@camstack/server 1.2.354 → 1.2.356

package/dist/api/capabilities.router.js

@@ -205,25 +205,15 @@ function createCapabilitiesRouter(addonRegistry, configService, loggingService)
             const overrides = registry.getDeviceOverrides(input.deviceId);
             return Object.fromEntries(overrides);
         }),
-        setDeviceCollectionFilter: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string(), addonIds: zod_1.z.array(zod_1.z.string()) }))
-            .mutation(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            registry.setDeviceCollectionFilter(input.deviceId, input.capability, input.addonIds);
-            logger.info('Device collection filter set', {
-                tags: { deviceId: Number(input.deviceId) },
-                meta: { capability: input.capability, addonIds: input.addonIds },
-            });
-        }),
-        clearDeviceCollectionFilter: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string() }))
-            .mutation(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            registry.clearDeviceCollectionFilter(input.deviceId, input.capability);
-            logger.info('Device collection filter cleared', {
-                tags: { deviceId: Number(input.deviceId) },
-                meta: { capability: input.capability },
-            });
-        }),
+        /*
+         * `setDeviceCollectionFilter` / `clearDeviceCollectionFilter` were REMOVED
+         * here (D556). They wrote an in-memory per-device allow list that nothing
+         * persisted, so an operator's pick survived until the next hub restart and
+         * then silently reverted — a control that looks like it works, which is the
+         * defect D62 exists for. Which sources a camera has is now asked of the ONE
+         * authority that already owned a per-camera function switch:
+         * `deviceManager.setWrapperActive`. The registry keeps only its projection,
+         * written by `device-source-activation.ts` and by nothing else.
+         */
     });
 }

package/dist/api/core/capabilities.router.js

@@ -114,25 +114,15 @@ function createCapabilitiesRouter(registry, config) {
             }
             return result;
         }),
-        setDeviceCollectionFilter: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({
-            deviceId: zod_1.z.string(),
-            capability: zod_1.z.string(),
-            addonIds: zod_1.z.array(zod_1.z.string()),
-        }))
-            .output(zod_1.z.void())
-            .mutation(({ input }) => {
-            if (!registry)
-                throw new Error('Capability registry unavailable');
-            registry.setDeviceCollectionFilter(input.deviceId, input.capability, input.addonIds);
-        }),
-        clearDeviceCollectionFilter: trpc_middleware_js_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string() }))
-            .output(zod_1.z.void())
-            .mutation(({ input }) => {
-            if (!registry)
-                throw new Error('Capability registry unavailable');
-            registry.clearDeviceCollectionFilter(input.deviceId, input.capability);
-        }),
+        /*
+         * `setDeviceCollectionFilter` / `clearDeviceCollectionFilter` were REMOVED
+         * here (D556). They wrote an in-memory per-device allow list that nothing
+         * persisted, so an operator's pick survived until the next hub restart and
+         * then silently reverted — a control that looks like it works, which is the
+         * defect D62 exists for. Which sources a camera has is now asked of the ONE
+         * authority that already owned a per-camera function switch:
+         * `deviceManager.setWrapperActive`. The registry keeps only its projection,
+         * written by `device-source-activation.ts` and by nothing else.
+         */
     });
 }

package/dist/api/trpc/cap-router-runtime.js

@@ -28,8 +28,10 @@ exports.createCapRouterPrimitives = createCapRouterPrimitives;
 exports.createCapRouterServices = createCapRouterServices;
 exports.buildRuntimeCapRouters = buildRuntimeCapRouters;
 const system_1 = require("@camstack/system");
+const types_1 = require("@camstack/types");
 const server_1 = require("@trpc/server");
 const cap_mount_helpers_js_1 = require("./cap-mount-helpers.js");
+const device_collection_dispatch_js_1 = require("./device-collection-dispatch.js");
 const trpc_middleware_js_1 = require("./trpc.middleware.js");
 /**
  * Pre-computed set of capName → array-output method names for collection
@@ -41,7 +43,10 @@ exports.COLLECTION_ARRAY_METHODS = computeArrayMethods();
 function computeArrayMethods() {
     const out = new Map();
     for (const def of system_1.ALL_CAPABILITY_DEFINITIONS) {
-        if (def.mode !== 'collection')
+        // The effective MOUNT, never `mode`: a device-scoped wrapper collection
+        // (`videoclips`, D554) fans over ONE DEVICE's sources through the
+        // per-device dispatcher, and must never be fanned globally here.
+        if ((0, types_1.resolveCapMount)(def).kind !== 'collection')
             continue;
         const names = [];
         for (const [name, schema] of Object.entries(def.methods)) {
@@ -56,6 +61,22 @@ function computeArrayMethods() {
     }
     return out;
 }
+/**
+ * Is this cap served by the GLOBAL collection mount — every registered
+ * provider, for every caller?
