@camstack/addon-pipeline 1.2.74 → 1.2.76

package/dist/session-decode/decode-worker-child.mjs

@@ -1,8 +1,5 @@
-import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-BzAQPUR-.mjs";
-import { t as getSharp } from "../lazy-sharp-B-mb8uWx.mjs";
-import { pathToFileURL } from "node:url";
-import * as fs from "node:fs";
-import * as path$1 from "node:path";
+import { i as formatNativeLeaseKnobs, n as isWorkerRequest, o as resolveNativeLeaseKnobs, r as logLevelForLine } from "../worker-protocol-DyX_HbaJ.mjs";
+import { n as setSharpWarnSink, r as hostExternalEntryUrls, t as getSharp } from "../lazy-sharp-6oymT_yf.mjs";
 //#region src/session-decode/color-conversion.ts
 /**
 * Explicit YUV→RGB colorspace/range resolution for the session-decode worker.
@@ -875,6 +872,82 @@ var NativeTileStore = class {
 	}
 };
 //#endregion
+//#region src/session-decode/planar-crop-source.ts
+/** How many planes each layout must present before the offsets mean anything. */
+var PLANE_COUNT = {
+	yuv420p: 3,
+	nv12: 2
+};
+/**
+* Cache tag for a native-crop scaler's SOURCE format. `yuv420p` is the empty
+* string on purpose: it keeps the historical, unprefixed cache key byte-for-byte
+* (`320x240->160x120`), so adding formats cannot silently move an existing
+* session onto a different scaler.
+*/
+function nativeCropSourceTag(format) {
+	switch (format) {
+		case "yuv420p": return "";
+		case "nv12": return "nv12:";
+		case "rgb24": return "rgb:";
+	}
+}
+/** A plane view starting at `offset`, or `null` when the plane is too short. */
+function viewAt(plane, offset, requiredSpan) {
+	if (!plane) return null;
+	if (offset < 0 || plane.length - offset < requiredSpan) return null;
+	return plane.subarray(offset);
+}
+/**
+* Resolve the plane views a crop of `region` reads, for `kind`.
+*
+* Returns `null` — never a partial or clamped view — when the frame does not
+* present the planes the layout requires, or when the region would run past a
+* plane's end. The caller counts that as a crop miss and says so ONCE; a short
+* view would hand libswscale a buffer to read past, which is how this path
+* previously produced heap corruption rather than an error.
+*
+* An odd origin is floored onto the chroma grid rather than rejected: the
+* geometry helper already aligns to even, and flooring reads the chroma sample
+* that CONTAINS the origin instead of inventing a half sample.
+*/
+function resolvePlanarCropSource(kind, planes, strides, region) {
+	if (!planes || planes.length < PLANE_COUNT[kind]) return null;
+	const yStride = strides?.[0] ?? 0;
+	const cStride = strides?.[1] ?? 0;
+	if (yStride <= 0 || cStride <= 0) return null;
+	const top = Math.max(0, region.top);
+	const left = Math.max(0, region.left);
+	const chromaRow = Math.floor(top / 2);
+	const chromaHeight = Math.ceil(region.height / 2);
+	const y = viewAt(planes[0], top * yStride + left, yStride * region.height);
+	if (kind === "nv12") {
+		const uvOffset = chromaRow * cStride + Math.floor(left / 2) * 2;
+		const uv = viewAt(planes[1], uvOffset, cStride * chromaHeight);
+		if (!y || !uv) return null;
+		return {
+			planes: [y, uv],
+			strides: [yStride, cStride]
+		};
+	}
+	const vStride = strides?.[2] ?? cStride;
+	const chromaOffset = chromaRow * cStride + Math.floor(left / 2);
+	const u = viewAt(planes[1], chromaOffset, cStride * chromaHeight);
+	const v = viewAt(planes[2], chromaRow * vStride + Math.floor(left / 2), vStride * chromaHeight);
+	if (!y || !u || !v) return null;
+	return {
+		planes: [
+			y,
+			u,
+			v
+		],
+		strides: [
+			yStride,
+			cStride,
+			vStride
+		]
+	};
+}
+//#endregion
 //#region src/session-decode/pinned-rgb-crop.ts
 /**
 * Pure decision/plumbing helpers for the `pinnedRgbCrop` native-crop color fix
@@ -930,12 +1003,13 @@ function leaseDownloadFilterKey(srcW, srcH, color) {
 /**
 * Cache key for the dedicated native-crop software scaler. YUV420P (flag OFF /
 * degrade) returns the historical `${srcW}x${srcH}->${dstW}x${dstH}` key
-* byte-for-byte; the RGB24 (flag ON) scaler carries an `rgb:` prefix so an RGB
-* scaler and a YUV scaler of identical geometry never alias the same cache slot.
