@camstack/system 1.2.58 → 1.2.60

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, O as doorbellCapability, _t as DeviceType, dt as BaseAddon, ut as errMsg, wt as createEvent } from "../../dist-UrXyJ9Zm.mjs";
+import { B as isSameAddonId, Et as createEvent, ft as errMsg, k as doorbellCapability, pt as BaseAddon, x as bareAddonId, yt as DeviceType, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over
@@ -216,6 +216,65 @@ var DoorbellTriggerEngine = class {
 //#endregion
 //#region src/builtins/doorbell/binding-mirror.ts
 /**
+* The virtual-doorbell wrapper's in-memory mirror of ONE durable fact per
+* camera: is this wrapper still the active `doorbell` binding for it?
+*
+* WHY A MIRROR AND NOT A READ. A doorbell press is a one-shot event: there
+* is no retry, no reconcile, nothing downstream that can notice it went
+* missing. The wrapper used to re-derive the binding on the ring path via
+* `deviceManager.getBindings` and treat ANY answer that omitted its own
+* activation as "the operator unbound this". On 2026-08-04/05 camera 615
+* rang zero times out of three real presses: the binding was persisted (a
+* same-day backup taken before the presses proves it, and the same process
+* later returned it correctly to a tRPC query), but the store answered
+* transiently without it — `getBindings` reads the device-manager addon
+* store, which is exactly the surface that can silently answer `{}` (D44,
+* `addon-registry.service.ts`). Three presses, three drops, at `debug`.
+*
+* WHY CORROBORATION AND NOT A BETTER DISCRIMINATOR. There isn't one. A
+* genuinely unbound pure-wrapper cap and a store answering from an empty
+* snapshot produce the SAME `getBindings` response — no `doorbell` entry,
+* with the camera's native entries (snapshot, motion, …) still present in
+* both cases because those come from the capability registry, not the
+* store. The response cannot be graded. What CAN be graded is repetition: a
+* real unbind is permanent and every later read agrees, a store blip does
+* not survive the next read. So a negative read ARMS the revocation and a
+* second consecutive negative applies it.
+*
+* ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
+* the ring path at all means the camera has a configured trigger source,
+* and a source can only be configured through this wrapper's own
+* binding-gated settings surface — so a configured source is itself
+* evidence the wrapper was bound. The cost of erring open is a spurious
+* ring on a camera the operator unbound but left configured, for at most
+* two reload cycles. The cost of erring closed is the press.
+*
+* ─────────────────────────────────────────────────────────────────────
+* 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
+* matters more than the fix. `refreshBindingMirror` matched the binding with
+* `entry.providerAddonId === this.ctx.id`. The two addon-context factories do
+* not spell `ctx.id` the same way: a forked addon gets `virtual-doorbell`, a
+* hub-main BUILTIN gets `addon:virtual-doorbell`. Every entry on the wire
+* carries the bare form. So for this builtin the comparison was false for
+* every entry, forever — not a blip. Corroboration only defends against a
+* TRANSIENT bad read; two systematically-wrong reads agree with each other,
+* and the mirror latched `unbound` with no way back except an operator
+* opening the settings page. A real press on camera 615 was dropped.
+*
+* Two things follow, and both are now load-bearing here:
+*
+*   1. The comparison goes through `isSameAddonId` ({@link entriesBindWrapper}),
+*      never a raw `===`.
+*   2. The DERIVED view (`deviceManager.getBindings`) is no longer the sole
+*      input. Before a negative is believed — and again on the ring path
+*      before a press is destroyed — the DURABLE authority is consulted
+*      directly ({@link readDurableWrapperBinding} over the `device-manager`
+*      addon store's `deviceBindings` map). That read carries a discriminator
+*      the derived view genuinely cannot offer: a store answering from an
+*      empty snapshot (D44) has no `deviceBindings` key at all, while a
+*      genuine unbind leaves the key present and merely omits the row.
+*/
+/**
 * Fold one SUCCESSFUL bindings read into the mirror. A read that failed must
 * never reach this function — an unanswerable store carries no information
 * and must leave the mirror exactly as it was.