+ *
+ * `mode: 'collection'` alone does not answer it any more: a device-scoped
+ * wrapper collection keeps the per-device mount (D554,
+ * `device-collection-dispatch.ts`), and fanning it globally here would answer
+ * one camera with another camera's sources on the `ctx.api` path while the
+ * tRPC path resolved per device — two authorities disagreeing about the same
+ * call, which is exactly what {@link aggregateCollectionCall} exists to
+ * prevent.
+ */
+function isGlobalCollection(reg, capName) {
+    const def = reg.getDefinition(capName);
+    return def !== undefined && (0, types_1.resolveCapMount)(def).kind === 'collection';
+}
 /**
  * Resolve a collection cap's provider exactly as the codegen-emitted
  * mount did:
@@ -108,7 +129,7 @@ function resolveCollectionProvider(reg, capName, addonId) {
 async function aggregateCollectionCall(reg, capName, method, args) {
     if (!reg)
         return null;
-    if (reg.getDefinition(capName)?.mode !== 'collection')
+    if (!isGlobalCollection(reg, capName))
         return null;
     if (!exports.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method))
         return null;
@@ -141,7 +162,7 @@ async function aggregateCollectionCall(reg, capName, method, args) {
 function addonPinOf(reg, capName, method, args) {
     if (!reg)
         return null;
-    if (reg.getDefinition(capName)?.mode !== 'collection')
+    if (!isGlobalCollection(reg, capName))
         return null;
     if (exports.COLLECTION_ARRAY_METHODS.get(capName)?.includes(method) === true)
         return null;
@@ -258,8 +279,26 @@ function createCapRouterServices(deps) {
                 const factory = deps.serverProviders[capName];
                 return factory ? factory(ctx) : null;
             }
+            // Both per-device mounts go through the SAME dispatcher. It resolves
+            // `getNativeProvider` first (the provider IS the device) and falls
+            // through to the D13 resolver `getProviderForDevice` — which is what a
+            // `device-scoped` WRAPPER needs: the per-device binding
+            // (`setWrapperActive` → `setDeviceOverride`) when there is one, the
+            // global active provider when there is not. No second resolver.
             case 'device-native':
+            case 'device-scoped': {
+                // A device-scoped cap whose mode is `collection` has SEVERAL providers
+                // per device — sources listed beside each other (D549 decision 2,
+                // D554). `requireDeviceScoped` resolves exactly one of them, and on a
+                // collection cap `getProviderForDevice` answers with whichever addon
+                // registered FIRST: every camera served by one source, silently. The
+                // collection twin fans the array methods over the device's sources and
+                // routes the scalar ones by the source inside the id.
+                if (reg?.getMode(capName) === 'collection') {
+                    return (0, device_collection_dispatch_js_1.requireDeviceCollection)(reg, capName, deps.logger);
+                }
                 return (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, capName);
+            }
             case 'collection':
                 return resolveCollectionProvider(reg, capName, addonId);
             // singleton / per-node / hub-only resolve the active singleton.

package/dist/api/trpc/device-collection-dispatch.js

@@ -0,0 +1,513 @@
+"use strict";
+/**
+ * The per-device COLLECTION dispatcher — a capability whose providers are
+ * SOURCES of one device, listed beside each other.
+ *
+ * `requireDeviceScoped` (`cap-mount-helpers.ts`) resolves ONE provider for a
+ * device: the native, else the D13 `getProviderForDevice`. That is right for a
+ * cap where a device has one answer. `videoclips` is not that cap any more
+ * (D549 decision 2, D554): a camera's clips live in several places at once —
+ * the analytics visit log, the camera's own SD card, a hub's storage, HomeKit
+ * — and the operator asked for all of them, side by side, never one hidden
+ * behind another. `getProviderForDevice` on a collection cap returns the FIRST
+ * registered provider, so leaving `videoclips` on it would have answered every
+ * camera from whichever addon booted first: the same silent single-answer
+ * defect D552 closed, wearing a different hat.
+ *
+ * The three rules this module implements, and nothing else:
+ *
+ *  1. **Fan out, per device.** An ARRAY-returning method is called on every
+ *     source the DEVICE has (`CapabilityRegistry.resolveCollectionForDevice` —
+ *     the enabled providers, minus the ones the operator switched off for this
+ *     camera through `deviceManager.setWrapperActive`, D556), and the results
+ *     are concatenated. No dedup ACROSS SOURCES, no best-source pick: a clip
+ *     held in two storages appears twice, once per source, and each row says
+ *     which (D549 decision 11 — stated there as a consequence precisely so it
+ *     is not "fixed" later). But a source is not a REGISTRATION: one addon
+ *     reaches this dispatcher as the device's native provider, as the
+ *     hub-local registration and once per agent node, and those are one
+ *     source answering three times. Each row is held once, keyed by the
+ *     identity its provider minted ({@link holdEachRowOnce}); on 592 that was
+ *     three `analytics` tick-boxes for one thing, D62's defect with the
+ *     polarity reversed (D554 amended 2026-09-20).
