@pproenca/node-webcodecs 0.1.1-alpha.0 → 0.1.1-alpha.6

package/src/video_encoder.cc

@@ -3,8 +3,11 @@
 
 #include "src/video_encoder.h"
 
+#include <chrono>
+#include <cstdio>
 #include <memory>
 #include <string>
+#include <thread>
 #include <utility>
 
 #include "src/common.h"
@@ -84,6 +87,9 @@ VideoEncoder::VideoEncoder(const Napi::CallbackInfo& info)
       bitstream_format_("annexb"),
       frame_count_(0),
       encode_queue_size_(0) {
+  // Track active encoder instance (following sharp pattern)
+  webcodecs::counterProcess++;
+  webcodecs::counterVideoEncoders++;
   Napi::Env env = info.Env();
 
   if (info.Length() < 1 || !info[0].IsObject()) {
@@ -106,20 +112,59 @@ VideoEncoder::VideoEncoder(const Napi::CallbackInfo& info)
   error_callback_ = Napi::Persistent(init.Get("error").As<Napi::Function>());
 }
 
-VideoEncoder::~VideoEncoder() { Cleanup(); }
+VideoEncoder::~VideoEncoder() {
+  // CRITICAL: Call Cleanup() first to stop the async worker thread and wait
+  // for pending TSFN callbacks. The worker may still be processing frames,
+  // and we must ensure it exits cleanly before any further cleanup.
+  Cleanup();
+
+  // Now safe to disable FFmpeg logging. The worker thread has exited and all
+  // pending callbacks have been processed or aborted.
+  webcodecs::ShutdownFFmpegLogging();
+
+  // Track active encoder instance (following sharp pattern)
+  webcodecs::counterProcess--;
+  webcodecs::counterVideoEncoders--;
+}
 
 void VideoEncoder::Cleanup() {
   if (async_worker_) {
+    // Stop() joins the worker thread - after this, no new TSFN calls will be made
     async_worker_->Stop();
-    async_worker_.reset();
+
+    // Wait for pending TSFN callbacks to complete.
+    // After Stop() joins the thread, there may still be queued TSFN callbacks
+    // that haven't been processed yet. These callbacks reference memory that
+    // will be freed below.
+    auto deadline =
+        std::chrono::steady_clock::now() + std::chrono::milliseconds(100);
+    while (async_worker_->GetPendingChunks() > 0 &&
+           std::chrono::steady_clock::now() < deadline) {
+      std::this_thread::sleep_for(std::chrono::milliseconds(1));
+    }
   }
 
+  // Release ThreadSafeFunctions to ensure proper cleanup.
+  // Release() signals no more calls will be made and decrements the reference
+  // count. Pending callbacks will receive null env.
   if (async_mode_) {
     output_tsfn_.Release();
     error_tsfn_.Release();
     async_mode_ = false;
   }
 
+  // Safe to destroy async_worker_ - worker thread has exited and TSFN released
+  if (async_worker_) {
+    async_worker_.reset();
+  }
+
+  // Flush codec internal buffers before destruction.
+  // CRITICAL: Only flush if codec was successfully opened. avcodec_flush_buffers
+  // crashes on an unopened codec context (the internal codec pointer is NULL).
+  if (codec_context_ && avcodec_is_open(codec_context_.get())) {
+    avcodec_flush_buffers(codec_context_.get());
+  }
+
   frame_.reset();
   packet_.reset();
   sws_context_.reset();
@@ -148,6 +193,12 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
   int framerate =
       webcodecs::AttrAsInt32(config, "framerate", kDefaultFramerate);
 
+  // Parse bitrateMode per W3C WebCodecs spec.
+  // "quantizer" = use CQP mode where frame->quality controls encoding quality.
+  // "variable" or "constant" = use bitrate-based encoding (default).
+  std::string bitrate_mode =
+      webcodecs::AttrAsStr(config, "bitrateMode", "variable");
+
   // Parse codec string
   std::string codec_str = webcodecs::AttrAsStr(config, "codec", "h264");
   codec_string_ = codec_str;  // Store for metadata
@@ -181,6 +232,20 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
     }
   }
 
