@camstack/addon-pipeline 1.2.140 → 1.2.142

package/dist/recorder/index.mjs

@@ -847,6 +847,23 @@ function upperBoundByStart(rows, startMs) {
 	}
 	return lo;
 }
+/**
+* Index of the FIRST element whose `startMs` is at-or-after `startMs` (lower
+* bound). On a start-sorted view this is exactly where a linear
+* `find(s => s.startMs === x)` and a linear `find(s => s.startMs >= x)` would
+* have stopped — which is what makes the binary-search replacements of those
+* two scans row-for-row identical, duplicate starts included.
+*/
+function lowerBoundByStart(rows, startMs) {
+	let lo = 0;
+	let hi = rows.length;
+	while (lo < hi) {
+		const mid = lo + hi >> 1;
+		if (rows[mid].startMs < startMs) lo = mid + 1;
+		else hi = mid;
+	}
+	return lo;
+}
 var RecordingIndex = class {
 	byDevice = /* @__PURE__ */ new Map();
 	/** Start-sorted views. Built lazily on first read (one copy+sort), then kept
@@ -865,6 +882,27 @@ var RecordingIndex = class {
 	*  hydrate. Empty = nothing has been looked at, which is NOT the same as
 	*  "there is nothing" — see {@link hydrationOf}. */
 	walked = /* @__PURE__ */ new Map();
+	/**
+	* Upper bound on the `durMs` of any row the index holds — the ONLY thing that
+	* turns "walk the whole sorted view" into "walk backwards a bounded number of
+	* rows".
+	*
+	* A start-sorted view answers "which row STARTS at/before X" by binary
+	* search, but every backward question here ("which row still COVERS X",
+	* "which footage ENDS at/before X") depends on `startMs + durMs`, which is
+	* not sorted. This scalar closes that: a row at `startMs` can never end later
+	* than `startMs + maxDurMs`, so once a candidate's ceiling can no longer beat
+	* the best answer found, no earlier row can either — and the walk stops.
+	*
+	* Monotonically non-decreasing on purpose. It is only ever an OVER-estimate
+	* (a longer walk, never a wrong answer); shrinking it on eviction would buy
+	* nothing and could only make it wrong.
+	*/
+	maxDurMs = 0;
+	/** Widen {@link maxDurMs} for a row entering the index. */
+	noteDuration(durMs) {
+		if (durMs > this.maxDurMs) this.maxDurMs = durMs;
+	}
 	mapFor(deviceId) {
 		let m = this.byDevice.get(deviceId);
 		if (!m) {
@@ -953,11 +991,13 @@ var RecordingIndex = class {
 		const prev = held.get(path);
 		if (prev !== void 0 && prev.locationId === locationId) {
 			this.rowsReused += 1;
+			this.noteDuration(prev.durMs);
 			return prev;
 		}
 		const p = parseSegmentPath(path);
 		if (!p || p.deviceId !== deviceId) return null;
 		this.rowsAllocated += 1;
+		this.noteDuration(p.durMs);
 		return {
 			deviceId: p.deviceId,
 			profile: p.profile,
@@ -1055,6 +1095,7 @@ var RecordingIndex = class {
 	*/
 	addSegment(s) {
 		const m = this.mapFor(s.deviceId);
+		this.noteDuration(s.durMs);
 		const replacing = m.has(s.path);
 		m.set(s.path, s);
 		if (replacing) {
@@ -1092,6 +1133,55 @@ var RecordingIndex = class {
 		while (end < segs.length && segs[end].startMs < toMs) end += 1;
 		return lo === 0 && end === segs.length ? segs : segs.slice(lo, end);
 	}
+	/**
+	* The row whose `startMs` is EXACTLY `startMs`, or null.
+	*
+	* The point lookup every byte read is: `readSegmentBytes` / `readGopBytes` /
+	* `readWindowBytes` all address a segment by its exact start, which is what
+	* the playback manifest and the locate answer handed the client. It used to
+	* be `segments(deviceId, profile).find(...)` — a full COPY of the
+	* device-profile archive plus a linear scan, per scrub tick and per playback
+	* fetch (~10 k rows copied to reach one of them on the live hub).
