@camstack/addon-pipeline 1.2.74 → 1.2.76

package/dist/recorder/index.mjs

@@ -1,10 +1,10 @@
-import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-CKY0efl3.mjs";
+import { At as string, Dt as number, J as recordingExportCapability, Mt as EventCategory, N as deriveRecordingMode, Ot as object, St as array, Z as storageEvictableCapability, _ as OpsLogEntrySchema, b as RECORDING_EXPORT_MAX_READ_BYTES, c as DEFAULT_EVENTS_BAND_BUFFER_SEC, d as EVENT_PAD_MS, ft as hydrateSchema, gt as nodePin, kt as record, p as ExportRecordSchema, q as recordingCapability, st as BaseAddon, tt as errMsg, ut as DeviceType, x as RecordingConfigSchema, yt as selectAssignedProfileSlots } from "../dist-zksfWnEA.mjs";
 import { t as resolveHubHostname } from "../hub-hostname-cCknRYKj.mjs";
-import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-CZ2xo67g.mjs";
+import { n as createFileDataPlaneHandler, s as parseRangeHeader, t as contentTypeFor } from "../addon-utils-A2S9D7pu.mjs";
 import { randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
-import { createReadStream, promises, realpathSync } from "node:fs";
 import path from "node:path";
+import { createReadStream, promises, realpathSync } from "node:fs";
 import { open } from "node:fs/promises";
 //#region src/recorder/event-capture.ts
 function markerFromMotion(data, pad) {
@@ -2249,7 +2249,7 @@ var DEFAULT_DEVICE_CONFIG = {
 	enabled: false,
 	bands: []
 };
-function serialize(map) {
+function serialize$1(map) {
 	const out = {};
 	for (const [id, config] of map) out[String(id)] = config;
 	return out;
@@ -2304,7 +2304,7 @@ async function saveDeviceConfig(state, deviceId, config) {
 	};
 	const map = await readDeviceConfigs(state);
 	map.set(deviceId, validated);
-	await state.set(serialize(map));
+	await state.set(serialize$1(map));
 	return validated;
 }
 /**
@@ -2642,6 +2642,33 @@ function buildExportArgs(input) {
 var RECORDING_EXPORTS_KEY = "recordingExports";
 /** Persisted shape: export id → full ExportRecord. */
 var RecordingExportsBlobSchema = record(string(), ExportRecordSchema);
+/**
+* One in-flight mutation chain per durable handle.
+*
+* EVERY mutation here is a read-modify-write of the SAME blob, and both halves
+* are async — so two overlapping cycles read the same snapshot and the second
+* `set` discards whatever the first one added. Last writer wins, silently.
+*
+* That is not a hypothetical. The engine patches `progressPct` roughly once a
+* second for an in-flight render, unawaited; on 2026-08-14 a `createExport` for
+* camera 615 landed between one such patch's read and its write, the row was
+* erased, and five seconds later the poll answered `unknown export
+* "547ea182-…"`. The camera's whole night was lost to it — the scheduler read a
+* vanished row as a failed render and re-queued, forever.
+*
+* Serialising per handle is the smallest fix that makes the loss impossible:
+* the cycles queue instead of interleaving, and the queue is per state object
+* so two recorders in one process never contend. A `WeakMap` keeps a disposed
+* handle collectable. Reads stay OUTSIDE the chain — a blob replacement is
+* atomic, so a reader always sees one consistent generation.
+*/
+var mutationChains = /* @__PURE__ */ new WeakMap();
+/** Run `work` after every mutation already queued for `state`, never before. */
+async function serialize(state, work) {
+	const next = (mutationChains.get(state) ?? Promise.resolve()).then(work, work);
+	mutationChains.set(state, next.catch(() => void 0));
+	return next;
+}
 /** Read every persisted export row, keyed by export id. */
 async function readExports(state) {
 	const blob = await state.get();
@@ -2650,26 +2677,30 @@ async function readExports(state) {
 /** Insert or replace one export row. Validates at the boundary. Returns it. */
 async function upsertExport(state, record) {
 	const validated = ExportRecordSchema.parse(record);
-	const map = await readExports(state);
-	map.set(validated.id, validated);
-	await state.set(Object.fromEntries(map));
-	return validated;
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		map.set(validated.id, validated);
+		await state.set(Object.fromEntries(map));
+		return validated;
+	});
 }
 /**
 * Shallow-merge a patch into one export row and persist. Returns the merged
 * record, or null when the id is unknown.
