@volter/world-core 3.0.151 → 3.0.153

package/src/live/ingest.ts

@@ -0,0 +1,210 @@
+// THE INGEST (architecture, "Other wires": live media): an RTMP publisher's connection as the kernel's byte stream
+// (`TwinStream`), its publish ruled by the pack's dialect (`semantics/live.ts`), its media cut into segments whose bytes
+// go to the pack's resource blobs and whose facts go to the tree as bookkeeping (`_live`, `_live_segment`), and the
+// dialect told when the publish starts playing and when it ends. What a connection is (the chunk stream, the encoder's
+// configuration, the segment being cut) stays on the connection. The World's own writes and blobs are handed in
+// (`LiveWorld`), so this module opens no store. Nothing here runs at module scope beyond the empty registry.
+import type { TwinStream } from '../twin-fetch.ts';
+import { initBlob, LIVE, LIVE_SEGMENT, recordingOf, segmentBlob, segmentsOf, type LiveReads } from './access.ts';
+import { readAudioTag, readVideoTag } from './flv.ts';
+import { RtmpRefusal, rtmpSession } from './rtmp.ts';
+import { type Cut, LiveOverrun, Segmenter } from './segmenter.ts';
+import type { LiveAdmission, LiveDecl, LiveEngine, LivePublish, LiveRecording } from './types.ts';
+
+/** What the ingest reads and writes of the World, bound by the pack's fetch to its service and root. */
+export type LiveWorld = LiveReads & {
+  /** a bookkeeping subject written (or, with `deleted: true`, deleted) at the World's time */
+  record(type: string, id: string, fields: Record<string, unknown>, operation: string): Promise<void>;
+  putBlob(key: string, bytes: Uint8Array): Promise<void>;
+  removeBlob(key: string): Promise<void>;
+  now(): string;
+};
+
+export type LiveIngestOptions<C> = {
+  /** the World this ingest's recordings are kept in (its service and root): one publisher per stream within it */
+  world: string;
+  decls: ReadonlyArray<LiveDecl>;
+  engines: Record<string, LiveEngine<C>>;
+  readOnly: boolean;
+  /** the handler contract's context a hook runs over, opened at the moment it runs */
+  open(decl: LiveDecl, ask: LivePublish): Promise<C>;
+  /** runs a hook and the writes it causes as the vendor's own move, one correlation */
+  run<T>(fn: () => Promise<T>): Promise<T>;
+  store: LiveWorld;
+  log?(line: string): void;
+};
+
+const STREAM_ID = /^[A-Za-z0-9._-]{1,128}$/;
+/** Connections one ingest's listener takes at once: publishers and the connections still on their way to publishing. */
+const MAX_CONNECTIONS = 32;
+/** The streams being published now, per World: a second publisher to one is refused, as a vendor's ingest refuses it. */
+const publishing = new Map<string, Set<string>>();
+
+export function liveIngest<C>(options: LiveIngestOptions<C>): TwinStream {
+  for (const d of options.decls) if (!options.engines[d.id]) throw new Error(`the manifest declares the ingest ${d.id}, and semantics/live.ts exports no ${d.id}`);
+  const log = options.log ?? ((line: string) => console.error(`live: ${line}`));
+  const store = options.store;
+  const active = publishing.get(options.world) ?? publishing.set(options.world, new Set()).get(options.world)!;
+
+  // the listener's cap (serveStream reads it): a World's publishers are its encoders, a few at once
+  return Object.assign((sink: Parameters<TwinStream>[0], peer: string): ReturnType<TwinStream> => {
+    let decl: LiveDecl | undefined;
+    let ask: LivePublish | undefined;
+    let stream: string | undefined;
+    let admitted: Extract<LiveAdmission, { stream: string }> | undefined;
+    let segmenter: Segmenter | undefined;
+    let initIndex = -1;
+    let priorInit: number | undefined;
+    let started = false;
+    let metadata: Record<string, unknown> | undefined;
+    let refusedCodec: string | undefined;
+
+    const recording = (): LiveRecording => {
+      const row = store.rows(LIVE).find((r) => r.id === stream)!;
+      return recordingOf(row, segmentsOf(store, stream!));
+    };
+    const hook = async (name: 'started' | 'ended'): Promise<void> => {
+      const engine = options.engines[decl!.id]!;
+      const fn = engine[name];
+      if (!fn) return;
+      try { await options.run(async () => fn.call(engine, await options.open(decl!, ask!), recording())); }
+      catch (error) { log(`${decl!.id}'s ${name} for ${stream} was not written: ${String((error as Error)?.message ?? error)}`); }
+    };
+
+    /** A closed segment kept: its init first when it opens one, its bytes, its subject; then what `retain` lets go. */
