nixamp 0.7.34 → 0.7.36

package/dist/audio.js

@@ -190,7 +190,9 @@ export class Stream {
             this.output.stdin?.on("error", () => { });
         }
         let stderr = "";
-        this.decoder.stderr?.on("data", (c) => { stderr += c.toString(); });
+        // The tail only: what went wrong is on the last line, and a film with a
+        // damaged audio track can say so once a frame for two hours.
+        this.decoder.stderr?.on("data", (c) => { stderr = (stderr + c.toString()).slice(-2000); });
         this.decoder.stdout?.on("data", (chunk) => {
             if (this.stopped || generation !== this.generation)
                 return;

package/dist/channels.d.ts

@@ -11,11 +11,35 @@ export interface ChannelInfo {
     /** The container it is sending, e.g. webm from a browser, flv over RTMP. */
     format: string;
     /** How it arrived. */
-    via: "http" | "rtmp";
+    via: "http" | "rtmp" | "pull";
     startedAt: number;
     bytes: number;
     listeners: number;
+    /**
+     * Whether there is a picture, which decides what a listener is sent and
+     * what the response calls it. A channel that says audio/mpeg while sending
+     * MP4 plays as nothing at all.
+     */
+    kind?: "audio" | "video";
+    /** For a channel we pull ourselves: where from. Never shown to a listener. */
+    source?: string;
+    /** The last thing ffmpeg complained about, for whoever administers this. */
+    error?: string;
+    /** How many times the source has been dialled again since it started. */
+    redials?: number;
 }
+/** How long to wait before dialling a dropped source again. */
+export declare const REDIAL = 2000;
+/** How many times in a row a source may fail without ever sending anything. */
+export declare const GIVE_UP = 5;
+/**
+ * How long a pulled source may say nothing before it is treated as gone.
+ *
+ * ffmpeg's own reconnect covers a connection that errors. It does not cover
+ * one that simply stops sending, and neither does anything else: a television
+ * channel that is quiet for half a minute is not being quiet, it is dead.
+ */
+export declare const STALL = 30000;
 /** A name that can sit in a URL and be read back in a list. */
 export declare function cleanId(value: unknown, fallback?: string): string;
 export interface ChannelOptions {
@@ -36,8 +60,74 @@ export declare class Channel {
     readonly listeners: Set<Listener>;
     private child;
     private closing;
+    /** Set for a channel that carries pictures, which cannot be joined blind. */
+    private fragments;
+    /** For a pulled channel: what to run, and how many times it has failed. */
+    private redial;
+    private failures;
+    private timer;
+    /** Fires when a pulled source has said nothing for STALL. */
+    private watchdog;
+    private stall;
+    private stderr;
     constructor(info: ChannelInfo, options: ChannelOptions, onGone: (id: string) => void);
     start(format: string): void;
+    /**
+     * Fetch a source ourselves, rather than waiting to be sent one.
+     *
+     * This is what makes a re-stream a channel instead of a track. A track is
+     * played by the one player a server has, so a second one is a second thing
+     * that server cannot do at the same time; a channel is its own process with
+     * its own audience, and a server can carry as many as it can decode. Two
+     * channels means two tabs, or two panels of a multiview.
+     *
+     * It keeps running with nobody listening. Live television does not pause
+     * because you looked away, and a room where the picture depends on who is
+     * in it is not a room anybody can be invited to.
+     */
+    pull(source: string, encode: string[], paced?: boolean, stall?: number): void;
+    /**
+     * Start the source over, now.
+     *
+     * For a pulled channel only: a publisher's stream cannot be dialled again
+     * from this end. The current ffmpeg is killed and a new one started at
+     * once, with the count of failures cleared -- somebody asking for this has
+     * decided the thing is worth another go, and should not inherit the four
+     * strikes a dead CDN ran up an hour ago.
+     */
+    restart(): boolean;
+    /**
+     * The stream that was is over; the next ffmpeg is a new one.
+     *
+     * New opening boxes, timestamps from zero again. Whoever was listening
+     * cannot follow that mid-picture, and a newcomer must not be handed the old
+     * opening boxes in front of the new fragments -- so the header is dropped
+     * and the audience is ended, to come back to the stream as it now is. The
+     * player rejoins on its own. Done the moment the source is known to be
+     * gone, not when the redial happens: somebody joining in between gets the
+     * new beginning as it is written, rather than a stale one first.
+     */
+    private startOver;
+    /** Expect output within STALL, or treat the source as gone and dial again. */
+    private rearm;
+    /** End everybody listening; the stream they were on is over. */
+    private hangUp;
+    /**
+     * A source that stopped. Try it again, unless it never worked at all.
+     *
+     * The difference matters: a channel that ran for six hours and dropped is
+     * worth dialling again, and a URL that has never once produced a byte is a
+     * mistake somebody made, and retrying it for ever helps nobody.
+     */
+    private dropped;
+    /**
+     * Out to the audience, whole boxes at a time when there are boxes.
+     *
+     * Video listeners are only ever sent complete boxes, so that a new one can
+     * be given the opening boxes and then join at the next fragment and have it
+     * make sense.
+     */
+    private emit;
     /** Feed the source. */
     write(chunk: Buffer): boolean;
     pump(body: Readable): Promise<void>;
@@ -75,6 +165,24 @@ export declare class Channels {
      * *different* channel is exactly what this class exists for.
      */
     publish(id: string, name: string, format: string, via: ChannelInfo["via"]): Channel | null;
+    /**
+     * Carry a source of our own: a re-stream, or a film on this disk shown live.
+     *
+     * Null when that channel is taken, the same as publishing. Everything else
+     * about it is the same too, which is the point -- a re-stream stops being a
+     * special case and becomes one more thing that is on.
+     */
+    pull(id: string, name: string, source: string, encode: string[], kind: "audio" | "video", paced?: boolean, stall?: number): Channel | null;
+    /**
+     * Dial a pulled channel's source again, now. False for a channel that is
+     * not there or is not ours to dial: a publisher's stream restarts at the
+     * publisher's end.
+     */
+    restart(id: string): boolean;
+    /** Whether a channel is one we fetch ourselves, and so can start over. */
+    pulled(id: string): boolean;
+    /** What a listener should be told this channel is. */
+    contentType(id: string): string;
     /** Attach a listener, or null when nothing is playing on that channel. */
     listen(id: string, listener: Listener): (() => void) | null;
     /** Feed a channel that already exists, for a publisher sending chunks. */

