@camstack/system 1.2.330 → 1.2.332

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,1407 +0,0 @@
-import { Gn as isSourceCap, Lt as isSameAddonId, Pn as SOURCE_CAPS, Sr as EventCategory, Wn as evaluateSensorEdge, X as buildDoorbellCompositionFeature, Xn as errMsg, Yn as DeviceType, Zn as BaseAddon, bt as doorbellCapability, ct as createDeviceExtensionProvider, gt as deviceExtensionCapability, pt as defineExtensionSlotProvider, q as bareAddonId, sr as createEvent, xt as doorbellFeatureSources } from "../../dist-Dp043AI0.mjs";
-import { n as parseDeviceStateChanged } from "../../device-state-changed-DoBbkyEI.mjs";
-import { z } from "zod";
-//#region src/builtins/doorbell/trigger-engine.ts
-/**
-* Pure trigger logic for the virtual-doorbell builtin — edge detection over
-* runtime-state slices with per-camera debounce. Extracted from the addon
-* class so the behaviour is unit-testable without instantiating the addon or
-* mocking the event bus.
-*
-* REACTION MODEL (simplified — operator picks a source, the system reacts
-* with a sensible default): a source device rings a camera's doorbell when a
-* known binary / switch cap on it RISES to its active state (false→true) — a
-* contact opening, a switch turning on, an alarm sensor firing. There is no
-* per-source trigger configuration today; the shape stays extensible for a
-* future custom-trigger override (see `doorbell-settings.ts`).
-*
-* ## Dove vive il fronte, dal 2026-08-27
-*
-* `SOURCE_CAP_ACTIVE_FIELD`, `SOURCE_CAP_CHANGED_AT_FIELD`, i due predicati di
-* slice e il predicato di fronte sono stati SPOSTATI in
-* `@camstack/types` (`catalogs/sensor-active-state.ts`), perché il recorder ne
-* ha bisogno per il trigger `RecordingTriggers.sensorDeviceIds`. Una seconda
-* copia sarebbe divergita alla prima cap aggiunta, e il sintomo — "il sensore
-* fa suonare il campanello ma non registra" — è precisamente D62.
-*
-* Questo file ri-esporta i nomi pubblici (i suoi consumatori non cambiano
-* import) e resta l'unico proprietario di ciò che è del CAMPANELLO e di
-* nessun altro: le assegnazioni camera↔sorgente, il debounce per camera e il
-* vocabolario `DoorbellIgnoreReason` — che ha un valore in più
-* (`no-assignment`) che il valutatore puro non può conoscere.
-*/
-function ignoredResult(reason) {
-	return {
-		fired: [],
-		debounced: [],
-		ignored: reason
-	};
-}
-/**
-* Stateful (but side-effect-free towards the outside) trigger engine.
-*
-* Tracks the last observed binary value per (sourceDevice, cap) so a
-* `DeviceStateChanged` re-emission (the slice's `lastChangedAt` moves while
-* the binary value does not) never double-fires.
-*
-* FIRST SIGHTINGS. Seeding the baseline and never firing was wrong for the
-* one case that matters: a momentary source (a button wired to a Home
-* Assistant switch) is NOT re-pushed in its resting `off` state after a hub
-* restart, so after every restart — several a day — the first slice the
-* engine ever sees for it is the PRESS ITSELF, already active. That press
-* was eaten whole; a real one on 2026-08-05 left no trace anywhere.
-*
-* The discriminator is the source's own transition timestamp. A first
-* sighting that is already active rings only when its transition can be
-* proved to have happened AFTER this engine started watching AND within
-* `firstSightingFreshnessMs`. Both halves earn their keep: freshness alone
-* would ring on a boot hydration of a state that flipped seconds before the
-* restart, and "after we started" alone would ring, on a long-lived
-* process, for a source adopted today whose state flipped yesterday. An
-* undateable first sighting (no timestamp, or a zero sentinel) does NOT
-* ring — the ambiguous case errs towards silence, but reports
-* `baseline-seeded-stale-active` so the caller can say so out loud.
-*/
-var DoorbellTriggerEngine = class {
-	assignments = [];
-	/** Last observed binary value keyed by `${deviceId}:${capName}`. */
-	lastValues = /* @__PURE__ */ new Map();
-	/** Last fire timestamp per camera — debounce bookkeeping. */
-	lastFiredAt = /* @__PURE__ */ new Map();
-	debounceMs;
-	now;
-	firstSightingFreshnessMs;
-	/** When this engine started watching — the floor for a first-sighting rise. */
-	startedAt;
-	constructor(options) {
-		this.debounceMs = options?.debounceMs ?? 2e3;
-		this.now = options?.now ?? Date.now;
-		this.firstSightingFreshnessMs = options?.firstSightingFreshnessMs ?? 3e4;
-		this.startedAt = this.now();
-	}
-	/** Replace the full assignment set (rebuilt whenever settings change). */
-	setAssignments(assignments) {
-		this.assignments = [...assignments];
-	}
-	getAssignments() {
-		return this.assignments;
-	}
-	/** True when any assignment references `deviceId` as its source. */
-	hasSource(deviceId) {
-		return this.assignments.some((a) => a.sourceDeviceId === deviceId);
-	}
-	/**
-	* Feed one `DeviceStateChanged` slice. Reports which cameras should ring,
-	* which were suppressed by the debounce window, and — when nothing was
-	* matched at all — WHY. Only a rise to active on a recognised source cap
-	* can ring; re-emissions and the falling edge never do.
-	*/
-	onStateSlice(deviceId, capName, slice) {
-		const key = `${deviceId}:${capName}`;
-		const verdict = evaluateSensorEdge({
-			capName,
-			slice,
-			prior: this.lastValues.get(key),
-			startedAtMs: this.startedAt,
-			nowMs: this.now(),
-			firstSightingFreshnessMs: this.firstSightingFreshnessMs
-		});
-		if (verdict.edge === "none") {
-			if (verdict.value !== null) this.lastValues.set(key, verdict.value);
-			return ignoredResult(verdict.reason);
-		}
-		this.lastValues.set(key, true);
-		return this.matchAndDebounce(deviceId);
-	}
-	matchAndDebounce(sourceDeviceId) {
-		const now = this.now();
-		const fired = [];
-		const debounced = [];
-		for (const assignment of this.assignments) {
-			if (assignment.sourceDeviceId !== sourceDeviceId) continue;
-			const last = this.lastFiredAt.get(assignment.cameraId);
-			if (last !== void 0 && now - last < this.debounceMs) {
-				debounced.push(assignment.cameraId);
-				continue;
-			}
-			this.lastFiredAt.set(assignment.cameraId, now);
-			fired.push(assignment.cameraId);
-		}
-		if (fired.length === 0 && debounced.length === 0) return ignoredResult("no-assignment");
-		return {
-			fired,
-			debounced,
-			ignored: null
-		};
-	}
-};
-//#endregion
-//#region src/builtins/doorbell/binding-mirror.ts
-/**
-* The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
-* camera: is this wrapper still the active `doorbell` binding for it?
-*
-* WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
-* is no retry, no reconcile, nothing downstream that can notice it went
-* missing. The wrapper used to re-derive the binding on the ring path via
-* `deviceManager.getBindings` and treat ANY answer that omitted its own
-* activation as "the operator unbound this". On 2026-08-04/05 camera 615
-* rang zero times out of three real presses: the binding was persisted (a
-* same-day backup taken before the presses proves it, and the same process
-* later returned it correctly to a tRPC query), but the store answered
-* transiently without it — `getBindings` reads the device-manager addon
-* store, which is exactly the surface that can silently answer `{}` (D44,
-* `addon-registry.service.ts`). Three presses, three drops, at `debug`.
