@camstack/addon-pipeline 1.2.196 → 1.2.197

package/dist/recorder/index.js

@@ -2,12 +2,12 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-HG5geL9t.js");
-const require_node = require("../node--my8JTOW.js");
+const require_dist = require("../dist-CBa1j3On.js");
+const require_node = require("../node-C-B8VuGi.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-Cv9x3jmu.js");
 const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-DaUBcb13.js");
-const require_retire_root_keys = require("../retire-root-keys-KE6D6Xh_.js");
+const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
@@ -3884,6 +3884,31 @@ var CalendarIndex = class {
 //#endregion
 //#region src/recorder/addon/config-store.ts
 /**
+* Per-device recording-config persistence for the recorder addon.
+*
+* ONE ROW PER CAMERA in `recorder:recording-configs`, through
+* {@link RowMapStore}. Asking what camera 617 records is a primary-key lookup;
+* saving its config writes that row and touches no other.
+*
+* ## What this replaced, and why
+*
+* Until the 2026-08-19 flatten every camera's `RecordingConfig` lived in ONE
+* key of the recorder's `addon-settings` / `root` blob — a row that was 201 833
+* bytes on the reference hub, because the ops-log and the export history shared
+* it. So `loadDeviceConfig(617)` read and `JSON.parse`d 201 KB, and
+* `saveDeviceConfig` read that, merged, and rewrote it. The staging walk did it
+* once per device and lost 45–267 s of a boot to it (2026-08-18); teaching the
+* walk to read the map once capped the symptom, and this removes the cause.
+*
+* ## Failure direction
+*
+* `RecordingConfigSchema` rejects unknown keys so a stale caller fails loudly,
+* but a row written by an older build may still carry retired ones — `.strip()`
+* drops them. And validation is now PER ROW: one unparseable camera costs that
+* camera, where the blob's single `safeParse` took every camera down to the
+* empty fallback (= the whole fleet silently unconfigured).
+*/
+/**
 * @durable class=config owner=recorder
 *   write="one row per camera, written by `saveDeviceConfig` (the `recording` cap's
 *     setConfig / band authoring) — the only writer"
@@ -3893,7 +3918,7 @@ var CalendarIndex = class {
 var RECORDING_CONFIGS_COLLECTION = "recorder:recording-configs";
 var RECORDING_CONFIGS_SPEC = {
 	collection: RECORDING_CONFIGS_COLLECTION,
-	schema: require_dist.RecordingConfigSchema.strip(),
+	schema: require_dist.preprocess((raw) => require_dist.migrateLegacyDeviceSignalConfig(raw).value, require_dist.RecordingConfigSchema.strip()),
 	columns: [
 		{
 			name: "deviceId",
@@ -3959,7 +3984,10 @@ async function loadDeviceConfig(state, deviceId) {
 */
 function deviceIdsWithLostBands(configs) {
 	const lost = [];
-	for (const [deviceId, config] of configs) if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	for (const [deviceId, config] of configs) {
+		if (config.deviceDecision === true) continue;
+		if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	}
 	return lost.toSorted((a, b) => a - b);
 }
 /** Boot-time check: log the {@link deviceIdsWithLostBands} once, if any. */
@@ -3969,6 +3997,48 @@ async function warnLostBands(state, logger) {
 	logger.warn(`recording config: device(s) ${lost.join(", ")} claim a recording mode but have NO bands — a pre-retirement config that lost its legacy authoring fields. Nothing is recorded for them until their bands are re-authored.`);
 }
 /**
+* Persist the D371→D380 shape for every stored row — the migration, in code,
+* run once per boot and IDEMPOTENT: a second run finds no legacy key and
+* writes nothing.
+*
+* It reads the rows RAW ({@link RowMapStore.readAllRaw}) on purpose. The read
+* schema already migrates in memory, so by the time `readAll` answers there is
+* nothing left to recognise — and the retired key is stripped by a non-strict
+* `z.object`, so the migration would look like it had nothing to do on exactly
+* the row it exists for.
+*
+* Both outcomes are logged, because both change what a camera records and
+* silence would read as "nothing happened" — which is what a stripped key
