graph LR
    A[会议服务器<br/>SFU/MCU] -->|WHIP Client| B[旁路网关<br/>Media Gateway]
    B -->|WHIP| C[转推集群<br/>Restream Cluster]
    B -->|WHIP| D[录制集群<br/>Recorder Cluster]
    C -->|RTMP/SRT| E[直播平台<br/>CDN]
    D -->|MP4/FLV| F[对象存储<br/>S3/MinIO]
    G[播放端] -->|WHEP| B

Client (Publisher)          Server (Ingest)
     |                          |
     |---- POST /whip (Offer) -->|
     |<--- 201 Created (Answer) -|
     |                          |
     |---- PATCH /whip/{id} (ICE Candidate) -->|
     |<--- 200 OK -----------------------------|

POST /whip HTTP/1.1
Content-Type: application/sdp
X-WhiP-Extension: recording=true; restream=dy,ks,bili; watermark=logo.png; metadata={"meeting_id":"m_123","speaker":"user_456"}

a=extmap:10 urn:ietf:params:rtp-hdrext:ssrc-audio-level
a=extmap:11 http://example.com/ext/meeting-metadata
a=fmtp:11 meeting_id=m_123;speaker=user_456;timestamp=1704067200

// pkg/gateway/whip_handler.go
func (h *WHIPHandler) HandleIngest(w http.ResponseWriter, r *http.Request) {
    // 1. 解析 Offer SDP
    offer := webrtc.SessionDescription{
        Type: webrtc.SDPTypeOffer,
        SDP:  parseSDP(r.Body),
    }

    // 2. 创建 PeerConnection（复用 ICE 服务器配置）
    pc, err := h.createPeerConnection(r.Context())
    if err != nil { h.respondError(w, err); return }

    // 3. 解析扩展字段 → 决定下游分发策略
    ext := parseExtensionHeaders(r.Header)
    downstream := h.buildDownstreamPlan(ext) // {recorders: [], restreams: []}

    // 4. 设置 OnTrack 回调：将 Track 扇出到下游
    pc.OnTrack(func(track *webrtc.TrackRemote, receiver *webrtc.RTPReceiver) {
        for _, dst := range downstream.recorders {
            dst.AddTrack(track) // 录制集群
        }
        for _, dst := range downstream.restreams {
            dst.AddTrack(track) // 转推集群
        }
    })

    // 5. 完成协商，返回 Answer
    answer, err := pc.SetRemoteDescription(offer)
    if err != nil { h.respondError(w, err); return }

    // 6. 写入响应头携带会话 ID，便于后续 PATCH ICE
    w.Header().Set("Location", fmt.Sprintf("/whip/%s", pc.ID()))
    w.WriteHeader(http.StatusCreated)
    w.Write([]byte(answer.SDP))
}

Viewer (Subscriber)         Server (Egress)
     |                          |
     |---- POST /whep (Offer) -->|
     |<--- 201 Created (Answer) -|
     |                          |
     |---- PATCH /whep/{id} (ICE Candidate) -->|

POST /whep/playback HTTP/1.1
Content-Type: application/sdp
X-WHEP-Session-Type: playback
X-WHEP-Recording-ID: rec_abc123
X-WHEP-Start-Time: 1704067200
X-WHEP-End-Time:   1704070800

// static/js/whep-player.js
class WHEPPlayer {
  constructor(videoEl, endpoint) {
    this.video = videoEl;
    this.endpoint = endpoint;
    this.pc = new RTCPeerConnection({ iceServers: [] });
    this.pc.ontrack = (e) => { this.video.srcObject = e.streams[0]; };
  }

  async play(sessionId = 'live') {
    const offer = await this.pc.createOffer();
    await this.pc.setLocalDescription(offer);

    const resp = await fetch(`${this.endpoint}/whep/${sessionId}`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/sdp' },
      body: offer.sdp
    });
    const answerSDP = await resp.text();
    await this.pc.setRemoteDescription({ type: 'answer', sdp: answerSDP });

    // Trickle ICE 候选
    this.pc.onicecandidate = (e) => {
      if (e.candidate) {
        fetch(`${this.endpoint}/whep/${sessionId}`, {
          method: 'PATCH',
          headers: { 'Content-Type': 'application/trickle-ice-sdpfrag' },
          body: e.candidate.toJSON().candidate
        });
      }
    };
  }
}

// 使用
new WHEPPlayer(document.getElementById('video'), 'https://gateway.example.com').play('meeting_m_123');

