux' && (host.arch === 'arm' || host.arch === 'arm64'),
+        args: (selection, kbps) => [
+            '-profile:v',
+            String(PROFILE_IDC[selection.profile]),
+            '-pix_fmt',
+            'yuv420p',
+            '-b:v',
+            kbps,
+        ],
+    },
+];
+/** How many seconds of synthetic picture one qualification run codes. */
+const QUALIFICATION_SECONDS = 2;
+/** The longest one qualification process may run before its selection counts as unqualified. */
+const QUALIFICATION_RUN_TIMEOUT_MS = 10_000;
+/** The longest qualification as a whole may take; a selection it has not finished by then stays unqualified. */
+const QUALIFICATION_BUDGET_MS = 60_000;
+/**
+ * The selections every hardware encoder is qualified against: each advertised profile and level, at the
+ * largest advertised geometry that level's frame-size limit admits, at the advertised frame-rate ceiling, and
+ * at 299 kbps, the lowest bit rate a controller has been measured selecting.
+ */
+const QUALIFICATION_SELECTIONS = ['baseline', 'main', 'high'].flatMap((profile) => [
+    ['3.1', 1280, 720],
+    ['3.2', 1280, 720],
+    ['4.0', 1920, 1080],
+].map(([level, width, height]) => ({
+    profile,
+    level,
+    width,
+    height,
+    fps: 30,
+    maxBitRate: 299,
+    mtu: 1378,
+    payloadType: 99,
+    ssrc: 1,
+    rtcpInterval: 0.5,
+})));
+const runQualification = (executable, args, input, timeoutMs) => new Promise((resolve) => {
+    const child = execFile(executable, args, { encoding: 'buffer', timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024, windowsHide: true }, (error, stdout, stderr) => resolve(error ? undefined : { stdout, stderr: stderr.toString() }));
+    child.stdin?.on('error', () => undefined);
+    child.stdin?.end(input);
+});
+/**
+ * Qualifies `encoder` for `selection` before `deadline`.
+ *
+ * The encoder codes {@link QUALIFICATION_SECONDS} of moving synthetic picture through the session's own
+ * argument list, which proves it is named by the binary, accepts those arguments, and opens on this host's
+ * devices. A second FFmpeg then traces the coded parameter sets, which proves what was coded: a profile at or
+ * below the negotiated one, the negotiated level and macroblock geometry, every frame, and no more bytes than
+ * the encoder budget plus the one second of it the session's rate control may borrow.
+ */
+async function qualification(executable, encoder, selection, run, deadline) {
+    const within = (args, input) => {
+        const left = deadline - Date.now();
+        return left > 0 ? run(executable, args, input, Math.min(left, QUALIFICATION_RUN_TIMEOUT_MS)) : 'budget';
+    };
+    const coded = await within([
+        '-hide_banner',
+        '-loglevel',
+        'error',
+        '-f',
+        'lavfi',
+        '-i',
+        `testsrc2=size=${selection.width}x${selection.height}:rate=${selection.fps}:duration=${QUALIFICATION_SECONDS}`,
+        ...encodeArguments(encoder, selection),
+        '-f',
+        'h264',
+        'pipe:1',
+    ]);
+    if (!coded || coded === 'budget') {
+        return coded ?? 'encode';
+    }
+    const traced = await within(['-hide_banner', '-f', 'h264', '-i', 'pipe:0', '-c', 'copy', '-bsf:v', 'trace_headers', '-f', 'null', '-'], coded.stdout);
+    if (!traced || traced === 'budget') {
+        return traced ?? 'trace';
+    }
+    const field = (name) => Number(new RegExp(`\\b${name}\\s.*= (\\d+)$`, 'm').exec(traced.stderr)?.[1]);
+    const profile = field('profile_idc');
+    const wanted = PROFILE_IDC[selection.profile];
+    const checks = [
+        ['profile', profile === wanted || (profile === 66 && field('constraint_set1_flag') === 1) || (profile === 77 && wanted === 100)],
+        ['level', field('level_idc') === Number(selection.level.replace('.', ''))],
+        [
+            'geometry',
+            field('pic_width_in_mbs_minus1') + 1 === Math.ceil(selection.width / 16) &&
+                field('pic_height_in_map_units_minus1') + 1 === Math.ceil(selection.height / 16),
+        ],
+        ['frames', (traced.stderr.match(/\bPacket: /g)?.length ?? 0) === selection.fps * QUALIFICATION_SECONDS],
+    ];
+    const bound = videoBudgetInsideCeiling(selection) * 125 * (QUALIFICATION_SECONDS + 1);
+    return (checks.find(([, passed]) => !passed)?.[0] ??
+        (coded.stdout.length <= bound ? 'qualified' : ['bytes', coded.stdout.length, bound]));
+}
+/** The live video packet size an administrator can choose for networks that drop the negotiated one. */
+export const SMALL_VIDEO_PACKET_SIZE = 1128;
 /** Adapts separate SDK elementary streams into independently failing HomeKit SRTP outputs. */
 export class FfmpegLiveMedia {
     executable;
@@ -159,12 +486,79 @@ export class FfmpegLiveMedia {
     createProcess;
     reservePort;
     createReturnAudioProcess;
-    constructor(executable, adaptationDiagnostics, createProcess = spawnLiveMediaProcess, reservePort = reserveMediaPort, createReturnAudioProcess = spawnReturnAudioProcess) {
+    maxVideoPacketSize;
+    copyVideo;
+    constantQuality;
+    constructor(executable, adaptationDiagnostics, createProcess = spawnLiveMediaProcess, reservePort = reserveMediaPort, createReturnAudioProcess = spawnReturnAudioProcess, maxVideoPacketSize = Number.POSITIVE_INFINITY, copyVideo = false, constantQuality = false) {
         this.executable = executable;
         this.adaptationDiagnostics = adaptationDiagnostics;
         this.createProcess = createProcess;
         this.reservePort = reservePort;
         this.createReturnAudioProcess = createReturnAudioProcess;
+        this.maxVideoPacketSize = maxVideoPacketSize;
+        this.copyVideo = copyVideo;
+        this.constantQuality = constantQuality;
+    }
+    /**
+     * Each hardware encoder's qualified selections, as `profile@level`, for the rest of this run.