+ *  2. **One failing source never empties the others.** Every source is called
+ *     independently and a rejection removes only its own rows — and says so,
+ *     per source, with `tags: { deviceId }`. A fan-out where one throwing
+ *     provider empties the list is worse than no fan-out. For the SOURCE
+ *     listing itself the failure becomes a row (`unreachable` + the reason):
+ *     an empty list from a camera nobody could reach reads as "this camera has
+ *     no recordings", which is the defect this whole line of work is about.
+ *  3. **A scalar method routes by the SOURCE inside the id it carries.** Clip
+ *     ids are self-contained and source-prefixed (`analytics:…`,
+ *     `native:reolink:onboard:…`, `hksv:…`), so the dispatcher asks each
+ *     source which ids it owns ({@link SOURCE_LISTING_METHOD}) and hands the
+ *     call to the one that claims the longest matching prefix. Several
+ *     registrations of one source all claim it: the FIRST serving one wins,
+ *     and it is the registration the collapsed listing row names. An id nobody
+ *     claims is REFUSED by name — never handed to the first provider, which is
+ *     how a fabricated `addonId` once came back with another addon's answer
+ *     (D552 consequences, `rejectUnresolvedAddonPin`).
+ *
+ * A device with exactly ONE source skips 1's merge and 3's probe entirely: its
+ * rows are returned verbatim in the provider's own order and its scalar calls
+ * go straight through. That is not an optimisation — it is the promise that a
+ * camera with one provider behaves exactly as it did before this mount
+ * existed, and it is pinned by spec.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SOURCE_LISTING_METHOD = void 0;
+exports.requireDeviceCollection = requireDeviceCollection;
+const types_1 = require("@camstack/types");
+const server_1 = require("@trpc/server");
+/**
+ * The device-collection CONVENTION: a cap whose providers are sources declares
+ * this method, taking `{ deviceId }` and returning one row per source with a
+ * `source` id and an `availability` block. It is what makes rule 3 possible
+ * without a second registry of id prefixes — the provider that mints the ids
+ * is the one that names them.
+ */
+exports.SOURCE_LISTING_METHOD = 'listSources';
+/** The field on a source row that carries its id / clip-id namespace. */
+const SOURCE_ID_FIELD = 'source';
+/** The field on a source row that names the addon serving it (D555/D557). */
+const SOURCE_ADDON_FIELD = 'addonId';
+/**
+ * The input field naming WHICH of a device's providers to ask. One at a time,
+ * by `addonId`, never a list of source ids: the operator settled the surface
+ * on 2026-09-20 (*"l'utilizzatore è uno solo"*). Absent means the device's
+ * bound provider.
+ */
+const PROVIDER_PIN_FIELD = 'provider';
+/** The capability whose singleton answers what a device is bound to. */
+const DEVICE_MANAGER_CAP = 'device-manager';
+/**
+ * EVERY source a DEVICE has — read from the device's BINDINGS, which is the
+ * framework's answer to "which providers does this device have".
+ *
+ * It used to enumerate REGISTRATIONS, and that is what put `analytics` in the
+ * picker three times on the first live run (device 592, 2026-09-20): one addon
+ * reached here as the device's native provider, as the hub-local registration
+ * and again as `pipeline-analytics@little-unraid`, with a fourth on the Mac
+ * node that `resolveCollectionForDevice` had already dropped. Three tick-boxes
+ * for one thing, and `listClips` triplicating every row underneath them.
+ *
+ * A binding is one per `(device, cap, provider)` and `setWrapperActive` (D62)
+ * is the authority over it, so **three rows for one provider stop being
+ * representable** — there is nothing to de-duplicate after the fact. It also
+ * makes the list mean what the operator says it means: a source exists for a
+ * camera because a configuration elsewhere put it there, not because some
+ * addon somewhere registered the capability.
+ *
+ * The binding names an ADDON, never a shape: `DeviceBindingEntry.kind` is UI
+ * metadata and is not branched on here (D13). A named addon is looked up in the
+ * cap's collection map, and failing that against the device's native provider,
+ * which the registry cannot always NAME (a cross-process native arrives through
+ * `setNativeFallback` with no addon id of its own) — in that case the binding is
+ * the only thing that names it.
+ *
+ * **A bindings read that FAILS keeps the registration set** (D49). Answering an
+ * empty list would read as "this camera has no recordings", which is the defect
+ * this whole line of work exists to end, so a failure is logged and the old
+ * behaviour stands for that call.