# config/restream_profiles.yaml
platforms:
  douyin:
    url_template: "rtmp://push.douyin.com/live/{stream_key}"
    vcodec: libx264
    acodec: aac
    preset: veryfast
    maxrate: 3000k
    bufsize: 6000k
    vf: "drawtext=fontfile=/fonts/msyh.ttc:text='%{metadata\:meeting_id}':x=10:y=10:fontsize=24:fontcolor=white@0.8"
  youtube:
    url_template: "rtmp://a.rtmp.youtube.com/live2/{stream_key}"
    vcodec: libx264
    acodec: aac
    preset: fast
    maxrate: 4500k

# scheduler/restream_dispatcher.py
class RestreamDispatcher:
    def assign(self, session_id: str, tracks: List[TrackInfo], targets: List[str]):
        for platform in targets:
            profile = PROFILES[platform]
            cmd = self.build_ffmpeg_cmd(profile, tracks, session_id)
            # 通过 Kubernetes Job / Nomad 启动转推任务
            self.orchestrator.launch(f"restream-{session_id}-{platform}", cmd)

gst-launch-1.0 -e 
  webrtcsrc name=src signaling-server=wss://gateway.example.com/whip/rec_abc123 
  ! application/x-rtp,media=video,encoding-name=H264 
  ! rtph264depay ! h264parse ! mp4mux fragment-duration=300000000 
  ! filesink location=/data/recordings/rec_abc123_%05d.mp4

# docker-compose.gateway.yml
services:
  whip-gateway:
    image: registry.example.com/whip-gateway:v1.4.2
    deploy:
      replicas: 6
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
    environment:
      - ICE_SERVERS=[{"urls":["stun:stun.example.com:3478"]},{"urls":["turn:turn.example.com:3478"],"username":"user","credential":"pass"}]
      - LOG_LEVEL=info
      - METRICS_PORT=9090
    ports:
      - "8080:8080"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/healthz"]
      interval: 10s
      timeout: 3s
      retries: 3

// mediasoup/worker/src/WhipProducer.cpp
class WhipProducer : public Producer {
public:
    WhipProducer(const json& whipConfig, const json& extensionParams)
        : whipConfig_(whipConfig), extParams_(extensionParams) {}

    void Start() override {
        // 1. 构建本地 SDP Offer（基于当前 Router 的 RTP Capabilities）
        auto offer = CreateLocalOffer();

        // 2. 注入业务扩展字段到 SDP 属性行
        InjectExtensionAttributes(offer, extParams_); // meeting_id, watermark, restream_targets

        // 3. 发起 HTTP POST 到旁路网关 /whip
        httpClient_.PostAsync(whipConfig_["endpoint"], offer, [this](auto resp) {
            if (resp.status == 201) {
                ParseAnswerAndSetupICE(resp.body);
                StartTrickleICE(); // 后续 Candidate 通过 PATCH 发送
                OnConnected();     // 触发 SFU 内部 onproducerready
            } else {
                HandleFailure(resp);
            }
        });
    }

private:
    void InjectExtensionAttributes(std::string& sdp, const json& ext) {
        // a=extmap-allow-mixed
        // a=fmtp:<pt> meeting_id=...;watermark=...;restream=dy,ks
        std::string attrs = fmt::format(
            "a=fmtp:{} meeting_id={};watermark={};restream={}rn",
            videoPt_, ext["meeting_id"], ext["watermark"], ext["restream_targets"]
        );
        InsertBeforeMediaSection(sdp, attrs);
    }
};

// pkg/egress/whip_sink.go
type WHIPSink struct {
    pc       *webrtc.PeerConnection
    tracks   map[uint32]*webrtc.TrackLocalStaticRTP
    config   *WHIPConfig
}

func NewWHIPSink(ctx context.Context, cfg *WHIPConfig) (*WHIPSink, error) {
    // 1. 复用 LiveKit 内部 ICE 配置（含 TURN 凭证）
    pc, err := webrtc.NewPeerConnection(webrtc.Configuration{
        ICEServers: cfg.ICEServers,
    })
    // 2. 预创建 TrackLocal，绑定到 LiveKit 的 TrackID
    for _, ti := range cfg.TrackInfos {
        track, _ := webrtc.NewTrackLocalStaticRTP(ti.Codec.RTPCodecCapability, ti.Name, ti.StreamID)
        pc.AddTrack(track)
        s.tracks[ti.SSRC] = track
    }
    // 3. 发起 WHIP 协商
    offer, _ := pc.CreateOffer(nil)
    pc.SetLocalDescription(offer)
    ans, err := s.doWHIPRequest(ctx, "POST", cfg.Endpoint, offer.SDP)
    pc.SetRemoteDescription(webrtc.SessionDescription{Type: webrtc.SDPTypeAnswer, SDP: ans})
    return s, nil
}

func (s *WHIPSink) WriteRTP(pkt *rtp.Packet) error {
    if track, ok := s.tracks[pkt.SSRC]; ok {
        return track.WriteRTP(pkt) // 直接写入，Pion 内部完成加密+发送
    }
    return nil
}

