node-av 6.2.0-beta.3 → 6.2.0-beta.30

package/dist/api/fmp4-stream.js

@@ -1,8 +1,8 @@
-import { AV_CODEC_ID_AAC, AV_CODEC_ID_AV1, AV_CODEC_ID_FLAC, AV_CODEC_ID_H264, AV_CODEC_ID_HEVC, AV_CODEC_ID_OPUS, AV_HWDEVICE_TYPE_NONE, AV_SAMPLE_FMT_FLTP, } from '../constants/constants.js';
-import { FF_ENCODER_AAC, FF_ENCODER_LIBX264 } from '../constants/encoders.js';
+import { AV_CODEC_ID_AAC, AV_CODEC_ID_AV1, AV_CODEC_ID_FLAC, AV_CODEC_ID_H264, AV_CODEC_ID_HEVC, AV_CODEC_ID_OPUS, AV_HWDEVICE_TYPE_NONE, AV_PIX_FMT_YUV420P, AV_SAMPLE_FMT_FLT, AV_SAMPLE_FMT_FLTP, } from '../constants/constants.js';
+import { FF_ENCODER_AAC, FF_ENCODER_LIBOPUS, FF_ENCODER_LIBX264 } from '../constants/encoders.js';
 import { Codec } from '../lib/codec.js';
 import { Rational } from '../lib/rational.js';
-import { avGetCodecString } from '../lib/utilities.js';
+import { avGetCodecString, avGetMediaTypeString, avGetPixFmtName } from '../lib/utilities.js';
 import { Decoder } from './decoder.js';
 import { Demuxer } from './demuxer.js';
 import { Encoder } from './encoder.js';
@@ -10,7 +10,9 @@ import { FilterPreset } from './filter-presets.js';
 import { FilterAPI } from './filter.js';
 import { HardwareContext } from './hardware.js';
 import { Muxer } from './muxer.js';
-import { consumeStreamInParallel, pipeline, PipelineControlImpl } from './pipeline.js';
+import { consumeStreamInParallel, interruptibleFrameSource, pipeline, PipelineControlImpl } from './pipeline.js';
+import { pickSupportedPixelFormat } from './utilities/codec-format.js';
+import { PacketAgeWatchdog } from './utilities/packet-age-watchdog.js';
 /**
  * Target codec strings for fMP4 streaming.
  */
@@ -22,11 +24,18 @@ export const FMP4_CODECS = {
     FLAC: 'flac',
     OPUS: 'opus',
 };
+/**
+ * Shortest fragDuration in seconds the transcoded video GOP follows.
+ *
+ * @internal
+ */
+const MIN_FRAGMENT_GOP = 0.5;
 /**
  * High-level fMP4 streaming with automatic codec detection and transcoding.
  *
  * Provides fragmented MP4 streaming for clients.
- * Automatically transcodes video to H.264 and audio to AAC if not supported by client.
+ * Automatically transcodes video to H.264 and audio to AAC (Opus when the client
+ * lists Opus but not AAC) if not supported by client.
  * Client sends supported codecs, server transcodes accordingly.
  * Essential component for building adaptive streaming servers.
  *
@@ -83,9 +92,19 @@ export class FMP4Stream {
     signal;
     supportedCodecs;
     incompleteBoxBuffer = null;
+    pendingFragment = [];
+    abortHandler;
+    stopRequested = false;
+    discardOutput = false;
+    stopPromise;
+    startAbort;
+    stopSignal = Promise.withResolvers();
     fragmentQueue = null;
+    packetAgeWatchdog;
+    _droppedFragments = 0;
     _initSegment = null;
     _initSegmentResolve = null;
+    _initSegmentReject = null;
     _initSegmentPromise = null;
     _ftypData = null;
     _moovData = null;
@@ -96,9 +115,25 @@ export class FMP4Stream {
      *
      * Use {@link create} factory method
      *
+     * @throws {RangeError} If dtsBackwardThreshold, dtsForwardThreshold or maxPacketAge is not a finite number >= 0
+     *
      * @internal
      */
     constructor(input, options) {
+        const isLiveInput = typeof input === 'string' && /^(rtsps?|rtmp(?:e|s|t|te|ts)?|s?rtp|udp|srt|tcp|tls|sctp):/i.test(input);
+        const dtsBackwardThreshold = options.dtsBackwardThreshold ?? 10;
+        // Only a source read in real time pairs a gap with the matching wait.
+        const dtsForwardThreshold = options.dtsForwardThreshold ?? (isLiveInput ? 10 : 0);
+        const maxPacketAge = options.maxPacketAge ?? 60;
+        for (const [name, value] of [
+            ['dtsBackwardThreshold', dtsBackwardThreshold],
+            ['dtsForwardThreshold', dtsForwardThreshold],
+            ['maxPacketAge', maxPacketAge],
+        ]) {
+            if (!Number.isFinite(value) || value < 0) {
+                throw new RangeError(`${name} must be a finite number of seconds >= 0, got ${value}`);
+            }
+        }
         if (typeof input === 'string') {
             this.inputUrl = input;
         }
@@ -114,10 +149,7 @@ export class FMP4Stream {
         this.inputOptions = {
             ...options.inputOptions,
             options: {
-                flags: 'low_delay',
-                fflags: 'nobuffer',
-                // analyzeduration: 0,
-                // probesize: 32,
+                ...(isLiveInput ? { flags: 'low_delay', fflags: 'nobuffer' } : {}),
                 timeout: 10000000,
                 rtsp_transport: inputUrl.toLowerCase().startsWith('rtsp') ? 'tcp' : undefined,
                 ...options.inputOptions?.options,
@@ -134,6 +166,8 @@ export class FMP4Stream {
                 fps: options.video?.fps,
                 width: options.video?.width,
                 height: options.video?.height,
+                bitrate: options.video?.bitrate,
+                tag: options.video?.tag,
                 encoderOptions: options.video?.encoderOptions ?? {},
             },
             audio: {
@@ -141,7 +175,11 @@ export class FMP4Stream {
             },
             bufferSize: options.bufferSize ?? 2 * 1024 * 1024,
             boxMode: options.boxMode ?? false,
+            maxQueuedFragments: options.maxQueuedFragments ?? 16,
             movFlags: options.movFlags ?? '+frag_keyframe+separate_moof+default_base_moof+empty_moov',
+            dtsBackwardThreshold,
+            dtsForwardThreshold,
+            maxPacketAge,
         };
         this.signal = options.signal;
         // Parse supported codecs
@@ -162,6 +200,8 @@ export class FMP4Stream {
      *
      * @returns Configured fMP4 stream instance
      *
+     * @throws {RangeError} If dtsBackwardThreshold, dtsForwardThreshold or maxPacketAge is not a finite number >= 0
+     *
      * @example
      * ```typescript
      * // Stream from file with codec negotiation
@@ -189,6 +229,8 @@ export class FMP4Stream {
      *
      * Only available when boxMode is enabled.
