@camstack/addon-pipeline 1.2.73 → 1.2.75

package/dist/lazy-sharp-DvwPafeP.js

@@ -0,0 +1,360 @@
+const require_dist = require("./dist-6ZJCV0jY.js");
+let node_url = require("node:url");
+let node_module = require("node:module");
+let node_path = require("node:path");
+node_path = require_dist.__toESM(node_path);
+//#region src/shared/host-external-import.ts
+/**
+* Resolving a HOST-EXTERNAL package (`sharp`, `node-av`, …) from a process that
+* does NOT have the framework ESM resolver hook registered.
+*
+* ## The problem this exists for
+*
+* An addon bundle leaves the packages in `HOST_EXTERNAL_SPECIFIERS`
+* (`@camstack/system` → `kernel/host-externals.ts`) unbundled and expects the
+* HOST to provide them. What provides them is a module-customization hook
+* (`framework-resolver-hook.mjs`) that `registerFrameworkResolver` installs in
+* the **addon-runner process**, re-anchoring those bare specifiers at
+* `<frameworkDir>/node_modules`.
+*
+* A worker started with a plain `child_process.fork` — the session decode
+* worker (`session-decode/fork-decode-worker.ts`) is the one in this package —
+* does NOT inherit that hook. In it, `import('sharp')` and `import('node-av')`
+* throw `Cannot find package 'X' imported from /data/addons/@camstack/…`,
+* because the addon directory has no `node_modules` to walk up into.
+*
+* ## Why an explicit path and not the hook
+*
+* Registering the framework resolver in the child was considered and rejected:
+*
+*  - it would need the child to reach INTO another package's build output
+*    (`<frameworkDir>/node_modules/@camstack/system/dist/…/framework-resolver-hook.mjs`)
+*    plus an `--import` shim, i.e. a hard coupling to a layout nothing checks;
+*  - a registered hook makes **every** `import()` in that process re-enter the
+*    loader and block the main thread on `Atomics.wait` until the hooks worker
+*    answers — the exact cost `shared/lazy-sharp.ts` was written to remove from
+*    the frame path. Paying it per decode worker to load two modules is the
+*    wrong trade;
+*  - the explicit-path fallback is already the shipped answer for `node-av` in
+*    this same worker, and had been for months. A second mechanism for `sharp`
+*    would mean two ways to fail.
+*
+* So: try the bare specifier (works on the hub, where the fork inherits the
+* hook, and in dev, where workspace symlinks resolve), then resolve the package
+* explicitly out of the module roots an agent is known to lay out.
+*
+* ## The anchors, in order
+*
+*  - **DOCKER / single-copy node** — the framework overlay
+*    `CAMSTACK_FRAMEWORK_DIR` (`<frameworkDir>/node_modules/<pkg>`). The
+*    launcher points this at the ACTIVE closure in data-root mode and forked
+*    children inherit it (`server/backend/src/launcher.ts`).
+*  - **ELECTRON agent** — the app bundle beside `CAMSTACK_BUNDLED_ADDONS_DIR`
+*    (`<resources>/addons`): `<resources>/node_modules/<pkg>` and the
+*    `app.asar.unpacked` mirror.
+*  - **the process cwd** — always tried last, and it is NOT redundant:
+*    `CAMSTACK_FRAMEWORK_DIR` is only exported on some boots (the Docker
+*    entrypoint sets it in its fallback branch; the launcher only in data-root
+*    mode), while the launcher ALWAYS extends `NODE_PATH` with the framework and
+*    hub `node_modules`. A CJS-style resolution honours `NODE_PATH`; an ESM
+*    `import()` of a bare specifier does not. This is the same escape hatch
+*    `stream-broker/webrtc/session.ts` uses to find the framework's `werift`.
+*
+* An anchor that cannot resolve the specifier is skipped, so an empty result
+* leaves the bare specifier as the only path, exactly as before.
+*
+* Resolution goes through `createRequire(...).resolve(specifier)` rather than a
+* hardcoded relative entry (`dist/index.js`, …): that honours the package's own
+* `exports`/`main`, so it keeps working across a dependency's file-layout
+* changes, handles SUBPATH specifiers (`node-av/constants`) with no mapping
+* table, and consults `NODE_PATH`. It also verifies the file exists, which is
+* what the previous `fs.existsSync` check did by hand.