sequenceDiagram
    participant Client
    participant OldPod
    participant Redis
    participant NewPod
    Client->>OldPod: PATCH /whip/{id} (ICE Candidate)
    Note over OldPod: 收到 SIGTERM / 健康检查失败
    OldPod->>Redis: DEL session:{id}:owner (释放锁)
    Client->>NewPod: PATCH /whip/{id} (ICE Candidate + ?migrate=true)
    NewPod->>Redis: GET session:{id}:candidates (补全历史 Candidate)
    NewPod->>Client: 200 OK (复用原有 DTLS 密钥材料)
    Note right of Client: DTLS 密钥不变，媒体流无感切换

// 旧 Pod 导出
state := pc.Export() // 包含 DTLS 飞行记录、加密参数
redis.Set(ctx, "session:"+id+":dtls", state, 5*time.Minute)

// 新 Pod 导入
state, _ := redis.Get(ctx, "session:"+id+":dtls").Bytes()
pc, _ := webrtc.NewPeerConnection(cfg)
pc.Import(state) // 恢复加密上下文，避免重新握手导致 1-2s 黑屏

graph LR
    A[WHIP Input<br/>H.264/VP8] --> B[解码器<br/>NVDEC/QSV]
    B --> C[滤镜链<br/>水印/Logo/时钟]
    C --> D[编码器池<br/>H.264 Main/High<br/>H.265 Main<br/>AV1]
    D --> E[封装分发器]
    E --> F[RTMP: 抖音]
    E --> G[RTMP: YouTube]
    E --> H[SRT: 备播中心]
    E --> I[MP4: 录制分片]

ffmpeg -hwaccel cuda -hwaccel_output_format cuda 
  -i "whip://gateway.example.com/whip/session_123" 
  -filter_complex 
  "[0:v]split=3[v1][v2][v3]; 
   [v1]scale_cuda=1920:1080,drawtext=...[out_hd]; 
   [v2]scale_cuda=1280:720[out_sd]; 
   [v3]scale_cuda=640:360[out_ld]" 
  -map "[out_hd]" -c:v h264_nvenc -b:v 3000k -f flv "rtmp://push.douyin.com/live/key1" 
  -map "[out_sd]" -c:v h264_nvenc -b:v 1500k -f flv "rtmp://a.rtmp.youtube.com/live2/key2" 
  -map "[out_ld]" -c:v h264_nvenc -b:v 800k  -f mp4  "pipe:1" | recorder_stdin_writer

# s3_lifecycle_policy.json
{
  "Rules": [
    {
      "ID": "RecordingLifecycle",
      "Status": "Enabled",
      "Filter": {"Prefix": "recordings/"},
      "Transitions": [
        {"Days": 1, "StorageClass": "STANDARD_IA"},   # 1天后转低频
        {"Days": 30, "StorageClass": "GLACIER_IR"},    # 30天转归档即时检索
        {"Days": 365, "StorageClass": "DEEP_ARCHIVE"}  # 1年转深度归档
      ],
      "Expiration": {"Days": 2555} # 7年合规保留后自动删除
    }
  ]
}

graph TD
    A[录制完成事件<br/>Kafka: recording.finished] --> B[任务编排器]
    B --> C[预处理: 关键帧提取/音频分离]
    C --> D1[ASR 语音识别<br/>Whisper/FunASR]
    C --> D2[视觉理解<br/>关键帧分类/人脸检测/屏幕内容OCR]
    C --> D3[合规审核<br/>涉政/涉黄/暴力/敏感词]
    D1 & D2 & D3 --> E[多模态融合<br/>生成会议纪要/章节标记/发言人时间轴]
    E --> F[结构化入库<br/>ES/ClickHouse/VectorDB]
    F --> G[业务侧消费<br/>智能回放/知识库检索/风控预警]

// 前端：基于章节标记的智能进度条
interface ChapterMarker {
  start: number;      // 秒
  end: number;
  title: string;      // "项目进度汇报"
  speaker: string;    // "张三"
  keywords: string[]; // ["Q3", "预算", "风险"]
  summary: string;    // LLM 生成的一句话摘要
}

// 播放器 Seek 逻辑
player.on('seeked', (time) => {
  const chapter = chapters.find(c => c.start <= time && time < c.end);
  if (chapter) showTooltip(chapter.summary, chapter.keywords);
});

# Terraform: 租户专属旁路网关部署单元
module "tenant_gateway" {
  source  = "./modules/whip-gateway"
  tenant_id = "tenant_acme_corp"
  
  # 专属 VPC 子网，物理隔离
  vpc_id          = "vpc-tenant-acme"
  subnet_ids      = ["subnet-az1", "subnet-az2"]
  security_groups = ["sg-whip-gateway-tenant-acme"] # 仅允许租户 SFU CIDR 入站
  
