@torrent-tv/proxy 2.74.1 → 2.76.0

package/routes/api/transcode-sessions/post.js

@@ -1,185 +1,185 @@
-/**
- * Create or return an existing HLS transcode session for a torrent file.
- *
- * POST /api/transcode-sessions
- *
- * @param {import("fastify").FastifyRequest} req
- * @param {import("fastify").FastifyReply} reply
- * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager, sourceRegistry: object, torrentPool: object }} deps
- * @returns {Promise<void>}
- */
-
-import { logger } from "../../../utils/logger.js";
-
-/**
- * Extract a plain object from the request body, guarding against
- * non-object payloads (arrays, primitives, null).
- *
- * @param {unknown} body
- * @returns {Record<string, unknown>}
- */
-function getPayload(body) {
-  if (body && typeof body === "object" && !Array.isArray(body)) {
-    return body;
-  }
-  return {};
-}
-
-/**
- * Claim the source's file so the pool cannot clean it up under a live session.
- *
- * Asynchronous underneath — the torrent lives on another thread — but the
- * caller needs a release function immediately, so the claim is chased and the
- * release waits for it.
- *
- * @param {{ sourceRegistry: object, torrentPool: object, sourceKey: string, fileIndex: number }} params
- * @returns {() => void}
- */
-function holdSource({ sourceRegistry, torrentPool, sourceKey, fileIndex }) {
-  let release = null;
-  let releasedEarly = false;
-  const record = sourceRegistry?.get?.(sourceKey);
-  if (!record) {
-    return () => {};
-  }
-  void Promise.resolve(torrentPool.getTorrent(record.sourceType, record.source))
-    .then((torrent) => {
-      release = torrentPool.acquireFile(torrent, fileIndex);
-      if (releasedEarly) {
-        release();
-      }
-    })
-    .catch(() => {});
-  return () => {
-    releasedEarly = true;
-    if (typeof release === "function") {
-      release();
-      release = null;
-    }
-  };
-}
-
-export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager, sourceRegistry, torrentPool }) {
-  const payload = getPayload(req.body);
-  const sourceKey = typeof payload.sourceKey === "string" ? payload.sourceKey.trim() : "";
-  const fileIndex = Number(payload.fileIndex);
-  const transcodeVideo = payload.transcodeVideo === true;
-  const transcodeAudio = payload.transcodeAudio === true;
-  const consumerId = typeof payload.consumerId === "string" ? payload.consumerId.trim() : "";
-  const fileName = typeof payload.fileName === "string" ? payload.fileName.trim() : "";
-  const targetWidth = Number(payload.targetWidth);
-  const targetHeight = Number(payload.targetHeight);
-  // Manual quality: the target box is a user-forced resolution, encoded exactly
-  // (capped to source), with the realtime budget's auto-downscale + runtime
-  // downswitch disabled for the session.
-  const manualQuality = payload.manualQuality === true;
-  // Whether this browser will take its audio from a separate rendition group in
-  // the master playlist rather than muxed into the picture. It has to say so:
-  // publishing renditions AND muxing the same audio would play it twice, while
-  // a browser that does not know about them would get no sound at all.
-  const audioRenditions = payload.audioRenditions === true;
-  const startPositionSeconds = Number(payload.startPositionSeconds);
-  const audioTrackIndex = Number(payload.audioTrackIndex);
-  // Which container to produce. The browser knows what its media stack will
-  // accept for the tracks it asked to be copied; an absent or unknown value
-  // leaves the proxy's own `--segment-format` in charge.
-  const segmentFormatId =
-    typeof payload.segmentFormat === "string" ? payload.segmentFormat.trim() : "";
-
-  if (!sourceKey || !Number.isInteger(fileIndex) || fileIndex < 0) {
-    return reply.code(400).send({ error: "sourceKey and valid fileIndex are required." });
-  }
-
-  try {
-    const session = await hlsSessionManager.createOrGetSession({
-      sourceKey,
-      fileIndex,
-      transcodeVideo,
-      transcodeAudio,
-      consumerId,
-      fileName,
-      targetWidth: Number.isInteger(targetWidth) && targetWidth > 0 ? targetWidth : 0,
-      targetHeight: Number.isInteger(targetHeight) && targetHeight > 0 ? targetHeight : 0,
-      manualQuality,
-      audioRenditions,
-      startPositionSeconds:
-        Number.isFinite(startPositionSeconds) && startPositionSeconds > 0
-          ? startPositionSeconds