+     *
+     * A spawn reads it, so a selection is served by hardware from the moment it qualifies, and an encoder that
+     * exits before output in a session is removed from it and serves nothing again.
+     */
+    qualified = new Map();
+    /**
+     * Qualifies every hardware encoder `host`'s binary may carry against every selection it is qualified for,
+     * one run after another and within {@link QUALIFICATION_BUDGET_MS}, and returns each tried encoder's
+     * outcome per `profile@level`.
+     *
+     * Until a selection qualifies it is coded by `libx264`, and a selection no encoder qualifies for stays there.
+     */
+    async qualify(host, run = runQualification) {
+        const deadline = Date.now() + QUALIFICATION_BUDGET_MS;
+        const outcomes = {};
+        for (const encoder of HARDWARE_ENCODERS.filter((candidate) => candidate.triedOn(host))) {
+            const tried = (outcomes[encoder.name] = {});
+            for (const selection of QUALIFICATION_SELECTIONS) {
+                const key = `${selection.profile}@${selection.level}`;
+                tried[key] = await qualification(this.executable, encoder, selection, run, deadline);
+                if (tried[key] === 'qualified') {
+                    this.qualified.set(encoder.name, (this.qualified.get(encoder.name) ?? new Set()).add(key));
+                }
+            }
+        }
+        return outcomes;
+    }
+    /**
+     * What a session codes `selection` from a `codec` source with: `copy` for a passed-through H.264 source,
+     * {@link CONSTANT_QUALITY} where the negotiated bit rate is ignored, else the first hardware encoder qualified
+     * for `selection`, or `libx264` where none is or `settings` turn hardware off. Without `settings`, this
+     * adapter's own.
+     */
+    encoderFor(codec, selection, settings) {
+        if ((settings?.liveVideoPassthrough ?? this.copyVideo) && codec === 'h264')
+            return 'copy';
+        if (settings?.ignoreHomeBitRate ?? this.constantQuality)
+            return CONSTANT_QUALITY;
+        if (settings?.hardwareVideoEncoder === false)
+            return LIBX264;
+        const key = `${selection.profile}@${selection.level}`;
+        return HARDWARE_ENCODERS.find((encoder) => this.qualified.get(encoder.name)?.has(key)) ?? LIBX264;
+    }
+    /** The largest video packet a session sends under `settings`, or under this adapter's own without them. */
+    packetSize(settings) {
+        if (!settings)
+            return this.maxVideoPacketSize;
+        return settings.smallVideoPackets ? SMALL_VIDEO_PACKET_SIZE : Number.POSITIVE_INFINITY;
+    }
+    /**
+     * The encoder and the argument list a session would code `selection` from a `codec` source with, its video
+     * written to `output` instead of RTP: every argument before `output` is the session's own, or that of a session
+     * of an adapter configured with `settings`.
+     */
+    videoAdaptation(codec, selection, output, settings) {
+        const video = { ...selection, mtu: Math.min(selection.mtu, this.packetSize(settings)) };
+        const encoder = this.encoderFor(codec, video, settings);
+        return { encoder: encoder === 'copy' ? encoder : encoder.name, args: videoArguments(codec, video, encoder, output) };
     }
     /**
      * Reserves the negotiated output ports so `SetupEndpoints` can be answered with them, and returns a
@@ -175,6 +569,7 @@ export class FfmpegLiveMedia {
     async prepare(transport) {
         const videoPort = await this.reservePort(transport.addressVersion);
         const targetAddress = transport.addressVersion === 'ipv6' ? `[${transport.targetAddress}]` : transport.targetAddress;
+        const maxVideoPacketSize = this.packetSize(transport.liveVideoSettings);
         let audioPort;
         try {
             audioPort = transport.audio ? await this.reservePort(transport.addressVersion) : undefined;
@@ -184,6 +579,13 @@ export class FfmpegLiveMedia {
             throw error;
         }
         let source;
+        /**
+         * Cancels the source acquisition in flight, and is held for exactly as long as one is.
+         *
+         * The station's one media channel is held for the whole of an uncancelled acquisition, so a session that
+         * ends during one cancels it rather than leaving it to the SDK's own wait.
+         */
+        let acquiring;
         let videoProcess;
         let audioProcess;
         let returnAudioProcess;
@@ -194,7 +596,6 @@ export class FfmpegLiveMedia {
         let negotiated;
         let stopped = false;
         let receivedVideoKeyframe = false;
-        let reconfigurationPending = false;
         /**
          * The coded configuration the source last announced, and the one the running adaptation was opened for.
          *
@@ -208,11 +609,20 @@ export class FfmpegLiveMedia {
         /** How many adaptation replacements the source's own changes have asked this session for. */
         let sourceInputReplacements = 0;
         let audioInputCodec;
+        /** An audio adaptation that exited before any output cannot code this source, so none is started again. */
+        let audioFailed = false;
         let rtcpDeadline;
         let initialRtcpGrace;
         let videoStartBackstop;
         let videoFailed = false;
         let rtcpObserved = false;
+        /** How many receiver reports this session was acknowledged by, and when the last one arrived. */
+        /** Why the video adaptation now running was started, which the record reporting it carries. */
+        let videoCause = 'first';
+        /** Where the next adaptation this session sends on starts its RTP sequence, advanced for every one. */
+        let videoSequence = 0;
+        let rtcpReports = 0;
+        let lastRtcpAt;
         let streaming = false;
         const stoppingProcesses = new WeakSet();
         const congested = new Set();
@@ -253,38 +663,14 @@ export class FfmpegLiveMedia {
             }
             sink.once('drain', () => releaseAdaptation(sink));
         };
-        /**
-         * Reports what one adaptation process did, whether or not the session it belonged to fails for it.