-*
-* WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
-* genuinely unbound pure-wrapper cap and a store answering from an empty
-* snapshot produce the SAME `getBindings` response — no `doorbell` entry,
-* with the camera's native entries (snapshot, motion, …) still present in
-* both cases because those come from the capability registry, not the
-* store. The response cannot be graded. What CAN be graded is repetition: a
-* real unbind is permanent and every later read agrees, a store blip does
-* not survive the next read. So a negative read ARMS the revocation and a
-* second consecutive negative applies it.
-*
-* ERRING. `undefined` (never read) and `unbind-pending` both ring. The cost
-* of erring open is a spurious ring on a camera whose wrapper is not bound
-* but which has trigger sources, for at most two reload cycles. The cost of
-* erring closed is the press.
-*
-* D655: a configured source is NO LONGER evidence of the binding. D49 leaned
-* on "a source can only be configured through this wrapper's own
-* binding-gated settings surface"; that surface is retired, and the
-* `doorbell-source` extension slot that replaced it is offered on every
-* camera, bound or not (D648). The erring-open window above is therefore
-* reachable by configuring sources on a never-bound camera, not only by
-* unbinding a configured one — still bounded by two reload cycles, and the
-* slot's card says `inactive` once the reads agree.
-*
-* ─────────────────────────────────────────────────────────────────────
-* 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
-* matters more than the fix. `refreshBindingMirror` matched the binding with
-* `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
-* not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
-* hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
-* carries the bare form. So for this builtin the comparison was false for
-* every entry, forever — not a blip. Corroboration only defends against a
-* TRANSIENT bad read; two systematically-wrong reads agree with each other,
-* and the mirror latched `unbound` with no way back except an operator
-* opening the settings page. A real press on camera 615 was dropped.
-*
-* Two things follow, and both are now load-bearing here:
-*
-*   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
-*      never a raw `===`.
-*   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
-*      input. Before a negative is believed — and again on the ring path
-*      before a press is destroyed — the DURABLE authority is consulted
-*      directly ({@link durableVerdictOf} over
-*      `deviceManager.getWrapperActivation`). That read carries a discriminator
-*      the derived view genuinely cannot offer: it is three-way, so a store
-*      that could not answer (`failed`) is never mistaken for a store that
-*      answered "nothing here" (`missing`).
-*
-* 2026-09-29 (D675). Until then the durable read was
-* `addonSettingsRaw.getGlobal({ addonId: 'device-manager' })`, whose backend
-* (`ConfigManager.getAddonConfig`) has had no store on the hub since D231
-* isolated the engine: it answered `{}` on every call, so every durable read
-* was `unreadable`, an operator's explicit "off" (camera 615,
-* `wrapperAddonId: null`) was never honoured, and a press rang anyway.
-*/
-/**
-* Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
-* never reach this function — an unanswerable store carries no information
-* and must leave the mirror exactly as it was.
-*/
-function nextBindingState(previous, boundNow) {
-	if (boundNow) return "bound";
-	return previous === "unbind-pending" || previous === "unbound" ? "unbound" : "unbind-pending";
-}
-/**
-* May a ring proceed on the mirror STATE alone? Only a corroborated unbind
-* stops one. {@link needsDurableRead} adds the served-elsewhere case on top.
-*/
-function allowsRing(state) {
-	return state !== "unbound";
-}
-/** True only when a read has positively confirmed the binding. */
-function hasConfirmedBinding(state) {
-	return state === "bound";
-}
-/**
-* Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
-* of `capName`?
-*
-* `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
-* which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
-* while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
-*/
-function entriesBindWrapper(entries, capName, ownAddonId) {
-	return entries.some((entry) => entry.capName === capName && entry.kind === "wrapped" && isSameAddonId(entry.providerAddonId, ownAddonId));
-}
-/**
-* Render binding entries for a log line. A systematic wrong answer and a
-* one-off blip produce the same VERDICT; only the entries themselves tell
-* them apart, so a negative read never gets to report just its conclusion.
-*/
-function summariseEntries(entries) {
-	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
-}
-/**
-* The durable verdict for `ownAddonId`, from device-manager's STORED
-* activation of this cap on this device (`deviceManager.getWrapperActivation`).
-*
-* - `value` naming this wrapper → `bound`.
-* - `value` naming another wrapper, or `null` — the operator's explicit "off"
-*   marker (D62) — → `unbound`.
-* - `missing` → `unbound`: the store ANSWERED and holds no activation, and the
-*   doorbell cap is `defaultActive: false`, so a wrapper nobody activated is
-*   not bound.
-* - `failed` → `unreadable`: it carries no information and destroys nothing.
-*/
-function durableVerdictOf(read, ownAddonId) {
-	switch (read.kind) {
-		case "failed": return "unreadable";
-		case "missing": return "unbound";
-		case "value": return read.wrapperAddonId !== null && isSameAddonId(read.wrapperAddonId, ownAddonId) ? "bound" : "unbound";
-	}
-}
-/**
-* Who, other than this wrapper, the derived view says serves `capName` —
-* `composer` on a camera whose doorbell was migrated to a composition (D671).
-* Non-empty means a press this wrapper does not ring is still somebody's ring.
-*/
-function otherProvidersOf(entries, capName, ownAddonId) {
-	return entries.filter((entry) => entry.capName === capName && !isSameAddonId(entry.providerAddonId, ownAddonId)).map((entry) => entry.providerAddonId);
-}
-/**
-* Does this camera need the durable authority before a verdict?
-*
-* An `unbound` mirror does (D72). So does any mirror short of `bound` on a
-* camera whose doorbell another provider serves — the D671 cutover, where
-* erring open means ringing ON TOP of the composer: after every restart the
-* mirror starts `undefined` and spends a reload cycle at `unbind-pending`, and
-* each press in that window was a duplicate ring. Two independent reads
-* agreeing — the derived view naming another provider, the store naming no
-* wrapper — is the D49 "second read agrees"; an unreadable store still rings.
-*/
-function needsDurableRead(mirror) {
-	if (!allowsRing(mirror.state)) return true;
-	return mirror.servedBy.length > 0 && mirror.state !== "bound";
-}
-/**
-* THE decision — the ring gate (`fireDoorbell` / `ringsAfterDurableRead`)
-* and the Extensions card's activation both call it, so what the card says
-* and what a press does cannot disagree. `durable` is `null` when it was not
-* read, which {@link needsDurableRead} allows only where it says so.
-* Pure: it reads nothing and writes nothing.
-*/
-function ringVerdict(mirror, durable) {
-	const state = mirror.state;
-	if (state === "bound") return "rings";
-	if (mirror.servedBy.length > 0) {
-		if (durable === "unbound") return "silent";
-		if (durable === "bound") return "rings";
-	}
-	if (state === "unbind-pending") return "rings-pending";
-	if (state === void 0) return "rings-unconfirmed";
-	if (durable === "bound") return "rings";
-	if (durable === "unbound") return "silent";
-	return "unknown";
-}
-/** Whether a press proceeds under this verdict. */
-function verdictRings(verdict) {
-	return verdict !== "silent";
-}
-//#endregion
-//#region src/builtins/doorbell/doorbell-settings.ts
-/**
-* Pure per-camera settings parsing/normalization for the virtual-doorbell
-* builtin. Kept separate from the addon class (and the runtime trigger
-* engine) so the persisted-shape handling — including tolerant migration of
-* the legacy single-source blob — is unit-testable in isolation.
-*
-* PERSISTED SHAPE (extensible by design):
-*   doorbellSources: Array<{ deviceId: number }>
-*
-* The source is an OBJECT rather than a bare id so future per-source options
-* (a custom trigger override, an event-type match, a per-source debounce)
-* can be added without another migration. Today only `deviceId` is stored;
-* the reaction is DERIVED at runtime from the source device's cap (see
-* `trigger-engine.ts`).