@@ -232,6 +291,52 @@ function allowsRing(state) {
 function hasConfirmedBinding(state) {
 	return state === "bound";
 }
+/**
+* Does this list of binding entries name `ownAddonId` as the ACTIVE WRAPPER
+* of `capName`?
+*
+* `isSameAddonId` is the whole point: `ownAddonId` is an `AddonContext.id`,
+* which is prefixed (`addon:…`) in hub-main and bare in a forked runner,
+* while `providerAddonId` is always bare. A raw `===` here is the D72 bug.
+*/
+function entriesBindWrapper(entries, capName, ownAddonId) {
+	return entries.some((entry) => entry.capName === capName && entry.kind === "wrapped" && isSameAddonId(entry.providerAddonId, ownAddonId));
+}
+/**
+* Render binding entries for a log line. A systematic wrong answer and a
+* one-off blip produce the same VERDICT; only the entries themselves tell
+* them apart, so a negative read never gets to report just its conclusion.
+*/
+function summariseEntries(entries) {
+	return entries.map((entry) => `${entry.capName}:${entry.kind}:${entry.providerAddonId}`);
+}
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Read the DURABLE authority — the `device-manager` addon store's
+* `deviceBindings` map — for "is `ownAddonId` the active wrapper of
+* `capName` on `deviceId`".
+*
+* This is the input the derived `getBindings` view is not: it is the row the
+* operator's toggle actually writes, with no registry resolution, no
+* `defaultActive` auto-binding and no cross-node cap folding in between. It
+* also grades its own trustworthiness, which `getBindings` cannot: the
+* absence of the `deviceBindings` KEY is the signature of a store answering
+* from an empty snapshot, whereas a genuine unbind leaves the key present.
+*/
+function readDurableWrapperBinding(record, deviceId, capName, ownAddonId) {
+	if (!isRecord$2(record)) return "unreadable";
+	const deviceBindings = record["deviceBindings"];
+	if (!isRecord$2(deviceBindings)) return "unreadable";
+	const perDevice = deviceBindings[String(deviceId)];
+	if (!isRecord$2(perDevice)) return "unbound";
+	const activation = perDevice[capName];
+	if (!isRecord$2(activation)) return "unbound";
+	const wrapperAddonId = activation["wrapperAddonId"];
+	if (typeof wrapperAddonId !== "string") return "unbound";
+	return isSameAddonId(wrapperAddonId, ownAddonId) ? "bound" : "unbound";
+}
 //#endregion
 //#region src/builtins/doorbell/doorbell-settings.ts
 /**
@@ -325,6 +430,13 @@ function applyDoorbellSourcesPatch(current, patchValue) {
 }
 //#endregion
 //#region src/builtins/doorbell/virtual-doorbell.addon.ts
+/**
+* The addon whose store IS the durable authority on wrapper activations.
+* `deviceBindings[<deviceId>][<capName>].wrapperAddonId` is the row the
+* operator's bindings toggle writes; `deviceManager.getBindings` is a VIEW
+* derived from it plus the capability registry.
+*/
+var DEVICE_MANAGER_ADDON_ID = "device-manager";
 /** Structural narrowing helper for untrusted bus payloads. */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -464,19 +576,14 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 	* byte-shaped like a native firmware ring so every downstream consumer
 	* (UI toast, notifier rules, exporters) is agnostic to the origin.
 	*
-	* The binding gate here is a pure in-memory read. It performs NO I/O and
-	* cannot fail: the whole point of the mirror is that the ring path can no
-	* longer be talked out of ringing by a store that answered badly.
+	* The binding gate here is a pure in-memory read on the path that RINGS:
+	* an open mirror performs NO I/O and cannot fail. The mirror can only
+	* DESTROY a press through the one branch below, and that branch is not
+	* allowed to be the last word — see `ringsDespiteUnboundMirror`.