+  // Parse latencyMode per W3C WebCodecs spec.
+  // "realtime" = disable B-frames for low latency (no reordering)
+  // "quality" = allow B-frames for better compression (default)
+  std::string latency_mode =
+      webcodecs::AttrAsStr(config, "latencyMode", "quality");
+
+  // Store config for codec reinitialization after flush.
+  // FFmpeg encoders enter EOF mode after sending NULL frame, requiring
+  // full reinitialization to continue encoding per W3C WebCodecs spec.
+  bitrate_ = bitrate;
+  framerate_ = framerate;
+  max_b_frames_ = (latency_mode == "realtime") ? 0 : kDefaultMaxBFrames;
+  use_qscale_ = (bitrate_mode == "quantizer");
+
   // Parse codec-specific bitstream format per W3C codec registration.
   // Default to "annexb" for backwards compatibility (FFmpeg's native format).
   // Per W3C spec, the default should be "avc"/"hevc" when explicit config
@@ -215,7 +280,46 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
     throw Napi::Error::New(env, "Unsupported codec: " + codec_str);
   }
 
-  codec_ = avcodec_find_encoder(codec_id);
+  // Try hardware encoders first based on platform and hardwareAcceleration
+  // setting
+  codec_ = nullptr;
+  std::string hw_accel =
+      webcodecs::AttrAsStr(config, "hardwareAcceleration", "no-preference");
+
+  if (hw_accel != "prefer-software") {
+#ifdef __APPLE__
+    if (codec_id == AV_CODEC_ID_H264) {
+      codec_ = avcodec_find_encoder_by_name("h264_videotoolbox");
+    } else if (codec_id == AV_CODEC_ID_HEVC) {
+      codec_ = avcodec_find_encoder_by_name("hevc_videotoolbox");
+    }
+#endif
+#ifdef _WIN32
+    if (codec_id == AV_CODEC_ID_H264) {
+      codec_ = avcodec_find_encoder_by_name("h264_nvenc");
+      if (!codec_) codec_ = avcodec_find_encoder_by_name("h264_qsv");
+      if (!codec_) codec_ = avcodec_find_encoder_by_name("h264_amf");
+    } else if (codec_id == AV_CODEC_ID_HEVC) {
+      codec_ = avcodec_find_encoder_by_name("hevc_nvenc");
+      if (!codec_) codec_ = avcodec_find_encoder_by_name("hevc_qsv");
+    }
+#endif
+#ifdef __linux__
+    if (codec_id == AV_CODEC_ID_H264) {
+      codec_ = avcodec_find_encoder_by_name("h264_vaapi");
+      if (!codec_) codec_ = avcodec_find_encoder_by_name("h264_nvenc");
+    } else if (codec_id == AV_CODEC_ID_HEVC) {
+      codec_ = avcodec_find_encoder_by_name("hevc_vaapi");
+      if (!codec_) codec_ = avcodec_find_encoder_by_name("hevc_nvenc");
+    }
+#endif
+  }
+
+  // Fallback to software encoder
+  if (!codec_) {
+    codec_ = avcodec_find_encoder(codec_id);
+  }
+
   if (!codec_) {
     throw Napi::Error::New(env, "Encoder not found for codec: " + codec_str);
   }
@@ -231,9 +335,24 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
   codec_context_->time_base = {1, framerate};
   codec_context_->framerate = {framerate, 1};
   codec_context_->pix_fmt = AV_PIX_FMT_YUV420P;
-  codec_context_->bit_rate = bitrate;
+  // When bitrateMode = "quantizer", enable CQP mode so frame->quality is
+  // respected. Don't set bit_rate - let quality control encoding.
+  if (bitrate_mode == "quantizer") {
+    codec_context_->flags |= AV_CODEC_FLAG_QSCALE;
+    codec_context_->global_quality = FF_QP2LAMBDA * 23;  // Default QP if none specified
+  } else {
+    codec_context_->bit_rate = bitrate;
+  }
   codec_context_->gop_size = kDefaultGopSize;
-  codec_context_->max_b_frames = kDefaultMaxBFrames;
+  // Per W3C WebCodecs spec: latencyMode "realtime" disables B-frames for low
+  // latency encoding (no frame reordering). This is critical for correct MP4
+  // muxing as B-frames require proper DTS calculation which isn't available
+  // from WebCodecs chunk timestamps.
+  if (latency_mode == "realtime") {
+    codec_context_->max_b_frames = 0;
+  } else {
+    codec_context_->max_b_frames = kDefaultMaxBFrames;
+  }
 
