@camstack/addon-pipeline 1.2.100 → 1.2.101

package/dist/stream-broker/index.js

@@ -4,6 +4,7 @@ Object.defineProperties(exports, {
 });
 const require_dist = require("../dist-dm3t4BOt.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
+const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_dist.__toESM(node_crypto, 1);
 let node_child_process = require("node:child_process");
@@ -117,8 +118,9 @@ function createClientLogIngest(onEntries) {
 */
 /**
 * Last-observed runtime probe (present only after the stream was pulled once).
-* Zod-backed because it is persisted durably (per-broker) so the field stays
-* populated across a hub restart — the schema is the single source of truth.
+* Zod-backed because it is persisted durably (ONE ROW per broker in
+* `stream-broker:probe-snapshots`) so the field stays populated across a hub
+* restart — the schema is the single source of truth, applied per row.
 */
 var ProbedSnapshotSchema = require_dist.object({
 	/** Detected video codec — preferred over the declared one when present. */
@@ -134,8 +136,7 @@ var ProbedSnapshotSchema = require_dist.object({
 	/** Epoch ms the snapshot was captured. */
 	at: require_dist.number()
 });
-/** Durable map keyed by `brokerIdFor(deviceId, camStreamId)`. */
-var ProbedSnapshotMapSchema = require_dist.record(require_dist.string(), ProbedSnapshotSchema);
+require_dist.record(require_dist.string(), ProbedSnapshotSchema);
 var SEP = " · ";
 function formatCodec(codec) {
 	const lower = codec.toLowerCase();
@@ -184,6 +185,208 @@ function formatProbedSummary(declared, snapshot, opts) {
 	return parts.join(SEP);
 }
 //#endregion
+//#region src/stream-broker/broker-row-stores.ts
+/**
+* The stream-broker's flattened settings maps — one row per entry.
+*
+* ## What this replaced
+*
+* `stream-broker:addon-settings` / `root` was 33 155 bytes on the reference
+* hub, and three keys were 32 735 of it: `probeSnapshots` (17 282 B, 109
+* streams), `rtspTokens` (13 147 B, 243 streams) and `profileMap` (2 306 B, 29
+* cameras — a per-DEVICE map, so it grows with the fleet). Every read of that
+* row parsed all of it, including `BaseAddon.resolveConfig`, and every write
+* rewrote all of it — a probe flush every few seconds while streams are live.
+*
+* Two keys deliberately STAY blob keys on that row, and the reasons are not
+* "they are small":
+*
+*   - `rtspEnabled` — brokerId → boolean, EMPTY on the reference hub. Its
+*     persister replaces the whole map from the set of registered restreamers,
+*     and reproducing that on rows means an authoritative prune. A prune driven
+*     by a map that shrinks whenever a broker unregisters is exactly the shape
+*     that turns an unbind into a wipe (D130, D49), and the twin key
+*     `rtspTokens` carries a comment about precisely that loss. Nothing is
+*     bought by moving 0 bytes at that risk.
+*   - `deviceOverrides` — 354 B, two cameras, same replace-the-whole-map
+*     persister, written only when an operator edits an override.
+*
+* The row survives either way: it is also where `BaseAddon.resolveConfig` reads
+* the operator's config fields from. The problem was a 33 KB row, not a blob.
+*/
+/**
+* The addon id — the settings-store namespace whose `root` row the flattened
+* keys are being retired from. Matches `packages/addon-pipeline/package.json`
+* (`camstack.addons[].id`).
+*/
+var STREAM_BROKER_ADDON_ID = "stream-broker";
+/**
+* Every one of these collections is keyed by the BROKER ID
+* (`<deviceId>/<camStreamId>`) or by the numeric deviceId. `brokerDeviceId`
+* recovers the numeric device from either, for the projected column that makes
+* a per-camera question an indexed query — and for `tags: { deviceId }` on
+* every line these stores log.
+*
+* Returns `null` rather than guessing: a key whose head is not a number is a
+* key this addon did not write, and inventing a device for it would put a row
+* on a camera at random.
