@7365admin1/core 3.42.1 → 3.42.3

package/CHANGELOG.md

@@ -1,5 +1,101 @@
 # @iservice365/core
 
+## 3.42.3
+
+### Patch Changes
+
+- 854dd11: Editing a building no longer creates duplicate levels or orphaned units
+
+  Updating a block inserted a brand-new level document for every level name in the
+  payload, without checking whether that name was already a level on the block. A
+  client that posted the block's existing level names back — which the block
+  editor's own full-levels payload does — got a second "Level 1" document, a
+  second entry in `building.levels`, and units still pointing at the first one.
+
+  The submitted names are now reconciled against the block's existing ACTIVE
+  levels first. A name that already matches an existing level is left alone and
+  keeps its `_id`, so nothing that references it is orphaned; only genuinely new
+  names are inserted.
+
+  Matching is case- and whitespace-insensitive, using the same normalisation the
+  import path already uses, so "Level 1", "level 1" and "Level  1" are
+  one level. Only the match key is normalised — the stored name keeps its
+  original spelling, so two genuinely different levels are never merged.
+
+  Removals are deliberately not inferred from this payload; deleting a level keeps
+  its own guarded path.
+
+  Worth a QA pass on building edit — this changes what a block update writes.
+
+## 3.42.2
+
+### Patch Changes
+
+- 7078e6f: Make ANPR "Connection Lost" alerts readable, paced, and self-clearing
+
+  The alert an operator actually saw was `Camera [Seventh Condominium-both]
+Connection Lost. Retrying in 10 seconds. Check the camera if this issue
+persists, Or set the camera to Inactive to stop this notification.` Three
+  things were wrong with it:
+
+  - `[<site>-<direction>]` glued a database enum onto the site name and showed it
+    as if it were a place. "both" is the camera's direction setting, not
+    somewhere you can go. The camera is now named the way the setup form names
+    it — by its own name where it has one, otherwise "the entry and exit ANPR
+    camera at <site>".
+  - It told the operator to set the camera Inactive to stop the alert. On a
+    camera driving a barrier, that is advice to switch off plate reading in order
+    to silence the warning that plate reading is off. Removed.
+  - It was emitted on every reconnect attempt — once every 10 seconds with no
+    ceiling — into a snackbar with a 20-second timeout, so a camera that stayed
+    down held a red toast on screen permanently, on every page. One hour of
+    downtime produced 360 alerts.
+
+  Alerts are now paced: the first failure, then roughly 1, 5 and 15 minutes, then
+  every 15 minutes for as long as it stays down. When the camera answers again,
+  an operator who was told it was down is told it is back; if they were never
+  alerted, nothing is sent.
+
+  **The reconnect loop itself is unchanged and still retries every 10 seconds** —
+  only the alerting is paced. A barrier camera has to come back the moment it can.
+
+  Recovery and fault alerts also carry `event` and `camera` fields so a client can
+  group or clear alerts per camera rather than matching on message text. Existing
+  clients ignore them and render `message` as they always have.
+
+- a5d2b88: Stop logging camera and mailer credentials
+
+  Six places wrote a secret or a resident's details to stdout on an ordinary code
+  path. `getTrafficJunction` dumped the whole `TSiteCamera` object — including the
+  camera's `username` and plaintext `password` — on every reconnect, and
+  `addPlateNumber` logged its argument, which carries the same password plus a
+  resident's plate number and owner name. `checkOutBySiteAndPlate` logged the
+  matched visitor transaction. `siteCameraRepo.updateById` logged the re-read
+  camera document, and `vehicleService.add` logged the whole array of a site's
+  cameras, both with credentials in them. `sendEmail` printed `MAILER_PASSWORD`
+  itself on every message sent.
+
+  All now log identifiers, counts and outcomes only, through the module's logger
+  rather than `console.log`; the mailer line is removed outright because it
+  carried nothing but the secret.
+
+- b472360: Fix three Dahua HTTP API defects found by checking our integration against the
+  vendor specification (V3.37):
+
+  - The ANPR reconnect loop retried authentication ten times at one-second
+    intervals. The device locks the account for 1800 seconds after three failed
+    logins in thirty, so our own recovery could take ANPR down at a site for half
+    an hour. Authentication now backs off well past the device's counting window,
+    and a network fault is distinguished from an authentication failure.
+  - 401 and 403 were handled backwards. Per spec §3.4, 401 is the digest
+    challenge (retry) and 403 is a credentials rejection (stop). We treated 403 as
+    an account lock and killed the listener, and counted 401s toward a "wrong
+    password" warning.
+  - `updatePlateNumber`, `bulkInsertPlateNumber` and `removePlateNumber`
+    interpolated values into the CGI query string unencoded, against the spec's
+    stated RFC 3986 requirement. A plate or owner name containing a space or "&"
+    broke the request or appended extra parameters to it.
+
 ## 3.42.1
 
