@camstack/addon-pipeline 1.2.171 → 1.2.173

package/dist/pipeline-runner/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-M39Js6iu.js");
-const require_node = require("../node-Byy6tlFm.js");
-const require_local_frame_registry = require("../local-frame-registry-CHUbcz6r.js");
-const require_worker_protocol = require("../worker-protocol-NB-CjUQf.js");
+const require_dist = require("../dist-DSJDq5hY.js");
+const require_node = require("../node-DVcGI_Kr.js");
+const require_local_frame_registry = require("../local-frame-registry-Y4TreSiT.js");
+const require_worker_protocol = require("../worker-protocol-wr4XEhUh.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-CO-c2L9_.js");
+const require_lazy_sharp = require("../lazy-sharp-Fre6HHg6.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
 const require_remote_restream = require("../remote-restream-CO36Sr30.js");
@@ -18,6 +18,51 @@ let node_url = require("node:url");
 let node_perf_hooks = require("node:perf_hooks");
 let node_os = require("node:os");
 node_os = require_dist.__toESM(node_os);
+//#region src/pipeline-runner/first-detection-frame.ts
+/**
+* How long a camera waits, after `attachCamera`, before a decoded frame
+* actually reaches the detection queue.
+*
+* The orchestrator already measures `session motion → attach latency` and it
+* is small — 11, 13 and 18 ms across three consecutive sessions on the same
+* camera. What nothing measured is the NEXT leg: from the attach to the first
+* frame the detector is given. An operator reporting "detection starts late"
+* is describing that leg, and answering them required reading the timestamps
+* of unrelated INFO lines and inferring — which produced a wrong first answer
+* (the absence of a `frame processed` line means the frame produced nothing
+* notable, not that no frame arrived).
+*
+* One number, once per attach, so a slow start is a value rather than an
+* inference.
+*/
+/** Pending attach marks, keyed by device. */
+var FirstDetectionFrameTimer = class {
+	attachedAt = /* @__PURE__ */ new Map();
+	/** A camera attached. Replaces any pending mark: the newest attach is the
+	*  one the next frame belongs to. */
+	markAttached(deviceId, nowMs) {
+		this.attachedAt.set(deviceId, nowMs);
+	}
+	/**
+	* A decoded frame was admitted to the detection queue. Returns the elapsed
+	* ms since the attach the FIRST time it is called after one, and `null`
+	* every time after — so the caller logs once per attach, not once per frame.
+	*/
+	takeLatency(deviceId, nowMs) {
+		const at = this.attachedAt.get(deviceId);
+		if (at === void 0) return null;
+		this.attachedAt.delete(deviceId);
+		return Math.max(0, nowMs - at);
+	}
+	/** A camera detached with no frame ever admitted — drop the mark so the
+	*  NEXT attach is not measured from this one. Returns whether one was
+	*  pending, which is itself the interesting fact: a session that ran and
+	*  fed the detector nothing. */
+	forget(deviceId) {
+		return this.attachedAt.delete(deviceId);
+	}
+};
+//#endregion
 //#region src/session-decode/fork-decode-worker.ts
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = (0, node_url.fileURLToPath)(new URL("../session-decode/decode-worker-child.js", require("url").pathToFileURL(__filename).href));
@@ -6434,6 +6479,8 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 		if (config.motionSources.includes("analyzer")) attachment.motionUnsubscribe = await this.subscribeMotionFrames(config);
 		const stepsCount = config.steps?.length ?? 0;
 		const dispatch = stepsCount > 0 ? `runPipeline(${stepsCount}step${stepsCount === 1 ? "" : "s"})` : config.steps !== void 0 ? "skip(0steps)" : "runFrame(legacy)";
+		const engineLabel = "node-local";
+		this.firstDetectionFrame.markAttached(config.deviceId, Date.now());
 		this.ctx.logger.info("attachCamera", {
 			tags: { deviceId: config.deviceId },
 			meta: {
@@ -6443,7 +6490,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 				detectionFps: config.detectionFps,
 				motionSources: config.motionSources,
 				dispatch,
-				engine: "node-local"
+				engine: engineLabel
 			}
 		});
 		return { success: true };
@@ -7292,10 +7339,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 	* no second dial, no second decode, no GPU). Mirrors the shm shared-motion
 	* seam (`subscribeMotionFrames` `shared` branch).
