@camstack/addon-pipeline 1.2.215 → 1.2.218

package/dist/{process-memory-BRdyl5fE.js → process-memory-DBxdiCSF.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-DoHcimdu.js");
+const require_dist = require("./dist-BbvtiBNc.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/{process-memory-CddpCDWL.mjs → process-memory-Du00R6-e.mjs}

@@ -1,4 +1,4 @@
-import { mt as parseProcStatus } from "./dist-DttqKvsQ.mjs";
+import { mt as parseProcStatus } from "./dist-Dl6GntEh.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 //#region src/shared/node-topology-platform.ts

package/dist/recorder/index.js

@@ -2,8 +2,8 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DoHcimdu.js");
-const require_node = require("../node-6uF72wri.js");
+const require_dist = require("../dist-BbvtiBNc.js");
+const require_node = require("../node-CbCVHEvJ.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
 const require_restream_intent = require("../restream-intent-B1Difcnq.js");
 const require_retire_root_keys = require("../retire-root-keys-Csb8z2f3.js");
@@ -1333,27 +1333,6 @@ var RecordingIndex = class {
 		return [...out.values()];
 	}
 	/**
-	* WHICH devices hold footage on any of `locationIds` — the census, without
-	* the archive.
-	*
-	* `getStorageUsage` used to answer this with `segmentsOnLocation(id)` per
-	* location: a full multi-device COPY of every row on the disk plus a sort of
-	* it (294 k rows on the live hub), to read one number off each row and throw
-	* the array away. This visits each device only until its first matching row.
-	* Same membership rule as before — a device is listed when at least one of
-	* its rows sits on one of the given locations, so footage stranded on a
-	* location id that no longer resolves stays invisible here exactly as it was.
-	* @residency archive-shaped
-	*/
-	deviceIdsOnLocations(locationIds) {
-		const out = /* @__PURE__ */ new Set();
-		for (const [deviceId, m] of this.byDevice) for (const s of m.values()) if (locationIds.has(s.locationId)) {
-			out.add(deviceId);
-			break;
-		}
-		return out;
-	}
-	/**
 	* Every RESIDENT segment on a storage location, across devices, oldest-first.
 	*
 	* ## The one that bit (D295)
@@ -3838,6 +3817,40 @@ async function segmentsOfHour(root, deviceId, profile, hourStartMs) {
 * the directory route serve the profile the client asked for when it exists,
 * and fall back to the availability pick when it does not.
 */
+/**
+* EVERY profile this camera holds footage in, across every root.
+*
+* {@link availabilityProfile} deliberately returns ONE — the timeline is a
+* single bar. That is right for the bar and wrong for the ANSWER: on
+* 2026-09-10 `getAvailability` reported twenty `high` ranges for camera 615
+* and the conclusion drawn was that this deployment records no `low` at all,
+* while `/media-fast/recordingsLow/615/low/` held 14 GB on a different
+* location (D433).
+*
+* Unions across roots for exactly that reason: `high` and `low` do not share a
+* location here, so a per-root answer sees one of them.
+*
+* Non-emptiness, not existence — the same rule {@link availabilityProfile}
+* keeps, so a directory left behind by a config change is not offered. And
+* only {@link KNOWN_PROFILES}: the camera dir also hosts `events/` and the
+* retired `strips/` trees, which a walker that trusts readdir would present as
+* playable.
+*
+* `list` is injectable for the test; production passes the module's own
+* directory read.
