Merge remote-tracking branch 'origin/dev' into claude/loving-dubinsky-32ccb0

Brings the branch up to date with dev (HEVC #1802, native H.264 decode #1796,
async device capture #1807, srt/rtmp/rtc egress) and keeps this PR's deltas:
NVENC/VAAPI always-on for Linux, openh264 always-on (no `software` feature),
publish=false removed, the nvidia-video-codec-sdk fork repinned to the hardened
dynamic-loading commit (default-features off), and the NVIDIA-probe fallback.

Note: restores dev's H.265/HEVC codec-aware encode path (Codec enum, codec-aware
backend selection, hev1 producer) that the previous branch merge had dropped by
taking "ours" wholesale. Verified: clippy -D clean, 19 moq-video tests pass
(incl. H.265 roundtrips), sort/taplo/fmt clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: kixelated

Cargo.lock

@@ -91,14 +91,18 @@ moq-cli publish --url https://relay.example.com --broadcast cam.hang \
 # One medium only:
 moq-cli publish --url https://relay.example.com --broadcast cam.hang capture --no-audio
 moq-cli publish --url https://relay.example.com --broadcast cam.hang capture --no-video
+
+# Pick a codec (default h264). h265 is hardware-only:
+moq-cli publish --url https://relay.example.com --broadcast cam.hang capture --codec h265
 ```
 
 Video capture uses a native per-platform backend (AVFoundation on macOS, V4L2 on
-Linux, Media Foundation on Windows) and a hardware H.264 encoder (VideoToolbox on
-macOS, NVENC on Linux NVIDIA, VAAPI on Linux Intel/AMD). There is no software
-encoder in the CLI build, so a machine with no usable hardware encoder errors
-rather than falling back. `--hardware` turns a missing encoder into an error
-instead of trying the next candidate. `--camera` takes a bare integer as a device index, otherwise a
+Linux, Media Foundation on Windows). The codec is chosen with `--codec`
+(`h264` default, or `h265`). For H.264 it picks a hardware encoder
+(VideoToolbox on macOS, NVENC on Linux NVIDIA, VAAPI on Linux Intel/AMD) when one
+is present, falling back to the built-in software encoder (openh264); force either
+with `--hardware` / `--software`. H.265 is hardware-only (VideoToolbox on macOS,
+Media Foundation on Windows). `--camera` takes a bare integer as a device index, otherwise a
 device path (Linux) or name (a friendly-name substring on Windows, the
 AVFoundation `uniqueID` on macOS). Audio capture uses cpal (CoreAudio / WASAPI /
 ALSA) and encodes Opus.

doc/bin/cli.md

@@ -31,8 +31,9 @@ peers see a black screen until the next natural keyframe arrives.
 `KeyframeRequest` events from the peer are logged but not propagated
 upstream; PLI-to-MoQ back-pressure is a future enhancement.
 
-AV1 / H.265 aren't in str0m 0.19's codec enum, so they're not negotiated;
-this is tracked as a follow-up. Use H.264 or VP9 for now.
+The egress paths (WHEP server, WHIP client) negotiate H.264, H.265, VP8,
+VP9, AV1, and Opus. The ingest paths (WHIP server, WHEP client) currently
+accept H.264, VP8, VP9, and Opus; H.265 / AV1 ingest is a follow-up.
 
 ## CLI shape
 
@@ -78,16 +79,26 @@ moq-rtc --relay https://relay.example.com --broadcast my-stream \
 
 ## Codec mapping
 
-| WebRTC codec | MoQ catalog |
-|--------------|-------------|
-| Opus         | `AudioCodec::Opus`, 48 kHz / stereo |
-| H.264        | `H264 { inline: true }` (Annex-B in catalog, no `avcC`) |
-| VP8          | `VideoCodec::VP8` |
-| VP9          | `VideoCodec::VP9` |
-
-H.264 input is reassembled by str0m as Annex-B; `moq-mux`'s H.264 importer
-in `Avc3` mode publishes the inline-parameter shape directly, which lines
-up with what the WebCodecs decoder in `@moq/watch` already expects. No