+	*
+	* Returns the FIRST row with that start, which is what `.find` returned on
+	* the same start-sorted view: a restart can leave two rows sharing a start,
+	* and the byte reader must keep resolving to the same one it always did.
+	*/
+	segmentStartingAt(deviceId, profile, startMs) {
+		const segs = this.sortedSegments(deviceId, profile);
+		const at = segs[lowerBoundByStart(segs, startMs)];
+		return at !== void 0 && at.startMs === startMs ? at : null;
+	}
+	/**
+	* Start-sorted rows whose SPAN `[startMs, startMs+durMs)` overlaps
+	* `[fromMs, toMs)` — i.e. `startMs < toMs && startMs + durMs > fromMs`.
+	*
+	* The overlap-inclusive twin of {@link segmentsStartingIn}, and the reason it
+	* cannot just slice from the `fromMs` lower bound: the segment an operator is
+	* actually watching at `fromMs` STARTED before it. Dropping it truncates the
+	* first segment of every playback window — silently, because the window still
+	* renders, just short. The boundary convention is the caller's, preserved
+	* from the whole-archive filter this replaces: a segment ending EXACTLY at
+	* `fromMs` is excluded (`end > fromMs`), a segment starting exactly at `toMs`
+	* is excluded (`start < toMs`), and a segment straddling `fromMs` is IN.
+	*
+	* The backward reach is {@link maxDurMs}, not "one element": with overlapping
+	* rows (a restart re-recording an hour) more than one predecessor can still
+	* cover `fromMs`, and the ceiling is the only bound that cannot miss one.
+	*/
+	segmentsOverlapping(deviceId, profile, fromMs, toMs) {
+		const segs = this.sortedSegments(deviceId, profile);
+		const end = lowerBoundByStart(segs, toMs);
+		let head = lowerBoundByStart(segs, fromMs);
+		const reach = fromMs - this.maxDurMs;
+		while (head > 0 && segs[head - 1].startMs > reach) head -= 1;
+		const out = [];
+		for (let i = head; i < end; i++) {
+			const s = segs[i];
+			if (s.startMs + s.durMs > fromMs) out.push(s);
+		}
+		return out;
+	}
 	/** True when `relPath` is currently indexed for `deviceId`. O(1). */
 	hasSegment(deviceId, relPath) {
 		return this.byDevice.get(deviceId)?.has(relPath) === true;
@@ -1210,6 +1300,26 @@ var RecordingIndex = class {
 		}
 		return [...out.values()];
 	}
+	/**
+	* WHICH devices hold footage on any of `locationIds` — the census, without
+	* the archive.
+	*
+	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
+	* location: a full multi-device COPY of every row on the disk plus a sort of
+	* it (294 k rows on the live hub), to read one number off each row and throw
+	* the array away. This visits each device only until its first matching row.
+	* Same membership rule as before — a device is listed when at least one of
+	* its rows sits on one of the given locations, so footage stranded on a
+	* location id that no longer resolves stays invisible here exactly as it was.
+	*/
+	deviceIdsOnLocations(locationIds) {
+		const out = /* @__PURE__ */ new Set();
+		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
+			out.add(deviceId);
+			break;
+		}
+		return out;
+	}
 	/** All segments on a storage location across every device, oldest-first. */
 	segmentsOnLocation(locationId) {
 		const out = [];
@@ -1246,20 +1356,59 @@ var RecordingIndex = class {
 		const segs = this.sortedSegments(deviceId, profile);
 		if (segs.length === 0) return null;
 		if (this.segmentAtIn(segs, epochMs) !== null) return epochMs;
-		const next = segs.find((s) => s.startMs >= epochMs);
+		const next = segs[lowerBoundByStart(segs, epochMs)];
 		return next ? next.startMs : null;
 	}
 	/**
+	* The end of the newest footage for a (device, profile), or null when there
+	* is none — "how far can an export reach?", asked once per render.