+ */
+async function sourcesForDevice(registry, capName, deviceId, logger) {
+    const registered = new Map(registry.getCollectionEntries(capName));
+    const bound = await boundAddonIds(registry, capName, deviceId, logger);
+    if (bound === null)
+        return registrationsForDevice(registry, capName, deviceId);
+    const sources = [];
+    for (const addonId of bound) {
+        const provider = registered.get(addonId) ?? nativeNamedBy(registry, capName, deviceId, addonId);
+        if (provider === undefined) {
+            // A binding whose provider never booted is a DROPPED source, and a
+            // dropped source that says nothing is indistinguishable from a camera
+            // that has none.
+            logger?.warn(`${capName}: device is bound to "${addonId}", which has registered no provider here`, { tags: { deviceId, addonId }, meta: { capability: capName } });
+            continue;
+        }
+        sources.push({ addonId, provider });
+    }
+    return sources;
+}
+/**
+ * The addon ids the device is bound to for `capName`, or `null` when the
+ * bindings could not be read at all (never an empty list for that case — the
+ * two must not look alike).
+ */
+async function boundAddonIds(registry, capName, deviceId, logger) {
+    const manager = registry.getSingleton(DEVICE_MANAGER_CAP);
+    if (manager === null || typeof manager.getBindings !== 'function') {
+        logger?.warn(`${capName}: no device manager to read this device's bindings from`, {
+            tags: { deviceId },
+            meta: { capability: capName },
+        });
+        return null;
+    }
+    try {
+        const answer = await manager.getBindings({ deviceId });
+        const ids = [];
+        for (const entry of answer.entries) {
+            if (entry.capName !== capName)
+                continue;
+            const addonId = entry.providerAddonId;
+            if (addonId.length > 0 && !ids.includes(addonId))
+                ids.push(addonId);
+        }
+        return ids;
+    }
+    catch (err) {
+        logger?.warn(`${capName}: could not read this device's bindings — keeping the registrations`, {
+            tags: { deviceId },
+            meta: { capability: capName, reason: errMessage(err) },
+        });
+        return null;
+    }
+}
+/**
+ * The device's native provider when the binding's addon id is the one that
+ * registered it — or when the registry cannot name it at all, which is how a
+ * cross-process native arrives (`setNativeFallback`). The native is not in
+ * `state.providers`, so it is asked about separately (D556 decision 5).
+ */
+function nativeNamedBy(registry, capName, deviceId, addonId) {
+    const native = registry.getNativeProvider(capName, deviceId);
+    if (native === null)
+        return undefined;
+    const nativeAddonId = registry.getNativeAddonId(capName, deviceId);
+    if (nativeAddonId !== null && nativeAddonId !== addonId)
+        return undefined;
+    return native;
+}
+/**
+ * What this dispatcher did before the bindings became its authority, kept for
+ * exactly one caller: the failure path above. Every registered provider this
+ * device may use, native first.
+ */
+function registrationsForDevice(registry, capName, deviceId) {
+    const admitted = new Set(registry.resolveCollectionForDevice(capName, String(deviceId)));
+    const sources = [];
+    const seen = new Set();
+    const native = registry.getNativeProvider(capName, deviceId);
+    if (native !== null) {
+        sources.push({
+            addonId: registry.getNativeAddonId(capName, deviceId) ?? 'native',
+            provider: native,
+        });
+        seen.add(native);
+    }
+    for (const [addonId, provider] of registry.getCollectionEntries(capName)) {
+        if (!admitted.has(provider) || seen.has(provider))
+            continue;
+        seen.add(provider);
+        sources.push({ addonId, provider });
+    }
+    return sources;
+}
+/** Is `method` one of the cap's array-returning (fan-out) methods? */
+function isFanOutMethod(registry, capName, method) {
+    const def = registry.getDefinition(capName);
+    if (def === undefined)
+        return false;
+    const schema = (0, types_1.expandCapMethods)(def)[method];
+    if (schema === undefined || schema.kind === 'subscription')
+        return false;
+    return (0, types_1.isArrayOutputSchema)(schema.output);
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Call one source, naming the cap, the source and the method on any refusal. */
+async function callSource(source, method, input, capName, deviceId) {
+    const fn = source.provider[method];
+    if (typeof fn !== 'function') {
+        throw new server_1.TRPCError({
+            code: 'NOT_IMPLEMENTED',
+            message: `Capability "${capName}" source "${source.addonId}" for device ${deviceId} does not implement "${method}"`,
+        });
+    }
+    return await fn.call(source.provider, input);
+}
+/**
+ * The `startMs` a row is ordered by, or null when the row does not declare a
+ * time range. A merge across sources is newest-first (D549 decision 2's
+ * `(startMs, endMs, id)`); rows that carry no window — a source listing, say —
+ * keep the order their providers produced them in.