 ### Patch Changes

package/dist/index.d.ts

@@ -7846,6 +7846,7 @@ declare function useBuildingLevelRepo(): {
         message: string;
         data: bson.Document[];
     }>;
+    getActiveLevelsByIds: (ids: (string | ObjectId)[], session?: ClientSession) => Promise<TBuildingLevel[]>;
 };
 
 declare function useBuildingLevelService(): {

package/dist/index.js

@@ -22212,7 +22212,6 @@ async function sendEmail({ to, subject, text, html }) {
       pass: MAILER_PASSWORD
     }
   });
-  console.log(MAILER_EMAIL, MAILER_PASSWORD, MAILER_TRANSPORT_HOST, MAILER_TRANSPORT_PORT);
   const mailOptions = {
     from: `Seven 365 <${MAILER_EMAIL}>`,
     to,
@@ -24249,6 +24248,86 @@ var loggerDahua = winston.createLogger({
   ]
 });
 
+// src/utils/camera-alert.util.ts
+var DIRECTION_WORDS = {
+  entry: "entry",
+  exit: "exit",
+  both: "entry and exit",
+  visitors: "visitor",
+  residents: "resident"
+};
+function describeCamera(camera) {
+  const site = String(camera?.siteName ?? "").trim();
+  const name = String(camera?.name ?? "").trim();
+  const at = site ? ` at ${site}` : "";
+  if (name)
+    return `Camera "${name}"${at}`;
+  const words = DIRECTION_WORDS[String(camera?.direction ?? "").trim().toLowerCase()];
+  return words ? `The ${words} ANPR camera${at}` : `The ANPR camera${at}`;
+}
+function cameraUnreachableMessage(camera) {
+  return `${describeCamera(camera)} is not responding. Plate reads and automatic barrier opening are stopped while it is down. The server keeps trying to reconnect on its own. If it does not come back, ask your site technician or the security-system installer to check the camera's power and network.`;
+}
+function cameraRecoveredMessage(camera) {
+  return `${describeCamera(camera)} is responding again. Plate reads have resumed.`;
+}
+function cameraCredentialsMessage(camera) {
+  return `${describeCamera(camera)} refused the login, so it cannot read plates. The username or password saved for it is wrong. An administrator can correct them in Site Settings > Cameras; if they are already correct, the camera's own account needs checking by your site technician.`;
+}
+function cameraNotAuthorisedMessage(camera) {
+  return `${describeCamera(camera)} rejected our connection, so it cannot read plates. This usually means its account is not allowed to use the plate-reading feed. Please ask your site technician or the security-system installer to check the camera's account permissions.`;
+}
+var CAMERA_ALERT_AT_ATTEMPT = [1, 6, 30, 90];
+var CAMERA_ALERT_EVERY_AFTER = 90;
+function shouldAlertOnFailure(consecutiveFailures) {
+  if (!Number.isInteger(consecutiveFailures) || consecutiveFailures < 1)
+    return false;
+  if (CAMERA_ALERT_AT_ATTEMPT.includes(consecutiveFailures))
+    return true;
+  if (consecutiveFailures < CAMERA_ALERT_EVERY_AFTER)
+    return false;
+  return (consecutiveFailures - CAMERA_ALERT_EVERY_AFTER) % CAMERA_ALERT_EVERY_AFTER === 0;
+}
+
+// src/utils/dahua-protocol.util.ts
+var DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT = 2;
+var AUTH_BACKOFF_MS = [6e4, 3e5, 9e5];
+function dahuaAuthBackoffMs(consecutiveAuthFailures) {
+  const index = Math.min(
+    Math.max(consecutiveAuthFailures, 1),
+    AUTH_BACKOFF_MS.length
+  );
+  return AUTH_BACKOFF_MS[index - 1];
+}
+function classifyDahuaStatus(statusCode) {
+  if (statusCode === 401)
+    return "challenge";
+  if (statusCode === 403)
+    return "rejected";
+  if (statusCode === 400 || statusCode === 500)
+    return "fatal";
+  return "proceed";
+}
+function classifyDahuaFailure(message) {
+  const text = String(message ?? "");
+  if (/\b403\b|forbidden/i.test(text))
+    return "rejected";
+  if (/\b401\b|unauthorized|invalid authority|digest/i.test(text)) {
+    return "challenge";
+  }
+  return "transient";
+}
+var enc = (value) => encodeURIComponent(String(value));
+function buildPlateUpdateEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=update&name=${enc(value.mode)}&recno=${enc(value.recno)}&PlateNumber=${enc(value.plateNumber)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateInsertEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=insert&name=${enc(value.mode)}&PlateNumber=${enc(value.plateNumber)}&VehicleType=${enc(value.vehicleType)}&VehicleColor=${enc(value.vehicleColor)}&BeginTime=${enc(value.start)}&CancelTime=${enc(value.end)}&+OpenGate=${value.openGate}&MasterOfCar=${enc(value.owner)}`;
+}
+function buildPlateRemoveEndpoint(value) {
+  return `/cgi-bin/recordUpdater.cgi?action=remove&recno=${enc(value.recno)}&name=${enc(value.mode)}`;
+}
+
 // src/services/dahua.service.ts
 var cameraRegistry = /* @__PURE__ */ new Map();