+	*
+	* NOT simply the last row's end: the view is sorted by START, and an earlier,
+	* longer segment can end later. Walks backwards from the newest row only
+	* while an earlier start could still, at {@link maxDurMs}, beat the best end
+	* seen — which on a uniform-length archive is one comparison.
+	*/
+	latestEnd(deviceId, profile) {
+		const segs = this.sortedSegments(deviceId, profile);
+		let best = null;
+		for (let i = segs.length - 1; i >= 0; i--) {
+			const s = segs[i];
+			if (best !== null && s.startMs + this.maxDurMs <= best) break;
+			const end = s.startMs + s.durMs;
+			if (best === null || end > best) best = end;
+		}
+		return best;
+	}
+	/**
 	* The exclusive END of the nearest footage ending at-or-before `epochMs`
 	* (the backward covered edge), or null when no footage ends at or before it.
 	* Backward counterpart of `nearestCoveredEdge`: consecutive segments leave
 	* small cracks (`startMs + durMs` < next `startMs` by ~11-17 ms), so a
 	* backward frame-step probing `startMs − 1` lands in a crack — this edge
 	* lets the caller hop to the true previous segment.
+	*
+	* ## Why this is a search and not a scan
+	*
+	* Called on EVERY locate that lands in a gap — during a drag across sparse
+	* footage, every tick — and it used to walk the device-profile's whole sorted
+	* view to do it. Two bounds replace the walk, and the second is the one that
+	* has to be right:
+	*
+	* 1. A row starting AFTER `epochMs` ends after it too (`durMs >= 0`), so
+	*    nothing at-or-past the upper bound of `epochMs` can qualify.
+	* 2. Below that bound the answer is NOT the predecessor. A row starting
+	*    before the cursor can still COVER it (disqualified: its end is past
+	*    `epochMs`), while an even earlier row ends cleanly before it and is the
+	*    true edge. So the walk continues backwards, and only {@link maxDurMs}
+	*    says when to stop: earlier rows start no later than this one, so none of
+	*    them can end past `startMs + maxDurMs`.
 	*/
 	coveredEdgeBefore(deviceId, profile, epochMs) {
+		const segs = this.sortedSegments(deviceId, profile);
 		let best = null;
-		for (const s of this.sortedSegments(deviceId, profile)) {
+		for (let i = upperBoundByStart(segs, epochMs) - 1; i >= 0; i--) {
+			const s = segs[i];
+			if (best !== null && s.startMs + this.maxDurMs <= best) break;
 			const end = s.startMs + s.durMs;
 			if (end <= epochMs && (best === null || end > best)) best = end;
 		}
@@ -1901,6 +2050,11 @@ var macrotask$2 = () => new Promise((resolve) => {
 * segment's start. Returns the LAST segment whose half-open span
 * `[startMs, startMs+durMs)` contains the instant (segments can overlap after a
 * restart; the newest wins). Null when no segment covers the instant.
+*
+* `segments` may be a CANDIDATE WINDOW rather than the device's whole archive —
+* the caller narrows it with an index search. The membership test below stays
+* regardless: narrowing may only remove rows that could not have won, never
+* decide which of the survivors does.
 */
 function resolveStillSource(segments, epochMs) {
 	let match = null;
@@ -1968,16 +2122,22 @@ var StillFrameService = class {
 	* caller replies 204 → the dialog shows its placeholder).
