@camstack/addon-pipeline 1.2.131 → 1.2.132

package/dist/recorder/index.js

@@ -1,7 +1,7 @@
-const require_dist = require("../dist-CqoMNE1e.js");
+const require_dist = require("../dist-DBP47QOz.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
-const require_addon_utils = require("../addon-utils-DCQ5AP_v.js");
+const require_addon_utils = require("../addon-utils-DzCn6z7v.js");
 const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
 let node_crypto = require("node:crypto");
 let node_child_process = require("node:child_process");
@@ -350,8 +350,13 @@ function fragmentRangeFor(index, offsetTicks) {
 * "nothing to read" (D49's letter, applied to a byte budget: a fallible
 * computation must never silently look like an unbind).
 */
-function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
-	const { samples, mfraOffset } = index;
+/**
+* The last sync sample at or before `offsetTicks` — the keyframe a decoder
+* must start from. Shared by {@link fragmentsWithinBudget} and
+* {@link fragmentsInWindow}: both walk forward from the same anchor, they
+* only differ in the condition that stops the walk.
+*/
+function findAnchor(samples, offsetTicks) {
 	let lo = 0;
 	let hi = samples.length - 1;
 	let anchor = 0;
@@ -364,6 +369,11 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 			lo = mid + 1;
 		} else hi = mid - 1;
 	}
+	return anchor;
+}
+function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, offsetTicks);
 	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
 	const anchorStart = samples[anchor]?.moofOffset ?? 0;
 	const anchorEnd = endOf(anchor);
@@ -400,6 +410,70 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 		oversizeFragment
 	};
 }
+/**
+* Convert a TIME WINDOW `[fromTicks, toTicks)` into the set of consecutive
+* fragments that covers it — the replay's primitive for "give me this many
+* seconds of one segment", as opposed to {@link fragmentsWithinBudget}'s
+* "give me as much as fits in N bytes" (the scrub GOP read's primitive).
+*
+* Stops walking forward the instant the NEXT fragment's own start time
+* already reaches `toTicks`: at that point the fragments already collected
+* cover the whole window, because each fragment's coverage runs up to the
+* next one's start (the same relationship {@link fragmentsWithinBudget}'s
+* `endOf` encodes). `maxBytes` is a SAFETY CEILING, not the primary stop
+* condition — a caller with a well-formed window is expected to hit the time
+* condition first; the byte cap exists so a pathological request cannot pull
+* an unbounded amount of one segment into memory.
+*
+* Same never-empty guarantee as {@link fragmentsWithinBudget}: the anchor
+* fragment is always returned, even when it alone exceeds `maxBytes`.
+*/
+function fragmentsInWindow(index, fromTicks, toTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, fromTicks);
+	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
+	const windowCoveredAt = (i) => {
+		const next = samples[i + 1];
+		return next === void 0 || next.timeTicks >= toTicks;
+	};
+	const anchorStart = samples[anchor]?.moofOffset ?? 0;
+	const anchorEnd = endOf(anchor);
+	const fragments = [{
+		start: anchorStart,
+		end: anchorEnd,
+		sampleIndex: anchor
+	}];
+	let total = anchorEnd - anchorStart;
+	const oversizeFragment = total > maxBytes;
+	let i = anchor;
+	let reachesWindowEnd = windowCoveredAt(i);
+	while (!reachesWindowEnd) {
+		const nextIndex = i + 1;
+		const nextSample = samples[nextIndex];
+		if (nextSample === void 0) break;
+		const nextStart = nextSample.moofOffset;
+		const nextEnd = endOf(nextIndex);
+		const nextSize = nextEnd - nextStart;
+		if (total + nextSize > maxBytes) break;
+		fragments.push({
+			start: nextStart,
+			end: nextEnd,
+			sampleIndex: nextIndex
+		});
+		total += nextSize;
+		i = nextIndex;
+		reachesWindowEnd = windowCoveredAt(i);
+	}
+	const last = fragments[fragments.length - 1];
+	return {
+		fragments,
+		start: fragments[0].start,
+		end: last.end,
+		reachesSegmentEnd: last.end >= mfraOffset,
+		reachesWindowEnd,
+		oversizeFragment
+	};
+}
 //#endregion
 //#region src/recorder/mfra-capture.ts
 /**
@@ -4440,6 +4514,34 @@ var SCRUB_GOP_BUDGET_MAX_BYTES = 15e5;
 function ticksToMs(ticks, timescale) {
 	return Math.round(ticks / timescale * 1e3);
 }
+/** ms → ticks on the video timescale — the inverse of {@link ticksToMs}. */
+function msToTicks(ms, timescale) {
+	return ms / 1e3 * timescale;
+}
+/**
+* Steps 1-2 shared by {@link readGopRange} and {@link readGopWindowRange}:
+* locate the `mfra` (seeded or from the tail), read the `ftyp`+`moov` head,
+* and pick the VIDEO track's sync table (never the audio one, which lists
+* every `moof` and would send a seek to bytes that do not open a GOP).