+*/
+async function profilesWithFootage(roots, deviceId, list = listDir) {
+	const found = /* @__PURE__ */ new Set();
+	for (const root of roots) {
+		const entries = await list(node_path.default.join(root, String(deviceId)));
+		for (const entry of entries) {
+			if (!KNOWN_PROFILES$1.has(entry)) continue;
+			if (found.has(entry)) continue;
+			if ((await list(node_path.default.join(root, String(deviceId), entry))).length > 0) found.add(entry);
+		}
+	}
+	return [...found].sort();
+}
 async function profileHasFootage(root, deviceId, profile) {
 	return (await listDir(node_path.default.join(root, String(deviceId), profile))).length > 0;
 }
@@ -3959,6 +3972,8 @@ var CalendarIndex = class {
 	segsReadAt = /* @__PURE__ */ new Map();
 	/** The profile availability reads from, resolved once per device. */
 	profileFor = /* @__PURE__ */ new Map();
+	profilesFor = /* @__PURE__ */ new Map();
+	profilesInFlight = /* @__PURE__ */ new Map();
 	/** `deviceId:profile` → whether the device records that profile, resolved
 	*  once. Same stability trade as {@link profileFor}: a config change that
 	*  adds a profile mid-session is picked up on restart, not on a timer. */
@@ -4241,6 +4256,31 @@ var CalendarIndex = class {
 	* reads at a time and they ALL ask for the profile before the first answer
 	* lands, so a cache alone let the pick run eight times. Parallelism found it.
 	*/
+	/**
+	* Every profile this camera holds footage in, across every root — cached
+	* like the pick, because it is the same shallow read (D433).
+	*
+	* {@link availabilityProfileFor} answers with ONE; this says what the one
+	* was chosen FROM, so a caller cannot mistake the timeline's single bar for
+	* the whole archive.
+	*/
+	async profilesWithFootageFor(deviceId) {
+		const cached = this.profilesFor.get(deviceId);
+		if (cached !== void 0) return cached;
+		const running = this.profilesInFlight.get(deviceId);
+		if (running) return running;
+		const resolve = (async () => {
+			const found = await profilesWithFootage(this.deps.roots(), deviceId);
+			this.profilesFor.set(deviceId, found);
+			return found;
+		})();
+		this.profilesInFlight.set(deviceId, resolve);
+		try {
+			return await resolve;
+		} finally {
+			if (this.profilesInFlight.get(deviceId) === resolve) this.profilesInFlight.delete(deviceId);
+		}
+	}
 	async availabilityProfileFor(deviceId) {
 		const cached = this.profileFor.get(deviceId);
 		if (cached !== void 0) return cached;
@@ -5885,6 +5925,8 @@ var TIME_RE = /time=(\d+):(\d+):(\d+(?:\.\d+)?)/;
 * whatever ffmpeg build is installed.
 */
 var EXPORT_MIN_PLAUSIBLE_BYTES = 1024;
+/** ffmpeg's own announcement of that pass — the only signal it gives. */
+var FASTSTART_RE = /Starting second pass: moving the moov atom/i;
 /** Expected OUTPUT duration (seconds) for progress scaling. */
 function expectedOutSeconds(rec) {
 	const rangeSec = Math.max(.001, (rec.toMs - rec.fromMs) / 1e3);
@@ -6194,6 +6236,7 @@ var ExportEngine = class {
 			args
 		} });
 		const stallMs = this.deps.stallMs ?? 9e4;
+		const faststartStallMs = this.deps.faststartStallMs ?? 9e5;
 		return new Promise((resolve) => {
 			const proc = this.deps.spawn(this.deps.ffmpegPath ?? "ffmpeg", args);
 			this.active.set(id, proc);
@@ -6205,14 +6248,16 @@ var ExportEngine = class {
 					stallTimer = null;
 				}
 			};
+			let budgetMs = stallMs;
 			const armStall = () => {
 				clearStall();
+				const armedFor = budgetMs;
 				stallTimer = setTimeout(() => {
-					stderrTail.push(`ffmpeg stalled: no progress for ${stallMs}ms`);
+					stderrTail.push(`ffmpeg stalled: no progress for ${armedFor}ms`);
 					try {
 						proc.kill("SIGKILL");
 					} catch {}
-				}, stallMs);
+				}, armedFor);
 			};
 			armStall();
 			proc.stderr?.on("data", (chunk) => {
@@ -6223,6 +6268,10 @@ var ExportEngine = class {
 						stderrTail.push(trimmed);
 						if (stderrTail.length > STDERR_TAIL_LINES$1) stderrTail.shift();
 					}
+					if (FASTSTART_RE.test(line)) {
+						budgetMs = faststartStallMs;
+						armStall();
+					}
 					const m = TIME_RE.exec(line);
 					if (m) {
 						armStall();
@@ -6866,6 +6915,81 @@ function buildRecordingDeviceSchema() {
 		}]
 	}] };
 }
+//#endregion
+//#region src/recorder/addon/device-storage-usage.ts
+/**
+* Gap between the per-camera sum and the per-volume total that is worth
+* saying out loud, as a share of the volume total.