 	*/
 	async getStill(deviceId, epochMs) {
-		const source = resolveStillSource(this.deps.listLowSegments(deviceId), epochMs);
-		if (source === null) return null;
+		const source = resolveStillSource(this.deps.lowSegmentsAt(deviceId, epochMs), epochMs);
+		if (source === null) {
+			this.deps.logger.debug("still: no low segment covers the instant", {
+				tags: { deviceId },
+				meta: { epochMs }
+			});
+			return null;
+		}
 		const abs = this.deps.resolveAbsPath(source.row);
 		const now = (this.deps.now ?? Date.now)();
 		const immutable = source.row.startMs + source.row.durMs < now;
 		if (!await this.acquireSlot()) {
-			this.deps.logger.debug("still: decode queue saturated, dropping request", { meta: {
-				deviceId,
-				epochMs
-			} });
+			this.deps.logger.debug("still: decode queue saturated, dropping request", {
+				tags: { deviceId },
+				meta: { epochMs }
+			});
 			return null;
 		}
 		try {
@@ -5077,7 +5237,7 @@ async function collectRangeSegments(deps, deviceId, profile, fromMs, toMs, uriMo
 	if (deps.index.hydrationOf(deviceId, fromMs, toMs) !== "hydrated") await deps.hydrateWindow?.(deviceId, fromMs, toMs);
 	const hydration = deps.index.hydrationOf(deviceId, fromMs, toMs);
 	const rootById = new Map(deps.locations().map((l) => [l.id, l.root]));
-	const candidates = deps.index.segments(deviceId, profile).filter((s) => s.startMs < toMs && s.startMs + s.durMs > fromMs).toSorted((a, b) => a.startMs - b.startMs).flatMap((s) => {
+	const candidates = deps.index.segmentsOverlapping(deviceId, profile, fromMs, toMs).flatMap((s) => {
 		const root = rootById.get(s.locationId);
 		if (root === void 0) return [];
 		const rel = segmentRelPath(deviceId, profile, s.startMs, s.durMs, s.bytes);
@@ -5243,7 +5403,7 @@ async function evictVictims(deps, deviceId, victims) {
 * and GOP byte-range reads so the two paths cannot drift on resolution.
 */
 function resolveSegmentFile(deps, deviceId, profile, startMs) {
-	const seg = deps.index.segments(deviceId, profile).find((s) => s.startMs === startMs);
+	const seg = deps.index.segmentStartingAt(deviceId, profile, startMs);
 	if (!seg) throw new Error(`recording: no segment at start ${startMs} for ${deviceId}/${profile}`);
 	const loc = deps.locations().find((l) => l.id === seg.locationId);
 	if (!loc) throw new Error(`recording: unknown location ${seg.locationId}`);
@@ -5412,8 +5572,7 @@ function buildRecordingProvider(deps) {
 		getStorageUsage: async () => {
 			const locations = deps.locations();
 			const devices = [];
-			const seenDevices = /* @__PURE__ */ new Set();
-			for (const loc of locations) for (const row of deps.index.segmentsOnLocation(loc.id)) seenDevices.add(row.deviceId);
+			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
 			let totalUsedBytes = 0;
 			for (const deviceId of seenDevices) {
 				const accounting = deps.index.accounting(deviceId);
@@ -5917,15 +6076,14 @@ async function renderFootage(renderDeps, input, ext, buildArgs) {
 		await promises.rm(outPath, { force: true }).catch(() => {});
 	}
 }
-/** The end of the newest FINALIZED `low` segment, or null when none exists. */
+/**
+* The end of the newest FINALIZED `low` segment, or null when none exists.
+*
+* One scalar off the tail of the live sorted view — it used to COPY the
+* device's whole `low` archive to fold a maximum out of it, per render.
+*/
 function latestFinalizedEnd(renderDeps, deviceId) {
-	const rows = renderDeps.deps.index.segments(deviceId, "low");
-	let end = null;
-	for (const s of rows) {
-		const candidate = s.startMs + s.durMs;
-		if (end === null || candidate > end) end = candidate;
-	}
-	return end;
+	return renderDeps.deps.index.latestEnd(deviceId, "low");
 }
 /**
 * Run one ffmpeg and GUARANTEE the child is gone before the promise settles.
@@ -11232,10 +11390,12 @@ var RECORDING_SEGMENT_HOURS_COLLECTION = "recorder:segment-hours";
 /**
 * The four aggregate columns exist so "how much footage is on this disk" is a
 * `SUM`/`MIN`/`MAX` over ~19 k hour rows instead of a walk over ~7.1 M in-RAM
-* segment rows. They are DERIVED from `paths` — never a second authority — and
-* {@link hourAggregate} is the only place that derives them, so a row loaded
-* from a database that predates these columns is corrected in the mirror the
-* moment it is read and repaired on disk by {@link SegmentHourLedger.repairAggregates}.