+* byte-for-byte; every other source layout carries its own prefix
+* ({@link nativeCropSourceTag}) so two scalers of identical geometry but
+* different SOURCE format never alias the same cache slot — a scaler built for
+* three planes handed two reads garbage, silently.
 */
-function nativeCropScalerKey(srcW, srcH, dstW, dstH, rgb24) {
-	const base = `${srcW}x${srcH}->${dstW}x${dstH}`;
-	return rgb24 ? `rgb:${base}` : base;
+function nativeCropScalerKey(srcW, srcH, dstW, dstH, srcFormat) {
+	return `${nativeCropSourceTag(srcFormat)}${srcW}x${srcH}->${dstW}x${dstH}`;
 }
 /**
 * Approximate resident bytes of a retained software frame, for the lease
@@ -994,31 +1068,60 @@ function resolveRgbCropSource(plane, planeStride, region) {
 	};
 }
 //#endregion
-//#region src/session-decode/decode-worker-child.ts
+//#region src/session-decode/subject-tile-cut.ts
+function failureReason(err) {
+	return err instanceof Error ? err.message : String(err);
+}
 /**
-* Decode-worker CHILD entry point — Epic C P1, Task 2.
+* Copy every subject's pixels out of `frame`. SYNCHRONOUS on purpose — see the
+* module docblock; adding an `await` here reopens the race this closes.
 *
-* This file is the whole program run by a per-session `child_process.fork`
-* that the pipeline-runner's session-decode coordinator (Task 3) spawns and
-* tears down on session end, so the OS reclaims the VAAPI/GPU decode pool by
-* process exit (Task 0 live-validated that reclaim-by-exit works — node-av
-* does not release the hw_frames_ctx pool on `dispose()` alone). It decodes
-* with node-av in-process and hands decoded frames to its parent as a
-* request/response PULL over its own dedicated fork IPC channel. Frames
-* NEVER touch `/dev/shm` — no shm sink is ever constructed here.
+* Liveness is re-checked before EVERY read and the loop STOPS at the first
+* failed check: once a frame has been freed, the remaining subjects are lost
+* regardless, and there is nothing to gain from asking again per subject.
+* `onFrameLost` therefore fires at most once.
+*/
+function extractSubjectTiles(frame, bboxes, ports) {
+	const raws = [];
+	for (const bbox of bboxes) {
+		if (!ports.isLive(frame)) {
+			ports.onFrameLost();
+			return raws;
+		}
+		try {
+			raws.push(ports.cutRaw(frame, bbox));
+		} catch (err) {
+			ports.onCutFailed(failureReason(err));
+		}
+	}
+	return raws;
+}
+/**
+* Cut and encode one frame's subject tiles.
+*
+* Two phases, and the boundary between them is the whole point: extraction
+* (synchronous, touches the frame) then encoding (async, touches only copies).
 *
-* ‼ SANCTIONED RAW IPC — READ BEFORE "FIXING" THIS FILE ‼
-* CLAUDE.md rule #8 forbids `process.send`/`process.on('message')` for
-* BUSINESS LOGIC — that rule governs cross-ADDON traffic, which must travel
-* over the UDS cap/event channel (`LocalChildRegistry`/`LocalChildClient`)
-* instead of raw IPC. This file is NOT a second addon: it is a private
-* worker directly forked by the pipeline-runner addon, exactly like the
-* Python inference pool's own subprocess. The Epic C P1 plan's Global
-* Constraints explicitly carve this out — "a directly-forked worker child
-* talks to its parent over its own IPC channel (this is NOT a cap call and
-* NOT `$process`)". Raw `process.on('message')` / `process.send` are the
-* correct, sanctioned mechanism for this specific file only.
