@torrent-tv/proxy 2.83.3 → 2.83.5

package/routes/api/sources/files/get.js

@@ -1,3 +1,5 @@
+import { contentsOf } from "../../../../services/torrent/Contents.js";
+
 /**
  * List the files of a registered source (torrent file OR magnet).
  *
@@ -70,17 +72,29 @@ export async function handleApiSourceFilesGet(req, reply, { sourceRegistry, torr
   }
 
   const torrent = result;
-  const files = (torrent.files ?? []).map((file, index) => ({
-    index,
-    name: file?.name ?? "",
-    // Path relative to the torrent root (matches the browser's own parser).
-    relativePath: file?.path ?? file?.name ?? "",
-    length: Number.isFinite(file?.length) ? file.length : 0
-  }));
-
+  // WHAT IS IN THIS TORRENT, decided here and nowhere else. The browser used to
+  // decide it again — a list of video extensions in its parser and a second,
+  // shorter pair inside its picker — and the three answers had already diverged
+  // (measured 2026-09-12: `.dat` was offered there and not counted here, which
+  // also decides whether a sidecar whose name matches nothing can belong to the
+  // only video present). It ships the paths already relative to the torrent
+  // root, so there is no stripping rule on the other side either.
+  const contents = contentsOf(torrent);
   return reply.send({
     name: torrent.name ?? "",
     infoHash: torrent.infoHash ?? "",
-    files
+    // In the order a person reads them — by folder, then by name, with runs of
+    // digits compared as numbers. A torrent's own order is whatever the tool
+    // that made it chose, and it is routinely by size.
+    files: contents.files(),
+    // The pictures, each with what belongs to it. By index, because the files
+    // themselves are in the list above and saying them twice is how two copies
+    // of one fact start.
+    items: contents.items.map((item) => ({
+      fileIndex: item.fileIndex,
+      audio: item.audio.map((part) => part.fileIndex),
+      subtitles: item.subtitles.map((part) => part.fileIndex),
+      images: item.images.map((part) => part.fileIndex)
+    }))
   });
 }

package/routes/api/sources/warm/post.js

@@ -1,9 +1,6 @@
 import { logger } from "../../../../utils/logger.js";
-import {
-  countVideoFiles,
-  matchSidecarFiles,
-  TEXT_SUBTITLE_SIDECAR_EXTENSIONS
-} from "../../../../services/torrent/files.js";
+import { TEXT_SUBTITLE_SIDECAR_EXTENSIONS } from "../../../../services/torrent/files.js";
+import { contentsOf } from "../../../../services/torrent/Contents.js";
 
 /**
  * Start fetching a source before anyone asks to play it.
@@ -70,17 +67,26 @@ export async function handleApiSourceWarmPost(req, reply, { sourceRegistry, torr
     return reply.send({ started: false, swarm: false, edges: false });
   }
 