-         *
-         * An audio adaptation is restarted rather than failed and a return-audio one fails only talkback, so
-         * without a report of their own those two exit with no account anywhere of why they stopped. An `output`
-         * report carries nothing but the tail, so it is made only when the process actually wrote something:
-         * a silent process that ended as intended has nothing to attribute.
-         */
-        const reportAdaptation = (role, event, stderr, code, signal) => {
-            const tail = stderr.tail();
-            if (event === 'output' && tail.length === 0) {
-                return;
-            }
-            adaptationDiagnostics?.report({
-                role,
-                event,
-                ...(typeof code === 'number' ? { code } : {}),
-                ...(typeof signal === 'string' ? { signal } : {}),
-                ...(tail.length ? { stderr: tail } : {}),
-            });
-        };
-        const stopProcess = (process) => {
+        const reportAdaptation = adaptationReporter(adaptationDiagnostics);
+        const stopAdaptation = (process) => {
             if (!process) {
                 return;
             }
             stoppingProcesses.add(process);
-            process.stdin.destroy();
+            stopProcess(process);
             releaseAdaptation(process.stdin);
-            process.kill('SIGTERM');
-            const killDeadline = setTimeout(() => process.kill('SIGKILL'), PROCESS_STOP_GRACE_MS);
-            killDeadline.unref?.();
-            process.on('exit', () => clearTimeout(killDeadline));
         };
         /** Stop a caller-owned SDK handle without allowing synchronous or asynchronous faults to abort cleanup. */
         const stopTalkbackHandle = (handle) => {
@@ -298,7 +684,9 @@ export class FfmpegLiveMedia {
                 return;
             }
             talkbackEnded = true;
-            stopProcess(returnAudioProcess);
+            stopAdaptation(returnAudioProcess);
+            returnAudioProcess?.stdout.destroy();
+            returnAudioProcess?.eld.destroy();
             returnAudioProcess = undefined;
             talkbackSink?.destroy();
             talkbackSink = undefined;
@@ -320,33 +708,43 @@ export class FfmpegLiveMedia {
                 return;
             }
             stopped = true;
+            acquiring?.abort(new Error('live media session stopped'));
             clearTimeout(rtcpDeadline);
             clearTimeout(initialRtcpGrace);
             clearTimeout(videoStartBackstop);
             stopTalkback();
-            stopProcess(videoProcess);
-            stopProcess(audioProcess);
-            if (source) {
-                source.stop();
-                transport.onSessionReleased?.();
+            stopAdaptation(videoProcess);
+            stopAdaptation(audioProcess);
+            source?.stop();
+            if (negotiated) {
+                transport.onSessionReleased?.(videoFailed ? 'failed' : 'requested', {
+                    reports: rtcpReports,
+                    ...(lastRtcpAt === undefined ? {} : { sinceLastReportMs: Date.now() - lastRtcpAt }),
+                }, ...(source === undefined ? ['sdk-source-acquisition'] : []));
             }
             videoPort.close();
             audioPort?.close();
         };
-        const failVideo = (reason) => {
+        const failVideo = (reason, error) => {
             if (stopped || videoFailed) {
                 return;
             }
             videoFailed = true;
             stop();
+            const warmUp = error instanceof LiveStreamStartError;
             const stage = reason === 'source-acquisition-timeout' || source === undefined
                 ? 'sdk-source-acquisition'
                 : reason === 'rtcp-timeout'
                     ? 'controller-rtcp'
-                    : !receivedVideoKeyframe
+                    : warmUp || !receivedVideoKeyframe
                         ? 'first-source-keyframe'
                         : 'first-adapted-output';
-            transport.onSessionOutcome?.({ outcome: 'failed', reason, stage });
+            transport.onSessionOutcome?.({
+                outcome: 'failed',
+                reason,
+                stage,
+                ...(warmUp ? { sourceStage: error.stage, sourceReason: error.reason } : {}),
+            });
             transport.onVideoFailure?.();
         };
         /**
@@ -357,6 +755,8 @@ export class FfmpegLiveMedia {
          */
         const resetRtcpDeadline = () => {
             rtcpObserved = true;
+            rtcpReports += 1;
+            lastRtcpAt = Date.now();
             clearTimeout(initialRtcpGrace);
             clearTimeout(rtcpDeadline);
             if (!streaming) {
@@ -371,13 +771,9 @@ export class FfmpegLiveMedia {
          * Adaptation reached the negotiated output, so the session is bounded from here by RTCP liveness
          * rather than by the start backstop. The initial grace is armed from this point because media may
          * legitimately start well after the session does.
-         *
-         * A selection HomeKit has already replaced does not discharge the deadline for its replacement, however
-         * much it keeps reporting: FFmpeg reports progress on a timer whether or not new media reaches it, so
-         * only the adaptation that carries the current selection can say that selection is being served.
          */
-        const observeAdaptationProgress = (reporter) => {
-            if (stopped || (reconfigurationPending && reporter === videoProcess)) {
+        const observeAdaptationProgress = () => {
+            if (stopped) {
                 return;
             }
             clearTimeout(videoStartBackstop);
@@ -406,13 +802,12 @@ export class FfmpegLiveMedia {
          * Writes one source access unit to the adaptation that is entitled to code it.