+    const keep = async (cut: Cut): Promise<void> => {
+      if (!stream || !admitted) return;
+      if (cut.init) {
+        // a publisher that reconnects with the encoder it had plays on under the recording's last init, its timeline
+        // carried on, so no player meets a discontinuity; a changed configuration opens the next init
+        const prior = initIndex < 0 && priorInit !== undefined ? await store.blob(initBlob(stream, priorInit)) : null;
+        if (prior && sameBytes(prior, cut.init.bytes)) initIndex = priorInit!;
+        else {
+          initIndex = initIndex < 0 ? (priorInit ?? -1) + 1 : initIndex + 1;
+          await store.putBlob(initBlob(stream, initIndex), cut.init.bytes);
+        }
+        await options.run(() => store.record(LIVE, stream!, {
+          ...(cut.init!.video ? { video: cut.init!.video } : {}),
+          ...(cut.init!.audio ? { audio: cut.init!.audio } : {}),
+          ...(metadata ? { metadata } : {}),
+        }, 'live.configure'));
+      }
+      const blob = segmentBlob(stream, cut.sequence);
+      await store.putBlob(blob, cut.bytes);
+      await options.run(() => store.record(LIVE_SEGMENT, `${stream}:${cut.sequence}`, {
+        stream, seq: cut.sequence, init: initIndex, start: round(cut.start), duration: round(cut.duration), size: cut.bytes.length, blob,
+      }, 'live.segment'));
+      if (admitted.retain !== undefined && admitted.retain > 0) {
+        for (const old of segmentsOf(store, stream).slice(0, -admitted.retain)) {
+          await store.removeBlob(old.blob);
+          await options.run(() => store.record(LIVE_SEGMENT, `${stream}:${old.seq}`, { deleted: true }, 'live.segment.expire'));
+        }
+      }
+      if (!started) { started = true; await hook('started'); }
+    };
+    const keepAll = async (cuts: Cut[]): Promise<void> => { for (const cut of cuts) await keep(cut); };
+
+    return rtmpSession(sink, {
+      connect(app) {
+        decl = options.decls.find((d) => d.app === app);
+        return decl ? undefined : `There is no application ${app || '(none)'} here.`;
+      },
+      async publish(asked) {
+        if (!decl) return { code: 'NetStream.Publish.BadName', description: 'No application was connected.' };
+        if (options.readOnly) return { code: 'NetStream.Publish.Denied', description: 'This World is read-only: it records nothing.' };
+        const [key = '', query = ''] = splitOnce(asked.name, '?');
+        ask = {
+          app: asked.app, key, query: Object.fromEntries(new URLSearchParams(query)), peer,
+          ...(asked.tcUrl !== undefined ? { tcUrl: asked.tcUrl } : {}), ...(asked.flashVer !== undefined ? { flashVer: asked.flashVer } : {}), ...(asked.type !== undefined ? { type: asked.type } : {}),
+        };
+        const engine = options.engines[decl.id]!;
+        const ruling = await options.run(async () => engine.publish(await options.open(decl!, ask!), ask!));
+        if ('refused' in ruling) return { code: ruling.refused, description: ruling.description };
+        if (!STREAM_ID.test(ruling.stream)) throw new Error(`${decl.id}'s publish named the stream ${JSON.stringify(ruling.stream)}; a stream is 1-128 letters, digits, '.', '_' or '-'`);
+        if (active.has(ruling.stream)) return { code: 'NetStream.Publish.BadName', description: `The stream ${ruling.stream} is already being published.` };
+        const named = ruling.stream;
+        active.add(named);
+        try {
+          // a recording continued: its segments' numbers, its inits' and its timeline carry on from where it stood
+          const prior = store.rows(LIVE).find((r) => r.id === named && r.deleted !== true);
+          const kept = segmentsOf(store, named);
+          const last = kept[kept.length - 1];
+          const offsetMs = last ? Math.ceil((last.start + last.duration) * 1000) : 0;
+          const now = store.now();
+          await options.run(() => store.record(LIVE, named, {
+            app: ask!.app, key: ask!.key, state: 'publishing', startedAt: typeof prior?.startedAt === 'string' ? prior.startedAt : now, endedAt: null,
+            publishes: Number(prior?.publishes ?? 0) + 1, window: ruling.window ?? 6, segmentSeconds: ruling.segmentSeconds ?? 2, ...(ruling.retain !== undefined ? { retain: ruling.retain } : {}),
+          }, 'live.publish'));
+          priorInit = last?.init;
+          segmenter = new Segmenter({ targetMs: Math.max(0.5, ruling.segmentSeconds ?? 2) * 1000, offsetMs, firstSequence: last ? last.seq + 1 : 0 });
+          stream = named;