-  // The edges are only worth fetching once it is known WHICH file will be
-  // played: on a season pack, warming twenty episodes' worth would spend the
-  // pool owner's bandwidth on nineteen files nobody opened. The caller passes
-  // an index when the torrent holds a single video, and again later if it
-  // wants to.
+  // WHICH FILE THIS IS ABOUT. The caller names one when it knows — a torrent
+  // with a single video, or an episode the viewer has settled on — and on a
+  // season pack it names none, because nobody has chosen yet.
+  //
+  // Then the first item of the torrent stands in for the choice. One item, not
+  // twenty: warming a whole pack's worth of edges would spend the pool owner's
+  // bandwidth on nineteen files nobody opened, while one item is two pieces and
+  // is also the likeliest pick. It is stated as something nobody is waiting
+  // for, so on a proxy serving somebody else it costs nothing at all until
+  // their own film has everything it needs.
+  const contents = contentsOf(torrent);
+  const named = fileIndex !== null && torrent.files?.[fileIndex] ? fileIndex : null;
+  const candidate = named ?? contents.items[0]?.fileIndex ?? null;
+
   let edges = false;
-  if (fileIndex !== null && torrent.files?.[fileIndex]) {
+  if (candidate !== null) {
     edges = true;
     // Deliberately not awaited: this is the multi-second part, and the point of
     // the whole route is that the viewer goes on choosing while it happens.
-    Promise.resolve(torrentPool.prefetchFileEdges(torrent, fileIndex)).catch((error) => {
+    Promise.resolve(torrentPool.prefetchFileEdges(torrent, candidate)).catch((error) => {
       const message = error instanceof Error ? error.message : String(error);
       logger.warn(`warm ${sourceKey.slice(0, 8)}: file edges failed: ${message}`);
     });
@@ -88,8 +94,8 @@ export async function handleApiSourceWarmPost(req, reply, { sourceRegistry, torr
     // the playback plan, so they must not queue behind a region nobody is
     // reading yet. This one only has to arrive before the encoder does, and the
     // encoder is a plan and a session away.
-    if (positionSeconds > 0 && typeof torrentPool.warmResumePosition === "function") {
-      Promise.resolve(torrentPool.warmResumePosition(torrent, fileIndex, positionSeconds)).catch(
+    if (named !== null && positionSeconds > 0 && typeof torrentPool.warmResumePosition === "function") {
+      Promise.resolve(torrentPool.warmResumePosition(torrent, named, positionSeconds)).catch(
         (error) => {
           const message = error instanceof Error ? error.message : String(error);
           logger.warn(`warm ${sourceKey.slice(0, 8)}: the viewer's position failed: ${message}`);
@@ -116,13 +122,8 @@ export async function handleApiSourceWarmPost(req, reply, { sourceRegistry, torr
   // does. The rest of it is fetched when it is played, and nothing here spends
   // the pool owner's bandwidth on a track nobody chose.
   let sidecars = 0;
-  if (fileIndex !== null && Array.isArray(torrent.files)) {
-    const matched = matchSidecarFiles({
-      files: torrent.files,
-      videoIndex: fileIndex,
-      torrentName: typeof torrent.name === "string" ? torrent.name : "",
-      videoCount: countVideoFiles(torrent.files)
-    });
+  if (candidate !== null && Array.isArray(torrent.files)) {
+    const matched = contents.sidecarsOf(candidate);
     const warmOne = (file, options) => {
       sidecars += 1;
       // Not awaited, like the picture's own edges above: the point of this route
@@ -162,7 +163,10 @@ export async function handleApiSourceWarmPost(req, reply, { sourceRegistry, torr
 
   logger.info(
     `warm ${sourceKey.slice(0, 8)}: swarm started for "${torrent.name}"` +
-      (edges ? `, fetching the edges of file ${fileIndex}` : ", file not chosen yet") +
+      (edges
+        ? `, fetching the edges of file ${candidate}` +
+          (named === null ? " — the first item, since nothing is chosen yet" : "")
+        : ", and it holds nothing to fetch the edges of") +
       (sidecars > 0 ? ` and of ${sidecars} file(s) beside it` : "")
   );
 

package/routes/api/transcode-sessions/post.js

@@ -25,39 +25,6 @@ function getPayload(body) {
   return {};
 }
 
-/**
- * Claim the source's file so the pool cannot clean it up under a live session.
- *
- * Asynchronous underneath — the torrent lives on another thread — but the
- * caller needs a release function immediately, so the claim is chased and the
- * release waits for it.
- *
- * @param {{ sourceRegistry: object, torrentPool: object, sourceKey: string, fileIndex: number }} params
- * @returns {() => void}
- */
-function holdSource({ sourceRegistry, torrentPool, sourceKey, fileIndex }) {
-  let release = null;
-  let releasedEarly = false;
-  const record = sourceRegistry?.get?.(sourceKey);
-  if (!record) {
-    return () => {};
-  }
-  void Promise.resolve(torrentPool.getTorrent(record.sourceType, record.source))
-    .then((torrent) => {
-      release = torrentPool.acquireFile(torrent, fileIndex);
-      if (releasedEarly) {
-        release();
-      }
-    })
-    .catch(() => {});
-  return () => {
-    releasedEarly = true;
-    if (typeof release === "function") {
-      release();
-      release = null;
-    }
-  };
-}
 