 var _savedOnDetected;
@@ -24294,7 +24373,8 @@ async function useDahuaDigestWithRetry({
   retryDelayMs = 0
 }) {
   let lastError;
-  for (let attempt = 1; attempt <= retries; attempt++) {
+  const effectiveRetries = Math.min(retries, DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT);
+  for (let attempt = 1; attempt <= effectiveRetries; attempt++) {
     try {
       const effectiveTimeout = streaming ? 0 : timeout;
       const response = await useDahuaDigest({
@@ -24321,9 +24401,9 @@ async function useDahuaDigestWithRetry({
       }
       const errorText = streaming ? `HTTP ${statusCode}` : getDahuaResponseText(response);
       const shouldRetry = isDahuaInvalidAuthority(errorText);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24335,9 +24415,9 @@ async function useDahuaDigestWithRetry({
       lastError = error;
       const message = error?.message || String(error);
       const shouldRetry = isDahuaInvalidAuthority(message);
-      if (shouldRetry && attempt < retries) {
+      if (shouldRetry && attempt < effectiveRetries) {
         loggerDahua.warn(
-          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${retries}`
+          `[${host}] Dahua Invalid Authority error. Retrying ${attempt}/${effectiveRetries}`
         );
         if (retryDelayMs > 0) {
           await sleep(retryDelayMs);
@@ -24441,7 +24521,9 @@ function useDahuaService() {
         return;
       try {
         const result = await _checkOutBySiteAndPlate(site, plateNumber2);
-        console.log("checkOutBySiteAndPlate result", result);
+        loggerDahua.info(
+          `checkOutBySiteAndPlate matched=${Boolean(result)} type=${result?.type ?? "none"}`
+        );
         if (onDetected2 && result?.type != "resident" && result?.site) {
           onDetected2({ reload: true, site: result?.site?.toString(), siteName: camera?.siteName, cameraDirection: camera?.direction, direction });
         }
@@ -24740,9 +24822,12 @@ function useDahuaService() {
     );
   }
   async function getTrafficJunction(camera, signal, onDetected) {
-    console.log(`getTrafficJunction camera object`, camera);
+    loggerDahua.info(
+      `getTrafficJunction starting for camera ${camera?._id} [${camera?.siteName}-${camera?.direction}] host ${camera?.host}`
+    );
     let authFailureCount = 0;
-    const MAX_AUTH_RETRIES = 10;
+    let connectionFailureCount = 0;
+    let alertedFailureCount = 0;
     while (!signal.aborted) {
       let bufferQueue = null;
       let response = null;
@@ -24757,31 +24842,48 @@ function useDahuaService() {
           streaming: true
         });
         const statusCode = getDahuaStatusCode(response);
-        if (statusCode === 401) {
-          loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          console.log(`[${camera?.siteName}-${camera?.direction}] 401 Unauthorized - Handshake or Wrong Credentials`);
-          throw new Error("401 Unauthorized - Handshake or Wrong Credentials");
-        } else if (statusCode === 403) {
+        const verdict = classifyDahuaStatus(statusCode);
+        if (verdict === "challenge") {
+          loggerDahua.warn(`[${camera?.siteName}-${camera?.direction}] 401 - digest challenge not completed; will re-authenticate after backoff.`);
+          throw new Error("401 Unauthorized - digest challenge not completed");
+        } else if (verdict === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden. Account locked or invalid permissions.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden - credentials rejected by the device. Not retrying.`
           );
           if (onDetected) {
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
-              messagePermanent: `Camera [${camera?.siteName}-${camera?.direction}]. Connection Error. Check username and password and try after 10 minutes.`
+              // Superseded #1803's own wording: cameraCredentialsMessage already
+              // says the login was refused and where to correct it, and no longer
+              // claims a ten-minute lockout.
+              messagePermanent: cameraCredentialsMessage(camera)
             });
           }
           return;
-        } else if ([400, 500].includes(statusCode)) {
+        } else if (verdict === "fatal") {
           loggerDahua.error(`[${camera?.siteName}-${camera?.direction}] Connection error: ${statusCode}`);
           if (onDetected) {
-            onDetected({ site: camera?.site, messagePermanent: `Camera [${camera?.siteName}-${camera?.direction}]. Connection Error. Possible Not Authorized.` });
