@camstack/system 1.2.316 → 1.2.317

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { At as isSameAddonId, Dn as SOURCE_CAP_ACTIVE_FIELD, En as SOURCE_CAPS, Gn as BaseAddon, On as SOURCE_CAP_CHANGED_AT_FIELD, Rn as evaluateSensorEdge, Un as DeviceType, W as bareAddonId, Wn as errMsg, ct as defineExtensionSlotProvider, hr as EventCategory, it as createDeviceExtensionProvider, mt as doorbellCapability, tr as createEvent, ut as deviceExtensionCapability, zn as isSourceCap } from "../../dist-BPvku43i.mjs";
+import { At as isSameAddonId, Dn as SOURCE_CAP_ACTIVE_FIELD, En as SOURCE_CAPS, Gn as BaseAddon, On as SOURCE_CAP_CHANGED_AT_FIELD, Rn as evaluateSensorEdge, Un as DeviceType, W as bareAddonId, Wn as errMsg, ct as defineExtensionSlotProvider, hr as EventCategory, it as createDeviceExtensionProvider, mt as doorbellCapability, tr as createEvent, ut as deviceExtensionCapability, zn as isSourceCap } from "../../dist-Dori4pf3.mjs";
 import { n as parseDeviceStateChanged } from "../../device-state-changed-DoBbkyEI.mjs";
 import { z } from "zod";
 //#region src/builtins/doorbell/trigger-engine.ts
@@ -196,11 +196,18 @@ var DoorbellTriggerEngine = class {
 *   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
 *      input. Before a negative is believed — and again on the ring path
 *      before a press is destroyed — the DURABLE authority is consulted
-*      directly ({@link readDurableWrapperBinding} over the `device-manager`
-*      addon store's `deviceBindings` map). That read carries a discriminator
-*      the derived view genuinely cannot offer: a store answering from an
-*      empty snapshot (D44) has no `deviceBindings` key at all, while a
-*      genuine unbind leaves the key present and merely omits the row.
+*      directly ({@link durableVerdictOf} over
+*      `deviceManager.getWrapperActivation`). That read carries a discriminator
+*      the derived view genuinely cannot offer: it is three-way, so a store
+*      that could not answer (`failed`) is never mistaken for a store that
+*      answered "nothing here" (`missing`).
+*
+* 2026-09-29 (D675). Until then the durable read was
+* `addonSettingsRaw.getGlobal({ addonId: 'device-manager' })`, whose backend
+* (`ConfigManager.getAddonConfig`) has had no store on the hub since D231
+* isolated the engine: it answered `{}` on every call, so every durable read
+* was `unreadable`, an operator's explicit "off" (camera 615,
+* `wrapperAddonId: null`) was never honoured, and a press rang anyway.
 */
 /**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
@@ -211,9 +218,12 @@ function nextBindingState(previous, boundNow) {
 	if (boundNow) return "bound";
 	return previous === "unbind-pending" || previous === "unbound" ? "unbound" : "unbind-pending";
 }
-/** May a ring proceed? Only a corroborated unbind stops one. */
+/**
+* May a ring proceed on the mirror STATE alone? Only a corroborated unbind
+* stops one. {@link needsDurableRead} adds the served-elsewhere case on top.
+*/
 function allowsRing(state) {
-	return !needsDurableRead(state);
+	return state !== "unbound";
 }
 /** True only when a read has positively confirmed the binding. */
 function hasConfirmedBinding(state) {
@@ -238,46 +248,62 @@ function entriesBindWrapper(entries, capName, ownAddonId) {
 function summariseEntries(entries) {
 	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
 }
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 /**
-* Read the DURABLE authority — the `device-manager` addon store's
-* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
-* `capName` on `deviceId`".
+* The durable verdict for `ownAddonId`, from device-manager's STORED
+* activation of this cap on this device (`deviceManager.getWrapperActivation`).