+* The hold is deliberately NOT ended at that boundary, tempting as it looks: the
+* tiles are not stored until the encodes finish, so releasing the raster early
+* would open a window in which a crop request for this frame can be served by
+* neither the lease nor a tile. That window is small and the RAM it would buy
+* back is one frame for a few milliseconds — a bad trade against a miss, which
+* is the failure this whole tier exists to remove. The caller releases once,
+* after the tiles are in the store.
 */
+async function cutSubjectTiles(frame, bboxes, ports) {
+	const raws = extractSubjectTiles(frame, bboxes, ports);
+	const tiles = [];
+	for (const raw of raws) try {
+		tiles.push(await ports.encode(raw));
+	} catch (err) {
+		ports.onCutFailed(failureReason(err));
+	}
+	return tiles;
+}
+//#endregion
+//#region src/session-decode/decode-worker-child.ts
 /** Wrap a software YUV420P frame as a lease entry (byte size ≈ w×h×1.5). */
 function toLeasedNavFrame(frame) {
 	return {
@@ -1210,68 +1313,64 @@ function gpuScaleFilterForBackend(backend) {
 function pixelFilterName(format) {
 	return format === "gray" ? "gray" : "rgb24";
 }
-var _nav = null;
-var _consts = null;
 /**
-* Candidate file URLs for a node-av entry (`.` or `./constants`) in the
-* module locations an AGENT lays node-av out in.
+* The crop layout a retained frame's `AV_PIX_FMT_*` maps to, or `null` when this
+* path cannot read it.
 *
-* WHY: this worker runs as a plain `child_process.fork` (see `fork-decode-
-* worker.ts`) which does NOT inherit the addon-runner's module resolution
-* (NODE_PATH / the framework ESM hook). On the HUB the fork inherits that hook,
-* so the bare `import('node-av')` resolves. On an AGENT it does not, so the
-* bare import throws `Cannot find package 'node-av'` and we resolve node-av
-* explicitly from the agent's known layout:
-*   • DOCKER agent — the framework overlay `CAMSTACK_FRAMEWORK_DIR`
-*     (`/data/framework/node_modules/node-av`).
-*   • ELECTRON agent — the app bundle beside `CAMSTACK_BUNDLED_ADDONS_DIR`
-*     (`<resources>/addons`): `<resources>/node_modules/node-av` (+ the
-*     `app.asar.unpacked` mirror).
-* Both env vars point at real dirs only on the respective platform; a missing
-* dir is skipped, and `[]` (dev / hub with the bare import already working)
-* keeps the bare specifier the only path.
+* Only the formats the lease can actually hold are listed, and deliberately so:
+* a format nobody has seen must surface as a NAMED failure the next session can
+* act on, not as a guess that silently mis-reads chroma. `AV_PIX_FMT_NV12` is
+* here because a videotoolbox-era retained frame arrives as two planes — the
+* shape that made every subject tile on dev:617 fail.
 */
-function fallbackNodeAvUrls(subpath) {
-	const rel = subpath === "." ? "dist/index.js" : "dist/constants/index.js";
-	const dirs = [];
-	const frameworkDir = process.env["CAMSTACK_FRAMEWORK_DIR"];
-	if (frameworkDir !== void 0 && frameworkDir.length > 0) dirs.push(path$1.join(frameworkDir, "node_modules", "node-av"));
-	const bundledAddons = process.env["CAMSTACK_BUNDLED_ADDONS_DIR"];
-	if (bundledAddons !== void 0 && bundledAddons.length > 0) {
-		const resourcesRoot = path$1.dirname(bundledAddons);
-		dirs.push(path$1.join(resourcesRoot, "node_modules", "node-av"));
-		dirs.push(path$1.join(resourcesRoot, "app.asar.unpacked", "node_modules", "node-av"));
-	}
-	const urls = [];
-	for (const dir of dirs) {
-		const entry = path$1.join(dir, rel);
-		if (fs.existsSync(entry)) urls.push(pathToFileURL(entry).href);
-	}
-	return urls;
+function planarCropKindFor(format, C) {
+	if (format === C.AV_PIX_FMT_YUV420P) return "yuv420p";
+	if (format === C.AV_PIX_FMT_NV12) return "nv12";
+	return null;
+}
+/** The `AV_PIX_FMT_*` a native-crop scaler is built with for a source layout. */
+function navPixelFormatFor(format, C) {
+	switch (format) {
+		case "yuv420p": return C.AV_PIX_FMT_YUV420P;
+		case "nv12": return C.AV_PIX_FMT_NV12;
+		case "rgb24": return C.AV_PIX_FMT_RGB24;
+	}
 }
+var _nav = null;
+var _consts = null;
 /**
 * Import a node-av entry, falling back to the agent's explicit node-av path
-* when the bare specifier can't be resolved (see {@link fallbackNodeAvUrls}).