+*/
+/**
+* The anchor filename resolution walks up from. It never has to EXIST —
+* `createRequire` only needs a path to anchor at — but naming it after camstack
+* keeps a stack trace readable if one ever escapes.
+*/
+var ANCHOR_FILE = "__camstack_host_external_anchor__.cjs";
+/** Node error codes that mean "the module is not there", not "it failed to load". */
+var RESOLUTION_ERROR_CODES = [
+	"ERR_MODULE_NOT_FOUND",
+	"MODULE_NOT_FOUND",
+	"ERR_PACKAGE_PATH_NOT_EXPORTED",
+	"ERR_UNSUPPORTED_DIR_IMPORT"
+];
+/** `err.code` when the error carries a string one. No cast: `in` narrows. */
+function errorCode(err) {
+	if (typeof err !== "object" || err === null) return null;
+	if (!("code" in err)) return null;
+	const code = err.code;
+	return typeof code === "string" ? code : null;
+}
+/**
+* True when `err` says the module could not be FOUND (as opposed to found and
+* failed to load — a broken native binary, a throwing top level).
+*
+* The distinction is load-bearing for callers that memoize failure: a
+* resolution failure is deterministic for the life of the process (the env and
+* the framework layout do not change under a running worker), so retrying it
+* per frame can only re-pay the loader round-trip and re-log. A LOAD failure
+* can plausibly be a deploy blip and stays retryable.
+*
+* The message check is a belt for the same braces: Node has moved these codes
+* before, and a miss here degrades to "retry forever", which is the bug.
+*/
+function isModuleResolutionError(err) {
+	const code = errorCode(err);
+	if (code !== null && RESOLUTION_ERROR_CODES.includes(code)) return true;
+	if (!(err instanceof Error)) return false;
+	return err.message.includes("Cannot find package") || err.message.includes("Cannot find module");
+}
+/**
+* The files a resolution is anchored at, in the order they are tried. Each is a
+* path INSIDE a candidate `node_modules` (so `<dir>/node_modules/<pkg>` is on
+* the walk), except the cwd anchor, which walks up from the cwd itself.
+*
+* The anchor files never have to exist — `createRequire` only needs a path.
+*/
+function hostExternalAnchors(env, cwd) {
+	const anchors = [];
+	const frameworkDir = env["CAMSTACK_FRAMEWORK_DIR"];
+	if (frameworkDir !== void 0 && frameworkDir.length > 0) anchors.push(node_path.join(frameworkDir, "node_modules", ANCHOR_FILE));
+	const bundledAddons = env["CAMSTACK_BUNDLED_ADDONS_DIR"];
+	if (bundledAddons !== void 0 && bundledAddons.length > 0) {
+		const resourcesRoot = node_path.dirname(bundledAddons);
+		anchors.push(node_path.join(resourcesRoot, "node_modules", ANCHOR_FILE));
+		anchors.push(node_path.join(resourcesRoot, "app.asar.unpacked", "node_modules", ANCHOR_FILE));
+	}
+	anchors.push(node_path.join(cwd, ANCHOR_FILE));
+	return anchors;
+}
+/** `createRequire(anchor).resolve(specifier)`, or `null` when it is not there. */
+function resolveFromAnchor(anchorPath, specifier) {
+	try {
+		return (0, node_module.createRequire)(anchorPath).resolve(specifier);
+	} catch {
+		return null;
+	}
+}
+/**
+* Importable `file:` URLs for `specifier`, in the order a caller should try them
+* after the bare specifier has already failed. Deduplicated (two anchors
+* routinely resolve to the SAME file — a NODE_PATH hit, or a symlink), and empty
+* when nothing resolves it, which leaves the bare specifier the only path.
+*/
+function hostExternalEntryUrls(specifier, options = {}) {
+	const env = options.env ?? process.env;
+	const cwd = options.cwd ?? process.cwd();
+	const resolveEntry = options.resolve ?? resolveFromAnchor;
+	const urls = [];
+	for (const anchor of hostExternalAnchors(env, cwd)) {
+		const entry = resolveEntry(anchor, specifier);
+		if (entry === null || entry.length === 0) continue;
+		const url = (0, node_url.pathToFileURL)(entry).href;
+		if (!urls.includes(url)) urls.push(url);
+	}
+	return urls;
+}
+//#endregion
+//#region src/shared/lazy-sharp.ts
+/**
+* lazy-sharp — resolve `sharp` ONCE, not once per frame, and give up ONCE when
+* it cannot be resolved at all.