          *
          * A source configuration the running adaptation was not opened for cannot be coded by it at all, so those
-         * frames wait for the keyframe that lets a replacement start. A reconfigured HomeKit selection changes
-         * only the output, so the current process keeps coding and keeps the previous selection on the wire until
-         * that same keyframe arrives; a controller reconfigures precisely when it is unhappy with what it
-         * receives, and the source is then often the very thing not producing keyframes.
+         * frames wait for the keyframe that lets a replacement start.
          *
          * Source-driven replacement is bounded by {@link MAX_SOURCE_INPUT_REPLACEMENTS}, past which the session
-         * fails rather than spawn again. A controller-driven one is not: the controller bounds how often it asks.
+         * fails rather than spawn again. It is the only replacement a session makes: a source that changes what it
+         * delivers cannot be coded by the running process at all, whereas a controller's renegotiated selection is
+         * a request this session declines in favour of the one it started on.
          */
         const writeVideo = (frame) => {
             if (stopped || !negotiated || !videoConfig) {
@@ -428,29 +823,39 @@ export class FfmpegLiveMedia {
             if (videoProcess && inputChanged && !frame.keyframe) {
                 return;
             }
-            if (videoProcess && frame.keyframe && (inputChanged || reconfigurationPending)) {
-                if (inputChanged) {
-                    sourceInputReplacements += 1;
-                }
+            if (videoProcess && frame.keyframe && inputChanged) {
+                sourceInputReplacements += 1;
                 if (sourceInputReplacements > MAX_SOURCE_INPUT_REPLACEMENTS) {
                     failVideo('source-input-unstable');
                     return;
                 }
-                reconfigurationPending = false;
-                stopProcess(videoProcess);
+                videoCause = 'source-configuration';
+                stopAdaptation(videoProcess);
                 videoProcess = undefined;
             }
             if (!videoProcess) {
                 adaptationConfig = videoConfig;
-                const child = this.createProcess(this.executable, videoArguments(videoConfig, negotiated.video, targetAddress, transport.video));
+                videoSequence = (videoSequence + OUTPUT_SEQUENCE_STEP) & 0xffff;
+                const { video } = negotiated;
+                const encoder = this.encoderFor(videoConfig.codec, video, transport.liveVideoSettings);
+                const child = this.createProcess(this.executable, videoArguments(videoConfig.codec, video, encoder, outputArguments(targetAddress, transport.video, video.payloadType, video.ssrc, video.mtu, videoSequence)));
                 videoProcess = child;
-                adaptationDiagnostics?.report({ role: 'live-video', event: 'started' });
+                const encoderName = encoder === 'copy' ? encoder : encoder.name;
+                adaptationDiagnostics?.report({
+                    role: 'live-video',
+                    event: 'started',
+                    cause: videoCause,
+                    encoder: encoderName,
+                    source: videoConfig.codec,
+                    sourceWidth: videoConfig.width,
+                    sourceHeight: videoConfig.height,
+                });
                 const stderr = new AdaptationStderr();
                 let producedOutput = false;
                 child.stderr.on('data', (chunk) => {
                     if (stderr.observe(chunk).some((line) => line.startsWith('progress='))) {
                         producedOutput = true;
-                        observeAdaptationProgress(child);
+                        observeAdaptationProgress();
                     }
                 });
                 child.stdin.on('error', () => {
@@ -472,19 +877,25 @@ export class FfmpegLiveMedia {
                         return;
                     }
                     reportAdaptation('live-video', producedOutput ? 'exited-while-streaming' : 'exited-before-output', stderr, code, signal);
+                    if (!producedOutput && this.qualified.delete(encoderName)) {
+                        adaptationDiagnostics?.report({ role: 'live-video', event: 'encoder-disqualified', encoder: encoderName });
+                    }
                     failVideo(producedOutput ? 'adaptation-exited-while-streaming' : 'adaptation-exited-before-output');
                 });
             }
             writeToAdaptation(videoProcess.stdin, frame.data);
         };
         const writeAudio = (frame) => {
-            if (stopped || !negotiated?.audio || !transport.audio || !audioPort) {
+            if (stopped || audioFailed || !negotiated?.audio || !transport.audio || !audioPort) {
                 return;
             }
             if (!audioProcess) {
                 audioInputCodec = frame.codec;
                 const child = this.createProcess(this.executable, audioArguments(frame, negotiated.audio, targetAddress, transport.audio));
                 audioProcess = child;
+                if (frame.config) {
+                    writeToAdaptation(child.stdin, Buffer.concat([FLV_FILE_HEADER, flvAacTag(0, frame.config)]));
+                }
                 adaptationDiagnostics?.report({ role: 'live-audio', event: 'started' });
                 const stderr = new AdaptationStderr();
                 let producedOutput = false;
@@ -509,44 +920,50 @@ export class FfmpegLiveMedia {
                     if (!stoppingProcesses.has(child) && audioProcess === child) {
                         reportAdaptation('live-audio', 'input-failed', stderr);
                     }
-                    stopProcess(child);
+                    stopAdaptation(child);
                     clearChild();
                 });
                 child.on('error', () => {
                     if (!stoppingProcesses.has(child)) {
                         reportAdaptation('live-audio', producedOutput ? 'exited-while-streaming' : 'spawn-failed', stderr);
                     }
-                    stopProcess(child);
+                    stopAdaptation(child);
                     clearChild();
                 });
                 child.on('exit', (code, signal) => {
-                    reportAdaptation('live-audio', stopped || stoppingProcesses.has(child)
+                    const event = stopped || stoppingProcesses.has(child)
                         ? 'output'
                         : producedOutput
                             ? 'exited-while-streaming'
-                            : 'exited-before-output', stderr, code, signal);
+                            : 'exited-before-output';
+                    audioFailed ||= event === 'exited-before-output';
+                    reportAdaptation('live-audio', event, stderr, code, signal);
                     clearChild();
                 });
             }
             if (audioInputCodec !== frame.codec) {
-                stopProcess(audioProcess);
+                stopAdaptation(audioProcess);
                 audioProcess = undefined;
                 audioInputCodec = undefined;
                 writeAudio(frame);
                 return;
             }
-            writeToAdaptation(audioProcess.stdin, frame.data);
+            writeToAdaptation(audioProcess.stdin, frame.config ? flvAacTag(1, frame.data) : frame.data);
         };
         /**
          * Write one decoded return-audio chunk through the SDK writable that owns ADTS frame recovery,
          * validation, pacing, and transport backpressure. The first chunk opens exactly one SDK handle;
          * stdout stays paused while that handle is acquired so acquisition cannot create an unbounded queue.
