nixamp 0.7.34 → 0.7.36

package/dist/server.js

@@ -19,7 +19,7 @@ import { readFileSync } from "node:fs";
 import { Connections } from "./connections.js";
 import { Broadcaster, DEFAULT_ENCODER, PRESETS, redact, } from "./broadcast.js";
 import { Ingest, normaliseFormat } from "./ingest.js";
-import { Channels, cleanId } from "./channels.js";
+import { Channels, cleanId, generatedId } from "./channels.js";
 import { RtmpListeners } from "./rtmp-in.js";
 import { Accounts, clearedCookie, sessionCookie, tokenFrom } from "./accounts.js";
 import { anonymousHandle, Handles } from "./handles.js";
@@ -1774,6 +1774,12 @@ export function createHandler(engine, options) {
                     via: one.via,
                     listeners: one.listeners,
                     startedAt: one.startedAt,
+                    // Whether it has a picture, so the page puts it in the element
+                    // that can show one. Never the source: that is the owner's.
+                    kind: one.kind ?? "audio",
+                    // How it has been going, for whoever may do something about it.
+                    redials: one.redials ?? 0,
+                    error: one.error ?? "",
                 })),
                 // Anything re-streamed into this server is a live stream too, and was
                 // sitting in the middle of the playlist among the files -- which is
@@ -1797,7 +1803,13 @@ export function createHandler(engine, options) {
         // devices can publish at once, each to their own channel, and a listener
         // picks which to hear.
         if (path === "/api/channels" && options.channels) {
-            json(response, 200, { channels: options.channels.list(), listeners: options.channels.listeners });
+            // Without the source. Anyone holding the listen link may ask what is
+            // on, and the address a channel is pulled from is the one thing about
+            // it that is not theirs to have.
+            json(response, 200, {
+                channels: options.channels.list().map(({ source: _source, ...shown }) => shown),
+                listeners: options.channels.listeners,
+            });
             return;
         }
         // Publishing. Anyone with the control link may; listening to the result is
@@ -1810,17 +1822,32 @@ export function createHandler(engine, options) {
             if (action === undefined && request.method === "GET") {
                 // Listening. The response is the fan-out target: whatever ffmpeg
                 // produces for this channel is written to it until one end goes away.
-                const detach = channels.listen(id, response);
-                if (detach === null) {
+                if (!channels.has(id)) {
                     json(response, 404, { error: "nothing is playing on that channel" });
                     return;
                 }
                 watch(request, response, "stream", id);
+                // Headers first, and then the listener.
+                //
+                // Attaching first was fine while a channel only ever wrote future
+                // bytes. A video channel writes the opening boxes to a new listener
+                // the moment it joins, and those went out before this response had
+                // any headers at all -- so it committed as a bare 200 with no
+                // content-type, ended immediately, and the picture was one kilobyte
+                // long. Whether it happened depended on whether ffmpeg had produced
+                // its header yet, which is why it looked intermittent.
                 response.writeHead(200, {
                     ...CORS,
-                    "content-type": "audio/mpeg",
+                    // Asked of the channel rather than assumed: a channel carrying
+                    // pictures that calls itself audio/mpeg plays as nothing at all.
+                    "content-type": channels.contentType(id),
                     "cache-control": "no-store",
                 });
+                const detach = channels.listen(id, response);
+                if (detach === null) {
+                    response.end();
+                    return;
+                }
                 const leave = () => detach();
                 request.on("close", leave);
                 response.on("close", leave);
@@ -1837,6 +1864,85 @@ export function createHandler(engine, options) {
                 json(response, 405, { error: "GET, POST or DELETE" });
                 return;
             }
+            /**
+             * Dial the source again, now.