+*
+* The two are aggregations of the SAME hour rows over the same location set —
+* one folded per camera, one summed in SQL — so in a healthy recorder they
+* agree to the byte. A few tenths of a percent is a write landing between the
+* two reads; 97% (60.5 GB against 1.9 TB) is the defect this file closes,
+* rebuilt somewhere new.
+*/
+var USAGE_MISMATCH_SHARE = .02;
+/** Floor under {@link USAGE_MISMATCH_SHARE} so a nearly empty disk does not
+*  warn on a single in-flight segment. */
+var USAGE_MISMATCH_FLOOR_BYTES = 1e9;
+/**
+* One row per camera the ARCHIVE holds footage for on `locationIds`, biggest
+* first (deviceId breaks a tie, so two consecutive calls compare).
+*
+* A node with no ledger REFUSES (D295 rule 3): empty rows, `read:
+* 'unavailable'`, and a line saying so. Falling back to the index would answer
+* the same question with the wrong quantity and look exactly like a correct
+* answer, which is how this shipped in the first place.
+*/
+function buildDeviceUsage(input) {
+	if (input.archive === null) {
+		input.logger.warn("recorder: no hour ledger on this node — the per-camera storage rows are UNANSWERED, not empty", { meta: { locations: [...input.locationIds].toSorted().join(",") } });
+		return {
+			devices: [],
+			totalUsedBytes: 0,
+			read: "unavailable"
+		};
+	}
+	const devices = [];
+	let totalUsedBytes = 0;
+	for (const [deviceId, archived] of input.archive) {
+		const resident = input.resident(deviceId);
+		totalUsedBytes += archived.bytes;
+		devices.push({
+			deviceId,
+			usedBytes: archived.bytes,
+			oldestMs: archived.oldestMs,
+			segments: archived.segments,
+			residentBytes: resident.bytes,
+			residentOldestMs: resident.oldestMs
+		});
+	}
+	return {
+		devices: devices.toSorted((a, b) => b.usedBytes - a.usedBytes || a.deviceId - b.deviceId),
+		totalUsedBytes,
+		read: "archive"
+	};
+}
+/**
+* Say it when the per-camera sum and the per-volume total disagree.
+*
+* The "I saw N of M" rule of D295, applied to a REPORT: these two numbers are
+* the same rows counted two ways, so a gap means one of the two reads saw a
+* fraction of the archive — and the whole point of D418 is that a page which
+* shows both without comparing them lets a 97% gap read as a fact about the
+* disks.
+*/
+function warnOnUsageMismatch(logger, deviceBytes, volumeBytes, read) {
+	if (read !== "archive") return;
+	if (volumeBytes === 0) return;
+	const gap = Math.abs(volumeBytes - deviceBytes);
+	if (gap <= USAGE_MISMATCH_FLOOR_BYTES) return;
+	if (gap <= volumeBytes * USAGE_MISMATCH_SHARE) return;
+	logger.warn("recorder: the per-camera storage sum disagrees with the per-volume total — one of the two reads saw a fraction of the archive", { meta: {
+		deviceBytes,
+		volumeBytes,
+		gap
+	} });
+}
 /** The placement-store key for one (camera, profile). Mirrors `assignmentKey`
 *  in `placement-store.ts`; kept local so this module stays dependency-free. */
 function sourceKey(source) {
@@ -7325,13 +7449,15 @@ function buildRecordingProvider(deps) {
 	* and by the batch alike — the batch collapses the TRANSPORT, and sharing the
 	* function is what makes that literally true instead of aspirational.
