@camstack/system 1.2.24 → 1.2.26

package/dist/{manifest-python-deps-BbOZZbVt.js → manifest-python-deps-COgal7Jy.js}

@@ -1188,6 +1188,27 @@ function addSettingsActions(addon, actions) {
 	}
 }
 //#endregion
+//#region src/kernel/moleculer/settings-read-guard.ts
+/**
+* Merge `patch` over the current value and write it — unless the read failed,
+* in which case write NOTHING.
+*
+* Returns whether the write was attempted, so a caller can surface the refusal.
+*/
+async function readModifyWrite(input) {
+	const current = await input.read();
+	if (current.kind === "failed") {
+		input.onRefused(current.error);
+		return false;
+	}
+	const base = current.kind === "value" ? current.value : {};
+	await input.write({
+		...base,
+		...input.patch
+	});
+	return true;
+}
+//#endregion
 //#region src/kernel/moleculer/device-cap-proxy.ts
 /**
 * Max number of accessory children spawned concurrently during a single
@@ -7171,8 +7192,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		bindingCache.clear();
 	});
 	const settingsApi = Reflect.get(api, "settingsStore");
-	const readBlob = async (coll, key, namespace) => {
-		if (!settingsApi) return {};
+	/**
+	* Read a settings blob, distinguishing a MISS from a FAILURE.
+	*
+	* Collapsing the two is a data-loss bug, not a style choice: every mutation
+	* is read-modify-write, so a failed read that answers "empty" makes the write
+	* persist the patch ALONE and destroy every field the patch does not mention.
+	* That is what emptied the recording configuration on 2026-07-31 when the UDS
+	* transport stalled — `{"enabled": false, "bands": []}`, two and a half hours
+	* of footage never written, and nothing that looked like a fault.
+	*/
+	const readBlobResult = async (coll, key, namespace) => {
+		if (!settingsApi) return { kind: "missing" };
 		try {
 			const v = await settingsApi.get.query(namespace !== void 0 ? {
 				namespace,
@@ -7182,11 +7213,40 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 				collection: coll,
 				key
 			});
-			return v && typeof v === "object" ? v : {};
-		} catch {
-			return {};
+			return v && typeof v === "object" ? {
+				kind: "value",
+				value: v
+			} : { kind: "missing" };
+		} catch (err) {
+			return {
+				kind: "failed",
+				error: (0, _camstack_types_addon.errMsg)(err)
+			};
 		}
 	};
+	/**
+	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
+	* to defaults instead of throwing. Safe here precisely because the result is
+	* never written back — {@link readBlobResult} is what the write paths use.
+	*/
+	const readBlob = async (coll, key, namespace) => {
+		const r = await readBlobResult(coll, key, namespace);
+		return r.kind === "value" ? r.value : {};
+	};
+	/** Read-modify-write that REFUSES to write when the read failed. */
+	const mergeBlob = async (coll, key, patch, namespace) => {
+		await readModifyWrite({
+			read: () => readBlobResult(coll, key, namespace),
+			write: (next) => writeBlob(coll, key, next, namespace),
+			patch,
+			onRefused: (error) => {
+				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
+					error,
+					patchKeys: Object.keys(patch)
+				} });
+			}
+		});
+	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -7225,10 +7285,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async writeAddonStore(patch) {
 			return serializeRmw("addon-settings", "root", async () => {
-				await writeBlob("addon-settings", "root", {
-					...await readBlob("addon-settings", "root", addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-settings", "root", patch, addonId);
 			});
 		},
 		async readDeviceStore(deviceId) {
@@ -7237,10 +7294,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		async writeDeviceStore(deviceId, patch) {
 			const key = String(deviceId);
 			return serializeRmw("addon-devices", key, async () => {
-				await writeBlob("addon-devices", key, {
-					...await readBlob("addon-devices", key, addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-devices", key, patch, addonId);
 			});
 		},
 		async clearDeviceStore(deviceId) {
@@ -7260,10 +7314,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async setSection(section, patch) {
 			return serializeRmw("sections", section, async () => {
-				await writeBlob("sections", section, {
-					...await readBlob("sections", section),
-					...patch
-				});
+				await mergeBlob("sections", section, patch);
 			});
 		}
 	};

package/dist/{manifest-python-deps-C9qhvMUi.mjs → manifest-python-deps-julrfvyf.mjs}