+* when the bare specifier can't be resolved.
+*
+* WHY: this worker runs as a plain `child_process.fork` (see
+* `fork-decode-worker.ts`) which does NOT inherit the addon-runner's module
+* resolution (the framework ESM hook). On the HUB the fork inherits that hook,
+* so the bare `import('node-av')` resolves; on an AGENT it does not and the bare
+* import throws `Cannot find package 'node-av'`. The candidate layouts, and why
+* the resolver hook is not simply registered in the child instead, live in
+* `shared/host-external-import.ts`. `sharp` needs the same treatment and gets it
+* through `shared/lazy-sharp.ts` — one mechanism, two callers.
+*
 * Each candidate is tried in turn so a copy whose native binary fails to load
 * doesn't mask a working one. A dynamic `import(url)` is typed `any`, so the
 * caller's declared module type applies without a cast.
 */
-async function importNodeAv(bareSpecifier, subpath) {
+async function importNodeAv(bareSpecifier) {
 	try {
 		return await import(bareSpecifier);
 	} catch (bareErr) {
-		for (const url of fallbackNodeAvUrls(subpath)) try {
+		for (const url of hostExternalEntryUrls(bareSpecifier)) try {
 			return await import(url);
 		} catch {}
 		throw bareErr;
 	}
 }
 async function getNodeAv() {
-	if (!_nav) _nav = await importNodeAv("node-av", ".");
+	if (!_nav) _nav = await importNodeAv("node-av");
 	return _nav;
 }
 async function getConstants() {
-	if (!_consts) _consts = await importNodeAv("node-av/constants", "./constants");
+	if (!_consts) _consts = await importNodeAv("node-av/constants");
 	return _consts;
 }
 function errMessage(err) {
@@ -1538,6 +1637,18 @@ var DecodeWorkerChild = class {
 	/** One-shot, so a legitimately long session does not repeat the warning
 	*  every ten seconds. */
 	warnedLarge = false;
+	/**
+	* One-shot for "there is no JPEG encoder here" — see {@link tileEncoder}. The
+	* branch it guards runs once per subject per frame, which is what made the
+	* un-guarded version a log flood rather than a diagnosis.
+	*/
+	warnedTileEncoderUnavailable = false;
+	/**
+	* The last subject-tile-cut failure REASON logged — see
+	* {@link reportTileCutFailure}. Compared, not counted: the count lives on the
+	* metrics line where it can be read per device.