+             *
+             * The thing an administrator reaches for when a channel says it is on
+             * the air and shows nobody anything. It is what fixed CNN by hand --
+             * take it off, put it back -- without having to know the source, which
+             * a browser is never told.
+             */
+            if (action === "restart") {
+                if (!channels.has(id)) {
+                    json(response, 404, { error: "nothing is playing on that channel" });
+                    return;
+                }
+                if (!channels.pulled(id)) {
+                    json(response, 409, { error: "that channel is published into this server; restart it at the publisher" });
+                    return;
+                }
+                const restarted = channels.restart(id);
+                json(response, restarted ? 200 : 409, { ok: restarted });
+                return;
+            }
+            /**
+             * Carry a source of our own, rather than waiting to be sent one.
+             *
+             * A re-stream used to be added to the playlist, where it became one
+             * more track -- and a server plays one track at a time, so the second
+             * channel you added sat there saying "stopped". Two channels are two
+             * processes with two audiences and two addresses, which is what lets
+             * one person watch the baseball while another watches the news, in two
+             * tabs or in two panels of the same multiview.
+             */
+            if (action === "pull") {
+                let source = "";
+                let called = "";
+                try {
+                    const body = JSON.parse(await readBody(request));
+                    called = String(body.name ?? "").replace(/[\u0000-\u001f\u007f]/g, " ").trim().slice(0, 80);
+                    // A track number rather than a path: it is the server's own library
+                    // either way, and a number cannot name a file outside it.
+                    if (typeof body.at === "number" && Number.isInteger(body.at) && body.at >= 0) {
+                        source = engine.trackPath(body.at) ?? "";
+                        if (source === "") {
+                            json(response, 404, { error: "no track there" });
+                            return;
+                        }
+                    }
+                    else {
+                        source = String(body.source ?? "").trim();
+                    }
+                }
+                catch {
+                    json(response, 400, { error: "bad JSON" });
+                    return;
+                }
+                if (source === "") {
+                    json(response, 400, { error: "give a URL to carry, or a track to show" });
+                    return;
+                }
+                const wanted = cleanId(rawId, generatedId());
+                if (channels.has(wanted)) {
+                    json(response, 409, { error: "that channel is already on" });
+                    return;
+                }
+                const probe = options.ffprobe ?? ["ffprobe"];
+                const codecs = await codecsOf({ ffmpeg: [], ffprobe: probe, play: null }, source);
+                const kind = codecs.video === "" ? "audio" : "video";
+                const encode = kind === "video"
+                    ? videoArgs(codecs)
+                    // No picture in it, so none is invented: MP3 is the thing every
+                    // browser plays and the thing a listener can join halfway through.
+                    : ["-vn", "-c:a", "libmp3lame", "-b:a", "192k", "-f", "mp3"];
+                const channel = channels.pull(wanted, called, source, encode, kind);
+                if (!channel) {
+                    json(response, 409, { error: "that channel is already on" });
+                    return;
+                }
+                json(response, 200, { ok: true, channel: channel.info });
+                return;
+            }
             const format = normaliseFormat(url.searchParams.get("format") ?? request.headers["content-type"]);
             if (format === null) {
                 json(response, 415, { error: "give a container ffmpeg knows: webm, ogg, mp4, mp3, wav" });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nixamp",
-  "version": "0.7.34",
+  "version": "0.7.36",
   "description": "It really whips the terminal's ass. A Winamp-shaped audio player for your terminal.",
   "license": "MIT",
   "type": "module",

