@camstack/server 1.2.355 → 1.2.356

package/dist/api/trpc/device-collection-dispatch.js

@@ -20,10 +20,16 @@
  *     source the DEVICE has (`CapabilityRegistry.resolveCollectionForDevice` —
  *     the enabled providers, minus the ones the operator switched off for this
  *     camera through `deviceManager.setWrapperActive`, D556), and the results
- *     are concatenated. No dedup, no best-source
- *     pick: a clip held in two storages appears twice, once per source, and
- *     each row says which (D549 decision 11 — stated there as a consequence
- *     precisely so it is not "fixed" later).
+ *     are concatenated. No dedup ACROSS SOURCES, no best-source pick: a clip
+ *     held in two storages appears twice, once per source, and each row says
+ *     which (D549 decision 11 — stated there as a consequence precisely so it
+ *     is not "fixed" later). But a source is not a REGISTRATION: one addon
+ *     reaches this dispatcher as the device's native provider, as the
+ *     hub-local registration and once per agent node, and those are one
+ *     source answering three times. Each row is held once, keyed by the
+ *     identity its provider minted ({@link holdEachRowOnce}); on 592 that was
+ *     three `analytics` tick-boxes for one thing, D62's defect with the
+ *     polarity reversed (D554 amended 2026-09-20).
  *  2. **One failing source never empties the others.** Every source is called
  *     independently and a rejection removes only its own rows — and says so,
  *     per source, with `tags: { deviceId }`. A fan-out where one throwing
@@ -35,7 +41,9 @@
  *     ids are self-contained and source-prefixed (`analytics:…`,
  *     `native:reolink:onboard:…`, `hksv:…`), so the dispatcher asks each
  *     source which ids it owns ({@link SOURCE_LISTING_METHOD}) and hands the
- *     call to the one that claims the longest matching prefix. An id nobody
+ *     call to the one that claims the longest matching prefix. Several
+ *     registrations of one source all claim it: the FIRST serving one wins,
+ *     and it is the registration the collapsed listing row names. An id nobody
  *     claims is REFUSED by name — never handed to the first provider, which is
  *     how a fabricated `addonId` once came back with another addon's answer
  *     (D552 consequences, `rejectUnresolvedAddonPin`).
@@ -49,7 +57,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SOURCE_LISTING_METHOD = void 0;
 exports.requireDeviceCollection = requireDeviceCollection;
-const system_1 = require("@camstack/system");
 const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 /**
@@ -64,50 +71,127 @@ exports.SOURCE_LISTING_METHOD = 'listSources';
 const SOURCE_ID_FIELD = 'source';
 /** The field on a source row that names the addon serving it (D555/D557). */
 const SOURCE_ADDON_FIELD = 'addonId';
-/** The field a source row carries the operator's off switch on (D556 amended). */
-const SOURCE_SWITCHED_OFF_FIELD = 'switchedOff';
-/** The availability field a switched-off row must not carry a value in. */
-const CATALOG_AGE_FIELD = 'catalogAsOf';
 /**
- * EVERY source a DEVICE has, in registration order with the device's native
- * provider first when it has one — each one marked with whether the operator
- * switched it off.
+ * The input field naming WHICH of a device's providers to ask. One at a time,
+ * by `addonId`, never a list of source ids: the operator settled the surface
+ * on 2026-09-20 (*"l'utilizzatore è uno solo"*). Absent means the device's
+ * bound provider.
+ */
+const PROVIDER_PIN_FIELD = 'provider';
+/** The capability whose singleton answers what a device is bound to. */
+const DEVICE_MANAGER_CAP = 'device-manager';
+/**
+ * EVERY source a DEVICE has — read from the device's BINDINGS, which is the
+ * framework's answer to "which providers does this device have".
+ *
+ * It used to enumerate REGISTRATIONS, and that is what put `analytics` in the
+ * picker three times on the first live run (device 592, 2026-09-20): one addon
+ * reached here as the device's native provider, as the hub-local registration
+ * and again as `pipeline-analytics@little-unraid`, with a fourth on the Mac
+ * node that `resolveCollectionForDevice` had already dropped. Three tick-boxes
+ * for one thing, and `listClips` triplicating every row underneath them.