+         * Once the handle's `codec` is `aac-eld`, ADTS output is discarded and fd 3 feeds the handle instead.
          */
         const writeReturnAudio = (camera, child, chunk) => {
             if (stopped || talkbackEnded) {
                 return;
             }
             if (talkbackSink) {
+                if (talkbackHandle?.codec === 'aac-eld') {
+                    return;
+                }
                 try {
                     if (!talkbackSink.write(chunk)) {
                         child.stdout.pause();
@@ -596,6 +1013,14 @@ export class FfmpegLiveMedia {
                         }
                     });
                     sink.on('error', () => failTalkback('device-audio-failed'));
+                    if (handle.codec === 'aac-eld') {
+                        const reader = new FlvAacReader();
+                        child.eld.on('data', (eldChunk) => writeReturnFrames(child, reader, sink, eldChunk));
+                        child.stdout.resume();
+                        transport.onTalkbackOutcome?.({ outcome: 'talking' });
+                        return;
+                    }
+                    child.eld.resume();
                     const accepted = sink.write(chunk);
                     if (talkbackEnded) {
                         return;
@@ -617,10 +1042,33 @@ export class FfmpegLiveMedia {
                 }
             }, () => failTalkback('source-unavailable'));
         };
+        /**
+         * Write the access units completed by one ELD output chunk through the SDK's object-mode writable,
+         * holding fd 3 from the first refusal until that writable drains. What stays buffered is the SDK's
+         * bounded pacing queue and at most the rest of the one read that was in hand. A write that fails or
+         * ends the talkback stops the loop.
+         */
+        const writeReturnFrames = (child, reader, sink, chunk) => {
+            for (const data of reader.push(chunk)) {
+                if (stopped || talkbackEnded) {
+                    return;
+                }
+                if (!sink.write(data) && !child.eld.isPaused()) {
+                    child.eld.pause();
+                    sink.once('drain', () => {
+                        if (!stopped && !talkbackEnded) {
+                            child.eld.resume();
+                        }
+                    });
+                }
+            }
+        };
         /**
          * Hand the accessory audio endpoint to FFmpeg and give the spawned process a bounded bind grace before
          * stream start is acknowledged. FFmpeg owns SRTP authentication, RTP AAC-ELD depacketization, decoding,
-         * and AAC-LC ADTS encoding; the SDK handle remains unopened until the process produces decoded audio.
+         * the AAC-LC ADTS encoding on stdout, and the copy of HomeKit's AAC-ELD access units on fd 3; the SDK
+         * handle remains unopened until the process produces decoded audio, and the handle's `codec` then
+         * selects the ADTS output (stdout) or the ELD output (fd 3).
          */
         const startReturnAudio = async (camera, selection) => {
             if (!camera.talkback || !selection || !transport.audio || !audioPort) {
@@ -640,22 +1088,19 @@ export class FfmpegLiveMedia {
                 const stderr = new AdaptationStderr();
                 let producedOutput = false;
                 child.stderr.on('data', (chunk) => stderr.observe(chunk));
-                child.stdin.on('error', () => {
+                const failInput = () => {
                     if (!stopped && !talkbackEnded && !stoppingProcesses.has(child)) {
                         reportAdaptation('return-audio', 'input-failed', stderr);
                         failTalkback('adaptation-failed');
                     }
-                });
+                };
+                child.stdin.on('error', failInput);
                 child.stdout.on('data', (chunk) => {
                     producedOutput = true;
                     writeReturnAudio(camera, child, chunk);
                 });
-                child.stdout.on('error', () => {
-                    if (!stopped && !talkbackEnded && !stoppingProcesses.has(child)) {
-                        reportAdaptation('return-audio', 'input-failed', stderr);
-                        failTalkback('adaptation-failed');
-                    }
-                });
+                child.stdout.on('error', failInput);
+                child.eld.on('error', failInput);
                 child.on('error', () => {
                     if (!stoppingProcesses.has(child)) {
                         reportAdaptation('return-audio', producedOutput ? 'exited-while-streaming' : 'spawn-failed', stderr);
@@ -668,7 +1113,11 @@ export class FfmpegLiveMedia {
                         return;
                     }
                     reportAdaptation('return-audio', producedOutput ? 'exited-while-streaming' : 'exited-before-output', stderr, code, signal);
-                    failTalkback('adaptation-failed');
+                    failTalkback(!stderr.tail().some((line) => line.includes('Error during demuxing: Operation timed out'))
+                        ? 'adaptation-failed'
+                        : receivedVideoKeyframe
+                            ? 'no-controller-audio'
+                            : 'source-unavailable');
                 });
                 child.stdin.end(returnAudioSdp(audioPort.port, selection, transport.audio, transport.addressVersion));
                 await delay(RETURN_AUDIO_BIND_GRACE_MS);
@@ -684,12 +1133,14 @@ export class FfmpegLiveMedia {
                 if (stopped) {
                     throw new Error('live media session is already stopped');
                 }
-                negotiated = selection;
+                negotiated = { ...selection, video: { ...selection.video, mtu: Math.min(selection.video.mtu, maxVideoPacketSize) } };
                 const returnAudioReady = startReturnAudio(camera, selection.audio);
                 let sourcePromise;
                 let acquisitionDeadline;
+                const acquisition = new AbortController();
+                acquiring = acquisition;
                 try {
-                    sourcePromise = camera.live();