 export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager, sourceRegistry, torrentPool }) {
   const payload = getPayload(req.body);
@@ -108,22 +75,7 @@ export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionMan
           : 0,
       audioTrackIndex:
         Number.isInteger(audioTrackIndex) && audioTrackIndex > 0 ? audioTrackIndex : 0,
-      segmentFormatId,
-      // Hold the torrent for as long as this session lives. Reads take a claim
-      // only while they run, and a seek leaves a gap with no read at all — the
-      // disk sweep caught that gap on 2026-08-06 and deleted the film being
-      // watched.
-      // Takes the file to hold, because a session does not always read the file
-      // it was created for: a release whose dub ships as its own file gives that
-      // soundtrack a session of its own, reading a different index of the same
-      // torrent. Defaults to the picture, which is every other case.
-      acquireSource: (heldFileIndex = fileIndex) =>
-        holdSource({
-          sourceRegistry,
-          torrentPool,
-          sourceKey,
-          fileIndex: Number.isInteger(heldFileIndex) ? heldFileIndex : fileIndex
-        })
+      segmentFormatId
     });
     // The index of quality variants, when this session has more than one to
     // offer. Its presence is what tells the browser it can change quality

package/routes/stream/get.js

@@ -208,8 +208,6 @@ export async function handleStreamGet(req, reply, { sourceRegistry, torrentPool,
     return;
   }
 
-  const releaseFile = torrentPool.acquireFile(torrent, fileIndex);
-
   const range = parseRange(req.headers.range, file.length);
   // Prioritize the pieces at this read position so a seek (a request at a new
   // byte offset) downloads first instead of waiting behind the sequential
@@ -343,8 +341,6 @@ export async function handleStreamGet(req, reply, { sourceRegistry, torrentPool,
         logger.warn(line);
       }
       reply.raw.destroy();
-    } finally {
-      releaseFile();
     }
     return;
   }
@@ -355,41 +351,11 @@ export async function handleStreamGet(req, reply, { sourceRegistry, torrentPool,
 
   if (!range) {
     reply.header("Content-Length", String(file.length));
-    const stream = file.createReadStream();
-    bindRelease(stream, reply, releaseFile);
-    return reply.send(stream);
+    return reply.send(file.createReadStream());
   }
 
   reply.code(206);
   reply.header("Content-Length", String(contentLength));
   reply.header("Content-Range", `bytes ${start}-${end}/${file.length}`);
-  const stream = file.createReadStream({ start, end });
-  bindRelease(stream, reply, releaseFile);
-  return reply.send(stream);
-}
-
-/**
- * Attach event listeners that release the file reference exactly once when
- * the stream or the underlying HTTP connection closes.
- *
- * @param {import("node:stream").Readable} stream
- * @param {import("fastify").FastifyReply} reply
- * @param {() => void} release
- * @returns {void}
- */
-function bindRelease(stream, reply, release) {
-  let released = false;
-  const releaseOnce = () => {
-    if (released) {
-      return;
-    }
-    released = true;
-    release();
-  };
-
-  stream.on("close", releaseOnce);
-  stream.on("end", releaseOnce);
-  stream.on("error", releaseOnce);
-  reply.raw.once("close", releaseOnce);
-  reply.raw.once("finish", releaseOnce);
+  return reply.send(file.createReadStream({ start, end }));
 }

package/services/controllers/SubtitleController.js

@@ -51,7 +51,6 @@ export class SubtitleController {
     if (!hasTrack) {
       const name = file.name ?? "";
       const ext = name.slice(name.lastIndexOf(".")).toLowerCase();
-      const release = this.torrentPool.acquireFile(torrent, fileIndex);
       try {
         const bytes = await readFileFully(file, EXTERNAL_MAX_BYTES);
         const text = SubtitleFileContainer.decodeBytes(bytes);
@@ -65,8 +64,6 @@ export class SubtitleController {
         return { vtt, language: TextSubtitleTrack.detectLanguageFromVtt(vtt), headers: {} };
       } catch (e) {
         return { error: `Could not read subtitle file: ${e?.message ?? e}`, status: 502 };
-      } finally {
-        release();
       }
     }
 