package/dist/channels.js

@@ -16,6 +16,45 @@
  */
 import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
+import { Fragments } from "./fragments.js";
+/** How long to wait before dialling a dropped source again. */
+export const REDIAL = 2000;
+/** How many times in a row a source may fail without ever sending anything. */
+export const GIVE_UP = 5;
+/**
+ * How long a pulled source may say nothing before it is treated as gone.
+ *
+ * ffmpeg's own reconnect covers a connection that errors. It does not cover
+ * one that simply stops sending, and neither does anything else: a television
+ * channel that is quiet for half a minute is not being quiet, it is dead.
+ */
+export const STALL = 30_000;
+/** How much of what ffmpeg said to keep, for the last line when it dies. */
+const TAIL = 2000;
+/**
+ * Read everything a child says on stderr, keeping only the end of it.
+ *
+ * This is not optional. A pipe nobody reads fills, at 64 KiB on Linux, and
+ * the child then blocks on its next write to it -- every thread it has waits
+ * on the one that is stuck, and it produces nothing more, for ever, without
+ * exiting. A channel carrying an IPTV transport stream logs a line for every
+ * corrupt packet, and over twelve hours that is more than 64 KiB. Measured on
+ * the real server: CNN "on the air" with a full stderr socket, its decoder
+ * thread asleep in the kernel on that write, its byte count frozen, and a
+ * listener handed the opening boxes and then nothing at all.
+ */
+function drain(stream, keep) {
+    let tail = "";
+    stream?.on("data", (chunk) => {
+        tail = (tail + chunk.toString("utf8")).slice(-TAIL);
+        keep(tail);
+    });
+    stream?.on("error", () => undefined);
+}
+/** The last thing ffmpeg said, which is where it says what went wrong. */
+function lastLine(tail) {
+    return tail.trim().split("\n").pop() ?? "";
+}
 /** A name that can sit in a URL and be read back in a list. */
 export function cleanId(value, fallback = "main") {
     if (typeof value !== "string")
@@ -36,6 +75,16 @@ export class Channel {
     listeners = new Set();
     child = null;
     closing = false;
+    /** Set for a channel that carries pictures, which cannot be joined blind. */
+    fragments = null;
+    /** For a pulled channel: what to run, and how many times it has failed. */
+    redial = null;
+    failures = 0;
+    timer = null;
+    /** Fires when a pulled source has said nothing for STALL. */
+    watchdog = null;
+    stall = STALL;
+    stderr = "";
     constructor(info, options, onGone) {
         this.info = info;
         this.options = options;
@@ -61,6 +110,7 @@ export class Channel {
             this.info.bytes += chunk.byteLength;
             this.send(chunk);
         });
+        drain(child.stderr, (tail) => { this.stderr = tail; });
         // A publisher that hangs up mid-write breaks the pipe, and an unhandled
         // EPIPE takes the whole server with it.
         child.stdin?.on("error", () => this.close());
@@ -70,6 +120,194 @@ export class Channel {
         this.child = child;
         this.options.onStart?.(this.info);
     }
+    /**
+     * Fetch a source ourselves, rather than waiting to be sent one.
+     *
+     * This is what makes a re-stream a channel instead of a track. A track is
+     * played by the one player a server has, so a second one is a second thing
+     * that server cannot do at the same time; a channel is its own process with
+     * its own audience, and a server can carry as many as it can decode. Two
+     * channels means two tabs, or two panels of a multiview.
+     *
+     * It keeps running with nobody listening. Live television does not pause
+     * because you looked away, and a room where the picture depends on who is
+     * in it is not a room anybody can be invited to.
+     */
+    pull(source, encode, paced = true, stall = STALL) {
+        this.stall = stall;
+        if (this.info.kind === "video")
+            this.fragments = new Fragments();
+        const [command, ...prefix] = this.options.ffmpeg;
+        const remote = /^https?:\/\//i.test(source);
+        const dial = () => {
+            if (this.closing)
+                return;
+            this.stderr = "";
+            const child = spawn(command, [
+                ...prefix,
+                "-hide_banner",
+                "-loglevel", "error",
+                // A dropped source is normal over hours, and a channel that dies
+                // the first time a CDN hiccups is not a channel anybody can rely
+                // on. ffmpeg redials on its own before we have to.
+                ...(remote ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
