@camstack/system 1.2.316 → 1.2.318

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-RAl10EfG.js");
+const require_dist = require("../../dist-Dcy0gVHu.js");
 const require_device_state_changed = require("../../device-state-changed-Bk7cvTnz.js");
 let zod = require("zod");
 //#region src/builtins/doorbell/trigger-engine.ts
@@ -201,11 +201,18 @@ var DoorbellTriggerEngine = class {
 *   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
 *      input. Before a negative is believed — and again on the ring path
 *      before a press is destroyed — the DURABLE authority is consulted
-*      directly ({@link readDurableWrapperBinding} over the `device-manager`
-*      addon store's `deviceBindings` map). That read carries a discriminator
-*      the derived view genuinely cannot offer: a store answering from an
-*      empty snapshot (D44) has no `deviceBindings` key at all, while a
-*      genuine unbind leaves the key present and merely omits the row.
+*      directly ({@link durableVerdictOf} over
+*      `deviceManager.getWrapperActivation`). That read carries a discriminator
+*      the derived view genuinely cannot offer: it is three-way, so a store
+*      that could not answer (`failed`) is never mistaken for a store that
+*      answered "nothing here" (`missing`).
+*
+* 2026-09-29 (D675). Until then the durable read was
+* `addonSettingsRaw.getGlobal({ addonId: 'device-manager' })`, whose backend
+* (`ConfigManager.getAddonConfig`) has had no store on the hub since D231
+* isolated the engine: it answered `{}` on every call, so every durable read
+* was `unreadable`, an operator's explicit "off" (camera 615,
+* `wrapperAddonId: null`) was never honoured, and a press rang anyway.
 */
 /**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
@@ -216,9 +223,12 @@ function nextBindingState(previous, boundNow) {
 	if (boundNow) return "bound";
 	return previous === "unbind-pending" || previous === "unbound" ? "unbound" : "unbind-pending";
 }
-/** May a ring proceed? Only a corroborated unbind stops one. */
+/**
+* May a ring proceed on the mirror STATE alone? Only a corroborated unbind
+* stops one. {@link needsDurableRead} adds the served-elsewhere case on top.
+*/
 function allowsRing(state) {
-	return !needsDurableRead(state);
+	return state !== "unbound";
 }
 /** True only when a read has positively confirmed the binding. */
 function hasConfirmedBinding(state) {
@@ -243,46 +253,62 @@ function entriesBindWrapper(entries, capName, ownAddonId) {
 function summariseEntries(entries) {
 	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
 }
-function isRecord$2(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 /**
-* Read the DURABLE authority — the `device-manager` addon store's
-* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
-* `capName` on `deviceId`".
+* The durable verdict for `ownAddonId`, from device-manager's STORED
+* activation of this cap on this device (`deviceManager.getWrapperActivation`).
 *
-* This is the input the derived `getBindings` view is not: it is the row the
-* operator's toggle actually writes, with no registry resolution, no
-* `defaultActive` auto-binding and no cross-node cap folding in between. It
-* also grades its own trustworthiness, which `getBindings` cannot: the
-* absence of the `deviceBindings` KEY is the signature of a store answering
-* from an empty snapshot, whereas a genuine unbind leaves the key present.
+* - `value` naming this wrapper → `bound`.
+* - `value` naming another wrapper, or `null` — the operator's explicit "off"
+*   marker (D62) — → `unbound`.
+* - `missing` → `unbound`: the store ANSWERED and holds no activation, and the
+*   doorbell cap is `defaultActive: false`, so a wrapper nobody activated is
+*   not bound.
+* - `failed` → `unreadable`: it carries no information and destroys nothing.
+*/
+function durableVerdictOf(read, ownAddonId) {
+	switch (read.kind) {
+		case "failed": return "unreadable";
+		case "missing": return "unbound";
+		case "value": return read.wrapperAddonId !== null && require_dist.isSameAddonId(read.wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+	}
+}
+/**
+* Who, other than this wrapper, the derived view says serves `capName` —
+* `composer` on a camera whose doorbell was migrated to a composition (D671).
+* Non-empty means a press this wrapper does not ring is still somebody's ring.
 */
-function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
-	if (!isRecord$2(record)) return "unreadable";
-	const deviceBindings = record["deviceBindings"];
-	if (!isRecord$2(deviceBindings)) return "unreadable";
-	const perDevice = deviceBindings[String(deviceId)];
-	if (!isRecord$2(perDevice)) return "unbound";
-	const activation = perDevice[capName];
-	if (!isRecord$2(activation)) return "unbound";
-	const wrapperAddonId = activation["wrapperAddonId"];
-	if (typeof wrapperAddonId !== "string") return "unbound";
-	return require_dist.isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+function otherProvidersOf(entries, capName, ownAddonId) {
+	return entries.filter((entry) => entry.capName === capName && !require_dist.isSameAddonId(entry.providerAddonId, ownAddonId)).map((entry) => entry.providerAddonId);
 }
-/** Does this mirror state need the durable authority before a verdict? Only `unbound` does. */
-function needsDurableRead(state) {
-	return state === "unbound";
+/**
+* Does this camera need the durable authority before a verdict?