+          admitted = ruling;
+        } catch (error) {
+          // the publish was not recorded: the stream is free again, and the publisher refused (rtmp.ts)
+          active.delete(named);
+          throw error;
+        }
+        return undefined;
+      },
+      metadata(meta) {
+        const flat = flatMetadata(meta as Record<string, unknown>);
+        metadata = { ...(metadata ?? {}), ...flat };
+        segmenter?.metadata(flat);
+      },
+      async video(timestamp, payload) {
+        if (!segmenter) return;
+        const tag = readVideoTag(payload);
+        if (tag.kind === 'unsupported') { if (refusedCodec !== tag.codec) log(`${stream}: ${tag.codec} video is not recorded (H.264 is)`); refusedCodec = tag.codec; return; }
+        const s = segmenter;
+        if (tag.kind === 'config') await keepAll(s.videoConfig(tag.config));
+        else if (tag.kind === 'frame') await keepAll(overrun(() => s.videoFrame(timestamp, tag.key, tag.cts, tag.data)));
+      },
+      async audio(timestamp, payload) {
+        if (!segmenter) return;
+        const tag = readAudioTag(payload);
+        if (tag.kind === 'unsupported') { if (refusedCodec !== tag.codec) log(`${stream}: ${tag.codec} audio is not recorded (AAC is)`); refusedCodec = tag.codec; return; }
+        const s = segmenter;
+        if (tag.kind === 'config') await keepAll(s.audioConfig(tag.config));
+        else await keepAll(overrun(() => s.audioFrame(timestamp, tag.data)));
+      },
+      async unpublish() {
+        if (!stream || !segmenter) return;
+        const s = segmenter;
+        segmenter = undefined;
+        // the recording always ends: what was cut is kept where it can be, and the end is written whatever the last
+        // segment did, so no playlist is left waiting on a publisher that is gone
+        try { await keepAll(s.flush()); } catch (error) { log(`${stream}: the last segment was not kept: ${String((error as Error)?.message ?? error)}`); }
+        try { await options.run(() => store.record(LIVE, stream!, { state: 'ended', endedAt: store.now() }, 'live.end')); }
+        catch (error) { log(`${stream}: its end was not written: ${String((error as Error)?.message ?? error)}`); }
+        finally { active.delete(stream); }
+        await hook('ended');
+      },
+    }, log);
+  }, { maxConnections: MAX_CONNECTIONS });
+}
+
+const round = (n: number): number => Math.round(n * 1000) / 1000;
+/** What a segmenter refuses, as RTMP's refusal of the publish (rtmp.ts ends it and closes the connection). */
+function overrun<T>(fn: () => T): T {
+  try { return fn(); } catch (error) { throw error instanceof LiveOverrun ? new RtmpRefusal('NetStream.Failed', error.message) : error; }
+}
+/** The publisher's metadata as the World keeps it: its flat values (`onMetaData` is one level: an encoder's name, sizes,
+ *  rates), at most 64 of them, a string at most 256 characters; nested values are not kept, so nothing it sent (a
+ *  reference back to itself among them) can make the recording's row unwritable. */
+function flatMetadata(meta: Record<string, unknown>): Record<string, string | number | boolean> {
+  const out: Record<string, string | number | boolean> = {};
+  for (const [key, value] of Object.entries(meta).slice(0, 64)) {
+    if (typeof value === 'number' ? Number.isFinite(value) : typeof value === 'boolean') out[key.slice(0, 64)] = value as number | boolean;
+    else if (typeof value === 'string') out[key.slice(0, 64)] = value.slice(0, 256);
+  }
+  return out;
+}
+function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
+  return true;
+}
+function splitOnce(s: string, sep: string): [string, string] {
+  const at = s.indexOf(sep);
+  return at < 0 ? [s, ''] : [s.slice(0, at), s.slice(at + 1)];
+}

package/src/live/rtmp.ts

@@ -0,0 +1,375 @@
+// RTMP's server side for a publisher (Adobe's RTMP 1.0 specification: §5.2 the handshake, §5.3 the chunk stream, §5.4
+// and §6.2 the control messages, §7.2 the commands), as OBS and ffmpeg publish: C0/C1/C2 answered with S0/S1/S2, the
+// chunk stream reassembled into messages, the peer's chunk size and acknowledgement window honoured, and the commands a
+// publisher sends (`connect`, `releaseStream`, `FCPublish`, `createStream`, `publish`, `FCUnpublish`, `deleteStream`)
+// answered as a media server answers them. Media and data messages are handed on as they arrive; what a publish means is
+// the caller's (`publish`). Every message is handled in arrival order, each after the last has settled.
