@camstack/system 1.2.304 → 1.2.305

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $t as siteZoneKey, A as STREAM_PROFILE_META, Bn as EventCategory, Bt as parseStreamParamsFormPatch, G as buildStreamParamsConfigSchema, Jt as runtimeStatePolicyFor, Lt as normalizeUnit, Ot as locationIconKey, Sn as WELL_KNOWN_TAB_MAP, _n as DeviceFeature, d as DAY_NAMES, dn as errMsg, h as DeviceStatusSchema, jn as isDeviceConfigCap, mt as formatMinutes, nt as deviceStateCapability, o as CAMERA_SWITCH_ORDER, ot as enumerateItemArrayFields, pn as BaseAddon, rt as deviceStatusCapability, s as CAP_NAMES_WITH_STATUS, st as enumerateSchemaFields, t as ALL_CAPABILITY_DEFINITIONS, tt as deviceManagerCapability, ut as expandContainer, vn as DeviceRole, wt as legacyAutoLinkIds, x as MINUTES_PER_DAY, y as LocationIconIdSchema, yn as DeviceType, zn as sleep$1 } from "../../dist-Duqf80QM.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CeO_dBHU.mjs";
+import { A as STREAM_PROFILE_META, Bt as normalizeUnit, Cn as DeviceType, Dt as legacyAutoLinkIds, En as WELL_KNOWN_TAB_MAP, Fn as isDeviceConfigCap, G as buildStreamParamsConfigSchema, Sn as DeviceRole, Un as sleep$1, Ut as parseStreamParamsFormPatch, Wn as EventCategory, Z as createDeviceExtensionProvider, Zt as runtimeStatePolicyFor, _n as BaseAddon, _t as formatMinutes, at as deviceStateCapability, d as DAY_NAMES, h as DeviceStatusSchema, hn as errMsg, it as deviceManagerCapability, jt as locationIconKey, lt as enumerateItemArrayFields, nn as siteZoneKey, o as CAMERA_SWITCH_ORDER, ot as deviceStatusCapability, pt as expandContainer, rt as deviceExtensionCapability, s as CAP_NAMES_WITH_STATUS, t as ALL_CAPABILITY_DEFINITIONS, tt as defineExtensionSlotProvider, ut as enumerateSchemaFields, x as MINUTES_PER_DAY, xn as DeviceFeature, y as LocationIconIdSchema } from "../../dist-Df1NhKxm.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-dC4ckbXJ.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -2937,6 +2937,47 @@ async function applyLinkedDevicesPatch(pctx, deviceId, patch) {
 	await pctx.settings.writeDeviceStore(deviceId, next);
 	return { success: true };
 }
+/**
+* Which NEW picks a linked-devices write must refuse: the camera itself, a
+* container (never a pick — its children are, D356 and the file header), and
+* an id no device has.
+*
+* Only ids that are not ALREADY persisted are judged. A list written before
+* this rule existed may hold a container or a device that has since been
+* deleted; the editor shows those as unavailable / missing, and keeping them
+* is not a new link. Removing them is the operator's call, never this
+* function's (a missing source is shown, never silently dropped).
+*
+* Deliberately NOT applied to the settings-section save
+* (`applyLinkedDevicesPatch` via `DEVICE_STORE_SECTIONS`): that surface has
+* never refused, its picker never offers a container, and the Locations page
+* writes the list through it. Slice 1 changes no behaviour on the old path;
+* both paths persist through `applyLinkedDevicesPatch`.
+*/
+function refusedLinkedPicks(params) {
+	const kept = new Set(params.persisted);
+	const out = [];
+	for (const deviceId of params.picked) {
+		if (kept.has(deviceId)) continue;
+		if (deviceId === params.selfId) {
+			out.push({
+				deviceId,
+				reason: "self"
+			});
+			continue;
+		}
+		const device = params.fleet.get(deviceId);
+		if (device === void 0) out.push({
+			deviceId,
+			reason: "unknown"
+		});
+		else if (device.type === DeviceType.Container) out.push({
+			deviceId,
+			reason: "container"
+		});
+	}
+	return out;
+}
 //#endregion
 //#region src/builtins/device-manager/device-store-sections.ts
 /** The device-manager's device-store-backed sections. Add an entry to extend. */
@@ -3926,6 +3967,124 @@ var DeviceEventPropagator = class {
 		return chain;
 	}
 };
+//#endregion
+//#region src/builtins/device-manager/device-extension-linked-slot.ts
+/** The routing prefix of this owner's `slotRef`s. */
+var DEVICE_MANAGER_EXTENSION_SOURCE = "device-manager";
+/** The store the slot reads and writes, named (D62). */
+var LINKED_DEVICES_AUTHORITY = `device-manager:${LINKED_IDS_CONFIG_KEY}`;
+/**
+* The picked ids' ledger rows, in ONE indexed read of the device manager's own
+* store (`rows.getMany`) — never the whole fleet to label a handful of ids.
+* An id no device has is absent from the map.
+*/
+async function pickedDevices(pctx, ids) {
+	const rows = await pctx.metaStore.rows.getMany(ids);
+	const out = /* @__PURE__ */ new Map();
+	for (const [id, row] of rows) out.set(id, {
+		name: row.meta.name,
+		type: row.meta.type
+	});
+	return out;
+}
+/** What a camera's picked id is, said once for the editor. */
+function sourceOf(deviceId, byId) {
+	const device = byId.get(deviceId);
+	if (device === void 0) return {
+		deviceId,
+		name: null,
+		health: "missing",
+		detail: "No device has this id any more — it links nothing until removed."
+	};
+	if (device.type === DeviceType.Container) return {
+		deviceId,
+		name: device.name,
+		health: "unavailable",
+		detail: "A container is never a pick (D356): its children are linked in its place. Pick the children instead."
+	};
+	return {