-          : 0,
-      audioTrackIndex:
-        Number.isInteger(audioTrackIndex) && audioTrackIndex > 0 ? audioTrackIndex : 0,
-      segmentFormatId,
-      // Hold the torrent for as long as this session lives. Reads take a claim
-      // only while they run, and a seek leaves a gap with no read at all — the
-      // disk sweep caught that gap on 2026-08-06 and deleted the film being
-      // watched.
-      // Takes the file to hold, because a session does not always read the file
-      // it was created for: a release whose dub ships as its own file gives that
-      // soundtrack a session of its own, reading a different index of the same
-      // torrent. Defaults to the picture, which is every other case.
-      acquireSource: (heldFileIndex = fileIndex) =>
-        holdSource({
-          sourceRegistry,
-          torrentPool,
-          sourceKey,
-          fileIndex: Number.isInteger(heldFileIndex) ? heldFileIndex : fileIndex
-        })
-    });
-    // The index of quality variants, when this session has more than one to
-    // offer. Its presence is what tells the browser it can change quality
-    // without a new session: the player switches variants itself, appending the
-    // new one after what is already buffered. Absent for a copied video, whose
-    // segments are cut at the source's own keyframes and so cannot be spliced
-    // with a re-encoded rung.
-    const hasVariants = hlsSessionManager.buildMasterPlaylist(session.id) !== null;
-    return reply.send({
-      sessionId: session.id,
-      playlistPath: `/transcode/${session.id}/index.m3u8`,
-      ...(hasVariants
-        ? {
-            masterPath: `/transcode/${session.id}/master.m3u8`,
-            // Which of the master's variants this session IS. The browser pins
-            // the player to it, so loading the master costs nothing: an encoder
-            // is already producing that height, and any other rung would be a
-            // second cold start before the first frame.
-            variantHeight: hlsSessionManager.variantHeightOf(session)
-          }
-        : {}),
-      // The heights this host will actually serve this file at, largest first
-      // — the ladder minus every rung it cannot produce faster than it is
-      // watched. The browser needs it whether or not a master exists: without
-      // it, it fell back to a ladder of its own invention and offered rungs the
-      // proxy had just refused, and picking one re-opened the session at a
-      // height measured at a third of realtime.
-      offeredHeights: hlsSessionManager.offeredHeights(session),
-      // What this session's output will carry, stated rather than left to be
-      // discovered. The browser checks what it actually got against this: a
-      // track that never arrives is otherwise noticed only by its absence,
-      // minutes later, as a black picture with working sound.
-      tracks: hlsSessionManager.declaredTracks(session),
-      // How far ahead of the viewer this proxy lets the encoder run, in seconds
-      // of playback. The browser sizes its own forward buffer from it, so the
-      // two sides agree by construction instead of each carrying a constant of
-      // its own — which is how the browser came to hold thirty seconds while
-      // two minutes stood produced on disk (roadmap item 4).
-      lookaheadSeconds: hlsSessionManager.lookaheadSeconds
-    });
-  } catch (error) {
-    if (error instanceof Error && error.code === "TRANSCODE_DISABLED") {
-      return reply.code(409).send({ error: error.message });
-    }
-    const message = error instanceof Error ? error.message : String(error);
-    // Say why on the proxy's own log, not only in the answer. This route
-    // answered 500 for every viewer of proxy 2.9.101-2.9.102 (an undeclared
-    // constant) and the addon log carried nothing but the data-channel layer's
-    // bare "→ 500": the cause had to be recovered by replaying the request
-    // against the live proxy. The stack is worth the two lines it costs — a
-    // programming error here is invisible to the viewer, who only sees that
-    // nothing plays.
-    logger.error(
-      `transcode-sessions: ${sourceKey}:${fileIndex} failed to prepare: ${message}\n` +
-        `${error instanceof Error ? (error.stack ?? "") : ""}`
-    );