+//
+// What a connection may hold is bounded (architecture, "Other wires": live media): a message is reassembled from the
+// bytes that arrived, never allocated at the length its header declares; the bytes held in messages being reassembled,
+// the chunk streams open and the whole messages waiting their turn each have a ceiling, far lower before a publish is
+// admitted, and a connection past one is closed. `backlog()` says how much is waiting, so the listener pauses the socket
+// while the World records (serve-http.ts, `serveStream`). Nothing here runs at module scope.
+import type { TwinStreamConnection, TwinStreamSink } from '../twin-fetch.ts';
+import { type Amf0Value, decodeAmf0, encodeAmf0 } from './amf0.ts';
+
+/** What the session asks of its caller. */
+export type RtmpPublisher = {
+  /** `connect`: the application the publisher names, and its command object; a string refuses it, with that reason */
+  connect(app: string, command: Record<string, Amf0Value>): string | undefined;
+  /** `publish`: whether the stream may be published, or RTMP's refusal (its code and description) */
+  publish(ask: { app: string; name: string; type?: string; tcUrl?: string; flashVer?: string }): Promise<{ code: string; description: string } | undefined>;
+  /** `@setDataFrame` / `onMetaData`, as published */
+  metadata(meta: Record<string, Amf0Value>): void | Promise<void>;
+  /** an FLV audio or video tag's body, at its RTMP timestamp (milliseconds); an `RtmpRefusal` thrown ends the publish */
+  audio(timestamp: number, payload: Uint8Array): void | Promise<void>;
+  video(timestamp: number, payload: Uint8Array): void | Promise<void>;
+  /** the publish ended (`FCUnpublish`, `closeStream`, `deleteStream`, the connection ended while publishing, or a
+   *  refusal of what was published) */
+  unpublish(): void | Promise<void>;
+};
+
+/** What a publisher's media can draw mid-publish: its `onStatus` error, then the publish ended and the connection closed. */
+export class RtmpRefusal extends Error {
+  constructor(readonly code: string, description: string) { super(description); }
+}
+
+const HANDSHAKE = 1536;
+/** The largest message: the chunk header's 24-bit length, the wire's own ceiling. The largest video frame measured fits
+ *  under it: 11,781,334 bytes, a 2160p frame of noise at CRF 1 (ffmpeg 8.1.2, libx264 ultrafast, `ffmpeg -f lavfi -i
+ *  "testsrc2=size=3840x2160:rate=30,noise=alls=30:allf=t+u" -frames:v 6 -c:v libx264 -preset ultrafast -crf 1 -f flv`, the
+ *  largest `ffprobe -show_entries packet=size`), beside 320,672 bytes for 1080p60 at a Twitch-like 8 Mbit/s CBR and
+ *  2,964,434 for 1080p at CRF 1; measured on Windows 11, twin-world 5c01b42b, nothing else encoding. */
+const MAX_MESSAGE = 0xffffff;
+/** Before a publish is admitted only commands come, a few hundred bytes each (ffmpeg's and librtmp's `connect` object):
+ *  a message, and what a connection holds in reassembly, stay small until the dialect has admitted the stream key. */
+const MAX_MESSAGE_UNADMITTED = 64 * 1024;
+const MAX_HELD_UNADMITTED = 256 * 1024;
+/** Once publishing: one frame reassembling while audio interleaves on its own chunk stream. */
+const MAX_HELD = MAX_MESSAGE + 1024 * 1024;
+/** Chunk streams a connection may open: ffmpeg uses 2, 3, 4, 6 and 8 (libavformat/rtmppkt.h, `RTMPChannel`), librtmp 2
+ *  to 5 and 8 (rtmp.c's `m_nChannel`). */
+const MAX_CHUNK_STREAMS = 64;
+/** Whole messages waiting their turn: the listener pauses past a few megabytes (serveStream); a transport that cannot
+ *  pause (a bridged WebSocket) is closed past this. */
+const MAX_QUEUED = 64 * 1024 * 1024;
+/** A connection that has not published this long after it opened is closed: one that never gets as far as a stream
