@camstack/addon-provider-reolink 1.2.46 → 1.2.48

package/dist/addon.js

@@ -26,7 +26,7 @@ let fs_promises = require("fs/promises");
 fs_promises = require_chunk.__toESM(fs_promises, 1);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -42,6 +42,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19207,6 +19216,12 @@ var CameraStatusSchema = object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
+var InferenceDeviceExclusionReasonSchema = _enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: string(),
@@ -19237,7 +19252,17 @@ var NodeInferenceDeviceSchema = object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: record(string(), DeviceStepConfigSchema).optional()
+	steps: record(string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
@@ -24192,7 +24217,12 @@ var ListResultSchema = object({
 	probedAt: number()
 });
 var PreferredSchema = LocalInterfaceSchema.nullable();
-var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
+/**
+* Candidate base URL for the SDK to race on connect. Order matters —
+* the SDK should attempt these top-to-bottom with a short per-candidate
+* timeout (e.g. 1500ms) and cache the winner for the session.
+*/
+var ConnectionEndpointSchema = object({
 	/** Operator-facing label (e.g. "LAN — en0", "Public tunnel"). */
 	label: string(),
 	/** Fully-formed base URL with scheme + host + port. */
@@ -24235,7 +24265,42 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	* ordering between polls.
 	*/
 	priority: number()
-})).readonly() });
+});
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = _enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = object({
+	port: number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = object({
+	endpoints: array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -24256,8 +24321,13 @@ var AllowedAddressesSchema = object({
 */
 addresses: array(string()).readonly() });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
-	/** Local hub HTTP port to use in base URLs. */
-	port: number().int().min(1).max(65535),
+	/**
+	* LEGACY HINT — do not send from new code. Kept optional so clients
+	* written against the echoing contract keep working; the hub uses it
+	* only when it cannot read its own port, and says so via
+	* `localPort.source === 'caller-hint'`.
+	*/
+	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 	*  candidate. Default `true`. */
 	includeLoopback: boolean().optional(),
@@ -30364,11 +30434,63 @@ DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeate
 new Set(Object.values(DeviceType));
 DeviceFeature.BatteryOperated;
 var LAST_FETCHED_FIELD = "lastFetchedAt";
+/**
+* How long a bridge stops re-attempting a refresh that did not land.
+*
+* Sized against the failure it exists for: a camera whose control plane
+* is unreachable costs the FULL connect give-up (~3s on Linux when the
+* neighbour never answers, up to the client's own timeout otherwise) on
+* every attempt, and a failed refresh never advances `lastFetchedAt`, so
+* without a cooldown the slice is permanently stale and EVERY read pays
+* that price. One attempt per minute is enough to notice the camera
+* coming back; per-read is enough to stall the viewer's first paint.
+*/
+var RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = 6e4;
+/**
+* The freshness window for a cap whose value changes ONLY when WE write it.
+*
+* The usual `staleMs: 10_000` is tuned for a reading that moves on its own — a
+* battery level, a day/night state that flips at dusk. It is the wrong number
+* for a cap like `privacy-mask`, whose two facts (is the video mask on, is the
+* microphone on) change when an operator changes them, through a `setMask` /
+* `setAudioEnabled` that **re-reads the camera and rewrites this very slice**.
+* A write is therefore its own invalidation: the window never delays an
+* operator's own change, however long it is.
+*
+* What the window really bounds is the ONE case we do not write: somebody
+* changing the mask in the vendor app or the camera's web UI. Ten minutes is
+* the trade — that change is visible within ten minutes, and a fleet of 29
+* cameras behind a page that polls every 5s costs about 3 camera round trips a
+* minute instead of 696
+* ([D221](../../../../docs/decisions/adr-0221-a-polled-list-never-dials-a-camera.md)).
+*
+* Use it ONLY with {@link RuntimeStateStaleReadPolicy} `'serve-and-revalidate'`.
+* On the awaiting default a window this long does not remove the stall, it
+* merely makes it rarer and just as long.