 *
-* This is the input the derived `getBindings` view is not: it is the row the
-* operator's toggle actually writes, with no registry resolution, no
-* `defaultActive` auto-binding and no cross-node cap folding in between. It
-* also grades its own trustworthiness, which `getBindings` cannot: the
-* absence of the `deviceBindings` KEY is the signature of a store answering
-* from an empty snapshot, whereas a genuine unbind leaves the key present.
+* - `value` naming this wrapper → `bound`.
+* - `value` naming another wrapper, or `null` — the operator's explicit "off"
+*   marker (D62) — → `unbound`.
+* - `missing` → `unbound`: the store ANSWERED and holds no activation, and the
+*   doorbell cap is `defaultActive: false`, so a wrapper nobody activated is
+*   not bound.
+* - `failed` → `unreadable`: it carries no information and destroys nothing.
+*/
+function durableVerdictOf(read, ownAddonId) {
+	switch (read.kind) {
+		case "failed": return "unreadable";
+		case "missing": return "unbound";
+		case "value": return read.wrapperAddonId !== null && isSameAddonId(read.wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+	}
+}
+/**
+* Who, other than this wrapper, the derived view says serves `capName` —
+* `composer` on a camera whose doorbell was migrated to a composition (D671).
+* Non-empty means a press this wrapper does not ring is still somebody's ring.
 */
-function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
-	if (!isRecord$2(record)) return "unreadable";
-	const deviceBindings = record["deviceBindings"];
-	if (!isRecord$2(deviceBindings)) return "unreadable";
-	const perDevice = deviceBindings[String(deviceId)];
-	if (!isRecord$2(perDevice)) return "unbound";
-	const activation = perDevice[capName];
-	if (!isRecord$2(activation)) return "unbound";
-	const wrapperAddonId = activation["wrapperAddonId"];
-	if (typeof wrapperAddonId !== "string") return "unbound";
-	return isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+function otherProvidersOf(entries, capName, ownAddonId) {
+	return entries.filter((entry) => entry.capName === capName && !isSameAddonId(entry.providerAddonId, ownAddonId)).map((entry) => entry.providerAddonId);
 }
-/** Does this mirror state need the durable authority before a verdict? Only `unbound` does. */
-function needsDurableRead(state) {
-	return state === "unbound";
+/**
+* Does this camera need the durable authority before a verdict?
+*
+* An `unbound` mirror does (D72). So does any mirror short of `bound` on a
+* camera whose doorbell another provider serves — the D671 cutover, where
+* erring open means ringing ON TOP of the composer: after every restart the
+* mirror starts `undefined` and spends a reload cycle at `unbind-pending`, and
+* each press in that window was a duplicate ring. Two independent reads
+* agreeing — the derived view naming another provider, the store naming no
+* wrapper — is the D49 "second read agrees"; an unreadable store still rings.
+*/
+function needsDurableRead(mirror) {
+	if (!allowsRing(mirror.state)) return true;
+	return mirror.servedBy.length > 0 && mirror.state !== "bound";
 }
 /**
-* THE decision — the ring gate (`fireDoorbell` / `ringsDespiteUnboundMirror`)
+* THE decision — the ring gate (`fireDoorbell` / `ringsAfterDurableRead`)
 * and the Extensions card's activation both call it, so what the card says
 * and what a press does cannot disagree. `durable` is `null` when it was not
-* read, which {@link needsDurableRead} allows for every state but `unbound`.
+* read, which {@link needsDurableRead} allows only where it says so.
 * Pure: it reads nothing and writes nothing.
 */
-function ringVerdict(state, durable) {
+function ringVerdict(mirror, durable) {
+	const state = mirror.state;
 	if (state === "bound") return "rings";
+	if (mirror.servedBy.length > 0) {
+		if (durable === "unbound") return "silent";
+		if (durable === "bound") return "rings";
+	}
 	if (state === "unbind-pending") return "rings-pending";
 	if (state === void 0) return "rings-unconfirmed";
 	if (durable === "bound") return "rings";
@@ -848,13 +874,6 @@ function errorText(err) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
-/**
-* The addon whose store IS the durable authority on wrapper activations.
-* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
-* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
-* derived from it plus the capability registry.