 	*/
 	async fireDoorbell(cameraId, timestamp) {
 		const binding = this.bindingMirror.get(cameraId);
-		if (!allowsRing(binding)) {
-			this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
-				tags: { deviceId: cameraId },
-				meta: { bindingState: binding }
-			});
-			return;
-		}
+		if (!allowsRing(binding) && !await this.ringsDespiteUnboundMirror(cameraId, binding)) return;
 		if (!hasConfirmedBinding(binding)) this.ctx.logger.warn("virtual-doorbell: ringing on an unconfirmed binding — the bindings store has not corroborated an unbind, and a one-shot press is never dropped on an unproven read", {
 			tags: { deviceId: cameraId },
 			meta: { bindingState: binding ?? "never-read" }
@@ -515,20 +622,28 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 		});
 	}
 	/**
-	* Fold one bindings read for `cameraId` into the mirror. Runs on the
-	* assignment-reload cadence, never while firing.
+	* The addon id as the REGISTRY and the bindings store spell it.
 	*
-	* A read that THROWS carries no information and leaves the mirror exactly
-	* as it was — the previous verdict keeps standing. A read that succeeds
-	* but omits our activation only ARMS a revocation; `nextBindingState`
-	* requires a second consecutive negative before the camera goes silent,
-	* because a genuine unbind and a store answering from an empty snapshot
-	* (D44) are indistinguishable in a single response.
+	* `ctx.id` does NOT: hub-main prefixes it (`addon:virtual-doorbell`) while
+	* a forked runner does not, and this builtin runs in hub-main. Comparing
+	* the raw `ctx.id` to a `providerAddonId` was false for every entry for
+	* twelve hours on 2026-08-07 (D72).
 	*/
-	async refreshBindingMirror(cameraId) {
-		let entries;
+	get ownAddonId() {
+		return bareAddonId(this.ctx.id);
+	}
+	/**
+	* One read of the DERIVED binding view. `null` when the read could not be
+	* answered at all — which carries no information and must leave the mirror
+	* untouched.
+	*/
+	async readDerivedBinding(cameraId) {
 		try {
-			entries = (await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId })).entries;
+			const bindings = await this.ctx.api.deviceManager.getBindings.query({ deviceId: cameraId });
+			return {
+				bound: entriesBindWrapper(bindings.entries, doorbellCapability.name, this.ownAddonId),
+				entries: bindings.entries
+			};
 		} catch (err) {
 			this.ctx.logger.warn("virtual-doorbell: binding check failed — keeping the last known verdict, NOT treating this as an unbind", {
 				tags: { deviceId: cameraId },
@@ -537,19 +652,126 @@ var VirtualDoorbellAddon = class extends BaseAddon {
 					bindingState: this.bindingMirror.get(cameraId)
 				}
 			});
+			return null;
+		}
+	}
+	/**
+	* One read of the DURABLE authority: the `device-manager` addon store's
+	* `deviceBindings` map, straight from the settings DB.
+	*
+	* This is deliberately NOT `getBindings`. The derived view folds the store
+	* together with the capability registry, `defaultActive` auto-binding and
+	* the cluster native-cap feeds — any of which can make it disagree with
+	* what the operator actually persisted, and one of which (an addon-id
+	* spelling mismatch) made it disagree *systematically* while looking
+	* exactly like a genuine unbind. The raw row cannot: it is what the
+	* bindings toggle wrote, and it grades its own trustworthiness (D44).
+	*/
+	async readDurableAuthority(cameraId) {
+		try {
+			return readDurableWrapperBinding(await this.ctx.api.addonSettingsRaw.getGlobal.query({ addonId: DEVICE_MANAGER_ADDON_ID }), cameraId, doorbellCapability.name, this.ownAddonId);
+		} catch (err) {
+			this.ctx.logger.warn("virtual-doorbell: the durable bindings store could not be read — it carries no information and revokes nothing", {
+				tags: { deviceId: cameraId },
+				meta: { error: errMsg(err) }
+			});
+			return "unreadable";
+		}
+	}
+	/**
+	* Reconcile `cameraId`'s mirror against the authority. Runs on the
+	* assignment-reload cadence, never while firing — and it runs on EVERY
+	* cycle regardless of the current verdict, so a camera sitting in
+	* `unbound` returns to `bound` on its own the moment the authority says
+	* so. There is no latch here that an operator has to clear.
+	*
+	* A positive derived read is believed immediately. A NEGATIVE one never
+	* is: the durable authority is asked, and it outranks the derived view in
+	* the direction that destroys work. Only when the authority agrees does
+	* the negative get folded, and even then `nextBindingState` still wants a
+	* second consecutive one (D49).