package/services/download/withdraw-claim.js

@@ -0,0 +1,80 @@
+/**
+ * @file Withdrawing the claim that this proxy has a piece.
+ *
+ * **The fact has one owner and it is the store.** The store holds the bytes, so
+ * it says what this proxy has. The library keeps a second copy of that fact in
+ * its completion bitfield, and until 2026-09-12 nothing reconciled the two: the
+ * disk tier drops a piece once every reader is past it — correctly, and that is
+ * what bounds the spill — while the bitfield went on saying the piece was
+ * verified. A read then concluded the piece was had, asked for it, was told it
+ * was absent, and failed. Nor was it ever fetched again, because the library
+ * does not download what it believes it already owns.
+ *
+ * Field 2026-09-12: a film played 80 seconds; the encoder ran on to 725 s, so
+ * some 565 spilled pieces fell behind every read head and were dropped,
+ * including piece 0; the encoder then lost its input and restarted, which
+ * re-opens the input at byte 0; and `/stream` answered `0 of 2363497962 bytes:
+ * Piece 0 is verified but absent from the store` to every read for the next 92
+ * minutes while the browser retried one segment and the picture stood still.
+ *
+ * So the eviction's own bargain — "a seek back re-downloads it" — is made true
+ * here, and the bitfield becomes a projection of what the store holds.
+ *
+ * **Why it is a plain function.** It takes the values it needs and holds
+ * nothing: no pool, no store, no client. That is what lets it be exercised with
+ * an object literal, and it is the rule the layers are checked against — a layer
+ * must be usable with plain values alone, with no process, no disk and no clock.
+ */
+
+/**
+ * Tell the library it no longer has a piece, so the next read of it waits for a
+ * download instead of failing.
+ *
+ * **What it deliberately does not do.** The library's `_markUnverified` would
+ * also re-select the piece; it does not here, because every torrent is added
+ * with `deselect: true`, which sets the library's own `_startAsDeselected` and
+ * makes it skip that call. The download set has exactly one owner —
+ * `SwarmSelection`, from the priority map — and a withdrawn piece is fetched
+ * again when a read states it, which is the same statement every other piece
+ * waits on.
+ *
+ * @param {object} what
+ * @param {number} what.index - The piece the store can no longer produce.
+ * @param {object[]} [what.files] - The store's own files; the torrent that owns
+ *   them is found through one of them, because the store has no idea what a
+ *   torrent is.
+ * @param {object} [what.torrent] - Given directly instead of through `files`.
+ * @param {(line: string) => void} [what.warn] - Said when the library refuses.
+ * @returns {"withdrawn" | "nothing-to-withdraw" | "no-torrent" | "refused"}
+ */
+export function withdrawClaim({ index, files, torrent, warn = () => undefined }) {
+  if (!Number.isInteger(index) || index < 0) {
+    return "nothing-to-withdraw";
+  }
+  const owner = torrent ?? files?.[0]?._torrent ?? null;
+  // A torrent being destroyed is the ordinary case at the end of a session, and
+  // it has no claim left to withdraw: the store is going with it.
+  if (!owner || owner.destroyed || typeof owner._markUnverified !== "function") {
+    return "no-torrent";
+  }
+  // NOTHING TO WITHDRAW, which is most of the time: the store also drops pieces
+  // it never completed, and marking one unverified that the library already
+  // knows is missing would re-create the piece and discard whatever blocks are
+  // in flight for it.
+  if (!owner.bitfield?.get?.(index)) {
+    return "nothing-to-withdraw";
+  }
+  try {
+    owner._markUnverified(index);
+  } catch (error) {
+    // This reaches into the library's own bookkeeping. If a later version
+    // changes it, the honest result is a line saying so rather than an eviction
+    // that fails.
+    warn(
+      `could not withdraw the claim on piece ${index} of ${owner.name ?? "?"}: ` +
+      `${error?.message ?? error}`
+    );
+    return "refused";
+  }
+  return "withdrawn";
+}