+| WebRTC codec | MoQ catalog | Egress | Ingest |
+|--------------|-------------|--------|--------|
+| Opus         | `AudioCodec::Opus`, 48 kHz / stereo | yes | yes |
+| H.264        | `VideoCodec::H264` (avc3 inline or avc1 + `avcC`) | yes | yes (avc3) |
+| H.265        | `VideoCodec::H265` (hev1 inline or hvc1 + `hvcC`) | yes | no |
+| VP8          | `VideoCodec::VP8` | yes | yes |
+| VP9          | `VideoCodec::VP9` | yes | yes |
+| AV1          | `VideoCodec::AV1` | yes | no |
+
+On egress, `codec::Track` reshapes each rendition into what str0m's Frame
+API expects. Opus / VP8 / VP9 / AV1 and inline-parameter H.264 (avc3) /
+H.265 (hev1) pass through untouched. Out-of-band-parameter H.264 (avc1) and
+H.265 (hvc1) are rewritten from length-prefixed NALU to Annex-B with the
+parameter sets (SPS/PPS, plus VPS for H.265) prepended to each keyframe.
+This reuses `moq-mux`'s `parse_avcc_param_sets` / `parse_hvcc_param_sets`
+and `annexb` helpers, the same logic as its `h264::Export` / `h265::Export`.
+
+On ingest, H.264 is reassembled by str0m as Annex-B; `moq-mux`'s H.264
+importer in `Avc3` mode publishes the inline-parameter shape directly, which
+lines up with what the WebCodecs decoder in `@moq/watch` already expects. No
 extra conversion needed in the gateway.
 
 (Written by Claude)

doc/bin/rtc.md

@@ -1,24 +1,31 @@
 ---
 title: moq-rtmp
-description: RTMP / enhanced-RTMP -> MoQ contribution ingest gateway
+description: RTMP / enhanced-RTMP <-> MoQ gateway (ingest and egress)
 ---
 
 # moq-rtmp
 
-`moq-rtmp` ingests [RTMP](https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol)
-(the protocol OBS, ffmpeg, and most hardware encoders speak) and publishes each
-stream into Media over QUIC as an ordinary broadcast.
+`moq-rtmp` bridges [RTMP](https://en.wikipedia.org/wiki/Real-Time_Messaging_Protocol)
+(the protocol OBS, ffmpeg, and most hardware encoders and players speak) and
+Media over QUIC, in **both directions**:
+
+- **Publish (ingest):** an encoder pushes a stream in, and `moq-rtmp` publishes it
+  into MoQ as an ordinary broadcast.
+- **Play (egress):** a player pulls `rtmp://host/<app>/<key>`, and `moq-rtmp`
+  subscribes to that broadcast from MoQ and streams it back down. VLC, ffplay, and
+  mpv can play it (browsers can't -- Flash is dead).
 
 RTMP carries media as FLV-format audio/video messages. `moq-rtmp` runs the RTMP
 handshake and chunk/AMF session (via the pure-Rust
-[`rml_rtmp`](https://crates.io/crates/rml_rtmp), no librtmp), re-wraps each
-message as an FLV tag, and feeds it to `moq-mux`'s FLV demuxer, which routes the
-media onto MoQ tracks. It's the contribution-ingest sibling of `moq-srt`
-(SRT/MPEG-TS) and `moq-rtc` (WHIP).
+[`rml_rtmp`](https://crates.io/crates/rml_rtmp), no librtmp). On ingest it re-wraps
+each message as an FLV tag and feeds it to `moq-mux`'s FLV demuxer; on egress it
+muxes the broadcast back to FLV with `moq-mux` and sends the tags out as RTMP
+messages. It's the sibling of `moq-srt` (SRT/MPEG-TS) and `moq-rtc` (WHIP/WHEP).
 
 Both **legacy RTMP** (H.264 + AAC) and **enhanced RTMP** (E-RTMP: the HEVC, AV1,
-VP9, Opus, and AC-3 FourCC payloads) are supported, because all codec handling
-lives in the `moq-mux` FLV demuxer.
+VP9, Opus, and AC-3 FourCC payloads) are supported in each direction, because all
+codec handling lives in the `moq-mux` FLV demuxer/muxer. Legacy players that speak
+only H.264 + AAC will reject the E-RTMP codecs on the play path.
 
 ## CLI shape
 
@@ -42,6 +49,15 @@ and the stream key to `cam0`; with ffmpeg:
 ffmpeg -re -i input.mp4 -c copy -f flv rtmp://127.0.0.1:1935/live/cam0
 ```
 