   // Set global header flag for non-annexb bitstream formats.
   // This puts SPS/PPS/VPS in codec_context_->extradata instead of in the
@@ -243,29 +362,130 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
     codec_context_->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
   }
 
-  // Codec-specific options.
-  if (codec_id == AV_CODEC_ID_H264) {
-    av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
-    av_opt_set(codec_context_->priv_data, "tune", "zerolatency", 0);
-  } else if (codec_id == AV_CODEC_ID_VP8 || codec_id == AV_CODEC_ID_VP9) {
-    // VP8/VP9 specific: set quality (crf) and speed
-    av_opt_set(codec_context_->priv_data, "quality", "realtime", 0);
-    av_opt_set(codec_context_->priv_data, "speed", "6", 0);
-    // VP8/VP9 don't support B-frames
-    codec_context_->max_b_frames = 0;
-  } else if (codec_id == AV_CODEC_ID_AV1) {
-    // AV1 specific options
-    av_opt_set(codec_context_->priv_data, "preset", "8", 0);
-  } else if (codec_id == AV_CODEC_ID_HEVC) {
-    // libx265 specific options
-    av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
-    // Note: libx265 tune options are different from libx264 (grain, animation,
-    // psnr, ssim) "zerolatency" is not valid for x265, using x265-params
-    // instead
-    av_opt_set(codec_context_->priv_data, "x265-params", "bframes=0", 0);
+  // Detect if this is a hardware encoder (for skipping software-specific
+  // options)
+  bool is_hw_encoder =
+      codec_ && (strstr(codec_->name, "videotoolbox") != nullptr ||
+                 strstr(codec_->name, "nvenc") != nullptr ||
+                 strstr(codec_->name, "qsv") != nullptr ||
+                 strstr(codec_->name, "vaapi") != nullptr ||
+                 strstr(codec_->name, "amf") != nullptr);
+
+  // Detect specific software encoder libraries.
+  // Different encoders support different options, so we must check the encoder
+  // name before setting library-specific options.
+  bool is_libx264 = codec_ && strcmp(codec_->name, "libx264") == 0;
+  bool is_libx265 = codec_ && strcmp(codec_->name, "libx265") == 0;
+  bool is_libvpx =
+      codec_ && (strcmp(codec_->name, "libvpx") == 0 ||
+                 strcmp(codec_->name, "libvpx-vp9") == 0);
+  bool is_libaom = codec_ && strcmp(codec_->name, "libaom-av1") == 0;
+  bool is_libsvtav1 = codec_ && strcmp(codec_->name, "libsvtav1") == 0;
+
+  // Codec-specific options (only for software encoders).
+  // Hardware encoders have their own internal quality/speed settings.
+  // Only set options when the specific encoder library is detected.
+  if (!is_hw_encoder) {
+    if (codec_id == AV_CODEC_ID_H264 && is_libx264) {
+      // libx264-specific options
+      av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
+      av_opt_set(codec_context_->priv_data, "tune", "zerolatency", 0);
+      // For bitrateMode=quantizer, enable CQP mode in libx264.
+      // libx264 ignores AV_CODEC_FLAG_QSCALE; it needs the "qp" option set.
+      // We set a default QP here; per-frame quality will be applied via
+      // frame->quality which libx264 reads when in CQP mode.
+      if (bitrate_mode == "quantizer") {
+        av_opt_set_int(codec_context_->priv_data, "qp", 23, 0);
+      }
+    } else if ((codec_id == AV_CODEC_ID_VP8 || codec_id == AV_CODEC_ID_VP9) &&
+               is_libvpx) {
+      // libvpx-specific options
+      av_opt_set(codec_context_->priv_data, "quality", "realtime", 0);
+      av_opt_set(codec_context_->priv_data, "speed", "6", 0);
+      // VP8/VP9 don't support B-frames
+      codec_context_->max_b_frames = 0;
+    } else if (codec_id == AV_CODEC_ID_AV1 && is_libaom) {
+      // libaom-av1 uses "cpu-used" for speed preset (0-8, higher = faster)
+      av_opt_set(codec_context_->priv_data, "cpu-used", "8", 0);
+    } else if (codec_id == AV_CODEC_ID_AV1 && is_libsvtav1) {
+      // SVT-AV1 uses "preset" for speed (0-13, higher = faster)
+      av_opt_set(codec_context_->priv_data, "preset", "8", 0);
+    } else if (codec_id == AV_CODEC_ID_HEVC && is_libx265) {
+      // libx265-specific options
+      av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
+      // Note: libx265 tune options are different from libx264 (grain,
+      // animation, psnr, ssim) "zerolatency" is not valid for x265, using
+      // x265-params instead
+      av_opt_set(codec_context_->priv_data, "x265-params", "bframes=0", 0);
+    }
+    // For unrecognized encoders, skip library-specific options entirely.
+    // The encoder will use its default settings.
+  }
+
+  // Hardware encoder-specific options.
+  if (is_hw_encoder) {
+    // VideoToolbox: allow software fallback when hardware encoding is unavailable
+    // (e.g., in CI/headless environments without GPU access)
+    if (strstr(codec_->name, "videotoolbox") != nullptr) {
+      av_opt_set(codec_context_->priv_data, "allow_sw", "1", 0);
+    }
   }
 