+* `null` on anything that does not look like a recorded segment.
+*/
+async function resolveSegmentIndex(file, seededIndex, read) {
+	const parsed = seededIndex === void 0 ? await parseTail(file, read) : null;
+	if (seededIndex === void 0 && parsed === null) return null;
+	const index = seededIndex ?? parsed.index;
+	const firstMoof = index.samples[0]?.moofOffset ?? 0;
+	if (firstMoof <= 0 || firstMoof >= file.size) return null;
+	const head = await read(0, firstMoof);
+	const init = parseInitInfo(head);
+	if (init === null) return null;
+	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
+	if (videoIndex === null) return null;
+	return {
+		head,
+		init,
+		videoIndex
+	};
+}
 /**
 * Read the single GOP covering `epochMs` from `file`, by byte range.
 *
@@ -4455,17 +4557,10 @@ async function readGopRange(file, args) {
 		bytesRead += chunk.length;
 		return chunk;
 	};
-	const parsed = args.seededIndex === void 0 ? await parseTail(file, read) : null;
-	if (args.seededIndex === void 0 && parsed === null) return null;
-	const index = args.seededIndex ?? parsed.index;
-	const firstMoof = index.samples[0]?.moofOffset ?? 0;
-	if (firstMoof <= 0 || firstMoof >= file.size) return null;
-	const head = await read(0, firstMoof);
-	const init = parseInitInfo(head);
-	if (init === null) return null;
-	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
-	if (videoIndex === null) return null;
-	const offsetTicks = Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale;
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const offsetTicks = msToTicks(Math.max(0, args.epochMs - args.segmentStartMs), init.videoTimescale);
 	let start;
 	let end;
 	let firstSampleIndex;
@@ -4510,6 +4605,49 @@ async function readGopRange(file, args) {
 	};
 }
 /**
+* Read the fragments covering `[fromMs, toMs)` from `file`, by byte range —
+* the WINDOW twin of {@link readGopRange}'s single instant. Same shape, same
+* standalone-demuxable `ftyp`+`moov` head, same `null`-on-unparseable
+* contract; the only difference is the stop condition
+* ({@link fragmentsInWindow} instead of {@link fragmentRangeFor} /
+* {@link fragmentsWithinBudget}).
+*/
+async function readGopWindowRange(file, args) {
+	let bytesRead = 0;
+	const read = async (offset, length) => {
+		const chunk = await file.read(offset, length);
+		bytesRead += chunk.length;
+		return chunk;
+	};
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const fromOffsetMs = Math.max(0, args.fromMs - args.segmentStartMs);
+	const toOffsetMs = Math.max(fromOffsetMs, args.toMs - args.segmentStartMs);
+	const plan = fragmentsInWindow(videoIndex, msToTicks(fromOffsetMs, init.videoTimescale), msToTicks(toOffsetMs, init.videoTimescale), args.maxBytes);
+	const { start, end } = plan;
+	if (start <= 0 || end <= start || end > file.size) return null;
+	const fragment = await read(start, end - start);
+	const firstSampleIndex = plan.fragments[0].sampleIndex;
+	const lastSampleIndex = plan.fragments[plan.fragments.length - 1].sampleIndex;
+	const startTicks = videoIndex.samples[firstSampleIndex]?.timeTicks ?? 0;
+	const nextTicks = videoIndex.samples[lastSampleIndex + 1]?.timeTicks;
+	const gopStartOffsetMs = ticksToMs(startTicks, init.videoTimescale);
+	const gopDurMs = nextTicks !== void 0 ? ticksToMs(nextTicks - startTicks, init.videoTimescale) : Math.max(1, args.segmentDurMs - gopStartOffsetMs);
+	const data = new Uint8Array(head.length + fragment.length);
+	data.set(head, 0);
+	data.set(fragment, head.length);
+	return {
+		data,
+		gopStartMs: args.segmentStartMs + gopStartOffsetMs,
+		gopDurMs,
+		bytesRead,
+		reachesSegmentEnd: plan.reachesSegmentEnd,
+		reachesWindowEnd: plan.reachesWindowEnd,
+		oversizeFragment: plan.oversizeFragment
+	};
+}
+/**
 * Fetch + parse the `mfra` tail, honouring `MfraParseError.needBytes` with ONE
 * widened retry. Null on anything else — bytes that are not a segment.