+                // A connection that stops answering is an error after this long,
+                // and an error is a thing the reconnect above knows what to do
+                // with. Without it a silent socket is waited on for ever. In
+                // microseconds, as ffmpeg wants it.
+                ...(remote ? ["-rw_timeout", String(stall * 1000)] : []),
+                // Real time, always. A file read as fast as the disk allows is an
+                // hour of film in ninety seconds and a room that cannot be in it
+                // together; a live source is already paced and loses nothing.
+                ...(paced ? ["-re"] : []),
+                "-i", source,
+                ...encode,
+                "pipe:1",
+            ], { stdio: ["ignore", "pipe", "pipe"] });
+            let sent = false;
+            this.child = child;
+            this.rearm(child);
+            child.stdout?.on("data", (chunk) => {
+                // An ffmpeg that was replaced can still have a chunk in the pipe.
+                if (this.child !== child)
+                    return;
+                sent = true;
+                this.info.bytes += chunk.byteLength;
+                this.rearm(child);
+                this.emit(chunk);
+            });
+            child.stdout?.on("error", () => undefined);
+            drain(child.stderr, (tail) => { this.stderr = tail; });
+            // Only the ffmpeg we are currently running gets to say the source
+            // dropped. One that was killed to make way for a restart is not news.
+            child.on("error", () => { if (this.child === child)
+                this.dropped(sent); });
+            child.on("close", () => { if (this.child === child)
+                this.dropped(sent); });
+        };
+        this.redial = dial;
+        dial();
+        this.options.onStart?.(this.info);
+    }
+    /**
+     * Start the source over, now.
+     *
+     * For a pulled channel only: a publisher's stream cannot be dialled again
+     * from this end. The current ffmpeg is killed and a new one started at
+     * once, with the count of failures cleared -- somebody asking for this has
+     * decided the thing is worth another go, and should not inherit the four
+     * strikes a dead CDN ran up an hour ago.
+     */
+    restart() {
+        const dial = this.redial;
+        if (!dial || this.closing)
+            return false;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        if (this.watchdog)
+            clearTimeout(this.watchdog);
+        this.watchdog = null;
+        this.failures = 0;
+        this.info.redials = (this.info.redials ?? 0) + 1;
+        this.info.error = undefined;
+        const old = this.child;
+        this.child = null;
+        old?.kill("SIGKILL");
+        this.startOver();
+        dial();
+        return true;
+    }
+    /**
+     * The stream that was is over; the next ffmpeg is a new one.
+     *
+     * New opening boxes, timestamps from zero again. Whoever was listening
+     * cannot follow that mid-picture, and a newcomer must not be handed the old
+     * opening boxes in front of the new fragments -- so the header is dropped
+     * and the audience is ended, to come back to the stream as it now is. The
+     * player rejoins on its own. Done the moment the source is known to be
+     * gone, not when the redial happens: somebody joining in between gets the
+     * new beginning as it is written, rather than a stale one first.
+     */
+    startOver() {
+        if (this.info.kind === "video")
+            this.fragments = new Fragments();
+        this.hangUp();
+    }
+    /** Expect output within STALL, or treat the source as gone and dial again. */
+    rearm(child) {
+        if (this.watchdog)
+            clearTimeout(this.watchdog);
+        this.watchdog = setTimeout(() => {
+            this.watchdog = null;
+            if (this.child !== child || this.closing)
+                return;
+            this.info.error = `no data from the source for ${Math.round(this.stall / 1000)}s`;
+            // Its close handler is what dials again.
+            child.kill("SIGKILL");
+        }, this.stall);
+        this.watchdog.unref?.();
+    }
+    /** End everybody listening; the stream they were on is over. */
+    hangUp() {
+        for (const listener of this.listeners) {
+            try {
+                listener.end();
+            }
+            catch {
+                // Gone already.
+            }
+        }
+        this.listeners.clear();
+        this.info.listeners = 0;
+    }
+    /**
+     * A source that stopped. Try it again, unless it never worked at all.
+     *
