@camstack/system 1.2.57 → 1.2.59

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
+const require_manifest_python_deps = require("./manifest-python-deps-d4acYXVV.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-Ck4-9K9m.mjs";
+import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-CX5tGRqf.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as v8 from "node:v8";

package/dist/addon-utils.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("./chunk-Cek0wNdY.js");
-const require_model_download_service = require("./model-download-service-hf0ookyy.js");
+const require_model_download_service = require("./model-download-service-Cpc6SWzV.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
 exports.ModelDownloadService = require_model_download_service.ModelDownloadService;

package/dist/addon-utils.mjs

@@ -1,3 +1,3 @@
-import { c as getModelFilePath, d as contentTypeFor, i as downloadFile, l as isModelDownloaded, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
+import { c as getModelFilePath, d as contentTypeFor, i as downloadFile, l as isModelDownloaded, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-D8B-4ktF.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 export { CustomActionRegistry, ModelDownloadService, collectModelFiles, contentTypeFor, createFileDataPlaneHandler, deleteModelFromDisk, downloadFile, ensureModel, getModelFilePath, isModelDownloaded, parseRangeHeader };

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
-let node_crypto = require("node:crypto");
 //#region src/builtins/addon-pages-aggregator/dedupe-pages.ts
 /** Stable identity for an addon page, independent of which node reported it. */
 function pageKey(info) {

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { Lt as EventCategory, dt as BaseAddon, m as addonPagesCapability, ut as errMsg } from "../../dist-DhL_zGRT.mjs";
+import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
+import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
-import { createHash, randomUUID } from "node:crypto";
 //#region src/builtins/addon-pages-aggregator/dedupe-pages.ts
 /** Stable identity for an addon page, independent of which node reported it. */
 function pageKey(info) {

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
-let node_crypto = require("node:crypto");
 //#region src/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.ts
 /**
 * Addon Widgets Aggregator — hub-local builtin that owns the singleton

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,8 +1,8 @@
-import { Lt as EventCategory, dt as BaseAddon, g as addonWidgetsCapability, ut as errMsg } from "../../dist-DhL_zGRT.mjs";
+import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
+import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
-import { createHash, randomUUID } from "node:crypto";
 //#region src/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.ts
 /**
 * Addon Widgets Aggregator — hub-local builtin that owns the singleton

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, _ as alertsCapability, dt as BaseAddon, n as AlertSchema, ut as errMsg, wt as createEvent } from "../../dist-DhL_zGRT.mjs";
+import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,14 +3,14 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
+let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
 let node_path$1 = require_chunk.__toESM(node_path, 1);
 node_path = require_chunk.__toESM(node_path);
-let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_fs_promises$1 = require_chunk.__toESM(node_fs_promises, 1);
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,9 +1,9 @@
-import { Lt as EventCategory, b as backupCapability, dt as BaseAddon } from "../../dist-DhL_zGRT.mjs";
+import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
+import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";
 import path, { basename, join, posix, win32 } from "node:path";
-import { randomBytes, randomUUID } from "node:crypto";
 import * as fsp from "node:fs/promises";
 import jn from "node:fs/promises";
 import { Buffer as Buffer$1 } from "buffer";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { U as logDestinationCapability, dt as BaseAddon } from "../../dist-DhL_zGRT.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
+let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
-let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
 //#region src/builtins/core-blocks/block-package.ts

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,7 +1,7 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { S as coreBlocksCapability, dt as BaseAddon, o as CoreBlockSchema } from "../../dist-DhL_zGRT.mjs";
-import * as path$1 from "node:path";
+import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-BqJJWCS8.mjs";
 import { randomUUID } from "node:crypto";
+import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 //#region src/builtins/core-blocks/block-package.ts
 /**

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BupxnZOi.js");
+const require_dist = require("../../dist-CV6XTApk.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
@@ -1644,7 +1644,7 @@ async function getBindings(deps, input) {
 			entries.push({
 				capName,
 				kind: "linked",
-				providerAddonId: deps.ctx.id,
+				providerAddonId: require_dist.bareAddonId(deps.ctx.id),
 				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
 				nativeAddonId: ""
 			});