 */
@@ -4801,6 +4939,16 @@ var RANGE_MERGE_GAP_MS = 5e3;
 * hour but covers the requested epoch is hydrated too. Recorder segments are
 * currently much shorter; the margin keeps this boundary future-safe. */
 var LOCATE_HYDRATE_MARGIN_MS = 6e4;
+/**
+* Safety ceiling for one `readWindowBytes` answer — NOT the primary stop
+* condition (the requested `toMs` is; see `fragmentsInWindow` in
+* `mfra-index.ts`). Sized off `high`'s own bandwidth hint above
+* (`PROFILE_BANDWIDTH.high` = 4 Mbps = 500 000 B/s): a 30 s replay window at
+* that rate is ~15 MB, so 20 MB covers it with headroom while still bounding
+* a pathological request. A window this call actually truncates is reported
+* (`reachesRequestedEnd: false`) rather than silently shortened.
+*/
+var WINDOW_READ_MAX_BYTES = 2e7;
 /** Empty "no playback" manifest. */
 function noPlayback(deviceId) {
 	return {
@@ -5318,6 +5466,76 @@ function buildRecordingProvider(deps) {
 				gopDurMs: seg.durMs
 			};
 		},
+		readWindowBytes: async ({ deviceId, profile, startMs, fromMs, toMs }) => {
+			const { abs, seg } = resolveSegmentFile(deps, deviceId, profile, startMs);
+			const segmentEndMs = seg.startMs + seg.durMs;
+			if (toMs > segmentEndMs) {
+				deps.logger.warn("recording: readWindowBytes refused — window runs past this segment, not silently clipped", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						startMs,
+						fromMs,
+						toMs,
+						segmentEndMs
+					}
+				});
+				return {
+					kind: "spans-multiple-segments",
+					segmentEndMs
+				};
+			}
+			const file = await (deps.openRangeReadable ?? openRangeFromDisk)(abs, seg.bytes);
+			try {
+				const gop = await readGopWindowRange(file, {
+					segmentStartMs: seg.startMs,
+					segmentDurMs: seg.durMs,
+					fromMs,
+					toMs,
+					seededIndex: deps.mfraFor?.(deviceId, profile, startMs),
+					maxBytes: WINDOW_READ_MAX_BYTES
+				});
+				if (gop !== null) {
+					if (gop.reachesWindowEnd !== true) deps.logger.warn("recording: readWindowBytes truncated by its safety byte cap before covering the requested window", {
+						tags: { deviceId },
+						meta: {
+							profile,
+							startMs,
+							fromMs,
+							toMs,
+							bytes: gop.data.length,
+							WINDOW_READ_MAX_BYTES
+						}
+					});
+					return {
+						kind: "ok",
+						data: gop.data,
+						gopStartMs: gop.gopStartMs,
+						gopDurMs: gop.gopDurMs,
+						reachesRequestedEnd: gop.reachesWindowEnd === true
+					};
+				}
+			} finally {
+				await file.close();
+			}
+			deps.logger.warn("recording: readWindowBytes fell back to the WHOLE segment (mfra/moov unparseable)", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					startMs,
+					fromMs,
+					toMs
+				}
+			});
+			const data = await readFile(abs);
+			return {
+				kind: "ok",
+				data: Uint8Array.from(data),
+				gopStartMs: seg.startMs,
+				gopDurMs: seg.durMs,
+				reachesRequestedEnd: true
+			};
+		},
 		setDeviceConfig: async ({ deviceId, config }) => {
 			const saved = await saveDeviceConfig(deps.configStore, deviceId, config);
 			if (deps.onConfigChanged) try {

package/dist/recorder/index.mjs

@@ -1,4 +1,4 @@