+ */
+function startMsOf(row) {
+    if (row === null || typeof row !== 'object')
+        return null;
+    const range = Reflect.get(row, 'timeRange');
+    if (range === null || typeof range !== 'object')
+        return null;
+    const startMs = Reflect.get(range, 'startMs');
+    return typeof startMs === 'number' ? startMs : null;
+}
+function endMsOf(row) {
+    if (row === null || typeof row !== 'object')
+        return 0;
+    const range = Reflect.get(row, 'timeRange');
+    if (range === null || typeof range !== 'object')
+        return 0;
+    const endMs = Reflect.get(range, 'endMs');
+    return typeof endMs === 'number' ? endMs : 0;
+}
+function idOf(row) {
+    if (row === null || typeof row !== 'object')
+        return '';
+    const id = Reflect.get(row, 'id');
+    return typeof id === 'string' ? id : '';
+}
+/** Newest-first by `(startMs, endMs, id)`; applied only when EVERY row has a window. */
+function mergeRows(rows) {
+    if (rows.some((row) => startMsOf(row) === null))
+        return rows;
+    return [...rows].sort((a, b) => {
+        const byStart = (startMsOf(b) ?? 0) - (startMsOf(a) ?? 0);
+        if (byStart !== 0)
+            return byStart;
+        const byEnd = endMsOf(b) - endMsOf(a);
+        if (byEnd !== 0)
+            return byEnd;
+        return idOf(a).localeCompare(idOf(b));
+    });
+}
+/**
+ * The row a source listing gets when the source could not be reached AT ALL.
+ *
+ * The source id is the addon's, because a provider that threw could not name
+ * its own sources — saying "this provider, as a whole, did not answer" is the
+ * honest version, and the reason carries the refusal verbatim. Never composed
+ * with a provider's output: this row replaces rows that do not exist.
+ */
+function unreachableSourceRow(addonId, reason) {
+    return {
+        [SOURCE_ID_FIELD]: addonId,
+        label: addonId,
+        availability: { state: 'unreachable', reason },
+    };
+}
+async function fanOut(sources, method, input, capName, deviceId, logger) {
+    const isSourceListing = method === exports.SOURCE_LISTING_METHOD;
+    const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, method, input, capName, deviceId)));
+    const rows = [];
+    for (const [index, result] of settled.entries()) {
+        const source = sources[index];
+        if (source === undefined)
+            continue;
+        if (result.status === 'rejected') {
+            const reason = errMessage(result.reason);
+            // A branch that drops work says so — a fan-out that silently loses a
+            // source is indistinguishable from a camera that has none.
+            logger?.warn(`${capName}.${method}: source failed — its rows are missing from this answer`, {
+                tags: { deviceId, addonId: source.addonId },
+                meta: { capability: capName, method, reason },
+            });
+            if (isSourceListing)
+                rows.push(unreachableSourceRow(source.addonId, reason));
+            continue;
+        }
+        if (!Array.isArray(result.value)) {
+            logger?.warn(`${capName}.${method}: source answered a non-array — contributing nothing`, {
+                tags: { deviceId, addonId: source.addonId },
+                meta: { capability: capName, method },
+            });
+            continue;
+        }
+        rows.push(...finishRows(source, result.value, isSourceListing));
+    }
+    return mergeRows(rows);
+}
+/**
+ * Stamp each source-listing row with the addon that really served it.
+ *
+ * The stamp is authoritative: a surface cannot otherwise resolve a source row
+ * to who answers it, and the alternative — a `native:reolink:* →
+ * provider-reolink` prefix table inside the widget — is a second authority on
+ * provider identity living in the one package with no business knowing it
+ * (D557). The registry's id is a fact; a provider's own value is a claim, so
+ * the fact wins.
+ *
+ * It used to also DROP the rows of a source the operator had switched off, and
+ * mark the listing row that let him switch it back on. That whole half went on
+ * 2026-09-20: every provider always works, and a source exists for a camera
+ * because a binding put it there — so "off" is an unbound provider, not a
+ * second store beside the binding (D556/D557 amended). Nothing here filters
+ * any more; the filtering happened when {@link sourcesForDevice} read the
+ * bindings.