 	*/
+	/** Attach → first decoded detection frame, one line per attach. See
+	*  {@link FirstDetectionFrameTimer}. */
+	firstDetectionFrame = new FirstDetectionFrameTimer();
 	enqueueSharedDetectionFrame(deviceId, frame, handle, reservation) {
 		const runner = this.runner;
 		if (!runner) return false;
 		const admitted = reservation ? reservation.detection && runner.enqueueReservedDetectionFrame(deviceId, frame, handle) : runner.enqueueDetectionFrame(deviceId, frame, handle);
+		if (admitted) {
+			const latencyMs = this.firstDetectionFrame.takeLatency(deviceId, Date.now());
+			if (latencyMs !== null) this.ctx?.logger.info("session-decode: first detection frame after attach", {
+				tags: { deviceId },
+				meta: { latencyMs }
+			});
+		}
 		if (reservation?.motion) runner.enqueueMotionFrame(deviceId, rgbFrameToGrayFrame(frame), void 0);
 		else if (!reservation) {
 			const sink = this.sharedMotionSinks.get(deviceId);

package/dist/pipeline-runner/index.mjs

@@ -1,7 +1,7 @@
-import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-D0liXHO7.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CQ6VBSrE.mjs";
-import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry--_WjAPa2.mjs";
-import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-CAWMqnxs.mjs";
+import { B as defineCustomActions, Bt as nodePin, Ft as createEvent, Gt as _enum, H as deriveDetailCropRect, Kt as array, L as customAction, Qt as object, X as failureContributionCapability, Xt as literal, Yt as lazy, Zt as number, _ as FailureCounters, en as string, et as loadContributionCapability, ft as pipelineRunnerCapability, jt as BaseAddon, lt as pickDetailCropConvention, m as DEVICE_BACKEND_TO_FORMAT, nn as EventCategory, p as DEFAULT_NATIVE_LEASE_SETTINGS, qt as boolean, u as DEFAULT_DETAIL_CROP_CONVENTION, ut as pickNativeLeaseOverride, wt as errMsg } from "../dist-D35w3ngN.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-B2NS7cyi.mjs";
+import { c as getStepDefinition, n as resolveFrameViewGeometry, t as localFrameRegistry } from "../local-frame-registry-AtRvlifj.mjs";
+import { a as nativeLeaseSettingEnv, t as isWorkerReply } from "../worker-protocol-B7PzysnJ.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 import { n as withDetectionIntent } from "../restream-intent-B4BXZra7.mjs";
@@ -12,6 +12,51 @@ import sharp from "sharp";
 import { fileURLToPath } from "node:url";
 import { PerformanceObserver } from "node:perf_hooks";
 import * as os from "node:os";
+//#region src/pipeline-runner/first-detection-frame.ts
+/**
+* How long a camera waits, after `attachCamera`, before a decoded frame
+* actually reaches the detection queue.
+*
+* The orchestrator already measures `session motion → attach latency` and it
+* is small — 11, 13 and 18 ms across three consecutive sessions on the same
+* camera. What nothing measured is the NEXT leg: from the attach to the first
+* frame the detector is given. An operator reporting "detection starts late"
+* is describing that leg, and answering them required reading the timestamps
+* of unrelated INFO lines and inferring — which produced a wrong first answer
+* (the absence of a `frame processed` line means the frame produced nothing
+* notable, not that no frame arrived).
+*
+* One number, once per attach, so a slow start is a value rather than an
+* inference.
+*/
+/** Pending attach marks, keyed by device. */
+var FirstDetectionFrameTimer = class {
+	attachedAt = /* @__PURE__ */ new Map();
+	/** A camera attached. Replaces any pending mark: the newest attach is the
+	*  one the next frame belongs to. */
+	markAttached(deviceId, nowMs) {
+		this.attachedAt.set(deviceId, nowMs);
+	}
+	/**
+	* A decoded frame was admitted to the detection queue. Returns the elapsed
+	* ms since the attach the FIRST time it is called after one, and `null`
+	* every time after — so the caller logs once per attach, not once per frame.