+* looks like from the outside.
+*/
+async function migrateLegacyDeviceSignalRows(state, logger) {
+	const migrated = [];
+	const stripped = [];
+	for (const [key, raw] of await state.readAllRaw()) {
+		const outcome = require_dist.migrateLegacyDeviceSignalConfig(raw);
+		if (!outcome.migrated && !outcome.strippedOnly) continue;
+		const deviceId = Number(key);
+		if (!Number.isInteger(deviceId)) continue;
+		const parsed = require_dist.RecordingConfigSchema.strip().safeParse(outcome.value);
+		if (!parsed.success) {
+			logger.warn("recording config: legacy device-signal row could not be migrated", {
+				tags: { deviceId },
+				meta: { error: parsed.error.message }
+			});
+			continue;
+		}
+		await saveDeviceConfig(state, deviceId, parsed.data);
+		if (outcome.migrated) migrated.push(deviceId);
+		else stripped.push(deviceId);
+	}
+	if (migrated.length > 0) logger.info("recording config: migrated to the on-device-decision mode (the retired band trigger)", { meta: { deviceIds: migrated } });
+	if (stripped.length > 0) logger.warn("recording config: a band mixed the retired device-signal trigger with others — the key was dropped and the band kept. These cameras no longer follow their own signal until the on-device-decision mode is selected for them.", { meta: { deviceIds: stripped } });
+	return {
+		migrated,
+		stripped
+	};
+}
+/**
 * Persist (insert or replace) a device's config — ONE row. Validates against
 * `RecordingConfigSchema` at the boundary (untrusted cap input). Returns the
 * validated config that was persisted.
@@ -12462,6 +12532,13 @@ function bandActiveAt(band, date) {
 	if (s > e) return applies(wd) && t >= s || applies(prevWd) && t < e;
 	return applies(wd);
 }
+/**
+* The band covering `date`, or null. GENERIC over the band type so the caller
+* gets back exactly what it put in: the recorder decides on `EffectiveBand`s
+* (`band-decision.ts`), which carry the one non-authored fact — that the DEVICE
+* decides — and a return type widened to `RecordingBand` would erase it right
+* where the gates read it.
+*/
 function activeBandAt(config, date) {
 	return config.bands.find((b) => bandActiveAt(b, date)) ?? null;
 }
@@ -12486,6 +12563,37 @@ function activeBandAt(config, date) {
 * unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
 */
 /**
+* THE band a `deviceDecision` config decides through: always on (every day,
+* `start === end` — the band engine's always-on shape), `events`, and listening
+* to exactly one source, the camera's own level.
+*
+* Its buffers are the canonical pad ({@link DEFAULT_EVENTS_BAND_BUFFER_SEC}),
+* not per-camera knobs: this mode's whole contract with the operator is ONE
+* flag. The pad only ever retains footage around an episode the device itself
+* delimited, so there is nothing here for an operator to tune.
+*/
+var DEVICE_DECISION_BAND = Object.freeze({
+	days: [],
+	start: "00:00",
+	end: "00:00",
+	mode: "events",
+	deviceSignal: true,
+	preBufferSec: require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec,
+	postBufferSec: require_dist.DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec
+});
+/**
+* THE bands the recorder decides on for a config — the ONE place
+* `config.bands` is turned into what the gates read.
+*
+* `deviceDecision` resolves to {@link DEVICE_DECISION_BAND} and to nothing
+* else; every other config is its own authored bands, byte for byte. Because
+* the schema makes the two exclusive, this is a choice and never a merge.
+*/
+function effectiveBands(config) {
+	if (config.deviceDecision === true) return [DEVICE_DECISION_BAND];
+	return config.bands ?? [];
+}
+/**
 * THE one place a band's pre/post buffers are read. An ABSENT field takes
 * {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
 * is honoured verbatim.
@@ -12526,6 +12634,9 @@ function triggerKey(source) {
 		case "signal": return "signal";
 	}
 }
+/** The single source {@link DEVICE_DECISION_BAND} listens to, shared so the
+*  band never allocates a new one per call. */
+var SIGNAL_SOURCES = Object.freeze([{ kind: "signal" }]);
 /**
 * LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
 * una banda diventano `TriggerSource[]`.
@@ -12541,6 +12652,7 @@ function triggerKey(source) {
 * denuncia invece di restare zitto.
 */
 function bandTriggerSources(band) {
+	if (band.deviceSignal === true) return SIGNAL_SOURCES;
 	const t = band.triggers;
 	if (t === void 0) return [];
 	const sources = [];
@@ -12554,7 +12666,6 @@ function bandTriggerSources(band) {
 		kind: "sensor",
 		sourceDeviceId
 	});
-	if (t.deviceSignal === true) sources.push({ kind: "signal" });
 	return sources;
 }
 /**
@@ -12740,8 +12851,8 @@ function eventsBandDemanded(band, triggers, atMs) {
 */
 function shouldRecordAt(config, triggers, at) {
 	if (!config.enabled) return false;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return false;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return false;
 	const band = activeBandAt({ bands }, at);
 	if (!band) return false;
 	if (band.mode === "continuous") return true;
@@ -12996,8 +13107,8 @@ function candidateEdgesMs(bands, nowMs) {
 * costs one wasted wake-up and never costs footage.
 */
 function nextBandEdgeMs(config, nowMs) {
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const current = activeBandAt({ bands }, new Date(nowMs));
 	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
 	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
@@ -13032,8 +13143,8 @@ function eventsWindowCloseMs(band, triggers, nowMs) {
 function nextDecisionChangeAt(input) {
 	const { config, triggers, nowMs } = input;
 	if (!config.enabled) return null;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const band = activeBandAt({ bands }, new Date(nowMs));
 	const edgeMs = nextBandEdgeMs(config, nowMs);
 	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
@@ -14503,7 +14614,7 @@ var RecordingController = class {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
 			const nowMs = this.now();
-			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
+			const band = activeBandAt({ bands: effectiveBands(config) }, new Date(nowMs));
 			if (!band || band.mode !== "events") return;
 			const { postMs } = resolveBandBufferMs(band);
 			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
@@ -14910,7 +15021,7 @@ var RecordingController = class {
 		if (this.stopped) return;
 		let band;
 		try {
-			band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 		} catch (err) {
 			this.deps.logger.warn("recorder: audio trigger qualification skipped — config read failed", {
 				tags: { deviceId },
@@ -14935,7 +15046,7 @@ var RecordingController = class {
 	*/
 	async postBufferMsFor(deviceId, atMs) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 			if (band) return resolveBandBufferMs(band).postMs;
 		} catch (err) {
 			this.deps.logger.warn("recorder: trigger history using the DEFAULT post-buffer — config read failed", {
@@ -15026,7 +15137,7 @@ var RecordingController = class {
 	reportUnrecordable(deviceId, config) {
 		if (!config.enabled) return;
 		if (this.unrecordableReported.has(deviceId)) return;
-		const bands = config.bands ?? [];
+		const bands = effectiveBands(config);
 		if (bands.length === 0) {
 			this.unrecordableReported.add(deviceId);
 			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
@@ -15363,7 +15474,7 @@ var RecordingController = class {
 	*/
 	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(startMs + durMs));
 			const triggers = this.triggersFor(deviceId);
 			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
 				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
@@ -17367,7 +17478,9 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 				watchIntervalMs: this.config.watchIntervalMs
 			}
 		});
-		warnLostBands(this.configStore(), this.ctx.logger);
+		migrateLegacyDeviceSignalRows(this.configStore(), this.ctx.logger).catch((err) => {
+			this.ctx.logger.warn("recorder: device-signal config migration failed", { meta: { error: require_dist.errMsg(err) } });
+		}).then(() => warnLostBands(this.configStore(), this.ctx.logger));
 		const providers = [
 			{
 				capability: require_dist.recordingCapability,