+ */
+function finishRows(source, rows, isSourceListing) {
+    if (!isSourceListing)
+        return rows;
+    const out = [];
+    for (const row of rows) {
+        if (row === null || typeof row !== 'object') {
+            out.push(row);
+            continue;
+        }
+        out.push({ ...row, [SOURCE_ADDON_FIELD]: source.addonId });
+    }
+    return out;
+}
+async function claimsOf(sources, capName, deviceId, logger) {
+    const claimed = new Map();
+    const unknownClaims = [];
+    const settled = await Promise.allSettled(sources.map(async (source) => await callSource(source, exports.SOURCE_LISTING_METHOD, { deviceId }, capName, deviceId)));
+    for (const [index, result] of settled.entries()) {
+        const source = sources[index];
+        if (source === undefined)
+            continue;
+        if (result.status === 'rejected' || !Array.isArray(result.value)) {
+            // It could not name its sources, so it cannot be excluded on that basis
+            // either — a read that FAILS must not destroy work (D49).
+            logger?.warn(`${capName}.${exports.SOURCE_LISTING_METHOD}: source could not name its ids — routing falls back to it only if it is the only such source`, {
+                tags: { deviceId, addonId: source.addonId },
+                meta: {
+                    capability: capName,
+                    reason: result.status === 'rejected' ? errMessage(result.reason) : 'non-array answer',
+                },
+            });
+            unknownClaims.push(source);
+            continue;
+        }
+        for (const row of result.value) {
+            if (row === null || typeof row !== 'object')
+                continue;
+            const id = Reflect.get(row, SOURCE_ID_FIELD);
+            if (typeof id === 'string' && id.length > 0 && !claimed.has(id))
+                claimed.set(id, source);
+        }
+    }
+    return { claimed, unknownClaims };
+}
+/** Every top-level string value of an object input — the candidate routing keys. */
+function stringFieldsOf(input) {
+    if (input === null || typeof input !== 'object' || Array.isArray(input))
+        return [];
+    const out = [];
+    for (const value of Object.values(input)) {
+        if (typeof value === 'string' && value.length > 0)
+            out.push(value);
+    }
+    return out;
+}
+/**
+ * The source that owns a source-prefixed id: `<sourceId>` itself, or anything
+ * under `<sourceId>:`. The LONGEST matching source wins, so
+ * `native:reolink:onboard` beats a hypothetical `native:reolink`.
+ */
+function ownerOf(claims, input) {
+    let best = null;
+    for (const value of stringFieldsOf(input)) {
+        for (const [sourceId, source] of claims.claimed) {
+            if (value !== sourceId && !value.startsWith(`${sourceId}:`))
+                continue;
+            if (best === null || sourceId.length > best.sourceId.length)
+                best = { source, sourceId };
+        }
+    }
+    return best;
+}
+async function dispatchScalar(sources, method, input, capName, deviceId, logger) {
+    const claims = await claimsOf(sources, capName, deviceId, logger);
+    const owner = ownerOf(claims, input);
+    if (owner !== null)
+        return await callSource(owner.source, method, input, capName, deviceId);
+    const fallback = claims.unknownClaims.length === 1 ? claims.unknownClaims[0] : undefined;
+    if (fallback !== undefined) {
+        logger?.warn(`${capName}.${method}: no source claimed this id — using the one source that could not name its ids`, {
+            tags: { deviceId, addonId: fallback.addonId },
+            meta: { capability: capName, method },
+        });
+        return await callSource(fallback, method, input, capName, deviceId);
+    }
+    const known = [...claims.claimed.keys()];
+    logger?.warn(`${capName}.${method}: refused — no source of this device claims the id`, {
+        tags: { deviceId },
+        meta: { capability: capName, method, knownSources: known, input },
+    });
+    throw new server_1.TRPCError({
+        code: 'BAD_REQUEST',
+        message: `Capability "${capName}.${method}": no source of device ${deviceId} claims ` +
+            `${JSON.stringify(input)}. Sources: ${known.length > 0 ? known.join(', ') : '(none named)'}. ` +
+            `An unclaimed id is refused rather than answered by another source.`,
+    });
+}
+/**
+ * The device's sources narrowed to the one the caller PINNED, if it pinned one.
+ *
+ * A pin the device is not bound to is REFUSED by name. Answering it from
+ * another provider is how a fabricated addon id once came back with somebody
+ * else's answer (D552, `rejectUnresolvedAddonPin`), and here it would hand a
+ * caller who asked for the camera's own SD card the analytics visit log with
+ * nothing saying so.
+ */
+function pinnedProvider(sources, input, capName, deviceId) {
+    if (input === null || typeof input !== 'object')
+        return sources;
+    const pin = Reflect.get(input, PROVIDER_PIN_FIELD);
+    if (typeof pin !== 'string' || pin.length === 0)
+        return sources;
+    const picked = sources.filter((source) => source.addonId === pin);
+    if (picked.length > 0)
+        return picked;
+    throw new server_1.TRPCError({
+        code: 'BAD_REQUEST',
+        message: `Capability "${capName}": device ${deviceId} is not bound to provider "${pin}". ` +
+            `Bound providers: ${sources.map((source) => source.addonId).join(', ') || '(none)'}. ` +
+            `A pin nobody answers is refused rather than served by another provider.`,
+    });
+}
+/**
+ * Build the per-device COLLECTION dispatcher for `capName` — the collection
+ * twin of `requireDeviceScoped`, and the provider object the cap router's
+ * `device-scoped` mount resolves when the cap's mode is `collection`.