+ *  key holds its place no longer than an encoder needs to connect and be admitted. */
+const PUBLISH_DEADLINE_MS = 30_000;
+const WINDOW = 5_000_000;
+const OUT_CHUNK = 4096;
+
+type ChunkState = { timestamp: number; tsField: number; extended: boolean; length: number; type: number; streamId: number; parts: Uint8Array[]; received: number };
+type Message = { type: number; streamId: number; timestamp: number; payload: Uint8Array };
+
+const u24 = (b: Uint8Array, at: number): number => (b[at]! << 16) | (b[at + 1]! << 8) | b[at + 2]!;
+const u32 = (b: Uint8Array, at: number): number => ((b[at]! << 24) >>> 0) + ((b[at + 1]! << 16) | (b[at + 2]! << 8) | b[at + 3]!);
+const u32le = (b: Uint8Array, at: number): number => (b[at]! | (b[at + 1]! << 8) | (b[at + 2]! << 16)) + ((b[at + 3]! << 24) >>> 0);
+const be32 = (n: number): number[] => [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff];
+
+function join(parts: Uint8Array[], length: number): Uint8Array {
+  if (parts.length === 1 && parts[0]!.length === length) return parts[0]!;
+  const out = new Uint8Array(length);
+  let at = 0;
+  for (const p of parts) { out.set(p, at); at += p.length; }
+  return out;
+}
+
+/** One publisher's connection: its bytes in, the server's answers out through the sink. */
+export function rtmpSession(sink: TwinStreamSink, publisher: RtmpPublisher, log: (line: string) => void = () => {}): TwinStreamConnection & { backlog(): number } {
+  let pending: Uint8Array = new Uint8Array(0);
+  let phase: 'c0c1' | 'c2' | 'chunks' | 'closed' = 'c0c1';
+  let inChunk = 128;
+  let received = 0;
+  let acked = 0;
+  let peerWindow = 0;
+  let app = '';
+  let tcUrl: string | undefined;
+  let flashVer: string | undefined;
+  let nextStream = 1;
+  let publishing = false;
+  let publishStream = 0;
+  let ended = false;
+  const chunks = new Map<number, ChunkState>();
+  /** a chunk whose header was read and whose payload is still arriving */
+  let current: { st: ChunkState; left: number } | undefined;
+  /** bytes held in messages being reassembled, and in whole messages waiting their turn */
+  let held = 0;
+  let queued = 0;
+  let chain: Promise<void> = Promise.resolve();
+  const deadline: ReturnType<typeof setTimeout> | undefined = setTimeout(() => { if (!publishing && !ended) overrun(`it did not publish within ${PUBLISH_DEADLINE_MS / 1000} s`); }, PUBLISH_DEADLINE_MS);
+  (deadline as { unref?: () => void }).unref?.();
+
+  let outChunk = 128;
+  const write = (bytes: Uint8Array): void => { if (phase !== 'closed') sink.write(bytes); };
+  /** A message as chunks of the server's chunk size: a type-0 header, then type-3 continuations. */
+  const send = (csid: number, type: number, streamId: number, payload: Uint8Array, timestamp = 0): void => {
+    const head = [csid & 0x3f, ...be32(Math.min(timestamp, 0xffffff)).slice(1), ...be32(payload.length).slice(1), type, streamId & 0xff, (streamId >> 8) & 0xff, (streamId >> 16) & 0xff, (streamId >>> 24) & 0xff];
+    const parts: number[] = head;
+    for (let at = 0; at < payload.length; at += outChunk) {
+      if (at > 0) parts.push(0xc0 | (csid & 0x3f));
+      for (const b of payload.subarray(at, at + outChunk)) parts.push(b);
+    }
+    write(Uint8Array.from(parts));
+  };
+  const control = (type: number, body: number[]): void => send(2, type, 0, Uint8Array.from(body));
+  const command = (csid: number, streamId: number, ...values: Amf0Value[]): void => send(csid, 20, streamId, encodeAmf0(...values));
+  const status = (streamId: number, level: 'status' | 'error', code: string, description: string, details?: string): void =>
+    command(5, streamId, 'onStatus', 0, null, { level, code, description, ...(details !== undefined ? { details } : {}) });
+  const close = (): void => {