+	*/
+	lastTileCutFailureReason = "";
 	lastDeliveredSnapshot = 0;
 	metricsTimer = null;
 	demuxer = null;
@@ -1823,41 +1934,60 @@ var DecodeWorkerChild = class {
 	async handleCutTiles(frameId, bboxes) {
 		try {
 			if (!this.tileStore.enabled || bboxes.length === 0) return;
+			const wanted = bboxes.slice(0, NATIVE_TILE_MAX_PER_FRAME);
+			if (bboxes.length > wanted.length) this.emitStderr(`decode-worker-child: tile cut capped at ${NATIVE_TILE_MAX_PER_FRAME} of ${bboxes.length} subjects on frame ${frameId} — the rest fall back to the ≤640 tier\n`);
+			const sharp = await this.tileEncoder();
 			const frame = this.leaseStore.get(frameId)?.frame ?? this.resolveRetainedFrame(frameId);
 			if (!frame) {
 				this.tileCutFailures += 1;
 				return;
 			}
+			if (sharp === null) {
+				this.tileCutFailures += wanted.length;
+				return;
+			}
+			if (!this.isRetainedFrameLive(frame)) {
+				this.tileCutFailures += wanted.length;
+				this.reportTileCutFailure(frameId, "the retained frame was released before the cut");
+				return;
+			}
 			this.tileFrameWidth = frame.width;
 			this.tileFrameHeight = frame.height;
-			const wanted = bboxes.slice(0, NATIVE_TILE_MAX_PER_FRAME);
-			if (bboxes.length > wanted.length) this.emitStderr(`decode-worker-child: tile cut capped at ${NATIVE_TILE_MAX_PER_FRAME} of ${bboxes.length} subjects on frame ${frameId} — the rest fall back to the ≤640 tier\n`);
-			const tiles = [];
-			for (const bbox of wanted) {
-				const { region } = resolveNativeTileRegion(frame.width, frame.height, bbox, NATIVE_TILE_PADDING_RATIO);
-				const resolved = {
-					region,
-					target: {
-						width: region.width,
-						height: region.height
-					}
-				};
-				try {
-					const raw = frame.isHwFrame() ? this.nativeHwCropToBuffer(frame, resolved) : this.nativeScaleCropToBuffer(frame, resolved);
-					const jpeg = await (await getSharp())(raw, { raw: {
-						width: region.width,
-						height: region.height,
+			const tiles = await cutSubjectTiles(frame, wanted, {
+				isLive: (f) => this.isRetainedFrameLive(f),
+				cutRaw: (f, bbox) => {
+					const { region } = resolveNativeTileRegion(f.width, f.height, bbox, NATIVE_TILE_PADDING_RATIO);
+					const resolved = {
+						region,
+						target: {
+							width: region.width,
+							height: region.height
+						}
+					};
+					return {
+						region,
+						raw: f.isHwFrame() ? this.nativeHwCropToBuffer(f, resolved) : this.nativeScaleCropToBuffer(f, resolved)
+					};
+				},
+				encode: async (tile) => {
+					const jpeg = await sharp(tile.raw, { raw: {
+						width: tile.region.width,
+						height: tile.region.height,
 						channels: 3
 					} }).jpeg({ quality: NATIVE_TILE_JPEG_QUALITY }).toBuffer();
-					tiles.push({
-						region,
+					return {
+						region: tile.region,
 						bytes: new Uint8Array(jpeg)
-					});
-				} catch (err) {
-					this.tileCutFailures += 1;
-					this.emitStderr(`decode-worker-child: subject tile cut FAILED on frame ${frameId} — ${errMessage(err)}\n`);
+					};
+				},
+				onFrameLost: () => {
+					this.reportTileCutFailure(frameId, "the retained frame was released mid-cut");
+				},
+				onCutFailed: (reason) => {
+					this.reportTileCutFailure(frameId, reason);
 				}
-			}
+			});
+			this.tileCutFailures += wanted.length - tiles.length;
 			if (tiles.length > 0) {
 				this.tilesCut += tiles.length;
 				this.tileStore.put(frameId, tiles);
@@ -1867,6 +1997,73 @@ var DecodeWorkerChild = class {
 		}
 	}
 	/**
+	* Is this retained frame still backed by pixels?
+	*
+	* A node-av frame whose `free()` has run reports `AV_PIX_FMT_NONE` and no
+	* planes — that is what dev:1443 logged (`pixel format -1 (planes=0,
+	* hw=false)`) when an eviction landed mid-cut. A HW frame legitimately has no
+	* `data` planes, so residency is judged there by format and dimensions.
+	*
+	* This is an ASSERTION of the invariant `subject-tile-cut.ts` establishes by
+	* ORDERING, not the mechanism that enforces it: within one synchronous turn
+	* nothing can free the frame, so the check can only fail for a frame that was
+	* already dead when the cut arrived. It is kept, and consulted before every
+	* read, so that an edit which reintroduces an await inside the loop degrades
+	* to a counted miss instead of a read of recycled memory.
+	*/
+	isRetainedFrameLive(frame) {
+		const C = this.consts;
+		if (!C) return false;
+		if (frame.format === C.AV_PIX_FMT_NONE) return false;
+		if (frame.width <= 0 || frame.height <= 0) return false;
+		if (frame.isHwFrame()) return true;
+		return (frame.data?.length ?? 0) > 0;
+	}
+	/**
+	* Report a failed subject-tile cut — on TRANSITION, not per subject.