      * Resolves once the first ftyp and moov boxes have been received.
+     * Rejects if the stream fails or is stopped before the init segment
+     * was produced, so awaiting it never hangs.
      *
      * @throws {Error} If boxMode is not enabled
      */
@@ -196,16 +238,39 @@ export class FMP4Stream {
         if (!this.options.boxMode) {
             throw new Error('initSegment is only available in box mode');
         }
-        this._initSegmentPromise ??= new Promise((resolve) => {
+        this._initSegmentPromise ??= new Promise((resolve, reject) => {
             if (this._initSegment) {
                 resolve(this._initSegment);
             }
             else {
                 this._initSegmentResolve = resolve;
+                this._initSegmentReject = reject;
             }
         });
         return this._initSegmentPromise;
     }
+    /**
+     * Number of media fragments dropped due to consumer backpressure.
+     *
+     * Incremented whenever the {@link fragments} backlog exceeds
+     * `maxQueuedFragments` and the oldest fragment is discarded.
+     * Reset to 0 when the stream is (re)started.
+     *
+     * @returns Total dropped fragments for the current run
+     *
+     * @example
+     * ```typescript
+     * for await (const fragment of stream.fragments()) {
+     *   await sendToClient(fragment.data);
+     *   if (stream.droppedFragments > 0) {
+     *     console.warn(`Consumer too slow: ${stream.droppedFragments} fragments dropped`);
+     *   }
+     * }
+     * ```
+     */
+    get droppedFragments() {
+        return this._droppedFragments;
+    }
     /**
      * Get the demuxer instance.
      *
@@ -255,7 +320,7 @@ export class FMP4Stream {
                 parts.push(FMP4_CODECS.H264);
             }
             if (this.source.audio) {
-                parts.push(FMP4_CODECS.AAC);
+                parts.push(this.audioTranscodeTarget());
             }
             return parts.join(',');
         }
@@ -299,8 +364,7 @@ export class FMP4Stream {
         if (audioCodecId) {
             const needsAudioTranscode = !this.isAudioCodecSupported(audioCodecId);
             if (needsAudioTranscode) {
-                // Transcoding to AAC
-                audioCodec = FMP4_CODECS.AAC;
+                audioCodec = this.audioTranscodeTarget();
             }
             else if (audioCodecId === AV_CODEC_ID_AAC) {
                 // AAC - use fixed codec string
@@ -322,13 +386,58 @@ export class FMP4Stream {
         // Combine video and audio codec strings
         return [videoCodec, audioCodec].filter(Boolean).join(',');
     }
+    /**
+     * Video description of the muxed fMP4 output (output codec, RFC 6381 codec string, resolution, fps).
+     *
+     * Available after {@link start} has opened the input.
+     *
+     * @returns The output video info, or `undefined` when there is no video track.
+     *
+     * @example
+     * ```typescript
+     * const videoInfo = stream.getVideoInfo();
+     * if (videoInfo) {
+     *   console.log(`Codec: ${videoInfo.codec}, Resolution: ${videoInfo.width}x${videoInfo.height}, FPS: ${videoInfo.fps}`);
+     * }
+     * ```
+     */
+    getVideoInfo() {
+        if (this.source) {
+            if (!this.source.video) {
+                return undefined;
+            }
+            return {
+                codec: 'h264',
+                codecString: FMP4_CODECS.H264,
+                width: this.options.video?.width ?? 0,
+                height: this.options.video?.height ?? 0,
+                fps: this.options.video?.fps ?? 0,
+            };
+        }
+        const videoStream = this.input?.video();
+        if (!videoStream) {
+            return undefined;
+        }
+        const codecId = videoStream.codecpar.codecId;
+        const transcode = !this.isVideoCodecSupported(codecId);
+        const codecString = transcode ? FMP4_CODECS.H264 : (avGetCodecString(videoStream.codecpar) ?? FMP4_CODECS.H264);
+        const codec = transcode || codecId === AV_CODEC_ID_H264 ? 'h264' : codecId === AV_CODEC_ID_HEVC ? 'hevc' : codecId === AV_CODEC_ID_AV1 ? 'av1' : 'unknown';
+        const rate = videoStream.avgFrameRate;
+        return {
+            codec,
+            codecString,
+            width: transcode && this.options.video?.width ? this.options.video.width : videoStream.codecpar.width,
+            height: transcode && this.options.video?.height ? this.options.video.height : videoStream.codecpar.height,
+            fps: transcode && this.options.video?.fps ? this.options.video.fps : rate.den ? rate.num / rate.den : 0,
+        };
+    }
     /**
      * Start streaming media to fMP4 chunks.
      *
      * Begins the media processing pipeline, reading packets from input,
      * transcoding based on supported codecs, and generating fMP4 chunks.
      * Video transcodes to H.264 if H.264/H.265 not supported.
-     * Audio transcodes to AAC if AAC/FLAC/Opus not supported.
+     * Audio transcodes to AAC (Opus when only Opus is listed) if the input codec is not supported.
      * This method returns immediately after starting the pipeline.