+	*/
+	takeLatency(deviceId, nowMs) {
+		const at = this.attachedAt.get(deviceId);
+		if (at === void 0) return null;
+		this.attachedAt.delete(deviceId);
+		return Math.max(0, nowMs - at);
+	}
+	/** A camera detached with no frame ever admitted — drop the mark so the
+	*  NEXT attach is not measured from this one. Returns whether one was
+	*  pending, which is itself the interesting fact: a session that ran and
+	*  fed the detector nothing. */
+	forget(deviceId) {
+		return this.attachedAt.delete(deviceId);
+	}
+};
+//#endregion
 //#region src/session-decode/fork-decode-worker.ts
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = fileURLToPath(new URL("../session-decode/decode-worker-child.js", import.meta.url));
@@ -6427,6 +6472,8 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 		if (config.motionSources.includes("analyzer")) attachment.motionUnsubscribe = await this.subscribeMotionFrames(config);
 		const stepsCount = config.steps?.length ?? 0;
 		const dispatch = stepsCount > 0 ? `runPipeline(${stepsCount}step${stepsCount === 1 ? "" : "s"})` : config.steps !== void 0 ? "skip(0steps)" : "runFrame(legacy)";
+		const engineLabel = "node-local";
+		this.firstDetectionFrame.markAttached(config.deviceId, Date.now());
 		this.ctx.logger.info("attachCamera", {
 			tags: { deviceId: config.deviceId },
 			meta: {
@@ -6436,7 +6483,7 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 				detectionFps: config.detectionFps,
 				motionSources: config.motionSources,
 				dispatch,
-				engine: "node-local"
+				engine: engineLabel
 			}
 		});
 		return { success: true };
@@ -7285,10 +7332,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends BaseAddon {
 	* no second dial, no second decode, no GPU). Mirrors the shm shared-motion
 	* seam (`subscribeMotionFrames` `shared` branch).
 	*/
+	/** Attach → first decoded detection frame, one line per attach. See
+	*  {@link FirstDetectionFrameTimer}. */
+	firstDetectionFrame = new FirstDetectionFrameTimer();
 	enqueueSharedDetectionFrame(deviceId, frame, handle, reservation) {
 		const runner = this.runner;
 		if (!runner) return false;
 		const admitted = reservation ? reservation.detection && runner.enqueueReservedDetectionFrame(deviceId, frame, handle) : runner.enqueueDetectionFrame(deviceId, frame, handle);
+		if (admitted) {
+			const latencyMs = this.firstDetectionFrame.takeLatency(deviceId, Date.now());
+			if (latencyMs !== null) this.ctx?.logger.info("session-decode: first detection frame after attach", {
+				tags: { deviceId },
+				meta: { latencyMs }
+			});
+		}
 		if (reservation?.motion) runner.enqueueMotionFrame(deviceId, rgbFrameToGrayFrame(frame), void 0);
 		else if (!reservation) {
 			const sink = this.sharedMotionSinks.get(deviceId);

package/dist/{process-memory-DjLHImhM.mjs → process-memory-BFuXzmyZ.mjs}

@@ -1,4 +1,4 @@
-import { ot as parseProcStatus } from "./dist-D0liXHO7.mjs";
+import { ot as parseProcStatus } from "./dist-D35w3ngN.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/{process-memory-CH3OIHHe.js → process-memory-DR2vCoO6.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-M39Js6iu.js");
+const require_dist = require("./dist-DSJDq5hY.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/recorder/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-M39Js6iu.js");
-const require_node = require("../node-Byy6tlFm.js");
+const require_dist = require("../dist-DSJDq5hY.js");
+const require_node = require("../node-DVcGI_Kr.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
@@ -5077,6 +5077,48 @@ function buildExportArgs(input) {
 * queue behind each other.