package/src/audio.ts

@@ -218,7 +218,9 @@ export class Stream {
     }
 
     let stderr = "";
-    this.decoder.stderr?.on("data", (c: Buffer) => { stderr += c.toString(); });
+    // The tail only: what went wrong is on the last line, and a film with a
+    // damaged audio track can say so once a frame for two hours.
+    this.decoder.stderr?.on("data", (c: Buffer) => { stderr = (stderr + c.toString()).slice(-2000); });
 
     this.decoder.stdout?.on("data", (chunk: Buffer) => {
       if (this.stopped || generation !== this.generation) return;

package/src/channels.ts

@@ -17,6 +17,7 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import type { Readable } from "node:stream";
+import { Fragments } from "./fragments.ts";
 
 /** Somewhere for a channel's audio to go. A response, in practice. */
 export interface Listener {
@@ -31,10 +32,63 @@ export interface ChannelInfo {
   /** The container it is sending, e.g. webm from a browser, flv over RTMP. */
   format: string;
   /** How it arrived. */
-  via: "http" | "rtmp";
+  via: "http" | "rtmp" | "pull";
   startedAt: number;
   bytes: number;
   listeners: number;
+  /**
+   * Whether there is a picture, which decides what a listener is sent and
+   * what the response calls it. A channel that says audio/mpeg while sending
+   * MP4 plays as nothing at all.
+   */
+  kind?: "audio" | "video";
+  /** For a channel we pull ourselves: where from. Never shown to a listener. */
+  source?: string;
+  /** The last thing ffmpeg complained about, for whoever administers this. */
+  error?: string;
+  /** How many times the source has been dialled again since it started. */
+  redials?: number;
+}
+
+/** How long to wait before dialling a dropped source again. */
+export const REDIAL = 2000;
+/** How many times in a row a source may fail without ever sending anything. */
+export const GIVE_UP = 5;
+/**
+ * How long a pulled source may say nothing before it is treated as gone.
+ *
+ * ffmpeg's own reconnect covers a connection that errors. It does not cover
+ * one that simply stops sending, and neither does anything else: a television
+ * channel that is quiet for half a minute is not being quiet, it is dead.
+ */
+export const STALL = 30_000;
+/** How much of what ffmpeg said to keep, for the last line when it dies. */
+const TAIL = 2000;
+
+/**
+ * Read everything a child says on stderr, keeping only the end of it.
+ *
+ * This is not optional. A pipe nobody reads fills, at 64 KiB on Linux, and
+ * the child then blocks on its next write to it -- every thread it has waits
+ * on the one that is stuck, and it produces nothing more, for ever, without
+ * exiting. A channel carrying an IPTV transport stream logs a line for every
+ * corrupt packet, and over twelve hours that is more than 64 KiB. Measured on
+ * the real server: CNN "on the air" with a full stderr socket, its decoder
+ * thread asleep in the kernel on that write, its byte count frozen, and a
+ * listener handed the opening boxes and then nothing at all.
+ */
+function drain(stream: Readable | null | undefined, keep: (tail: string) => void): void {
+  let tail = "";
+  stream?.on("data", (chunk: Buffer) => {
+    tail = (tail + chunk.toString("utf8")).slice(-TAIL);
+    keep(tail);
+  });
+  stream?.on("error", () => undefined);
+}
+
+/** The last thing ffmpeg said, which is where it says what went wrong. */
+function lastLine(tail: string): string {
+  return tail.trim().split("\n").pop() ?? "";
 }
 
 /** A name that can sit in a URL and be read back in a list. */
@@ -60,6 +114,16 @@ export class Channel {
   readonly listeners = new Set<Listener>();
   private child: ChildProcess | null = null;
   private closing = false;
+  /** Set for a channel that carries pictures, which cannot be joined blind. */
+  private fragments: Fragments | null = null;
+  /** For a pulled channel: what to run, and how many times it has failed. */
+  private redial: (() => void) | null = null;
+  private failures = 0;
+  private timer: ReturnType<typeof setTimeout> | null = null;
+  /** Fires when a pulled source has said nothing for STALL. */
+  private watchdog: ReturnType<typeof setTimeout> | null = null;
+  private stall = STALL;
+  private stderr = "";
 
   constructor(
     readonly info: ChannelInfo,
@@ -92,6 +156,7 @@ export class Channel {
       this.info.bytes += chunk.byteLength;
       this.send(chunk);
     });
+    drain(child.stderr, (tail) => { this.stderr = tail; });
     // A publisher that hangs up mid-write breaks the pipe, and an unhandled
     // EPIPE takes the whole server with it.
     child.stdin?.on("error", () => this.close());
@@ -103,6 +168,192 @@ export class Channel {
     this.options.onStart?.(this.info);
   }
 