package/dist/recorder/index.mjs

@@ -1,9 +1,9 @@
-import { $t as number, D as RecordingSignalStatusSchema, E as RecordingConfigSchema, Et as errMsg, Ft as DeviceFeature, Gt as selectAssignedProfileSlots, H as deriveBatteryPresence, Ht as nodePin, It as DeviceType, Jt as array, Kt as sleep$1, Nt as BaseAddon, P as batteryCapability, R as customAction, Rt as hydrateSchema, St as storageEvictableCapability, T as RECORDING_EXPORT_MAX_READ_BYTES, V as defineCustomActions, W as deriveRecordingMode, Y as evaluateSensorEdge, Yt as boolean, bt as resolveRecordingProfiles, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as object, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingSignalCapability, ht as recordingExportCapability, i as BatteryStatusSchema, in as EventCategory, mt as recordingCapability, nn as string, qt as _enum, tn as record, tt as loadContributionCapability, x as OpsLogEntrySchema } from "../dist-mYDK58Jp.mjs";
-import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-xRsaPwBa.mjs";
+import { Ct as storageEvictableCapability, D as RecordingSignalStatusSchema, Dt as errMsg, E as RecordingConfigSchema, H as deriveBatteryPresence, It as DeviceFeature, Jt as _enum, Kt as selectAssignedProfileSlots, Lt as DeviceType, P as batteryCapability, Pt as BaseAddon, R as customAction, T as RECORDING_EXPORT_MAX_READ_BYTES, Ut as nodePin, V as defineCustomActions, W as deriveRecordingMode, Xt as boolean, Y as evaluateSensorEdge, Yt as array, _t as recordingSignalCapability, at as migrateLegacyDeviceSignalConfig, d as DEFAULT_EVENTS_BAND_BUFFER_SEC, en as number, et as isFirstLevelMacroClass, g as ExportRecordSchema, gt as recordingExportCapability, ht as recordingCapability, i as BatteryStatusSchema, in as string, nn as preprocess, on as EventCategory, qt as sleep$1, rn as record, tn as object, tt as loadContributionCapability, x as OpsLogEntrySchema, xt as resolveRecordingProfiles, zt as hydrateSchema } from "../dist-Y4BsF_EC.mjs";
+import { i as NO_COST_CLAIM, t as ChildCostRegistry } from "../node-B5ouEQYN.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
 import { r as withRecordingIntent } from "../restream-intent-B4BXZra7.mjs";
 import { n as startEventLoopStallMonitor } from "../event-loop-stall-monitor-DXLNBMkY.mjs";
-import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DMolfhsP.mjs";
+import { n as RowMapStore, t as retireRootKeys } from "../retire-root-keys-DZvlso2l.mjs";
 import { randomUUID } from "node:crypto";
 import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
@@ -3879,6 +3879,31 @@ var CalendarIndex = class {
 //#endregion
 //#region src/recorder/addon/config-store.ts
 /**
+* Per-device recording-config persistence for the recorder addon.
+*
+* ONE ROW PER CAMERA in `recorder:recording-configs`, through
+* {@link RowMapStore}. Asking what camera 617 records is a primary-key lookup;
+* saving its config writes that row and touches no other.
+*
+* ## What this replaced, and why
+*
+* Until the 2026-08-19 flatten every camera's `RecordingConfig` lived in ONE
+* key of the recorder's `addon-settings` / `root` blob — a row that was 201 833
+* bytes on the reference hub, because the ops-log and the export history shared
+* it. So `loadDeviceConfig(617)` read and `JSON.parse`d 201 KB, and
+* `saveDeviceConfig` read that, merged, and rewrote it. The staging walk did it
+* once per device and lost 45–267 s of a boot to it (2026-08-18); teaching the
+* walk to read the map once capped the symptom, and this removes the cause.
+*
+* ## Failure direction
+*
+* `RecordingConfigSchema` rejects unknown keys so a stale caller fails loudly,
+* but a row written by an older build may still carry retired ones — `.strip()`
+* drops them. And validation is now PER ROW: one unparseable camera costs that