+            onDetected({ site: camera?.site, messagePermanent: cameraNotAuthorisedMessage(camera) });
           }
           return;
         }
         authFailureCount = 0;
         isAuthFailure = false;
+        if (alertedFailureCount > 0 && onDetected) {
+          onDetected({
+            site: camera?.site,
+            direction: camera?.direction,
+            // `event` and `camera` let a client group or clear an alert per
+            // camera instead of matching on the message text. Older clients
+            // ignore them and just render `message`, as they always have.
+            event: "camera-recovered",
+            camera: camera?._id?.toString(),
+            message: cameraRecoveredMessage(camera)
+          });
+        }
+        connectionFailureCount = 0;
+        alertedFailureCount = 0;
         loggerDahua.info(`[${camera?.siteName}-${camera?.direction}] Successfully connected to ANPR.`);
         const contentType = response.res.headers["content-type"];
         const boundaryMatch = contentType?.match(/boundary=(.*)$/i);
@@ -24827,50 +24929,53 @@ function useDahuaService() {
           break;
         }
         const errMsg = String(error?.message || error);
-        if (errMsg.includes("403") || errMsg.includes("Forbidden")) {
+        const failure = classifyDahuaFailure(errMsg);
+        if (failure === "rejected") {
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client. Account locked or invalid credentials.`
+            `[${camera?.siteName}-${camera?.direction}] 403 Forbidden thrown by Dahua client - credentials rejected. Not retrying.`
           );
           if (onDetected) {
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
-              messagePermanent: `Camera [${camera?.siteName}-${camera?.direction}]. Connection Error. Check username and password and try after 10 minutes.`
+              messagePermanent: cameraCredentialsMessage(camera)
             });
           }
           return;
         }
-        const isAuthError = errMsg.includes("401") || errMsg.includes("Unauthorized") || errMsg.includes("Invalid Authority");
-        if (isAuthError) {
+        if (failure === "challenge") {
           authFailureCount++;
           isAuthFailure = true;
           loggerDahua.warn(
-            `[${camera?.siteName}-${camera?.direction}] Auth attempt ${authFailureCount}/${MAX_AUTH_RETRIES}`
+            `[${camera?.siteName}-${camera?.direction}] Authentication attempt ${authFailureCount} failed; next attempt in ${dahuaAuthBackoffMs(authFailureCount) / 1e3}s`
           );
-          if (authFailureCount >= MAX_AUTH_RETRIES) {
+          if (authFailureCount === DAHUA_AUTH_ATTEMPTS_BEFORE_ALERT) {
             loggerDahua.error(
-              `[${camera?.siteName}-${camera?.direction}] Max auth failures reached (${MAX_AUTH_RETRIES}). Wrong credentials.`
+              `[${camera?.siteName}-${camera?.direction}] ${authFailureCount} consecutive authentication failures. Slowing down and alerting the operator.`
             );
             if (onDetected) {
               onDetected({
                 site: camera?.site,
                 direction: camera?.direction,
-                messagePermanent: `Camera [${camera?.siteName}-${camera?.direction}]. Connection Error. Check username and password.`
+                messagePermanent: cameraCredentialsMessage(camera)
               });
             }
-            return;
           }
         } else {
           authFailureCount = 0;
           isAuthFailure = false;
+          connectionFailureCount++;
           loggerDahua.error(
-            `[${camera?.siteName}-${camera?.direction}] Connection lost or error: ${error.message || error}. Retrying in 10 seconds...`
+            `[${camera?.siteName}-${camera?.direction}] Connection lost or error: ${error.message || error}. Retrying in 10 seconds... (failure ${connectionFailureCount})`
           );
-          if (onDetected) {
+          if (onDetected && shouldAlertOnFailure(connectionFailureCount)) {
+            alertedFailureCount = connectionFailureCount;
             onDetected({
               site: camera?.site,
               direction: camera?.direction,
-              message: `Camera in [${camera?.siteName}-${camera?.direction}] Connection Lost. Retrying in 10 seconds. Check the camera if this issue persists, Or set the camera to Inactive to stop this notification.`
+              event: "camera-fault",
+              camera: camera?._id?.toString(),
+              message: cameraUnreachableMessage(camera)
             });
           }
         }
@@ -24894,7 +24999,7 @@ function useDahuaService() {
         }
       }