-*/
-/** Device-store key holding the source list. */
-var KEY_SOURCES = "doorbellSources";
-/**
-* Legacy device-store keys from the pre-simplification shape (single source
-* device + explicit trigger + event type). Retained ONLY for tolerant
-* migration on read and cleanup on write — never written afresh.
-*/
-var LEGACY_KEY_SOURCE = "doorbellSourceDeviceId";
-var LEGACY_KEY_TRIGGER = "doorbellTrigger";
-var LEGACY_KEY_EVENT_TYPE = "doorbellEventType";
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Coerce a persisted / form-supplied id (number or numeric string) to a
-*  positive integer device id, or null when it is not a usable id. */
-function coerceDeviceId(value) {
-	if (typeof value === "number" && Number.isInteger(value) && value > 0) return value;
-	if (typeof value === "string" && value !== "none" && value.trim().length > 0) {
-		const parsed = Number(value);
-		if (Number.isInteger(parsed) && parsed > 0) return parsed;
-	}
-	return null;
-}
-/** Fold a raw list of ids / source records into a deduped source array. */
-function collectSources(items) {
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of items) {
-		const id = isRecord$1(item) ? coerceDeviceId(item["deviceId"]) : coerceDeviceId(item);
-		if (id !== null && !seen.has(id)) {
-			seen.add(id);
-			out.push({ deviceId: id });
-		}
-	}
-	return out;
-}
-/**
-* Parse the persisted doorbell sources for one camera. Tolerant of BOTH:
-*   - the new `doorbellSources: [{deviceId}]` shape (ids may arrive as
-*     numbers, numeric strings, or `{deviceId}` records); and
-*   - the legacy single `doorbellSourceDeviceId` scalar, mapped onto one
-*     source (the old trigger/eventType are dropped — the reaction is now
-*     derived at runtime).
-*
-* Never throws on malformed data — unknown entries are skipped.
-*/
-function parseDoorbellSources(blob) {
-	const raw = blob[KEY_SOURCES];
-	const fromNew = Array.isArray(raw) ? collectSources(raw) : [];
-	if (fromNew.length > 0) return fromNew;
-	return collectSources([blob[LEGACY_KEY_SOURCE]]);
-}
-/**
-* Normalize a settings-patch value for the `doorbellSources` multiselect
-* (a `string[]` of device ids from the form, or an already-shaped
-* `{deviceId}[]` / `number[]`) into the persisted extensible shape.
-*/
-function normalizeDoorbellSources(value) {
-	if (!Array.isArray(value)) return [];
-	return collectSources(value);
-}
-/**
-* Produce the next device-store blob after applying a doorbell-sources
-* patch: writes the normalized new shape and strips every legacy key so a
-* migrated camera never carries stale single-source fields.
-*/
-function applyDoorbellSourcesPatch(current, patchValue) {
-	const next = { ...current };
-	delete next[LEGACY_KEY_SOURCE];
-	delete next[LEGACY_KEY_TRIGGER];
-	delete next[LEGACY_KEY_EVENT_TYPE];
-	next[KEY_SOURCES] = normalizeDoorbellSources(patchValue);
-	return next;
-}
-//#endregion
-//#region src/builtins/doorbell/doorbell-extension-slot.ts
-/**
-* The virtual doorbell's side of `device-extension` (D648): the
-* `doorbell-source` slot, served over the wrapper's `doorbellSources` store
-* — since D655 the only editor of a camera's trigger devices.
-*
-*  - `list` reads the store through `parseDoorbellSources` — the parser the
-*    trigger engine's assignments are built from — so the slot's value is
-*    exactly what rings. It also REPORTS whether the wrapper is bound to the
-*    camera (`activation`), named as `setWrapperActive`'s: sources on an
-*    unbound camera ring nothing, and the card must say so rather than look
-*    configured. Nothing here writes it.
-*  - The activation costs NOTHING on the common path. A camera with no
-*    sources has no gate worth reporting and makes no read. A camera with
-*    sources is answered from the addon's D49 binding mirror — the in-memory
-*    verdict the ring path itself uses — through `ringVerdict`, the ring
-*    gate's own decision function. The card is READ-ONLY: it never refreshes
-*    or writes the mirror, and reads the durable authority only for an
-*    `unbound` mirror, exactly where the ring gate reads it.
-*    `getBindings` was measured at up to 5.24 s on the live hub (2026-08-30),
-*    and the dispatcher already paid one for this page.
-*  - The picked sources are labelled with ONE batched `listAll({deviceIds})`,
-*    never a `getDevice` per id.
-*  - `set` goes through the addon's `persistDoorbellSources`, the SAME
-*    normalise-and-store path the wrapper has, which also invalidates
-*    the assignment cache so the binding mirror is re-read off the ring path
-*    (D49). A `setSlot` call is NOT evidence that the wrapper is bound (the
-*    contract reaches this provider through `device-extension`'s own
-*    binding), so it never confirms the mirror. A NEW pick must be a device
-*    that carries a source cap (`SOURCE_CAPS`, the D636 ids-only read) — which
-*    also refuses a container, a device with no source cap and an id no
-*    device has — and never the camera itself.
-*  - `candidates` are those same source-capable devices, devices in the
-*    camera's location suggested.
-*/
-/** The routing prefix of this owner's `slotRef`s. */
-var VIRTUAL_DOORBELL_EXTENSION_SOURCE = "virtual-doorbell";
-/** The store the slot reads and writes, named (D62). */
-var DOORBELL_SOURCES_AUTHORITY = `virtual-doorbell:${KEY_SOURCES}`;
-/** The authority that decides whether the wrapper serves a camera at all. */
-var WRAPPER_ACTIVATION_AUTHORITY = "device-manager:setWrapperActive";
-var INACTIVE_DETAIL = "The virtual doorbell is not bound to this camera: these devices ring nothing until it is activated in the camera’s bindings.";
-var PENDING_DETAIL = "One bindings read did not see the wrapper; a press still rings until a second read agrees.";
-/** How the card SAYS a verdict. The verdict itself is `ringVerdict`'s, never the card's. */
-function activationFromVerdict(verdict) {
-	const authority = WRAPPER_ACTIVATION_AUTHORITY;
-	switch (verdict) {
-		case "rings": return {
-			state: "active",
-			authority
-		};
-		case "rings-pending": return {
-			state: "active",
-			authority,
-			detail: PENDING_DETAIL
-		};
-		case "rings-unconfirmed": return {
-			state: "active",
-			authority,
-			detail: "No bindings read has confirmed the wrapper yet; a press rings meanwhile."
-		};
-		case "unknown": return {
-			state: "unknown",
-			authority,
-			detail: "Could not verify: the last reads did not see the wrapper and the bindings store cannot answer. A press still rings."
-		};
-		case "silent": return {
-			state: "inactive",
-			authority,
-			detail: INACTIVE_DETAIL
-		};
-	}
-}
-/**
-* Concurrent card views of the same `unbound` camera share ONE durable read,
-* per camera, for as long as it is in flight — a page with several viewers
-* (or a refetch storm) must not multiply the store round trip. Only the
-* CARD's reads are shared: the ring gate calls the addon's
-* `readDurableAuthority` on its own path and never waits behind a card.
-*/
-function shareDurableReads(read) {
-	const inFlight = /* @__PURE__ */ new Map();
-	return (deviceId) => {
-		const pending = inFlight.get(deviceId);
-		if (pending !== void 0) return pending;
-		const started = read(deviceId).finally(() => {
-			inFlight.delete(deviceId);
-		});
-		inFlight.set(deviceId, started);
-		return started;
-	};
-}
-async function activationOf(deps, readDurable, deviceId) {
-	const mirrored = deps.readBindingMirror(deviceId);
-	return activationFromVerdict(ringVerdict(mirrored, needsDurableRead(mirrored) ? await readDurable(deviceId) : null));
-}
-function sourceOf(deviceId, byId) {
-	const device = byId.get(deviceId);
-	if (device === void 0) return {
-		deviceId,
-		name: null,
-		health: "missing",
-		detail: "No device has this id any more — it rings nothing until removed."