+* camera, where the blob's single `safeParse` took every camera down to the
+* empty fallback (= the whole fleet silently unconfigured).
+*/
+/**
 * @durable class=config owner=recorder
 *   write="one row per camera, written by `saveDeviceConfig` (the `recording` cap's
 *     setConfig / band authoring) — the only writer"
@@ -3888,7 +3913,7 @@ var CalendarIndex = class {
 var RECORDING_CONFIGS_COLLECTION = "recorder:recording-configs";
 var RECORDING_CONFIGS_SPEC = {
 	collection: RECORDING_CONFIGS_COLLECTION,
-	schema: RecordingConfigSchema.strip(),
+	schema: preprocess((raw) => migrateLegacyDeviceSignalConfig(raw).value, RecordingConfigSchema.strip()),
 	columns: [
 		{
 			name: "deviceId",
@@ -3954,7 +3979,10 @@ async function loadDeviceConfig(state, deviceId) {
 */
 function deviceIdsWithLostBands(configs) {
 	const lost = [];
-	for (const [deviceId, config] of configs) if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	for (const [deviceId, config] of configs) {
+		if (config.deviceDecision === true) continue;
+		if (config.enabled && config.bands.length === 0 && config.mode && config.mode !== "off") lost.push(deviceId);
+	}
 	return lost.toSorted((a, b) => a - b);
 }
 /** Boot-time check: log the {@link deviceIdsWithLostBands} once, if any. */
@@ -3964,6 +3992,48 @@ async function warnLostBands(state, logger) {
 	logger.warn(`recording config: device(s) ${lost.join(", ")} claim a recording mode but have NO bands — a pre-retirement config that lost its legacy authoring fields. Nothing is recorded for them until their bands are re-authored.`);
 }
 /**
+* Persist the D371→D380 shape for every stored row — the migration, in code,
+* run once per boot and IDEMPOTENT: a second run finds no legacy key and
+* writes nothing.
+*
+* It reads the rows RAW ({@link RowMapStore.readAllRaw}) on purpose. The read
+* schema already migrates in memory, so by the time `readAll` answers there is
+* nothing left to recognise — and the retired key is stripped by a non-strict
+* `z.object`, so the migration would look like it had nothing to do on exactly
+* the row it exists for.
+*
+* Both outcomes are logged, because both change what a camera records and
+* silence would read as "nothing happened" — which is what a stripped key
+* looks like from the outside.
+*/
+async function migrateLegacyDeviceSignalRows(state, logger) {
+	const migrated = [];
+	const stripped = [];
+	for (const [key, raw] of await state.readAllRaw()) {
+		const outcome = migrateLegacyDeviceSignalConfig(raw);
+		if (!outcome.migrated && !outcome.strippedOnly) continue;
+		const deviceId = Number(key);
+		if (!Number.isInteger(deviceId)) continue;
+		const parsed = RecordingConfigSchema.strip().safeParse(outcome.value);
+		if (!parsed.success) {
+			logger.warn("recording config: legacy device-signal row could not be migrated", {
+				tags: { deviceId },
+				meta: { error: parsed.error.message }
+			});
+			continue;
+		}
+		await saveDeviceConfig(state, deviceId, parsed.data);
+		if (outcome.migrated) migrated.push(deviceId);
+		else stripped.push(deviceId);
+	}
+	if (migrated.length > 0) logger.info("recording config: migrated to the on-device-decision mode (the retired band trigger)", { meta: { deviceIds: migrated } });
+	if (stripped.length > 0) logger.warn("recording config: a band mixed the retired device-signal trigger with others — the key was dropped and the band kept. These cameras no longer follow their own signal until the on-device-decision mode is selected for them.", { meta: { deviceIds: stripped } });
+	return {
+		migrated,
+		stripped
+	};
+}
+/**
 * Persist (insert or replace) a device's config — ONE row. Validates against
 * `RecordingConfigSchema` at the boundary (untrusted cap input). Returns the