package/services/hls-session-manager.js

@@ -441,13 +441,6 @@ const START_FAST_FAIL_MS = 2_000;
 // for whatever residual case still fails — not a second competing "fix" that
 // blindly retries the identical command hoping for a different result.
 const MAX_FAILED_STARTS = 3;
-// A run that lost its INPUT is retried rather than condemned: the torrent can
-// be added again and the pieces downloaded again, so the data being gone is a
-// wait, not a verdict. Backed off so a source that is truly unavailable costs a
-// process every few seconds rather than continuously, and never given up on —
-// the session's own idle TTL is what ends it if the viewer leaves.
-const INPUT_RETRY_BASE_MS = 2_000;
-const INPUT_RETRY_MAX_MS = 15_000;
 // Idle TTL: a session is disposed this long after the last segment/playlist
 // access. Long enough that a viewer who pauses, backgrounds the tab, or briefly
 // turns the phone off can resume WITHOUT a cold ffmpeg restart (the warm session
@@ -1577,6 +1570,11 @@ export class HlsSessionManager {
       contentionPenalties: this.contentionPenalties,
       startingSpeedFor: (address) => this.encodeCost.speedForOutput(address),
       segmentStore: this.segmentStore,
+      // HOW IT ASKS TO DECIDE AGAIN. A plan that refuses to place anything
+      // because an output's input is away needs something to bring it back:
+      // nothing about the state changes while the data is missing, so no event
+      // arrives on its own.
+      planSoon: () => this.planEncodersSoon(),
       logger
     });
     // What a start and a stop were measured to cost here, before any viewer
@@ -1680,12 +1678,7 @@ export class HlsSessionManager {
     // keyframe times and which container they were read from. Present only for
     // a variant of a session cut at the source's keyframes, and it is what
     // makes the two interchangeable.
-    inheritedGrid = null,
-    // Called once for a session that is actually created, and expected to
-    // return a function that lets the source go. It is what keeps the torrent's
-    // data alive for as long as a viewer has a session on it — see
-    // disposeSession.
-    acquireSource = null
+    inheritedGrid = null
   }) {
     if (!this.enabled) {
       const error = new Error("Audio transcoding is disabled on this proxy.");
@@ -2540,40 +2533,6 @@ export class HlsSessionManager {
         lastLoggedAt: 0
       }
     };
-    // Kept so a variant of this session can take its own hold on the same
-    // source: a variant is another encode of the same file and must keep the
-    // torrent's data alive exactly as this one does.
-    session.acquireSource = typeof acquireSource === "function" ? acquireSource : null;
-    if (typeof acquireSource === "function") {
-      // One claim per file this session READS. Almost always that is one file;
-      // a muxed session whose soundtrack ships beside the picture reads two, and
-      // holding only the picture would leave the sound to be swept off the disk
-      // from under a running encoder.
-      const claim = (heldFileIndex) => {
-        try {
-          const release = acquireSource(heldFileIndex);
-          return typeof release === "function" ? release : null;
-        } catch {
-          return null;
-        }
-      };
-      const releases = [claim(undefined)];
-      if (audioInputUrl) {
-        releases.push(claim(audioSource.fileIndex));
-      }
-      const held = releases.filter((release) => typeof release === "function");
-      session.releaseSource = held.length > 0
-        ? () => {
-            for (const release of held) {
-              try {
-                release();
-              } catch {
-                // Best effort — a session must always finish being disposed.
-              }
-            }
-          }
-        : null;
-    }
     // The viewer who asked for this session, so a browser that names itself
     // never has to have requested a segment first for its own soundtrack choice
     // to be known — nor for its own POSITION to be known, which is the same
@@ -5748,33 +5707,19 @@ export class HlsSessionManager {
     // condemn a session whose data merely went away.
     if (ended.ending === ENCODE_EXIT.INPUT_LOST) {
       session.inputRetryCount = (session.inputRetryCount ?? 0) + 1;
-      const delayMs = Math.min(
-        INPUT_RETRY_MAX_MS,
-        INPUT_RETRY_BASE_MS * 2 ** Math.min(session.inputRetryCount - 1, 6)
-      );
       logger.warn(
         `transcode ${session.id} encode-run #${ended.from}..#${ended.to} lost its input ` +
-          `(${session.lastError}); retrying in ${Math.round(delayMs / 1000)}s ` +