+ *
+ * Returns null without a registry (the router then surfaces
+ * PRECONDITION_FAILED), exactly as the singleton dispatcher does.
+ */
+function requireDeviceCollection(registry, capName, logger) {
+    if (!registry)
+        return null;
+    const dispatcher = new Proxy({}, {
+        get(_target, prop) {
+            if (typeof prop !== 'string')
+                return undefined;
+            return async (input) => {
+                const deviceId = input !== null && typeof input === 'object' ? Reflect.get(input, 'deviceId') : undefined;
+                if (typeof deviceId !== 'number') {
+                    throw new server_1.TRPCError({
+                        code: 'BAD_REQUEST',
+                        message: `${capName}.${prop}: input must carry numeric "deviceId"`,
+                    });
+                }
+                const bound = await sourcesForDevice(registry, capName, deviceId, logger);
+                const sources = pinnedProvider(bound, input, capName, deviceId);
+                if (sources.length === 0) {
+                    throw new server_1.TRPCError({
+                        code: 'PRECONDITION_FAILED',
+                        message: `Capability "${capName}" not registered for device ${deviceId}`,
+                    });
+                }
+                const first = sources[0];
+                if (isFanOutMethod(registry, capName, prop)) {
+                    // One source is not a merge: its rows travel verbatim, in its own
+                    // order, so a camera with one provider answers exactly as it did
+                    // before this dispatcher existed (D554 decision 6). Only the
+                    // listing rows are finished, and only to carry the addon stamp.
+                    if (sources.length === 1 && first !== undefined) {
+                        const answered = await callSource(first, prop, input, capName, deviceId);
+                        if (!Array.isArray(answered))
+                            return answered;
+                        return finishRows(first, answered, prop === exports.SOURCE_LISTING_METHOD);
+                    }
+                    return await fanOut(sources, prop, input, capName, deviceId, logger);
+                }
+                if (sources.length === 1 && first !== undefined) {
+                    return await callSource(first, prop, input, capName, deviceId);
+                }
+                return await dispatchScalar(sources, prop, input, capName, deviceId, logger);
+            };
+        },
+    });
+    return dispatcher;
+}

package/dist/api/trpc/generated-cap-mounts.js

@@ -78,7 +78,7 @@ function mountAllCaps(services) {
         alarmPanel: (0, generated_cap_routers_js_1.createCapRouter_alarmPanel)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'alarm-panel'), remoteCapProxy),
         alerts: (0, generated_cap_routers_js_1.createCapRouter_alerts)((_ctx) => reg?.getSingleton('alerts') ?? null, remoteCapProxy),
         ambientLightSensor: (0, generated_cap_routers_js_1.createCapRouter_ambientLightSensor)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'ambient-light-sensor'), remoteCapProxy),
-        audioAnalysis: (0, generated_cap_routers_js_1.createCapRouter_audioAnalysis)((_ctx) => reg?.getSingleton('audio-analysis') ?? null, remoteCapProxy),
+        audioAnalysis: (0, generated_cap_routers_js_1.createCapRouter_audioAnalysis)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'audio-analysis'), remoteCapProxy),
         audioAnalyzer: (0, generated_cap_routers_js_1.createCapRouter_audioAnalyzer)((_ctx) => reg?.getSingleton('audio-analyzer') ?? null, remoteCapProxy),
         audioCodec: (0, generated_cap_routers_js_1.createCapRouter_audioCodec)((_ctx) => reg?.getSingleton('audio-codec') ?? null, remoteCapProxy),
         audioMetrics: (0, generated_cap_routers_js_1.createCapRouter_audioMetrics)((_ctx) => reg?.getSingleton('audio-metrics') ?? null, remoteCapProxy),
@@ -107,8 +107,8 @@ function mountAllCaps(services) {
         button: (0, generated_cap_routers_js_1.createCapRouter_button)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'button'), remoteCapProxy),
         cameraCredentials: (0, generated_cap_routers_js_1.createCapRouter_cameraCredentials)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'camera-credentials'), remoteCapProxy),
         cameraGridLayout: (0, generated_cap_routers_js_1.createCapRouter_cameraGridLayout)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'camera-grid-layout'), remoteCapProxy),
-        cameraPipelineConfig: (0, generated_cap_routers_js_1.createCapRouter_cameraPipelineConfig)((_ctx) => reg?.getSingleton('camera-pipeline-config') ?? null, remoteCapProxy),