      *
      * @returns Promise that resolves when pipeline is started
@@ -352,6 +461,8 @@ export class FMP4Stream {
     async start() {
         this.startPromise ??= this.doStart().catch((error) => {
             this.startPromise = undefined;
+            // A pending initSegment consumer must not hang when startup fails.
+            this.rejectInitSegment(error instanceof Error ? error : new Error(String(error)));
             throw error;
         });
         await this.startPromise;
@@ -362,11 +473,29 @@ export class FMP4Stream {
      * @internal
      */
     async doStart() {
+        // A start racing an in-flight stop() waits for the teardown to finish,
+        // otherwise it would build the pipeline on top of freed resources.
+        if (this.stopPromise) {
+            await this.stopPromise;
+        }
         if (this.pipeline) {
             return;
         }
         this.signal?.throwIfAborted();
-        this.signal?.addEventListener('abort', () => this.stop(), { once: true });
+        // Store the handler so stop() can remove it - otherwise listeners would
+        // accumulate across restarts. Teardown errors are swallowed here: they are
+        // already surfaced via onClose(error) by the completion handler.
+        this.abortHandler = () => {
+            this.stop().catch(() => { });
+        };
+        this.signal?.addEventListener('abort', this.abortHandler, { once: true });
+        this._droppedFragments = 0;
+        this.discardOutput = false;
+        // Re-armed per start so a restart is not torn down by the previous run.
+        this.stopSignal = Promise.withResolvers();
+        // Lets stop() interrupt a startup that is blocked in the input open
+        // (an RTSP connect can take seconds).
+        this.startAbort = new AbortController();
         // Frame-source path: encode pre-composited frames directly (no demuxer/decoder).
         if (this.source) {
             await this.startFromFrames();
@@ -377,8 +506,10 @@ export class FMP4Stream {
             if (!this.inputUrl) {
                 throw new Error('No input URL or Demuxer provided');
             }
-            this.input = await Demuxer.open(this.inputUrl, this.inputOptions);
+            const openSignal = this.signal ? AbortSignal.any([this.signal, this.startAbort.signal]) : this.startAbort.signal;
+            this.input = await Demuxer.open(this.inputUrl, { ...this.inputOptions, signal: openSignal });
         }
+        this.throwIfStopRequested();
         const videoStream = this.input.video();
         const audioStream = this.input.audio();
         // Check if video needs transcoding
@@ -396,6 +527,7 @@ export class FMP4Stream {
                 hardware: this.hardwareContext,
                 exitOnError: false,
             });
+            this.throwIfStopRequested();
             // Determine if we need filters by comparing with current stream properties
             const currentWidth = videoStream.codecpar.width;
             const currentHeight = videoStream.codecpar.height;
@@ -403,6 +535,7 @@ export class FMP4Stream {
             const needsScale = (this.options.video.width !== undefined && this.options.video.width !== currentWidth) ||
                 (this.options.video.height !== undefined && this.options.video.height !== currentHeight);
             const needsFps = this.options.video.fps !== undefined && isFinite(currentFps) && this.options.video.fps !== currentFps;
+            const encoderCodec = this.hardwareContext?.getEncoderCodec('h264') ?? Codec.findEncoderByName(FF_ENCODER_LIBX264);
             // Create filter chain only if needed
             if (needsScale || needsFps) {
                 const filterChain = FilterPreset.chain(this.hardwareContext);
@@ -416,13 +549,28 @@ export class FMP4Stream {
                 if (needsFps) {
                     filterChain.filter('fps', { fps: this.options.video.fps });
                 }
+                // Software scaling leaves the graph output format unconstrained, so swscale keeps the
+                // source format on both sides of the scale. Packed formats like yuyv422 can't be scaled
+                // in place (yuyv422 -> yuyv422 fails with ENOSYS), and the encoder wouldn't accept them
+                // anyway. Pin the output to yuv420p so the graph negotiates a real conversion: it is the
+                // one format every browser/player can decode via MSE (unlike e.g. the 4:2:2 High profile
+                // that a least-loss pick would choose for a yuyv422 source). Fall back to a codec-supported
+                // format only if the encoder genuinely can't take yuv420p. Hardware chains negotiate their
+                // format through the frames context instead.
+                if (needsScale && !this.hardwareContext) {
+                    const formats = encoderCodec.pixelFormats;
+                    const targetFmt = !formats || formats.includes(AV_PIX_FMT_YUV420P) ? AV_PIX_FMT_YUV420P : pickSupportedPixelFormat(videoStream.codecpar.format, formats);
+                    const targetFmtName = avGetPixFmtName(targetFmt);
+                    if (targetFmtName) {
+                        filterChain.filter('format', { pix_fmts: targetFmtName });
+                    }
+                }
                 this.videoFilter = FilterAPI.create(filterChain.build(), {
                     hardware: this.hardwareContext,
                 });
             }
-            const encoderCodec = this.hardwareContext?.getEncoderCodec('h264') ?? Codec.findEncoderByName(FF_ENCODER_LIBX264);
             let encoderOptions = {};
-            if (encoderCodec.name === FF_ENCODER_LIBX264 || encoderCodec.name === FF_ENCODER_LIBX264) {
+            if (encoderCodec.name === FF_ENCODER_LIBX264) {
                 encoderOptions.preset = 'ultrafast';
                 encoderOptions.tune = 'zerolatency';
             }
@@ -430,36 +578,100 @@ export class FMP4Stream {
                 ...encoderOptions,
                 ...this.options.video.encoderOptions,
             };
+            const effectiveFps = this.options.video.fps ?? currentFps;
+            const fpsForGop = isFinite(effectiveFps) && effectiveFps > 0 ? effectiveFps : 30;
+            const bitrate = this.options.video.bitrate;
             this.videoEncoder = await Encoder.create(encoderCodec, {
                 decoder: this.videoDecoder,
                 options: encoderOptions,
+                configure: (ctx) => {
+                    ctx.gopSize = this.gopSize(fpsForGop);
+                    this.applyBitrate(ctx, bitrate);
+                },
             });
+            this.throwIfStopRequested();
         }
         // Check if audio needs transcoding
         const needsAudioTranscode = audioStream && !this.isAudioCodecSupported(audioStream.codecpar.codecId);
         if (needsAudioTranscode) {
-            // Transcode to AAC
             this.audioDecoder = await Decoder.create(audioStream, {
                 exitOnError: false,
             });
-            const targetSampleRate = 44100;
-            const filterChain = FilterPreset.chain().aformat(AV_SAMPLE_FMT_FLTP, targetSampleRate, 'stereo').build();
-            this.audioFilter = FilterAPI.create(filterChain);
-            this.audioEncoder = await Encoder.create(FF_ENCODER_AAC, {
-                decoder: this.audioDecoder,
-                filter: this.audioFilter,
-                options: this.options.audio.encoderOptions,
-            });
+            await this.createAudioEncoder(this.audioDecoder, audioStream.codecpar.channels);
+            this.throwIfStopRequested();
         }
         // Setup output with callback
         this.output = await this.createOutput();
+        this.throwIfStopRequested();
         this.attachCompletion(this.runPipeline());
     }
+    /**
+     * Abort an in-flight startup once stop() was requested.