-          `(attempt ${session.inputRetryCount})`
+          `(${session.lastError}) (attempt ${session.inputRetryCount})`
       );
-      session.inputRetryTimer = setTimeout(() => {
-        session.inputRetryTimer = null;
-        if (run.state !== ENCODE_RUN_STATE.RETRY_WAIT) {
-          return;
-        }
+      // HOW LONG TO WAIT IS THE PLAN'S, and this says only what happened. The
+      // delay used to be timed here, against the dead run, which the plan never
+      // consults — so it placed a fresh run at the same spot as fast as ffmpeg
+      // could fail there: 2432 starts in 23 minutes in the field 2026-09-12,
+      // against a delay that had reached its 15 s ceiling long before. The
+      // orchestrator holds it now, beside the decision it governs.
+      if (run.state === ENCODE_RUN_STATE.RETRY_WAIT) {
         run.retryDue();
-        // The data may be back, which is a reason to DECIDE again and not a
-        // decision. Where to start is the plan's, from where the viewers are;
-        // this used to start one at the segment last requested, which is the
-        // player's read head rather than anybody's position, and is a number
-        // requests are explicitly not allowed to steer an encoder by.
-        //
-        // What the delay is for stays: the plan is a function of the state, and
-        // nothing about the state changes while the torrent is away, so it would
-        // command the same start as fast as ffmpeg could fail.
-        this.planEncodersSoon();
-      }, delayMs);
-      session.inputRetryTimer.unref?.();
+      }
       return;
     }
     // A run that exits THIS fast never did real work: it failed at the start
@@ -7686,14 +7631,6 @@ export class HlsSessionManager {
    * @returns {void}
    */
   #stopEncodeRun(session, reason) {
-    // Everything armed to re-decide on this session's behalf. A stop that
-    // leaves the input-retry timer running is not a stop: it fires seconds
-    // later and has the plan asked again for a session nobody is watching, and
-    // torrent starvation, which is what arms it, is routine here.
-    if (session.inputRetryTimer) {
-      clearTimeout(session.inputRetryTimer);
-      session.inputRetryTimer = null;
-    }
     const running = liveRunsOf(session);
     if (running.length === 0) {
       return;
@@ -7839,8 +7776,7 @@ export class HlsSessionManager {
             // creations (field 2026-08-17, corrections of 0.6-2.9 s).
             published: base.timeline.published
           }
-        : null,
-      acquireSource: base.acquireSource
+        : null
     })
       .then(async (variant) => {
         // Making a session takes seconds — a probe and a keyframe index — and
@@ -8628,15 +8564,7 @@ export class HlsSessionManager {
             boundaries: base.timeline.boundaries,
             published: base.timeline.published
           }
-        : null,
-      // Hold the file this rendition will READ. For a soundtrack shipped beside
-      // the picture that is a different file of the same torrent, and nothing
-      // else claims it: the base holds the picture, and the disk sweep deletes
-      // what nobody is holding — which is how a film being watched was deleted
-      // on 2026-08-06.
-      acquireSource: () => base.acquireSource?.(
-        this.#resolveAudioSource(base.file.sourceKey, base.file.fileIndex, trackIndex).fileIndex
-      )
+        : null
     });
     return rendition ?? null;
   }
@@ -10017,27 +9945,6 @@ export class HlsSessionManager {
       }
     }
 
-    // Let go of the source. While a session exists its torrent must survive
-    // both cleanups the pool runs, and until now neither knew about it: the
-    // only claim on a file is taken by a READ, and during a seek there is no
-    // read at all — the old encoder is dead and the new one has not started.
-    // Field 2026-08-06, that window met the thirty-second disk sweep and the
-    // film being watched was evicted mid-seek, six gigabytes deleted, after
-    // which the new encoder had nothing to read. The session's own thirty
-    // minutes governed the session, never the data under it.
-    if (typeof session.releaseSource === "function") {
-      try {
-        session.releaseSource();
-      } catch {
-        // Best effort — a session must always finish being disposed.
-      }
-      session.releaseSource = null;
-    }
-
-    if (session.inputRetryTimer) {
-      clearTimeout(session.inputRetryTimer);
-      session.inputRetryTimer = null;
-    }
 
     // Whether the process is still RUNNING, not whether anyone has called kill
     // on it: `.killed` means only that a signal was sent, and a run that ended