+ *
+ * A binding is one per `(device, cap, provider)` and `setWrapperActive` (D62)
+ * is the authority over it, so **three rows for one provider stop being
+ * representable** — there is nothing to de-duplicate after the fact. It also
+ * makes the list mean what the operator says it means: a source exists for a
+ * camera because a configuration elsewhere put it there, not because some
+ * addon somewhere registered the capability.
  *
- * `resolveCollectionForDevice` decides which of the registered providers this
- * device may use: it drops disabled ones and ones inactive for the system. The
- * ones the operator switched OFF for this camera are NOT dropped here — they
- * are marked, because a switched-off source must still produce a ROW to be
- * switched back on from, and only its own provider can name it (D554 decision
- * 4; D556 as amended). What that mark costs the source is everything else:
- * {@link requireDeviceCollection} calls it for the source listing and for
- * nothing else. The deny set is the registry's PROJECTION of the persisted
- * wrapper activation — the operator's verb is `deviceManager.setWrapperActive`
- * and the authority is its store, never a second one here (D556).
+ * The binding names an ADDON, never a shape: `DeviceBindingEntry.kind` is UI
+ * metadata and is not branched on here (D13). A named addon is looked up in the
+ * cap's collection map, and failing that against the device's native provider,
+ * which the registry cannot always NAME (a cross-process native arrives through
+ * `setNativeFallback` with no addon id of its own) — in that case the binding is
+ * the only thing that names it.
  *
- * `resolveCollectionForDevice` returns provider objects only, so the addon ids
- * — needed to NAME a source that failed, to stamp the rows, and to apply the
- * addon-grained half of the deny set — come from `getCollectionEntries` by
- * object identity: both come from the same registry map in the same call, so
- * the reference IS the key.
+ * **A bindings read that FAILS keeps the registration set** (D49). Answering an
+ * empty list would read as "this camera has no recordings", which is the defect
+ * this whole line of work exists to end, so a failure is logged and the old
+ * behaviour stands for that call.
  */
-function sourcesForDevice(registry, capName, deviceId) {
-    const admitted = new Set(registry.resolveCollectionForDevice(capName, String(deviceId), {
-        includeSwitchedOff: true,
-    }));
+async function sourcesForDevice(registry, capName, deviceId, logger) {
+    const registered = new Map(registry.getCollectionEntries(capName));
+    const bound = await boundAddonIds(registry, capName, deviceId, logger);
+    if (bound === null)
+        return registrationsForDevice(registry, capName, deviceId);
+    const sources = [];
+    for (const addonId of bound) {
+        const provider = registered.get(addonId) ?? nativeNamedBy(registry, capName, deviceId, addonId);
+        if (provider === undefined) {
+            // A binding whose provider never booted is a DROPPED source, and a
+            // dropped source that says nothing is indistinguishable from a camera
+            // that has none.
+            logger?.warn(`${capName}: device is bound to "${addonId}", which has registered no provider here`, { tags: { deviceId, addonId }, meta: { capability: capName } });
+            continue;
+        }
+        sources.push({ addonId, provider });
+    }
+    return sources;
+}
+/**
+ * The addon ids the device is bound to for `capName`, or `null` when the
+ * bindings could not be read at all (never an empty list for that case — the
+ * two must not look alike).
+ */
+async function boundAddonIds(registry, capName, deviceId, logger) {
+    const manager = registry.getSingleton(DEVICE_MANAGER_CAP);
+    if (manager === null || typeof manager.getBindings !== 'function') {
+        logger?.warn(`${capName}: no device manager to read this device's bindings from`, {
+            tags: { deviceId },
+            meta: { capability: capName },
+        });
+        return null;
+    }
+    try {
+        const answer = await manager.getBindings({ deviceId });
+        const ids = [];
+        for (const entry of answer.entries) {
+            if (entry.capName !== capName)
+                continue;
+            const addonId = entry.providerAddonId;
+            if (addonId.length > 0 && !ids.includes(addonId))
+                ids.push(addonId);
+        }
+        return ids;
+    }
+    catch (err) {
+        logger?.warn(`${capName}: could not read this device's bindings — keeping the registrations`, {
+            tags: { deviceId },
+            meta: { capability: capName, reason: errMessage(err) },
+        });
+        return null;
+    }
+}
+/**
+ * The device's native provider when the binding's addon id is the one that
+ * registered it — or when the registry cannot name it at all, which is how a
+ * cross-process native arrives (`setNativeFallback`). The native is not in
+ * `state.providers`, so it is asked about separately (D556 decision 5).