+	*/
+	async refreshBindingMirror(cameraId) {
+		const derived = await this.readDerivedBinding(cameraId);
+		if (derived === null) return;
+		if (derived.bound) {
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
+			return;
+		}
+		const authority = await this.readDurableAuthority(cameraId);
+		const entries = summariseEntries(derived.entries);
+		if (authority === "bound") {
+			this.ctx.logger.warn("virtual-doorbell: the derived binding list omits this wrapper but the durable bindings store still names this wrapper — trusting the store", {
+				tags: { deviceId: cameraId },
+				meta: {
+					ownAddonId: this.ownAddonId,
+					entries
+				}
+			});
+			this.bindingMirror.set(cameraId, nextBindingState(this.bindingMirror.get(cameraId), true));
 			return;
 		}
-		const boundNow = entries.some((entry) => entry.capName === doorbellCapability.name && entry.kind === "wrapped" && entry.providerAddonId === this.ctx.id);
 		const previous = this.bindingMirror.get(cameraId);
-		const next = nextBindingState(previous, boundNow);
+		const next = nextBindingState(previous, false);
 		this.bindingMirror.set(cameraId, next);
-		if (next !== previous && next !== "bound") this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
+		this.ctx.logger.warn("virtual-doorbell: bindings read did not see this wrapper", {
 			tags: { deviceId: cameraId },
 			meta: {
 				from: previous ?? "never-read",
-				to: next
+				to: next,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries
+			}
+		});
+	}
+	/**
+	* The mirror says `unbound` and a real press just arrived. Decide, with
+	* ONE read of the durable authority, whether to destroy it.
+	*
+	* D49 forbade I/O on the ring path because the read it would have made was
+	* the same fallible derived read that caused the problem. This read is
+	* different in both directions: it is the authority rather than a view of
+	* it, and it is paid ONLY on the branch that would otherwise drop a press —
+	* a ring is rare, one query is cheap, and a dropped ring has no retry, no
+	* reconcile and nothing downstream that notices.
+	*
+	* Returns `true` when the ring must proceed.
+	*/
+	async ringsDespiteUnboundMirror(cameraId, binding) {
+		const authority = await this.readDurableAuthority(cameraId);
+		if (authority === "bound") {
+			this.bindingMirror.set(cameraId, "bound");
+			this.ctx.logger.warn("virtual-doorbell: ring RESCUED — the mirror said unbound but the durable bindings store still names this wrapper; the mirror has been repaired", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		if (authority === "unreadable") {
+			this.ctx.logger.warn("virtual-doorbell: ringing on an unbound mirror — the durable bindings store could not answer, and an unanswerable store never destroys a one-shot press", {
+				tags: { deviceId: cameraId },
+				meta: {
+					bindingState: binding,
+					ownAddonId: this.ownAddonId
+				}
+			});
+			return true;
+		}
+		const derived = await this.readDerivedBinding(cameraId);
+		this.ctx.logger.warn("virtual-doorbell: ring DROPPED — the wrapper is not bound to this camera, but a trigger source is still configured for it", {
+			tags: { deviceId: cameraId },
+			meta: {
+				bindingState: binding,
+				ownAddonId: this.ownAddonId,
+				durableAuthority: authority,
+				entries: derived === null ? "unreadable" : summariseEntries(derived.entries)
 			}
 		});
+		return false;
 	}
 	/**
 	* Record a binding we observed FIRST-HAND. Both callers are cap methods

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { U as logDestinationCapability, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-C5XpOjbI.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, dt as BaseAddon, ut as errMsg, wt as createEvent } from "../../dist-UrXyJ9Zm.mjs";
+import { Et as createEvent, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { d as ScopedTokenSchema, dt as BaseAddon, ot as userManagementCapability, p as UserRecordSchema, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-UrXyJ9Zm.mjs";