-	};
-	return {
-		deviceId,
-		name: device.name,
-		health: "ok"
-	};
-}
-async function candidatesFor(deps, deviceId) {
-	const [ids, fleet] = await Promise.all([deps.sourceCapableDeviceIds(), deps.listFleet()]);
-	const eligible = new Set(ids);
-	const byId = new Map(fleet.map((d) => [d.id, d]));
-	const location = byId.get(deviceId)?.location ?? null;
-	const out = [];
-	for (const device of fleet) {
-		if (device.id === deviceId || !eligible.has(device.id)) continue;
-		const suggested = location !== null && device.location === location;
-		const parent = device.parentDeviceId === null ? void 0 : byId.get(device.parentDeviceId);
-		out.push({
-			deviceId: device.id,
-			name: device.name,
-			type: device.type,
-			location: device.location,
-			parentName: parent?.name ?? null,
-			suggested,
-			reason: suggested ? "same location" : null
-		});
-	}
-	return out.toSorted((a, b) => Number(b.suggested) - Number(a.suggested) || a.name.localeCompare(b.name));
-}
-/** Why each NEW pick is refused, or [] when every one is a legitimate source. */
-async function refusedPicks(deps, deviceId, picked) {
-	const persisted = new Set((await deps.readSources(deviceId)).map((s) => s.deviceId));
-	const added = picked.filter((id) => !persisted.has(id));
-	if (added.length === 0) return [];
-	const eligible = new Set(await deps.sourceCapableDeviceIds());
-	const refused = [];
-	for (const id of added) if (id === deviceId) refused.push(`${id} is the camera itself`);
-	else if (!eligible.has(id)) refused.push(`${id} carries no doorbell source capability (a binary sensor or switch)`);
-	return refused;
-}
-/** Build the `device-extension` provider the virtual doorbell registers. */
-function createDoorbellExtensionProvider(deps) {
-	const readDurable = shareDurableReads(deps.readDurableBinding);
-	return createDeviceExtensionProvider({
-		source: VIRTUAL_DOORBELL_EXTENSION_SOURCE,
-		label: "Virtual doorbell",
-		slots: [defineExtensionSlotProvider("doorbell-source", {
-			list: async (deviceId) => {
-				const ids = (await deps.readSources(deviceId)).map((s) => s.deviceId);
-				if (ids.length === 0) return {
-					authority: DOORBELL_SOURCES_AUTHORITY,
-					activation: null,
-					value: {
-						slot: "doorbell-source",
-						deviceIds: []
-					},
-					sources: []
-				};
-				const [devices, activation] = await Promise.all([deps.listDevices(ids), activationOf(deps, readDurable, deviceId)]);
-				const byId = new Map(devices.map((d) => [d.id, d]));
-				return {
-					authority: DOORBELL_SOURCES_AUTHORITY,
-					activation,
-					value: {
-						slot: "doorbell-source",
-						deviceIds: ids
-					},
-					sources: ids.map((id) => sourceOf(id, byId))
-				};
-			},
-			set: async (deviceId, value) => {
-				const refused = await refusedPicks(deps, deviceId, value.deviceIds);
-				if (refused.length > 0) {
-					deps.logger.warn("virtual-doorbell: extension write refused — nothing persisted", {
-						tags: { deviceId },
-						meta: { refused }
-					});
-					throw new Error(`doorbell-source on ${deviceId}: refused — ${refused.join("; ")}`);
-				}
-				await deps.persistSources(deviceId, value.deviceIds);
-				return {
-					applied: true,
-					reload: "none"
-				};
-			},
-			candidates: (deviceId) => candidatesFor(deps, deviceId)
-		})],
-		hostTypeOf: async (deviceId) => (await deps.getDevice(deviceId))?.type ?? null,
-		logger: deps.logger
-	});
-}
-//#endregion
-//#region src/builtins/doorbell/doorbell-composition-migration.ts
-var DOORBELL_COMPOSITION_MIGRATION_STATE_KEY = "doorbell-source-composition-migration-v1";
-var DOORBELL_COMPOSITION_MIGRATION_CALLER = {
-	userId: "system:doorbell-source-migration",
-	isAdmin: true
-};
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stableValue(value) {
-	if (Array.isArray(value)) return value.map(stableValue);
-	if (!isRecord(value)) return value;
-	return Object.fromEntries(Object.keys(value).toSorted().map((key) => [key, stableValue(value[key])]));
-}
-function sameJson(a, b) {
-	return JSON.stringify(stableValue(a)) === JSON.stringify(stableValue(b));
-}
-function withoutEnabled(feature) {
-	const { enabled: _enabled, ...rest } = feature;
-	return rest;
-}
-function migrationSources(camera, configured, devicesById, bindingsById) {
-	const sources = [];
-	for (const configuredSource of configured) {
-		const device = devicesById.get(configuredSource.deviceId);
-		const entries = bindingsById.get(configuredSource.deviceId);
-		if (device === void 0 || entries === void 0) throw new Error(`source device ${configuredSource.deviceId} could not be resolved and read`);
-		const found = doorbellFeatureSources({
-			addonId: device.addonId,
-			stableId: device.stableId
-		}, entries.map((entry) => entry.capName));
-		if (found.length === 0) throw new Error(`source device ${configuredSource.deviceId} has no supported source capability`);
-		sources.push(...found);
-	}
-	if (sources.length === 0) throw new Error(`camera ${camera.id} has no resolvable doorbell sources`);
-	return sources;
-}
-function wrapperIsActive(entries) {
-	return entries.some((entry) => entry.capName === "doorbell" && entry.kind === "wrapped" && entry.providerAddonId === "virtual-doorbell");
-}
-function composerIsBound(entries) {
-	return entries.some((entry) => entry.capName === "doorbell" && (entry.providerAddonId === "composer" || entry.nativeAddonId === "composer"));
-}
-var DoorbellCompositionMigration = class {
-	deps;
-	rerunRequested = false;
-	inFlight = null;
-	stopped = false;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	request(reason) {
-		if (this.stopped) return;
-		this.rerunRequested = true;
-		if (this.inFlight !== null) return;
-		this.inFlight = this.runUntilQuiet(reason).finally(() => {
-			this.inFlight = null;
-			if (this.rerunRequested && !this.stopped) this.request("coalesced lifecycle event");
-		});
-	}
-	async waitForIdle() {
-		while (this.inFlight !== null || this.rerunRequested) {
-			const current = this.inFlight;
-			if (current !== null) await current;
-			else await Promise.resolve();
-		}
-	}
-	shutdown() {
-		this.stopped = true;
-		this.rerunRequested = false;
-	}
-	async runUntilQuiet(reason) {
-		while (this.rerunRequested && !this.stopped) {
-			this.rerunRequested = false;
-			try {
-				await this.runAttempt(reason);
-			} catch (err) {
-				this.deps.logger.warn("doorbell-source migration: attempt failed", { meta: {
-					reason,
-					error: err instanceof Error ? err.message : String(err)
-				} });
-			}
-		}
-	}
-	async runAttempt(reason) {
-		if (await this.deps.isComplete()) return;
-		const cameras = await this.deps.listCameras();
-		const configuredByCamera = /* @__PURE__ */ new Map();
-		const failedReads = /* @__PURE__ */ new Set();
-		for (const camera of cameras) try {
-			const sources = await this.deps.readSources(camera.id);
-			if (sources.length > 0) configuredByCamera.set(camera.id, sources);
-		} catch (err) {
-			failedReads.add(camera.id);
-			this.warnCamera(camera.id, `could not read source settings (${errorText(err)})`);
-		}
-		if (failedReads.size > 0) return;
-		if (configuredByCamera.size === 0) {
-			await this.deps.markComplete();
-			return;
-		}
-		const camerasById = new Map(cameras.map((camera) => [camera.id, camera]));