+*
+* ## What this fixes (2026-08-02)
+*
+* `await import('sharp')` sat directly in the frame path, in a spot whose own
+* comment reads "This is the production hot path (camera frames from broker)",
+* and in six other places along the same path. At ~13 fps per camera across the
+* fleet that is thousands of dynamic imports a minute.
+*
+* Node caches the MODULE after the first import, so this looks free. It is not:
+* the addon runner registers module-customization hooks (the framework
+* resolver), and with hooks registered every `import()` re-enters the loader and
+* resolves the specifier through the hooks worker — **synchronously**. A CPU
+* profile of the live detection runner caught it exactly:
+*
+*     makeSyncRequest@hooks:631
+*     resolveSync@hooks:860
+*     #resolveAndMaybeBlockOnLoaderThread@loader:715
+*     …
+*     import@loader:626
+*     runPipeline@index.js:5565
+*
+* `#resolveAndMaybeBlockOnLoaderThread` is the name of the problem:
+* `makeSyncRequest` blocks the MAIN THREAD on `Atomics.wait` until the hooks
+* worker answers. That is a synchronous block on the frame path, which is the
+* shape the 22-88s event-loop freezes had.
+*
+* ## What it fixes a second time (2026-08-14)
+*
+* A memo that CLEARS on failure re-pays that entire cost on every call once the
+* module genuinely is not there. The subject-tile tier hit exactly that: in the
+* decode worker (a plain `child_process.fork`, no resolver hook) `import('sharp')`
+* cannot resolve, and because the memo was dropped on failure, every subject of
+* every frame re-entered the loader and logged a WARN — 3 800 WARN/min
+* cluster-wide, with a synchronous loader round-trip on the frame path behind
+* each one, and not one tile ever cut.
+*
+* So this module now does two more things:
+*
+*  1. **Falls back to an explicit path.** Same mechanism `node-av` has used in
+*     the same worker for months, extracted into
+*     `shared/host-external-import.ts` — read its docblock for the layouts and
+*     for why the framework resolver is NOT registered in the child instead.
+*  2. **Distinguishes the two failure kinds.**
+*     - **Resolution** failure (nothing, anywhere, resolves `sharp`): the answer
+*       cannot change while this process lives, so it is memoized as a sticky
+*       {@link SharpUnavailableError}. Later calls reject IMMEDIATELY, with no
+*       loader re-entry, and exactly ONE warning is emitted for the process
+*       naming every candidate tried and the cause.
+*     - **Load** failure (found, but the native binary or the module body threw):
+*       the memo is cleared, so a later call retries. A partially-installed
+*       native dep during a deploy must not poison the encoder for the whole
+*       process lifetime — that would turn a blip into a camera that never
+*       produces media again. This is the original behaviour, kept on purpose,
+*       and it is safe to keep only because it is now the NARROW case.
+*
+* ## Why a memo and not a static import
+*
+* `sharp` is a heavy native module. The dynamic import was deliberate — nodes
+* that never encode a frame should not pay to load it, and a node whose native
+* build is missing must fail at first use rather than at boot. Both properties
+* survive: the module is still loaded on FIRST use, and a failure still surfaces
+* at that call. Only the repeat resolutions are removed.
+*
+* The promise itself is cached (not just the resolved value), so N concurrent
+* first-callers share one import instead of racing into N.
+*/
+/** The bare specifier. Also the first entry of a failure's candidate list. */
+var SHARP_SPECIFIER = "sharp";
+/**
+* `sharp` cannot be resolved in this process, and nothing about that can change
+* while it runs. Carries the candidates tried so the log answers "where did you
+* look" without a second round of diagnosis.
+*/
+var SharpUnavailableError = class extends Error {
+	attempts;
+	constructor(attempts, cause) {
+		super(`sharp could not be resolved in this process — tried ${attempts.join(", ")}; cause: ${describeError(cause)}`, { cause });
+		this.name = "SharpUnavailableError";
+		this.attempts = attempts;
+	}
+};
+function describeError(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+/**
+* The bare specifier stays a LITERAL `import('sharp')` so the bundler keeps
+* treating it as the declared external it is; only the fallback candidates go
+* through a variable specifier (typed `any` by TS, so the declared return type
+* applies without a cast — the same shape `importNodeAv` uses).