+import { ct as userManagementCapability, d as ScopedTokenSchema, p as UserRecordSchema, pt as BaseAddon, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-C5XpOjbI.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { H as localNetworkCapability, Lt as EventCategory, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { W as localNetworkCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { U as logDestinationCapability, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-C5XpOjbI.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { K as metricsProviderCapability, Lt as EventCategory, dt as BaseAddon, wt as createEvent } from "../../dist-UrXyJ9Zm.mjs";
+import { Et as createEvent, J as metricsProviderCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Et as emitReadiness, Lt as EventCategory, Q as scoreRuntimes, X as platformProbeCapability, dt as BaseAddon, k as enumerateInferenceDevices, ut as errMsg } from "../../dist-UrXyJ9Zm.mjs";
+import { A as enumerateInferenceDevices, Ot as emitReadiness, Q as platformProbeCapability, et as scoreRuntimes, ft as errMsg, pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as EventCategory, dt as BaseAddon } from "../../dist-UrXyJ9Zm.mjs";
+import { pt as BaseAddon, zt as EventCategory } from "../../dist-C5XpOjbI.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**
@@ -604,7 +604,7 @@ var SnapshotAddon = class SnapshotAddon extends require_dist.BaseAddon {
 				access: "authenticated",
 				handler
 			}) ?? null;
-			this.ctx.logger.info("snapshot media data-plane served", { meta: { baseUrl: this.mediaDataPlane ? `/addon/${this.ctx.id}/media` : "(no dataPlane facility)" } });
+			this.ctx.logger.info("snapshot media data-plane served", { meta: { baseUrl: this.mediaDataPlane ? `/addon/${require_dist.bareAddonId(this.ctx.id)}/media` : "(no dataPlane facility)" } });
 		} catch (err) {
 			this.ctx.logger.warn("snapshot media data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
 			this.mediaDataPlane = null;

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { At as nodePin, _t as DeviceType, dt as BaseAddon, ht as DeviceFeature, i as BatteryStatusSchema, it as streamQualityLabel, tt as snapshotCapability, ut as errMsg } from "../../dist-UrXyJ9Zm.mjs";
+import { Mt as nodePin, _t as DeviceFeature, ft as errMsg, i as BatteryStatusSchema, ot as streamQualityLabel, pt as BaseAddon, rt as snapshotCapability, x as bareAddonId, yt as DeviceType } from "../../dist-C5XpOjbI.mjs";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**
@@ -599,7 +599,7 @@ var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 				access: "authenticated",
 				handler
 			}) ?? null;
-			this.ctx.logger.info("snapshot media data-plane served", { meta: { baseUrl: this.mediaDataPlane ? `/addon/${this.ctx.id}/media` : "(no dataPlane facility)" } });
+			this.ctx.logger.info("snapshot media data-plane served", { meta: { baseUrl: this.mediaDataPlane ? `/addon/${bareAddonId(this.ctx.id)}/media` : "(no dataPlane facility)" } });
 		} catch (err) {
 			this.ctx.logger.warn("snapshot media data-plane failed to serve", { meta: { error: errMsg(err) } });
 			this.mediaDataPlane = null;

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Chl2MvMd.js");
+const require_dist = require("../../dist-Cis_iV-u.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { P as filesystemBrowseCapability, dt as BaseAddon, rt as storageProviderCapability } from "../../dist-UrXyJ9Zm.mjs";
+import { F as filesystemBrowseCapability, at as storageProviderCapability, pt as BaseAddon } from "../../dist-C5XpOjbI.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/retired-settings-keys.d.ts

@@ -0,0 +1,94 @@
+import { ISettingsBackend, SettingsCollection } from '@camstack/types';
+/** One retired-key declaration, scoped to a single store row. */
+export interface RetiredKeySpec {
+    /** Addon id owning the store (the settings-store namespace). */
+    readonly namespace: string;
+    /** Collection inside that namespace, e.g. `addon-settings`. */
+    readonly collection: SettingsCollection;
+    /** Row id inside the collection, e.g. `root`. */
+    readonly row: string;
+    /** Keys retired verbatim. Matched exactly. */
+    readonly keys: readonly string[];
+    /**
+     * Keys retired in both their bare form and their per-node form
+     * (`<key>@<nodeId>`), which is how `nodeScopedKey` persists a
+     * `perNode: true` schema field.