+*
+* An `unbound` mirror does (D72). So does any mirror short of `bound` on a
+* camera whose doorbell another provider serves — the D671 cutover, where
+* erring open means ringing ON TOP of the composer: after every restart the
+* mirror starts `undefined` and spends a reload cycle at `unbind-pending`, and
+* each press in that window was a duplicate ring. Two independent reads
+* agreeing — the derived view naming another provider, the store naming no
+* wrapper — is the D49 "second read agrees"; an unreadable store still rings.
+*/
+function needsDurableRead(mirror) {
+	if (!allowsRing(mirror.state)) return true;
+	return mirror.servedBy.length > 0 && mirror.state !== "bound";
 }
 /**
-* THE decision — the ring gate (`fireDoorbell` / `ringsDespiteUnboundMirror`)
+* THE decision — the ring gate (`fireDoorbell` / `ringsAfterDurableRead`)
 * and the Extensions card's activation both call it, so what the card says
 * and what a press does cannot disagree. `durable` is `null` when it was not
-* read, which {@link needsDurableRead} allows for every state but `unbound`.
+* read, which {@link needsDurableRead} allows only where it says so.
 * Pure: it reads nothing and writes nothing.
 */
-function ringVerdict(state, durable) {
+function ringVerdict(mirror, durable) {
+	const state = mirror.state;
 	if (state === "bound") return "rings";
+	if (mirror.servedBy.length > 0) {
+		if (durable === "unbound") return "silent";
+		if (durable === "bound") return "rings";
+	}
 	if (state === "unbind-pending") return "rings-pending";
 	if (state === void 0) return "rings-unconfirmed";
 	if (durable === "bound") return "rings";
@@ -853,13 +879,6 @@ function errorText(err) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
-/**
-* The addon whose store IS the durable authority on wrapper activations.
-* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
-* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
-* derived from it plus the capability registry.
-*/
-var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Narrow a raw `doorbell` runtime-state slice to counters (defaults on absence). */
 function parseDoorbellSlice(slice) {
 	const lastPressedAtRaw = slice?.["lastPressedAt"];
@@ -912,6 +931,24 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* `binding-mirror.ts` for why a single negative read is not believed.
 	*/
 	bindingMirror = /* @__PURE__ */ new Map();
+	/**
+	* Per camera, the last NEGATIVE refresh this addon reported — its state,
+	* the authority's verdict and who else serves the doorbell. A refresh runs
+	* every reload cycle (about once a minute); the same answer repeated is not
+	* news, so it is reported once per change and forgotten on a positive read.
+	* Camera 615 logged the same WARN 607 times in 14 h after D671.
+	*/
+	reportedNegative = /* @__PURE__ */ new Map();
+	/** Cameras whose last durable-authority read THREW — reported once per outage. */
+	durableReadFailing = /* @__PURE__ */ new Set();
+	/**
+	* Per camera, the OTHER providers of `doorbell` the last successful derived
+	* read named (the composer after D671). Written off the ring path with the
+	* mirror; read on it, to decide whether erring open would double a ring.
+	*/
+	servedElsewhere = /* @__PURE__ */ new Map();
+	/** Cameras whose store-over-derived disagreement has been reported, until a derived read agrees. */
+	reportedStoreOverride = /* @__PURE__ */ new Set();
 	constructor() {
 		super({
 			debounceMs: 2e3,
@@ -992,7 +1029,7 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 				projection: "slim",
 				deviceIds: [...deviceIds]
 			})).map(toSlotDevice),
-			readBindingMirror: (deviceId) => this.bindingMirror.get(deviceId),
+			readBindingMirror: (deviceId) => this.mirrorRead(deviceId),
 			readDurableBinding: (deviceId) => this.readDurableAuthority(deviceId),
 			sourceCapableDeviceIds: () => this.ctx.api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...require_dist.SOURCE_CAPS] }),
 			listFleet: async () => (await this.ctx.api.deviceManager.listAll.query({ projection: "slim" })).map(toSlotDevice)
@@ -1041,9 +1078,9 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
 	* The binding gate here is a pure in-memory read on the path that RINGS:
-	* an open mirror performs NO I/O and cannot fail. The mirror can only
-	* DESTROY a press through the one branch below, and that branch is not
-	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
+	* a `bound` mirror, or an open one on a camera nobody else serves, performs
+	* NO I/O and cannot fail. Every other case asks the durable authority once
+	* before deciding — see `needsDurableRead` and `ringsAfterDurableRead`.