+*/
+var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
 function createRuntimeStateBridge(params) {
 	const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty, logger } = params;
 	const missCooldownMs = params.refreshMissCooldownMs ?? 6e4;
+	const staleRead = params.staleRead ?? "await-refresh";
 	/** Epoch ms until which a refresh is not re-attempted. 0 = no cooldown. */
 	let missCooldownUntil = 0;
+	/**
+	* The refresh this bridge currently has in the air, if any.
+	*
+	* Providers single-flight their own camera client, so this is not what stops
+	* a second round trip. What it stops is a POLLED reader JOINING one: under
+	* `'serve-and-revalidate'` a read that finds a refresh already outstanding is
+	* answered from the slice at once — even a cold, empty slice, which reports
+	* UNKNOWN, which is the truth about a camera nobody has reached.
+	*
+	* That distinction is the whole cost of an unreachable camera. Measured on
+	* the live hub (device 3629, an offline battery Reolink): its refresh takes
+	* 23.1s to give up, so without this every 5s poll landing inside those 23s
+	* joined the wait and spent the caller's full 1.2s source budget — five
+	* stalled polls per cooldown cycle, for one camera, forever.
+	*/
+	let refreshInFlight = null;
 	const readFetchedAt = () => {
 		const value = runtimeState.getCapState(cap.name)?.[LAST_FETCHED_FIELD];
 		return typeof value === "number" ? value : 0;
@@ -30389,14 +30511,14 @@ function createRuntimeStateBridge(params) {
 			}
 		});
 	};
-	const ensureFresh = async () => {
-		const slice = runtimeState.getCapState(cap.name);
-		const fetchedAt = readFetchedAt();
-		if (slice && Date.now() - fetchedAt <= staleMs) {
-			missCooldownUntil = 0;
-			return;
-		}
-		if (Date.now() < missCooldownUntil) return;
+	/**
+	* One refresh attempt, plus the LANDED check that decides the cooldown.
+	*
+	* @param fetchedAt What `lastFetchedAt` was before the attempt — the only
+	*                  evidence the bridge has that the refresh persisted
+	*                  anything, since providers swallow their own camera errors.
+	*/
+	const runRefresh = async (fetchedAt) => {
 		try {
 			await refresh();
 		} catch (err) {
@@ -30412,6 +30534,41 @@ function createRuntimeStateBridge(params) {
 		}
 		openMissCooldown(void 0);
 	};
+	/**
+	* Start a refresh and remember it, at most one at a time.
+	*
+	* It never rejects: under `'serve-and-revalidate'` the caller is answered
+	* from the slice either way, so a floating rejection would take the process
+	* down for a fault the miss cooldown has already recorded and logged.
+	*/
+	const startRefresh = (fetchedAt) => {
+		const existing = refreshInFlight;
+		if (existing !== null) return existing;
+		const started = runRefresh(fetchedAt).catch(() => void 0).finally(() => {
+			refreshInFlight = null;
+		});
+		refreshInFlight = started;
+		return started;
+	};
+	const ensureFresh = async () => {
+		const slice = runtimeState.getCapState(cap.name);
+		const fetchedAt = readFetchedAt();
+		if (slice && Date.now() - fetchedAt <= staleMs) {
+			missCooldownUntil = 0;
+			return;
+		}
+		if (Date.now() < missCooldownUntil) return;
+		if (staleRead === "serve-and-revalidate") {
+			if (refreshInFlight !== null) return;
+			if (slice && fetchedAt > 0) {
+				startRefresh(fetchedAt);
+				return;
+			}
+			await startRefresh(fetchedAt);
+			return;
+		}
+		await runRefresh(fetchedAt);
+	};
 	const projectStatus = () => {
 		const slice = runtimeState.getCapState(cap.name);
 		if (!slice) return empty();
@@ -232395,6 +232552,34 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	*  within a day while removing the per-poll round-trip entirely. */
 	static CAP_OPTIONS_TTL_MS = 360 * 6e4;
 	/**
+	* Per-cap epoch-ms until which a FAILED options probe is not re-attempted.
+	*
+	* The same discipline `createRuntimeStateBridge` applies to a refresh that
+	* did not land, for the same reason and against the same measurement. A probe
+	* that fails persists nothing, so without this the next caller probes again —
+	* and on a camera that is merely unreachable each attempt burns the full
+	* connect give-up. Measured on the live hub (2026-08-21, device 3629, a
+	* battery Reolink the registry already calls offline): `getOptions` took
+	* **23.1s on every single call**, while its `getStatus` sibling answered in
+	* 8ms because the bridge had already opened its cooldown. The status side was
+	* bounded and the options side was not, and only one of them was visible.