   int ret = avcodec_open2(codec_context_.get(), codec_, nullptr);
+
+  // If hardware encoder failed, fall back to software encoder.
+  // Per W3C spec, "prefer-hardware" still allows software fallback.
+  if (ret < 0 && is_hw_encoder) {
+    // Reset the failed hardware encoder context
+    codec_context_.reset();
+
+    // Find software encoder as fallback
+    codec_ = avcodec_find_encoder(codec_id);
+    if (codec_) {
+      codec_context_ = ffmpeg::make_codec_context(codec_);
+      if (codec_context_) {
+        // Reconfigure encoder for software
+        codec_context_->width = width_;
+        codec_context_->height = height_;
+        codec_context_->time_base = {1, framerate};
+        codec_context_->framerate = {framerate, 1};
+        codec_context_->pix_fmt = AV_PIX_FMT_YUV420P;
+        if (bitrate_mode == "quantizer") {
+          codec_context_->flags |= AV_CODEC_FLAG_QSCALE;
+          codec_context_->global_quality = FF_QP2LAMBDA * 23;
+        } else {
+          codec_context_->bit_rate = bitrate;
+        }
+        codec_context_->gop_size = kDefaultGopSize;
+        if (latency_mode == "realtime") {
+          codec_context_->max_b_frames = 0;
+        } else {
+          codec_context_->max_b_frames = kDefaultMaxBFrames;
+        }
+        if (bitstream_format_ != "annexb") {
+          codec_context_->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
+        }
+
+        // Set software encoder-specific options
+        if (codec_id == AV_CODEC_ID_H264 &&
+            strcmp(codec_->name, "libx264") == 0) {
+          av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
+          av_opt_set(codec_context_->priv_data, "tune", "zerolatency", 0);
+          if (bitrate_mode == "quantizer") {
+            av_opt_set_int(codec_context_->priv_data, "qp", 23, 0);
+          }
+        } else if (codec_id == AV_CODEC_ID_HEVC &&
+                   strcmp(codec_->name, "libx265") == 0) {
+          av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
+          av_opt_set(codec_context_->priv_data, "x265-params", "bframes=0", 0);
+        }
+
+        // Try opening software encoder
+        ret = avcodec_open2(codec_context_.get(), codec_, nullptr);
+      }
+    }
+  }
+
   if (ret < 0) {
     char errbuf[256];
     av_strerror(ret, errbuf, sizeof(errbuf));
@@ -278,7 +498,11 @@ Napi::Value VideoEncoder::Configure(const Napi::CallbackInfo& info) {
   frame_->format = codec_context_->pix_fmt;
   frame_->width = width_;
   frame_->height = height_;
-  av_frame_get_buffer(frame_.get(), kFrameBufferAlignment);
+  ret = av_frame_get_buffer(frame_.get(), kFrameBufferAlignment);
+  if (ret < 0) {
+    Cleanup();
+    throw Napi::Error::New(env, "Failed to allocate frame buffer");
+  }
 
   packet_ = ffmpeg::make_packet();
 