+Then play the same broadcast back out over RTMP from any player:
+
+```bash
+# Pulls broadcast `live/cam0` (the same URL it was pushed to).
+ffplay rtmp://127.0.0.1:1935/live/cam0
+mpv rtmp://127.0.0.1:1935/live/cam0
+vlc rtmp://127.0.0.1:1935/live/cam0
+```
+
 ### `serve` flags
 
 - `--server-bind`: QUIC/WebTransport bind address (default `[::]:443`). Also
@@ -81,23 +97,32 @@ moq-rtmp serve --server-bind [::]:443 --tls-generate localhost \
 
 Each connection's broadcast path is `<app>/<key>` from the RTMP app and stream
 key (`rtmp://host/<app>/<key>`), falling back to just the app when the key is
-empty, with `--rtmp-prefix` prepended. First publisher on a path wins; a second
-connection to the same path is rejected.
+empty, with `--rtmp-prefix` prepended. The same routing applies to both
+directions, so the URL round-trips: push to `rtmp://host/live/cam0`, then pull it
+back from `rtmp://host/live/cam0`.
+
+A play waits for the broadcast to be announced, so a player can connect slightly
+before the publisher. First **publisher** on a path wins (a second publish to a
+live path is rejected); **plays** don't claim a path, so any number of players can
+pull the same broadcast at once. In `serve` mode plays are served from the same
+origin the server exposes, so anything in it -- RTMP ingests and otherwise -- can
+be pulled back out over RTMP.
 
 ## Notes and limitations
 
 - **Auth.** The binary (and the `moq_rtmp::run` convenience) is unauthenticated:
-  anyone who can reach the TCP port can publish. Gate it with a host firewall or
-  a private network. To authenticate, embed the library and drive its
-  `Server` / `Request` API: `Server::accept` yields a pending publish, and you
-  verify the app / stream key (e.g. the stream key as a moq-token JWT) before
-  calling `request.accept(origin, path)` or `request.reject(reason)` -- no
-  callback, the policy lives in your loop.
-- **Embedding.** A relay can run ingest in-process by depending on the `moq-rtmp`
-  library (`default-features = false`). Call `moq_rtmp::run` against its own
-  origin for the unauthenticated case, or use `Server` / `Request` to plug in the
-  relay's existing JWT/path auth and scope the origin per token. Either way the
-  media is published locally with no extra hop.
+  anyone who can reach the TCP port can publish or play. Gate it with a host
+  firewall or a private network. To authenticate, embed the library and drive its
+  `Server` / `Request` API: `Server::accept` yields a `Request` that is either a
+  `Publish` or a `Play`, and you verify the app / stream key (e.g. the stream key
+  as a moq-token JWT) before accepting it into / out of an origin at a path of your
+  choosing, or rejecting it -- no callback, the policy lives in your loop.
+- **Embedding.** A relay can run the gateway in-process by depending on the
+  `moq-rtmp` library (`default-features = false`). Call `moq_rtmp::run` against its
+  own origin for the unauthenticated case (publishers ingest into it, players are
+  served out of it), or use `Server` / `Request` to plug in the relay's existing
+  JWT/path auth and scope the origin per token. Either way the media stays local
+  with no extra hop.
 - **RTMPS.** Embedders can terminate TLS themselves: set `Config::tls` (or
   `Server::with_tls`) with a `rustls::ServerConfig`, or accept the connection and
   finish the TLS handshake by hand and hand the stream to `moq_rtmp::accept_stream`

doc/bin/rtmp.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Native video decode C API: `moq_consume_video_raw` (+ `_close`, `_frame`,
+  `_frame_free`) subscribes to an H.264 track and hands back decoded I420 frames,
+  the video counterpart to `moq_consume_audio_raw`. Decoding happens inside
+  libmoq (VideoToolbox / openh264), so consumers no longer need ffmpeg.
+
 ## [0.3.7](https://github.com/moq-dev/moq/compare/libmoq-v0.3.6...libmoq-v0.3.7) - 2026-06-19
 