 * validated config that was persisted.
@@ -12456,6 +12526,13 @@ function bandActiveAt(band, date) {
 	if (s > e) return applies(wd) && t >= s || applies(prevWd) && t < e;
 	return applies(wd);
 }
+/**
+* The band covering `date`, or null. GENERIC over the band type so the caller
+* gets back exactly what it put in: the recorder decides on `EffectiveBand`s
+* (`band-decision.ts`), which carry the one non-authored fact — that the DEVICE
+* decides — and a return type widened to `RecordingBand` would erase it right
+* where the gates read it.
+*/
 function activeBandAt(config, date) {
 	return config.bands.find((b) => bandActiveAt(b, date)) ?? null;
 }
@@ -12480,6 +12557,37 @@ function activeBandAt(config, date) {
 * unit-testable without ffmpeg, the broker, the event bus, or a real wall clock.
 */
 /**
+* THE band a `deviceDecision` config decides through: always on (every day,
+* `start === end` — the band engine's always-on shape), `events`, and listening
+* to exactly one source, the camera's own level.
+*
+* Its buffers are the canonical pad ({@link DEFAULT_EVENTS_BAND_BUFFER_SEC}),
+* not per-camera knobs: this mode's whole contract with the operator is ONE
+* flag. The pad only ever retains footage around an episode the device itself
+* delimited, so there is nothing here for an operator to tune.
+*/
+var DEVICE_DECISION_BAND = Object.freeze({
+	days: [],
+	start: "00:00",
+	end: "00:00",
+	mode: "events",
+	deviceSignal: true,
+	preBufferSec: DEFAULT_EVENTS_BAND_BUFFER_SEC.preBufferSec,
+	postBufferSec: DEFAULT_EVENTS_BAND_BUFFER_SEC.postBufferSec
+});
+/**
+* THE bands the recorder decides on for a config — the ONE place
+* `config.bands` is turned into what the gates read.
+*
+* `deviceDecision` resolves to {@link DEVICE_DECISION_BAND} and to nothing
+* else; every other config is its own authored bands, byte for byte. Because
+* the schema makes the two exclusive, this is a choice and never a merge.
+*/
+function effectiveBands(config) {
+	if (config.deviceDecision === true) return [DEVICE_DECISION_BAND];
+	return config.bands ?? [];
+}
+/**
 * THE one place a band's pre/post buffers are read. An ABSENT field takes
 * {@link DEFAULT_EVENTS_BAND_BUFFER_SEC}; an explicit value — including `0` —
 * is honoured verbatim.
@@ -12520,6 +12628,9 @@ function triggerKey(source) {
 		case "signal": return "signal";
 	}
 }
+/** The single source {@link DEVICE_DECISION_BAND} listens to, shared so the
+*  band never allocates a new one per call. */
+var SIGNAL_SOURCES = Object.freeze([{ kind: "signal" }]);
 /**
 * LE sorgenti che questa banda ascolta — l'unico posto dove i `triggers` di
 * una banda diventano `TriggerSource[]`.
@@ -12535,6 +12646,7 @@ function triggerKey(source) {
 * denuncia invece di restare zitto.
 */
 function bandTriggerSources(band) {
+	if (band.deviceSignal === true) return SIGNAL_SOURCES;
 	const t = band.triggers;
 	if (t === void 0) return [];
 	const sources = [];
@@ -12548,7 +12660,6 @@ function bandTriggerSources(band) {
 		kind: "sensor",
 		sourceDeviceId
 	});
-	if (t.deviceSignal === true) sources.push({ kind: "signal" });
 	return sources;
 }
 /**
@@ -12734,8 +12845,8 @@ function eventsBandDemanded(band, triggers, atMs) {
 */
 function shouldRecordAt(config, triggers, at) {
 	if (!config.enabled) return false;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return false;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return false;
 	const band = activeBandAt({ bands }, at);
 	if (!band) return false;
 	if (band.mode === "continuous") return true;
@@ -12990,8 +13101,8 @@ function candidateEdgesMs(bands, nowMs) {
 * costs one wasted wake-up and never costs footage.
 */
 function nextBandEdgeMs(config, nowMs) {