       if (!signal.aborted) {
-        const waitMs = isAuthFailure ? 1e3 : 1e4;
+        const waitMs = isAuthFailure ? dahuaAuthBackoffMs(authFailureCount) : 1e4;
         await new Promise((res) => setTimeout(res, waitMs));
       }
     }
@@ -24907,7 +25012,9 @@ function useDahuaService() {
     return match ? match[1] : null;
   }
   async function addPlateNumber(value) {
-    console.log("addPlateNumber called with value:", value);
+    loggerDahua.info(
+      `addPlateNumber called for host ${value?.host} mode ${value?.mode}`
+    );
     let recno = null;
     const validation = import_joi42.default.object({
       host: import_joi42.default.string().required(),
@@ -25052,7 +25159,15 @@ function useDahuaService() {
       const openGateString = String(value.isOpenGate);
       _isOpenGate = openGateString ? openGateString : "true";
     }
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=update&name=${value.mode}&recno=${value.recno}&PlateNumber=${value.plateNumber}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${_isOpenGate}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateUpdateEndpoint({
+      mode: value.mode,
+      recno: value.recno,
+      plateNumber: value.plateNumber,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: _isOpenGate
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -25085,7 +25200,10 @@ function useDahuaService() {
         host: value.host,
         username: value.username,
         password: value.password,
-        endpoint: `/cgi-bin/recordUpdater.cgi?action=remove&recno=${value.recno}&name=${value.mode}`
+        endpoint: buildPlateRemoveEndpoint({
+          recno: value.recno,
+          mode: value.mode
+        })
       });
       return response;
     } catch (error2) {
@@ -25141,7 +25259,16 @@ function useDahuaService() {
     value.vehicleColor = String(value.vehicleColor ?? "").substring(0, 31) || "unknown";
     const _openGate = String(value.isOpenGate);
     const isOpenGateString = _openGate && _openGate !== "undefined" ? _openGate : "true";
-    const endpoint = `/cgi-bin/recordUpdater.cgi?action=insert&name=${value.mode}&PlateNumber=${value.plateNumber}&VehicleType=${value.vehicleType}&VehicleColor=${value.vehicleColor}&BeginTime=${value.start}&CancelTime=${value.end}&+OpenGate=${isOpenGateString}&MasterOfCar=${value.owner}`;
+    const endpoint = buildPlateInsertEndpoint({
+      mode: value.mode,
+      plateNumber: value.plateNumber,
+      vehicleType: value.vehicleType,
+      vehicleColor: value.vehicleColor,
+      start: value.start,
+      end: value.end,
+      owner: value.owner,
+      openGate: isOpenGateString
+    });
     try {
       const response = await useDahuaDigest({
         host: value.host,
@@ -25567,7 +25694,7 @@ function useSiteCameraRepo() {
       }
       if (result?._id) {
         const result2 = await findOne({ _id: new import_mongodb47.ObjectId(result._id) }, void 0, { session });
-        console.log("updateById result2", result2);
+        import_node_server_utils74.logger.info(`Site camera ${result2?._id} re-read after update; reconnecting listener`);
         if (result2?._id) {
           const { listenToCamera } = useDahuaService();
           await listenToCamera(result2);
@@ -27857,7 +27984,9 @@ function useVehicleService() {
           siteCameras.push(...siteCameraReq.items);
           page++;
         } while (page <= pages);
-        console.log("add vehicle service siteCameras", siteCameras);
+        import_node_server_utils79.logger.info(
+          `addVehicle resolved ${siteCameras.length} site camera(s) for site ${value?.site}`
+        );
       }
       for (const plateNumber of plateNumbers) {
         const vehicleValue = {
@@ -30163,6 +30292,20 @@ function useBuildingLevelRepo() {
       }
     }
   }
+  async function getActiveLevelsByIds(ids, session) {
+    if (!ids || ids.length === 0)
+      return [];
+    let objectIds;
+    try {
+      objectIds = ids.map((id) => new import_mongodb56.ObjectId(id));
+    } catch {
+      throw new import_node_server_utils88.BadRequestError("Invalid level ID format.");
+    }
+    return collection.find(
+      { _id: { $in: objectIds }, status: "active" /* ACTIVE */ },
+      { projection: { _id: 1, name: 1 }, session }
+    ).toArray();
+  }
   async function updateLevelById(_id, value, session) {
     try {
       _id = new import_mongodb56.ObjectId(_id);
@@ -30361,7 +30504,8 @@ function useBuildingLevelRepo() {
     deleteById,
     bulkWriteLevels,
     batchUpdateByIds,
-    getBuildingLevelList
+    getBuildingLevelList,
+    getActiveLevelsByIds
   };
 }
 