+* segment rows. They are DERIVED from `paths` — never a second authority — by
+* {@link withSegmentPath} and nothing else: {@link hourAggregate} is that step
+* over every path and {@link appendSegmentPath} is that step over one, so there
+* is no second derivation to drift. A row loaded from a database that predates
+* these columns is corrected in the mirror the moment it is read and repaired
+* on disk by {@link SegmentHourLedger.repairAggregates}.
 */
 var RECORDING_SEGMENT_HOURS_COLUMNS = [
 	{
@@ -11312,33 +11472,57 @@ var RECORDING_SEGMENT_HOURS_INDEXES = [
 		columns: ["locationId", "hourStartMs"]
 	})
 ];
+/** The identity of the {@link hourAggregate} fold — an hour holding nothing. */
+var EMPTY_HOUR_AGGREGATE = {
+	bytes: 0,
+	segments: 0,
+	minStartMs: 0,
+	maxStartMs: 0
+};
 /**
-* Bytes / count / oldest / newest for one hour's paths.
+* ONE path folded into an aggregate — the whole derivation, expressed as its
+* single step.
+*
+* {@link hourAggregate} is this step over every path, and {@link
+* SegmentHourLedger.recordSegment} is this step over the one path that just
+* arrived. That is not two implementations that happen to agree: the full
+* derivation is *defined* as this function repeated, so an append is the fold
+* resumed from the state the held row already carries — a `SegmentHourRow`'s
+* aggregate half IS the fold state over its `paths`.
+*
+* Why it had to become a step: `recordSegment` re-derived the whole hour on
+* every finalize. Σ1..360 ≈ 65 k path parses per camera-profile-hour at 10 s
+* segments, Σ1..1708 ≈ 1.46 M in the restart-storm hours of 2026-08-29, at
+* ~3.4 finalizes/s fleet-wide, forever.
+*
+* A path the parser refuses contributes nothing — it is not a segment, and
+* counting it would inflate a disk report. `segments === 0` is the first-path
+* sentinel for min/max, so an aggregate with no segments carries 0/0 rather
+* than a sentinel nobody can compare against.
+*/
+function withSegmentPath(agg, path) {
+	const p = parseSegmentPath(path);
+	if (p === null) return agg;
+	return {
+		bytes: agg.bytes + p.bytes,
+		segments: agg.segments + 1,
+		minStartMs: agg.segments === 0 || p.startMs < agg.minStartMs ? p.startMs : agg.minStartMs,
+		maxStartMs: agg.segments === 0 || p.startMs > agg.maxStartMs ? p.startMs : agg.maxStartMs
+	};
+}
+/**
+* Bytes / count / oldest / newest for one hour's paths — the sole FULL
+* derivation, used by rebuilds ({@link recordToRow}, `dropSegments`) and never
+* by the append path.
 *
 * Every field of a segment path encodes its own facts (`parseSegmentPath`), so
 * this is a derivation, not a measurement: it can never disagree with the paths
-* it was computed from. A path the parser refuses contributes nothing — it is
-* not a segment, and counting it would inflate a disk report.
+* it was computed from.
 */
 function hourAggregate(paths) {
-	let bytes = 0;
-	let segments = 0;
-	let minStartMs = 0;
-	let maxStartMs = 0;
-	for (const path of paths) {
-		const p = parseSegmentPath(path);
-		if (p === null) continue;
-		bytes += p.bytes;
-		if (segments === 0 || p.startMs < minStartMs) minStartMs = p.startMs;
-		if (segments === 0 || p.startMs > maxStartMs) maxStartMs = p.startMs;
-		segments += 1;
-	}
-	return {
-		bytes,
-		segments,
-		minStartMs,
-		maxStartMs
-	};
+	let agg = EMPTY_HOUR_AGGREGATE;
+	for (const path of paths) agg = withSegmentPath(agg, path);
+	return agg;
 }
 /** Build the persisted row for an hour from its paths — the ONE constructor. */
 function segmentHourRow(base) {
@@ -11348,6 +11532,33 @@ function segmentHourRow(base) {
 	};
 }
 /**
+* The row an hour becomes when ONE more path joins it.