+     */
+    readonly perNodeKeys: readonly string[];
+    /** Why they are dead — cited in the record, not re-derived at the call site. */
+    readonly reason: string;
+}
+/** What a purge pass deleted from one row. */
+export interface RetiredKeyPurgeResult {
+    readonly addon: string;
+    readonly collection: string;
+    readonly row: string;
+    readonly keys: readonly string[];
+}
+/** The store access the purge needs. Narrow on purpose — trivially fakeable. */
+export interface RetiredKeyStore {
+    /** Current row value, or `null` when the row does not exist. Throws on fault. */
+    read(spec: RetiredKeySpec): Promise<Record<string, unknown> | null>;
+    /** Replace the row with `value`. */
+    write(spec: RetiredKeySpec, value: Record<string, unknown>): Promise<void>;
+}
+/**
+ * Is THIS node the one whose settings store is the cluster's authority?
+ *
+ * Mirrors `resolveNodeRole` (server/backend `node-role.ts`) — unset or `'hub'`
+ * means hub, which is the launcher's own default. It is duplicated rather than
+ * imported because `@camstack/system` is a dependency OF the backend, not the
+ * other way round; the parse is four lines and the env var is the contract.
+ *
+ * Anything else answers `false`. Skipping where the purge should have run is a
+ * missed cleanup the next hub boot fixes; running where it should not have is a
+ * write to a store this node does not own. Only one of those is recoverable.
+ */
+export declare function settingsStoreIsAuthoritativeHere(env: NodeJS.ProcessEnv): boolean;
+/** The logging surface the purge uses — a structural subset of `IScopedLogger`. */
+export interface RetiredKeyLogger {
+    info(message: string, context?: {
+        readonly meta?: Record<string, unknown>;
+    }): void;
+    warn(message: string, context?: {
+        readonly meta?: Record<string, unknown>;
+    }): void;
+}
+/**
+ * The dead keys, per row.
+ *
+ * `detection-pipeline` / `addon-settings` / `root` — every key in this row is
+ * dead; the row itself is kept because the addon writes live keys into it
+ * (`pipelineTemplates`, `videoPipelineSteps`).
+ *
+ *  - `pipelineSteps` / `pipelineEngine`: the persisted GLOBAL step + engine
+ *    seed. Removed with `getGlobalSteps` becoming pure — dispatch builds steps
+ *    from the orchestrator's `agentSettings` plus per-camera overrides, and
+ *    never consulted the seed. See `addon-pipeline/src/detection-pipeline/provider.ts`.
+ *  - `engineRuntime` / `engineBackend` / `engineDevice` / `probedBestEngine`:
+ *    the per-node engine CASCADE, removed with the operator-facing engine
+ *    election. Each node now runs a device-array of inference pools balanced
+ *    per session, and the node-default pool derives live from the node's own
+ *    hardware (`resolveAutoEngine`). See
+ *    `addon-pipeline/src/detection-pipeline/engine-store-keys.ts`.
+ */
+export declare const RETIRED_SETTINGS_KEYS: readonly RetiredKeySpec[];
+/**
+ * Adapt the settings backend to {@link RetiredKeyStore}.
+ *
+ * `get` answering a non-object (missing row) is a MISS, not a fault: it maps to
+ * `null` and the purge skips the row. A backend throw propagates, which is what
+ * routes it to the "read failed, row left untouched" branch.
+ */
+export declare function retiredKeyStoreOf(backend: ISettingsBackend): RetiredKeyStore;
+/** Keys of `blob` that `spec` retires. Pure. */
+export declare function planRetiredKeyPurge(blob: Readonly<Record<string, unknown>>, spec: RetiredKeySpec): readonly string[];
+/**
+ * Delete every retired key present in the declared rows — on the hub.
+ *
+ * Off the authoritative node this is a no-op that touches nothing and says
+ * nothing (see the module header). Returns one entry per row that actually
+ * changed — empty when the store is already clean, which is the steady state
+ * after the first boot that ran it.
+ */
+export declare function purgeRetiredSettingsKeys(store: RetiredKeyStore, logger: RetiredKeyLogger, specs?: readonly RetiredKeySpec[], env?: NodeJS.ProcessEnv): Promise<readonly RetiredKeyPurgeResult[]>;