 */
 /**
+* The storage class export MP4s live in: `artifacts`, SHARED with the
+* notification-center's artifact shelf (operator 2026-09-04: one generic
+* class, not one per producer — D341), a declared SINGLETON. Never the addon
+* data dir: 8.4 GB of operator-exported clips sat in
+* `addons-data/recorder/exports`, inside every system backup, invisible to
+* occupancy and relocation, on the constrained appdata disk. And never a
+* `recordings`-class subtree: footage classes are quota-capped and swept, and
+* an export is something the operator DELIBERATELY created — its only
+* retention is its own (`expiresAt` chosen at creation + delete-after-
+* download), enforced by the export janitor and nothing else. Sharing the
+* LOCATION with the notification shelf never means sharing a SWEEP: each
+* tenant walks only its own subtree.
+*
+* Declared by BOTH consuming addons with identical cardinality — the
+* registry throws at kernel boot on a conflict, and each addon's pinning
+* spec holds its side of the agreement.
+*/
+var ARTIFACTS_MEDIA_LOCATION = "artifacts";
+/**
+* `<root>/<deviceId>/exports/` — the exports TENANT subtree, DEVICE-FIRST
+* like the notification shelf's `<root>/<deviceId>/nc-artifacts/…` (operator
+* 2026-09-04: one directory per camera answers "what does this camera hold",
+* and per-device occupancy is uniform across both tenants). The ONE
+* derivation of the tenant dir — export MP4s, source playlists and the
+* ffconcat sidecar all live here; nothing may join the path a second way.
+*/
+function exportTenantDirFor(root, deviceId) {
+	return node_path.default.join(root, String(deviceId), "exports");
+}
+/**
+* `<root>/<deviceId>/exports/<exportId>.mp4` — the ONE derivation of an
+* export's file path, via {@link exportTenantDirFor}. Rows store no path, so
+* repointing the class root moves the whole library while every row keeps
+* resolving. A `null` root (location not yet resolved, or unresolvable)
+* REFUSES: falling back to the addon data dir is the failure mode this class
+* exists to end (D341).
+*/
+function exportOutPathFor(root, deviceId, exportId) {
+	if (root === null) throw new Error("artifacts storage location is not resolved — exports refuse rather than fall back to the addon data dir (D341)");
+	return node_path.default.join(exportTenantDirFor(root, deviceId), `${exportId}.mp4`);
+}
+/**
 * @durable class=ledger owner=recorder
 *   write="one row per export job, inserted by `createExport` and rewritten by the
 *     render engine's progress/state patches and by the download hook"
@@ -7404,18 +7446,21 @@ function buildRecordingProvider(deps) {
 */
 /**
 * Absolute path of ONE export's source playlist:
-* `<exportsDir>/<deviceId>/<exportId>.src.m3u8`. Unique per export id, so two
-* concurrent renders (and any concurrent playback request) never share a file.
+* `<root>/<deviceId>/exports/<exportId>.src.m3u8` — inside the exports
+* TENANT subtree of the shared `artifacts` class root, derived through
+* {@link exportTenantDirFor} so no caller can join the path a second way.
+* Unique per export id, so two concurrent renders (and any concurrent
+* playback request) never share a file.
 */
 function exportSourcePlaylistPath(exportsDir, deviceId, exportId) {
-	return node_path.default.join(exportsDir, String(deviceId), `${exportId}.src.m3u8`);
+	return node_path.default.join(exportTenantDirFor(exportsDir, deviceId), `${exportId}.src.m3u8`);
 }
 /**
 * Absolute path of the same export's FFCONCAT list — the timelapse pass-1
 * input (`buildConcatPassArgs`). Sibling of the m3u8, same uniqueness rules.
 */
 function exportSourceConcatPath(exportsDir, deviceId, exportId) {
-	return node_path.default.join(exportsDir, String(deviceId), `${exportId}.src.ffconcat`);
+	return node_path.default.join(exportTenantDirFor(exportsDir, deviceId), `${exportId}.src.ffconcat`);
 }
 /**
 * Write the export's source playlist and return it, or null when no segment of
@@ -16377,6 +16422,14 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	*  Every other node stays fully inert — registers no providers, serves no
 	*  playback, runs no controller. Resolved in `onInitialize`. */
 	isRecordingNode = true;
+	/**
+	* Resolved root of the shared `artifacts` storage location — the export
+	* MP4s' home and the GIF/clip render scratch. `null` until `onHubReachable`
+	* resolves it (and forever if the location is unreachable): every consumer
+	* then REFUSES with a named error instead of falling back to the addon data
+	* dir (D341).