+     *
+     * Checked after every await in the startup path: the resources created so
+     * far are all assigned to instance fields, so the stop() that is waiting on
+     * this startup tears them down the moment it unwinds.
+     *
+     * @throws {Error} If stop() was called while starting
+     *
+     * @internal
+     */
+    throwIfStopRequested() {
+        if (this.stopRequested) {
+            throw new Error('FMP4Stream stopped during start');
+        }
+    }
+    /**
+     * Cap the video bitrate on the encoder context.
+     *
+     * Applies a VBV rate cap (maxrate + a 1s buffer) WITHOUT setting a target
+     * bitrate, so the encoder keeps its default constant-quality mode but can
+     * never exceed the negotiated ceiling. Setting the bitrate as an ABR target
+     * instead would push a normally-lighter stream UP to fill it, overshooting on
+     * bursts - the opposite of what strict rate-capped consumers want.
+     * No-op when no bitrate was requested.
+     *
+     * @param ctx - Encoder codec context
+     *
+     * @param bitrate - Maximum bitrate in bits per second, or undefined
+     *
+     * @internal
+     */
+    applyBitrate(ctx, bitrate) {
+        if (!bitrate || bitrate <= 0) {
+            return;
+        }
+        ctx.rcMaxRate = BigInt(Math.round(bitrate));
+        // 1s buffer keeps per-fragment size close to the cap instead of allowing
+        // multi-second bursts over it.
+        ctx.rcBufferSize = Math.round(bitrate);
+    }
+    /**
+     * GOP size for the video encoder that starts every fragment with a keyframe.
+     *
+     * frag_duration flushes a fragment once it is that long, mid-GOP on a
+     * P-frame unless the GOP has the same length, and strict consumers reject
+     * such fragments. Shorter fragments (the 1 µs default flushes after every
+     * frame) are not matched: a GOP of a few frames multiplies the bitrate, so
+     * below MIN_FRAGMENT_GOP the GOP is 2 s, as with a fragDuration of 0.
+     *
+     * @param fps - Output frame rate
+     *
+     * @returns GOP size in frames
+     *
+     * @internal
+     */
+    gopSize(fps) {
+        const fragSeconds = this.options.fragDuration / 1_000_000;
+        const seconds = fragSeconds >= MIN_FRAGMENT_GOP ? fragSeconds : 2;
+        return Math.max(1, Math.round(fps * seconds));
+    }
     /**
      * Create the fMP4 output muxer with the fragment-emitting write callback.
      *
      * Uses `this.input` when present (demuxer path) and no input for the
-     * frame-source path.
+     * frame-source path. Attaches a fresh packet age watchdog unless
+     * `maxPacketAge` is 0.
      *
      * @returns The configured muxer
      *
@@ -468,12 +680,17 @@ export class FMP4Stream {
     async createOutput() {
         const cb = {
             write: (buffer) => {
+                // Swallows what the teardown of a failed session flushes (see attachCompletion).
+                if (this.discardOutput) {
+                    return buffer.length;
+                }
                 if (this.options.boxMode) {
                     // Box mode: buffer until we have complete boxes
                     this.processBoxMode(buffer);
                 }
                 else {
                     // Chunk mode: send raw data immediately
+                    this.packetAgeWatchdog?.consumeChunk(buffer);
                     const info = { isComplete: false, boxes: [] };
                     this.options.onData(buffer, info);
                     this.pushFragment(buffer, info);
@@ -481,39 +698,126 @@ export class FMP4Stream {
                 return buffer.length;
             },
         };
-        return await Muxer.open(cb, {
+        const output = await Muxer.open(cb, {
             input: this.input,
             format: 'mp4',
             bufferSize: this.options.bufferSize,
             exitOnError: false,
+            dtsBackwardThreshold: this.options.dtsBackwardThreshold,
+            dtsForwardThreshold: this.options.dtsForwardThreshold,
+            configure: (fmt) => {
+                const tag = this.options.video?.tag;
+                if (!tag) {
+                    return;
+                }
+                for (const stream of fmt.streams) {
+                    if (stream.codecpar.codecId === AV_CODEC_ID_HEVC) {
+                        stream.codecpar.codecTag = tag;
+                    }
+                }
+            },
             options: {
                 movflags: this.options.movFlags,
                 frag_duration: this.options.fragDuration,
             },
         });
+        // Per session: a restart must not inherit the previous session's backlog.
+        if (this.options.maxPacketAge > 0) {
+            this.packetAgeWatchdog = new PacketAgeWatchdog(this.options.maxPacketAge, (index) => {
+                const codecType = output.getStream(index)?.codecpar.codecType;
+                return codecType === undefined ? '' : (avGetMediaTypeString(codecType) ?? '');
+            });
+            output.setPacketObserver(this.packetAgeWatchdog);
+        }
+        return output;
     }
     /**
      * Wire the pipeline completion to the fragment/close callbacks.
      *
      * On success ends the fragment iterator and invokes `onClose()`; on error
-     * stops the stream and invokes `onClose(error)`. Runs in the background.