+*/
+function brokerDeviceId(key) {
+	const head = key.includes("/") ? key.slice(0, key.indexOf("/")) : key;
+	const id = Number(head);
+	return Number.isInteger(id) && id > 0 ? id : null;
+}
+/**
+* Bound for a whole-map read. `settings-store.query` silently caps an unbounded
+* read at 2 000 rows and answers as if that were everything; at 974 devices ×
+* up to 5 streams the default is HALF the margin, so every read here names its
+* own ceiling and a truncation is reported rather than shrunk.
+*/
+var BROKER_ROWS_LIMIT = 2e4;
+/**
+* @durable class=mirror owner=stream-broker
+*   write="one row per broker (`<deviceId>/<camStreamId>`), replaced wholesale from the
+*     manager's live probe map by the throttled metrics flush and once on shutdown"
+*   retention="the flush is authoritative: a broker the manager no longer holds loses its
+*     row. Losing the whole collection costs the settings 'Probed' field showing 'not yet
+*     probed' until the stream is pulled again — it is re-derived from the next probe."
+*/
+var BROKER_PROBE_SNAPSHOTS_COLLECTION = "stream-broker:probe-snapshots";
+var BROKER_PROBE_SNAPSHOTS_SPEC = {
+	collection: BROKER_PROBE_SNAPSHOTS_COLLECTION,
+	schema: ProbedSnapshotSchema,
+	columns: [{
+		name: "deviceId",
+		type: "INTEGER"
+	}, {
+		name: "at",
+		type: "INTEGER",
+		notNull: true
+	}],
+	indexes: [{
+		name: "idx_stream_broker_probe_device",
+		columns: ["deviceId"]
+	}],
+	project: (key, value) => ({
+		deviceId: brokerDeviceId(key),
+		at: value.at
+	}),
+	deviceIdColumn: "deviceId",
+	loadLimit: BROKER_ROWS_LIMIT
+};
+function probeSnapshotsStore(store, logger) {
+	return new require_retire_root_keys.RowMapStore({
+		spec: BROKER_PROBE_SNAPSHOTS_SPEC,
+		store,
+		logger
+	});
+}
+/**
+* The token, wrapped in an object rather than stored bare.
+*
+* A bare string in a `JSON` column round-trips only because the engine's
+* decoder JSON-parses a stored string ONLY when it starts with `{` or `[`. That
+* is a heuristic, not a contract; a token is opaque hex today and a future
+* format that starts with a brace would come back as an object. One field costs
+* nothing and makes the row self-describing.
+*/
+var RtspTokenRowSchema = require_dist.object({ token: require_dist.string().min(1) });
+/**
+* @durable class=ledger owner=stream-broker
+*   write="one row per broker (`<deviceId>/<camStreamId>`), upserted when the restream
+*     server mints a token. MERGE only — a token is stable forever per stream unless it
+*     is explicitly regenerated"
+*   retention="nothing deletes a row. The persister receives only the CURRENTLY registered
+*     restreamers, so a replace would erase the token of an unregistered broker and turn
+*     an external NVR URL into a dead 404 at the next idle or reboot."
+*/
+var BROKER_RTSP_TOKENS_COLLECTION = "stream-broker:rtsp-tokens";
+var BROKER_RTSP_TOKENS_SPEC = {
+	collection: BROKER_RTSP_TOKENS_COLLECTION,
+	schema: RtspTokenRowSchema,
+	columns: [{
+		name: "deviceId",
+		type: "INTEGER"
+	}],
+	indexes: [{
+		name: "idx_stream_broker_rtsp_tokens_device",
+		columns: ["deviceId"]
+	}],
+	project: (key) => ({ deviceId: brokerDeviceId(key) }),
+	deviceIdColumn: "deviceId",
+	loadLimit: BROKER_ROWS_LIMIT
+};
+function rtspTokensStore(store, logger) {
+	return new require_retire_root_keys.RowMapStore({
+		spec: BROKER_RTSP_TOKENS_SPEC,
+		store,
+		logger
+	});
+}
+/** One camera's profile → camStreamId assignment, plus whether it is automatic. */
+var ProfileAssignmentSchema = require_dist.object({
+	map: require_dist.record(require_dist.string(), require_dist.string()),
+	auto: require_dist.boolean()
+});
+/**
+* @durable class=config owner=stream-broker
+*   write="one row per camera, replaced wholesale from the manager's assignment map on
+*     every profile mutation — the map is authoritative and its boot pass PRUNES cameras
+*     the device registry no longer knows, which is why the write is a replace and not
+*     an upsert"
+*   retention="the replace is the retention: a camera dropped from the manager's map loses
+*     its row. Losing a row costs one automatic re-assignment on the next catalog pull."