+    if (phase === 'closed') return;
+    phase = 'closed';
+    clearTimeout(deadline);
+    pending = new Uint8Array(0);
+    chunks.clear();
+    current = undefined;
+    held = 0;
+    try { sink.end(); } catch { /* the peer is gone */ }
+  };
+  /** A connection past a ceiling: said once, and closed. */
+  const overrun = (what: string): void => { log(`closing a connection: ${what}`); close(); };
+  const stop = async (): Promise<void> => {
+    if (!publishing || ended) return;
+    ended = true;
+    publishing = false;
+    await publisher.unpublish();
+  };
+
+  const onCommand = async (message: Message, values: Amf0Value[]): Promise<void> => {
+    const [name, txnValue, object, ...args] = values;
+    const txn = typeof txnValue === 'number' ? txnValue : 0;
+    switch (name) {
+      case 'connect': {
+        const cmd = (object && typeof object === 'object' && !Array.isArray(object) && !(object instanceof Date) ? object : {}) as Record<string, Amf0Value>;
+        app = String(cmd.app ?? '').replace(/^\/+|\/+$/g, '');
+        tcUrl = typeof cmd.tcUrl === 'string' ? cmd.tcUrl : undefined;
+        flashVer = typeof cmd.flashVer === 'string' ? cmd.flashVer : undefined;
+        const refused = publisher.connect(app, cmd);
+        if (refused !== undefined) {
+          command(3, 0, '_error', txn, null, { level: 'error', code: 'NetConnection.Connect.Rejected', description: refused });
+          close();
+          return;
+        }
+        control(5, be32(WINDOW));
+        control(6, [...be32(WINDOW), 2]);
+        control(1, be32(OUT_CHUNK));
+        outChunk = OUT_CHUNK;
+        command(3, 0, '_result', txn, { fmsVer: 'FMS/3,0,1,123', capabilities: 31 }, { level: 'status', code: 'NetConnection.Connect.Success', description: 'Connection succeeded.', objectEncoding: 0 });
+        return;
+      }
+      case 'releaseStream':
+      case 'FCPublish':
+      case 'getStreamLength':
+      case '_checkbw':
+        if (txn > 0) command(3, 0, '_result', txn, null, undefined);
+        return;
+      case 'createStream':
+        command(3, 0, '_result', txn, null, nextStream++);
+        return;
+      case 'publish': {
+        const stream = message.streamId;
+        const named = typeof args[0] === 'string' ? args[0] : '';
+        if (publishing) { status(stream, 'error', 'NetStream.Publish.BadName', 'This connection is already publishing.', named); return; }
+        const type = typeof args[1] === 'string' ? args[1] : undefined;
+        let refusal: { code: string; description: string } | undefined;
+        try { refusal = await publisher.publish({ app, name: named, ...(type !== undefined ? { type } : {}), ...(tcUrl !== undefined ? { tcUrl } : {}), ...(flashVer !== undefined ? { flashVer } : {}) }); }
+        catch (error) { log(`publish failed: ${String((error as Error)?.message ?? error)}`); refusal = { code: 'NetStream.Publish.Denied', description: 'The server could not take the stream.' }; }
+        if (refusal) { status(stream, 'error', refusal.code, refusal.description, named); close(); return; }
+        publishing = true;
+        publishStream = stream;
+        // user control StreamBegin (event 0) for the publish's stream, then its start
+        control(4, [0, 0, ...be32(stream)]);
+        status(stream, 'status', 'NetStream.Publish.Start', `${named.split('?')[0]} is now published.`, named.split('?')[0]);
+        return;
+      }
+      case 'FCUnpublish':
+      case 'closeStream':
+      case 'deleteStream':
+        await stop();
+        return;
+      case 'play':
+        status(message.streamId, 'error', 'NetStream.Play.Failed', 'This server takes published streams; it plays none over RTMP.');
+        close();
+        return;