+     * stops the stream, discarding the output the muxer still holds, and invokes
+     * `onClose(error)`. Either way `onClose` runs exactly once and the detached
+     * chain never rejects. Runs in the background.
      *
      * @param completion - The pipeline completion promise
      *
      * @internal
      */
     attachCompletion(completion) {
-        completion
-            .then(() => {
+        // One then() with both handlers: a throwing onClose() in the success path
+        // must not fall through into the error path and fire onClose a second time.
+        completion.then(() => {
             this.endFragments();
-            this.options.onClose?.();
-        })
-            .catch(async (error) => {
+            // No-op in the normal case (init segment resolved long ago) - only
+            // fires if the stream ended without ever emitting ftyp+moov.
+            this.rejectInitSegment(new Error('FMP4Stream ended before init segment was produced'));
+            this.emitClose();
+        }, async (reason) => {
+            const error = reason instanceof Error ? reason : new Error(String(reason));
             this.endFragments();
-            await this.stop();
-            this.options.onClose?.(error);
+            // Reject with the pipeline error so an initSegment consumer sees the
+            // actual failure instead of the generic "stopped" error from stop().
+            this.rejectInitSegment(error);
+            // A stop() in flight or an aborted signal means the owner is tearing
+            // the stream down - the pipeline unwinding with an AbortError is the
+            // expected shutdown path, not a failure. Decided before the stop()
+            // below, which would make every failure look deliberate.
+            const deliberate = this.isDeliberateStop(reason);
+            // Closing the output flushes the muxer's backlog and the trailer. After
+            // a failure that backlog is suspect: when a backward jump ends the
+            // session, the packets the timeline had jumped ahead to are still
+            // queued and would leave as a fragment placed that far ahead; after a
+            // stall it holds up to maxPacketAge of retained samples. Nothing is
+            // emitted past the failure, through onData or fragments(). A
+            // deliberate stop keeps its tail.
+            if (!deliberate) {
+                this.discardOutput = true;
+            }
+            // Release the input (e.g. the RTSP connection) before reporting, so an
+            // owner that restarts from onClose never overlaps a live session. A
+            // teardown failure must not swallow the onClose call: without it the
+            // owner never learns the stream is gone.
+            try {
+                await this.stop();
+            }
+            catch {
+                // doStop() already released whatever it could.
+            }
+            this.emitClose(deliberate ? undefined : error);
         });
     }
+    /**
+     * Invoke the owner's onClose callback.
+     *
+     * The completion chain runs detached, so an exception from the callback
+     * could only surface as an unhandled rejection - it is logged instead.
+     *
+     * @param error - Pipeline error, or undefined for a clean end
+     *
+     * @internal
+     */
+    emitClose(error) {
+        try {
+            this.options.onClose(error);
+        }
+        catch (callbackError) {
+            // The stream is already closed; logged so a broken restart path in the
+            // owner does not vanish silently.
+            console.error('[FMP4Stream] onClose callback threw:', callbackError);
+        }
+    }
+    /**
+     * Whether a pipeline rejection was caused by an intentional shutdown.
+     *
+     * @param error - The pipeline rejection reason
+     *
+     * @returns True when stop() is in flight or the owner's signal aborted
+     *
+     * @internal
+     */
+    isDeliberateStop(error) {
+        return this.stopRequested || this.stopPromise !== undefined || this.signal?.aborted === true || (error instanceof Error && error.name === 'AbortError');
+    }
     /**
      * Set up encoders and the fMP4 muxer for a pre-composited frame source and
      * start encoding. No demuxer or decoder is involved - the provided frames are
@@ -552,37 +856,39 @@ export class FMP4Stream {
                 fps = 30;
             }
             // Set the framerate explicitly - without a decoder the encoder would infer
-            // it from the frame timebase and pick an absurd level. Bound the GOP so
-            // fragments get keyframes at a sensible cadence.
+            // it from the frame timebase and pick an absurd level.
+            const bitrate = this.options.video.bitrate;
             this.videoEncoder = await Encoder.create(encoderCodec, {
                 options: encoderOptions,
                 configure: (ctx) => {
                     ctx.framerate = new Rational(Math.round(fps), 1);
-                    ctx.gopSize = Math.max(1, Math.round(fps * 2));
+                    ctx.gopSize = this.gopSize(fps);
+                    this.applyBitrate(ctx, bitrate);
                 },
             });
         }
-        // Audio encoder (AAC), resampling via aformat like the demuxer path.
         if (source.audio) {
-            const filterChain = FilterPreset.chain().aformat(AV_SAMPLE_FMT_FLTP, 44100, 'stereo').build();
-            this.audioFilter = FilterAPI.create(filterChain);
-            this.audioEncoder = await Encoder.create(FF_ENCODER_AAC, {
-                filter: this.audioFilter,
-                options: this.options.audio.encoderOptions,
-            });
+            await this.createAudioEncoder();
         }
+        this.throwIfStopRequested();
         this.output = await this.createOutput();
+        this.throwIfStopRequested();
         // eslint-disable-next-line prefer-const
         let control;
         const shouldStop = () => control?.isStopped() ?? false;
         const tasks = [];
+        // A frame source has no demuxer for stop() to interrupt, so wrap it to make
+        // a silent source releasable instead of blocking teardown forever.
+        const stopped = this.stopSignal.promise;
         if (source.video && this.videoEncoder) {
             const streamIndex = this.output.addStream(this.videoEncoder);
-            tasks.push(consumeStreamInParallel(this.videoEncoder.packets(source.video), this.output, streamIndex, shouldStop));
+            const video = interruptibleFrameSource(source.video, stopped);
+            tasks.push(consumeStreamInParallel(this.videoEncoder.packets(video), this.output, streamIndex, shouldStop));
         }
         if (source.audio && this.audioFilter && this.audioEncoder) {
             const streamIndex = this.output.addStream(this.audioEncoder);
-            tasks.push(consumeStreamInParallel(this.audioEncoder.packets(this.audioFilter.frames(source.audio)), this.output, streamIndex, shouldStop));
+            const audio = interruptibleFrameSource(source.audio, stopped);
+            tasks.push(consumeStreamInParallel(this.audioEncoder.packets(this.audioFilter.frames(audio)), this.output, streamIndex, shouldStop));
         }
         // Close the shared muxer only after ALL streams are done (flushes the trailer).
         const run = Promise.all(tasks).then(async () => {
@@ -597,7 +903,8 @@ export class FMP4Stream {
      *
      * Stops the pipeline, closes output, and releases all FFmpeg resources.