+*/
+var BROKER_PROFILE_MAP_COLLECTION = "stream-broker:profile-map";
+var BROKER_PROFILE_MAP_SPEC = {
+	collection: BROKER_PROFILE_MAP_COLLECTION,
+	schema: ProfileAssignmentSchema,
+	columns: [{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	}, {
+		name: "auto",
+		type: "BOOLEAN",
+		notNull: true
+	}],
+	project: (key, value) => ({
+		deviceId: Number(key),
+		auto: value.auto
+	}),
+	deviceIdColumn: "deviceId",
+	loadLimit: BROKER_ROWS_LIMIT
+};
+function profileMapStore(store, logger) {
+	return new require_retire_root_keys.RowMapStore({
+		spec: BROKER_PROFILE_MAP_SPEC,
+		store,
+		logger
+	});
+}
+/**
+* The dead `addon-settings` / `root` keys. A CLAIM that each key is dead,
+* enforced by nothing else — the migration script names the same three, keep
+* the two in lockstep.
+*/
+var STREAM_BROKER_RETIRED_ROOT_KEYS = [
+	{
+		key: "probeSnapshots",
+		successor: BROKER_PROBE_SNAPSHOTS_COLLECTION,
+		reason: "one row per broker since the flatten; as a blob it was 17 KB of the 33 KB root row, rewritten whole by the throttled metrics flush"
+	},
+	{
+		key: "rtspTokens",
+		successor: BROKER_RTSP_TOKENS_COLLECTION,
+		reason: "one row per broker since the flatten; as a blob a single minted token rewrote 33 KB"
+	},
+	{
+		key: "profileMap",
+		successor: BROKER_PROFILE_MAP_COLLECTION,
+		reason: "one row per camera since the flatten; a per-DEVICE map, so as a blob it grew with the fleet — 2.3 KB at 29 cameras, ~77 KB at 974"
+	}
+];
+//#endregion
 //#region src/stream-broker/battery-wake-on-play.ts
 /**
 * Wake-on-play — pressing play on a sleeping battery camera wakes it, and the
@@ -14195,15 +14398,18 @@ function readDeclaredAudioEnabled(v) {
 /** Whole-blob schema for the persisted `deviceOverrides` store key:
 *  numeric-string deviceId → DeviceOverride (includes `derivedStreams`). */
 var DeviceOverridesMapSchema = require_dist.record(require_dist.string(), DeviceOverrideSchema);
-/** Persisted store-key schemas for the broker's other durable blobs.
-*  `rtspTokens`: camStreamKey → token hex. `rtspEnabled`: brokerId →
-*  enabled. `profileMap`: numeric-string deviceId → {map, auto}. */
-var RtspTokensSchema = require_dist.record(require_dist.string(), require_dist.string());
+/**
+* The one persisted store KEY the broker still keeps as a blob: `rtspEnabled`,
+* brokerId → enabled.
+*
+* `rtspTokens` and `profileMap` moved to their own collections in the
+* 2026-08-19 flatten and their whole-blob schemas are gone with them — the row
+* shapes live in `broker-row-stores.ts`. `rtspEnabled` stayed, and why is
+* argued in that file's header: its persister replaces the map from the set of
+* CURRENTLY registered restreamers, and reproducing that on rows would mean a
+* prune driven by a map that shrinks on every unregister.
+*/
 var RtspEnabledSchema = require_dist.record(require_dist.string(), require_dist.boolean());
-var ProfileMapSchema = require_dist.record(require_dist.string(), require_dist.object({
-	map: require_dist.record(require_dist.string(), require_dist.string()),
-	auto: require_dist.boolean()
-}));
 var PUSH_KINDS = new Set(["push-annexb"]);
 /** Walk a profile map and return the slot that points at `camStreamId`, or null. */
 function findProfileForStream(map, camStreamId) {
@@ -34952,14 +35158,16 @@ var EventLoopStallMonitor = class {
 //#endregion
 //#region src/stream-broker/addon.ts
 /**
-* Hydrate the persisted RTSP restream state (`rtspTokens` / `rtspEnabled`)
-* through the durable `state()` handles — the sanctioned settings accessor —
-* instead of a raw `readAddonStore()`. Same store keys, same persisted
-* shapes; a corrupt blob falls back to empty (durable-state semantics) and
-* absent keys keep first-boot silence (no loader call, no log).