@@ -30382,7 +30526,10 @@ function useBuildingService() {
   } = useBuildingUnitRepo();
   const { updateStatusById } = useFileRepo();
   const { deleteFile } = useFileService();
-  const { bulkWriteLevels: _bulkWriteLevels } = useBuildingLevelRepo();
+  const {
+    bulkWriteLevels: _bulkWriteLevels,
+    getActiveLevelsByIds: _getActiveLevelsByIds
+  } = useBuildingLevelRepo();
   function normalizeImportKey(value) {
     return String(value ?? "").trim().replace(/\s+/g, " ").toLowerCase();
   }
@@ -30476,23 +30623,37 @@ function useBuildingService() {
         );
       }
       if (data.levels) {
-        const levelsPayload = (data.levels ?? []).map((levelName) => ({
-          blockId: id,
-          site: building.site.toString(),
-          name: levelName,
-          status: "active" /* ACTIVE */,
-          createdAt: /* @__PURE__ */ new Date(),
-          updatedAt: null,
-          deletedAt: null
-        }));
-        let levels;
-        if (levelsPayload.length > 0) {
-          levels = await _bulkWriteLevels(levelsPayload, session);
-        }
-        if (levels) {
-          building.levels.push(...Object.values(levels.insertedIds));
-          data.levels = building.levels.map((id2) => id2.toString());
+        const submittedNames = data.levels ?? [];
+        const existingLevels = await _getActiveLevelsByIds(
+          building.levels,
+          session
+        );
+        const seenKeys = new Set(
+          existingLevels.map((level) => normalizeImportKey(level.name))
+        );
+        const newNames = submittedNames.filter((name) => {
+          const key = normalizeImportKey(name);
+          if (seenKeys.has(key))
+            return false;
+          seenKeys.add(key);
+          return true;
+        });
+        if (newNames.length > 0) {
+          const levelsPayload = newNames.map((name) => ({
+            blockId: id,
+            site: building.site.toString(),
+            name,
+            status: "active" /* ACTIVE */,
+            createdAt: /* @__PURE__ */ new Date(),
+            updatedAt: null,
+            deletedAt: null
+          }));
+          const levels = await _bulkWriteLevels(levelsPayload, session);
+          if (levels) {
+            building.levels.push(...Object.values(levels.insertedIds));
+          }
         }
+        data.levels = building.levels.map((levelId) => levelId.toString());
       }
       const buildingUnitData = {};
       if (data.name && building.name !== data.name) {