+	*/
+	exportsRoot = null;
 	index = new RecordingIndex();
 	/**
 	* Stops the GC-attributing stall monitor armed in {@link onInitialize}.
@@ -16792,12 +16845,12 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			relocate: relocateEngine,
 			gifRender: (input) => renderGif({
 				deps: recordingDeps,
-				exportsDir: node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				exportsDir: this.exportsDirOrThrow(),
 				spawn: node_child_process.spawn
 			}, input),
 			clipRender: (input) => renderClip({
 				deps: recordingDeps,
-				exportsDir: node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				exportsDir: this.exportsDirOrThrow(),
 				spawn: node_child_process.spawn
 			}, input),
 			locations: () => this.resolvedLocations,
@@ -16912,8 +16965,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			}
 		});
 		const exportsState = this.exportsStore();
-		const exportsDir = node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX);
-		const exportOutPath = (rec) => node_path.default.join(exportsDir, String(rec.deviceId), `${rec.id}.mp4`);
+		const exportOutPath = (rec) => exportOutPathFor(this.exportsRoot, rec.deviceId, rec.id);
 		const removeExportFile = async (p) => {
 			await node_fs.promises.rm(p, { force: true });
 		};
@@ -16925,7 +16977,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				await node_fs.promises.mkdir(node_path.default.dirname(exportOutPath(rec)), { recursive: true });
 				return writeExportSourcePlaylist({
 					deps: recordingDeps,
-					exportsDir,
+					exportsDir: this.exportsDirOrThrow(),
 					exportId: rec.id,
 					deviceId: rec.deviceId,
 					profile: rec.profile,
@@ -17160,6 +17212,18 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	async onHubReachable() {
 		if (!this.isRecordingNode) return;
 		await this.refreshLocations();
+		try {
+			this.exportsRoot = await this.ctx.api.storage.resolve.query({
+				location: ARTIFACTS_MEDIA_LOCATION,
+				relativePath: ""
+			});
+		} catch (err) {
+			this.ctx.logger.error("artifacts storage location is NOT available — exports, GIF and clip renders will REFUSE until it is", { meta: {
+				location: ARTIFACTS_MEDIA_LOCATION,
+				error: require_dist.errMsg(err),
+				hint: "the declaration is seeded when a storage-provider registers; restart this node so the manifest is re-read, or create an artifacts location. Refusing is deliberate — the addon data dir carries no media (D341)."
+			} });
+		}
 		if (this.resolvedLocations.length === 0) {
 			this.ctx.logger.warn("recorder: no recordings storage locations resolved — index not hydrated");
 			return;
@@ -17393,6 +17457,10 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
+		if (this.exportsRoot === null) {
+			this.ctx.logger.warn("recorder: exports bootstrap skipped — artifacts location unresolved");
+			return;
+		}
 		try {
 			await reconcileInterruptedExports({
 				state: this.exportsStore(),
@@ -17947,11 +18015,21 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 	placementStore() {
 		return this.state(RECORDING_PLACEMENT_KEY, RecordingPlacementBlobSchema, EMPTY_PLACEMENT);
 	}
+	/** The artifacts class ROOT, or a NAMED refusal — never an invented path.