-import { B as deriveRecordingMode, Dt as hydrateSchema, F as customAction, Gt as string, Ht as number, L as defineCustomActions, Lt as array, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, Rt as boolean, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-DO0UVhOk.mjs";
+import { B as deriveRecordingMode, Dt as hydrateSchema, F as customAction, Gt as string, Ht as number, L as defineCustomActions, Lt as array, M as batteryCapability, Pt as selectAssignedProfileSlots, R as deriveBatteryPresence, Rt as boolean, St as BaseAddon, T as RecordingConfigSchema, Tt as DeviceType, Ut as object, Wt as record, at as recordingCapability, b as OpsLogEntrySchema, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, ft as storageEvictableCapability, g as ExportRecordSchema, gt as errMsg, i as BatteryStatusSchema, jt as nodePin, m as EVENT_PAD_MS, ot as recordingExportCapability, qt as EventCategory, ut as resolveRecordingProfiles, w as RECORDING_EXPORT_MAX_READ_BYTES, wt as DeviceFeature } from "../dist-BZYUUBUx.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CgBCF-mE.mjs";
@@ -349,8 +349,13 @@ function fragmentRangeFor(index, offsetTicks) {
 * "nothing to read" (D49's letter, applied to a byte budget: a fallible
 * computation must never silently look like an unbind).
 */
-function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
-	const { samples, mfraOffset } = index;
+/**
+* The last sync sample at or before `offsetTicks` — the keyframe a decoder
+* must start from. Shared by {@link fragmentsWithinBudget} and
+* {@link fragmentsInWindow}: both walk forward from the same anchor, they
+* only differ in the condition that stops the walk.
+*/
+function findAnchor(samples, offsetTicks) {
 	let lo = 0;
 	let hi = samples.length - 1;
 	let anchor = 0;
@@ -363,6 +368,11 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 			lo = mid + 1;
 		} else hi = mid - 1;
 	}
+	return anchor;
+}
+function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, offsetTicks);
 	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
 	const anchorStart = samples[anchor]?.moofOffset ?? 0;
 	const anchorEnd = endOf(anchor);
@@ -399,6 +409,70 @@ function fragmentsWithinBudget(index, offsetTicks, maxBytes) {
 		oversizeFragment
 	};
 }
+/**
+* Convert a TIME WINDOW `[fromTicks, toTicks)` into the set of consecutive
+* fragments that covers it — the replay's primitive for "give me this many
+* seconds of one segment", as opposed to {@link fragmentsWithinBudget}'s
+* "give me as much as fits in N bytes" (the scrub GOP read's primitive).
+*
+* Stops walking forward the instant the NEXT fragment's own start time
+* already reaches `toTicks`: at that point the fragments already collected
+* cover the whole window, because each fragment's coverage runs up to the
+* next one's start (the same relationship {@link fragmentsWithinBudget}'s
+* `endOf` encodes). `maxBytes` is a SAFETY CEILING, not the primary stop
+* condition — a caller with a well-formed window is expected to hit the time
+* condition first; the byte cap exists so a pathological request cannot pull
+* an unbounded amount of one segment into memory.
+*
+* Same never-empty guarantee as {@link fragmentsWithinBudget}: the anchor
+* fragment is always returned, even when it alone exceeds `maxBytes`.