+*/
+async function importSharpModule(specifier) {
+	if (specifier === SHARP_SPECIFIER) return import("sharp");
+	return await import(specifier);
+}
+/**
+* Build a loader. Exported for tests; production uses the module-level
+* {@link getSharp}, which is one of these.
+*/
+function createSharpLoader(deps = {}) {
+	const importModule = deps.importModule ?? importSharpModule;
+	const fallbackUrls = deps.fallbackUrls ?? (() => hostExternalEntryUrls(SHARP_SPECIFIER));
+	const warn = deps.warn;
+	let pending = null;
+	let unavailable = null;
+	let warned = false;
+	/** Bare first, then each fallback candidate, in order. */
+	const attempt = async () => {
+		const attempts = [SHARP_SPECIFIER];
+		let lastError;
+		try {
+			return (await importModule(SHARP_SPECIFIER)).default;
+		} catch (bareError) {
+			if (!isModuleResolutionError(bareError)) {
+				pending = null;
+				throw bareError;
+			}
+			lastError = bareError;
+		}
+		for (const url of fallbackUrls()) {
+			attempts.push(url);
+			try {
+				return (await importModule(url)).default;
+			} catch (candidateError) {
+				if (!isModuleResolutionError(candidateError)) {
+					pending = null;
+					throw candidateError;
+				}
+				lastError = candidateError;
+			}
+		}
+		const failure = new SharpUnavailableError(attempts, lastError);
+		unavailable = failure;
+		pending = null;
+		if (!warned) {
+			warned = true;
+			if (warn) warn(failure.message);
+			else process.stderr.write(`${failure.message}\n`);
+		}
+		throw failure;
+	};
+	return {
+		load: () => {
+			if (unavailable !== null) return Promise.reject(unavailable);
+			if (pending === null) pending = attempt();
+			return pending;
+		},
+		reset: () => {
+			pending = null;
+			unavailable = null;
+			warned = false;
+		}
+	};
+}
+/** Where the process-wide loader's single diagnostic goes. */
+var warnSink = null;
+/**
+* Route the one-off "sharp is unavailable" diagnostic somewhere it will be seen.
+* Without a sink it goes to stderr, which the decode worker's parent inherits
+* but does NOT forward to the scoped logger — so the worker installs one at
+* boot (`decode-worker-child.ts`) to get the line into `addons.getLogs` with its
+* `[dev:<id>]` prefix.
+*/
+function setSharpWarnSink(sink) {
+	warnSink = sink;
+}
+var defaultLoader = createSharpLoader({ warn: (message) => {
+	if (warnSink) warnSink(message);
+	else process.stderr.write(`${message}\n`);
+} });
+/**
+* The `sharp` factory, resolved once per process.
+*
+* Rejects with {@link SharpUnavailableError} — immediately, and without touching
+* the module loader — once resolution has been proven impossible here.
+*/
+function getSharp() {
+	return defaultLoader.load();
+}
+//#endregion
+Object.defineProperty(exports, "getSharp", {
+	enumerable: true,
+	get: function() {
+		return getSharp;
+	}
+});
+Object.defineProperty(exports, "hostExternalEntryUrls", {
+	enumerable: true,
+	get: function() {
+		return hostExternalEntryUrls;
+	}
+});
+Object.defineProperty(exports, "setSharpWarnSink", {
+	enumerable: true,
+	get: function() {
+		return setSharpWarnSink;
+	}
+});

package/dist/motion-wasm/index.js

@@ -2,10 +2,10 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BAbvf81B.js");
-const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
-let node_fs = require("node:fs");
+const require_dist = require("../dist-6ZJCV0jY.js");
+const require_lazy_sharp = require("../lazy-sharp-DvwPafeP.js");
 let node_path = require("node:path");
+let node_fs = require("node:fs");
 //#region src/motion-wasm/wasm-motion-detector.ts
 /**
 * WasmMotionDetector — loads the AssemblyScript WASM module and provides

package/dist/motion-wasm/index.mjs

@@ -1,7 +1,7 @@
-import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-Dpr92hOt.mjs";
-import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
-import { readFileSync } from "node:fs";
+import { H as motionDetectionCapability, R as evaluateZoneRules, ft as hydrateSchema, st as BaseAddon, ut as DeviceType } from "../dist-T_8jMw7d.mjs";
+import { t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
 import { join } from "node:path";
+import { readFileSync } from "node:fs";
 //#region src/motion-wasm/wasm-motion-detector.ts
 /**
 * WasmMotionDetector — loads the AssemblyScript WASM module and provides