-    return reply.code(500).send({ error: `Failed to prepare transcode session: ${message}` });
-  }
-}
+/**
+ * Create or return an existing HLS transcode session for a torrent file.
+ *
+ * POST /api/transcode-sessions
+ *
+ * @param {import("fastify").FastifyRequest} req
+ * @param {import("fastify").FastifyReply} reply
+ * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager, sourceRegistry: object, torrentPool: object }} deps
+ * @returns {Promise<void>}
+ */
+
+import { logger } from "../../../utils/logger.js";
+
+/**
+ * Extract a plain object from the request body, guarding against
+ * non-object payloads (arrays, primitives, null).
+ *
+ * @param {unknown} body
+ * @returns {Record<string, unknown>}
+ */
+function getPayload(body) {
+  if (body && typeof body === "object" && !Array.isArray(body)) {
+    return body;
+  }
+  return {};
+}
+
+/**
+ * Claim the source's file so the pool cannot clean it up under a live session.
+ *
+ * Asynchronous underneath — the torrent lives on another thread — but the
+ * caller needs a release function immediately, so the claim is chased and the
+ * release waits for it.
+ *
+ * @param {{ sourceRegistry: object, torrentPool: object, sourceKey: string, fileIndex: number }} params
+ * @returns {() => void}
+ */
+function holdSource({ sourceRegistry, torrentPool, sourceKey, fileIndex }) {
+  let release = null;
+  let releasedEarly = false;
+  const record = sourceRegistry?.get?.(sourceKey);
+  if (!record) {
+    return () => {};
+  }
+  void Promise.resolve(torrentPool.getTorrent(record.sourceType, record.source))
+    .then((torrent) => {
+      release = torrentPool.acquireFile(torrent, fileIndex);
+      if (releasedEarly) {
+        release();
+      }
+    })
+    .catch(() => {});
+  return () => {
+    releasedEarly = true;
+    if (typeof release === "function") {
+      release();
+      release = null;
+    }
+  };
+}
+
+export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager, sourceRegistry, torrentPool }) {
+  const payload = getPayload(req.body);
+  const sourceKey = typeof payload.sourceKey === "string" ? payload.sourceKey.trim() : "";
+  const fileIndex = Number(payload.fileIndex);
+  const transcodeVideo = payload.transcodeVideo === true;
+  const transcodeAudio = payload.transcodeAudio === true;
+  const consumerId = typeof payload.consumerId === "string" ? payload.consumerId.trim() : "";
+  const fileName = typeof payload.fileName === "string" ? payload.fileName.trim() : "";
+  const targetWidth = Number(payload.targetWidth);
+  const targetHeight = Number(payload.targetHeight);
+  // Manual quality: the target box is a user-forced resolution, encoded exactly
+  // (capped to source), with the realtime budget's auto-downscale + runtime
+  // downswitch disabled for the session.
+  const manualQuality = payload.manualQuality === true;
+  // Whether this browser will take its audio from a separate rendition group in
+  // the master playlist rather than muxed into the picture. It has to say so:
+  // publishing renditions AND muxing the same audio would play it twice, while
+  // a browser that does not know about them would get no sound at all.
+  const audioRenditions = payload.audioRenditions === true;
+  const startPositionSeconds = Number(payload.startPositionSeconds);
+  const audioTrackIndex = Number(payload.audioTrackIndex);
+  // Which container to produce. The browser knows what its media stack will
+  // accept for the tracks it asked to be copied; an absent or unknown value
+  // leaves the proxy's own `--segment-format` in charge.
+  const segmentFormatId =
+    typeof payload.segmentFormat === "string" ? payload.segmentFormat.trim() : "";
+
+  if (!sourceKey || !Number.isInteger(fileIndex) || fileIndex < 0) {
+    return reply.code(400).send({ error: "sourceKey and valid fileIndex are required." });
+  }
+
+  try {
+    const session = await hlsSessionManager.createOrGetSession({
+      sourceKey,
+      fileIndex,
+      transcodeVideo,
+      transcodeAudio,
+      consumerId,
+      fileName,
+      targetWidth: Number.isInteger(targetWidth) && targetWidth > 0 ? targetWidth : 0,
+      targetHeight: Number.isInteger(targetHeight) && targetHeight > 0 ? targetHeight : 0,
+      manualQuality,
+      audioRenditions,
+      startPositionSeconds:
+        Number.isFinite(startPositionSeconds) && startPositionSeconds > 0
+          ? startPositionSeconds
+          : 0,