@@ -1186,6 +1186,27 @@ function addSettingsActions(addon, actions) {
 	}
 }
 //#endregion
+//#region src/kernel/moleculer/settings-read-guard.ts
+/**
+* Merge `patch` over the current value and write it — unless the read failed,
+* in which case write NOTHING.
+*
+* Returns whether the write was attempted, so a caller can surface the refusal.
+*/
+async function readModifyWrite(input) {
+	const current = await input.read();
+	if (current.kind === "failed") {
+		input.onRefused(current.error);
+		return false;
+	}
+	const base = current.kind === "value" ? current.value : {};
+	await input.write({
+		...base,
+		...input.patch
+	});
+	return true;
+}
+//#endregion
 //#region src/kernel/moleculer/device-cap-proxy.ts
 /**
 * Max number of accessory children spawned concurrently during a single
@@ -7169,8 +7190,18 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		bindingCache.clear();
 	});
 	const settingsApi = Reflect.get(api, "settingsStore");
-	const readBlob = async (coll, key, namespace) => {
-		if (!settingsApi) return {};
+	/**
+	* Read a settings blob, distinguishing a MISS from a FAILURE.
+	*
+	* Collapsing the two is a data-loss bug, not a style choice: every mutation
+	* is read-modify-write, so a failed read that answers "empty" makes the write
+	* persist the patch ALONE and destroy every field the patch does not mention.
+	* That is what emptied the recording configuration on 2026-07-31 when the UDS
+	* transport stalled — `{"enabled": false, "bands": []}`, two and a half hours
+	* of footage never written, and nothing that looked like a fault.
+	*/
+	const readBlobResult = async (coll, key, namespace) => {
+		if (!settingsApi) return { kind: "missing" };
 		try {
 			const v = await settingsApi.get.query(namespace !== void 0 ? {
 				namespace,
@@ -7180,11 +7211,40 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 				collection: coll,
 				key
 			});
-			return v && typeof v === "object" ? v : {};
-		} catch {
-			return {};
+			return v && typeof v === "object" ? {
+				kind: "value",
+				value: v
+			} : { kind: "missing" };
+		} catch (err) {
+			return {
+				kind: "failed",
+				error: errMsg(err)
+			};
 		}
 	};
+	/**
+	* Soft read for CONSUMERS: a failure reads as empty so a boot path degrades
+	* to defaults instead of throwing. Safe here precisely because the result is
+	* never written back — {@link readBlobResult} is what the write paths use.
+	*/
+	const readBlob = async (coll, key, namespace) => {
+		const r = await readBlobResult(coll, key, namespace);
+		return r.kind === "value" ? r.value : {};
+	};
+	/** Read-modify-write that REFUSES to write when the read failed. */
+	const mergeBlob = async (coll, key, patch, namespace) => {
+		await readModifyWrite({
+			read: () => readBlobResult(coll, key, namespace),
+			write: (next) => writeBlob(coll, key, next, namespace),
+			patch,
+			onRefused: (error) => {
+				scopedLogger.error(`settings merge REFUSED (${coll}/${key}) — read failed, refusing to overwrite with a partial blob`, { meta: {
+					error,
+					patchKeys: Object.keys(patch)
+				} });
+			}
+		});
+	};
 	const writeBlob = async (coll, key, value, namespace) => {
 		if (!settingsApi) return;
 		try {
@@ -7223,10 +7283,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async writeAddonStore(patch) {
 			return serializeRmw("addon-settings", "root", async () => {
-				await writeBlob("addon-settings", "root", {
-					...await readBlob("addon-settings", "root", addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-settings", "root", patch, addonId);
 			});
 		},
 		async readDeviceStore(deviceId) {
@@ -7235,10 +7292,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		async writeDeviceStore(deviceId, patch) {
 			const key = String(deviceId);
 			return serializeRmw("addon-devices", key, async () => {
-				await writeBlob("addon-devices", key, {
-					...await readBlob("addon-devices", key, addonId),
-					...patch
-				}, addonId);
+				await mergeBlob("addon-devices", key, patch, addonId);
 			});
 		},
 		async clearDeviceStore(deviceId) {
@@ -7258,10 +7312,7 @@ async function buildAddonContext(runtime, declaration, dataDir, options) {
 		},
 		async setSection(section, patch) {
 			return serializeRmw("sections", section, async () => {
-				await writeBlob("sections", section, {
-					...await readBlob("sections", section),
-					...patch
-				});
+				await mergeBlob("sections", section, patch);
 			});
 		}
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.24",
+  "version": "1.2.26",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",