package/dist/pipeline-runner/index.js

@@ -2,20 +2,19 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_chunk = require("../chunk-emK7D4bc.js");
-const require_dist = require("../dist-BAbvf81B.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-BhKoybot.js");
-const require_worker_protocol = require("../worker-protocol-BFq9AIDa.js");
+const require_dist = require("../dist-6ZJCV0jY.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-Cjof8vA1.js");
+const require_worker_protocol = require("../worker-protocol-B0cbTXyw.js");
 const require_hub_hostname = require("../hub-hostname-DAJXlOgV.js");
-const require_lazy_sharp = require("../lazy-sharp-CcYuXtsa.js");
+const require_lazy_sharp = require("../lazy-sharp-DvwPafeP.js");
 const require_remote_restream = require("../remote-restream-BYbAsgUf.js");
 let sharp = require("sharp");
-sharp = require_chunk.__toESM(sharp);
+sharp = require_dist.__toESM(sharp);
 let node_child_process = require("node:child_process");
 let node_url = require("node:url");
 let node_perf_hooks = require("node:perf_hooks");
 let node_os = require("node:os");
-node_os = require_chunk.__toESM(node_os);
+node_os = require_dist.__toESM(node_os);
 //#region src/session-decode/fork-decode-worker.ts
 /** Absolute path to the built decode-worker child entry (a vite build entry). */
 var CHILD_ENTRY_PATH = (0, node_url.fileURLToPath)(new URL("../session-decode/decode-worker-child.js", require("url").pathToFileURL(__filename).href));
@@ -3836,6 +3835,18 @@ function isUsable(bbox) {
 }
 //#endregion
 //#region src/pipeline-runner/index.ts
+/**
+* Bound on the frames whose cutter is bound but whose result has not come back.
+* A few per camera in flight; the ceiling only catches results that never
+* arrive (shed, inference timeout, detach mid-flight).
+*/
+var MAX_BOUND_FRAME_CUTTERS = 256;
+/** How often a camera reports its undispatched cuts. */
+var TILE_CUT_DROP_LOG_INTERVAL_MS = 6e4;
+/** The per-frame binding key — the same identity the retention handle carries. */
+function frameCutterKey(handle) {
+	return `${handle.shmId}#${handle.slot}#${handle.seq}`;
+}
 var DEFAULT_CONFIG = {
 	maxQueueDepth: 30,
 	maxConcurrentInferences: 16,
@@ -4151,6 +4162,20 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 	*/
 	nativeCropRegistry = new NativeCropRegistry();
 	/**
+	* Per-frame cutter bindings — handle key → the requester that can cut this
+	* frame's subject tiles and end its hold.
+	*
+	* Deliberately NOT `nativeCropRegistry`. That one is a node-wide LRU capped
+	* at 256 and shared by every camera to serve LATE cross-process crops; on the
+	* live hub it sits pinned at its cap, so an entry's lifetime depends on how
+	* busy the OTHER cameras are. Ending a frame's hold is a per-frame lifecycle
+	* event and cannot be allowed to depend on that.
+	*/
+	frameCutters = /* @__PURE__ */ new Map();
+	/** Per-camera tally of cuts that could not be dispatched, and why. */
+	tileCutDrops = /* @__PURE__ */ new Map();
+	tileCutDropLoggedAt = /* @__PURE__ */ new Map();
+	/**
 	* Node-level RAM store of retained rgb detection frames, keyed by the
 	* `FrameHandle` that rides the inference-result event (shm-ring removal
 	* 2026-07-16 — replaces the `csr.` shm retention ring). Backs the
@@ -5158,23 +5183,80 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 	* by an encode.
 	*/
 	cutSubjectTiles(deviceId, result, handle) {
-		if (!handle) return;
-		const found = this.nativeCropRegistry.get(handle);
-		if (!found) return;
+		const outcome = this.dispatchSubjectTiles(result, handle);
+		if (outcome === "sent") return;
+		const tally = this.tileCutDrops.get(deviceId) ?? {
+			handleless: 0,
+			unbound: 0,
+			threw: 0
+		};
+		tally[outcome] += 1;
+		this.tileCutDrops.set(deviceId, tally);
+		const now = Date.now();
+		if (now - (this.tileCutDropLoggedAt.get(deviceId) ?? 0) < TILE_CUT_DROP_LOG_INTERVAL_MS) return;
+		this.tileCutDropLoggedAt.set(deviceId, now);
+		this.ctx.logger.warn("subject tile cut NOT dispatched — the frame hold will not be released", {
+			tags: { deviceId },
+			meta: {
+				...tally,
+				lastReason: outcome,
+				boundFrames: this.frameCutters.size
+			}
+		});
+	}
+	/**
+	* Send the cut for one finished frame. Returns what happened, so the caller
+	* can account for it.