+	*
+	* Every failure is COUNTED (`tileCutFailures`, on the periodic metrics line
+	* per device), so the volume is never hidden; what is suppressed is only the
+	* repetition of a cause already stated. A tile cut fails once per subject per
+	* frame, so a standing cause — a retained format this path cannot read, which
+	* is precisely what dev:617 had — writes one line per subject per frame: 533
+	* identical lines that said the same thing 533 times.
+	*
+	* Transition rather than one-shot, mirroring {@link logColorProvenance}: a
+	* SECOND, different cause is worth a line, and a cause that comes back after
+	* another one intervened is a real signal. The frame id is in the message but
+	* deliberately not in the comparison key — otherwise every frame is a
+	* "transition" and nothing is suppressed.
+	*/
+	reportTileCutFailure(frameId, reason) {
+		if (reason === this.lastTileCutFailureReason) return;
+		this.lastTileCutFailureReason = reason;
+		this.emitStderr(`decode-worker-child: subject tile cut FAILED on frame ${frameId} — ${reason} (further identical failures are counted in tileCutFailures, not logged)\n`);
+	}
+	/**
+	* The JPEG encoder for subject tiles, or `null` when `sharp` cannot be
+	* resolved in this process at all.
+	*
+	* `getSharp()` memoizes an unresolvable `sharp` (see `shared/lazy-sharp.ts`),
+	* so this costs one module-loader round trip for the worker's whole life and a
+	* rejected promise thereafter. The diagnostic is one-shot for the same reason
+	* the memo is: the cause cannot change under a running worker, and the failing
+	* branch is per subject per frame. The loader emits its own line naming every
+	* path it tried; this one names the CONSEQUENCE, which is what an operator
+	* looking at a camera with no detail crops needs to read.
+	*/
+	async tileEncoder() {
+		try {
+			return await getSharp();
+		} catch (err) {
+			if (!this.warnedTileEncoderUnavailable) {
+				this.warnedTileEncoderUnavailable = true;
+				this.emitStderr(`decode-worker-child: subject tile tier DISABLED — no JPEG encoder: ${errMessage(err)}\n`);
+			}
+			return null;
+		}
+	}
+	/**
 	* Serve a native crop from a retained subject TILE — the rung that covers the
 	* ordinary case, where the request arrives seconds after the frame is gone.
 	*
@@ -2069,30 +2266,16 @@ var DecodeWorkerChild = class {
 		if (frame.format === C.AV_PIX_FMT_RGB24) return this.nativeRgbCropToBuffer(nav, C, frame, resolved);
 		this.logColorProvenance("sw-crop", this.resolveFrameColor(frame));
 		const { region, target } = resolved;
-		const planes = frame.data;
-		const strides = frame.linesize;
-		const yPlane = planes?.[0];
-		const uPlane = planes?.[1];
-		const vPlane = planes?.[2];
-		if (!yPlane || !uPlane || !vPlane) throw new Error("decode-worker-child: retained frame missing planar YUV420P data");
-		const yStride = strides[0] ?? 0;
-		const cStride = strides[1] ?? 0;
-		const ySlice = yPlane.subarray(region.top * yStride + region.left);
-		const uSlice = uPlane.subarray(region.top / 2 * cStride + region.left / 2);
-		const vSlice = vPlane.subarray(region.top / 2 * cStride + region.left / 2);
-		const scaler = this.ensureNativeCropScaler(nav, C, region.width, region.height, target.width, target.height, C.AV_PIX_FMT_YUV420P);
+		const kind = planarCropKindFor(frame.format, C);
+		if (kind === null) throw new Error(`decode-worker-child: retained frame in unsupported pixel format ${frame.format} (planes=${frame.data?.length ?? 0}, hw=${frame.isHwFrame()}) — cannot crop`);
+		const source = resolvePlanarCropSource(kind, frame.data, frame.linesize, region);