+* Hydrate the persisted RTSP restream state. Tokens come from their own
+* collection (one row per broker); `rtspEnabled` is still a key of the settings
+* row. An unparseable token row is skipped by the store — one dead token, not
+* every token — and an empty set keeps first-boot silence (no loader call, no
+* log).
 */
 async function hydratePersistedRtspState(deps) {
-	const tokens = new Map(Object.entries(await deps.tokensState.get()));
+	const rows = await deps.tokensStore.readAll();
+	const tokens = /* @__PURE__ */ new Map();
+	for (const [brokerId, row] of rows) tokens.set(brokerId, row.token);
 	if (tokens.size > 0) {
 		deps.loadTokens(tokens);
 		deps.logger.info("Loaded persisted RTSP tokens", { meta: { tokenCount: tokens.size } });
@@ -35061,7 +35269,7 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 	/** Durable per-stream probe map (powers the settings "Probed" field across
 	*  restarts). Loaded on activate, flushed throttled from the metrics loop and
 	*  once on shutdown. */
-	probeSnapshotsState = null;
+	probeSnapshots = null;
 	lastProbePersistAt = 0;
 	constructor() {
 		super({
@@ -35137,13 +35345,15 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		const localNodeId = localNode ? localNode.includes("/") ? localNode.split("/")[0] : localNode : void 0;
 		this.brokerManager.setApiAccess(this.ctx.api, localNodeId, this.ctx.kernel.hwaccel);
 		await this.loadFfmpegConfig();
+		await this.declareRowCollections();
+		await this.purgeFlattenedSettingsKeys();
 		const rtspProvider = this.brokerManager.getRtspRestreamProvider();
 		const brokerManager = this.brokerManager;
-		const rtspTokensState = this.state("rtspTokens", RtspTokensSchema, {});
+		const rtspTokens = rtspTokensStore(this.ctx.api.settingsStore, this.ctx.logger);
 		const rtspEnabledState = this.state("rtspEnabled", RtspEnabledSchema, {});
 		try {
 			await hydratePersistedRtspState({
-				tokensState: rtspTokensState,
+				tokensStore: rtspTokens,
 				enabledState: rtspEnabledState,
 				loadTokens: (tokens) => brokerManager.loadPersistedTokens(tokens),
 				loadEnabled: (states) => rtspProvider.loadPersistedEnabled(states),
@@ -35152,11 +35362,7 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		} catch {}
 		rtspProvider.setTokenPersister(async (tokens) => {
 			try {
-				await rtspTokensState.update((prev) => {
-					const merged = { ...prev };
-					for (const [k, v] of tokens) merged[k] = v;
-					return merged;
-				});
+				for (const [brokerId, token] of tokens) await rtspTokens.write(brokerId, { token });
 				this.ctx.logger.info("Persisted RTSP tokens", { meta: { current: tokens.size } });
 			} catch (err) {
 				this.ctx.logger.warn("Failed to persist RTSP tokens", { meta: { error: require_dist.errMsg(err) } });
@@ -35189,22 +35395,22 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 				this.ctx.logger.warn("Failed to persist device overrides", { meta: { error: require_dist.errMsg(err) } });
 			});
 		});
-		const profileMapState = this.state("profileMap", ProfileMapSchema, {});
+		const profileMap = profileMapStore(this.ctx.api.settingsStore, this.ctx.logger);
 		const profileMapPersister = (assignments) => {
-			const obj = {};
-			for (const [deviceId, assignment] of assignments) obj[`${deviceId}`] = {
+			const next = /* @__PURE__ */ new Map();
+			for (const [deviceId, assignment] of assignments) next.set(`${deviceId}`, {
 				map: { ...assignment.map },
 				auto: assignment.auto
-			};
-			profileMapState.set(obj).catch((err) => {
+			});
+			profileMap.replaceAll(next).catch((err) => {
 				this.ctx.logger.warn("Failed to persist profile map", { meta: { error: require_dist.errMsg(err) } });
 			});
 		};
 		this.brokerManager.setProfileMapPersister(profileMapPersister);
 		try {