+	*
+	* The cutter is looked up in {@link frameCutters} — the addon's OWN per-frame
+	* binding — and NOT in `nativeCropRegistry`. That distinction is the bug this
+	* method exists to not have again: the registry is a node-wide LRU capped at
+	* 256 entries, shared by every camera, and it exists to serve LATE
+	* cross-process crops. Measured on the live hub during the incident it sits
+	* PINNED at `registrySize=256 registryCap=256`, so an entry's lifetime is a
+	* function of how many other cameras are busy. Ending a frame's hold is a
+	* per-frame lifecycle event and must never be subject to another camera's
+	* eviction pressure.
+	*/
+	dispatchSubjectTiles(result, handle) {
+		if (!handle) return "handleless";
+		const key = frameCutterKey(handle);
+		const cutter = this.frameCutters.get(key);
+		this.frameCutters.delete(key);
+		if (!cutter) return "unbound";
 		const boxes = planTileCuts(result.detections ?? [], {
 			width: result.width,
 			height: result.height
 		});
 		try {
-			found.request.cutTiles(boxes);
-		} catch (err) {
-			this.ctx.logger.debug("subject tile cut could not be dispatched", {
-				tags: { deviceId },
-				meta: {
-					subjects: boxes.length,
-					error: err instanceof Error ? err.message : String(err)
-				}
-			});
+			cutter.cutTiles(boxes);
+			return "sent";
+		} catch {
+			return "threw";
+		}
+	}
+	/**
+	* Bind a frame's cutter at DELIVERY, so its result can end its hold.
+	*
+	* Bounded by {@link MAX_BOUND_FRAME_CUTTERS}: a frame whose result never
+	* comes back (a shed, a timed-out inference, a camera detaching mid-flight)
+	* would otherwise leave its binding forever. The oldest is dropped and its
+	* hold released directly — the worker's own frame bound would have reclaimed
+	* it anyway, but releasing here is what keeps `holdOverflow` meaning "the
+	* runner stopped answering" rather than "the runner forgot".
+	*/
+	bindFrameCutter(handle, cutter) {
+		const key = frameCutterKey(handle);
+		this.frameCutters.delete(key);
+		this.frameCutters.set(key, cutter);
+		while (this.frameCutters.size > MAX_BOUND_FRAME_CUTTERS) {
+			const oldest = this.frameCutters.keys().next().value;
+			if (oldest === void 0) break;
+			const stale = this.frameCutters.get(oldest);
+			this.frameCutters.delete(oldest);
+			try {
+				stale?.release();
+			} catch {}
 		}
 	}
 	/**
@@ -5973,7 +6055,10 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 						reservation = null;
 						if (!current) return;
 						const handle = current.detection ? retainedFrames?.write(config.deviceId, frame) ?? void 0 : void 0;
-						if (handle && nativeCrop) this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+						if (handle && nativeCrop) {
+							this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+							this.bindFrameCutter(handle, nativeCrop);
+						}
 						if (this.enqueueSharedDetectionFrame(config.deviceId, frame, handle, current)) nativeCrop?.markInferred();
 					}
 				});
@@ -6497,7 +6582,10 @@ var PipelineRunnerAddon = class PipelineRunnerAddon extends require_dist.BaseAdd
 				onDecodedFrame: (frame, nativeCrop) => {
 					if (settled) return;
 					const handle = retainedFrames?.write(config.deviceId, frame) ?? void 0;
-					if (handle && nativeCrop) this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+					if (handle && nativeCrop) {
+						this.nativeCropRegistry.register(handle, nativeCrop, config.deviceId);
+						this.bindFrameCutter(handle, nativeCrop);
+					}
 					if (runner.enqueueOccupancyFrame(deviceId, frame, handle)) nativeCrop?.markInferred();
 					count++;
 					if (count >= frames) {