+     * The difference matters: a channel that ran for six hours and dropped is
+     * worth dialling again, and a URL that has never once produced a byte is a
+     * mistake somebody made, and retrying it for ever helps nobody.
+     */
+    dropped(sent) {
+        if (this.closing || !this.redial)
+            return;
+        this.child = null;
+        if (this.watchdog)
+            clearTimeout(this.watchdog);
+        this.watchdog = null;
+        const said = lastLine(this.stderr);
+        if (said)
+            this.info.error = said;
+        this.failures = sent ? 0 : this.failures + 1;
+        if (this.failures >= GIVE_UP) {
+            this.close();
+            return;
+        }
+        this.info.redials = (this.info.redials ?? 0) + 1;
+        this.startOver();
+        const dial = this.redial;
+        this.timer = setTimeout(() => {
+            this.timer = null;
+            dial();
+        }, REDIAL);
+        // A redial is not a reason to keep the process alive at exit.
+        this.timer.unref?.();
+    }
+    /**
+     * Out to the audience, whole boxes at a time when there are boxes.
+     *
+     * Video listeners are only ever sent complete boxes, so that a new one can
+     * be given the opening boxes and then join at the next fragment and have it
+     * make sense.
+     */
+    emit(chunk) {
+        if (!this.fragments) {
+            this.send(chunk);
+            return;
+        }
+        for (const box of this.fragments.push(chunk))
+            this.send(box);
+    }
     /** Feed the source. */
     write(chunk) {
         return this.child?.stdin?.write(chunk) ?? false;
@@ -106,6 +344,17 @@ export class Channel {
         this.info.listeners = this.listeners.size;
     }
     listen(listener) {
+        // What the stream is, before any of what it is currently saying. Without
+        // this a listener who arrives after the first second gets fragments that
+        // reference tracks they were never told about: a blank panel, no error.
+        if (this.fragments?.ready) {
+            try {
+                listener.write(this.fragments.header);
+            }
+            catch {
+                // Gone before it began; the detach below still tidies up.
+            }
+        }
         this.listeners.add(listener);
         this.info.listeners = this.listeners.size;
         return () => {
@@ -117,6 +366,16 @@ export class Channel {
         if (this.closing)
             return;
         this.closing = true;
+        this.redial = null;
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = null;
+        if (this.watchdog)
+            clearTimeout(this.watchdog);
+        this.watchdog = null;
+        const said = lastLine(this.stderr);
+        if (said && !this.info.error)
+            this.info.error = said;
         const child = this.child;
         this.child = null;
         try {
@@ -194,6 +453,47 @@ export class Channels {
         channel.start(format);
         return channel;
     }
+    /**
+     * Carry a source of our own: a re-stream, or a film on this disk shown live.
+     *
+     * Null when that channel is taken, the same as publishing. Everything else
+     * about it is the same too, which is the point -- a re-stream stops being a
+     * special case and becomes one more thing that is on.
+     */
+    pull(id, name, source, encode, kind, paced = true, stall = STALL) {
+        if (this.open.has(id))
+            return null;
+        const channel = new Channel({
+            id,
+            name: name || source,
+            format: kind === "video" ? "mp4" : "mp3",
+            via: "pull",
+            startedAt: Date.now(),
+            bytes: 0,
+            listeners: 0,
+            kind,
+            source,
+        }, this.options, (gone) => this.open.delete(gone));
+        this.open.set(id, channel);
+        channel.pull(source, encode, paced, stall);
+        return channel;
+    }
+    /**
+     * Dial a pulled channel's source again, now. False for a channel that is
+     * not there or is not ours to dial: a publisher's stream restarts at the
+     * publisher's end.
+     */
+    restart(id) {
+        return this.open.get(id)?.restart() ?? false;
+    }
+    /** Whether a channel is one we fetch ourselves, and so can start over. */
+    pulled(id) {
+        return this.open.get(id)?.info.via === "pull";
+    }
+    /** What a listener should be told this channel is. */
+    contentType(id) {
+        return this.open.get(id)?.info.kind === "video" ? "video/mp4" : "audio/mpeg";
+    }
     /** Attach a listener, or null when nothing is playing on that channel. */
     listen(id, listener) {
         const channel = this.open.get(id);