+	*/
+	capOptionsMissCooldownUntil = /* @__PURE__ */ new Map();
+	/**
+	* Per-cap in-flight options probe, so concurrent callers share ONE.
+	*
+	* The cooldown above only opens once a probe has FAILED — and on an
+	* unreachable camera that takes the full connect give-up (23.1s measured on
+	* device 3629). Every poll arriving inside that window used to start its own
+	* probe, so the cooldown never got a chance to bound anything: the fix for
+	* "one dial per poll" has to cover the dial that is still in the air.
+	*
+	* A caller that finds one here is SERVED, not queued behind it — this method
+	* sits on a polled path, and waiting for a probe that is not coming back is
+	* how one unreachable camera stalls every poll it overlaps.
+	*/
+	capOptionsInFlight = /* @__PURE__ */ new Map();
+	/**
 	* Read a persisted `getOptions` descriptor, validated with the cap's
 	* OWN Zod schema. Validation (not a cast) is what makes the
 	* `z.unknown()` blob type-safe: an entry written by an older addon
@@ -232452,7 +232637,11 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	async resolveCapOptions(params) {
 		const { capName, schema, probe, fallback } = params;
 		const cached = this.readCapOptionsCache(capName, schema);
-		if (cached && Date.now() - cached.fetchedAt < ReolinkCamera.CAP_OPTIONS_TTL_MS) return cached.value;
+		if (this.capOptionsInFlight.has(capName)) return cached?.value ?? fallback();
+		if (cached && Date.now() - cached.fetchedAt < ReolinkCamera.CAP_OPTIONS_TTL_MS) {
+			this.capOptionsMissCooldownUntil.delete(capName);
+			return cached.value;
+		}
 		if (this.isBattery && this.sleeping) {
 			this.ctx.logger.debug("cap options: battery cam sleeping — serving cache, not probing", {
 				tags: { deviceId: this.id },
@@ -232463,19 +232652,29 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			});
 			return cached?.value ?? fallback();
 		}
+		const cooldownUntil = this.capOptionsMissCooldownUntil.get(capName) ?? 0;
+		if (Date.now() < cooldownUntil) return cached?.value ?? fallback();
+		const started = probe();
+		this.capOptionsInFlight.set(capName, started);
 		try {
-			const value = await probe();
+			const value = await started;
 			await this.persistCapOptions(capName, value);
+			this.capOptionsMissCooldownUntil.delete(capName);
 			return value;
 		} catch (err) {
-			this.ctx.logger.debug("cap options probe failed — serving cache/fallback", {
+			this.capOptionsMissCooldownUntil.set(capName, Date.now() + RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS);
+			this.ctx.logger.warn("cap options probe failed — serving cache/fallback and not re-probing for a minute", {
 				tags: { deviceId: this.id },
 				meta: {
 					capName,
+					cooldownMs: RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS,
+					hasCache: cached !== null,
 					error: err instanceof Error ? err.message : String(err)
 				}
 			});
 			return cached?.value ?? fallback();
+		} finally {
+			if (this.capOptionsInFlight.get(capName) === started) this.capOptionsInFlight.delete(capName);
 		}
 	}
 	/**
@@ -232916,7 +233115,6 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	registerPrivacyMaskCap() {
 		const channel = this.getChannel();
 		const CAP_NAME = "privacy-mask";
-		const STALE_MS = 1e4;
 		const refreshFromCamera = async () => {
 			if (this.privacyMaskRefreshInFlight) return this.privacyMaskRefreshInFlight;
 			const promise = (async () => {
@@ -232969,7 +233167,8 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				cap: privacyMaskCapability,
 				ownDeviceId: this.id,
 				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
-				staleMs: STALE_MS,
+				staleMs: OPERATOR_WRITTEN_STALE_MS,
+				staleRead: "serve-and-revalidate",
 				empty: () => ({
 					enabled: false,
 					regions: [],

package/dist/addon.mjs

@@ -21,7 +21,7 @@ import netImpl from "net";
 import { fileURLToPath } from "url";
 import { mkdir } from "fs/promises";
 import os from "node:os";
-//#region ../types/dist/event-category-XfKNtfCc.mjs
+//#region ../types/dist/event-category-CIa_iT6b.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -37,6 +37,15 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
+	* The hub reissued its own TLS certificate at boot (`ensureTlsCert`).