-		const sourceIds = [...new Set([...configuredByCamera.values()].flatMap((sources) => sources.map((s) => s.deviceId)))].toSorted((a, b) => a - b);
-		const sourceDevices = await this.deps.listSourceDevices(sourceIds);
-		const devicesById = new Map(sourceDevices.map((device) => [device.id, device]));
-		const bindingIds = [...new Set([...configuredByCamera.keys(), ...sourceIds])].toSorted((a, b) => a - b);
-		const bindingRows = await this.deps.getBindingsBatch(bindingIds);
-		const bindingsById = new Map(bindingRows.map((row) => [row.deviceId, row.entries]));
-		const coreBlocks = this.deps.coreBlocks();
-		if (coreBlocks === null) {
-			for (const cameraId of configuredByCamera.keys()) this.warnCamera(cameraId, "core-blocks provider is not ready");
-			return;
-		}
-		let allSettled = true;
-		for (const [cameraId, configured] of configuredByCamera) {
-			const camera = camerasById.get(cameraId);
-			const entries = bindingsById.get(cameraId);
-			if (camera === void 0 || entries === void 0) {
-				allSettled = false;
-				this.warnCamera(cameraId, "camera or binding row could not be read");
-				continue;
-			}
-			try {
-				const sources = migrationSources(camera, configured, devicesById, bindingsById);
-				const cameraRef = {
-					addonId: camera.addonId,
-					stableId: camera.stableId
-				};
-				const read = await coreBlocks.getCustomization({ ...cameraRef });
-				if (read.state !== "loaded") throw new Error(`customizations are not loaded (${read.reason})`);
-				const view = read.view;
-				if (view !== null && !view.block.enabled) throw new Error(`customization block ${view.block.id} is disabled`);
-				const existingComposition = view?.block.source?.kind === "composition" ? view.block.source.composition : null;
-				if (view !== null && existingComposition === null) throw new Error(`customization block ${view.block.id} has no readable composition`);
-				const existingDoorbell = existingComposition?.features.find((feature) => feature.cap === "doorbell");
-				const wrapperActive = wrapperIsActive(entries);
-				const composerBound = composerIsBound(entries);
-				const crashRecovery = !wrapperActive && composerBound && existingDoorbell?.kind === "fields" && existingDoorbell.enabled === true;
-				const enabled = wrapperActive || crashRecovery;
-				const canonical = buildDoorbellCompositionFeature({
-					camera: cameraRef,
-					sources,
-					enabled
-				});
-				let needsSave = view === null;
-				let composition;
-				if (existingComposition === null) composition = {
-					target: {
-						kind: "existing",
-						device: cameraRef
-					},
-					features: [canonical]
-				};
-				else if (existingDoorbell === void 0) {
-					composition = {
-						...existingComposition,
-						features: [...existingComposition.features, canonical]
-					};
-					needsSave = true;
-				} else if (existingDoorbell.kind === "fields" && sameJson(withoutEnabled(existingDoorbell), withoutEnabled(canonical))) {
-					composition = {
-						...existingComposition,
-						features: existingComposition.features.map((feature) => feature.cap === "doorbell" ? canonical : feature)
-					};
-					needsSave ||= existingDoorbell.enabled !== canonical.enabled;
-				} else throw new Error("an existing doorbell feature is not owned by this migration");
-				if (needsSave) if (view === null) await coreBlocks.createComposition({
-					block: {
-						enabled: true,
-						composition
-					},
-					caller: DOORBELL_COMPOSITION_MIGRATION_CALLER
-				});
-				else await coreBlocks.updateComposition({
-					blockId: view.block.id,
-					expectedUpdatedAt: view.block.updatedAt,
-					block: { composition },
-					caller: DOORBELL_COMPOSITION_MIGRATION_CALLER
-				});
-				if (!enabled) continue;
-				if (!composerBound) {
-					allSettled = false;
-					continue;
-				}
-				if (wrapperActive) {
-					await this.deps.setWrapperActive({
-						deviceId: camera.id,
-						capName: "doorbell",
-						wrapperAddonId: "virtual-doorbell",
-						active: false
-					});
-					this.deps.logger.info("doorbell-source migration: composer owns doorbell; wrapper deactivated", {
-						tags: { deviceId: camera.id },
-						meta: { reason }
-					});
-				}
-			} catch (err) {
-				allSettled = false;
-				this.warnCamera(cameraId, errorText(err));
-			}
-		}
-		if (allSettled) await this.deps.markComplete();
-	}
-	warnCamera(cameraId, reason) {
-		this.deps.logger.warn("doorbell-source migration: camera not migrated", {
-			tags: { deviceId: cameraId },
-			meta: { reason }
-		});
-	}
-};
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/builtins/doorbell/virtual-doorbell.addon.ts
-/** Narrow a raw `doorbell` runtime-state slice to counters (defaults on absence). */
-function parseDoorbellSlice(slice) {
-	const lastPressedAtRaw = slice?.["lastPressedAt"];
-	const countRaw = slice?.["pressCountSinceStart"];
-	return {
-		lastPressedAt: typeof lastPressedAtRaw === "number" ? lastPressedAtRaw : null,
-		pressCountSinceStart: typeof countRaw === "number" && Number.isFinite(countRaw) && countRaw >= 0 ? countRaw : 0
-	};
-}
-/**
-* VirtualDoorbellAddon — WRAPPER over the `doorbell` capability.
-*
-* Turns any binary sensor or switch (contact, motion, flood/gas/CO/smoke,
-* vibration, tamper, generic binary, or a switch) into a doorbell for a
-* camera:
-*
-*   1. The operator binds the wrapper to a camera in the bindings UI
-*      (`defaultActive: false` — never auto-bound).
-*   2. In the camera's Extensions section (the `doorbell-source` slot,
-*      D648/D655) the operator picks one or more SOURCE devices — that is
-*      the ONLY choice. The reaction is derived automatically per
-*      device type: a binary sensor rings when it goes active, a switch
-*      rings when it turns on (see `trigger-engine.ts`). The persisted
-*      shape (`doorbellSources: [{deviceId}]`) stays extensible for a
-*      future custom-trigger override.
-*   3. At runtime the addon watches `EventCategory.DeviceStateChanged`
-*      (binary/switch slice transitions — false→true edge detected). On a
-*      matching, debounced rise it emits `EventCategory.DoorbellOnPressed`
-*      with the CAMERA as source (`{deviceId: cameraId, timestamp}` — the
-*      same shape Reolink's native `emitDoorbellPressed` produces) and
-*      bumps the camera's `doorbell` runtime-state counters via the
-*      standard `deviceState.setCapSlice` plumbing.
-*
-* Fires ONLY for cameras with at least one configured source device that
-* this wrapper is BOUND to. The binding is NOT re-derived on the ring path:
-* it is mirrored in memory (`binding-mirror.ts`) and refreshed on the
-* assignment-reload cadence, because a fallible read must never be able to
-* destroy a one-shot press.
-*/
-var VirtualDoorbellAddon = class extends BaseAddon {
-	engine;
-	compositionMigration = null;
-	providerRegisteredUnsubscribe = null;
-	/** Monotonic guard: assignments are reloaded lazily on trigger traffic. */
-	assignmentsLoadedAt = 0;
-	assignmentsLoading = null;
-	/**
-	* Per-camera mirror of "is this wrapper still the active doorbell
-	* binding". Written ONLY off the ring path; read on it. See
-	* `binding-mirror.ts` for why a single negative read is not believed.