package/dist/fragments.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Splitting a fragmented MP4 into the pieces a late arrival needs.
+ *
+ * MP3 can be joined halfway through because every frame says what it is: a
+ * player finds the next frame boundary and carries on. Fragmented MP4 cannot.
+ * It opens with an `ftyp` and a `moov` that describe the tracks -- how many,
+ * which codecs, what timescale -- and everything after that is a `moof` and an
+ * `mdat` that mean nothing without them. Hand somebody the middle of that
+ * stream and their browser has no idea what it is holding, which is a black
+ * panel and no error.
+ *
+ * So the opening boxes are kept, and a listener who arrives an hour late is
+ * given them before the live bytes. Fragments written with `frag_keyframe`
+ * each begin at a keyframe, so the picture starts at the first one rather than
+ * with a screen of blocks catching up.
+ *
+ * This also means listeners are only ever written whole boxes. A chunk from a
+ * pipe ends wherever the pipe felt like ending it, and half a `moof` is not
+ * something to send anybody.
+ */
+export interface Box {
+    type: string;
+    bytes: Buffer;
+}
+/**
+ * The first whole box in a buffer, or null when it has not all arrived.
+ *
+ * Null is also the answer for anything malformed, because the difference does
+ * not matter to a caller who can only wait or give up, and guessing at a
+ * broken length walks off the end of the stream.
+ */
+export declare function firstBox(buffer: Buffer): {
+    box: Box;
+    rest: Buffer;
+} | null;
+/** The boxes that describe the stream rather than carry it. */
+export declare function isOpening(type: string): boolean;
+/**
+ * A fragmented MP4 arriving in pieces, handed back a box at a time.
+ *
+ * Keeps the opening boxes so they can be replayed to whoever turns up later.
+ * If the bytes turn out not to be an MP4 at all -- a source that failed, a
+ * format nobody expected -- it stops trying to parse and passes them through,
+ * on the grounds that a stream somebody might be able to play beats a stream
+ * nobody can.
+ */
+export declare class Fragments {
+    private held;
+    private opening;
+    private confused;
+    /** The `ftyp` and `moov` seen so far, ready to send to a new listener. */
+    get header(): Buffer;
+    /** Whether enough has arrived to describe the stream to somebody new. */
+    get ready(): boolean;
+    /** Feed bytes in; get whole boxes out, in order. */
+    push(chunk: Buffer): Buffer[];
+}