-			const obj = await profileMapState.get();
+			const rows = await profileMap.readAll();
 			const loaded = /* @__PURE__ */ new Map();
-			for (const [rawKey, val] of Object.entries(obj)) {
+			for (const [rawKey, val] of rows) {
 				const deviceId = Number(rawKey);
 				if (!Number.isInteger(deviceId)) continue;
 				const map = {};
@@ -35222,12 +35428,13 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load profile map", { meta: { error: require_dist.errMsg(err) } });
 		}
-		const probeSnapshotsState = this.state("probeSnapshots", ProbedSnapshotMapSchema, {});
-		this.probeSnapshotsState = probeSnapshotsState;
+		const probeSnapshots = probeSnapshotsStore(this.ctx.api.settingsStore, this.ctx.logger);
+		this.probeSnapshots = probeSnapshots;
 		try {
-			const blob = await probeSnapshotsState.get();
+			const rows = await probeSnapshots.readAll();
+			const blob = Object.fromEntries(rows);
 			this.brokerManager.loadProbeSnapshots(blob);
-			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: Object.keys(blob).length } });
+			this.ctx.logger.info("Loaded persisted probe snapshots", { meta: { streamCount: rows.size } });
 		} catch (err) {
 			this.ctx.logger.warn("Failed to load probe snapshots", { meta: { error: require_dist.errMsg(err) } });
 		}
@@ -35584,17 +35791,54 @@ var StreamBrokerAddon = class extends require_dist.BaseAddon {
 		this.flushProbeSnapshots(timestamp, false);
 	}
 	/**
+	* Declare the three row collections that replaced the `probeSnapshots`,
+	* `rtspTokens` and `profileMap` blob keys. Idempotent — a re-declaration of
+	* the same shape is a no-op in the engine.
+	*
+	* Not swallowed: a broker whose `stream-broker:rtsp-tokens` is undeclared
+	* mints a new token for every stream and every external NVR URL in the
+	* installation goes dead. Crashing loudly is bounded by `CrashSupervisor`
+	* (D6); silently reissuing tokens is not.
+	*/
+	async declareRowCollections() {
+		const store = this.ctx.api.settingsStore;
+		const logger = this.ctx.logger;
+		await probeSnapshotsStore(store, logger).declare();
+		await rtspTokensStore(store, logger).declare();
+		await profileMapStore(store, logger).declare();
+	}
+	/**
+	* Drop the flattened keys from `stream-broker:addon-settings` / `root`, each
+	* gated on its own successor collection being non-empty. `rtspEnabled` and
+	* `deviceOverrides` stay — see `broker-row-stores.ts` for why.
+	*
+	* Best-effort: a purge that throws must not take the broker down. The keys
+	* are dead weight, not a fault.
+	*/
+	async purgeFlattenedSettingsKeys() {
+		try {
+			await require_retire_root_keys.retireRootKeys({
+				store: this.ctx.api.settingsStore,
+				addonId: STREAM_BROKER_ADDON_ID,
+				logger: this.ctx.logger,
+				specs: STREAM_BROKER_RETIRED_ROOT_KEYS
+			});
+		} catch (err) {
+			this.ctx.logger.warn("stream-broker: retiring the flattened settings keys failed", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
+	/**
 	* Persist the manager's probe map to the durable handle. Throttled to
 	* PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS (or `force` on shutdown) so a busy
 	* streaming fleet doesn't drive a write per metrics tick.
 	*/
 	flushProbeSnapshots(now, force) {
-		const state = this.probeSnapshotsState;
+		const store = this.probeSnapshots;
 		const manager = this.brokerManager;
-		if (!state || !manager) return;
+		if (!store || !manager) return;
 		if (!force && now - this.lastProbePersistAt < PROBE_SNAPSHOTS_PERSIST_INTERVAL_MS) return;
 		this.lastProbePersistAt = now;
-		state.set(manager.getProbeSnapshots()).catch((err) => {
+		store.replaceAll(new Map(Object.entries(manager.getProbeSnapshots()))).catch((err) => {
 			this.ctx.logger.warn("Failed to persist probe snapshots", { meta: { error: require_dist.errMsg(err) } });
 		});
 	}