@@ -353,6 +577,24 @@ Napi::Value VideoEncoder::Encode(const Napi::CallbackInfo& info) {
     throw Napi::Error::New(env, "Encoder not configured");
   }
 
+  // SAFETY VALVE: Reject if queue is too large.
+  // This prevents OOM if the consumer ignores backpressure.
+  // For async mode, check the async worker's queue; for sync mode, use encode_queue_size_.
+  if (async_mode_ && async_worker_) {
+    size_t async_queue = async_worker_->QueueSize() + async_worker_->GetPendingChunks();
+    if (async_queue >= kMaxHardQueueSize) {
+      throw Napi::Error::New(
+          env,
+          "QuotaExceededError: Encode queue is full. You must handle backpressure "
+          "by waiting for encodeQueueSize to decrease.");
+    }
+  } else if (encode_queue_size_ >= static_cast<int>(kMaxHardQueueSize)) {
+    throw Napi::Error::New(
+        env,
+        "QuotaExceededError: Encode queue is full. You must handle backpressure "
+        "by waiting for encodeQueueSize to decrease.");
+  }
+
   if (info.Length() < 1 || !info[0].IsObject()) {
     throw Napi::Error::New(env, "encode requires VideoFrame");
   }
@@ -430,7 +672,9 @@ Napi::Value VideoEncoder::Encode(const Napi::CallbackInfo& info) {
     task.rgba_data.resize(data_size);
     std::memcpy(task.rgba_data.data(), video_frame->GetData(), data_size);
 
-    encode_queue_size_++;
+    // Note: Don't increment encode_queue_size_ for async path.
+    // The hard limit check uses async_worker_->QueueSize() + GetPendingChunks() instead.
+    webcodecs::counterQueue++;  // Global queue tracking
     async_worker_->Enqueue(std::move(task));
 
     return env.Undefined();
@@ -513,6 +757,89 @@ Napi::Value VideoEncoder::Encode(const Napi::CallbackInfo& info) {
   return env.Undefined();
 }
 
+void VideoEncoder::ReinitializeCodec() {
+  // Reinitialize codec context after flush.
+  // FFmpeg encoders enter EOF mode after sending NULL frame and cannot
+  // accept new input without full reinitialization.
+  // This is required for W3C WebCodecs compliance where flush() should
+  // allow continued encoding.
+
+  if (!codec_) {
+    return;  // No codec configured
+  }
+
+  // Close old codec context (RAII handles cleanup via reset)
+  codec_context_.reset();
+  sws_context_.reset();
+
+  // Recreate codec context with same settings
+  codec_context_ = ffmpeg::make_codec_context(codec_);
+  if (!codec_context_) {
+    return;  // Failed to allocate - will be detected on next encode
+  }
+
+  // Reconfigure encoder with stored settings
+  codec_context_->width = width_;
+  codec_context_->height = height_;
+  codec_context_->time_base = {1, framerate_};
+  codec_context_->framerate = {framerate_, 1};
+  codec_context_->pix_fmt = AV_PIX_FMT_YUV420P;
+  codec_context_->gop_size = kDefaultGopSize;
+  codec_context_->max_b_frames = max_b_frames_;
+
+  if (use_qscale_) {
+    codec_context_->flags |= AV_CODEC_FLAG_QSCALE;
+    codec_context_->global_quality = FF_QP2LAMBDA * 23;
+  } else {
+    codec_context_->bit_rate = bitrate_;
+  }
+
+  if (bitstream_format_ != "annexb") {
+    codec_context_->flags |= AV_CODEC_FLAG_GLOBAL_HEADER;
+  }
+
+  // Hardware encoder-specific options
+  if (codec_ && strstr(codec_->name, "videotoolbox") != nullptr) {
+    av_opt_set(codec_context_->priv_data, "allow_sw", "1", 0);
+  }
+
+  // Software encoder-specific options
+  bool is_libx264 = codec_ && strcmp(codec_->name, "libx264") == 0;
+  if (is_libx264) {
+    av_opt_set(codec_context_->priv_data, "preset", "fast", 0);
+    av_opt_set(codec_context_->priv_data, "tune", "zerolatency", 0);
+    if (use_qscale_) {
+      av_opt_set_int(codec_context_->priv_data, "qp", 23, 0);
+    }
+  }
+
+  // Open codec
+  int ret = avcodec_open2(codec_context_.get(), codec_, nullptr);
+  if (ret < 0) {
+    codec_context_.reset();
+    return;  // Failed to open - will be detected on next encode
+  }
+
+  // Recreate sws context for RGBA to YUV conversion
+  sws_context_.reset(sws_getContext(width_, height_, AV_PIX_FMT_RGBA, width_,
+                                    height_, AV_PIX_FMT_YUV420P, SWS_BILINEAR,
+                                    nullptr, nullptr, nullptr));
+
+  // Recreate frame and packet for sync mode
+  if (!async_mode_) {
+    frame_ = ffmpeg::make_frame();
+    if (frame_) {
+      frame_->format = AV_PIX_FMT_YUV420P;
+      frame_->width = width_;
+      frame_->height = height_;
+      av_frame_get_buffer(frame_.get(), kFrameBufferAlignment);
+    }
+    packet_ = ffmpeg::make_packet();
+  }
+
+  // Note: frame_count_ is NOT reset - continue numbering from before flush
+}
+
 Napi::Value VideoEncoder::Flush(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
 