+      audioTrackIndex:
+        Number.isInteger(audioTrackIndex) && audioTrackIndex > 0 ? audioTrackIndex : 0,
+      segmentFormatId,
+      // Hold the torrent for as long as this session lives. Reads take a claim
+      // only while they run, and a seek leaves a gap with no read at all — the
+      // disk sweep caught that gap on 2026-08-06 and deleted the film being
+      // watched.
+      // Takes the file to hold, because a session does not always read the file
+      // it was created for: a release whose dub ships as its own file gives that
+      // soundtrack a session of its own, reading a different index of the same
+      // torrent. Defaults to the picture, which is every other case.
+      acquireSource: (heldFileIndex = fileIndex) =>
+        holdSource({
+          sourceRegistry,
+          torrentPool,
+          sourceKey,
+          fileIndex: Number.isInteger(heldFileIndex) ? heldFileIndex : fileIndex
+        })
+    });
+    // The index of quality variants, when this session has more than one to
+    // offer. Its presence is what tells the browser it can change quality
+    // without a new session: the player switches variants itself, appending the
+    // new one after what is already buffered. Absent for a copied video, whose
+    // segments are cut at the source's own keyframes and so cannot be spliced
+    // with a re-encoded rung.
+    const hasVariants = hlsSessionManager.buildMasterPlaylist(session.id) !== null;
+    return reply.send({
+      sessionId: session.id,
+      playlistPath: `/transcode/${session.id}/index.m3u8`,
+      ...(hasVariants
+        ? {
+            masterPath: `/transcode/${session.id}/master.m3u8`,
+            // Which of the master's variants this session IS. The browser pins
+            // the player to it, so loading the master costs nothing: an encoder
+            // is already producing that height, and any other rung would be a
+            // second cold start before the first frame.
+            variantHeight: hlsSessionManager.liveOutputs.variantHeightOf(session)
+          }
+        : {}),
+      // The heights this host will actually serve this file at, largest first
+      // — the ladder minus every rung it cannot produce faster than it is
+      // watched. The browser needs it whether or not a master exists: without
+      // it, it fell back to a ladder of its own invention and offered rungs the
+      // proxy had just refused, and picking one re-opened the session at a
+      // height measured at a third of realtime.
+      offeredHeights: hlsSessionManager.offeredHeights(session),
+      // What this session's output will carry, stated rather than left to be
+      // discovered. The browser checks what it actually got against this: a
+      // track that never arrives is otherwise noticed only by its absence,
+      // minutes later, as a black picture with working sound.
+      tracks: hlsSessionManager.declaredTracks(session),
+      // How far ahead of the viewer this proxy lets the encoder run, in seconds
+      // of playback. The browser sizes its own forward buffer from it, so the
+      // two sides agree by construction instead of each carrying a constant of
+      // its own — which is how the browser came to hold thirty seconds while
+      // two minutes stood produced on disk (roadmap item 4).
+      lookaheadSeconds: hlsSessionManager.lookaheadSeconds
+    });
+  } catch (error) {
+    if (error instanceof Error && error.code === "TRANSCODE_DISABLED") {
+      return reply.code(409).send({ error: error.message });
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    // Say why on the proxy's own log, not only in the answer. This route
+    // answered 500 for every viewer of proxy 2.9.101-2.9.102 (an undeclared
+    // constant) and the addon log carried nothing but the data-channel layer's
+    // bare "→ 500": the cause had to be recovered by replaying the request
+    // against the live proxy. The stack is worth the two lines it costs — a
+    // programming error here is invisible to the viewer, who only sees that
+    // nothing plays.
+    logger.error(
+      `transcode-sessions: ${sourceKey}:${fileIndex} failed to prepare: ${message}\n` +
+        `${error instanceof Error ? (error.stack ?? "") : ""}`
+    );
+    return reply.code(500).send({ error: `Failed to prepare transcode session: ${message}` });
+  }
+}