-	*/
-	bindingMirror = /* @__PURE__ */ new Map();
-	/**
-	* Per camera, the last NEGATIVE refresh this addon reported — its state,
-	* the authority's verdict and who else serves the doorbell. A refresh runs
-	* every reload cycle (about once a minute); the same answer repeated is not
-	* news, so it is reported once per change and forgotten on a positive read.
-	* Camera 615 logged the same WARN 607 times in 14 h after D671.
-	*/
-	reportedNegative = /* @__PURE__ */ new Map();
-	/** Cameras whose last durable-authority read THREW — reported once per outage. */
-	durableReadFailing = /* @__PURE__ */ new Set();
-	/**
-	* Per camera, the OTHER providers of `doorbell` the last successful derived
-	* read named (the composer after D671). Written off the ring path with the
-	* mirror; read on it, to decide whether erring open would double a ring.
-	*/
-	servedElsewhere = /* @__PURE__ */ new Map();
-	/** Cameras whose store-over-derived disagreement has been reported, until a derived read agrees. */
-	reportedStoreOverride = /* @__PURE__ */ new Set();
-	constructor() {
-		super({
-			debounceMs: 2e3,
-			assignmentsTtlMs: 6e4
-		});
-		this.engine = new DoorbellTriggerEngine({ debounceMs: 2e3 });
-	}
-	async onInitialize() {
-		this.engine = new DoorbellTriggerEngine({ debounceMs: this.config.debounceMs });
-		this.ctx.logger.info("Virtual doorbell wrapper initialized");
-		this.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
-			const data = parseDeviceStateChanged(event.data);
-			if (!data) return;
-			this.handleStateChanged(data);
-		});
-		const migrationState = this.state(DOORBELL_COMPOSITION_MIGRATION_STATE_KEY, z.object({ complete: z.boolean() }), { complete: false });
-		this.compositionMigration = new DoorbellCompositionMigration({
-			logger: this.ctx.logger.child("doorbell-source-migration"),
-			listCameras: async () => this.ctx.api.deviceManager.listAll.query({
-				isCamera: true,
-				projection: "slim"
-			}),
-			listSourceDevices: async (deviceIds) => this.ctx.api.deviceManager.listAll.query({
-				deviceIds: [...deviceIds],
-				projection: "slim"
-			}),
-			readSources: (cameraId) => this.readDeviceSources(cameraId),
-			getBindingsBatch: async (deviceIds) => this.ctx.api.deviceManager.getBindingsBatch.query({ deviceIds: [...deviceIds] }),
-			coreBlocks: () => this.ctx.capabilities?.get("core-blocks") ?? null,
-			setWrapperActive: (input) => this.ctx.api.deviceManager.setWrapperActive.mutate(input),
-			isComplete: async () => (await migrationState.get()).complete,
-			markComplete: async () => migrationState.set({ complete: true })
-		});
-		this.providerRegisteredUnsubscribe = this.ctx.eventBus.subscribe({ category: "capability:provider-registered" }, (event) => {
-			if (event.data["capability"] !== "core-blocks") return;
-			this.compositionMigration?.request("core-blocks registered");
-		});
-		this.subscribe({ category: EventCategory.DeviceBindingsChanged }, () => {
-			this.compositionMigration?.request("device bindings changed");
-		});
-		this.compositionMigration.request("addon initialized");
-		return [{
-			capability: doorbellCapability,
-			provider: { getStatus: (input) => this.getStatus(input.deviceId) }
-		}, {
-			capability: deviceExtensionCapability,
-			provider: this.buildExtensionProvider()
-		}];
-	}
-	async onShutdown() {
-		this.providerRegisteredUnsubscribe?.();
-		this.providerRegisteredUnsubscribe = null;
-		this.compositionMigration?.shutdown();
-		this.compositionMigration = null;
-	}
-	/**
-	* The `device-extension` provider: the only editor of a camera's trigger
-	* devices since D655 (see `doorbell-extension-slot.ts`).
-	*/
-	buildExtensionProvider() {
-		const toSlotDevice = (d) => ({
-			id: d.id,
-			name: d.name,
-			type: d.type,
-			location: d.location,
-			parentDeviceId: d.parentDeviceId
-		});
-		return createDoorbellExtensionProvider({
-			ownAddonId: this.ownAddonId,
-			logger: this.ctx.logger,
-			readSources: (deviceId) => this.readDeviceSources(deviceId),
-			persistSources: (deviceId, deviceIds) => this.persistDoorbellSources(deviceId, deviceIds),
-			getDevice: async (deviceId) => {
-				const found = await this.ctx.api.deviceManager.getDevice.query({ deviceId });
-				return found ? toSlotDevice(found) : null;
-			},
-			listDevices: async (deviceIds) => (await this.ctx.api.deviceManager.listAll.query({
-				projection: "slim",
-				deviceIds: [...deviceIds]
-			})).map(toSlotDevice),
-			readBindingMirror: (deviceId) => this.mirrorRead(deviceId),
-			readDurableBinding: (deviceId) => this.readDurableAuthority(deviceId),
-			sourceCapableDeviceIds: () => this.ctx.api.deviceManager.listDeviceIdsByCaps.query({ capNames: [...SOURCE_CAPS] }),
-			listFleet: async () => (await this.ctx.api.deviceManager.listAll.query({ projection: "slim" })).map(toSlotDevice)
-		});
-	}
-	async handleStateChanged(data) {
-		if (!isSourceCap(data.capName)) return;
-		await this.ensureAssignments();
-		const result = this.engine.onStateSlice(data.deviceId, data.capName, data.slice);
-		this.logSuppressions(data, result);
-		for (const cameraId of result.fired) await this.fireDoorbell(cameraId, Date.now(), data.deviceId, data.capName);
-	}
-	/**
-	* Say out loud every case where a rise did NOT become a ring. Silence
-	* reads as "never happened": three real presses on camera 615 produced
-	* zero operator-visible lines because the drop logged at `debug`.
-	*/
-	logSuppressions(data, result) {
-		for (const cameraId of result.debounced) this.ctx.logger.info("virtual-doorbell: rise suppressed by the debounce window", {
-			tags: { deviceId: cameraId },
-			meta: {
-				sourceDeviceId: data.deviceId,
-				capName: data.capName
-			}
-		});
-		if (result.ignored === "baseline-seeded-stale-active") {
-			const message = "virtual-doorbell: first slice seen for this source is already ACTIVE but its transition could not be dated — seeded as baseline, a press may have been swallowed";
-			const options = {
-				tags: { deviceId: data.deviceId },
-				meta: { capName: data.capName }
-			};
-			if (this.engine.hasSource(data.deviceId)) this.ctx.logger.warn(message, options);
-			else this.ctx.logger.debug(message, options);
-			return;
-		}
-		if (result.ignored === "no-assignment") this.ctx.logger.debug("virtual-doorbell: rise on a source no camera is wired to", {
-			tags: { deviceId: data.deviceId },
-			meta: { capName: data.capName }
-		});
-	}
-	/**
-	* Ring the camera's virtual doorbell: bump the `doorbell` runtime-state
-	* counters through the canonical `deviceState.setCapSlice` write, and
-	* emit the typed `DoorbellOnPressed` event with the CAMERA as source —
-	* byte-shaped like a native firmware ring so every downstream consumer
-	* (UI toast, notifier rules, exporters) is agnostic to the origin.
-	*
-	* The binding gate here is a pure in-memory read on the path that RINGS:
-	* a `bound` mirror, or an open one on a camera nobody else serves, performs
-	* NO I/O and cannot fail. Every other case asks the durable authority once
-	* before deciding — see `needsDurableRead` and `ringsAfterDurableRead`.
-	*
-	* `sourceDeviceId`/`capName` are the source that produced this rise —
-	* carried through purely so the terminal `pressed` line can name it. Every
-	* suppression branch beside it already reports its source
-	* (`logSuppressions`); the successful path was the one place that did not,
-	* which meant answering "what rang it" required hand-correlating a
-	* timestamp against provider logs (proven live 2026-08-25, camera 615).