+ */
+function nativeNamedBy(registry, capName, deviceId, addonId) {
+    const native = registry.getNativeProvider(capName, deviceId);
+    if (native === null)
+        return undefined;
+    const nativeAddonId = registry.getNativeAddonId(capName, deviceId);
+    if (nativeAddonId !== null && nativeAddonId !== addonId)
+        return undefined;
+    return native;
+}
+/**
+ * What this dispatcher did before the bindings became its authority, kept for
+ * exactly one caller: the failure path above. Every registered provider this
+ * device may use, native first.
+ */
+function registrationsForDevice(registry, capName, deviceId) {
+    const admitted = new Set(registry.resolveCollectionForDevice(capName, String(deviceId)));
     const sources = [];
     const seen = new Set();
     const native = registry.getNativeProvider(capName, deviceId);
     if (native !== null) {
-        // The native is NOT in `state.providers`, so `resolveCollectionForDevice`
-        // never sees it — it is asked about separately, against the same authority
-        // (D556 decision 5). Without this the picker would carry one row the
-        // operator cannot switch off, and it is the camera's OWN recordings:
-        // exactly the source the external-videoclips line is about.
-        const nativeAddonId = registry.getNativeAddonId(capName, deviceId) ?? 'native';
         sources.push({
-            addonId: nativeAddonId,
+            addonId: registry.getNativeAddonId(capName, deviceId) ?? 'native',
             provider: native,
-            switchedOff: registry.isDeviceSourceDisabled(String(deviceId), capName, nativeAddonId),
         });
         seen.add(native);
     }
@@ -115,11 +199,7 @@ function sourcesForDevice(registry, capName, deviceId) {
         if (!admitted.has(provider) || seen.has(provider))
             continue;
         seen.add(provider);
-        sources.push({
-            addonId,
-            provider,
-            switchedOff: registry.isDeviceSourceDisabled(String(deviceId), capName, addonId),
-        });
+        sources.push({ addonId, provider });
     }
     return sources;
 }
@@ -206,7 +286,7 @@ function unreachableSourceRow(addonId, reason) {
         availability: { state: 'unreachable', reason },
     };
 }
-async function fanOut(registry, sources, method, input, capName, deviceId, logger) {
+async function fanOut(sources, method, input, capName, deviceId, logger) {
     const isSourceListing = method === exports.SOURCE_LISTING_METHOD;
     const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, method, input, capName, deviceId)));
     const rows = [];
@@ -233,88 +313,38 @@ async function fanOut(registry, sources, method, input, capName, deviceId, logge
             });
             continue;
         }
-        rows.push(...finishRows(registry, capName, deviceId, source, result.value, isSourceListing));
+        rows.push(...finishRows(source, result.value, isSourceListing));
     }
     return mergeRows(rows);
 }
 /**
- * The availability block without its catalog age.
+ * Stamp each source-listing row with the addon that really served it.
  *
- * `catalogAsOf` means "when this source's catalog was last CONFIRMED". A source
- * the operator switched off is never asked for a catalog, so it has no
- * confirmation to report and will never get a fresher one — and an age that can
- * only grow draws a STALLING source rather than an off switch (D62: disabled
- * must never look like broken). The rest of the block is left exactly as the
- * provider said it: what the source CAN do is a different question from whether
- * it may.
- */
-function withoutCatalogAge(availability) {
-    if (availability === null || typeof availability !== 'object')
-        return availability;
-    return Object.fromEntries(Object.entries(availability).filter(([key]) => key !== CATALOG_AGE_FIELD));
-}
-/**
- * Stamp each row with the addon that really served it, mark a source listing
- * row the operator switched off, and drop the CLIP rows of such a source.
- *
- * The two halves are deliberately asymmetric, and that asymmetry is the whole
- * of D556's amendment: a switched-off source contributes no clips (the point of
- * the switch) and keeps its row (the control the switch is undone from). A
- * `listSources` that dropped the row left an unticked source with nothing to
- * un-tick — on a Reolink camera, which has exactly one source since D555's
- * collapse, that is the entire picker.
