@camstack/system 1.2.304 → 1.2.306

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C571Y95Z.js");
+const require_dist = require("../../dist-vecbhDzu.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -166,13 +166,19 @@ var DoorbellTriggerEngine = class {
 * not survive the next read. So a negative read ARMS the revocation and a
 * second consecutive negative applies it.
 *
-* ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
-* the ring path at all means the camera has a configured trigger source,
-* and a source can only be configured through this wrapper's own
-* binding-gated settings surface — so a configured source is itself
-* evidence the wrapper was bound. The cost of erring open is a spurious
-* ring on a camera the operator unbound but left configured, for at most
-* two reload cycles. The cost of erring closed is the press.
+* ERRING. `undefined` (never read) and `unbind-pending` both ring. The cost
+* of erring open is a spurious ring on a camera whose wrapper is not bound
+* but which has trigger sources, for at most two reload cycles. The cost of
+* erring closed is the press.
+*
+* D655: a configured source is NO LONGER evidence of the binding. D49 leaned
+* on "a source can only be configured through this wrapper's own
+* binding-gated settings surface"; that surface is retired, and the
+* `doorbell-source` extension slot that replaced it is offered on every
+* camera, bound or not (D648). The erring-open window above is therefore
+* reachable by configuring sources on a never-bound camera, not only by
+* unbinding a configured one — still bounded by two reload cycles, and the
+* slot's card says `inactive` once the reads agree.
 *
 * ─────────────────────────────────────────────────────────────────────
 * 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
@@ -210,7 +216,7 @@ function nextBindingState(previous, boundNow) {
 }
 /** May a ring proceed? Only a corroborated unbind stops one. */
 function allowsRing(state) {
-	return state !== "unbound";
+	return !needsDurableRead(state);
 }
 /** True only when a read has positively confirmed the binding. */
 function hasConfirmedBinding(state) {
@@ -262,6 +268,29 @@ function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
 	if (typeof wrapperAddonId !== "string") return "unbound";
 	return require_dist.isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
 }
+/** Does this mirror state need the durable authority before a verdict? Only `unbound` does. */
+function needsDurableRead(state) {
+	return state === "unbound";
+}
+/**
+* THE decision — the ring gate (`fireDoorbell` / `ringsDespiteUnboundMirror`)
+* and the Extensions card's activation both call it, so what the card says
+* and what a press does cannot disagree. `durable` is `null` when it was not
+* read, which {@link needsDurableRead} allows for every state but `unbound`.
+* Pure: it reads nothing and writes nothing.
+*/
+function ringVerdict(state, durable) {
+	if (state === "bound") return "rings";
+	if (state === "unbind-pending") return "rings-pending";
+	if (state === void 0) return "rings-unconfirmed";
+	if (durable === "bound") return "rings";
+	if (durable === "unbound") return "silent";
+	return "unknown";
+}
+/** Whether a press proceeds under this verdict. */
+function verdictRings(verdict) {
+	return verdict !== "silent";
+}
 //#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
@@ -354,6 +383,203 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 	return next;
 }
 //#endregion
+//#region src/builtins/doorbell/doorbell-extension-slot.ts
+/**
+* The virtual doorbell's side of `device-extension` (D648): the
+* `doorbell-source` slot, served over the wrapper's `doorbellSources` store
+* — since D655 the only editor of a camera's trigger devices.
+*
+*  - `list` reads the store through `parseDoorbellSources` — the parser the
+*    trigger engine's assignments are built from — so the slot's value is
+*    exactly what rings. It also REPORTS whether the wrapper is bound to the
+*    camera (`activation`), named as `setWrapperActive`'s: sources on an
+*    unbound camera ring nothing, and the card must say so rather than look
+*    configured. Nothing here writes it.
+*  - The activation costs NOTHING on the common path. A camera with no
+*    sources has no gate worth reporting and makes no read. A camera with
+*    sources is answered from the addon's D49 binding mirror — the in-memory
+*    verdict the ring path itself uses — through `ringVerdict`, the ring
+*    gate's own decision function. The card is READ-ONLY: it never refreshes
+*    or writes the mirror, and reads the durable authority only for an
+*    `unbound` mirror, exactly where the ring gate reads it.
+*    `getBindings` was measured at up to 5.24 s on the live hub (2026-08-30),
+*    and the dispatcher already paid one for this page.
+*  - The picked sources are labelled with ONE batched `listAll({deviceIds})`,
+*    never a `getDevice` per id.