package/routes/api/transcode-sessions/progress/get.js

@@ -14,7 +14,11 @@ export async function handleApiTranscodeSessionsProgressGet(req, reply, { hlsSes
     return reply.code(400).send({ error: "sessionId is required." });
   }
 
-  const progress = await hlsSessionManager.getSessionProgress(sessionId);
+  // Whose progress. One picture serves everyone watching it, and after a
+  // quality change the stream on screen is another session — a different one
+  // for each viewer who changed.
+  const consumerId = typeof req.query?.consumer === "string" ? req.query.consumer : "";
+  const progress = await hlsSessionManager.getSessionProgress(sessionId, consumerId);
   if (!progress) {
     return reply.code(404).send({ error: "Transcode session was not found." });
   }

package/routes/transcode/audio-file/get.js

@@ -25,7 +25,17 @@ export async function handleTranscodeAudioFileGet(req, reply, { hlsSessionManage
   const trackIndex = Number(req.params.trackIndex);
   const fileName = typeof req.params.fileName === "string" ? req.params.fileName : "";
 
-  const resolved = await hlsSessionManager.resolveAudioRenditionFile(baseSessionId, trackIndex, fileName);
+  // Which viewer is asking. One picture serves everyone watching it, and the
+  // soundtrack each of them chose is their own: without this, a segment request
+  // from one viewer would be read as everybody moving to that track, and the
+  // other viewer's encoder would be stopped once per segment.
+  const consumerId = typeof req.query?.consumer === "string" ? req.query.consumer : "";
+  const resolved = await hlsSessionManager.resolveAudioRenditionFile(
+    baseSessionId,
+    trackIndex,
+    fileName,
+    consumerId
+  );
   if (resolved.error) {
     // Retryable, like every other not-ready answer on this path: a 500 for a
     // rendition playlist would end the stream over something the next attempt

package/routes/transcode/audio-warm/get.js

@@ -36,9 +36,19 @@ export async function handleTranscodeAudioWarmGet(req, reply, { hlsSessionManage
     return reply.code(400).send({ error: "A track index and a non-negative position are required." });
   }
 
+  // Whose track change this is. Another viewer of the same picture may be
+  // listening to something else, and preparing a track must not be read as
+  // everybody moving to it.
+  const consumerId = typeof req.query?.consumer === "string" ? req.query.consumer : "";
+
   let prepared;
   try {
-    prepared = await hlsSessionManager.prepareAudioTrack(baseSessionId, trackIndex, positionSeconds);
+    prepared = await hlsSessionManager.prepareAudioTrack(
+      baseSessionId,
+      trackIndex,
+      positionSeconds,
+      consumerId
+    );
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
     reply.header("Retry-After", "1");

package/routes/transcode/session-file/get.js

@@ -117,7 +117,7 @@ export async function serveSessionFile(req, reply, { hlsSessionManager, sessionI
     // where the viewer was.
     logger.info(
       `[hold] ${fileName} refused: the viewer is at ` +
-      `${hlsSessionManager.viewerPositionOf(sessionId).toFixed(1)}s and this is not the segment there`
+      `${hlsSessionManager.viewerPositionOf(sessionId, consumerId).toFixed(1)}s and this is not the segment there`
     );
     reply.header("Retry-After", "0");
     return reply.code(503).send({ error: "Superseded by a seek." });