+  /**
+   * Fetch a source ourselves, rather than waiting to be sent one.
+   *
+   * This is what makes a re-stream a channel instead of a track. A track is
+   * played by the one player a server has, so a second one is a second thing
+   * that server cannot do at the same time; a channel is its own process with
+   * its own audience, and a server can carry as many as it can decode. Two
+   * channels means two tabs, or two panels of a multiview.
+   *
+   * It keeps running with nobody listening. Live television does not pause
+   * because you looked away, and a room where the picture depends on who is
+   * in it is not a room anybody can be invited to.
+   */
+  pull(source: string, encode: string[], paced = true, stall = STALL): void {
+    this.stall = stall;
+    if (this.info.kind === "video") this.fragments = new Fragments();
+    const [command, ...prefix] = this.options.ffmpeg as [string, ...string[]];
+    const remote = /^https?:\/\//i.test(source);
+
+    const dial = (): void => {
+      if (this.closing) return;
+      this.stderr = "";
+      const child = spawn(
+        command,
+        [
+          ...prefix,
+          "-hide_banner",
+          "-loglevel", "error",
+          // A dropped source is normal over hours, and a channel that dies
+          // the first time a CDN hiccups is not a channel anybody can rely
+          // on. ffmpeg redials on its own before we have to.
+          ...(remote ? ["-reconnect", "1", "-reconnect_streamed", "1", "-reconnect_delay_max", "5"] : []),
+          // A connection that stops answering is an error after this long,
+          // and an error is a thing the reconnect above knows what to do
+          // with. Without it a silent socket is waited on for ever. In
+          // microseconds, as ffmpeg wants it.
+          ...(remote ? ["-rw_timeout", String(stall * 1000)] : []),
+          // Real time, always. A file read as fast as the disk allows is an
+          // hour of film in ninety seconds and a room that cannot be in it
+          // together; a live source is already paced and loses nothing.
+          ...(paced ? ["-re"] : []),
+          "-i", source,
+          ...encode,
+          "pipe:1",
+        ],
+        { stdio: ["ignore", "pipe", "pipe"] },
+      );
+
+      let sent = false;
+      this.child = child;
+      this.rearm(child);
+      child.stdout?.on("data", (chunk: Buffer) => {
+        // An ffmpeg that was replaced can still have a chunk in the pipe.
+        if (this.child !== child) return;
+        sent = true;
+        this.info.bytes += chunk.byteLength;
+        this.rearm(child);
+        this.emit(chunk);
+      });
+      child.stdout?.on("error", () => undefined);
+      drain(child.stderr, (tail) => { this.stderr = tail; });
+      // Only the ffmpeg we are currently running gets to say the source
+      // dropped. One that was killed to make way for a restart is not news.
+      child.on("error", () => { if (this.child === child) this.dropped(sent); });
+      child.on("close", () => { if (this.child === child) this.dropped(sent); });
+    };
+
+    this.redial = dial;
+    dial();
+    this.options.onStart?.(this.info);
+  }
+
+  /**
+   * Start the source over, now.
+   *
+   * For a pulled channel only: a publisher's stream cannot be dialled again
+   * from this end. The current ffmpeg is killed and a new one started at
+   * once, with the count of failures cleared -- somebody asking for this has
+   * decided the thing is worth another go, and should not inherit the four
+   * strikes a dead CDN ran up an hour ago.
+   */
+  restart(): boolean {
+    const dial = this.redial;
+    if (!dial || this.closing) return false;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = null;
+    this.failures = 0;
+    this.info.redials = (this.info.redials ?? 0) + 1;
+    this.info.error = undefined;
+    const old = this.child;
+    this.child = null;
+    old?.kill("SIGKILL");
+    this.startOver();
+    dial();
+    return true;
+  }
+
+  /**
+   * The stream that was is over; the next ffmpeg is a new one.
+   *
+   * New opening boxes, timestamps from zero again. Whoever was listening
+   * cannot follow that mid-picture, and a newcomer must not be handed the old
+   * opening boxes in front of the new fragments -- so the header is dropped
+   * and the audience is ended, to come back to the stream as it now is. The
+   * player rejoins on its own. Done the moment the source is known to be
+   * gone, not when the redial happens: somebody joining in between gets the
+   * new beginning as it is written, rather than a stale one first.
+   */
+  private startOver(): void {
+    if (this.info.kind === "video") this.fragments = new Fragments();
+    this.hangUp();
+  }
+
+  /** Expect output within STALL, or treat the source as gone and dial again. */
+  private rearm(child: ChildProcess): void {
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = setTimeout(() => {
+      this.watchdog = null;
+      if (this.child !== child || this.closing) return;
+      this.info.error = `no data from the source for ${Math.round(this.stall / 1000)}s`;
+      // Its close handler is what dials again.
+      child.kill("SIGKILL");
+    }, this.stall);
+    this.watchdog.unref?.();
+  }
+
+  /** End everybody listening; the stream they were on is over. */
+  private hangUp(): void {
+    for (const listener of this.listeners) {
+      try {
+        listener.end();
+      } catch {
+        // Gone already.
+      }
+    }
+    this.listeners.clear();
+    this.info.listeners = 0;
+  }
+
+  /**
+   * A source that stopped. Try it again, unless it never worked at all.
+   *
+   * The difference matters: a channel that ran for six hours and dropped is
+   * worth dialling again, and a URL that has never once produced a byte is a
+   * mistake somebody made, and retrying it for ever helps nobody.
+   */
+  private dropped(sent: boolean): void {
+    if (this.closing || !this.redial) return;
+    this.child = null;
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = null;
+    const said = lastLine(this.stderr);
+    if (said) this.info.error = said;
+    this.failures = sent ? 0 : this.failures + 1;
+    if (this.failures >= GIVE_UP) {
+      this.close();
+      return;
+    }
+    this.info.redials = (this.info.redials ?? 0) + 1;
+    this.startOver();
+    const dial = this.redial;
+    this.timer = setTimeout(() => {
+      this.timer = null;
+      dial();
+    }, REDIAL);
+    // A redial is not a reason to keep the process alive at exit.
+    this.timer.unref?.();
+  }
+
+  /**
+   * Out to the audience, whole boxes at a time when there are boxes.
+   *
+   * Video listeners are only ever sent complete boxes, so that a new one can
+   * be given the opening boxes and then join at the next fragment and have it
+   * make sense.
+   */
+  private emit(chunk: Buffer): void {
+    if (!this.fragments) {
+      this.send(chunk);
+      return;
+    }
+    for (const box of this.fragments.push(chunk)) this.send(box);
+  }
+
   /** Feed the source. */
   write(chunk: Buffer): boolean {
     return this.child?.stdin?.write(chunk) ?? false;
@@ -141,6 +392,16 @@ export class Channel {
   }
 