-*/
-var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Narrow a raw `doorbell` runtime-state slice to counters (defaults on absence). */
 function parseDoorbellSlice(slice) {
 	const lastPressedAtRaw = slice?.["lastPressedAt"];
@@ -907,6 +926,24 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* `binding-mirror.ts` for why a single negative read is not believed.
 	*/
 	bindingMirror = /* @__PURE__ */ new Map();
+	/**
+	* Per camera, the last NEGATIVE refresh this addon reported — its state,
+	* the authority's verdict and who else serves the doorbell. A refresh runs
+	* every reload cycle (about once a minute); the same answer repeated is not
+	* news, so it is reported once per change and forgotten on a positive read.
+	* Camera 615 logged the same WARN 607 times in 14 h after D671.
+	*/
+	reportedNegative = /* @__PURE__ */ new Map();
+	/** Cameras whose last durable-authority read THREW — reported once per outage. */
+	durableReadFailing = /* @__PURE__ */ new Set();
+	/**
+	* Per camera, the OTHER providers of `doorbell` the last successful derived
+	* read named (the composer after D671). Written off the ring path with the
+	* mirror; read on it, to decide whether erring open would double a ring.
+	*/
+	servedElsewhere = /* @__PURE__ */ new Map();
+	/** Cameras whose store-over-derived disagreement has been reported, until a derived read agrees. */
+	reportedStoreOverride = /* @__PURE__ */ new Set();
 	constructor() {
 		super({
 			debounceMs: 2e3,
@@ -987,7 +1024,7 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 				projection: "slim",
 				deviceIds: [...deviceIds]
 			})).map(toSlotDevice),
-			readBindingMirror: (deviceId) => this.bindingMirror.get(deviceId),
+			readBindingMirror: (deviceId) => this.mirrorRead(deviceId),
 			readDurableBinding: (deviceId) => this.readDurableAuthority(deviceId),
 			sourceCapableDeviceIds: () => this.ctx.api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...SOURCE_CAPS] }),
 			listFleet: async () => (await this.ctx.api.deviceManager.listAll.query({ projection: "slim" })).map(toSlotDevice)
@@ -1036,9 +1073,9 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
 	* The binding gate here is a pure in-memory read on the path that RINGS:
-	* an open mirror performs NO I/O and cannot fail. The mirror can only
-	* DESTROY a press through the one branch below, and that branch is not
-	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
+	* a `bound` mirror, or an open one on a camera nobody else serves, performs
+	* NO I/O and cannot fail. Every other case asks the durable authority once
+	* before deciding — see `needsDurableRead` and `ringsAfterDurableRead`.
 	*
 	* `sourceDeviceId`/`capName` are the source that produced this rise —
 	* carried through purely so the terminal `pressed` line can name it. Every
@@ -1048,8 +1085,9 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* timestamp against provider logs (proven live 2026-08-25, camera 615).
 	*/
 	async fireDoorbell(cameraId, timestamp, sourceDeviceId, capName) {
-		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
+		const mirror = this.mirrorRead(cameraId);
+		const binding = mirror.state;
+		if (needsDurableRead(mirror) && !await this.ringsAfterDurableRead(cameraId, mirror)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -1126,8 +1164,10 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* One read of the DURABLE authority: the `device-manager` addon store's
-	* `deviceBindings` map, straight from the settings DB.
+	* One read of the DURABLE authority: the wrapper activation device-manager
+	* STORED for this camera (`deviceManager.getWrapperActivation`, D675) — the
+	* row the operator's bindings toggle writes. `deviceManager.getBindings` is
+	* a VIEW derived from it plus the capability registry.
 	*
 	* This is deliberately NOT `getBindings`. The derived view folds the store
 	* together with the capability registry, `defaultActive` auto-binding and
@@ -1136,17 +1176,35 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* spelling mismatch) made it disagree *systematically* while looking
 	* exactly like a genuine unbind. The raw row cannot: it is what the
 	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*
+	* A read that throws is reported when the outage STARTS and when it ends —
+	* never per read: this runs on every reload cycle.