package/dist/fragments.js

@@ -0,0 +1,109 @@
+/**
+ * Splitting a fragmented MP4 into the pieces a late arrival needs.
+ *
+ * MP3 can be joined halfway through because every frame says what it is: a
+ * player finds the next frame boundary and carries on. Fragmented MP4 cannot.
+ * It opens with an `ftyp` and a `moov` that describe the tracks -- how many,
+ * which codecs, what timescale -- and everything after that is a `moof` and an
+ * `mdat` that mean nothing without them. Hand somebody the middle of that
+ * stream and their browser has no idea what it is holding, which is a black
+ * panel and no error.
+ *
+ * So the opening boxes are kept, and a listener who arrives an hour late is
+ * given them before the live bytes. Fragments written with `frag_keyframe`
+ * each begin at a keyframe, so the picture starts at the first one rather than
+ * with a screen of blocks catching up.
+ *
+ * This also means listeners are only ever written whole boxes. A chunk from a
+ * pipe ends wherever the pipe felt like ending it, and half a `moof` is not
+ * something to send anybody.
+ */
+/** The header of an MP4 box: four bytes of length, four of name. */
+const HEADER = 8;
+/** A length of 1 means the real one is the eight bytes that follow. */
+const BIG = 16;
+/**
+ * The first whole box in a buffer, or null when it has not all arrived.
+ *
+ * Null is also the answer for anything malformed, because the difference does
+ * not matter to a caller who can only wait or give up, and guessing at a
+ * broken length walks off the end of the stream.
+ */
+export function firstBox(buffer) {
+    if (buffer.length < HEADER)
+        return null;
+    const stated = buffer.readUInt32BE(0);
+    const type = buffer.toString("latin1", 4, HEADER);
+    // A name is four printable characters. Anything else means we are not
+    // looking at a box header, and no length read from here can be trusted.
+    if (!/^[\x20-\x7e]{4}$/.test(type))
+        return null;
+    let size = stated;
+    let header = HEADER;
+    if (stated === 1) {
+        if (buffer.length < BIG)
+            return null;
+        const large = buffer.readBigUInt64BE(HEADER);
+        if (large > BigInt(Number.MAX_SAFE_INTEGER))
+            return null;
+        size = Number(large);
+        header = BIG;
+    }
+    // Zero means "to the end of the file", which a live stream does not have.
+    if (size < header)
+        return null;
+    if (buffer.length < size)
+        return null;
+    return { box: { type, bytes: buffer.subarray(0, size) }, rest: buffer.subarray(size) };
+}
+/** The boxes that describe the stream rather than carry it. */
+export function isOpening(type) {
+    return type === "ftyp" || type === "moov";
+}
+/**
+ * A fragmented MP4 arriving in pieces, handed back a box at a time.
+ *
+ * Keeps the opening boxes so they can be replayed to whoever turns up later.
+ * If the bytes turn out not to be an MP4 at all -- a source that failed, a
+ * format nobody expected -- it stops trying to parse and passes them through,
+ * on the grounds that a stream somebody might be able to play beats a stream
+ * nobody can.
+ */
+export class Fragments {
+    held = Buffer.alloc(0);
+    opening = [];
+    confused = false;
+    /** The `ftyp` and `moov` seen so far, ready to send to a new listener. */
+    get header() {
+        return this.opening.length === 0 ? Buffer.alloc(0) : Buffer.concat(this.opening);
+    }
+    /** Whether enough has arrived to describe the stream to somebody new. */
+    get ready() {
+        return this.opening.length > 0;
+    }
+    /** Feed bytes in; get whole boxes out, in order. */
+    push(chunk) {
+        if (this.confused)
+            return [chunk];
+        this.held = this.held.length === 0 ? chunk : Buffer.concat([this.held, chunk]);
+        const out = [];
+        for (;;) {
+            const next = firstBox(this.held);
+            if (!next)
+                break;
+            this.held = next.rest;
+            if (isOpening(next.box.type))
+                this.opening.push(next.box.bytes);
+            out.push(next.box.bytes);
+        }
+        // Nothing parses and the buffer keeps growing: this is not an MP4. Let it
+        // through rather than swallowing a stream into memory for ever.
+        if (this.opening.length === 0 && this.held.length > 4 * 1024 * 1024) {
+            this.confused = true;
+            const everything = this.held;
+            this.held = Buffer.alloc(0);
+            return [everything];
+        }
+        return out;
+    }
+}

package/dist/rtmp-in.js

@@ -59,6 +59,10 @@ export class RtmpListeners {
             channel?.feed(chunk);
         });
         child.stdout?.on("error", () => child.kill("SIGKILL"));
+        // Read and dropped. A pipe nobody reads fills at 64 KiB, and ffmpeg then
+        // blocks on its next complaint and stops producing anything -- a
+        // publisher whose stream hiccups enough would take the slot down with it.
+        child.stderr?.resume();
         child.on("error", () => this.done(slot, child, channel));
         child.on("close", () => this.done(slot, child, channel));
     }