+                    sourcePromise = camera.live({ signal: acquisition.signal });
                     void sourcePromise.then((lateSource) => {
                         if (stopped && source !== lateSource) {
                             lateSource.stop();
@@ -704,11 +1155,13 @@ export class FfmpegLiveMedia {
                     ]);
                 }
                 catch (error) {
-                    failVideo(error === SOURCE_ACQUISITION_TIMEOUT ? 'source-acquisition-timeout' : sourceFailure(error));
+                    acquisition.abort(new Error('live media source acquisition was cancelled'));
+                    failVideo(error === SOURCE_ACQUISITION_TIMEOUT ? 'source-acquisition-timeout' : liveSourceFailure(error), error);
                     throw error === SOURCE_ACQUISITION_TIMEOUT ? new Error('live media source acquisition timed out') : error;
                 }
                 finally {
                     clearTimeout(acquisitionDeadline);
+                    acquiring = undefined;
                 }
                 if (stopped) {
                     source.stop();
@@ -724,49 +1177,31 @@ export class FfmpegLiveMedia {
                         notice.extend();
                     }
                 });
-                source.on('error', (error) => failVideo(sourceFailure(error)));
+                source.on('error', (error) => failVideo(liveSourceFailure(error), error));
                 source.on('stop', () => failVideo('source-stopped'));
                 await returnAudioReady;
             },
-            /**
-             * Acknowledges a reconfigured selection and applies it at the next source keyframe.
-             *
-             * Nothing is torn down here: the current adaptation keeps the previous selection on the wire until the
-             * replacement has a keyframe to start from. The deferral is still bounded, because a session that never
-             * applies the selection HomeKit asked for must end and be renegotiated rather than silently serve the
-             * old one forever.
-             */
-            reconfigure(video) {
-                if (!negotiated) {
-                    return;
-                }
-                negotiated = { ...negotiated, video };
-                reconfigurationPending = videoProcess !== undefined;
-                clearTimeout(videoStartBackstop);
-                videoStartBackstop = setTimeout(() => failVideo('no-video-within-backstop'), SOURCE_START_BACKSTOP_MS);
-                videoStartBackstop.unref?.();
-            },
             stop,
         };
     }
 }
 /**
- * Options every adapted elementary stream applies to its own input.
+ * Options every adapted input applies to itself: a piped elementary stream, or audio framed as FLV.
  *
- * A piped elementary stream carries no container, so FFmpeg's initial stream analysis is the only thing
- * standing between the first written access unit and the first coded frame. The caller already declares the
- * format, so that analysis has nothing left to discover and is bounded to its minimum; leaving it at the
+ * FFmpeg's initial stream analysis is the only thing standing between the first written access unit and the
+ * first coded frame. The caller already declares the format, and an FLV input states its decoder config in its
+ * first tag, so that analysis has nothing left to discover and is bounded to its minimum; leaving it at the
  * default delays first output by seconds and scales that delay with the source keyframe interval.
  *
- * Every such input is read on one clock: when its media arrived. A pipe carries no timeline of its own, so
- * arrival is the only timeline there is, and two adapted streams of one session can be presented together
- * only while both are read on it.
+ * Every such input is read on one clock: when its media arrived. An elementary stream carries no timeline of its
+ * own and the FLV tags this plugin writes carry none either, so arrival is the only timeline there is, and two
+ * adapted streams of one session can be presented together only while both are read on it.
  *
  * Nothing asks FFmpeg to discard or reinterpret what it read. Discarding the analysed packets throws away the
  * leading keyframe the caller waited for, and a raw A-law demuxer stops emitting timestamps entirely, so both
  * cost media that was already in hand.
  */
-function commonArguments(inputFormat, inputOptions = []) {
+export function commonArguments(inputFormat, inputOptions = []) {
     return [
         '-hide_banner',
         '-loglevel',
@@ -787,12 +1222,21 @@ function commonArguments(inputFormat, inputOptions = []) {
         'pipe:0',
     ];
 }
-function outputArguments(targetAddress, target, payloadType, ssrc, packetSize) {
+/**
+ * The RTP output one adaptation sends on: the controller's endpoint, the identity the session negotiated for
+ * it, and where its sequence numbering starts.
+ *
+ * `sequence` is stated wherever a session may send on more than one adaptation, because the identity and the
+ * SRTP key outlive the process: see {@link OUTPUT_SEQUENCE_STEP} for what a restarted numbering costs. An
+ * output no replacement can follow omits it and keeps FFmpeg's own base.
+ */
+function outputArguments(targetAddress, target, payloadType, ssrc, packetSize, sequence) {
     return [
         '-payload_type',
         String(payloadType),
         '-ssrc',
         String(ssrc),
+        ...(sequence === undefined ? [] : ['-seq', String(sequence)]),
         '-f',
         'rtp',
         '-srtp_out_suite',
@@ -811,11 +1255,19 @@ function outputArguments(targetAddress, target, payloadType, ssrc, packetSize) {
  * every frame it was given.
  *
  * A negotiated frame rate is a CEILING, not a cadence, so the rate is bounded rather than pinned. Pinning it
- * makes the encoder duplicate frames the source never sent, and each duplicate costs a full encode and a share
- * of the negotiated bit rate for a picture carrying nothing new. Measured on a 1600x1200 doorbell delivering
- * about 15 fps against a 30 fps selection: 264 of 267 emitted frames were duplicates and the adaptation ran at
- * 0.32x real time, so it fell further behind every second and the session died on its backstop with nothing
- * watchable reaching the controller.