+*/
+function fragmentsInWindow(index, fromTicks, toTicks, maxBytes) {
+	const { samples, mfraOffset } = index;
+	const anchor = findAnchor(samples, fromTicks);
+	const endOf = (i) => samples[i + 1]?.moofOffset ?? mfraOffset;
+	const windowCoveredAt = (i) => {
+		const next = samples[i + 1];
+		return next === void 0 || next.timeTicks >= toTicks;
+	};
+	const anchorStart = samples[anchor]?.moofOffset ?? 0;
+	const anchorEnd = endOf(anchor);
+	const fragments = [{
+		start: anchorStart,
+		end: anchorEnd,
+		sampleIndex: anchor
+	}];
+	let total = anchorEnd - anchorStart;
+	const oversizeFragment = total > maxBytes;
+	let i = anchor;
+	let reachesWindowEnd = windowCoveredAt(i);
+	while (!reachesWindowEnd) {
+		const nextIndex = i + 1;
+		const nextSample = samples[nextIndex];
+		if (nextSample === void 0) break;
+		const nextStart = nextSample.moofOffset;
+		const nextEnd = endOf(nextIndex);
+		const nextSize = nextEnd - nextStart;
+		if (total + nextSize > maxBytes) break;
+		fragments.push({
+			start: nextStart,
+			end: nextEnd,
+			sampleIndex: nextIndex
+		});
+		total += nextSize;
+		i = nextIndex;
+		reachesWindowEnd = windowCoveredAt(i);
+	}
+	const last = fragments[fragments.length - 1];
+	return {
+		fragments,
+		start: fragments[0].start,
+		end: last.end,
+		reachesSegmentEnd: last.end >= mfraOffset,
+		reachesWindowEnd,
+		oversizeFragment
+	};
+}
 //#endregion
 //#region src/recorder/mfra-capture.ts
 /**
@@ -4438,6 +4512,34 @@ var SCRUB_GOP_BUDGET_MAX_BYTES = 15e5;
 function ticksToMs(ticks, timescale) {
 	return Math.round(ticks / timescale * 1e3);
 }
+/** ms → ticks on the video timescale — the inverse of {@link ticksToMs}. */
+function msToTicks(ms, timescale) {
+	return ms / 1e3 * timescale;
+}
+/**
+* Steps 1-2 shared by {@link readGopRange} and {@link readGopWindowRange}:
+* locate the `mfra` (seeded or from the tail), read the `ftyp`+`moov` head,
+* and pick the VIDEO track's sync table (never the audio one, which lists
+* every `moof` and would send a seek to bytes that do not open a GOP).
+* `null` on anything that does not look like a recorded segment.
+*/
+async function resolveSegmentIndex(file, seededIndex, read) {
+	const parsed = seededIndex === void 0 ? await parseTail(file, read) : null;
+	if (seededIndex === void 0 && parsed === null) return null;
+	const index = seededIndex ?? parsed.index;
+	const firstMoof = index.samples[0]?.moofOffset ?? 0;
+	if (firstMoof <= 0 || firstMoof >= file.size) return null;
+	const head = await read(0, firstMoof);
+	const init = parseInitInfo(head);
+	if (init === null) return null;
+	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
+	if (videoIndex === null) return null;
+	return {
+		head,
+		init,
+		videoIndex
+	};
+}
 /**
 * Read the single GOP covering `epochMs` from `file`, by byte range.
 *
@@ -4453,17 +4555,10 @@ async function readGopRange(file, args) {
 		bytesRead += chunk.length;
 		return chunk;
 	};
-	const parsed = args.seededIndex === void 0 ? await parseTail(file, read) : null;
-	if (args.seededIndex === void 0 && parsed === null) return null;
-	const index = args.seededIndex ?? parsed.index;
-	const firstMoof = index.samples[0]?.moofOffset ?? 0;
-	if (firstMoof <= 0 || firstMoof >= file.size) return null;
-	const head = await read(0, firstMoof);
-	const init = parseInitInfo(head);
-	if (init === null) return null;
-	const videoIndex = index.trackId === init.videoTrackId ? index : parsed === null ? null : reparseTail(parsed.tail, file.size, init.videoTrackId);
-	if (videoIndex === null) return null;
-	const offsetTicks = Math.max(0, args.epochMs - args.segmentStartMs) / 1e3 * init.videoTimescale;
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const offsetTicks = msToTicks(Math.max(0, args.epochMs - args.segmentStartMs), init.videoTimescale);
 	let start;
 	let end;
 	let firstSampleIndex;
@@ -4508,6 +4603,49 @@ async function readGopRange(file, args) {
 	};
 }
 /**
+* Read the fragments covering `[fromMs, toMs)` from `file`, by byte range —
+* the WINDOW twin of {@link readGopRange}'s single instant. Same shape, same
+* standalone-demuxable `ftyp`+`moov` head, same `null`-on-unparseable
+* contract; the only difference is the stop condition
+* ({@link fragmentsInWindow} instead of {@link fragmentRangeFor} /
+* {@link fragmentsWithinBudget}).