+	* Emitted only when the material on disk actually changed, so an
+	* operator who trusted the old certificate by hand is told rather than
+	* discovering it as a browser error. Payload `TlsCertChangedPayload`.
+	*
+	* Rule: docs/decisions/adr-0227-*.md
+	*/
+	EventCategory["SystemTlsCertChanged"] = "system.tls-cert-changed";
+	/**
 	* A newer addon or server-root package version was found by the
 	* authoritative registry check. Emitted once when any observed
 	* `latestVersion` changes (or a package/node first appears behind);
@@ -19202,6 +19211,12 @@ var CameraStatusSchema = object({
 	/** Unix timestamp (ms) when this snapshot was composed server-side. */
 	fetchedAt: number()
 });
+var InferenceDeviceExclusionReasonSchema = _enum([
+	"disabled",
+	"unavailable",
+	"cannot-host-camera-root",
+	"accelerator-preferred"
+]);
 var NodeInferenceDeviceSchema = object({
 	/** Stable per-node device key, e.g. `openvino:npu`, `edgetpu:usb`, `cpu`. */
 	key: string(),
@@ -19232,7 +19247,17 @@ var NodeInferenceDeviceSchema = object({
 	* available per format; this is the stored selection that becomes the
 	* default for EVERY camera landing on this accelerator.
 	*/
-	steps: record(string(), DeviceStepConfigSchema).optional()
+	steps: record(string(), DeviceStepConfigSchema).optional(),
+	/**
+	* `null` when the device IS a camera-root candidate on this node; otherwise
+	* the reason the dispatcher drops it. Computed by the SAME
+	* `resolveInferenceDeviceEligibility` the dispatcher runs, so this view can
+	* never disagree with the election — deriving it in the UI from
+	* `enabled`/`available` would silently miss `cannot-host-camera-root` (needs
+	* the node's model catalog) and `accelerator-preferred` (needs the node-wide
+	* "an accelerator is serving" predicate).
+	*/
+	exclusion: InferenceDeviceExclusionReasonSchema.nullable()
 });
 var NodeInferenceDevicesSchema = object({
 	nodeId: string(),
@@ -24187,7 +24212,12 @@ var ListResultSchema = object({
 	probedAt: number()
 });
 var PreferredSchema = LocalInterfaceSchema.nullable();
-var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
+/**
+* Candidate base URL for the SDK to race on connect. Order matters —
+* the SDK should attempt these top-to-bottom with a short per-candidate
+* timeout (e.g. 1500ms) and cache the winner for the session.
+*/
+var ConnectionEndpointSchema = object({
 	/** Operator-facing label (e.g. "LAN — en0", "Public tunnel"). */
 	label: string(),
 	/** Fully-formed base URL with scheme + host + port. */
@@ -24230,7 +24260,42 @@ var GetConnectionEndpointsResultSchema = object({ endpoints: array(object({
 	* ordering between polls.
 	*/
 	priority: number()
-})).readonly() });
+});
+/**
+* Where the advertised local port came from. Ordered most → least
+* authoritative, and the whole point of returning it: a client must be able to
+* tell a FACT about the hub's socket from an echo of its own guess.
+*/
+var LocalPortSourceEnum = _enum([
+	"server-config",
+	"server-env",
+	"caller-hint",
+	"default"
+]);
+/** The port every LAN/loopback `baseUrl` in the same result was built with. */
+var AdvertisedLocalPortSchema = object({
+	port: number().int().min(1).max(65535),
+	source: LocalPortSourceEnum
+});
+var GetConnectionEndpointsResultSchema = object({
+	endpoints: array(ConnectionEndpointSchema).readonly(),
+	/**
+	* The port the hub built the LAN/loopback URLs with, and where that number
+	* came from.