+ * with `-r` makes the encoder interpolate a cadence a bare Annex-B pipe never states, which collapses a session
+ * onto one instant.
+ *
+ * The output is constant-rate, which fills a gap in arrival with a duplicate of the last picture rather than
+ * carrying the gap. A duplicate costs a full encode and a share of the negotiated bit rate for a frame carrying
+ * nothing new, and a source over this transport gaps as its normal case: measured on the bundled encoder against
+ * a 15 fps arrival stalled 1.5 seconds after every second of media, a constant rate emitted 266 frames of which
+ * 146 were duplicates, against 120 frames and none when the arrival timestamps were passed through, at the same
+ * 0.90x real time either way. What the duplicates buy is a dense presentation timeline: a controller shown the
+ * gaps instead displays a picture that visibly jumps at every one of them.
+ *
+ * `-fpsmax` states that ceiling for a constant-rate output only, and FFmpeg refuses it beside any other
+ * frame-rate mode, so the two cannot be combined.
  *
  * A negotiated selection states no refresh cadence, so the keyframe interval is plugin policy: `-g` and
  * `-keyint_min` are the negotiated rate doubled and scene-cut detection is off, which is a refresh every two
@@ -834,26 +1286,30 @@ function outputArguments(targetAddress, target, payloadType, ssrc, packetSize) {
  * coded stream can carry a negotiated Main or High profile; `ultrafast` drops CABAC and codes Constrained
  * Baseline whatever `-profile:v` asks for. `-tune zerolatency` pins the same `sliced_threads`, `bframes`
  * and `rc_lookahead` at either preset, so this costs computation rather than frame delay.
+ *
+ * `copy` sends an H.264 source as the camera coded it, with no encoder in the process. Nothing above then holds:
+ * the geometry, frame rate, bit rate, profile and keyframe interval are the camera's own, not the negotiated
+ * selection. Only the RTP output is the negotiated one. An H.265 source is transcoded either way.
+ *
+ * {@link CONSTANT_QUALITY} codes at {@link CONSTANT_QUALITY_CRF} with no rate control, so the negotiated bit rate is not
+ * honoured: the output spends what the picture needs. A controller asks 299 kbps for 720p and does not raise it
+ * during a session, which the ceiling above codes as a blurred, then blocky, picture.
  */
-function videoArguments(input, selection, targetAddress, target) {
-    const budget = videoBudgetInsideCeiling(selection);
+function videoArguments(codec, selection, encoder, output) {
+    if (encoder === 'copy') {
+        return [...commonArguments('h264'), '-an', '-c:v', 'copy', ...output];
+    }
+    return [...commonArguments(codec === 'h265' ? 'hevc' : codec), ...encodeArguments(encoder, selection), ...output];
+}
+/** What one encoder is given to code `selection`, between its input and its output, in a session and in qualification alike. */
+function encodeArguments(encoder, selection) {
     return [
-        ...commonArguments(input.codec === 'h265' ? 'hevc' : input.codec),
         '-an',
         '-c:v',
-        'libx264',
-        '-preset',
-        'superfast',
-        '-tune',
-        'zerolatency',
-        '-profile:v',
-        selection.profile,
-        '-level:v',
-        selection.level,
-        '-pix_fmt',
-        'yuv420p',
+        encoder.name,
+        ...encoder.args(selection, `${videoBudgetInsideCeiling(selection)}k`),
         '-vf',
-        `scale=${selection.width}:${selection.height}:force_original_aspect_ratio=decrease,pad=${selection.width}:${selection.height}:(ow-iw)/2:(oh-ih)/2`,
+        `scale=${selection.width}:${selection.height}:force_original_aspect_ratio=decrease,pad=${selection.width}:${selection.height}:(ow-iw)/2:(oh-ih)/2${encoder.upload ?? ''}`,
         '-fpsmax',
         String(selection.fps),
         '-g',
@@ -862,22 +1318,84 @@ function videoArguments(input, selection, targetAddress, target) {
         String(selection.fps * 2),
         '-sc_threshold',
         '0',
-        '-b:v',
-        `${budget}k`,
-        '-maxrate',
-        `${budget}k`,
-        '-bufsize',
-        `${budget}k`,
-        ...outputArguments(targetAddress, target, selection.payloadType, selection.ssrc, selection.mtu),
     ];
 }
+/** FLV signature, version 1, the audio-only flag, header size 9, and the zero size of the tag before the first. */
+const FLV_FILE_HEADER = Buffer.from([0x46, 0x4c, 0x56, 0x01, 0x04, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00]);
+/**
+ * One FLV audio tag of an AAC elementary stream and its trailing size. The body is the AAC sound flags 0xaf, the AAC
+ * packet type (0 for the AudioSpecificConfig, 1 for one access unit) and `payload` unchanged. The sound flags fix the
+ * 44 kHz, 16-bit, stereo values the format requires; an AAC decoder takes the real parameters from the
+ * AudioSpecificConfig. The timestamp, its extension and the stream id are zero: the stream carries no timeline of its
+ * own, because its reader stamps every tag with the instant it arrived.
+ */
+function flvAacTag(packetType, payload) {
+    const header = Buffer.alloc(13);
+    header[0] = 8;
+    header.writeUIntBE(payload.length + 2, 1, 3);
+    header[11] = 0xaf;
+    header[12] = packetType;
+    const previousTagSize = Buffer.alloc(4);
+    previousTagSize.writeUInt32BE(13 + payload.length);
+    return Buffer.concat([header, payload, previousTagSize]);
+}
 /**
- * Adapts one source audio elementary stream to the negotiated AAC-ELD output.