@@ -523,6 +850,13 @@ Napi::Value VideoEncoder::Flush(const Napi::CallbackInfo& info) {
   if (async_mode_ && async_worker_) {
     // Wait for async worker to drain its queue
     async_worker_->Flush();
+    // Reinitialize codec after drain (FFmpeg enters EOF mode after NULL frame)
+    ReinitializeCodec();
+    if (async_worker_) {
+      // Update worker with new codec context and sws context
+      async_worker_->SetCodecContext(codec_context_.get(), sws_context_.get(),
+                                     width_, height_);
+    }
     // Reset queue after async flush completes
     encode_queue_size_ = 0;
     codec_saturated_.store(false);
@@ -535,6 +869,9 @@ Napi::Value VideoEncoder::Flush(const Napi::CallbackInfo& info) {
   // Get remaining packets.
   EmitChunks(env);
 
+  // Reinitialize codec after drain (FFmpeg enters EOF mode after NULL frame)
+  ReinitializeCodec();
+
   // Reset queue after flush
   encode_queue_size_ = 0;
   codec_saturated_.store(false);
@@ -545,13 +882,29 @@ Napi::Value VideoEncoder::Flush(const Napi::CallbackInfo& info) {
 Napi::Value VideoEncoder::Reset(const Napi::CallbackInfo& info) {
   Napi::Env env = info.Env();
 
+  // W3C spec: reset() is a no-op when closed (don't throw)
   if (state_ == "closed") {
-    throw Napi::Error::New(env,
-                           "InvalidStateError: Cannot reset a closed encoder");
+    return env.Undefined();
+  }
+
+  // CRITICAL: Stop async worker FIRST before accessing codec_context_.
+  // The worker thread may be calling avcodec_send_frame() or avcodec_receive_packet()
+  // concurrently. AVCodecContext is NOT thread-safe - concurrent access causes SIGSEGV.
+  if (async_worker_) {
+    async_worker_->Stop();
+    async_worker_.reset();
   }
 
-  // Flush any pending frames (don't emit - discard).
-  if (codec_context_) {
+  // Release ThreadSafeFunctions after worker is stopped.
+  if (async_mode_) {
+    output_tsfn_.Release();
+    error_tsfn_.Release();
+    async_mode_ = false;
+  }
+
+  // Now safe to flush codec - worker is stopped.
+  // Drain encoder's internal buffers, discard any remaining encoded packets.
+  if (codec_context_ && packet_) {
     avcodec_send_frame(codec_context_.get(), nullptr);
     while (avcodec_receive_packet(codec_context_.get(), packet_.get()) == 0) {
       av_packet_unref(packet_.get());
@@ -559,7 +912,11 @@ Napi::Value VideoEncoder::Reset(const Napi::CallbackInfo& info) {
   }
 