-	*/
-	async fireDoorbell(cameraId, timestamp, sourceDeviceId, capName) {
-		const mirror = this.mirrorRead(cameraId);
-		const binding = mirror.state;
-		if (needsDurableRead(mirror) && !await this.ringsAfterDurableRead(cameraId, mirror)) return;
-		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
-			tags: { deviceId: cameraId },
-			meta: { bindingState: binding ?? "never-read" }
-		});
-		try {
-			const next = {
-				lastPressedAt: timestamp,
-				pressCountSinceStart: parseDoorbellSlice(await this.ctx.api.deviceState.getCapSlice.query({
-					deviceId: cameraId,
-					capName: doorbellCapability.name
-				})).pressCountSinceStart + 1
-			};
-			await this.ctx.api.deviceState.setCapSlice.mutate({
-				deviceId: cameraId,
-				capName: doorbellCapability.name,
-				slice: next
-			});
-		} catch (err) {
-			this.ctx.logger.warn("virtual-doorbell: runtime-state update failed", {
-				tags: { deviceId: cameraId },
-				meta: { error: errMsg(err) }
-			});
-		}
-		this.ctx.eventBus.emit(createEvent(EventCategory.DoorbellOnPressed, {
-			type: "device",
-			id: cameraId,
-			deviceId: cameraId,
-			addonId: this.ctx.id
-		}, {
-			deviceId: cameraId,
-			timestamp
-		}));
-		this.ctx.logger.info("virtual-doorbell: pressed", {
-			tags: { deviceId: cameraId },
-			meta: {
-				timestamp,
-				sourceDeviceId,
-				capName
-			}
-		});
-	}
-	/**
-	* The addon id as the REGISTRY and the bindings store spell it.
-	*
-	* `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
-	* a forked runner does not, and this builtin runs in hub-main. Comparing
-	* the raw `ctx.id` to a `providerAddonId` was false for every entry for
-	* twelve hours on 2026-08-07 (D72).
-	*/
-	get ownAddonId() {
-		return bareAddonId(this.ctx.id);
-	}
-	/**
-	* One read of the DERIVED binding view. `null` when the read could not be
-	* answered at all — which carries no information and must leave the mirror
-	* untouched.
-	*/
-	async readDerivedBinding(cameraId) {
-		try {
-			const bindings = await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId });
-			return {
-				bound: entriesBindWrapper(bindings.entries, doorbellCapability.name, this.ownAddonId),
-				entries: bindings.entries
-			};
-		} catch (err) {
-			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
-				tags: { deviceId: cameraId },
-				meta: {
-					error: errMsg(err),
-					bindingState: this.bindingMirror.get(cameraId)
-				}
-			});
-			return null;
-		}
-	}
-	/**
-	* One read of the DURABLE authority: the wrapper activation device-manager
-	* STORED for this camera (`deviceManager.getWrapperActivation`, D675) — the
-	* row the operator's bindings toggle writes. `deviceManager.getBindings` is
-	* a VIEW derived from it plus the capability registry.
-	*
-	* This is deliberately NOT `getBindings`. The derived view folds the store
-	* together with the capability registry, `defaultActive` auto-binding and
-	* the cluster native-cap feeds — any of which can make it disagree with
-	* what the operator actually persisted, and one of which (an addon-id
-	* spelling mismatch) made it disagree *systematically* while looking
-	* exactly like a genuine unbind. The raw row cannot: it is what the
-	* bindings toggle wrote, and it grades its own trustworthiness (D44).
-	*
-	* A read that throws is reported when the outage STARTS and when it ends —
-	* never per read: this runs on every reload cycle.
-	*/
-	async readDurableAuthority(cameraId) {
-		let read;
-		try {
-			read = await this.ctx.api.deviceManager.getWrapperActivation.query({
-				deviceId: cameraId,
-				capName: doorbellCapability.name
-			});
-		} catch (err) {
-			read = {
-				kind: "failed",
-				error: errMsg(err)
-			};
-		}
-		if (read.kind === "failed") {
-			if (!this.durableReadFailing.has(cameraId)) {
-				this.durableReadFailing.add(cameraId);
-				this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing (reported once until it answers again)", {
-					tags: { deviceId: cameraId },
-					meta: { error: read.error }
-				});
-			}
-			return "unreadable";
-		}
-		if (this.durableReadFailing.delete(cameraId)) this.ctx.logger.info("virtual-doorbell: the durable bindings store answers again", { tags: { deviceId: cameraId } });
-		return durableVerdictOf(read, this.ownAddonId);
-	}
-	/**
-	* Reconcile `cameraId`'s mirror against the authority. Runs on the
-	* assignment-reload cadence, never while firing — and it runs on EVERY
-	* cycle regardless of the current verdict, so a camera sitting in
-	* `unbound` returns to `bound` on its own the moment the authority says
-	* so. There is no latch here that an operator has to clear.
-	*
-	* A positive derived read is believed immediately. A NEGATIVE one never
-	* is: the durable authority is asked, and it outranks the derived view in
-	* the direction that destroys work. Only when the authority agrees does
-	* the negative get folded, and even then `nextBindingState` still wants a
-	* second consecutive one (D49).
-	*/
-	async refreshBindingMirror(cameraId) {
-		const derived = await this.readDerivedBinding(cameraId);
-		if (derived === null) return;
-		const servedBy = otherProvidersOf(derived.entries, doorbellCapability.name, this.ownAddonId);
-		this.servedElsewhere.set(cameraId, servedBy);
-		if (derived.bound) {
-			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
-			this.reportedNegative.delete(cameraId);
-			this.reportedStoreOverride.delete(cameraId);
-			return;
-		}
-		const authority = await this.readDurableAuthority(cameraId);
-		const entries = summariseEntries(derived.entries);
-		if (authority === "bound") {
-			this.reportedNegative.delete(cameraId);
-			if (!this.reportedStoreOverride.has(cameraId)) {
-				this.reportedStoreOverride.add(cameraId);
-				this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store (reported once until they agree)", {
-					tags: { deviceId: cameraId },
-					meta: {
-						ownAddonId: this.ownAddonId,
-						entries
-					}
-				});
-			}
-			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
-			return;
-		}
-		this.reportedStoreOverride.delete(cameraId);
-		const previous = this.bindingMirror.get(cameraId);
-		const next = nextBindingState(previous, false);
-		this.bindingMirror.set(cameraId, next);
-		this.reportNegativeRefresh(cameraId, {
-			from: previous ?? "never-read",
-			to: next,
-			authority,
-			servedBy,
-			entries
-		});
-	}
-	/** The ring gate's in-memory input for one camera — no I/O. */
-	mirrorRead(cameraId) {
-		return {
-			state: this.bindingMirror.get(cameraId),
-			servedBy: this.servedElsewhere.get(cameraId) ?? []
-		};
-	}
-	/**
-	* Report a negative refresh ONCE per change of what it says (D391: a
-	* repeated identical line is noise that buries the next real one).
-	*
-	* The level follows what the answer MEANS:
-	*   - the durable store could not grade it (`unreadable`) — WARN: the
-	*     camera's ring now depends on erring open, and nobody can say whether
-	*     that is right;
-	*   - the store CONFIRMS the wrapper is not bound — an operator's unbind or
-	*     the D671 cutover to a composition. That is a state, not an anomaly:
-	*     INFO when it is believed (`unbound`), DEBUG for the first,
-	*     not-yet-believed read.