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as setByPath, A as enumerateItemArrayFields, D as deviceStatusCapability, E as deviceStateCapability, F as getByPath, It as sleep, Lt as EventCategory, M as evaluateLinkExpression, T as deviceManagerCapability, Y as parseStreamParamsFormPatch, _t as DeviceType, a as CAP_NAMES_WITH_STATUS, at as toExpressionValue, bt as WELL_KNOWN_TAB_MAP, dt as BaseAddon, gt as DeviceRole, ht as DeviceFeature, j as enumerateSchemaFields, kt as isDeviceConfigCap, q as normalizeUnit, s as DeviceStatusSchema, st as validateExpressionSource, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, ut as errMsg, v as applyTransform, x as buildStreamParamsConfigSchema } from "../../dist-DhL_zGRT.mjs";
+import { D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as sleep, S as buildStreamParamsConfigSchema, St as WELL_KNOWN_TAB_MAP, Y as normalizeUnit, Z as parseStreamParamsFormPatch, _t as DeviceFeature, a as CAP_NAMES_WITH_STATUS, ft as errMsg, j as enumerateItemArrayFields, jt as isDeviceConfigCap, lt as validateExpressionSource, pt as BaseAddon, s as DeviceStatusSchema, st as toExpressionValue, t as ALL_CAPABILITY_DEFINITIONS, tt as setByPath, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceRole, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-BqJJWCS8.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
@@ -1639,7 +1639,7 @@ async function getBindings(deps, input) {
 			entries.push({
 				capName,
 				kind: "linked",
-				providerAddonId: deps.ctx.id,
+				providerAddonId: bareAddonId(deps.ctx.id),
 				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
 				nativeAddonId: ""
 			});

package/dist/builtins/doorbell/binding-mirror.d.ts

@@ -31,6 +31,31 @@
  * evidence the wrapper was bound. The cost of erring open is a spurious
  * ring on a camera the operator unbound but left configured, for at most
  * two reload cycles. The cost of erring closed is the press.
+ *
+ * ─────────────────────────────────────────────────────────────────────
+ * 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+ * matters more than the fix. `refreshBindingMirror` matched the binding with
+ * `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+ * not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+ * hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+ * carries the bare form. So for this builtin the comparison was false for
+ * every entry, forever — not a blip. Corroboration only defends against a
+ * TRANSIENT bad read; two systematically-wrong reads agree with each other,
+ * and the mirror latched `unbound` with no way back except an operator
+ * opening the settings page. A real press on camera 615 was dropped.
+ *
+ * Two things follow, and both are now load-bearing here:
+ *
+ *   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+ *      never a raw `===`.
+ *   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+ *      input. Before a negative is believed — and again on the ring path
+ *      before a press is destroyed — the DURABLE authority is consulted
+ *      directly ({@link readDurableWrapperBinding} over the `device-manager`
+ *      addon store's `deviceBindings` map). That read carries a discriminator
+ *      the derived view genuinely cannot offer: a store answering from an
+ *      empty snapshot (D44) has no `deviceBindings` key at all, while a
+ *      genuine unbind leaves the key present and merely omits the row.
  */
 /**
  * `bound` — a read saw the wrapper's activation.
@@ -48,3 +73,43 @@ export declare function nextBindingState(previous: DoorbellBindingState | undefi
 export declare function allowsRing(state: DoorbellBindingState | undefined): boolean;
 /** True only when a read has positively confirmed the binding. */
 export declare function hasConfirmedBinding(state: DoorbellBindingState | undefined): boolean;
+/** The fields of a `DeviceBindingEntry` this module reasons about. */
+export interface BindingEntryView {
+    readonly capName: string;
+    readonly kind: string;
+    readonly providerAddonId: string;
+}
+/**
+ * Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+ * of `capName`?
+ *
+ * `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+ * which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+ * while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+ */
+export declare function entriesBindWrapper(entries: ReadonlyArray<BindingEntryView>, capName: string, ownAddonId: string): boolean;
+/**
+ * Render binding entries for a log line. A systematic wrong answer and a
+ * one-off blip produce the same VERDICT; only the entries themselves tell
+ * them apart, so a negative read never gets to report just its conclusion.
+ */
+export declare function summariseEntries(entries: ReadonlyArray<BindingEntryView>): string[];
+/**
+ * `bound` / `unbound` — the durable store answered, and this is its answer.
+ * `unreadable` — the store could not be read, or answered from an empty
+ * snapshot (D44). It carries NO information and must never destroy work.
+ */
+export type DurableBindingVerdict = 'bound' | 'unbound' | 'unreadable';
+/**
+ * Read the DURABLE authority — the `device-manager` addon store's
+ * `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+ * `capName` on `deviceId`".
+ *
+ * This is the input the derived `getBindings` view is not: it is the row the
+ * operator's toggle actually writes, with no registry resolution, no
+ * `defaultActive` auto-binding and no cross-node cap folding in between. It
+ * also grades its own trustworthiness, which `getBindings` cannot: the
+ * absence of the `deviceBindings` KEY is the signature of a store answering
+ * from an empty snapshot, whereas a genuine unbind leaves the key present.
+ */
+export declare function readDurableWrapperBinding(record: unknown, deviceId: number, capName: string, ownAddonId: string): DurableBindingVerdict;