 	*
 	* `sourceDeviceId`/`capName` are the source that produced this rise —
 	* carried through purely so the terminal `pressed` line can name it. Every
@@ -1053,8 +1090,9 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* timestamp against provider logs (proven live 2026-08-25, camera 615).
 	*/
 	async fireDoorbell(cameraId, timestamp, sourceDeviceId, capName) {
-		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
+		const mirror = this.mirrorRead(cameraId);
+		const binding = mirror.state;
+		if (needsDurableRead(mirror) && !await this.ringsAfterDurableRead(cameraId, mirror)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -1131,8 +1169,10 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/**
-	* One read of the DURABLE authority: the `device-manager` addon store's
-	* `deviceBindings` map, straight from the settings DB.
+	* One read of the DURABLE authority: the wrapper activation device-manager
+	* STORED for this camera (`deviceManager.getWrapperActivation`, D675) — the
+	* row the operator's bindings toggle writes. `deviceManager.getBindings` is
+	* a VIEW derived from it plus the capability registry.
 	*
 	* This is deliberately NOT `getBindings`. The derived view folds the store
 	* together with the capability registry, `defaultActive` auto-binding and
@@ -1141,17 +1181,35 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	* spelling mismatch) made it disagree *systematically* while looking
 	* exactly like a genuine unbind. The raw row cannot: it is what the
 	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*
+	* A read that throws is reported when the outage STARTS and when it ends —
+	* never per read: this runs on every reload cycle.
 	*/
 	async readDurableAuthority(cameraId) {
+		let read;
 		try {
-			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, require_dist.doorbellCapability.name, this.ownAddonId);
-		} catch (err) {
-			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
-				tags: { deviceId: cameraId },
-				meta: { error: require_dist.errMsg(err) }
+			read = await this.ctx.api.deviceManager.getWrapperActivation.query({
+				deviceId: cameraId,
+				capName: require_dist.doorbellCapability.name
 			});
+		} catch (err) {
+			read = {
+				kind: "failed",
+				error: require_dist.errMsg(err)
+			};
+		}
+		if (read.kind === "failed") {
+			if (!this.durableReadFailing.has(cameraId)) {
+				this.durableReadFailing.add(cameraId);
+				this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing (reported once until it answers again)", {
+					tags: { deviceId: cameraId },
+					meta: { error: read.error }
+				});
+			}
 			return "unreadable";
 		}
+		if (this.durableReadFailing.delete(cameraId)) this.ctx.logger.info("virtual-doorbell: the durable bindings store answers again", { tags: { deviceId: cameraId } });
+		return durableVerdictOf(read, this.ownAddonId);
 	}
 	/**
 	* Reconcile `cameraId`'s mirror against the authority. Runs on the
@@ -1169,60 +1227,114 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 	async refreshBindingMirror(cameraId) {
 		const derived = await this.readDerivedBinding(cameraId);
 		if (derived === null) return;
+		const servedBy = otherProvidersOf(derived.entries, require_dist.doorbellCapability.name, this.ownAddonId);
+		this.servedElsewhere.set(cameraId, servedBy);
 		if (derived.bound) {
 			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			this.reportedNegative.delete(cameraId);
+			this.reportedStoreOverride.delete(cameraId);
 			return;
 		}
 		const authority = await this.readDurableAuthority(cameraId);
 		const entries = summariseEntries(derived.entries);
 		if (authority === "bound") {
-			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
-				tags: { deviceId: cameraId },
-				meta: {
-					ownAddonId: this.ownAddonId,
-					entries
-				}
-			});
+			this.reportedNegative.delete(cameraId);
+			if (!this.reportedStoreOverride.has(cameraId)) {
+				this.reportedStoreOverride.add(cameraId);
+				this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store (reported once until they agree)", {
+					tags: { deviceId: cameraId },
+					meta: {
+						ownAddonId: this.ownAddonId,
+						entries
+					}
+				});
+			}
 			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
+		this.reportedStoreOverride.delete(cameraId);
 		const previous = this.bindingMirror.get(cameraId);
 		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.reportNegativeRefresh(cameraId, {
+			from: previous ?? "never-read",
+			to: next,
+			authority,
+			servedBy,
+			entries
+		});
+	}
+	/** The ring gate's in-memory input for one camera — no I/O. */
+	mirrorRead(cameraId) {
+		return {
+			state: this.bindingMirror.get(cameraId),
+			servedBy: this.servedElsewhere.get(cameraId) ?? []
+		};
+	}
+	/**
+	* Report a negative refresh ONCE per change of what it says (D391: a
+	* repeated identical line is noise that buries the next real one).