 	*/
-	const availabilityFor = async (deviceId, fromMs, toMs) => {
+	const availabilityFor = async (deviceId, fromMs, toMs, requestedProfile) => {
 		const calendar = deps.calendar;
 		if (calendar) {
-			const profile = await calendar.availabilityProfileFor(deviceId);
+			const profilesWithFootage = await calendar.profilesWithFootageFor(deviceId);
+			const profile = await calendar.servedProfileFor(deviceId, requestedProfile);
 			if (profile === null) return {
 				deviceId,
-				ranges: []
+				ranges: [],
+				profilesWithFootage: [...profilesWithFootage]
 			};
 			const ranges = [];
 			for (const r of await calendar.rangesIn(deviceId, profile, fromMs, toMs)) ranges.push({
@@ -7341,16 +7467,20 @@ function buildRecordingProvider(deps) {
 			});
 			return {
 				deviceId,
-				ranges
+				ranges,
+				profilesWithFootage: [...profilesWithFootage]
 			};
 		}
+		const profiles = new Set(deps.index.segments(deviceId).map((s) => s.profile));
+		const asked = requestedProfile !== void 0 && profiles.has(requestedProfile);
 		return {
 			deviceId,
-			ranges: [...new Set(deps.index.segments(deviceId).map((s) => s.profile))].flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
+			ranges: [...profiles].filter((p) => !asked || p === requestedProfile).flatMap((profile) => deps.index.ranges(deviceId, profile, fromMs, toMs, RANGE_MERGE_GAP_MS).map((r) => ({
 				profile,
 				startMs: r.startMs,
 				endMs: r.endMs
-			})))
+			}))),
+			profilesWithFootage: [...profiles].sort()
 		};
 	};
 	/** The per-camera day read. Same rule as {@link availabilityFor}: one body. */
@@ -7380,7 +7510,7 @@ function buildRecordingProvider(deps) {
 		getStatus: async ({ deviceId }) => {
 			return statusFor(deps, deviceId, await loadDeviceConfig(deps.configStore, deviceId));
 		},
-		getAvailability: ({ deviceId, fromMs, toMs }) => availabilityFor(deviceId, fromMs, toMs),
+		getAvailability: ({ deviceId, fromMs, toMs, profile }) => availabilityFor(deviceId, fromMs, toMs, profile),
 		/**
 		* `getAvailability` for a SET of cameras. Same body per camera, run
 		* concurrently; only the transport collapses.
@@ -7394,11 +7524,12 @@ function buildRecordingProvider(deps) {
 			refuseOverCap("getAvailabilityBatch", deviceIds.length);
 			return Promise.all(deviceIds.map(async (deviceId) => {
 				try {
-					const { ranges } = await availabilityFor(deviceId, fromMs, toMs);
+					const { ranges, profilesWithFootage } = await availabilityFor(deviceId, fromMs, toMs);
 					return {
 						deviceId,
 						read: "read",
-						ranges
+						ranges,
+						profilesWithFootage
 					};
 				} catch (err) {
 					deps.logger.warn("recording availability could not be read", {
@@ -7412,7 +7543,8 @@ function buildRecordingProvider(deps) {
 					return {
 						deviceId,
 						read: "unreadable",
-						ranges: []
+						ranges: [],
+						profilesWithFootage: []
 					};
 				}
 			}));
@@ -7453,18 +7585,15 @@ function buildRecordingProvider(deps) {
 		getPlaybackManifest: ({ deviceId, fromMs, toMs }) => buildPlaybackManifest(deps, codecCache, deviceId, fromMs, toMs),
 		getStorageUsage: async () => {
 			const locations = deps.locations();
-			const devices = [];
-			const seenDevices = deps.index.deviceIdsOnLocations(new Set(locations.map((l) => l.id)));
-			let totalUsedBytes = 0;