-	*/
-	reportNegativeRefresh(cameraId, report) {
-		const key = `${report.to}|${report.authority}|${report.servedBy.join(",")}`;
-		if (this.reportedNegative.get(cameraId) === key) return;
-		this.reportedNegative.set(cameraId, key);
-		const options = {
-			tags: { deviceId: cameraId },
-			meta: {
-				from: report.from,
-				to: report.to,
-				ownAddonId: this.ownAddonId,
-				durableAuthority: report.authority,
-				doorbellServedBy: report.servedBy,
-				entries: report.entries
-			}
-		};
-		if (report.authority === "unreadable") {
-			this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper and the durable store cannot confirm it — a press still rings", options);
-			return;
-		}
-		const message = report.servedBy.length > 0 ? `virtual-doorbell: wrapper deactivated on this camera — its doorbell is served by ${report.servedBy.join(", ")}` : "virtual-doorbell: wrapper deactivated on this camera — the bindings store confirms it";
-		if (report.to === "unbound") this.ctx.logger.info(message, options);
-		else this.ctx.logger.debug(message, options);
-	}
-	/**
-	* A real press arrived on a camera the in-memory gate cannot clear on its
-	* own: the mirror is `unbound`, or it is short of `bound` while another
-	* provider serves the doorbell. Decide, with ONE read of the durable
-	* authority, whether this wrapper rings.
-	*
-	* D49 forbade I/O on the ring path because the read it would have made was
-	* the same fallible derived read that caused the problem. This read is
-	* different in both directions: it is the authority rather than a view of
-	* it, and it is paid ONLY where erring open could be wrong — a dropped ring
-	* (an `unbound` mirror) or a DOUBLED one (another provider rings this
-	* camera). A ring is rare and one query is cheap. An unreadable store still
-	* rings: it carries no information.
-	*
-	* Returns `true` when the ring must proceed.
-	*/
-	async ringsAfterDurableRead(cameraId, mirror) {
-		const binding = mirror.state;
-		const authority = await this.readDurableAuthority(cameraId);
-		const verdict = ringVerdict(mirror, authority);
-		switch (verdict) {
-			case "rings":
-				this.bindingMirror.set(cameraId, "bound");
-				this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror did not confirm this wrapper but the durable bindings store still names it; the mirror has been repaired", {
-					tags: { deviceId: cameraId },
-					meta: {
-						bindingState: binding ?? "never-read",
-						doorbellServedBy: mirror.servedBy,
-						ownAddonId: this.ownAddonId
-					}
-				});
-				return verdictRings(verdict);
-			case "unknown":
-				this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
-					tags: { deviceId: cameraId },
-					meta: {
-						bindingState: binding,
-						ownAddonId: this.ownAddonId
-					}
-				});
-				return verdictRings(verdict);
-			case "silent": {
-				const derived = await this.readDerivedBinding(cameraId);
-				const servedBy = derived === null ? mirror.servedBy : otherProvidersOf(derived.entries, doorbellCapability.name, this.ownAddonId);
-				const options = {
-					tags: { deviceId: cameraId },
-					meta: {
-						bindingState: binding,
-						ownAddonId: this.ownAddonId,
-						durableAuthority: authority,
-						doorbellServedBy: servedBy,
-						entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
-					}
-				};
-				if (servedBy.length > 0) this.ctx.logger.info(`virtual-doorbell: press left to ${servedBy.join(", ")} — this wrapper is deactivated on this camera`, options);
-				else this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", options);
-				return verdictRings(verdict);
-			}
-			case "rings-pending":
-			case "rings-unconfirmed":
-				this.ctx.logger.warn(`virtual-doorbell: ringing although ${mirror.servedBy.join(", ")} serves this doorbell — the durable bindings store could not confirm this wrapper was deactivated`, {
-					tags: { deviceId: cameraId },
-					meta: {
-						bindingState: binding ?? "never-read",
-						durableAuthority: authority,
-						ownAddonId: this.ownAddonId
-					}
-				});
-				return verdictRings(verdict);
-		}
-	}
-	/**
-	* Lazily (re)build the camera→source assignment set from every
-	* camera's device store. TTL-bounded so devices/settings appearing
-	* after boot are picked up without a save; invalidated eagerly by
-	* `persistDoorbellSources`.
-	*/
-	async ensureAssignments() {
-		const now = Date.now();
-		if (this.assignmentsLoadedAt > 0 && now - this.assignmentsLoadedAt < this.config.assignmentsTtlMs) return;
-		if (this.assignmentsLoading) return this.assignmentsLoading;
-		this.assignmentsLoading = this.loadAssignments().then(() => {
-			this.assignmentsLoadedAt = Date.now();
-		}).catch((err) => {
-			this.ctx.logger.warn("virtual-doorbell: assignment reload failed", { meta: { error: errMsg(err) } });
-		}).finally(() => {
-			this.assignmentsLoading = null;
-		});
-		return this.assignmentsLoading;
-	}
-	async loadAssignments() {
-		if (!this.ctx.settings) {
-			this.ctx.logger.warn("virtual-doorbell: no settings store — every camera reads ZERO trigger sources, no doorbell can ring");
-			return;
-		}
-		const cameras = (await this.ctx.api.deviceManager.listAll.query({})).filter((d) => d.type === DeviceType.Camera);
-		const assignments = [];
-		const configuredCameras = [];
-		for (const camera of cameras) {
-			const sources = await this.readDeviceSources(camera.id);
-			if (sources.length > 0) configuredCameras.push(camera.id);
-			for (const source of sources) assignments.push({
-				cameraId: camera.id,
-				sourceDeviceId: source.deviceId
-			});
-		}
-		for (const cameraId of configuredCameras) await this.refreshBindingMirror(cameraId);
-		const hadAssignments = this.engine.getAssignments().length > 0;
-		this.engine.setAssignments(assignments);
-		if (hadAssignments && assignments.length === 0) this.ctx.logger.warn("virtual-doorbell: assignment reload went from configured to EMPTY — every camera just lost its trigger sources");
-		this.ctx.logger.debug("virtual-doorbell: assignments loaded", { meta: {
-			count: assignments.length,
-			configuredCameras: configuredCameras.length
-		} });
-	}
-	invalidateAssignments() {
-		this.assignmentsLoadedAt = 0;
-	}
-	/**
-	* Status from the kernel-managed `doorbell` runtime-state slice —
-	* the wrapper keeps NO parallel counter fields (the slice is the
-	* single source of truth, persisted across restarts).
-	*/
-	async getStatus(deviceId) {
-		try {
-			return parseDoorbellSlice(await this.ctx.api.deviceState.getCapSlice.query({
-				deviceId,
-				capName: doorbellCapability.name
-			}));
-		} catch (err) {
-			this.ctx.logger.warn("virtual-doorbell: getCapSlice failed during getStatus", {
-				tags: { deviceId },
-				meta: { error: errMsg(err) }
-			});
-			return null;
-		}
-	}
-	/**
-	* The camera's configured doorbell sources, parsed tolerantly (new
-	* `doorbellSources` shape + legacy single-source migration).
-	*/
-	async readDeviceSources(deviceId) {
-		if (!this.ctx.settings) return [];
-		return parseDoorbellSources(await this.ctx.settings.readDeviceStore(deviceId));
-	}
-	/**
-	* THE write path for a camera's trigger sources — the `doorbell-source`
-	* extension slot lands here (D648; its only caller since D655): normalise
-	* to `doorbellSources: [{deviceId}]`, strip the legacy keys, and invalidate
-	* the assignment cache so the next rise (and the binding mirror's next
-	* refresh, off the ring path) sees the new wiring.
-	*/
-	async persistDoorbellSources(deviceId, value) {
-		if (!this.ctx.settings) throw new Error("[virtual-doorbell] settings store unavailable — cannot persist per-device settings");
-		const current = await this.ctx.settings.readDeviceStore(deviceId);
-		await this.ctx.settings.writeDeviceStore(deviceId, applyDoorbellSourcesPatch(current, value));
-		this.invalidateAssignments();
-	}
-};
-//#endregion
-export { VirtualDoorbellAddon, VirtualDoorbellAddon as default };