+ * Every access unit of one AAC elementary stream carried in FLV tags, in order. Bytes arrive in arbitrary pieces, so a
+ * partial tag is held until the rest arrives; the sequence-header tag and non-AAC tags are skipped.
+ */
+class FlvAacReader {
+    held = Buffer.alloc(0);
+    headerSkipped = false;
+    /** Feed the next bytes of the stream and return the access units they complete. */
+    push(chunk) {
+        const bytes = this.held.length ? Buffer.concat([this.held, chunk]) : chunk;
+        let at = 0;
+        if (!this.headerSkipped) {
+            if (bytes.length < FLV_FILE_HEADER.length) {
+                this.held = Buffer.from(bytes);
+                return [];
+            }
+            at = FLV_FILE_HEADER.length;
+            this.headerSkipped = true;
+        }
+        const units = [];
+        while (bytes.length - at >= 11) {
+            const size = bytes.readUIntBE(at + 1, 3);
+            const end = at + 11 + size + 4;
+            if (bytes.length < end) {
+                break;
+            }
+            if (bytes[at] === 8 && size > 2 && bytes[at + 11] === 0xaf && bytes[at + 12] === 1) {
+                units.push(Buffer.from(bytes.subarray(at + 13, at + 11 + size)));
+            }
+            at = end;
+        }
+        this.held = Buffer.from(bytes.subarray(at));
+        return units;
+    }
+}
+/**
+ * The FFmpeg input format and input options for one source audio stream.
  *
- * The SDK reports no sample rate or channel count, because a station sends neither; 16 kHz mono is the
- * assumption every Eufy client applies. Raw A-law carries nothing at all and must be told that assumption,
- * while an ADTS input states its own rate in every frame header and rejects the option outright, which fails
- * the process before it reads a byte.
+ * A stream whose decoder config travels apart from its access units is framed as FLV, which states that config
+ * once ahead of them, and is decoded by `libfdk_aac`, which decodes AAC-ELD in the config the SDK declares. Outside
+ * such a config the SDK reports no sample rate or channel count, because a station sends neither;
+ * 16 kHz mono is the assumption every Eufy client applies. Raw A-law carries nothing at all and must be told that
+ * assumption, while an ADTS input states its own rate in every frame header and rejects the option outright, which
+ * fails the process before it reads a byte.
+ */
+function audioInput(frame) {
+    if (frame.config) {
+        return ['flv', ['-c:a', 'libfdk_aac']];
+    }
+    if (frame.codec === 'g711a') {
+        return ['alaw', ['-ar', '16k', '-ac', '1']];
+    }
+    return ['aac', []];
+}
+/**
+ * Adapts one source audio elementary stream to the negotiated AAC-ELD output, reading it as {@link audioInput}
+ * describes.
  *
  * Asynchronous resampling is what makes this output honour the arrival clock its input is read on. An encoder
  * advances its output timeline by the samples in each coded frame it is handed, whatever timestamp arrived
@@ -890,13 +1408,12 @@ function videoArguments(input, selection, targetAddress, target) {
  * accident of the filter: a live view owes its controller the newest audio, and audio which is already
  * seconds stale by the time it arrives cannot be presented beside a picture timestamped on arrival.
  *
- * `libfdk_aac` selects its transport from the requested output framing, and AAC-ELD cannot be carried in
+ * The `libfdk_aac` encoder selects its transport from the requested output framing, and AAC-ELD cannot be carried in
  * ADTS, so without an explicit global header the encoder refuses to initialise at all.
  */
 function audioArguments(frame, selection, targetAddress, target) {
-    const rawAlaw = frame.codec === 'g711a';
     return [
-        ...commonArguments(rawAlaw ? 'alaw' : 'aac', rawAlaw ? ['-ar', '16k', '-ac', '1'] : []),
+        ...commonArguments(...audioInput(frame)),
         '-vn',
         '-c:a',
         'libfdk_aac',
@@ -916,9 +1433,10 @@ function audioArguments(frame, selection, targetAddress, target) {
     ];
 }
 /**
- * Decode HomeKit's controller-to-accessory AAC-ELD SRTP and emit the SDK's exact talkback input: 16 kHz
- * mono AAC-LC in ADTS. The SDK owns complete-frame recovery, the 640-byte frame limit, and 64 ms pacing,
- * so FFmpeg must produce a byte stream rather than impose another clock.
+ * Decode HomeKit's controller-to-accessory AAC-ELD SRTP and emit both talkback inputs the SDK accepts: 16 kHz mono
+ * AAC-LC in ADTS on stdout, and HomeKit's own AAC-ELD access units, copied unchanged, in FLV on fd 3. The opened
+ * handle's `codec` names the one that is fed; the other is drained. The SDK owns frame validation, the 640-byte
+ * limit and pacing, so FFmpeg produces byte streams rather than imposing another clock.
  */
 function returnAudioArguments() {
     return [
@@ -950,6 +1468,16 @@ function returnAudioArguments() {
         '-f',
         'adts',
         'pipe:1',
+        '-map',
+        '0:a:0',
+        '-vn',
+        '-c:a',
+        'copy',
+        '-flvflags',
+        'no_duration_filesize',
+        '-f',
+        'flv',
+        'pipe:3',
     ];
 }
 /**
@@ -980,7 +1508,8 @@ function spawnLiveMediaProcess(executable, args) {
     return spawn(executable, args, { stdio: ['pipe', 'ignore', 'pipe'] });
 }
 function spawnReturnAudioProcess(executable, args) {
-    return spawn(executable, args, { stdio: ['pipe', 'pipe', 'pipe'] });
+    const child = spawn(executable, args, { stdio: ['pipe', 'pipe', 'pipe', 'pipe'] });
+    return Object.assign(child, { eld: child.stdio[3] });
 }
 function reserveMediaPort(addressVersion) {
     return new Promise((resolve, reject) => {