+*  - `set` goes through the addon's `persistDoorbellSources`, the SAME
+*    normalise-and-store path the wrapper has, which also invalidates
+*    the assignment cache so the binding mirror is re-read off the ring path
+*    (D49). A `setSlot` call is NOT evidence that the wrapper is bound (the
+*    contract reaches this provider through `device-extension`'s own
+*    binding), so it never confirms the mirror. A NEW pick must be a device
+*    that carries a source cap (`SOURCE_CAPS`, the D636 ids-only read) — which
+*    also refuses a container, a device with no source cap and an id no
+*    device has — and never the camera itself.
+*  - `candidates` are those same source-capable devices, devices in the
+*    camera's location suggested.
+*/
+/** The routing prefix of this owner's `slotRef`s. */
+var VIRTUAL_DOORBELL_EXTENSION_SOURCE = "virtual-doorbell";
+/** The store the slot reads and writes, named (D62). */
+var DOORBELL_SOURCES_AUTHORITY = `virtual-doorbell:${KEY_SOURCES}`;
+/** The authority that decides whether the wrapper serves a camera at all. */
+var WRAPPER_ACTIVATION_AUTHORITY = "device-manager:setWrapperActive";
+var INACTIVE_DETAIL = "The virtual doorbell is not bound to this camera: these devices ring nothing until it is activated in the camera’s bindings.";
+var PENDING_DETAIL = "One bindings read did not see the wrapper; a press still rings until a second read agrees.";
+/** How the card SAYS a verdict. The verdict itself is `ringVerdict`'s, never the card's. */
+function activationFromVerdict(verdict) {
+	const authority = WRAPPER_ACTIVATION_AUTHORITY;
+	switch (verdict) {
+		case "rings": return {
+			state: "active",
+			authority
+		};
+		case "rings-pending": return {
+			state: "active",
+			authority,
+			detail: PENDING_DETAIL
+		};
+		case "rings-unconfirmed": return {
+			state: "active",
+			authority,
+			detail: "No bindings read has confirmed the wrapper yet; a press rings meanwhile."
+		};
+		case "unknown": return {
+			state: "unknown",
+			authority,
+			detail: "Could not verify: the last reads did not see the wrapper and the bindings store cannot answer. A press still rings."
+		};
+		case "silent": return {
+			state: "inactive",
+			authority,
+			detail: INACTIVE_DETAIL
+		};
+	}
+}
+/**
+* Concurrent card views of the same `unbound` camera share ONE durable read,
+* per camera, for as long as it is in flight — a page with several viewers
+* (or a refetch storm) must not multiply the store round trip. Only the
+* CARD's reads are shared: the ring gate calls the addon's
+* `readDurableAuthority` on its own path and never waits behind a card.
+*/
+function shareDurableReads(read) {
+	const inFlight = /* @__PURE__ */ new Map();
+	return (deviceId) => {
+		const pending = inFlight.get(deviceId);
+		if (pending !== void 0) return pending;
+		const started = read(deviceId).finally(() => {
+			inFlight.delete(deviceId);
+		});
+		inFlight.set(deviceId, started);
+		return started;
+	};
+}
+async function activationOf(deps, readDurable, deviceId) {
+	const mirrored = deps.readBindingMirror(deviceId);
+	return activationFromVerdict(ringVerdict(mirrored, needsDurableRead(mirrored) ? await readDurable(deviceId) : null));
+}
+function sourceOf(deviceId, byId) {
+	const device = byId.get(deviceId);
+	if (device === void 0) return {
+		deviceId,
+		name: null,
+		health: "missing",
+		detail: "No device has this id any more — it rings nothing until removed."