+	*  Every export-side path (MP4s, playlists, render scratch) derives from it
+	*  through `exportTenantDirFor` → `<root>/<deviceId>/exports/…`, beside
+	*  (never inside) the notification shelf's `<root>/<deviceId>/nc-artifacts/…`
+	*  sibling (D341). No consumer joins the path a second way. */
+	exportsDirOrThrow() {
+		const root = this.exportsRoot;
+		if (root === null) throw new Error("artifacts storage location is not resolved — exports and footage renders refuse rather than fall back to the addon data dir (D341)");
+		return root;
+	}
 	/** Retention deps shared by the sweep and the download-complete hook. */
 	exportJanitorDeps() {
 		return {
 			state: this.exportsStore(),
-			outPath: (rec) => node_path.default.join(this.ctx.dataDir, EXPORTS_PREFIX, String(rec.deviceId), `${rec.id}.mp4`),
+			outPath: (rec) => exportOutPathFor(this.exportsRoot, rec.deviceId, rec.id),
 			removeFile: async (p) => {
 				await node_fs.promises.rm(p, { force: true });
 			}
@@ -18007,7 +18085,13 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			res.writeHead(404).end();
 			return;
 		}
-		const absPath = outPath(rec);
+		let absPath;
+		try {
+			absPath = outPath(rec);
+		} catch {
+			res.writeHead(503).end();
+			return;
+		}
 		let size;
 		try {
 			const st = await node_fs.promises.stat(absPath);

package/dist/recorder/index.mjs

@@ -1,5 +1,5 @@
-import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, Gt as _enum, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Wt as sleep$1, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-D0liXHO7.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-CQ6VBSrE.mjs";
+import { $ as isFirstLevelMacroClass, $t as record, B as defineCustomActions, Bt as nodePin, E as RecordingConfigSchema, Gt as _enum, It as hydrateSchema, J as evaluateSensorEdge, Kt as array, L as customAction, N as batteryCapability, Nt as DeviceFeature, Pt as DeviceType, Qt as object, T as RECORDING_EXPORT_MAX_READ_BYTES, U as deriveRecordingMode, Ut as selectAssignedProfileSlots, V as deriveBatteryPresence, Wt as sleep$1, Zt as number, bt as storageEvictableCapability, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as string, et as loadContributionCapability, g as ExportRecordSchema, i as BatteryStatusSchema, jt as BaseAddon, mt as recordingExportCapability, nn as EventCategory, pt as recordingCapability, qt as boolean, vt as resolveRecordingProfiles, wt as errMsg, x as OpsLogEntrySchema } from "../dist-D35w3ngN.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-B2NS7cyi.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
@@ -5071,6 +5071,48 @@ function buildExportArgs(input) {
 * queue behind each other.
 */
 /**
+* The storage class export MP4s live in: `artifacts`, SHARED with the
+* notification-center's artifact shelf (operator 2026-09-04: one generic
+* class, not one per producer — D341), a declared SINGLETON. Never the addon
+* data dir: 8.4 GB of operator-exported clips sat in
+* `addons-data/recorder/exports`, inside every system backup, invisible to
+* occupancy and relocation, on the constrained appdata disk. And never a
+* `recordings`-class subtree: footage classes are quota-capped and swept, and
+* an export is something the operator DELIBERATELY created — its only
+* retention is its own (`expiresAt` chosen at creation + delete-after-
+* download), enforced by the export janitor and nothing else. Sharing the
+* LOCATION with the notification shelf never means sharing a SWEEP: each
+* tenant walks only its own subtree.
+*
+* Declared by BOTH consuming addons with identical cardinality — the
+* registry throws at kernel boot on a conflict, and each addon's pinning
+* spec holds its side of the agreement.
+*/
+var ARTIFACTS_MEDIA_LOCATION = "artifacts";
+/**
+* `<root>/<deviceId>/exports/` — the exports TENANT subtree, DEVICE-FIRST
+* like the notification shelf's `<root>/<deviceId>/nc-artifacts/…` (operator
+* 2026-09-04: one directory per camera answers "what does this camera hold",
+* and per-device occupancy is uniform across both tenants). The ONE
+* derivation of the tenant dir — export MP4s, source playlists and the
+* ffconcat sidecar all live here; nothing may join the path a second way.
+*/
+function exportTenantDirFor(root, deviceId) {
+	return path.join(root, String(deviceId), "exports");
+}
+/**
+* `<root>/<deviceId>/exports/<exportId>.mp4` — the ONE derivation of an
+* export's file path, via {@link exportTenantDirFor}. Rows store no path, so
+* repointing the class root moves the whole library while every row keeps
+* resolving. A `null` root (location not yet resolved, or unresolvable)
+* REFUSES: falling back to the addon data dir is the failure mode this class
+* exists to end (D341).