-			for (const deviceId of seenDevices) {
-				const accounting = deps.index.accounting(deviceId);
-				totalUsedBytes += accounting.bytes;
-				devices.push({
-					deviceId,
-					usedBytes: accounting.bytes,
-					oldestMs: accounting.oldestMs
-				});
-			}
+			const locationIds = new Set(locations.map((l) => l.id));
+			const deviceUsage = buildDeviceUsage({
+				locationIds,
+				archive: deps.archiveDeviceUsage?.(locationIds) ?? null,
+				resident: (deviceId) => deps.index.accounting(deviceId),
+				logger: deps.logger
+			});
+			const devices = deviceUsage.devices;
+			const totalUsedBytes = deviceUsage.totalUsedBytes;
 			const byPhysical = /* @__PURE__ */ new Map();
 			for (const loc of locations) {
 				const key = physicalRootKey(loc.root);
@@ -7493,11 +7622,12 @@ function buildRecordingProvider(deps) {
 					totalBytes: cap.totalBytes
 				};
 			}));
-			devices.sort((a, b) => b.usedBytes - a.usedBytes);
+			warnOnUsageMismatch(deps.logger, totalUsedBytes, locationUsages.reduce((sum, l) => sum + l.usedBytes, 0), deviceUsage.read);
 			return {
 				nodeId: deps.nodeId,
 				totalUsedBytes,
-				devices,
+				devices: [...devices],
+				devicesRead: deviceUsage.read,
 				locations: locationUsages
 			};
 		},
@@ -8391,6 +8521,14 @@ var DurableLedger = class DurableLedger {
 //#endregion
 //#region src/recorder/addon/segment-hour-ledger.ts
 var HOUR_MS$3 = 36e5;
+/** `Math.min` where a missing left operand means "nothing yet", not `NaN`. */
+function minOf(a, b) {
+	return a === null ? b : Math.min(a, b);
+}
+/** `Math.max` with the same rule as {@link minOf}. */
+function maxOf(a, b) {
+	return a === null ? b : Math.max(a, b);
+}
 var macrotask$1 = () => new Promise((resolve) => {
 	setImmediate(resolve);
 });
@@ -9041,7 +9179,7 @@ var SegmentHourLedger = class SegmentHourLedger {
 	*
 	* The reader repairs the durable index it just reconstructed, so the next
 	* cold read of this hour is a point read instead of another `readdir`
-	* (`docs/design/2026-08-29-scrypted-nvr-recording-model.md` §4.2). Two
+	* (`docs/design/2026-08-29-reference-nvr-recording-model.md` §4.2). Two
 	* constraints, both enforced by the caller and re-stated here because
 	* getting either wrong turns a READ into durable damage: the hour must be
 	* CLOSED (a live hour's directory races the writer, so a walk of it is a
@@ -9274,6 +9412,53 @@ var SegmentHourLedger = class SegmentHourLedger {
 		for (const row of this.ledger.snapshot()) if (locationIds.has(row.locationId)) out.add(row.deviceId);
 		return out;
 	}
+	/**
+	* Bytes / segments / oldest / newest per CAMERA on these locations — the
+	* per-camera half of the storage page, answered by the ARCHIVE (D418).
+	*
+	* ## Why the T1 fold and not `census({ deviceId })` per camera
+	*
+	* `census` is the right authority for a SCOPE, and it cannot express this
+	* scope: {@link SegmentHourLedger.predicate} takes ONE `locationId`, so
+	* "camera 615 across the three resolvable volumes" is three aggregates, and
+	* `census({ deviceId })` alone would silently count footage stranded on a
+	* location id that no longer resolves — bytes no volume row on the same page
+	* accounts for. Per camera per volume that is `cameras × volumes` SQL
+	* aggregates for one operator click, and it grows with the fleet.