+	};
+	return {
+		deviceId,
+		name: device.name,
+		health: "ok"
+	};
+}
+async function candidatesFor(deps, deviceId) {
+	const [ids, fleet] = await Promise.all([deps.sourceCapableDeviceIds(), deps.listFleet()]);
+	const eligible = new Set(ids);
+	const byId = new Map(fleet.map((d) => [d.id, d]));
+	const location = byId.get(deviceId)?.location ?? null;
+	const out = [];
+	for (const device of fleet) {
+		if (device.id === deviceId || !eligible.has(device.id)) continue;
+		const suggested = location !== null && device.location === location;
+		const parent = device.parentDeviceId === null ? void 0 : byId.get(device.parentDeviceId);
+		out.push({
+			deviceId: device.id,
+			name: device.name,
+			type: device.type,
+			location: device.location,
+			parentName: parent?.name ?? null,
+			suggested,
+			reason: suggested ? "same location" : null
+		});
+	}
+	return out.toSorted((a, b) => Number(b.suggested) - Number(a.suggested) || a.name.localeCompare(b.name));
+}
+/** Why each NEW pick is refused, or [] when every one is a legitimate source. */
+async function refusedPicks(deps, deviceId, picked) {
+	const persisted = new Set((await deps.readSources(deviceId)).map((s) => s.deviceId));
+	const added = picked.filter((id) => !persisted.has(id));
+	if (added.length === 0) return [];
+	const eligible = new Set(await deps.sourceCapableDeviceIds());
+	const refused = [];
+	for (const id of added) if (id === deviceId) refused.push(`${id} is the camera itself`);
+	else if (!eligible.has(id)) refused.push(`${id} carries no doorbell source capability (a binary sensor or switch)`);
+	return refused;
+}
+/** Build the `device-extension` provider the virtual doorbell registers. */
+function createDoorbellExtensionProvider(deps) {
+	const readDurable = shareDurableReads(deps.readDurableBinding);
+	return require_dist.createDeviceExtensionProvider({
+		source: VIRTUAL_DOORBELL_EXTENSION_SOURCE,
+		label: "Virtual doorbell",
+		slots: [require_dist.defineExtensionSlotProvider("doorbell-source", {
+			list: async (deviceId) => {
+				const ids = (await deps.readSources(deviceId)).map((s) => s.deviceId);
+				if (ids.length === 0) return {
+					authority: DOORBELL_SOURCES_AUTHORITY,
+					enabled: null,
+					activation: null,
+					value: {
+						slot: "doorbell-source",
+						deviceIds: []
+					},
+					sources: []
+				};
+				const [devices, activation] = await Promise.all([deps.listDevices(ids), activationOf(deps, readDurable, deviceId)]);
+				const byId = new Map(devices.map((d) => [d.id, d]));
+				return {
+					authority: DOORBELL_SOURCES_AUTHORITY,
+					enabled: null,
+					activation,
+					value: {
+						slot: "doorbell-source",
+						deviceIds: ids
+					},
+					sources: ids.map((id) => sourceOf(id, byId))
+				};
+			},
+			set: async (deviceId, value) => {
+				const refused = await refusedPicks(deps, deviceId, value.deviceIds);
+				if (refused.length > 0) {
+					deps.logger.warn("virtual-doorbell: extension write refused — nothing persisted", {
+						tags: { deviceId },
+						meta: { refused }
+					});
+					throw new Error(`doorbell-source on ${deviceId}: refused — ${refused.join("; ")}`);
+				}
+				await deps.persistSources(deviceId, value.deviceIds);
+				return {
+					applied: true,
+					reload: "none"
+				};
+			},
+			candidates: (deviceId) => candidatesFor(deps, deviceId)
+		})],
+		hostTypeOf: async (deviceId) => (await deps.getDevice(deviceId))?.type ?? null,
+		logger: deps.logger
+	});
+}
+//#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
 /**
 * The addon whose store IS the durable authority on wrapper activations.
@@ -402,9 +628,9 @@ function parseDoorbellSlice(slice) {
 *
 *   1. The operator binds the wrapper to a camera in the bindings UI
 *      (`defaultActive: false` — never auto-bound).
-*   2. In the camera's GENERAL settings (next to "Linked devices") the
-*      operator picks one or more SOURCE devices from a searchable list —
-*      that is the ONLY choice. The reaction is derived automatically per
+*   2. In the camera's Extensions section (the `doorbell-source` slot,
+*      D648/D655) the operator picks one or more SOURCE devices — that is
+*      the ONLY choice. The reaction is derived automatically per
 *      device type: a binary sensor rings when it goes active, a switch
 *      rings when it turns on (see `trigger-engine.ts`). The persisted
 *      shape (`doorbellSources: [{deviceId}]`) stays extensible for a
@@ -451,14 +677,43 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		});
 		return [{
 			capability: require_dist.doorbellCapability,
-			provider: {
-				getStatus: (input) => this.getStatus(input.deviceId),
-				getDeviceSettingsContribution: (input) => this.buildDeviceSettingsContribution(input.deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: (input) => this.saveDeviceSettingsPatch(input.deviceId, input.patch)
-			}
+			provider: { getStatus: (input) => this.getStatus(input.deviceId) }
+		}, {
+			capability: require_dist.deviceExtensionCapability,
+			provider: this.buildExtensionProvider()
 		}];
 	}
+	/**
+	* The `device-extension` provider: the only editor of a camera's trigger
+	* devices since D655 (see `doorbell-extension-slot.ts`).