   // Clean up FFmpeg resources.
-  Cleanup();
+  frame_.reset();
+  packet_.reset();
+  sws_context_.reset();
+  codec_context_.reset();
+  codec_ = nullptr;
 
   // Reset state.
   state_ = "unconfigured";

package/src/video_encoder.h

@@ -51,6 +51,7 @@ class VideoEncoder : public Napi::ObjectWrap<VideoEncoder> {
   // Internal helpers.
   void Cleanup();
   void EmitChunks(Napi::Env env);
+  void ReinitializeCodec();  // Recreates codec context after flush
 
   // FFmpeg state.
   const AVCodec*
@@ -81,10 +82,24 @@ class VideoEncoder : public Napi::ObjectWrap<VideoEncoder> {
   // "annexb": Description embedded in bitstream (default for backwards compat)
   std::string bitstream_format_;
   int64_t frame_count_;
+
+  // Stored configuration for codec reinitialization after flush.
+  // FFmpeg encoders enter EOF mode after flush (sending NULL frame),
+  // requiring full reinitialization to accept new frames per W3C spec.
+  int bitrate_;
+  int framerate_;
+  int max_b_frames_;
+  bool use_qscale_;
   int encode_queue_size_;
   std::atomic<bool> codec_saturated_{false};
   static constexpr size_t kMaxQueueSize = 16;  // Saturation threshold
 
+  // HARD LIMIT: The "Circuit Breaker".
+  // If the user ignores backpressure signals and keeps pushing frames,
+  // we reject requests to prevent OOM.
+  // 64 frames @ 4K RGBA (3840x2160x4) is ~2GB of RAM.
+  static constexpr size_t kMaxHardQueueSize = 64;
+
   // Saturation status accessor
   bool IsCodecSaturated() const { return codec_saturated_.load(); }
 

package/src/video_filter.cc

@@ -295,22 +295,33 @@ Napi::Value VideoFilter::ApplyBlur(const Napi::CallbackInfo& info) {
     return env.Undefined();
   }
 
-  // Parse and link filter graph
-  AVFilterInOut* outputs = avfilter_inout_alloc();
-  AVFilterInOut* inputs = avfilter_inout_alloc();
+  // Parse and link filter graph (RAII for initial allocation safety)
+  ffmpeg::AVFilterInOutPtr outputs_raii = ffmpeg::make_filter_inout();
+  ffmpeg::AVFilterInOutPtr inputs_raii = ffmpeg::make_filter_inout();
 
-  outputs->name = av_strdup("in");
-  outputs->filter_ctx = buffersrc_ctx_;
-  outputs->pad_idx = 0;
-  outputs->next = nullptr;
+  if (!outputs_raii || !inputs_raii) {
+    Napi::Error::New(env, "Failed to allocate filter inout")
+        .ThrowAsJavaScriptException();
+    return env.Undefined();
+  }
+
+  outputs_raii->name = av_strdup("in");
+  outputs_raii->filter_ctx = buffersrc_ctx_;
+  outputs_raii->pad_idx = 0;
+  outputs_raii->next = nullptr;
+
+  inputs_raii->name = av_strdup("out");
+  inputs_raii->filter_ctx = buffersink_ctx_;
+  inputs_raii->pad_idx = 0;
+  inputs_raii->next = nullptr;
 
-  inputs->name = av_strdup("out");
-  inputs->filter_ctx = buffersink_ctx_;
-  inputs->pad_idx = 0;
-  inputs->next = nullptr;
+  // Release ownership before parse_ptr (it may modify/consume the pointers)
+  AVFilterInOut* outputs = outputs_raii.release();
+  AVFilterInOut* inputs = inputs_raii.release();
 
   ret = avfilter_graph_parse_ptr(filter_graph_.get(), filter_str.c_str(),
                                  &inputs, &outputs, nullptr);
+  // parse_ptr may have modified pointers, free remaining
   avfilter_inout_free(&inputs);
   avfilter_inout_free(&outputs);