   listen(listener: Listener): () => void {
+    // What the stream is, before any of what it is currently saying. Without
+    // this a listener who arrives after the first second gets fragments that
+    // reference tracks they were never told about: a blank panel, no error.
+    if (this.fragments?.ready) {
+      try {
+        listener.write(this.fragments.header);
+      } catch {
+        // Gone before it began; the detach below still tidies up.
+      }
+    }
     this.listeners.add(listener);
     this.info.listeners = this.listeners.size;
     return () => {
@@ -152,6 +413,13 @@ export class Channel {
   close(): void {
     if (this.closing) return;
     this.closing = true;
+    this.redial = null;
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    if (this.watchdog) clearTimeout(this.watchdog);
+    this.watchdog = null;
+    const said = lastLine(this.stderr);
+    if (said && !this.info.error) this.info.error = said;
     const child = this.child;
     this.child = null;
     try {
@@ -234,6 +502,62 @@ export class Channels {
     return channel;
   }
 
+  /**
+   * Carry a source of our own: a re-stream, or a film on this disk shown live.
+   *
+   * Null when that channel is taken, the same as publishing. Everything else
+   * about it is the same too, which is the point -- a re-stream stops being a
+   * special case and becomes one more thing that is on.
+   */
+  pull(
+    id: string,
+    name: string,
+    source: string,
+    encode: string[],
+    kind: "audio" | "video",
+    paced = true,
+    stall = STALL,
+  ): Channel | null {
+    if (this.open.has(id)) return null;
+    const channel = new Channel(
+      {
+        id,
+        name: name || source,
+        format: kind === "video" ? "mp4" : "mp3",
+        via: "pull",
+        startedAt: Date.now(),
+        bytes: 0,
+        listeners: 0,
+        kind,
+        source,
+      },
+      this.options,
+      (gone) => this.open.delete(gone),
+    );
+    this.open.set(id, channel);
+    channel.pull(source, encode, paced, stall);
+    return channel;
+  }
+
+  /**
+   * Dial a pulled channel's source again, now. False for a channel that is
+   * not there or is not ours to dial: a publisher's stream restarts at the
+   * publisher's end.
+   */
+  restart(id: string): boolean {
+    return this.open.get(id)?.restart() ?? false;
+  }
+
+  /** Whether a channel is one we fetch ourselves, and so can start over. */
+  pulled(id: string): boolean {
+    return this.open.get(id)?.info.via === "pull";
+  }
+
+  /** What a listener should be told this channel is. */
+  contentType(id: string): string {
+    return this.open.get(id)?.info.kind === "video" ? "video/mp4" : "audio/mpeg";
+  }
+
   /** Attach a listener, or null when nothing is playing on that channel. */
   listen(id: string, listener: Listener): (() => void) | null {
     const channel = this.open.get(id);