+		deviceId,
+		name: device.name,
+		health: "ok"
+	};
+}
+function describeRefusal(deviceId, reason) {
+	if (reason === "self") return `${deviceId} is the camera itself`;
+	if (reason === "container") return `${deviceId} is a container — pick its children`;
+	return `${deviceId} is not a device`;
+}
+async function fleetOf(pctx) {
+	const all = await listAll(pctx, LINK_CANDIDATE_PROJECTION);
+	return new Map(all.map((d) => [d.id, d]));
+}
+function candidatesFor(deviceId, byId) {
+	const location = byId.get(deviceId)?.location ?? null;
+	const out = [];
+	for (const device of byId.values()) {
+		if (device.id === deviceId) continue;
+		if (device.parentDeviceId === deviceId) continue;
+		if (device.type === DeviceType.Container) continue;
+		const suggested = location !== null && device.location === location;
+		const parent = device.parentDeviceId === null ? void 0 : byId.get(device.parentDeviceId);
+		out.push({
+			deviceId: device.id,
+			name: device.name,
+			type: device.type,
+			location: device.location,
+			parentName: parent?.name ?? null,
+			suggested,
+			reason: suggested ? "same location" : null
+		});
+	}
+	return out.toSorted((a, b) => Number(b.suggested) - Number(a.suggested) || a.name.localeCompare(b.name));
+}
+/** Build the `device-extension` provider the device manager registers. */
+function createDeviceManagerExtensionProvider(pctx) {
+	return createDeviceExtensionProvider({
+		source: DEVICE_MANAGER_EXTENSION_SOURCE,
+		label: "Device manager",
+		slots: [defineExtensionSlotProvider("linked-devices", {
+			list: async (deviceId) => {
+				const { manualIds } = parseLinkedDevicesConfig(await pctx.settings.readDeviceStore(deviceId));
+				const byId = await pickedDevices(pctx, manualIds);
+				return {
+					authority: LINKED_DEVICES_AUTHORITY,
+					enabled: null,
+					activation: null,
+					value: {
+						slot: "linked-devices",
+						deviceIds: [...manualIds]
+					},
+					sources: manualIds.map((id) => sourceOf(id, byId))
+				};
+			},
+			set: async (deviceId, value) => {
+				const [byId, blob] = await Promise.all([pickedDevices(pctx, value.deviceIds), pctx.settings.readDeviceStore(deviceId)]);
+				const refused = refusedLinkedPicks({
+					selfId: deviceId,
+					picked: value.deviceIds,
+					persisted: parseLinkedDevicesConfig(blob).manualIds,
+					fleet: byId
+				});
+				if (refused.length > 0) {
+					pctx.host.ctx.logger.warn("linked-devices: write refused — nothing persisted", {
+						tags: { deviceId },
+						meta: { refused }
+					});
+					throw new Error(`linked-devices on ${deviceId}: refused — ` + refused.map((r) => describeRefusal(r.deviceId, r.reason)).join("; "));
+				}
+				await applyLinkedDevicesPatch(pctx, deviceId, { [LINKED_IDS_CONFIG_KEY]: value.deviceIds });
+				return {
+					applied: true,
+					reload: "none"
+				};
+			},
+			candidates: async (deviceId) => candidatesFor(deviceId, await fleetOf(pctx))
+		})],
+		hostTypeOf: async (deviceId) => (await pctx.metaStore.resolvePersistedById(deviceId))?.meta.type ?? null,
+		logger: pctx.host.ctx.logger
+	});
+}
 /** A refusal that names a switch the camera does not offer, rather than one it
 *  could not be asked about. The cap documents rejecting the former; anything
 *  else is treated as the camera being out of reach, which is the safe reading:
@@ -8044,28 +8203,35 @@ var DeviceManagerAddon = class extends BaseAddon {
 			this.propagator.start();
 			this.ctx.logger.info("device-event-propagator started");
 		}
-		return [{
-			capability: deviceManagerCapability,
-			provider
-		}, {
-			capability: deviceStateCapability,
-			provider: {
-				getSnapshot: async (input) => {
-					return stateMirror.snapshotForDevice(input.deviceId);
-				},
-				getCapSlice: async (input) => {
-					return stateMirror.capSlice(input.deviceId, input.capName);
-				},
-				getAllSnapshots: async () => {
-					return stateMirror.allSnapshots();
-				},
-				setCapSlice: async (input) => {
-					const { deviceId, capName, slice } = input;
-					if (!await resolvePersistedById(deviceId)) throw new Error(`[device-manager] setCapSlice: unknown device id=${deviceId}`);
-					if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings, capName);
+		return [
+			{
+				capability: deviceManagerCapability,
+				provider
+			},
+			{
+				capability: deviceStateCapability,
+				provider: {
+					getSnapshot: async (input) => {
+						return stateMirror.snapshotForDevice(input.deviceId);
+					},
+					getCapSlice: async (input) => {
+						return stateMirror.capSlice(input.deviceId, input.capName);
+					},
+					getAllSnapshots: async () => {
+						return stateMirror.allSnapshots();
+					},
+					setCapSlice: async (input) => {
+						const { deviceId, capName, slice } = input;
+						if (!await resolvePersistedById(deviceId)) throw new Error(`[device-manager] setCapSlice: unknown device id=${deviceId}`);
+						if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings, capName);
+					}
 				}
+			},
+			{
+				capability: deviceExtensionCapability,
+				provider: createDeviceManagerExtensionProvider(pctx)
 			}
-		}];
+		];
 	}
 	async onShutdown() {
 		this.propagator?.stop();