 	*/
 	async readDurableAuthority(cameraId) {
+		let read;
 		try {
-			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, doorbellCapability.name, this.ownAddonId);
-		} catch (err) {
-			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
-				tags: { deviceId: cameraId },
-				meta: { error: errMsg(err) }
+			read = await this.ctx.api.deviceManager.getWrapperActivation.query({
+				deviceId: cameraId,
+				capName: doorbellCapability.name
 			});
+		} catch (err) {
+			read = {
+				kind: "failed",
+				error: errMsg(err)
+			};
+		}
+		if (read.kind === "failed") {
+			if (!this.durableReadFailing.has(cameraId)) {
+				this.durableReadFailing.add(cameraId);
+				this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing (reported once until it answers again)", {
+					tags: { deviceId: cameraId },
+					meta: { error: read.error }
+				});
+			}
 			return "unreadable";
 		}
+		if (this.durableReadFailing.delete(cameraId)) this.ctx.logger.info("virtual-doorbell: the durable bindings store answers again", { tags: { deviceId: cameraId } });
+		return durableVerdictOf(read, this.ownAddonId);
 	}
 	/**
 	* Reconcile `cameraId`'s mirror against the authority. Runs on the
@@ -1164,60 +1222,114 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	async refreshBindingMirror(cameraId) {
 		const derived = await this.readDerivedBinding(cameraId);
 		if (derived === null) return;
+		const servedBy = otherProvidersOf(derived.entries, doorbellCapability.name, this.ownAddonId);
+		this.servedElsewhere.set(cameraId, servedBy);
 		if (derived.bound) {
 			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			this.reportedNegative.delete(cameraId);
+			this.reportedStoreOverride.delete(cameraId);
 			return;
 		}
 		const authority = await this.readDurableAuthority(cameraId);
 		const entries = summariseEntries(derived.entries);
 		if (authority === "bound") {
-			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
-				tags: { deviceId: cameraId },
-				meta: {
-					ownAddonId: this.ownAddonId,
-					entries
-				}
-			});
+			this.reportedNegative.delete(cameraId);
+			if (!this.reportedStoreOverride.has(cameraId)) {
+				this.reportedStoreOverride.add(cameraId);
+				this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store (reported once until they agree)", {
+					tags: { deviceId: cameraId },
+					meta: {
+						ownAddonId: this.ownAddonId,
+						entries
+					}
+				});
+			}
 			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
+		this.reportedStoreOverride.delete(cameraId);
 		const previous = this.bindingMirror.get(cameraId);
 		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.reportNegativeRefresh(cameraId, {
+			from: previous ?? "never-read",
+			to: next,
+			authority,
+			servedBy,
+			entries
+		});
+	}
+	/** The ring gate's in-memory input for one camera — no I/O. */
+	mirrorRead(cameraId) {
+		return {
+			state: this.bindingMirror.get(cameraId),
+			servedBy: this.servedElsewhere.get(cameraId) ?? []
+		};
+	}
+	/**
+	* Report a negative refresh ONCE per change of what it says (D391: a
+	* repeated identical line is noise that buries the next real one).
+	*
+	* The level follows what the answer MEANS:
+	*   - the durable store could not grade it (`unreadable`) — WARN: the
+	*     camera's ring now depends on erring open, and nobody can say whether
+	*     that is right;
+	*   - the store CONFIRMS the wrapper is not bound — an operator's unbind or
+	*     the D671 cutover to a composition. That is a state, not an anomaly:
+	*     INFO when it is believed (`unbound`), DEBUG for the first,
+	*     not-yet-believed read.