+	*
+	* The level follows what the answer MEANS:
+	*   - the durable store could not grade it (`unreadable`) — WARN: the
+	*     camera's ring now depends on erring open, and nobody can say whether
+	*     that is right;
+	*   - the store CONFIRMS the wrapper is not bound — an operator's unbind or
+	*     the D671 cutover to a composition. That is a state, not an anomaly:
+	*     INFO when it is believed (`unbound`), DEBUG for the first,
+	*     not-yet-believed read.
+	*/
+	reportNegativeRefresh(cameraId, report) {
+		const key = `${report.to}|${report.authority}|${report.servedBy.join(",")}`;
+		if (this.reportedNegative.get(cameraId) === key) return;
+		this.reportedNegative.set(cameraId, key);
+		const options = {
 			tags: { deviceId: cameraId },
 			meta: {
-				from: previous ?? "never-read",
-				to: next,
+				from: report.from,
+				to: report.to,
 				ownAddonId: this.ownAddonId,
-				durableAuthority: authority,
-				entries
+				durableAuthority: report.authority,
+				doorbellServedBy: report.servedBy,
+				entries: report.entries
 			}
-		});
+		};
+		if (report.authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper and the durable store cannot confirm it — a press still rings", options);
+			return;
+		}
+		const message = report.servedBy.length > 0 ? `virtual-doorbell: wrapper deactivated on this camera — its doorbell is served by ${report.servedBy.join(", ")}` : "virtual-doorbell: wrapper deactivated on this camera — the bindings store confirms it";
+		if (report.to === "unbound") this.ctx.logger.info(message, options);
+		else this.ctx.logger.debug(message, options);
 	}
 	/**
-	* The mirror says `unbound` and a real press just arrived. Decide, with
-	* ONE read of the durable authority, whether to destroy it.
+	* A real press arrived on a camera the in-memory gate cannot clear on its
+	* own: the mirror is `unbound`, or it is short of `bound` while another
+	* provider serves the doorbell. Decide, with ONE read of the durable
+	* authority, whether this wrapper rings.
 	*
 	* D49 forbade I/O on the ring path because the read it would have made was
 	* the same fallible derived read that caused the problem. This read is
 	* different in both directions: it is the authority rather than a view of
-	* it, and it is paid ONLY on the branch that would otherwise drop a press —
-	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
-	* reconcile and nothing downstream that notices.
+	* it, and it is paid ONLY where erring open could be wrong — a dropped ring
+	* (an `unbound` mirror) or a DOUBLED one (another provider rings this
+	* camera). A ring is rare and one query is cheap. An unreadable store still
+	* rings: it carries no information.
 	*
 	* Returns `true` when the ring must proceed.
 	*/
-	async ringsDespiteUnboundMirror(cameraId, binding) {
+	async ringsAfterDurableRead(cameraId, mirror) {
+		const binding = mirror.state;
 		const authority = await this.readDurableAuthority(cameraId);
-		const verdict = ringVerdict(binding, authority);
+		const verdict = ringVerdict(mirror, authority);
 		switch (verdict) {
 			case "rings":
 				this.bindingMirror.set(cameraId, "bound");
-				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror did not confirm this wrapper but the durable bindings store still names it; the mirror has been repaired", {
 					tags: { deviceId: cameraId },
 					meta: {
-						bindingState: binding,
+						bindingState: binding ?? "never-read",
+						doorbellServedBy: mirror.servedBy,
 						ownAddonId: this.ownAddonId
 					}
 				});
@@ -1238,19 +1350,32 @@ var VirtualDoorbellAddon = class extends require_dist.BaseAddon {
 				return verdictRings(verdict);
 			case "silent": {
 				const derived = await this.readDerivedBinding(cameraId);
-				this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+				const servedBy = derived === null ? mirror.servedBy : otherProvidersOf(derived.entries, require_dist.doorbellCapability.name, this.ownAddonId);
+				const options = {
 					tags: { deviceId: cameraId },
 					meta: {
 						bindingState: binding,
 						ownAddonId: this.ownAddonId,
 						durableAuthority: authority,
+						doorbellServedBy: servedBy,
 						entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 					}
-				});
+				};
+				if (servedBy.length > 0) this.ctx.logger.info(`virtual-doorbell: press left to ${servedBy.join(", ")} — this wrapper is deactivated on this camera`, options);
+				else this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", options);
 				return verdictRings(verdict);
 			}
 			case "rings-pending":
-			case "rings-unconfirmed": return verdictRings(verdict);
+			case "rings-unconfirmed":
+				this.ctx.logger.warn(`virtual-doorbell: ringing although ${mirror.servedBy.join(", ")} serves this doorbell — the durable bindings store could not confirm this wrapper was deactivated`, {
+					tags: { deviceId: cameraId },
+					meta: {
+						bindingState: binding ?? "never-read",
+						durableAuthority: authority,
+						ownAddonId: this.ownAddonId
+					}
+				});
+				return verdictRings(verdict);
 		}
 	}
 	/**