+	*/
+	buildExtensionProvider() {
+		const toSlotDevice = (d) => ({
+			id: d.id,
+			name: d.name,
+			type: d.type,
+			location: d.location,
+			parentDeviceId: d.parentDeviceId
+		});
+		return createDoorbellExtensionProvider({
+			ownAddonId: this.ownAddonId,
+			logger: this.ctx.logger,
+			readSources: (deviceId) => this.readDeviceSources(deviceId),
+			persistSources: (deviceId, deviceIds) => this.persistDoorbellSources(deviceId, deviceIds),
+			getDevice: async (deviceId) => {
+				const found = await this.ctx.api.deviceManager.getDevice.query({ deviceId });
+				return found ? toSlotDevice(found) : null;
+			},
+			listDevices: async (deviceIds) => (await this.ctx.api.deviceManager.listAll.query({
+				projection: "slim",
+				deviceIds: [...deviceIds]
+			})).map(toSlotDevice),
+			readBindingMirror: (deviceId) => this.bindingMirror.get(deviceId),
+			readDurableBinding: (deviceId) => this.readDurableAuthority(deviceId),
+			sourceCapableDeviceIds: () => this.ctx.api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...require_dist.SOURCE_CAPS] }),
+			listFleet: async () => (await this.ctx.api.deviceManager.listAll.query({ projection: "slim" })).map(toSlotDevice)
+		});
+	}
 	async handleStateChanged(data) {
 		if (!require_dist.isSourceCap(data.capName)) return;
 		await this.ensureAssignments();
@@ -676,53 +931,49 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	*/
 	async ringsDespiteUnboundMirror(cameraId, binding) {
 		const authority = await this.readDurableAuthority(cameraId);
-		if (authority === "bound") {
-			this.bindingMirror.set(cameraId, "bound");
-			this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
-				tags: { deviceId: cameraId },
-				meta: {
-					bindingState: binding,
-					ownAddonId: this.ownAddonId
-				}
-			});
-			return true;
-		}
-		if (authority === "unreadable") {
-			this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
-				tags: { deviceId: cameraId },
-				meta: {
-					bindingState: binding,
-					ownAddonId: this.ownAddonId
-				}
-			});
-			return true;
-		}
-		const derived = await this.readDerivedBinding(cameraId);
-		this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
-			tags: { deviceId: cameraId },
-			meta: {
-				bindingState: binding,
-				ownAddonId: this.ownAddonId,
-				durableAuthority: authority,
-				entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
+		const verdict = ringVerdict(binding, authority);
+		switch (verdict) {
+			case "rings":
+				this.bindingMirror.set(cameraId, "bound");
+				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+					tags: { deviceId: cameraId },
+					meta: {
+						bindingState: binding,
+						ownAddonId: this.ownAddonId
+					}
+				});
+				return verdictRings(verdict);
+			case "unknown":
+				this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
+					tags: { deviceId: cameraId },
+					meta: {
+						bindingState: binding,
+						ownAddonId: this.ownAddonId
+					}
+				});
+				return verdictRings(verdict);
+			case "silent": {
+				const derived = await this.readDerivedBinding(cameraId);
+				this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+					tags: { deviceId: cameraId },
+					meta: {
+						bindingState: binding,
+						ownAddonId: this.ownAddonId,
+						durableAuthority: authority,
+						entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
+					}
+				});
+				return verdictRings(verdict);
 			}
-		});
-		return false;
-	}
-	/**
-	* Record a binding we observed FIRST-HAND. Both callers are cap methods
-	* the router only reaches by resolving this wrapper for this device —
-	* which it can only do through the binding — so a call is direct evidence
-	* and outranks anything the store says.
-	*/
-	confirmBindingFromCapCall(deviceId) {
-		this.bindingMirror.set(deviceId, nextBindingState(this.bindingMirror.get(deviceId), true));
+			case "rings-pending":
+			case "rings-unconfirmed": return verdictRings(verdict);
+		}
 	}
 	/**
 	* Lazily (re)build the camera→source assignment set from every
 	* camera's device store. TTL-bounded so devices/settings appearing
-	* after boot are picked up without a settings save; invalidated
-	* eagerly by `applyDeviceSettingsPatch`.