+	*/
+	reportNegativeRefresh(cameraId, report) {
+		const key = `${report.to}|${report.authority}|${report.servedBy.join(",")}`;
+		if (this.reportedNegative.get(cameraId) === key) return;
+		this.reportedNegative.set(cameraId, key);
+		const options = {
 			tags: { deviceId: cameraId },
 			meta: {
-				from: previous ?? "never-read",
-				to: next,
+				from: report.from,
+				to: report.to,
 				ownAddonId: this.ownAddonId,
-				durableAuthority: authority,
-				entries
+				durableAuthority: report.authority,
+				doorbellServedBy: report.servedBy,
+				entries: report.entries
 			}
-		});
+		};
+		if (report.authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper and the durable store cannot confirm it — a press still rings", options);
+			return;
+		}
+		const message = report.servedBy.length > 0 ? `virtual-doorbell: wrapper deactivated on this camera — its doorbell is served by ${report.servedBy.join(", ")}` : "virtual-doorbell: wrapper deactivated on this camera — the bindings store confirms it";
+		if (report.to === "unbound") this.ctx.logger.info(message, options);
+		else this.ctx.logger.debug(message, options);
 	}
 	/**
-	* The mirror says `unbound` and a real press just arrived. Decide, with
-	* ONE read of the durable authority, whether to destroy it.
+	* A real press arrived on a camera the in-memory gate cannot clear on its
+	* own: the mirror is `unbound`, or it is short of `bound` while another
+	* provider serves the doorbell. Decide, with ONE read of the durable
+	* authority, whether this wrapper rings.
 	*
 	* D49 forbade I/O on the ring path because the read it would have made was
 	* the same fallible derived read that caused the problem. This read is
 	* different in both directions: it is the authority rather than a view of
-	* it, and it is paid ONLY on the branch that would otherwise drop a press —
-	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
-	* reconcile and nothing downstream that notices.
+	* it, and it is paid ONLY where erring open could be wrong — a dropped ring
+	* (an `unbound` mirror) or a DOUBLED one (another provider rings this
+	* camera). A ring is rare and one query is cheap. An unreadable store still
+	* rings: it carries no information.
 	*
 	* Returns `true` when the ring must proceed.
 	*/
-	async ringsDespiteUnboundMirror(cameraId, binding) {
+	async ringsAfterDurableRead(cameraId, mirror) {
+		const binding = mirror.state;
 		const authority = await this.readDurableAuthority(cameraId);
-		const verdict = ringVerdict(binding, authority);
+		const verdict = ringVerdict(mirror, authority);
 		switch (verdict) {
 			case "rings":
 				this.bindingMirror.set(cameraId, "bound");
-				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror did not confirm this wrapper but the durable bindings store still names it; the mirror has been repaired", {
 					tags: { deviceId: cameraId },
 					meta: {
-						bindingState: binding,
+						bindingState: binding ?? "never-read",
+						doorbellServedBy: mirror.servedBy,
 						ownAddonId: this.ownAddonId
 					}
 				});
@@ -1233,19 +1345,32 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 				return verdictRings(verdict);
 			case "silent": {
 				const derived = await this.readDerivedBinding(cameraId);
-				this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+				const servedBy = derived === null ? mirror.servedBy : otherProvidersOf(derived.entries, doorbellCapability.name, this.ownAddonId);
+				const options = {
 					tags: { deviceId: cameraId },
 					meta: {
 						bindingState: binding,
 						ownAddonId: this.ownAddonId,
 						durableAuthority: authority,
+						doorbellServedBy: servedBy,
 						entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 					}
-				});