+	*
+	* Returned rather than merely applied, because "the URL is right" and "the
+	* client can KNOW the URL is right" are different properties. A client that
+	* only sees a corrected URL cannot distinguish a hub that fixed the port from
+	* a hub that echoed the port the client sent, so it cannot decide whether to
+	* race the candidate or discard it. With `source` it can: anything but
+	* `caller-hint` is the hub's own socket.
+	*
+	* Absent on hubs predating this field — a client that finds it missing is
+	* talking to an echoing hub and must degrade exactly as it does for
+	* `caller-hint`.
+	*/
+	localPort: AdvertisedLocalPortSchema
+});
 /**
 * The chosen outbound endpoint for notification artifacts. `baseUrl: null` =
 * AUTO (resolved from the candidate ranking at send time); `resolved` reports
@@ -24251,8 +24316,13 @@ var AllowedAddressesSchema = object({
 */
 addresses: array(string()).readonly() });
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
-	/** Local hub HTTP port to use in base URLs. */
-	port: number().int().min(1).max(65535),
+	/**
+	* LEGACY HINT — do not send from new code. Kept optional so clients
+	* written against the echoing contract keep working; the hub uses it
+	* only when it cannot read its own port, and says so via
+	* `localPort.source === 'caller-hint'`.
+	*/
+	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
 	*  candidate. Default `true`. */
 	includeLoopback: boolean().optional(),
@@ -30359,11 +30429,63 @@ DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeate
 new Set(Object.values(DeviceType));
 DeviceFeature.BatteryOperated;
 var LAST_FETCHED_FIELD = "lastFetchedAt";
+/**
+* How long a bridge stops re-attempting a refresh that did not land.
+*
+* Sized against the failure it exists for: a camera whose control plane
+* is unreachable costs the FULL connect give-up (~3s on Linux when the
+* neighbour never answers, up to the client's own timeout otherwise) on
+* every attempt, and a failed refresh never advances `lastFetchedAt`, so
+* without a cooldown the slice is permanently stale and EVERY read pays
+* that price. One attempt per minute is enough to notice the camera
+* coming back; per-read is enough to stall the viewer's first paint.
+*/
+var RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS = 6e4;
+/**
+* The freshness window for a cap whose value changes ONLY when WE write it.
+*
+* The usual `staleMs: 10_000` is tuned for a reading that moves on its own — a
+* battery level, a day/night state that flips at dusk. It is the wrong number
+* for a cap like `privacy-mask`, whose two facts (is the video mask on, is the
+* microphone on) change when an operator changes them, through a `setMask` /
+* `setAudioEnabled` that **re-reads the camera and rewrites this very slice**.
+* A write is therefore its own invalidation: the window never delays an
+* operator's own change, however long it is.
+*
+* What the window really bounds is the ONE case we do not write: somebody
+* changing the mask in the vendor app or the camera's web UI. Ten minutes is
+* the trade — that change is visible within ten minutes, and a fleet of 29
+* cameras behind a page that polls every 5s costs about 3 camera round trips a
+* minute instead of 696
+* ([D221](../../../../docs/decisions/adr-0221-a-polled-list-never-dials-a-camera.md)).
+*
+* Use it ONLY with {@link RuntimeStateStaleReadPolicy} `'serve-and-revalidate'`.
+* On the awaiting default a window this long does not remove the stall, it
+* merely makes it rarer and just as long.
+*/
+var OPERATOR_WRITTEN_STALE_MS = 10 * 6e4;
 function createRuntimeStateBridge(params) {
 	const { runtimeState, cap, ownDeviceId, refresh, staleMs, empty, logger } = params;
 	const missCooldownMs = params.refreshMissCooldownMs ?? 6e4;
+	const staleRead = params.staleRead ?? "await-refresh";
 	/** Epoch ms until which a refresh is not re-attempted. 0 = no cooldown. */
 	let missCooldownUntil = 0;
+	/**
+	* The refresh this bridge currently has in the air, if any.
+	*
+	* Providers single-flight their own camera client, so this is not what stops
+	* a second round trip. What it stops is a POLLED reader JOINING one: under
+	* `'serve-and-revalidate'` a read that finds a refresh already outstanding is
+	* answered from the slice at once — even a cold, empty slice, which reports
+	* UNKNOWN, which is the truth about a camera nobody has reached.