+*/
+function exportOutPathFor(root, deviceId, exportId) {
+	if (root === null) throw new Error("artifacts storage location is not resolved — exports refuse rather than fall back to the addon data dir (D341)");
+	return path.join(exportTenantDirFor(root, deviceId), `${exportId}.mp4`);
+}
+/**
 * @durable class=ledger owner=recorder
 *   write="one row per export job, inserted by `createExport` and rewritten by the
 *     render engine's progress/state patches and by the download hook"
@@ -7398,18 +7440,21 @@ function buildRecordingProvider(deps) {
 */
 /**
 * Absolute path of ONE export's source playlist:
-* `<exportsDir>/<deviceId>/<exportId>.src.m3u8`. Unique per export id, so two
-* concurrent renders (and any concurrent playback request) never share a file.
+* `<root>/<deviceId>/exports/<exportId>.src.m3u8` — inside the exports
+* TENANT subtree of the shared `artifacts` class root, derived through
+* {@link exportTenantDirFor} so no caller can join the path a second way.
+* Unique per export id, so two concurrent renders (and any concurrent
+* playback request) never share a file.
 */
 function exportSourcePlaylistPath(exportsDir, deviceId, exportId) {
-	return path.join(exportsDir, String(deviceId), `${exportId}.src.m3u8`);
+	return path.join(exportTenantDirFor(exportsDir, deviceId), `${exportId}.src.m3u8`);
 }
 /**
 * Absolute path of the same export's FFCONCAT list — the timelapse pass-1
 * input (`buildConcatPassArgs`). Sibling of the m3u8, same uniqueness rules.
 */
 function exportSourceConcatPath(exportsDir, deviceId, exportId) {
-	return path.join(exportsDir, String(deviceId), `${exportId}.src.ffconcat`);
+	return path.join(exportTenantDirFor(exportsDir, deviceId), `${exportId}.src.ffconcat`);
 }
 /**
 * Write the export's source playlist and return it, or null when no segment of
@@ -16371,6 +16416,14 @@ var RecorderV2Addon = class extends BaseAddon {
 	*  Every other node stays fully inert — registers no providers, serves no
 	*  playback, runs no controller. Resolved in `onInitialize`. */
 	isRecordingNode = true;
+	/**
+	* Resolved root of the shared `artifacts` storage location — the export
+	* MP4s' home and the GIF/clip render scratch. `null` until `onHubReachable`
+	* resolves it (and forever if the location is unreachable): every consumer
+	* then REFUSES with a named error instead of falling back to the addon data
+	* dir (D341).
+	*/
+	exportsRoot = null;
 	index = new RecordingIndex();
 	/**
 	* Stops the GC-attributing stall monitor armed in {@link onInitialize}.
@@ -16786,12 +16839,12 @@ var RecorderV2Addon = class extends BaseAddon {
 			relocate: relocateEngine,
 			gifRender: (input) => renderGif({
 				deps: recordingDeps,
-				exportsDir: path.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				exportsDir: this.exportsDirOrThrow(),
 				spawn
 			}, input),
 			clipRender: (input) => renderClip({
 				deps: recordingDeps,
-				exportsDir: path.join(this.ctx.dataDir, EXPORTS_PREFIX),
+				exportsDir: this.exportsDirOrThrow(),
 				spawn
 			}, input),
 			locations: () => this.resolvedLocations,
@@ -16906,8 +16959,7 @@ var RecorderV2Addon = class extends BaseAddon {
 			}
 		});
 		const exportsState = this.exportsStore();
-		const exportsDir = path.join(this.ctx.dataDir, EXPORTS_PREFIX);
-		const exportOutPath = (rec) => path.join(exportsDir, String(rec.deviceId), `${rec.id}.mp4`);
+		const exportOutPath = (rec) => exportOutPathFor(this.exportsRoot, rec.deviceId, rec.id);
 		const removeExportFile = async (p) => {
 			await promises.rm(p, { force: true });
 		};
@@ -16919,7 +16971,7 @@ var RecorderV2Addon = class extends BaseAddon {
 				await promises.mkdir(path.dirname(exportOutPath(rec)), { recursive: true });
 				return writeExportSourcePlaylist({
 					deps: recordingDeps,
-					exportsDir,
+					exportsDir: this.exportsDirOrThrow(),
 					exportId: rec.id,
 					deviceId: rec.deviceId,
 					profile: rec.profile,
@@ -17154,6 +17206,18 @@ var RecorderV2Addon = class extends BaseAddon {
 	async onHubReachable() {
 		if (!this.isRecordingNode) return;
 		await this.refreshLocations();
+		try {
+			this.exportsRoot = await this.ctx.api.storage.resolve.query({
+				location: ARTIFACTS_MEDIA_LOCATION,
+				relativePath: ""
+			});
+		} catch (err) {
+			this.ctx.logger.error("artifacts storage location is NOT available — exports, GIF and clip renders will REFUSE until it is", { meta: {
+				location: ARTIFACTS_MEDIA_LOCATION,
+				error: errMsg(err),
+				hint: "the declaration is seeded when a storage-provider registers; restart this node so the manifest is re-read, or create an artifacts location. Refusing is deliberate — the addon data dir carries no media (D341)."