      * Safe to call multiple times. After stopping, you can call start() again
-     * to restart the stream.
+     * to restart the stream. Resolves even if the pipeline had failed; that
+     * error is reported through `onClose(error)`.
      *
      * @example
      * ```typescript
@@ -611,46 +918,117 @@ export class FMP4Stream {
      * ```
      */
     async stop() {
-        this.endFragments();
+        // Memoized: concurrent stop() calls share one teardown instead of
+        // double-closing native resources.
+        this.stopPromise ??= this.doStop().finally(() => {
+            this.stopPromise = undefined;
+        });
+        await this.stopPromise;
+    }
+    /**
+     * Perform the actual teardown (see {@link stop}).
+     *
+     * @internal
+     */
+    async doStop() {
+        // An in-flight start() must unwind before teardown - otherwise it would
+        // keep building the pipeline on top of freed resources and leave an
+        // orphaned transcode running forever. The flag makes doStart() bail at its
+        // next checkpoint, the abort unblocks a startup stuck in the input open.
+        this.stopRequested = true;
+        this.startAbort?.abort();
+        this.startAbort = undefined;
+        // Unblocks a frame source that went silent, so the completion barrier below
+        // cannot wait on a pull that will never settle.
+        this.stopSignal.resolve();
+        const inflightStart = this.startPromise;
         // Allow a fresh start() after stopping.
         this.startPromise = undefined;
-        // Stop pipeline if running and wait for completion. Swallow a rejected
-        // completion - the error is already surfaced via the onClose(error) path;
-        // we just need cleanup to proceed.
-        if (this.pipeline && !this.pipeline.isStopped()) {
-            this.pipeline.stop();
+        if (inflightStart) {
             try {
-                await this.pipeline.completion;
+                await inflightStart;
             }
             catch {
-                // Pipeline errored - proceed with teardown regardless.
-            }
-            this.pipeline = undefined;
-        }
-        // Close all resources
-        await this.input?.close();
-        this.input = undefined;
-        this.videoDecoder?.close();
-        this.videoDecoder = undefined;
-        this.videoFilter?.close();
-        this.videoFilter = undefined;
-        this.videoEncoder?.close();
-        this.videoEncoder = undefined;
-        this.audioDecoder?.close();
-        this.audioDecoder = undefined;
-        this.audioFilter?.close();
-        this.audioFilter = undefined;
-        this.audioEncoder?.close();
-        this.audioEncoder = undefined;
-        this.hardwareContext?.dispose();
-        this.hardwareContext = undefined;
-        await this.output?.close();
-        this.output = undefined;
-        this._initSegment = null;
-        this._initSegmentResolve = null;
-        this._initSegmentPromise = null;
-        this._ftypData = null;
-        this._moovData = null;
+                // Aborted or failed startup - resources are torn down below either way.
+            }
+        }
+        try {
+            this.endFragments();
+            // A consumer awaiting the init segment must not hang forever.
+            this.rejectInitSegment(new Error('FMP4Stream stopped before init segment was produced'));
+            // Remove the abort listener so it does not accumulate across restarts.
+            if (this.abortHandler) {
+                this.signal?.removeEventListener('abort', this.abortHandler);
+                this.abortHandler = undefined;
+            }
+            // Stop pipeline if running and wait for completion. Swallow a rejected
+            // completion - the error is already surfaced via the onClose(error) path;
+            // we just need cleanup to proceed.
+            const pipeline = this.pipeline;
+            if (pipeline) {
+                if (!pipeline.isStopped()) {
+                    pipeline.stop();
+                }
+                try {
+                    await pipeline.completion;
+                }
+                catch {
+                    // Pipeline errored - proceed with teardown regardless.
+                }
+                if (this.pipeline === pipeline) {
+                    this.pipeline = undefined;
+                }
+            }
+            // Close all resources. The output goes FIRST: its async write worker may
+            // still be draining (header init reads the input's stream parameters),
+            // so freeing the input before the muxer has fully settled is a
+            // use-after-free on the worker thread.
+            // After a failure nothing the output emits is used (see attachCompletion),
+            // so the trailer is skipped instead of flushed into the void.
+            if (this.discardOutput) {
+                this.output?.discardOnClose();
+            }
+            // close() rethrows a failed background write after it freed the muxer.
+            // That error already ended the pipeline and reaches the owner through
+            // onClose(error), so it must not abort the teardown here and leak the
+            // codecs and the input (an RTSP connection) below.
+            try {
+                await this.output?.close();
+            }
+            catch {
+                // Surfaced through the pipeline completion.
+            }
+            this.output = undefined;
+            this.packetAgeWatchdog = undefined;
+            this.videoDecoder?.close();
+            this.videoDecoder = undefined;
+            this.videoFilter?.close();
+            this.videoFilter = undefined;
+            this.videoEncoder?.close();
+            this.videoEncoder = undefined;
+            this.audioDecoder?.close();
+            this.audioDecoder = undefined;
+            this.audioFilter?.close();
+            this.audioFilter = undefined;
+            this.audioEncoder?.close();
+            this.audioEncoder = undefined;
+            this.hardwareContext?.dispose();
+            this.hardwareContext = undefined;
+            await this.input?.close();
+            this.input = undefined;
+            // Reset parser and init segment state so a restart parses a clean stream.