+				};
+				if (servedBy.length > 0) this.ctx.logger.info(`virtual-doorbell: press left to ${servedBy.join(", ")} — this wrapper is deactivated on this camera`, options);
+				else this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", options);
 				return verdictRings(verdict);
 			}
 			case "rings-pending":
-			case "rings-unconfirmed": return verdictRings(verdict);
+			case "rings-unconfirmed":
+				this.ctx.logger.warn(`virtual-doorbell: ringing although ${mirror.servedBy.join(", ")} serves this doorbell — the durable bindings store could not confirm this wrapper was deactivated`, {
+					tags: { deviceId: cameraId },
+					meta: {
+						bindingState: binding ?? "never-read",
+						durableAuthority: authority,
+						ownAddonId: this.ownAddonId
+					}
+				});
+				return verdictRings(verdict);
 		}
 	}
 	/**

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-RAl10EfG.js");
+const require_dist = require("../../dist-a6p0V-IL.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { Gn as BaseAddon, Rt as logDestinationCapability } from "../../dist-BPvku43i.mjs";
+import { Gn as BaseAddon, Rt as logDestinationCapability } from "../../dist-Dori4pf3.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-RAl10EfG.js");
+const require_dist = require("../../dist-a6p0V-IL.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { E as RECORDING_SOURCE_CAMSTACK_ADDON, Gn as BaseAddon, Wn as errMsg, hr as EventCategory, k as RecordingStatusSchema, tr as createEvent } from "../../dist-BPvku43i.mjs";
+import { E as RECORDING_SOURCE_CAMSTACK_ADDON, Gn as BaseAddon, Wn as errMsg, hr as EventCategory, k as RecordingStatusSchema, tr as createEvent } from "../../dist-Dori4pf3.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-RAl10EfG.js");
+const require_dist = require("../../dist-a6p0V-IL.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -6017,8 +6017,24 @@ var require_jsonwebtoken = /* @__PURE__ */ require_chunk.__commonJSMin(((exports
 	};
 }));
 //#endregion
-//#region src/auth/token-expiry.ts
+//#region src/kernel/settings-read-error.ts
 var import_jsonwebtoken = /* @__PURE__ */ require_chunk.__toESM(require_jsonwebtoken());
+var SettingsReadUnavailableError = class extends Error {
+	reader;
+	reason;
+	name = "SettingsReadUnavailableError";
+	constructor(reader, reason, detail) {
+		super(`[${reader}] settings read refused (${reason}): ${detail}`);
+		this.reader = reader;
+		this.reason = reason;
+	}
+};
+/** Narrow an unknown throw to {@link SettingsReadUnavailableError}. */
+function isSettingsReadUnavailable(err) {
+	return err instanceof SettingsReadUnavailableError;
+}
+//#endregion
+//#region src/auth/token-expiry.ts
 /**
 * Validation for the operator-configured session-JWT lifetime
 * (`auth.tokenExpiry`, System → Settings → Authentication → Token Expiry).
@@ -6209,7 +6225,7 @@ var AuthManager = class {
 		}
 	}
 	signToken(payload) {
-		const configured = this.config.get("auth.tokenExpiry");
+		const configured = this.readConfiguredExpiry();
 		const parsed = parseTokenExpiry(configured);
 		if (!parsed.ok) {
 			const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
@@ -6220,6 +6236,32 @@ var AuthManager = class {
 		}
 		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
 	}
+	/**
+	* The operator's `auth.tokenExpiry`, or `undefined` → DEFAULT_TOKEN_EXPIRY.
+	*
+	* On the hub this reader is `ConfigService`, which answers the key from its
+	* boot-time mirror of the settings store and REFUSES while that mirror is
+	* unknown (pending or failed, D675). A login must not fail over it, so the
+	* refusal signs with the default — and says so once per reason, because a
+	* mint that silently ignored a saved lifetime is the defect this setting
+	* already had once.