+	*
+	* The T1 hour summary answers all of them in ONE pass with no I/O, exactly
+	* as {@link devicesWithFootage} and {@link profilesWithFootage} already do,
+	* and it is the same rows `accountingForLocations` sums in SQL — the mirror
+	* is write-behind, so it is never BEHIND the store. The cost is one pass
+	* over the hour rows the mirror holds — O(writers × profiles × hours), ~19 k
+	* on the live hub (see {@link REPAIR_MAX_ROWS}) against 98 445 segments,
+	* i.e. it does NOT scale with the segment count — and it is capped for good
+	* by {@link SEGMENT_HOUR_SUMMARY_LIMIT}, the mirror's own ceiling.
+	*
+	* ## What an empty answer means
+	*
+	* The same thing it means for {@link devicesWithFootage}: "the mirror knows
+	* no hour here" — which is also what a ledger whose load failed reports. The
+	* caller must not render that as "no camera has footage"; `getStorageUsage`
+	* cross-checks the per-camera sum against the volume aggregate and SAYS so
+	* when the two disagree.
+	*/
+	usageByDevice(locationIds) {
+		const out = /* @__PURE__ */ new Map();
+		if (locationIds.size === 0) return out;
+		for (const row of this.ledger.snapshot()) {
+			if (!locationIds.has(row.locationId)) continue;
+			const empty = row.segments === 0;
+			const prev = out.get(row.deviceId);
+			out.set(row.deviceId, {
+				bytes: (prev?.bytes ?? 0) + row.bytes,
+				segments: (prev?.segments ?? 0) + row.segments,
+				oldestMs: empty ? prev?.oldestMs ?? null : minOf(prev?.oldestMs ?? null, row.minStartMs),
+				newestMs: empty ? prev?.newestMs ?? null : maxOf(prev?.newestMs ?? null, row.maxStartMs)
+			});
+		}
+		return out;
+	}
 	async oldestSegmentsScoped(locationIds, deviceIds, targetBytes) {
 		const ids = [...locationIds];
 		if (ids.length === 0 || targetBytes <= 0) return {
@@ -14533,7 +14718,7 @@ var RecordingController = class {
 	/**
 	* The ADAPTIVE attach bound. A transient `spawn ffmpeg` failure (EAGAIN) is
 	* the host saying it cannot fork right now, and the answer is to attach
-	* FEWER cameras at once — not to serialise them, which `e2fa17a2b` removed
+	* FEWER cameras at once — not to serialise them, which removed
 	* for good reason. Every bounded-parallel attach in this file reads it.
 	*/
 	spawnPressure;
@@ -16038,7 +16223,7 @@ function selectRedundantSegments(segs) {
 * The pruner that used to remove it, `runRedundancyJanitor`, was reachable ONLY
 * from `runFullArchiveWalk`, which was reachable only from
 * `scheduleDeferredFullWalk`, which had no caller at all — so on 2026-08-27
-* (commit `9308428b4`) all three were deleted together as dead code. That was
+* all three were deleted together as dead code. That was
 * correct about the walk and left the system with **no duplicate pruner
 * whatsoever**. The precedent for letting this class of waste run unattended is
 * the 179 GB of stranded staging segments in `staging-reconcile.ts`.
@@ -17449,6 +17634,7 @@ var RecorderV2Addon = class extends require_dist.BaseAddon {
 			refreshLocations: () => this.refreshLocations(),
 			capacity: (root) => this.locationCapacity(root),
 			archiveAccounting: (locationIds) => this.segmentHours?.accountingForLocations(locationIds) ?? Promise.resolve(EMPTY_ARCHIVE_ACCOUNTING),
+			archiveDeviceUsage: (locationIds) => this.segmentHours?.usageByDevice(locationIds) ?? null,
 			archive: () => this.segmentHours,
 			ledgerWalk: this.ledgerWalkReconciler(),
 			hydrateDevice: (deviceId, locations) => hydrateDeviceFromStorage(this.ctx.api, this.index, deviceId, locations, this.ctx.logger),