+            this.incompleteBoxBuffer = null;
+            this.pendingFragment = [];
+            this._initSegment = null;
+            this._initSegmentResolve = null;
+            this._initSegmentReject = null;
+            this._initSegmentPromise = null;
+            this._ftypData = null;
+            this._moovData = null;
+        }
+        finally {
+            this.stopRequested = false;
+        }
     }
     /**
      * Async generator that yields media fragments (moof+mdat chunks).
@@ -663,8 +1041,16 @@ export class FMP4Stream {
      *
      * The generator completes when the stream stops or the pipeline ends.
      *
+     * Only a single consumer is supported: a second concurrent fragments() call
+     * would silently strand the first consumer, so it throws instead. The
+     * backlog is bounded by `maxQueuedFragments` - if the consumer falls behind
+     * a live source, the oldest fragments are dropped (see
+     * {@link droppedFragments}).
+     *
      * @yields {FMP4Fragment} Media fragment with data buffer and box info
      *
+     * @throws {Error} If another fragments() iterator is already active
+     *
      * @example
      * ```typescript
      * const stream = FMP4Stream.create('rtsp://camera/stream', {
@@ -681,6 +1067,9 @@ export class FMP4Stream {
      * ```
      */
     async *fragments() {
+        if (this.fragmentQueue) {
+            throw new Error('fragments() supports only a single consumer; the previous iterator is still active');
+        }
         this.fragmentQueue = { queue: [], resolve: null, done: false };
         try {
             while (true) {
@@ -759,6 +1148,47 @@ export class FMP4Stream {
         }
         return false;
     }
+    /**
+     * Codec that unsupported audio is transcoded to.
+     *
+     * @returns Opus when the client lists Opus but not AAC, otherwise AAC
+     *
+     * @internal
+     */
+    audioTranscodeTarget() {
+        return this.supportedCodecs.has(FMP4_CODECS.OPUS) && !this.supportedCodecs.has(FMP4_CODECS.AAC) ? FMP4_CODECS.OPUS : FMP4_CODECS.AAC;
+    }
+    /**
+     * Create the audio filter and encoder for the transcode target.
+     *
+     * AAC is resampled to 44.1 kHz stereo. Opus is resampled to 48 kHz, the only
+     * rate it transmits, keeps mono input mono and uses 20 ms frames.
+     *
+     * @param decoder - Input audio decoder, absent for a frame source
+     *
+     * @param channels - Input channel count, 0 when unknown
+     *
+     * @internal
+     */
+    async createAudioEncoder(decoder, channels = 0) {
+        if (this.audioTranscodeTarget() === FMP4_CODECS.OPUS) {
+            this.audioFilter = FilterAPI.create(FilterPreset.chain()
+                .aformat(AV_SAMPLE_FMT_FLT, 48000, channels === 1 ? 'mono' : 'stereo')
+                .build());
+            this.audioEncoder = await Encoder.create(FF_ENCODER_LIBOPUS, {
+                decoder,
+                filter: this.audioFilter,
+                options: { frame_duration: 20, ...this.options.audio.encoderOptions },
+            });
+            return;
+        }
+        this.audioFilter = FilterAPI.create(FilterPreset.chain().aformat(AV_SAMPLE_FMT_FLTP, 44100, 'stereo').build());
+        this.audioEncoder = await Encoder.create(FF_ENCODER_AAC, {
+            decoder,
+            filter: this.audioFilter,
+            options: this.options.audio.encoderOptions,
+        });
+    }
     /**
      * Check if audio codec is supported.
      *
@@ -783,6 +1213,18 @@ export class FMP4Stream {
     /**
      * Process buffer in box mode - buffers until complete boxes are available.
      *
+     * The muxer splits writes at arbitrary positions, so a chunk may end
+     * anywhere - including inside a box header. Any trailing partial box
+     * (header or body) is buffered for the next chunk; the parser never
+     * loses bytes regardless of where the split falls.
+     *
+     * Emission is fragment-aligned: a `moof` is held back until its `mdat` has
+     * arrived, then both are emitted as ONE onData call. The avio buffer flushes
+     * at arbitrary points (a fragment larger than the buffer always splits), so
+     * without this a consumer would see a bare `moof` followed by a detached
+     * `mdat` - unplayable framing for fMP4 consumers.
+     * Non-fragment boxes (ftyp, moov, mfra, ...) are emitted as they complete.
+     *
      * @param chunk - Incoming data chunk from FFmpeg
      *
      * @internal
@@ -794,60 +1236,132 @@ export class FMP4Stream {
             this.incompleteBoxBuffer = null;
         }
         let offset = 0;
-        const boxes = [];
-        while (offset + 8 <= chunk.length) {
+        let immediate = [];
+        const flushImmediate = () => {
+            if (immediate.length > 0) {
+                this.emitBoxGroup(immediate);
+                immediate = [];
+            }
+        };
+        while (offset < chunk.length) {
+            const remaining = chunk.length - offset;
+            // Partial 32-bit header - buffer the tail for the next chunk. Dropping
+            // it would desynchronize the parser for the rest of the stream.
+            if (remaining < 8) {
+                this.incompleteBoxBuffer = chunk.subarray(offset);
+                break;
+            }
             // Read box header
-            const boxSize = chunk.readUInt32BE(offset);
-            const boxType = chunk.toString('ascii', offset + 4, offset + 8);
+            const size32 = chunk.readUInt32BE(offset);
+            let headerSize = 8;
+            let boxSize = size32;
+            if (size32 === 1) {
+                // 64-bit box: the actual size follows the type field as a 64-bit
+                // largesize (16-byte header total). movenc emits this for mdat > 4 GB.
+                if (remaining < 16) {
+                    this.incompleteBoxBuffer = chunk.subarray(offset);
+                    break;
+                }
+                headerSize = 16;
+                boxSize = Number(chunk.readBigUInt64BE(offset + 8));
+            }
+            // Safety check: invalid box size. size==0 ("box extends to end of file")
+            // cannot be framed in a live stream and any size below the header size
+            // is corrupt - recovery is impossible, so drop the rest of this chunk
+            // rather than emit garbage framing downstream.
+            if (boxSize < headerSize) {
+                // Emitted samples can no longer be counted - stop judging packet ages
+                // instead of mistaking the lost framing for a stalled muxer.