 ### Fixed

rs/libmoq/CHANGELOG.md

@@ -24,6 +24,7 @@ moq-audio = { workspace = true }
 moq-mux = { workspace = true }
 moq-native = { workspace = true, default-features = true }
 moq-net = { workspace = true, features = ["serde"] }
+moq-video = { workspace = true }
 thiserror = "2"
 tokio = { workspace = true, features = ["macros"] }
 tracing = "0.1"

rs/libmoq/Cargo.toml

@@ -492,6 +492,25 @@ impl Consume {
 		Ok(())
 	}
 
+	/// Look up a video rendition by catalog index, returning the
+	/// (broadcast, config, name) tuple needed to subscribe — mirrors
+	/// the index-based selection in `video_ordered`.
+	pub fn video_rendition(
+		&self,
+		catalog: Id,
+		index: usize,
+	) -> Result<(moq_net::BroadcastConsumer, hang::catalog::VideoConfig, String), Error> {
+		let consume = self.catalog.get(catalog).ok_or(Error::CatalogNotFound)?;
+		let (name, config) = consume
+			.catalog
+			.video
+			.renditions
+			.iter()
+			.nth(index)
+			.ok_or(Error::NoIndex)?;
+		Ok((consume.broadcast.clone(), config.clone(), name.clone()))
+	}
+
 	/// Look up an audio rendition by catalog index, returning the
 	/// (broadcast, config, name) tuple needed to subscribe — mirrors
 	/// the index-based selection in `audio_ordered`.

rs/libmoq/src/consume.rs

@@ -142,6 +142,10 @@ pub enum Error {
 	/// Error from the moq-audio codec layer.
 	#[error("audio error: {0}")]
 	Audio(Arc<moq_audio::AudioError>),
+
+	/// Error from the moq-video codec layer.
+	#[error("video error: {0}")]
+	Video(Arc<moq_video::Error>),
 }
 
 impl From<moq_audio::AudioError> for Error {
@@ -150,6 +154,12 @@ impl From<moq_audio::AudioError> for Error {
 	}
 }
 
+impl From<moq_video::Error> for Error {
+	fn from(err: moq_video::Error) -> Self {
+		Error::Video(Arc::new(err))
+	}
+}
+
 impl From<tracing::metadata::ParseLevelError> for Error {
 	fn from(err: tracing::metadata::ParseLevelError) -> Self {
 		Error::Level(Arc::new(err))
@@ -195,6 +205,7 @@ impl ffi::ReturnCode for Error {
 			Error::Native(_) => -33,
 			Error::Unauthorized => -34,
 			Error::Forbidden => -35,
+			Error::Video(_) => -36,
 		}
 	}
 }

rs/libmoq/src/error.rs

@@ -26,11 +26,13 @@ mod origin;
 mod publish;
 mod session;
 mod state;
+mod video;
 
 pub use api::*;
 pub use audio::*;
 pub use error::*;
 pub use id::*;
+pub use video::*;
 
 pub(crate) use consume::*;
 pub(crate) use origin::*;

rs/libmoq/src/lib.rs

@@ -1,13 +1,14 @@
 use std::sync::{LazyLock, Mutex, MutexGuard};
 
-use crate::{Consume, Origin, Publish, Session, audio::Audio};
+use crate::{Consume, Origin, Publish, Session, audio::Audio, video::Video};
 
 pub struct State {
 	pub session: Session,
 	pub origin: Origin,
 	pub publish: Publish,
 	pub consume: Consume,
 	pub audio: Audio,
+	pub video: Video,
 }
 
 impl State {
@@ -18,6 +19,7 @@ impl State {
 			publish: Publish::default(),
 			consume: Consume::default(),
 			audio: Audio::default(),
+			video: Video::default(),
 		}
 	}