+	*
+	* That distinction is the whole cost of an unreachable camera. Measured on
+	* the live hub (device 3629, an offline battery Reolink): its refresh takes
+	* 23.1s to give up, so without this every 5s poll landing inside those 23s
+	* joined the wait and spent the caller's full 1.2s source budget — five
+	* stalled polls per cooldown cycle, for one camera, forever.
+	*/
+	let refreshInFlight = null;
 	const readFetchedAt = () => {
 		const value = runtimeState.getCapState(cap.name)?.[LAST_FETCHED_FIELD];
 		return typeof value === "number" ? value : 0;
@@ -30384,14 +30506,14 @@ function createRuntimeStateBridge(params) {
 			}
 		});
 	};
-	const ensureFresh = async () => {
-		const slice = runtimeState.getCapState(cap.name);
-		const fetchedAt = readFetchedAt();
-		if (slice && Date.now() - fetchedAt <= staleMs) {
-			missCooldownUntil = 0;
-			return;
-		}
-		if (Date.now() < missCooldownUntil) return;
+	/**
+	* One refresh attempt, plus the LANDED check that decides the cooldown.
+	*
+	* @param fetchedAt What `lastFetchedAt` was before the attempt — the only
+	*                  evidence the bridge has that the refresh persisted
+	*                  anything, since providers swallow their own camera errors.
+	*/
+	const runRefresh = async (fetchedAt) => {
 		try {
 			await refresh();
 		} catch (err) {
@@ -30407,6 +30529,41 @@ function createRuntimeStateBridge(params) {
 		}
 		openMissCooldown(void 0);
 	};
+	/**
+	* Start a refresh and remember it, at most one at a time.
+	*
+	* It never rejects: under `'serve-and-revalidate'` the caller is answered
+	* from the slice either way, so a floating rejection would take the process
+	* down for a fault the miss cooldown has already recorded and logged.
+	*/
+	const startRefresh = (fetchedAt) => {
+		const existing = refreshInFlight;
+		if (existing !== null) return existing;
+		const started = runRefresh(fetchedAt).catch(() => void 0).finally(() => {
+			refreshInFlight = null;
+		});
+		refreshInFlight = started;
+		return started;
+	};
+	const ensureFresh = async () => {
+		const slice = runtimeState.getCapState(cap.name);
+		const fetchedAt = readFetchedAt();
+		if (slice && Date.now() - fetchedAt <= staleMs) {
+			missCooldownUntil = 0;
+			return;
+		}
+		if (Date.now() < missCooldownUntil) return;
+		if (staleRead === "serve-and-revalidate") {
+			if (refreshInFlight !== null) return;
+			if (slice && fetchedAt > 0) {
+				startRefresh(fetchedAt);
+				return;
+			}
+			await startRefresh(fetchedAt);
+			return;
+		}
+		await runRefresh(fetchedAt);
+	};
 	const projectStatus = () => {
 		const slice = runtimeState.getCapState(cap.name);
 		if (!slice) return empty();
@@ -232375,6 +232532,34 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	*  within a day while removing the per-poll round-trip entirely. */
 	static CAP_OPTIONS_TTL_MS = 360 * 6e4;
 	/**
+	* Per-cap epoch-ms until which a FAILED options probe is not re-attempted.
+	*
+	* The same discipline `createRuntimeStateBridge` applies to a refresh that
+	* did not land, for the same reason and against the same measurement. A probe
+	* that fails persists nothing, so without this the next caller probes again —
+	* and on a camera that is merely unreachable each attempt burns the full
+	* connect give-up. Measured on the live hub (2026-08-21, device 3629, a
+	* battery Reolink the registry already calls offline): `getOptions` took
+	* **23.1s on every single call**, while its `getStatus` sibling answered in
+	* 8ms because the bridge had already opened its cooldown. The status side was
+	* bounded and the options side was not, and only one of them was visible.
+	*/
+	capOptionsMissCooldownUntil = /* @__PURE__ */ new Map();
+	/**
+	* Per-cap in-flight options probe, so concurrent callers share ONE.