+                this.packetAgeWatchdog?.onFramingLost();
+                break;
+            }
             // Check if we have the complete box
             if (offset + boxSize > chunk.length) {
-                // Box is incomplete - save for next chunk
+                // Box body is incomplete - save the whole box for the next chunk
                 this.incompleteBoxBuffer = chunk.subarray(offset);
                 break;
             }
-            // We have the complete box - parse it
-            const box = {
-                type: boxType,
+            const parsed = {
+                type: chunk.toString('ascii', offset + 4, offset + 8),
                 size: boxSize,
-                data: chunk.subarray(offset + 8, offset + boxSize),
-                offset: offset,
+                headerSize,
+                raw: chunk.subarray(offset, offset + boxSize),
             };
-            boxes.push(box);
+            if (parsed.type === 'moof' || parsed.type === 'moov') {
+                this.packetAgeWatchdog?.consumeBox(parsed.raw);
+            }
+            if (parsed.type === 'moof') {
+                flushImmediate();
+                if (this.pendingFragment.length > 0) {
+                    // a moof without a following mdat never happens with movenc, emit
+                    // the stale fragment as-is rather than silently dropping bytes
+                    this.emitBoxGroup(this.pendingFragment);
+                    this.pendingFragment = [];
+                }
+                this.pendingFragment.push(parsed);
+            }
+            else if (this.pendingFragment.length > 0) {
+                this.pendingFragment.push(parsed);
+                if (parsed.type === 'mdat') {
+                    this.emitBoxGroup(this.pendingFragment);
+                    this.pendingFragment = [];
+                }
+            }
+            else {
+                immediate.push(parsed);
+            }
             // Move to next box
             offset += boxSize;
-            // Safety check: invalid box size
-            if (boxSize < 8) {
-                break;
-            }
         }
-        // If we have complete boxes, send them to the callback
-        if (boxes.length > 0) {
-            const boxData = chunk.subarray(0, offset);
-            const info = { isComplete: true, boxes };
-            // onData callback gets everything
-            this.options.onData(boxData, info);
-            // Init segment tracking: collect ftyp and moov data
-            if (!this._initSegment) {
-                for (const box of boxes) {
-                    if (box.type === 'ftyp' && !this._ftypData) {
-                        this._ftypData = chunk.subarray(box.offset, box.offset + box.size);
-                    }
-                    if (box.type === 'moov' && !this._moovData) {
-                        this._moovData = chunk.subarray(box.offset, box.offset + box.size);
-                    }
+        flushImmediate();
+    }
+    /**
+     * Emit a group of complete boxes as one onData call.
+     *
+     * Concatenates the raw box bytes, rebuilds the box list with offsets
+     * relative to the emitted buffer, tracks the init segment, and feeds the
+     * fragments() queue when the group is a media fragment.
+     *
+     * @param entries - Complete boxes in stream order
+     *
+     * @internal
+     */
+    emitBoxGroup(entries) {
+        const data = entries.length === 1 ? entries[0].raw : Buffer.concat(entries.map((e) => e.raw));
+        let position = 0;
+        const boxes = entries.map((entry) => {
+            const box = {
+                type: entry.type,
+                size: entry.size,
+                data: data.subarray(position + entry.headerSize, position + entry.size),
+                offset: position,
+            };
+            position += entry.size;
+            return box;
+        });
+        const info = { isComplete: true, boxes };
+        this.options.onData(data, info);
+        // Init segment tracking: collect ftyp and moov data
+        if (!this._initSegment) {
+            for (const box of boxes) {
+                if (box.type === 'ftyp' && !this._ftypData) {
+                    this._ftypData = data.subarray(box.offset, box.offset + box.size);
                 }
-                if (this._ftypData && this._moovData) {
-                    this._initSegment = Buffer.concat([this._ftypData, this._moovData]);
-                    this._initSegmentResolve?.(this._initSegment);
-                    this._initSegmentResolve = null;
+                if (box.type === 'moov' && !this._moovData) {
+                    this._moovData = data.subarray(box.offset, box.offset + box.size);
                 }
             }
-            // fragments() generator gets only media fragments (moof+mdat)
-            const isMediaFragment = boxes.some((b) => b.type === 'moof');
-            if (isMediaFragment) {
-                this.pushFragment(boxData, info);
+            if (this._ftypData && this._moovData) {
+                this._initSegment = Buffer.concat([this._ftypData, this._moovData]);
+                this._initSegmentResolve?.(this._initSegment);
+                this._initSegmentResolve = null;
+                this._initSegmentReject = null;
             }
         }
+        // fragments() generator gets only media fragments (moof+mdat)
+        if (boxes.some((b) => b.type === 'moof')) {
+            this.pushFragment(data, info);
+        }
     }
     /**
      * Push a fragment to the fragment queue for the async generator.
@@ -868,8 +1382,34 @@ export class FMP4Stream {
         }
         else {
             this.fragmentQueue.queue.push(fragment);
+            // Live sources keep producing regardless of consumer speed - bound the
+            // backlog by dropping the oldest media fragments. The init segment never
+            // enters this queue in box mode (kept separately via initSegment).
+            while (this.fragmentQueue.queue.length > this.options.maxQueuedFragments) {
+                this.fragmentQueue.queue.shift();
+                this._droppedFragments++;
+            }
         }
     }
+    /**
+     * Reject a pending initSegment promise so consumers never hang.
+     *
+     * No-op when the promise was never requested or has already settled. The
+     * promise is marked as handled to avoid an unhandled rejection when no
+     * consumer is currently awaiting it.
+     *
+     * @param error - Rejection reason (pipeline error or stop-before-init)
+     *
+     * @internal
+     */
+    rejectInitSegment(error) {
+        if (!this._initSegmentReject)
+            return;
+        this._initSegmentPromise?.catch(() => { });
+        this._initSegmentReject(error);
+        this._initSegmentReject = null;
+        this._initSegmentResolve = null;
+    }
     /**
      * Signal the fragment queue that no more fragments will arrive.
      *