+*/
+async function readGopWindowRange(file, args) {
+	let bytesRead = 0;
+	const read = async (offset, length) => {
+		const chunk = await file.read(offset, length);
+		bytesRead += chunk.length;
+		return chunk;
+	};
+	const resolved = await resolveSegmentIndex(file, args.seededIndex, read);
+	if (resolved === null) return null;
+	const { head, init, videoIndex } = resolved;
+	const fromOffsetMs = Math.max(0, args.fromMs - args.segmentStartMs);
+	const toOffsetMs = Math.max(fromOffsetMs, args.toMs - args.segmentStartMs);
+	const plan = fragmentsInWindow(videoIndex, msToTicks(fromOffsetMs, init.videoTimescale), msToTicks(toOffsetMs, init.videoTimescale), args.maxBytes);
+	const { start, end } = plan;
+	if (start <= 0 || end <= start || end > file.size) return null;
+	const fragment = await read(start, end - start);
+	const firstSampleIndex = plan.fragments[0].sampleIndex;
+	const lastSampleIndex = plan.fragments[plan.fragments.length - 1].sampleIndex;
+	const startTicks = videoIndex.samples[firstSampleIndex]?.timeTicks ?? 0;
+	const nextTicks = videoIndex.samples[lastSampleIndex + 1]?.timeTicks;
+	const gopStartOffsetMs = ticksToMs(startTicks, init.videoTimescale);
+	const gopDurMs = nextTicks !== void 0 ? ticksToMs(nextTicks - startTicks, init.videoTimescale) : Math.max(1, args.segmentDurMs - gopStartOffsetMs);
+	const data = new Uint8Array(head.length + fragment.length);
+	data.set(head, 0);
+	data.set(fragment, head.length);
+	return {
+		data,
+		gopStartMs: args.segmentStartMs + gopStartOffsetMs,
+		gopDurMs,
+		bytesRead,
+		reachesSegmentEnd: plan.reachesSegmentEnd,
+		reachesWindowEnd: plan.reachesWindowEnd,
+		oversizeFragment: plan.oversizeFragment
+	};
+}
+/**
 * Fetch + parse the `mfra` tail, honouring `MfraParseError.needBytes` with ONE
 * widened retry. Null on anything else — bytes that are not a segment.
 */
@@ -4799,6 +4937,16 @@ var RANGE_MERGE_GAP_MS = 5e3;
 * hour but covers the requested epoch is hydrated too. Recorder segments are
 * currently much shorter; the margin keeps this boundary future-safe. */
 var LOCATE_HYDRATE_MARGIN_MS = 6e4;
+/**
+* Safety ceiling for one `readWindowBytes` answer — NOT the primary stop
+* condition (the requested `toMs` is; see `fragmentsInWindow` in
+* `mfra-index.ts`). Sized off `high`'s own bandwidth hint above
+* (`PROFILE_BANDWIDTH.high` = 4 Mbps = 500 000 B/s): a 30 s replay window at
+* that rate is ~15 MB, so 20 MB covers it with headroom while still bounding
+* a pathological request. A window this call actually truncates is reported
+* (`reachesRequestedEnd: false`) rather than silently shortened.