+	*
+	* The cooldown above only opens once a probe has FAILED — and on an
+	* unreachable camera that takes the full connect give-up (23.1s measured on
+	* device 3629). Every poll arriving inside that window used to start its own
+	* probe, so the cooldown never got a chance to bound anything: the fix for
+	* "one dial per poll" has to cover the dial that is still in the air.
+	*
+	* A caller that finds one here is SERVED, not queued behind it — this method
+	* sits on a polled path, and waiting for a probe that is not coming back is
+	* how one unreachable camera stalls every poll it overlaps.
+	*/
+	capOptionsInFlight = /* @__PURE__ */ new Map();
+	/**
 	* Read a persisted `getOptions` descriptor, validated with the cap's
 	* OWN Zod schema. Validation (not a cast) is what makes the
 	* `z.unknown()` blob type-safe: an entry written by an older addon
@@ -232432,7 +232617,11 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	async resolveCapOptions(params) {
 		const { capName, schema, probe, fallback } = params;
 		const cached = this.readCapOptionsCache(capName, schema);
-		if (cached && Date.now() - cached.fetchedAt < ReolinkCamera.CAP_OPTIONS_TTL_MS) return cached.value;
+		if (this.capOptionsInFlight.has(capName)) return cached?.value ?? fallback();
+		if (cached && Date.now() - cached.fetchedAt < ReolinkCamera.CAP_OPTIONS_TTL_MS) {
+			this.capOptionsMissCooldownUntil.delete(capName);
+			return cached.value;
+		}
 		if (this.isBattery && this.sleeping) {
 			this.ctx.logger.debug("cap options: battery cam sleeping — serving cache, not probing", {
 				tags: { deviceId: this.id },
@@ -232443,19 +232632,29 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 			});
 			return cached?.value ?? fallback();
 		}
+		const cooldownUntil = this.capOptionsMissCooldownUntil.get(capName) ?? 0;
+		if (Date.now() < cooldownUntil) return cached?.value ?? fallback();
+		const started = probe();
+		this.capOptionsInFlight.set(capName, started);
 		try {
-			const value = await probe();
+			const value = await started;
 			await this.persistCapOptions(capName, value);
+			this.capOptionsMissCooldownUntil.delete(capName);
 			return value;
 		} catch (err) {
-			this.ctx.logger.debug("cap options probe failed — serving cache/fallback", {
+			this.capOptionsMissCooldownUntil.set(capName, Date.now() + RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS);
+			this.ctx.logger.warn("cap options probe failed — serving cache/fallback and not re-probing for a minute", {
 				tags: { deviceId: this.id },
 				meta: {
 					capName,
+					cooldownMs: RUNTIME_STATE_REFRESH_MISS_COOLDOWN_MS,
+					hasCache: cached !== null,
 					error: err instanceof Error ? err.message : String(err)
 				}
 			});
 			return cached?.value ?? fallback();
+		} finally {
+			if (this.capOptionsInFlight.get(capName) === started) this.capOptionsInFlight.delete(capName);
 		}
 	}
 	/**
@@ -232896,7 +233095,6 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 	registerPrivacyMaskCap() {
 		const channel = this.getChannel();
 		const CAP_NAME = "privacy-mask";
-		const STALE_MS = 1e4;
 		const refreshFromCamera = async () => {
 			if (this.privacyMaskRefreshInFlight) return this.privacyMaskRefreshInFlight;
 			const promise = (async () => {
@@ -232949,7 +233147,8 @@ var ReolinkCamera = class ReolinkCamera extends BaseDevice {
 				cap: privacyMaskCapability,
 				ownDeviceId: this.id,
 				refresh: this.sleepGatedRefresh(CAP_NAME, refreshFromCamera),
-				staleMs: STALE_MS,
+				staleMs: OPERATOR_WRITTEN_STALE_MS,
+				staleRead: "serve-and-revalidate",
 				empty: () => ({
 					enabled: false,
 					regions: [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-reolink",
-  "version": "1.2.46",
+  "version": "1.2.48",
   "description": "Reolink camera device provider addon for CamStack — native Baichuan protocol",
   "keywords": [
     "camstack",