+      default:
+        if (txn > 0) command(3, 0, '_error', txn, null, { level: 'error', code: 'NetConnection.Call.Failed', description: `${String(name)} is not a command this server answers.` });
+    }
+  };
+
+  /** What was published, handed on: a refusal of it ends the publish (its `onStatus` error first) and the connection. */
+  const media = async (hand: () => void | Promise<void>): Promise<void> => {
+    try { await hand(); } catch (error) {
+      if (!(error instanceof RtmpRefusal)) throw error;
+      status(publishStream, 'error', error.code, error.message);
+      await stop();
+      close();
+    }
+  };
+
+  const onMessage = async (message: Message): Promise<void> => {
+    const p = message.payload;
+    switch (message.type) {
+      case 3: case 6: return;
+      case 4: {
+        const event = (p[0]! << 8) | p[1]!;
+        // a ping request is answered with the same timestamp (event 7, PingResponse)
+        if (event === 6 && p.length >= 6) control(4, [0, 7, ...Array.from(p.subarray(2, 6))]);
+        return;
+      }
+      case 5: peerWindow = u32(p, 0); return;
+      case 8: if (publishing) await media(() => publisher.audio(message.timestamp, p)); return;
+      case 9: if (publishing) await media(() => publisher.video(message.timestamp, p)); return;
+      case 15: case 18: {
+        const values = decodeAmf0(message.type === 15 ? p.subarray(1) : p);
+        const meta = values[0] === '@setDataFrame' ? values[2] : values[0] === 'onMetaData' ? values[1] : undefined;
+        if (publishing && meta && typeof meta === 'object' && !Array.isArray(meta) && !(meta instanceof Date)) await media(() => publisher.metadata(meta));
+        return;
+      }
+      case 17: case 20: await onCommand(message, decodeAmf0(message.type === 17 ? p.subarray(1) : p)); return;
+      default: return;
+    }
+  };
+
+  /** A chunk's bytes taken into its message, within what the connection may hold; false when past it (closed). */
+  const absorb = (st: ChunkState, bytes: Uint8Array): boolean => {
+    if (bytes.length === 0) return true;
+    const ceiling = publishing ? MAX_HELD : MAX_HELD_UNADMITTED;
+    if (held + bytes.length > ceiling) { overrun(`it holds more than ${ceiling} bytes of unfinished messages`); return false; }
+    st.parts.push(bytes.slice());
+    st.received += bytes.length;
+    held += bytes.length;
+    return true;
+  };
+  /** A chunk ended: its message, when whole, handled; the chunk size and an abort take effect at once, before the next
+   *  chunk is read (RTMP 1.0 §5.4.1, §5.4.2). */
+  const finish = (st: ChunkState): void => {
+    if (st.received < st.length) return;
+    const payload = join(st.parts, st.length);
+    held -= st.received;
+    st.parts = [];
+    st.received = 0;
+    if (st.type === 1) { inChunk = Math.max(1, u32(payload, 0) & 0x7fffffff); return; }
+    if (st.type === 2) {
+      const aborted = chunks.get(u32(payload, 0));
+      if (aborted) { held -= aborted.received; aborted.parts = []; aborted.received = 0; if (current?.st === aborted) current = undefined; }
+      return;
+    }
+    const message: Message = { type: st.type, streamId: st.streamId, timestamp: st.timestamp, payload };
+    queued += payload.length;
+    if (queued > MAX_QUEUED) { overrun(`more than ${MAX_QUEUED} bytes of messages wait to be recorded`); return; }
+    chain = chain.then(() => (phase === 'closed' && message.type !== 20 ? undefined : onMessage(message))).catch((error) => {
+      log(`a message failed: ${String((error as Error)?.message ?? error)}`);
+      close();
+    }).finally(() => { queued -= payload.length; });
+  };
+
+  /** What the pending bytes give: the rest of a chunk under way, or a chunk's header and as much of its payload as came.