+		if (!source) throw new Error(`decode-worker-child: retained ${kind} frame missing plane data for ${region.width}x${region.height}+${region.left}+${region.top} (planes=${frame.data?.length ?? 0})`);
+		const scaler = this.ensureNativeCropScaler(nav, C, region.width, region.height, target.width, target.height, kind);
 		const tightStride = target.width * 3;
 		const dstStride = tightStride + 63 & -64;
 		const dstBuffer = Buffer.allocUnsafe(dstStride * target.height + 64);
-		const scaledHeight = scaler.scaleSync([
-			ySlice,
-			uSlice,
-			vSlice
-		], [
-			yStride,
-			cStride,
-			cStride
-		], 0, region.height, [dstBuffer], [dstStride]);
+		const srcPlanes = source.planes.map((plane) => Buffer.from(plane.buffer, plane.byteOffset, plane.byteLength));
+		const scaledHeight = scaler.scaleSync(srcPlanes, [...source.strides], 0, region.height, [dstBuffer], [dstStride]);
 		if (scaledHeight < 0) throw new Error(`native crop sws_scale failed: ${scaledHeight}`);
 		if (scaledHeight !== target.height) throw new Error(`native crop scaler produced ${scaledHeight} of ${target.height} rows`);
 		if (dstStride === tightStride) return dstBuffer.subarray(0, tightStride * target.height);
@@ -2113,7 +2296,7 @@ var DecodeWorkerChild = class {
 		if (!plane) throw new Error("decode-worker-child: retained RGB frame missing packed plane data");
 		const { src: srcRgb, stride: srcSliceStride } = resolveRgbCropSource(plane, frame.linesize[0] ?? 0, region);
 		const srcSlice = Buffer.from(srcRgb.buffer, srcRgb.byteOffset, srcRgb.byteLength);
-		const scaler = this.ensureNativeCropScaler(nav, C, region.width, region.height, target.width, target.height, C.AV_PIX_FMT_RGB24);
+		const scaler = this.ensureNativeCropScaler(nav, C, region.width, region.height, target.width, target.height, "rgb24");
 		const tightStride = target.width * 3;
 		const dstStride = tightStride + 63 & -64;
 		const dstBuffer = Buffer.allocUnsafe(dstStride * target.height + 64);
@@ -2149,14 +2332,16 @@ var DecodeWorkerChild = class {
 	}
 	/**
 	* Build-once / reuse the dedicated native-crop software scaler (rgb out).
-	* `srcFmt` parameterizes the SOURCE pixel format so the scaler matches the
-	* retained frame: `AV_PIX_FMT_YUV420P` (flag OFF / degrade — YUV→RGB convert)
-	* or `AV_PIX_FMT_RGB24` (`pinnedRgbCrop` — a pure RGB→RGB spatial resize). The
-	* cache key folds the format in so an RGB and a YUV scaler of identical
+	* `srcFormat` names the SOURCE layout so the scaler matches the retained
+	* frame: `yuv420p` (flag OFF / degrade — YUV→RGB convert), `nv12` (a
+	* two-plane retained frame — libswscale reads it natively, so this is the same
+	* single pass, not a conversion) or `rgb24` (`pinnedRgbCrop` — a pure RGB→RGB
+	* spatial resize). The cache key folds the format in so scalers of identical
 	* geometry never alias one slot (see {@link nativeCropScalerKey}).
 	*/
-	ensureNativeCropScaler(nav, C, srcW, srcH, dstW, dstH, srcFmt) {
-		const key = nativeCropScalerKey(srcW, srcH, dstW, dstH, srcFmt === C.AV_PIX_FMT_RGB24);
+	ensureNativeCropScaler(nav, C, srcW, srcH, dstW, dstH, srcFormat) {
+		const srcFmt = navPixelFormatFor(srcFormat, C);
+		const key = nativeCropScalerKey(srcW, srcH, dstW, dstH, srcFormat);
 		const cached = this.nativeCropScaler;
 		if (cached && key === this.nativeCropScalerKey) return cached;
 		this.nativeCropScaler?.[Symbol.dispose]?.();
@@ -2608,6 +2793,9 @@ var DecodeWorkerChild = class {
 	}
 };
 var worker = new DecodeWorkerChild();
+setSharpWarnSink((message) => {
+	worker.emitStderr(`decode-worker-child: ${message}\n`, "warn");
+});
 process.on("message", (message) => {
 	worker.handleMessage(message);
 });