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const current = activeBandAt({ bands }, new Date(nowMs));
 	const candidates = [...new Set(candidateEdgesMs(bands, nowMs))].filter((ms) => ms > nowMs).toSorted((a, b) => a - b);
 	for (const ms of candidates) if (activeBandAt({ bands }, new Date(ms)) !== current) return ms;
@@ -13026,8 +13137,8 @@ function eventsWindowCloseMs(band, triggers, nowMs) {
 function nextDecisionChangeAt(input) {
 	const { config, triggers, nowMs } = input;
 	if (!config.enabled) return null;
-	const bands = config.bands;
-	if (!bands || bands.length === 0) return null;
+	const bands = effectiveBands(config);
+	if (bands.length === 0) return null;
 	const band = activeBandAt({ bands }, new Date(nowMs));
 	const edgeMs = nextBandEdgeMs(config, nowMs);
 	const closeMs = band === null ? null : eventsWindowCloseMs(band, triggers, nowMs);
@@ -14497,7 +14608,7 @@ var RecordingController = class {
 			const config = await this.deps.loadConfig(deviceId);
 			if (config.enabled !== true) return;
 			const nowMs = this.now();
-			const band = activeBandAt({ bands: config.bands ?? [] }, new Date(nowMs));
+			const band = activeBandAt({ bands: effectiveBands(config) }, new Date(nowMs));
 			if (!band || band.mode !== "events") return;
 			const { postMs } = resolveBandBufferMs(band);
 			const sinceMs = nowMs - postMs - TRIGGER_HISTORY_MARGIN_MS;
@@ -14904,7 +15015,7 @@ var RecordingController = class {
 		if (this.stopped) return;
 		let band;
 		try {
-			band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 		} catch (err) {
 			this.deps.logger.warn("recorder: audio trigger qualification skipped — config read failed", {
 				tags: { deviceId },
@@ -14929,7 +15040,7 @@ var RecordingController = class {
 	*/
 	async postBufferMsFor(deviceId, atMs) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(atMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(atMs));
 			if (band) return resolveBandBufferMs(band).postMs;
 		} catch (err) {
 			this.deps.logger.warn("recorder: trigger history using the DEFAULT post-buffer — config read failed", {
@@ -15020,7 +15131,7 @@ var RecordingController = class {
 	reportUnrecordable(deviceId, config) {
 		if (!config.enabled) return;
 		if (this.unrecordableReported.has(deviceId)) return;
-		const bands = config.bands ?? [];
+		const bands = effectiveBands(config);
 		if (bands.length === 0) {
 			this.unrecordableReported.add(deviceId);
 			this.deps.logger.warn("recorder: device is enabled but has no recording bands — nothing will ever be recorded", { tags: { deviceId } });
@@ -15357,7 +15468,7 @@ var RecordingController = class {
 	*/
 	async handleFinalizedSegment(deviceId, profile, placement, attach, startMs, durMs, flatAbsPath) {
 		try {
-			const band = activeBandAt({ bands: (await this.deps.loadConfig(deviceId)).bands ?? [] }, new Date(startMs + durMs));
+			const band = activeBandAt({ bands: effectiveBands(await this.deps.loadConfig(deviceId)) }, new Date(startMs + durMs));
 			const triggers = this.triggersFor(deviceId);
 			if (band?.mode === "events" && !segmentRetainedForEvents(startMs, startMs + durMs, band, triggers, attach)) {
 				this.reportDiscardedSegment(deviceId, profile, attach, band, triggers, startMs, durMs);
@@ -17361,7 +17472,9 @@ var RecorderV2Addon = class extends BaseAddon {
 				watchIntervalMs: this.config.watchIntervalMs
 			}
 		});
-		warnLostBands(this.configStore(), this.ctx.logger);
+		migrateLegacyDeviceSignalRows(this.configStore(), this.ctx.logger).catch((err) => {
+			this.ctx.logger.warn("recorder: device-signal config migration failed", { meta: { error: errMsg(err) } });
+		}).then(() => warnLostBands(this.configStore(), this.ctx.logger));
 		const providers = [
 			{
 				capability: recordingCapability,