+   *  How many bytes it took, or 0 when no more can be read yet. */
+  const readChunk = (): number => {
+    const b = pending;
+    if (current) {
+      const n = Math.min(current.left, b.length);
+      if (n === 0) return 0;
+      const { st } = current;
+      if (!absorb(st, b.subarray(0, n))) return b.length;
+      current.left -= n;
+      if (current.left === 0) { current = undefined; finish(st); }
+      return n;
+    }
+    if (b.length < 1) return 0;
+    const fmt = b[0]! >> 6;
+    let csid = b[0]! & 0x3f;
+    let at = 1;
+    if (csid === 0) { if (b.length < 2) return 0; csid = 64 + b[1]!; at = 2; }
+    else if (csid === 1) { if (b.length < 3) return 0; csid = 64 + b[1]! + b[2]! * 256; at = 3; }
+    const headerLength = [11, 7, 3, 0][fmt]!;
+    if (b.length < at + headerLength) return 0;
+    const prior = chunks.get(csid);
+    if (!prior && chunks.size >= MAX_CHUNK_STREAMS) { overrun(`it opened more than ${MAX_CHUNK_STREAMS} chunk streams`); return b.length; }
+    const st: ChunkState = prior ?? { timestamp: 0, tsField: 0, extended: false, length: 0, type: 0, streamId: 0, parts: [], received: 0 };
+    let tsField = st.tsField;
+    let length = st.length;
+    let type = st.type;
+    let streamId = st.streamId;
+    if (fmt <= 2) tsField = u24(b, at);
+    if (fmt <= 1) { length = u24(b, at + 3); type = b[at + 6]!; }
+    if (fmt === 0) streamId = u32le(b, at + 7);
+    at += headerLength;
+    // the extended timestamp: after a header whose field is 0xffffff, and in each type-3 chunk of a chunk stream whose
+    // last header had one (RTMP 1.0 §5.3.1.3), as ffmpeg and librtmp send it
+    const extended = fmt === 3 ? st.extended : tsField === 0xffffff;
+    let ts = tsField;
+    if (extended) { if (b.length < at + 4) return 0; ts = u32(b, at); at += 4; }
+    const starting = st.received === 0;
+    const largest = publishing ? MAX_MESSAGE : MAX_MESSAGE_UNADMITTED;
+    if (starting && length > largest) { overrun(`a message of ${length} bytes is past the ${largest} it may send now`); return b.length; }
+    if (!starting && length < st.received) { overrun('a chunk header shortened the message under way'); return b.length; }
+    // the header is the chunk stream's now
+    if (starting) {
+      // a type-0 header's timestamp is absolute; every other is a delta on the chunk stream's last (a type-3 header's is
+      // the last header's field, as ffmpeg reads it)
+      st.timestamp = fmt === 0 ? ts : st.timestamp + ts;
+    }
+    if (fmt <= 2) { st.tsField = tsField; st.extended = extended; }
+    st.length = length; st.type = type; st.streamId = streamId;
+    if (!prior) chunks.set(csid, st);
+    const take = Math.min(inChunk, length - st.received);
+    const n = Math.min(take, b.length - at);
+    if (!absorb(st, b.subarray(at, at + n))) return b.length;
+    if (n < take) current = { st, left: take - n };
+    else finish(st);
+    return at + n;
+  };
+
+  const pump = (): void => {
+    for (;;) {
+      if (phase === 'closed') { pending = new Uint8Array(0); return; }
+      if (phase === 'c0c1') {
+        if (pending.length < 1 + HANDSHAKE) return;
+        if (pending[0] !== 3) { log(`RTMP version ${pending[0]} is not 3`); close(); return; }
+        const c1 = pending.subarray(1, 1 + HANDSHAKE);
+        // S0 (version 3), S1 (time 0, zero, filler), S2 (C1 echoed): the simple handshake
+        const s = new Uint8Array(1 + HANDSHAKE * 2);
+        s[0] = 3;
+        s.set(c1, 1 + HANDSHAKE);
+        write(s);
+        pending = pending.slice(1 + HANDSHAKE);
+        phase = 'c2';
+        continue;
+      }
+      if (phase === 'c2') {
+        if (pending.length < HANDSHAKE) return;
+        pending = pending.slice(HANDSHAKE);
+        phase = 'chunks';
+        continue;
+      }
+      const took = readChunk();
+      if (took === 0) return;
+      pending = pending.subarray(took);
+    }
+  };
+
+  return {
+    data(chunk) {
+      if (phase === 'closed') return;
+      received += chunk.length;
+      // the acknowledgement the peer's window asks for (RTMP 1.0 §5.4.3)
+      if (peerWindow > 0 && received - acked >= peerWindow) { acked = received; control(3, be32(received >>> 0)); }
+      // what is left unread is at most a chunk header (a chunk's payload is taken as it comes), so the copy is small
+      const rest = pending;
+      pending = new Uint8Array(rest.length + chunk.length);
+      pending.set(rest, 0); pending.set(chunk, rest.length);
+      pump();
+    },
+    settled: () => chain,
+    // what the twin's work has not reached: whole messages waiting and the few bytes not yet read. An unfinished
+    // message's bytes are not in it: only more bytes finish it, and what it may hold is bounded (MAX_HELD)
+    backlog: () => queued + pending.length,
+    close() {
+      clearTimeout(deadline);
+      // the connection ended: a publish still open ends with it, after every message already read
+      chain = chain.then(() => stop()).catch((error) => log(`the publish's end failed: ${String((error as Error)?.message ?? error)}`));
+      phase = 'closed';
+    },
+  };
+}