- *
- * **The stamp** is authoritative: a surface cannot otherwise resolve a source
- * row to who answers it, and the alternative — a `native:reolink:* →
+ * The stamp is authoritative: a surface cannot otherwise resolve a source row
+ * to who answers it, and the alternative — a `native:reolink:* →
  * provider-reolink` prefix table inside the widget — is a second authority on
  * provider identity living in the one package with no business knowing it
  * (D557). The registry's id is a fact; a provider's own value is a claim, so
  * the fact wins.
  *
- * **The drop** happens here rather than in `sourcesForDevice` because one
- * addon serves SEVERAL of a device's sources (`addon-provider-reolink` answers
- * a hub child with `onboard` AND `hub`), so dropping the PROVIDER would turn
- * off every source it has while the operator ticked one. Rows are where
- * sources are actually named, so this is the grain the per-source authority
- * applies at — same registry projection, same migration rule, one step finer.
- *
- * A camera with NO deny entry is untouched: the rows come back verbatim, in
- * the provider's own order, which is D554 decision 6's guarantee and today's
- * behaviour for every camera on the fleet.
+ * It used to also DROP the rows of a source the operator had switched off, and
+ * mark the listing row that let him switch it back on. That whole half went on
+ * 2026-09-20: every provider always works, and a source exists for a camera
+ * because a binding put it there — so "off" is an unbound provider, not a
+ * second store beside the binding (D556/D557 amended). Nothing here filters
+ * any more; the filtering happened when {@link sourcesForDevice} read the
+ * bindings.
  */
-function finishRows(registry, capName, deviceId, source, rows, isSourceListing) {
-    const denied = registry.getDeviceDisabledSources(String(deviceId), capName);
+function finishRows(source, rows, isSourceListing) {
+    if (!isSourceListing)
+        return rows;
     const out = [];
     for (const row of rows) {
         if (row === null || typeof row !== 'object') {
             out.push(row);
             continue;
         }
-        const rowSourceId = Reflect.get(row, SOURCE_ID_FIELD);
-        // ONE predicate for the whole deny set, migration rule included: an entry
-        // is a source id, or (pre-re-key, D555) the id of the addon that serves it.
-        const off = denied.length > 0 &&
-            (0, system_1.isSourceDenied)(denied, {
-                addonId: source.addonId,
-                ...(typeof rowSourceId === 'string' ? { sourceId: rowSourceId } : {}),
-            });
-        if (isSourceListing) {
-            const stamped = {
-                ...row,
-                [SOURCE_ADDON_FIELD]: source.addonId,
-            };
-            out.push(off
-                ? {
-                    ...stamped,
-                    availability: withoutCatalogAge(Reflect.get(row, 'availability')),
-                    [SOURCE_SWITCHED_OFF_FIELD]: true,
-                }
-                : stamped);
-            continue;
-        }
-        if (off)
-            continue;
-        out.push(row);
+        out.push({ ...row, [SOURCE_ADDON_FIELD]: source.addonId });
     }
     return out;
 }
@@ -402,6 +432,31 @@ async function dispatchScalar(sources, method, input, capName, deviceId, logger)
             `An unclaimed id is refused rather than answered by another source.`,
     });
 }
+/**
+ * The device's sources narrowed to the one the caller PINNED, if it pinned one.
+ *
+ * A pin the device is not bound to is REFUSED by name. Answering it from
+ * another provider is how a fabricated addon id once came back with somebody
+ * else's answer (D552, `rejectUnresolvedAddonPin`), and here it would hand a
+ * caller who asked for the camera's own SD card the analytics visit log with
+ * nothing saying so.