 */
 async function patchExport(state, id, patch) {
-	const map = await readExports(state);
-	const existing = map.get(id);
-	if (!existing) return null;
-	const merged = ExportRecordSchema.parse({
-		...existing,
-		...patch
+	return serialize(state, async () => {
+		const map = await readExports(state);
+		const existing = map.get(id);
+		if (!existing) return null;
+		const merged = ExportRecordSchema.parse({
+			...existing,
+			...patch
+		});
+		map.set(id, merged);
+		await state.set(Object.fromEntries(map));
+		return merged;
 	});
-	map.set(id, merged);
-	await state.set(Object.fromEntries(map));
-	return merged;
 }
 /** Read one export row by id, or null. */
 async function getExportRecord(state, id) {
@@ -3000,6 +3031,80 @@ async function markDownloaded(id, now, deps, scheduleDelete, graceMs) {
 	}, graceMs);
 }
 //#endregion
+//#region src/recorder/addon/export-reconcile.ts
+/**
+* States that can only mean "a render was owed and the process went away".
+*
+* There is no live render at reconcile time by construction: the engine is
+* built fresh with an empty queue, and this runs before anything is enqueued.
+*/
+function isInterrupted(record) {
+	return record.state === "queued" || record.state === "rendering";
+}
+/**
+* Hand every interrupted row back to the engine, once, at boot.
+*
+* A row past its `expiresAt` is FAILED rather than re-rendered: hours of
+* footage re-encoded for a file the janitor is about to drop costs a recording
+* node an ffmpeg for nothing. Failing it is also what makes the outcome
+* visible — a row that silently stays `queued` forever is the defect this
+* module exists to remove, and swapping it for a quieter one would not be a
+* fix.
+*/
+async function reconcileInterruptedExports(deps) {
+	const now = deps.now();
+	const interrupted = (await listExportsFor(deps.state)).filter(isInterrupted);
+	if (interrupted.length === 0) return {
+		requeued: 0,
+		expired: 0
+	};
+	let requeued = 0;
+	let expired = 0;
+	for (const row of interrupted) {
+		const tags = { deviceId: row.deviceId };
+		const meta = {
+			exportId: row.id,
+			wasState: row.state,
+			fromMs: row.fromMs,
+			toMs: row.toMs,
+			createdAt: row.createdAt
+		};
+		if (row.expiresAt <= now) {
+			expired += 1;
+			await patchExport(deps.state, row.id, {
+				state: "failed",
+				progressPct: null,
+				error: "interrupted by a restart and expired before it could be rendered"
+			});
+			deps.logger.warn("export abandoned: interrupted by a restart, and already expired", {
+				tags,
+				meta
+			});
+			continue;
+		}
+		requeued += 1;
+		await patchExport(deps.state, row.id, {
+			state: "queued",
+			progressPct: null,
+			error: null
+		});
+		deps.logger.warn("export re-queued: it was interrupted by a restart", {
+			tags,
+			meta
+		});
+		deps.engine.enqueue(row.id);
+	}
+	deps.logger.info("recording exports reconciled after restart", { meta: {
+		interrupted: interrupted.length,
+		requeued,
+		expired
+	} });
+	return {
+		requeued,
+		expired
+	};
+}
+//#endregion
 //#region src/recorder/playlist.ts
 /** A VOD variant playlist with an absolute wall-clock anchor per segment. */
 function buildVariantPlaylist(segments) {
@@ -7477,23 +7582,25 @@ var RecorderV2Addon = class extends BaseAddon {
 		this.retentionSweeper?.start();
 	}
 	/**
-	* Resume interrupted exports and arm the expiry sweep. A row left `rendering`
-	* by a crash/restart has no live ffmpeg, so demote it to `queued` and re-enqueue
-	* it alongside any still-`queued` rows. The sweep runs immediately then on an
-	* interval; both are best-effort (a failure never blocks boot).
+	* Resume interrupted exports and arm the expiry sweep.
+	*
+	* The resume itself lives in `export-reconcile.ts` — pure, tested, and loud
+	* about every row it moves. It used to be an untested loop inlined here that
+	* said nothing at all, so "why is this export still queued an hour later" had
+	* no answer in the log, and a row whose life had already run out was
+	* re-rendered anyway. Both halves are best-effort: a failure never blocks
+	* boot.
 	*/
 	async bootstrapExports() {
 		const engine = this.exportEngine;
 		if (!engine) return;
-		const state = this.exportsStore();
 		try {
-			for (const rec of await listExportsFor(state)) {
-				if (rec.state === "rendering") await patchExport(state, rec.id, {
-					state: "queued",
-					progressPct: null
-				});
-				if (rec.state === "queued" || rec.state === "rendering") engine.enqueue(rec.id);
-			}
+			await reconcileInterruptedExports({
+				state: this.exportsStore(),
+				engine,
+				now: () => Date.now(),
+				logger: this.ctx.logger.child("export")
+			});
 		} catch (err) {
 			this.ctx.logger.warn("recorder: export boot re-queue failed", { meta: { error: errMsg(err) } });
 		}