+	* after boot are picked up without a save; invalidated eagerly by
+	* `persistDoorbellSources`.
 	*/
 	async ensureAssignments() {
 		const now = Date.now();
@@ -793,72 +1044,17 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		return parseDoorbellSources(await this.ctx.settings.readDeviceStore(deviceId));
 	}
 	/**
-	* Single-trip, non-throwing device lookup (mirrors snapshot's
-	* `lookupDeviceMeta`). Null on any failure — callers fall back to
-	* rendering the section (better a spurious section than a thrown
-	* aggregator entry).
+	* THE write path for a camera's trigger sources — the `doorbell-source`
+	* extension slot lands here (D648; its only caller since D655): normalise
+	* to `doorbellSources: [{deviceId}]`, strip the legacy keys, and invalidate
+	* the assignment cache so the next rise (and the binding mirror's next
+	* refresh, off the ring path) sees the new wiring.
 	*/
-	async lookupDevice(deviceId) {
-		try {
-			const found = await this.ctx.api.deviceManager.getDevice.query({ deviceId });
-			return found ? { type: found.type } : null;
-		} catch (err) {
-			this.ctx.logger.debug("virtual-doorbell: getDevice failed during contribution", {
-				tags: { deviceId },
-				meta: { error: require_dist.errMsg(err) }
-			});
-			return null;
-		}
-	}
-	/**
-	* Settings section for the device-detail page — contributed into the
-	* GENERAL settings surface (no `tab`, so it lands in the same tab as
-	* "Linked devices", ordered just after it). Camera-only: the doorbell
-	* cap also applies to Button accessories (native providers) where a
-	* virtual-source picker is meaningless.
-	*
-	* A SINGLE `device-multiselect` field carries only a declarative
-	* `deviceFilter` — the admin-ui renders the SHARED searchable device
-	* picker (same idiom as "Linked devices") whose options come from
-	* `deviceManager.listAll` filtered CLIENT-SIDE. The addon NO LONGER
-	* computes the option list server-side: the old path enumerated
-	* `deviceManager.getAllBindings`, which returns an empty set on the live
-	* cluster and left the picker blank. The reaction is still derived
-	* automatically per device type — no trigger/eventType controls.
-	*/
-	async buildDeviceSettingsContribution(deviceId) {
-		const device = await this.lookupDevice(deviceId);
-		if (device && device.type !== require_dist.DeviceType.Camera) return null;
-		this.confirmBindingFromCapCall(deviceId);
-		const sources = await this.readDeviceSources(deviceId);
-		return { sections: [{
-			id: "virtual-doorbell",
-			title: "Virtual doorbell",
-			description: "Ring this camera’s doorbell when a chosen device becomes active — a contact opening, a switch turning on, or a sensor firing. Pick any binary sensor or switch below; the reaction is automatic per device type.",
-			order: 71,
-			fields: [{
-				type: "device-multiselect",
-				key: KEY_SOURCES,
-				label: "Trigger devices",
-				description: "Any of these becoming active rings this camera. Binary sensors ring when they go active; switches ring when they turn on.",
-				deviceFilter: {
-					caps: require_dist.SOURCE_CAPS,
-					types: require_dist.SOURCE_DEVICE_TYPES,
-					excludeDeviceId: deviceId
-				},
-				value: sources.map((s) => String(s.deviceId))
-			}]
-		}] };
-	}
-	async saveDeviceSettingsPatch(deviceId, patch) {
+	async persistDoorbellSources(deviceId, value) {
 		if (!this.ctx.settings) throw new Error("[virtual-doorbell] settings store unavailable — cannot persist per-device settings");
-		this.confirmBindingFromCapCall(deviceId);
-		if ("doorbellSources" in patch) {
-			const next = applyDoorbellSourcesPatch(await this.ctx.settings.readDeviceStore(deviceId), patch[KEY_SOURCES]);
-			await this.ctx.settings.writeDeviceStore(deviceId, next);
-			this.invalidateAssignments();
-		}
-		return { success: true };
+		const current = await this.ctx.settings.readDeviceStore(deviceId);
+		await this.ctx.settings.writeDeviceStore(deviceId, applyDoorbellSourcesPatch(current, value));
+		this.invalidateAssignments();
 	}
 };
 //#endregion