+			} });
+		}
 		if (this.resolvedLocations.length === 0) {
 			this.ctx.logger.warn("recorder: no recordings storage locations resolved — index not hydrated");
 			return;
@@ -17387,6 +17451,10 @@ var RecorderV2Addon = class extends BaseAddon {
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
+		if (this.exportsRoot === null) {
+			this.ctx.logger.warn("recorder: exports bootstrap skipped — artifacts location unresolved");
+			return;
+		}
 		try {
 			await reconcileInterruptedExports({
 				state: this.exportsStore(),
@@ -17941,11 +18009,21 @@ var RecorderV2Addon = class extends BaseAddon {
 	placementStore() {
 		return this.state(RECORDING_PLACEMENT_KEY, RecordingPlacementBlobSchema, EMPTY_PLACEMENT);
 	}
+	/** The artifacts class ROOT, or a NAMED refusal — never an invented path.
+	*  Every export-side path (MP4s, playlists, render scratch) derives from it
+	*  through `exportTenantDirFor` → `<root>/<deviceId>/exports/…`, beside
+	*  (never inside) the notification shelf's `<root>/<deviceId>/nc-artifacts/…`
+	*  sibling (D341). No consumer joins the path a second way. */
+	exportsDirOrThrow() {
+		const root = this.exportsRoot;
+		if (root === null) throw new Error("artifacts storage location is not resolved — exports and footage renders refuse rather than fall back to the addon data dir (D341)");
+		return root;
+	}
 	/** Retention deps shared by the sweep and the download-complete hook. */
 	exportJanitorDeps() {
 		return {
 			state: this.exportsStore(),
-			outPath: (rec) => path.join(this.ctx.dataDir, EXPORTS_PREFIX, String(rec.deviceId), `${rec.id}.mp4`),
+			outPath: (rec) => exportOutPathFor(this.exportsRoot, rec.deviceId, rec.id),
 			removeFile: async (p) => {
 				await promises.rm(p, { force: true });
 			}
@@ -18001,7 +18079,13 @@ var RecorderV2Addon = class extends BaseAddon {
 			res.writeHead(404).end();
 			return;
 		}
-		const absPath = outPath(rec);
+		let absPath;
+		try {
+			absPath = outPath(rec);
+		} catch {
+			res.writeHead(503).end();
+			return;
+		}
 		let size;
 		try {
 			const st = await promises.stat(absPath);

package/dist/{segment-demux-js-B0KzROD9.js → segment-demux-js-CeJfEP5v.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-M39Js6iu.js");
+const require_dist = require("./dist-DSJDq5hY.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/{segment-demux-js-Bmy3u2VM.mjs → segment-demux-js-wtPM5v2H.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { wt as errMsg } from "./dist-D0liXHO7.mjs";
+import { wt as errMsg } from "./dist-D35w3ngN.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-NB-CjUQf.js");
-const require_lazy_sharp = require("../lazy-sharp-CO-c2L9_.js");
+const require_worker_protocol = require("../worker-protocol-wr4XEhUh.js");
+const require_lazy_sharp = require("../lazy-sharp-Fre6HHg6.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,4 +1,4 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-CAWMqnxs.mjs";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-B7PzysnJ.mjs";
 import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 //#region src/session-decode/color-conversion.ts
 /**