package/dist/{retire-root-keys-KE6D6Xh_.js → retire-root-keys-Csb8z2f3.js}

@@ -91,6 +91,25 @@ var RowMapStore = class RowMapStore {
 		} });
 		return out;
 	}
+	/**
+	* Every entry as it was WRITTEN, unvalidated and unparsed — the read a
+	* MIGRATION needs.
+	*
+	* {@link readAll} answers through the CURRENT schema, which is exactly what a
+	* migration must not do: a retired key is stripped by a non-strict `z.object`
+	* before the migration could see it, so the row it is there to rescue looks
+	* like a row that never needed rescuing. Only a migration should call this;
+	* everything else wants the validated read.
+	*/
+	async readAllRaw() {
+		const records = await this.store.query.query({
+			collection: this.spec.collection,
+			filter: { limit: this.spec.loadLimit }
+		});
+		const out = /* @__PURE__ */ new Map();
+		for (const record of records) out.set(record.id, record.data[ROW_MAP_VALUE_COLUMN]);
+		return out;
+	}
 	/** Insert or replace ONE entry. Validates at the boundary. */
 	async write(key, value) {
 		const validated = this.spec.schema.parse(value);

package/dist/{retire-root-keys-DMolfhsP.mjs → retire-root-keys-DZvlso2l.mjs}

@@ -91,6 +91,25 @@ var RowMapStore = class RowMapStore {
 		} });
 		return out;
 	}
+	/**
+	* Every entry as it was WRITTEN, unvalidated and unparsed — the read a
+	* MIGRATION needs.
+	*
+	* {@link readAll} answers through the CURRENT schema, which is exactly what a
+	* migration must not do: a retired key is stripped by a non-strict `z.object`
+	* before the migration could see it, so the row it is there to rescue looks
+	* like a row that never needed rescuing. Only a migration should call this;
+	* everything else wants the validated read.
+	*/
+	async readAllRaw() {
+		const records = await this.store.query.query({
+			collection: this.spec.collection,
+			filter: { limit: this.spec.loadLimit }
+		});
+		const out = /* @__PURE__ */ new Map();
+		for (const record of records) out.set(record.id, record.data[ROW_MAP_VALUE_COLUMN]);
+		return out;
+	}
 	/** Insert or replace ONE entry. Validates at the boundary. */
 	async write(key, value) {
 		const validated = this.spec.schema.parse(value);

package/dist/{segment-demux-js-CXvgKfsn.mjs → segment-demux-js-DXPgq2cf.mjs}

@@ -1,5 +1,5 @@
 import { r as __toESM, t as __commonJSMin } from "./chunk-DnnnRqeS.mjs";
-import { Et as errMsg } from "./dist-mYDK58Jp.mjs";
+import { Dt as errMsg } from "./dist-Y4BsF_EC.mjs";
 import { spawn } from "node:child_process";
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ __commonJSMin(((exports) => {

package/dist/{segment-demux-js-CBynn9Gh.js → segment-demux-js-DiIsywGz.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-HG5geL9t.js");
+const require_dist = require("./dist-CBa1j3On.js");
 let node_child_process = require("node:child_process");
 //#region ../../node_modules/mp4box/dist/mp4box.all.js
 var require_mp4box_all = /* @__PURE__ */ require_dist.__commonJSMin(((exports) => {

package/dist/session-decode/decode-worker-child.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_worker_protocol = require("../worker-protocol-DCsi4YS1.js");
-const require_lazy_sharp = require("../lazy-sharp-DmAwZ0s9.js");
+const require_worker_protocol = require("../worker-protocol-CXsdriRX.js");
+const require_lazy_sharp = require("../lazy-sharp-CS5WE9mI.js");
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.

package/dist/session-decode/decode-worker-child.mjs

@@ -1,4 +1,4 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-C0R1DDC0.mjs";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-_7zrToTo.mjs";
 import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-DXsqwpph.mjs";
 //#region src/session-decode/color-conversion.ts
 /**

package/dist/stream-broker/_stub.js

@@ -1,7 +1,7 @@
-import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-CBxobiZW.mjs";
+import { a as e, c as t, d as n, f as r, i, l as a, n as o, o as s, p as c, r as l, s as u, t as d, u as f } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-Dj_qoc1e.mjs";
 import { a as p, i as m, n as h, o as g, r as _, t as v } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react__loadShare__.js-C9j-2lBe.mjs";
 import { n as y, r as b, t as x } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-XO0-Pyu6.mjs";
-import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-B_NVJXAy.mjs";
+import { t as S } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-Cv5McbTI.mjs";
 import { n as C, t as w } from "./_virtual_mf___mfe_internal__addon_stream_broker_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-BO7TIbJV.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var T = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), E = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), D = (e) => {