package/dist/builtins/doorbell/virtual-doorbell.addon.d.ts

@@ -67,23 +67,68 @@ export declare class VirtualDoorbellAddon extends BaseAddon<VirtualDoorbellAddon
      * byte-shaped like a native firmware ring so every downstream consumer
      * (UI toast, notifier rules, exporters) is agnostic to the origin.
      *
-     * The binding gate here is a pure in-memory read. It performs NO I/O and
-     * cannot fail: the whole point of the mirror is that the ring path can no
-     * longer be talked out of ringing by a store that answered badly.
+     * The binding gate here is a pure in-memory read on the path that RINGS:
+     * an open mirror performs NO I/O and cannot fail. The mirror can only
+     * DESTROY a press through the one branch below, and that branch is not
+     * allowed to be the last word — see `ringsDespiteUnboundMirror`.
      */
     private fireDoorbell;
     /**
-     * Fold one bindings read for `cameraId` into the mirror. Runs on the
-     * assignment-reload cadence, never while firing.
+     * The addon id as the REGISTRY and the bindings store spell it.
      *
-     * A read that THROWS carries no information and leaves the mirror exactly
-     * as it was — the previous verdict keeps standing. A read that succeeds
-     * but omits our activation only ARMS a revocation; `nextBindingState`
-     * requires a second consecutive negative before the camera goes silent,
-     * because a genuine unbind and a store answering from an empty snapshot
-     * (D44) are indistinguishable in a single response.
+     * `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+     * a forked runner does not, and this builtin runs in hub-main. Comparing
+     * the raw `ctx.id` to a `providerAddonId` was false for every entry for
+     * twelve hours on 2026-08-07 (D72).
+     */
+    private get ownAddonId();
+    /**
+     * One read of the DERIVED binding view. `null` when the read could not be
+     * answered at all — which carries no information and must leave the mirror
+     * untouched.
+     */
+    private readDerivedBinding;
+    /**
+     * One read of the DURABLE authority: the `device-manager` addon store's
+     * `deviceBindings` map, straight from the settings DB.
+     *
+     * This is deliberately NOT `getBindings`. The derived view folds the store
+     * together with the capability registry, `defaultActive` auto-binding and
+     * the cluster native-cap feeds — any of which can make it disagree with
+     * what the operator actually persisted, and one of which (an addon-id
+     * spelling mismatch) made it disagree *systematically* while looking
+     * exactly like a genuine unbind. The raw row cannot: it is what the
+     * bindings toggle wrote, and it grades its own trustworthiness (D44).
+     */
+    private readDurableAuthority;
+    /**
+     * Reconcile `cameraId`'s mirror against the authority. Runs on the
+     * assignment-reload cadence, never while firing — and it runs on EVERY
+     * cycle regardless of the current verdict, so a camera sitting in
+     * `unbound` returns to `bound` on its own the moment the authority says
+     * so. There is no latch here that an operator has to clear.
+     *
+     * A positive derived read is believed immediately. A NEGATIVE one never
+     * is: the durable authority is asked, and it outranks the derived view in
+     * the direction that destroys work. Only when the authority agrees does
+     * the negative get folded, and even then `nextBindingState` still wants a
+     * second consecutive one (D49).
      */
     private refreshBindingMirror;
+    /**
+     * The mirror says `unbound` and a real press just arrived. Decide, with
+     * ONE read of the durable authority, whether to destroy it.
+     *
+     * D49 forbade I/O on the ring path because the read it would have made was
+     * the same fallible derived read that caused the problem. This read is
+     * different in both directions: it is the authority rather than a view of
+     * it, and it is paid ONLY on the branch that would otherwise drop a press —
+     * a ring is rare, one query is cheap, and a dropped ring has no retry, no
+     * reconcile and nothing downstream that notices.
+     *
+     * Returns `true` when the ring must proceed.
+     */
+    private ringsDespiteUnboundMirror;
     /**
      * Record a binding we observed FIRST-HAND. Both callers are cap methods
      * the router only reaches by resolving this wrapper for this device —