  # 专属 TURN 服务器池
  turn_servers = [
    "turn:turn-tenant-acme-1.internal:3478",
    "turn:turn-tenant-acme-2.internal:3478"
  ]
  
  # 专属录制存储桶 (KMS 密钥隔离)
  recording_bucket = "s3://acme-recordings-prod"
  kms_key_arn      = "arn:aws:kms:...:key/acme-dedicated"
}

# /etc/sysctl.d/99-whip-gateway.conf
# UDP 缓冲区扩大（防丢包）
net.core.rmem_max = 67108864
net.core.wmem_max = 67108864
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192

# 连接跟踪表扩大（高并发 NAT 场景）
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 120

# TIME_WAIT 复用（高频短连接场景）
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# 文件句柄
fs.file-max = 2097152
fs.nr_open = 1048576

// Go 运行时调优 (main.go 早期初始化)
debug.SetGCPercent(50)        // 降低 GC 触发阈值，减少延迟抖动
debug.SetMemoryLimit(28 * 1024 * 1024 * 1024) // 容器限制 32G，预留 4G 给 OS
runtime.GOMAXPROCS(7)         // 留 1 核给网络中断/GC 标记

// pkg/media/buffer_pool.go
var rtpPacketPool = sync.Pool{
    New: func() interface{} {
        // 预分配 1500 字节缓冲区，避免频繁 make
        return &rtp.Packet{Header: rtp.Header{}, Payload: make([]byte, 1500)}
    },
}

func (s *WHIPSession) readLoop() {
    for {
        pkt := rtpPacketPool.Get().(*rtp.Packet)
        n, _, err := s.conn.ReadFrom(pkt.Payload)
        if err != nil { rtpPacketPool.Put(pkt); break }
        pkt.Payload = pkt.Payload[:n]
        if err := s.pc.WriteRTP(pkt); err != nil { /* handle */ }
        // 重置复用
        pkt.Header = rtp.Header{}
        pkt.Payload = pkt.Payload[:cap(pkt.Payload)]
        rtpPacketPool.Put(pkt)
    }
}

// 结构体标记驱动日志脱敏/导出过滤
type MeetingMetadata struct {
    MeetingID   string `json:"meeting_id" pii:"none"`
    OrganizerID string `json:"organizer_id" pii:"pseudonymize"` // 日志输出 hash(id)
    ParticipantEmails []string `json:"-" pii:"redact"`          // 完全不序列化
    RecordingConsentMap map[string]bool `json:"consent" pii:"sensitive"`
}

# chaos-network-partition.yaml
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: whip-gateway-partition
spec:
  action: partition
  mode: one
  selector:
    namespaces: ["prod"]
    labelSelectors:
      app: whip-gateway
  direction: both
  target:
    selector:
      namespaces: ["prod"]
      labelSelectors:
        app: sfu-server
  duration: "60s"
  scheduler:
    cron: "@every 1h"

# .github/workflows/compatibility-test.yml
jobs:
  compat-matrix:
    strategy:
      matrix:
        client: [chrome-stable, firefox-stable, safari-tp, electron-28, ffmpeg-6.1, gstreamer-1.22, pion-v3, webrtc-rs-0.12]
        server: [v1.2.x, v1.3.x, v1.4.x]
    steps:
      - name: Run WHIP/WHEP Interop Test Suite
        run: |
          go test -v ./test/interop -client=${{matrix.client}} -server=${{matrix.server}}

# 1. 抓取 WHIP 信令交互 (过滤 HTTP/SDP)
tcpdump -i any -s 0 -w whip.pcap 'tcp port 8080 and (tcp[((tcp[12]>>4)*4)]=0x50 or tcp[((tcp[12]>>4)*4)]=0x48)'

# 2. 分析 RTP 延迟/抖动/丢包 (Wireshark 命令行)
tshark -r media.pcap -Y "rtp" -T fields -e frame.time_relative -e rtp.ssrc -e rtp.seq -e rtp.timestamp -e rtp.marker > rtp.csv

# 3. 检查 ICE 连接状态 (Pion 内置)
curl -s http://localhost:9090/debug/ice | jq '.sessions[] | {id, state, nominated_pair, rtt_ms}'

# 4. FFmpeg 转推进程资源监控
watch -n 1 'nvidia-smi; pidstat -p $(pgrep ffmpeg) -u -r -d 1'

# 5. 录制文件完整性快速校验
ffprobe -v error -show_entries format=duration,size,bit_rate -of csv=p=0 recording_001.mp4

# 6. Go 程序实时 GC/内存分析
go tool pprof -http=:8081 http://localhost:6060/debug/pprof/heap