package/dist/builtins/doorbell/binding-mirror.d.ts

@@ -113,3 +113,27 @@ export type DurableBindingVerdict = 'bound' | 'unbound' | 'unreadable';
  * from an empty snapshot, whereas a genuine unbind leaves the key present.
  */
 export declare function readDurableWrapperBinding(record: unknown, deviceId: number, capName: string, ownAddonId: string): DurableBindingVerdict;
+/**
+ * What a press on this camera would do right now.
+ *
+ * `rings` — the binding is confirmed (mirror `bound`, or the durable store
+ * rescued an `unbound` mirror). `rings-pending` — one negative read, not yet
+ * believed. `rings-unconfirmed` — no read has happened yet; the ring path errs
+ * open. `unknown` — the mirror says unbound but the durable store could not
+ * be read: a press RINGS (an unanswerable store never destroys a one-shot
+ * press), and nobody can say whether that is right. `silent` — the durable
+ * store agrees with an unbound mirror: the only verdict that drops a press.
+ */
+export type RingVerdict = 'rings' | 'rings-pending' | 'rings-unconfirmed' | 'unknown' | 'silent';
+/** Does this mirror state need the durable authority before a verdict? Only `unbound` does. */
+export declare function needsDurableRead(state: DoorbellBindingState | undefined): boolean;
+/**
+ * THE decision — the ring gate (`fireDoorbell` / `ringsDespiteUnboundMirror`)
+ * and the Extensions card's activation both call it, so what the card says
+ * and what a press does cannot disagree. `durable` is `null` when it was not
+ * read, which {@link needsDurableRead} allows for every state but `unbound`.
+ * Pure: it reads nothing and writes nothing.
+ */
+export declare function ringVerdict(state: DoorbellBindingState | undefined, durable: DurableBindingVerdict | null): RingVerdict;
+/** Whether a press proceeds under this verdict. */
+export declare function verdictRings(verdict: RingVerdict): boolean;