+ */
+function pinnedProvider(sources, input, capName, deviceId) {
+    if (input === null || typeof input !== 'object')
+        return sources;
+    const pin = Reflect.get(input, PROVIDER_PIN_FIELD);
+    if (typeof pin !== 'string' || pin.length === 0)
+        return sources;
+    const picked = sources.filter((source) => source.addonId === pin);
+    if (picked.length > 0)
+        return picked;
+    throw new server_1.TRPCError({
+        code: 'BAD_REQUEST',
+        message: `Capability "${capName}": device ${deviceId} is not bound to provider "${pin}". ` +
+            `Bound providers: ${sources.map((source) => source.addonId).join(', ') || '(none)'}. ` +
+            `A pin nobody answers is refused rather than served by another provider.`,
+    });
+}
 /**
  * Build the per-device COLLECTION dispatcher for `capName` — the collection
  * twin of `requireDeviceScoped`, and the provider object the cap router's
@@ -425,53 +480,27 @@ function requireDeviceCollection(registry, capName, logger) {
                         message: `${capName}.${prop}: input must carry numeric "deviceId"`,
                     });
                 }
-                const all = sourcesForDevice(registry, capName, deviceId);
-                if (all.length === 0) {
+                const bound = await sourcesForDevice(registry, capName, deviceId, logger);
+                const sources = pinnedProvider(bound, input, capName, deviceId);
+                if (sources.length === 0) {
                     throw new server_1.TRPCError({
                         code: 'PRECONDITION_FAILED',
                         message: `Capability "${capName}" not registered for device ${deviceId}`,
                     });
                 }
-                // The LISTING sees every source the device has, switched off or not
-                // — that row is the only control the operator has to switch one back
-                // on. Everything else sees the SERVING set.
-                const listing = prop === exports.SOURCE_LISTING_METHOD;
-                const sources = listing ? all : all.filter((source) => !source.switchedOff);
-                if (sources.length === 0) {
-                    // Every source is switched off. That is an operator's decision and
-                    // not a missing provider, so it must not wear PRECONDITION_FAILED's
-                    // "not registered" — the rows say which it is, and the answer to
-                    // "what clips does it have" is honestly none (D556 left this open).
-                    logger?.info(`${capName}.${prop}: every source of this device is switched off`, {
-                        tags: { deviceId },
-                        meta: { capability: capName, method: prop, sources: all.map((s) => s.addonId) },
-                    });
-                    if (isFanOutMethod(registry, capName, prop))
-                        return [];
-                    throw new server_1.TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Capability "${capName}.${prop}": every source of device ${deviceId} is ` +
-                            `switched off for this camera. Switch one back on to serve it.`,
-                    });
-                }
                 const first = sources[0];
                 if (isFanOutMethod(registry, capName, prop)) {
                     // One source is not a merge: its rows travel verbatim, in its own
                     // order, so a camera with one provider answers exactly as it did
-                    // before this dispatcher existed.
+                    // before this dispatcher existed (D554 decision 6). Only the
+                    // listing rows are finished, and only to carry the addon stamp.
                     if (sources.length === 1 && first !== undefined) {
-                        // One PROVIDER is not a merge — but it may still serve several
-                        // SOURCES, and the operator may have switched one of them off.
-                        // So the rows are finished (stamped, and filtered by source)
-                        // even here; with no deny entry that is the identity function,
-                        // so an untouched camera answers exactly as it did before
-                        // (D554 decision 6).
                         const answered = await callSource(first, prop, input, capName, deviceId);
                         if (!Array.isArray(answered))
                             return answered;
-                        return finishRows(registry, capName, deviceId, first, answered, prop === exports.SOURCE_LISTING_METHOD);
+                        return finishRows(first, answered, prop === exports.SOURCE_LISTING_METHOD);
                     }
-                    return await fanOut(registry, sources, prop, input, capName, deviceId, logger);
+                    return await fanOut(sources, prop, input, capName, deviceId, logger);
                 }
                 if (sources.length === 1 && first !== undefined) {
                     return await callSource(first, prop, input, capName, deviceId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.355",
+  "version": "1.2.356",
   "private": false,
   "files": [
     "dist",
@@ -35,8 +35,8 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.244",
-    "@camstack/addon-agent-ui": "1.2.132",
+    "@camstack/addon-admin-ui": "1.2.245",
+    "@camstack/addon-agent-ui": "1.2.133",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
     "@camstack/addon-notifiers": "1.2.119",
@@ -44,9 +44,9 @@
     "@camstack/addon-pipeline-orchestrator": "1.2.231",
     "@camstack/addon-post-analysis": "1.2.272",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.276",
-    "@camstack/types": "1.2.234",
-    "@camstack/ui-library": "1.2.190",
+    "@camstack/system": "1.2.277",
+    "@camstack/types": "1.2.235",
+    "@camstack/ui-library": "1.2.191",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",