+*/
+var WINDOW_READ_MAX_BYTES = 2e7;
 /** Empty "no playback" manifest. */
 function noPlayback(deviceId) {
 	return {
@@ -5316,6 +5464,76 @@ function buildRecordingProvider(deps) {
 				gopDurMs: seg.durMs
 			};
 		},
+		readWindowBytes: async ({ deviceId, profile, startMs, fromMs, toMs }) => {
+			const { abs, seg } = resolveSegmentFile(deps, deviceId, profile, startMs);
+			const segmentEndMs = seg.startMs + seg.durMs;
+			if (toMs > segmentEndMs) {
+				deps.logger.warn("recording: readWindowBytes refused — window runs past this segment, not silently clipped", {
+					tags: { deviceId },
+					meta: {
+						profile,
+						startMs,
+						fromMs,
+						toMs,
+						segmentEndMs
+					}
+				});
+				return {
+					kind: "spans-multiple-segments",
+					segmentEndMs
+				};
+			}
+			const file = await (deps.openRangeReadable ?? openRangeFromDisk)(abs, seg.bytes);
+			try {
+				const gop = await readGopWindowRange(file, {
+					segmentStartMs: seg.startMs,
+					segmentDurMs: seg.durMs,
+					fromMs,
+					toMs,
+					seededIndex: deps.mfraFor?.(deviceId, profile, startMs),
+					maxBytes: WINDOW_READ_MAX_BYTES
+				});
+				if (gop !== null) {
+					if (gop.reachesWindowEnd !== true) deps.logger.warn("recording: readWindowBytes truncated by its safety byte cap before covering the requested window", {
+						tags: { deviceId },
+						meta: {
+							profile,
+							startMs,
+							fromMs,
+							toMs,
+							bytes: gop.data.length,
+							WINDOW_READ_MAX_BYTES
+						}
+					});
+					return {
+						kind: "ok",
+						data: gop.data,
+						gopStartMs: gop.gopStartMs,
+						gopDurMs: gop.gopDurMs,
+						reachesRequestedEnd: gop.reachesWindowEnd === true
+					};
+				}
+			} finally {
+				await file.close();
+			}
+			deps.logger.warn("recording: readWindowBytes fell back to the WHOLE segment (mfra/moov unparseable)", {
+				tags: { deviceId },
+				meta: {
+					profile,
+					startMs,
+					fromMs,
+					toMs
+				}
+			});
+			const data = await readFile(abs);
+			return {
+				kind: "ok",
+				data: Uint8Array.from(data),
+				gopStartMs: seg.startMs,
+				gopDurMs: seg.durMs,
+				reachesRequestedEnd: true
+			};
+		},
 		setDeviceConfig: async ({ deviceId, config }) => {
 			const saved = await saveDeviceConfig(deps.configStore, deviceId, config);
 			if (deps.onConfigChanged) try {

package/dist/{segment-demux-js-skhsAZx6.mjs → segment-demux-js-BL1UDdiI.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { gt as errMsg } from "./dist-DO0UVhOk.mjs";
+import { gt as errMsg } from "./dist-BZYUUBUx.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-Cu0oDMUL.js → segment-demux-js-wTzFi5UW.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CqoMNE1e.js");
+const require_dist = require("./dist-DBP47QOz.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-G3HXTY8z.js");
-const require_lazy_sharp = require("../lazy-sharp-BGrpS8yi.js");
+const require_worker_protocol = require("../worker-protocol-C3zaz0Jv.js");
+const require_lazy_sharp = require("../lazy-sharp-B_kETjyQ.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,4 +1,4 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-_Ujvj1hl.mjs";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-Cut8984B.mjs";
 import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
 //#region src/session-decode/color-conversion.ts
 /**

package/dist/stream-broker/_stub.js

@@ -1,7 +1,7 @@
-import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CQKwHIHI.mjs";
+import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-BUw_aTfK.mjs";
 import { a as p, i as m, n as h, o as g, r as _, t as v } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react__loadShare__.js-C9j-2lBe.mjs";
 import { n as y, r as b, t as x } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-XO0-Pyu6.mjs";
-import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-Bme2OZQp.mjs";
+import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-DXKTNEae.mjs";
 import { n as C, t as w } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-BO7TIbJV.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var T = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), E = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), D = (e) => {

package/dist/stream-broker/{_virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-DGQkDEYw.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_stream_broker_widgets-DlKJZ-_M.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.33",
+		version: "1.2.34",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.111",
+		version: "1.2.112",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.74",
+		version: "1.2.75",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_stream_broker_widgets",