package/src/fragments.ts

@@ -0,0 +1,115 @@
+/**
+ * Splitting a fragmented MP4 into the pieces a late arrival needs.
+ *
+ * MP3 can be joined halfway through because every frame says what it is: a
+ * player finds the next frame boundary and carries on. Fragmented MP4 cannot.
+ * It opens with an `ftyp` and a `moov` that describe the tracks -- how many,
+ * which codecs, what timescale -- and everything after that is a `moof` and an
+ * `mdat` that mean nothing without them. Hand somebody the middle of that
+ * stream and their browser has no idea what it is holding, which is a black
+ * panel and no error.
+ *
+ * So the opening boxes are kept, and a listener who arrives an hour late is
+ * given them before the live bytes. Fragments written with `frag_keyframe`
+ * each begin at a keyframe, so the picture starts at the first one rather than
+ * with a screen of blocks catching up.
+ *
+ * This also means listeners are only ever written whole boxes. A chunk from a
+ * pipe ends wherever the pipe felt like ending it, and half a `moof` is not
+ * something to send anybody.
+ */
+
+/** The header of an MP4 box: four bytes of length, four of name. */
+const HEADER = 8;
+/** A length of 1 means the real one is the eight bytes that follow. */
+const BIG = 16;
+
+export interface Box {
+  type: string;
+  bytes: Buffer;
+}
+
+/**
+ * The first whole box in a buffer, or null when it has not all arrived.
+ *
+ * Null is also the answer for anything malformed, because the difference does
+ * not matter to a caller who can only wait or give up, and guessing at a
+ * broken length walks off the end of the stream.
+ */
+export function firstBox(buffer: Buffer): { box: Box; rest: Buffer } | null {
+  if (buffer.length < HEADER) return null;
+  const stated = buffer.readUInt32BE(0);
+  const type = buffer.toString("latin1", 4, HEADER);
+  // A name is four printable characters. Anything else means we are not
+  // looking at a box header, and no length read from here can be trusted.
+  if (!/^[\x20-\x7e]{4}$/.test(type)) return null;
+
+  let size = stated;
+  let header = HEADER;
+  if (stated === 1) {
+    if (buffer.length < BIG) return null;
+    const large = buffer.readBigUInt64BE(HEADER);
+    if (large > BigInt(Number.MAX_SAFE_INTEGER)) return null;
+    size = Number(large);
+    header = BIG;
+  }
+  // Zero means "to the end of the file", which a live stream does not have.
+  if (size < header) return null;
+  if (buffer.length < size) return null;
+  return { box: { type, bytes: buffer.subarray(0, size) }, rest: buffer.subarray(size) };
+}
+
+/** The boxes that describe the stream rather than carry it. */
+export function isOpening(type: string): boolean {
+  return type === "ftyp" || type === "moov";
+}
+
+/**
+ * A fragmented MP4 arriving in pieces, handed back a box at a time.
+ *
+ * Keeps the opening boxes so they can be replayed to whoever turns up later.
+ * If the bytes turn out not to be an MP4 at all -- a source that failed, a
+ * format nobody expected -- it stops trying to parse and passes them through,
+ * on the grounds that a stream somebody might be able to play beats a stream
+ * nobody can.
+ */
+export class Fragments {
+  private held: Buffer = Buffer.alloc(0);
+  private opening: Buffer[] = [];
+  private confused = false;
+
+  /** The `ftyp` and `moov` seen so far, ready to send to a new listener. */
+  get header(): Buffer {
+    return this.opening.length === 0 ? Buffer.alloc(0) : Buffer.concat(this.opening);
+  }
+
+  /** Whether enough has arrived to describe the stream to somebody new. */
+  get ready(): boolean {
+    return this.opening.length > 0;
+  }
+
+  /** Feed bytes in; get whole boxes out, in order. */
+  push(chunk: Buffer): Buffer[] {
+    if (this.confused) return [chunk];
+    this.held = this.held.length === 0 ? chunk : Buffer.concat([this.held, chunk]);
+
+    const out: Buffer[] = [];
+    for (;;) {
+      const next = firstBox(this.held);
+      if (!next) break;
+      this.held = next.rest;
+      if (isOpening(next.box.type)) this.opening.push(next.box.bytes);
+      out.push(next.box.bytes);
+    }
+
+    // Nothing parses and the buffer keeps growing: this is not an MP4. Let it
+    // through rather than swallowing a stream into memory for ever.
+    if (this.opening.length === 0 && this.held.length > 4 * 1024 * 1024) {
+      this.confused = true;
+      const everything = this.held;
+      this.held = Buffer.alloc(0);
+      return [everything];
+    }
+    return out;
+  }
+}

package/src/rtmp-in.ts

@@ -71,6 +71,10 @@ export class RtmpListeners {
       channel?.feed(chunk);
     });
     child.stdout?.on("error", () => child.kill("SIGKILL"));
+    // Read and dropped. A pipe nobody reads fills at 64 KiB, and ffmpeg then
+    // blocks on its next complaint and stops producing anything -- a
+    // publisher whose stream hiccups enough would take the slot down with it.
+    child.stderr?.resume();
     child.on("error", () => this.done(slot, child, channel));
     child.on("close", () => this.done(slot, child, channel));
   }