+	*/
+	readConfiguredExpiry() {
+		try {
+			return this.config.get("auth.tokenExpiry");
+		} catch (err) {
+			if (!isSettingsReadUnavailable(err)) throw err;
+			const key = `unreadable:${err.reason}`;
+			if (!this.reportedInvalidExpiries.has(key)) {
+				this.reportedInvalidExpiries.add(key);
+				this.logger.warn("auth.tokenExpiry could not be read from the settings store — signing with the default lifetime", { meta: {
+					reason: err.reason,
+					error: err.message
+				} });
+			}
+			return;
+		}
+	}
 	verifyToken(token) {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
 	}
@@ -9947,7 +9989,9 @@ exports.AuthManager = AuthManager;
 exports.LocalAuthAddon = LocalAuthAddon;
 exports.default = LocalAuthAddon;
 exports.ScopedTokenManager = ScopedTokenManager;
+exports.SettingsReadUnavailableError = SettingsReadUnavailableError;
 exports.UserManager = UserManager;
+exports.isSettingsReadUnavailable = isSettingsReadUnavailable;
 Object.defineProperty(exports, "require_ms", {
 	enumerable: true,
 	get: function() {

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { Gn as BaseAddon, H as authProviderCapability, L as UserRecordSchema, M as ScopedTokenSchema, r as ApiKeyRecordSchema, vn as userManagementCapability } from "../../dist-BPvku43i.mjs";
+import { Gn as BaseAddon, H as authProviderCapability, L as UserRecordSchema, M as ScopedTokenSchema, r as ApiKeyRecordSchema, vn as userManagementCapability } from "../../dist-Dori4pf3.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -6000,7 +6000,7 @@ var require_sign = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 //#endregion
-//#region src/auth/token-expiry.ts
+//#region src/kernel/settings-read-error.ts
 var import_jsonwebtoken = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
 		decode: require_decode(),
@@ -6011,6 +6011,22 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		TokenExpiredError: require_TokenExpiredError()
 	};
 })))());
+var SettingsReadUnavailableError = class extends Error {
+	reader;
+	reason;
+	name = "SettingsReadUnavailableError";
+	constructor(reader, reason, detail) {
+		super(`[${reader}] settings read refused (${reason}): ${detail}`);
+		this.reader = reader;
+		this.reason = reason;
+	}
+};
+/** Narrow an unknown throw to {@link SettingsReadUnavailableError}. */
+function isSettingsReadUnavailable(err) {
+	return err instanceof SettingsReadUnavailableError;
+}
+//#endregion
+//#region src/auth/token-expiry.ts
 /**
 * Validation for the operator-configured session-JWT lifetime
 * (`auth.tokenExpiry`, System → Settings → Authentication → Token Expiry).
@@ -6201,7 +6217,7 @@ var AuthManager = class {
 		}
 	}
 	signToken(payload) {
-		const configured = this.config.get("auth.tokenExpiry");
+		const configured = this.readConfiguredExpiry();
 		const parsed = parseTokenExpiry(configured);
 		if (!parsed.ok) {
 			const seen = typeof configured === "string" ? configured : JSON.stringify(configured);
@@ -6212,6 +6228,32 @@ var AuthManager = class {
 		}
 		return import_jsonwebtoken.sign({ ...payload }, this.jwtSecret, { expiresIn: parsed.seconds });
 	}
+	/**
+	* The operator's `auth.tokenExpiry`, or `undefined` → DEFAULT_TOKEN_EXPIRY.
+	*
+	* On the hub this reader is `ConfigService`, which answers the key from its
+	* boot-time mirror of the settings store and REFUSES while that mirror is
+	* unknown (pending or failed, D675). A login must not fail over it, so the
+	* refusal signs with the default — and says so once per reason, because a
+	* mint that silently ignored a saved lifetime is the defect this setting
+	* already had once.
+	*/
+	readConfiguredExpiry() {
+		try {
+			return this.config.get("auth.tokenExpiry");
+		} catch (err) {
+			if (!isSettingsReadUnavailable(err)) throw err;
+			const key = `unreadable:${err.reason}`;
+			if (!this.reportedInvalidExpiries.has(key)) {
+				this.reportedInvalidExpiries.add(key);
+				this.logger.warn("auth.tokenExpiry could not be read from the settings store — signing with the default lifetime", { meta: {
+					reason: err.reason,
+					error: err.message
+				} });
+			}
+			return;
+		}
+	}
 	verifyToken(token) {
 		return import_jsonwebtoken.verify(token, this.jwtSecret);
 	}
@@ -9934,4 +9976,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, require_safe_buffer as a, require_ms as i, ScopedTokenManager as n, ApiKeyManager as o, AuthManager as r, UserManager as t };
+export { LocalAuthAddon, LocalAuthAddon as default, isSettingsReadUnavailable as a, ApiKeyManager as c, SettingsReadUnavailableError as i, ScopedTokenManager as n, require_ms as o, AuthManager as r, require_safe_buffer as s, UserManager as t };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-RAl10EfG.js");
+const require_dist = require("../../dist-a6p0V-IL.js");
 const require_tls = require("../../tls-D_wUeOTD.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");