package/dist/builtins/doorbell/doorbell-extension-slot.d.ts

@@ -0,0 +1,66 @@
+import { ExtensionSlotActivation, IDeviceExtensionProvider, IScopedLogger } from '@camstack/types';
+import { DoorbellBindingState, DurableBindingVerdict, RingVerdict } from './binding-mirror.js';
+import { DoorbellSource } from './doorbell-settings.js';
+/** The routing prefix of this owner's `slotRef`s. */
+export declare const VIRTUAL_DOORBELL_EXTENSION_SOURCE = "virtual-doorbell";
+/** The store the slot reads and writes, named (D62). */
+export declare const DOORBELL_SOURCES_AUTHORITY = "virtual-doorbell:doorbellSources";
+/** The authority that decides whether the wrapper serves a camera at all. */
+export declare const WRAPPER_ACTIVATION_AUTHORITY = "device-manager:setWrapperActive";
+/** The compact device row this slot needs from the device manager. */
+export interface DoorbellSlotDevice {
+    readonly id: number;
+    readonly name: string;
+    readonly type: string;
+    readonly location: string | null;
+    readonly parentDeviceId: number | null;
+}
+/** What the slot needs from the addon — its store, its mirror, and the fleet's reads. */
+export interface DoorbellSlotDeps {
+    readonly ownAddonId: string;
+    readonly logger: IScopedLogger;
+    readonly readSources: (deviceId: number) => Promise<readonly DoorbellSource[]>;
+    /** The addon's own settings-save path (normalise, store, invalidate). */
+    readonly persistSources: (deviceId: number, deviceIds: readonly number[]) => Promise<void>;
+    /** The host's own row — ONE read, for its type. */
+    readonly getDevice: (deviceId: number) => Promise<DoorbellSlotDevice | null>;
+    /** Several devices in ONE read. Ids no device has are simply absent. */
+    readonly listDevices: (deviceIds: readonly number[]) => Promise<readonly DoorbellSlotDevice[]>;
+    /** The D49 mirror's verdict for this camera, or undefined when it has none. */
+    readonly readBindingMirror: (deviceId: number) => DoorbellBindingState | undefined;
+    /**
+     * The DURABLE authority, read-only — the same read the ring gate makes
+     * before it drops a press. Never throws: a store that cannot answer is
+     * `unreadable`, which carries no information.
+     */
+    readonly readDurableBinding: (deviceId: number) => Promise<DurableBindingVerdict>;
+    readonly sourceCapableDeviceIds: () => Promise<readonly number[]>;
+    readonly listFleet: () => Promise<readonly DoorbellSlotDevice[]>;
+}
+/** How the card SAYS a verdict. The verdict itself is `ringVerdict`'s, never the card's. */
+export declare function activationFromVerdict(verdict: RingVerdict): ExtensionSlotActivation;
+/**
+ * The card's activation — READ-ONLY (D648 fix round 3).
+ *
+ * The verdict is `ringVerdict`, the function the ring gate decides with, fed
+ * the addon's mirror as it stands. The card never refreshes the mirror and
+ * never writes it: the mirror gates the ring, and a view that could move it
+ * would let a page refetch during a store blip silence a doorbell. The only
+ * read the card may make is the durable authority, and only where the ring
+ * gate would make it too (`needsDurableRead`: an `unbound` mirror). A camera
+ * the mirror has never seen costs nothing — the ring path errs open there and
+ * so does the card.
+ */
+/** The card's durable read for one camera, shared by every view asking at once. */
+type DurableReader = (deviceId: number) => Promise<DurableBindingVerdict>;
+/**
+ * Concurrent card views of the same `unbound` camera share ONE durable read,
+ * per camera, for as long as it is in flight — a page with several viewers
+ * (or a refetch storm) must not multiply the store round trip. Only the
+ * CARD's reads are shared: the ring gate calls the addon's
+ * `readDurableAuthority` on its own path and never waits behind a card.
+ */
+export declare function shareDurableReads(read: DurableReader): DurableReader;
+/** Build the `device-extension` provider the virtual doorbell registers. */
+export declare function createDoorbellExtensionProvider(deps: DoorbellSlotDeps): IDeviceExtensionProvider;
+export {};

package/dist/builtins/doorbell/virtual-doorbell.addon.d.ts

@@ -53,6 +53,11 @@ export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddon
     private readonly bindingMirror;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * The `device-extension` provider: the same store and the same save path as
+     * the settings section below (see `doorbell-extension-slot.ts`).
+     */
+    private buildExtensionProvider;
     private handleStateChanged;
     /**
      * Say out loud every case where a rise did NOT become a ring. Silence
@@ -188,5 +193,14 @@ export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddon
      */
     private buildDeviceSettingsContribution;
     private saveDeviceSettingsPatch;
+    /**
+     * THE write path for a camera's trigger sources — the settings save above
+     * and the `doorbell-source` extension slot both land here (D648), so the
+     * two surfaces cannot store different shapes: normalise to
+     * `doorbellSources: [{deviceId}]`, strip the legacy keys, and invalidate the
+     * assignment cache so the next rise (and the binding mirror's next
+     * refresh, off the ring path) sees the new wiring.
+     */
+    private persistDoorbellSources;
 }
 export default VirtualDoorbellAddon;