+*
+* Identical to `segmentHourRow({ ...held, paths: [...held.paths, path] })` and
+* strictly cheaper: the aggregate half of `held` is already the fold over
+* `held.paths`, so this resumes that fold instead of restarting it. The
+* equality is not an assumption — `segment-hour-append.spec.ts` pins it on
+* generated hours including out-of-order arrival, duplicate paths, unparseable
+* paths and storm-sized hours.
+*
+* The four fields are named rather than spread on purpose. {@link
+* withSegmentPath} hands its argument straight back for a path the parser
+* refuses, and `held` is a whole row — spreading that return would put the
+* PREVIOUS `paths` array back over the appended one. Which is exactly what it
+* did until the generated-hours test caught it.
+*/
+function appendSegmentPath(held, path) {
+	const { bytes, segments, minStartMs, maxStartMs } = withSegmentPath(held, path);
+	return {
+		...held,
+		paths: [...held.paths, path],
+		bytes,
+		segments,
+		minStartMs,
+		maxStartMs
+	};
+}
+/**
 * The largest share of a device's held hours a single walk may delete.
 *
 * On 2026-08-19 the recorder respawned while `/recordings` was an empty tmpfs —
@@ -11680,19 +11891,31 @@ var SegmentHourLedger = class {
 		} });
 		return repaired;
 	}
-	/** Write-behind: a just-finalized segment joins its hour row. */
+	/**
+	* Write-behind: a just-finalized segment joins its hour row.
+	*
+	* THE hot path — every profile-writer lands here every `segmentSeconds`,
+	* ~3.4 times a second fleet-wide. The append is {@link appendSegmentPath}:
+	* one `parseSegmentPath` and four scalar updates, whatever the hour already
+	* holds. It used to re-derive the whole hour, which made one hour
+	* O(N²) — 65 k parses at 360 segments, 1.46 M in a restart-storm hour.
+	*/
 	async recordSegment(row) {
 		const { key, hourStartMs: hour } = hourOf(row);
 		const held = this.ledger.get(key);
-		if (held !== void 0 && held.paths.includes(row.path)) return;
-		await this.ledger.put(segmentHourRow({
-			key,
-			deviceId: row.deviceId,
-			profile: row.profile,
-			locationId: row.locationId,
-			hourStartMs: hour,
-			paths: held === void 0 ? [row.path] : [...held.paths, row.path]
-		}));
+		if (held === void 0) {
+			await this.ledger.put(segmentHourRow({
+				key,
+				deviceId: row.deviceId,
+				profile: row.profile,
+				locationId: row.locationId,
+				hourStartMs: hour,
+				paths: [row.path]
+			}));
+			return;
+		}
+		if (held.paths.includes(row.path)) return;
+		await this.ledger.put(appendSegmentPath(held, row.path));
 	}
 	/**
 	* Eviction confirmed these paths are gone from disk. Drop them; forget the
@@ -11756,10 +11979,7 @@ var SegmentHourLedger = class {
 				hourStartMs: hour,
 				paths: [seg.path]
 			}));
-			else fromIndex.set(key, segmentHourRow({
-				...existing,
-				paths: [...existing.paths, seg.path]
-			}));
+			else fromIndex.set(key, appendSegmentPath(existing, seg.path));
 		}
 		const refused = this.refusedPrunes(walked, fromIndex);
 		for (const row of this.ledger.snapshot()) {
@@ -12989,7 +13209,7 @@ var RecorderV2Addon = class extends BaseAddon {
 		}
 		try {
 			const stillService = new StillFrameService({
-				listLowSegments: (deviceId) => this.index.segments(deviceId, "low"),
+				lowSegmentsAt: (deviceId, epochMs) => this.index.segmentsOverlapping(deviceId, "low", epochMs, epochMs + 1),
 				resolveAbsPath: (row) => this.resolveSegmentAbsPath(row),
 				logger: this.ctx.logger.child("Still")
 			});