package/routes/transcode/variant-file/get.js

@@ -26,7 +26,16 @@ export async function handleTranscodeVariantFileGet(req, reply, { hlsSessionMana
   const height = Number(req.params.height);
   const fileName = typeof req.params.fileName === "string" ? req.params.fileName : "";
 
-  const resolved = await hlsSessionManager.resolveVariantFile(baseSessionId, height, fileName);
+  // Which viewer is asking. Two viewers of one picture can be on two rungs, and
+  // a segment request is what says which rung a viewer is watching — read as
+  // the session's own, one of them would take the other off their step.
+  const consumerId = typeof req.query?.consumer === "string" ? req.query.consumer : "";
+  const resolved = await hlsSessionManager.resolveVariantFile(
+    baseSessionId,
+    height,
+    fileName,
+    consumerId
+  );
   if (resolved.error) {
     // Preparing the variant failed — a probe, a keyframe index, an input that
     // is not there yet. Retryable, like every other not-ready answer on this

package/scripts/render-run-graph.js

@@ -28,7 +28,7 @@ import {
   mayRestart,
   processCanBeSignalled,
   wireState
-} from "../services/encode-run-state.js";
+} from "../services/encode/encode-run-state.js";
 
 /** Where the rendered document lives. */
 export const GRAPH_DOC_PATH = path.join(
@@ -97,7 +97,7 @@ export function renderRunGraphMarkdown() {
   const lines = [];
 
   lines.push(
-    "<!-- GENERATED from services/encode-run-state.js by scripts/render-run-graph.js.",
+    "<!-- GENERATED from services/encode/encode-run-state.js by scripts/render-run-graph.js.",
     "     Do not edit by hand: change the table and run `npm run graph`. -->",
     "",
     "# The encoder run — states and transitions",

package/server.js

@@ -210,6 +210,23 @@ export async function startProxyServer({
         return null;
       }
     },
+    // Where the file's keyframes are, read by the same container that answered
+    // the two above. It used to be read by the session itself over this proxy's
+    // own HTTP, once per session — so two viewers opening one film read the
+    // same table twice, and each of them could get a different answer about
+    // whether the picture can be copied at all.
+    getContainerKeyframes: async ({ sourceKey, fileIndex }) => {
+      const record = sourceRegistry.get(sourceKey);
+      if (!record || typeof torrentPool.getContainerKeyframes !== "function") {
+        return null;
+      }
+      try {
+        const torrent = await torrentPool.getTorrent(record.sourceType, record.source);
+        return await torrentPool.getContainerKeyframes(torrent, fileIndex);
+      } catch {
+        return null;
+      }
+    },
     // Pull one whole file onto the disk. Used for a soundtrack that ships beside
     // the picture, once the encoder is as far ahead of the viewer as it is
     // allowed to get — the one moment the swarm's capacity is demonstrably
@@ -232,6 +249,14 @@ export async function startProxyServer({
       await torrentPool.fillFileInBackground?.(torrent, fileIndex);
     }
   });
+  // What the last life of this process left on the disk. The kernel kills this
+  // one often enough for that to be an ordinary state rather than an odd one —
+  // twice in a single viewing on 2026-09-02 — and when it does, no exit handler
+  // runs and nothing is cleared up. So this is both the cleanup and the only
+  // record that those encoders ended at all: it says what it found before it
+  // decides anything, keeps the segments whose closure is proven, and removes
+  // the one piece per output that was being written when the process died.
+  hlsSessionManager.adoptSegmentsLeftBehind();
   const playbackPlanner = createPlaybackPlanner({
     ffmpegBin,
     transcodeAudioEnabled: transcodeAudio,