-        cameraStreams: (0, generated_cap_routers_js_1.createCapRouter_cameraStreams)((_ctx) => reg?.getSingleton('camera-streams') ?? null, remoteCapProxy),
+        cameraPipelineConfig: (0, generated_cap_routers_js_1.createCapRouter_cameraPipelineConfig)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'camera-pipeline-config'), remoteCapProxy),
+        cameraStreams: (0, generated_cap_routers_js_1.createCapRouter_cameraStreams)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'camera-streams'), remoteCapProxy),
         carbonMonoxide: (0, generated_cap_routers_js_1.createCapRouter_carbonMonoxide)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'carbon-monoxide'), remoteCapProxy),
         climateControl: (0, generated_cap_routers_js_1.createCapRouter_climateControl)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'climate-control'), remoteCapProxy),
         color: (0, generated_cap_routers_js_1.createCapRouter_color)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'color'), remoteCapProxy),
@@ -162,7 +162,7 @@ function mountAllCaps(services) {
         }, remoteCapProxy),
         dayNight: (0, generated_cap_routers_js_1.createCapRouter_dayNight)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'day-night'), remoteCapProxy),
         decoder: (0, generated_cap_routers_js_1.createCapRouter_decoder)((_ctx) => reg?.getSingleton('decoder') ?? null, remoteCapProxy),
-        detectionPipeline: (0, generated_cap_routers_js_1.createCapRouter_detectionPipeline)((_ctx) => reg?.getSingleton('detection-pipeline') ?? null, remoteCapProxy),
+        detectionPipeline: (0, generated_cap_routers_js_1.createCapRouter_detectionPipeline)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'detection-pipeline'), remoteCapProxy),
         deviceAdoption: (0, generated_cap_routers_js_1.createCapRouter_deviceAdoption)((_ctx) => reg?.getSingleton('device-adoption') ??
             null, remoteCapProxy),
         deviceDiscovery: (0, generated_cap_routers_js_1.createCapRouter_deviceDiscovery)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'device-discovery'), remoteCapProxy),
@@ -337,8 +337,7 @@ function mountAllCaps(services) {
         modelDistributor: (0, generated_cap_routers_js_1.createCapRouter_modelDistributor)((_ctx) => reg?.getSingleton('model-distributor') ??
             null, remoteCapProxy),
         motion: (0, generated_cap_routers_js_1.createCapRouter_motion)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'motion'), remoteCapProxy),
-        motionDetection: (0, generated_cap_routers_js_1.createCapRouter_motionDetection)((_ctx) => reg?.getSingleton('motion-detection') ??
-            null, remoteCapProxy),
+        motionDetection: (0, generated_cap_routers_js_1.createCapRouter_motionDetection)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'motion-detection'), remoteCapProxy),
         motionTrigger: (0, generated_cap_routers_js_1.createCapRouter_motionTrigger)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'motion-trigger'), remoteCapProxy),
         motionZones: (0, generated_cap_routers_js_1.createCapRouter_motionZones)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'motion-zones'), remoteCapProxy),
         mqttBroker: (0, generated_cap_routers_js_1.createCapRouter_mqttBroker)((_ctx, addonId) => {
@@ -412,7 +411,7 @@ function mountAllCaps(services) {
         osd: (0, generated_cap_routers_js_1.createCapRouter_osd)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'osd'), remoteCapProxy),
         osdManager: (0, generated_cap_routers_js_1.createCapRouter_osdManager)((_ctx) => reg?.getSingleton('osd-manager') ?? null, remoteCapProxy),
         petFeeder: (0, generated_cap_routers_js_1.createCapRouter_petFeeder)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'pet-feeder'), remoteCapProxy),
-        pipelineAnalytics: (0, generated_cap_routers_js_1.createCapRouter_pipelineAnalytics)((_ctx) => reg?.getSingleton('pipeline-analytics') ?? null, remoteCapProxy),
+        pipelineAnalytics: (0, generated_cap_routers_js_1.createCapRouter_pipelineAnalytics)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'pipeline-analytics'), remoteCapProxy),
         pipelineExecutor: (0, generated_cap_routers_js_1.createCapRouter_pipelineExecutor)((_ctx) => reg?.getSingleton('pipeline-executor') ??
             null, remoteCapProxy),
         pipelineOrchestrator: (0, generated_cap_routers_js_1.createCapRouter_pipelineOrchestrator)((_ctx) => reg?.getSingleton('pipeline-orchestrator') ?? null, remoteCapProxy),
@@ -431,7 +430,7 @@ function mountAllCaps(services) {
         recordingExport: (0, generated_cap_routers_js_1.createCapRouter_recordingExport)((_ctx) => reg?.getSingleton('recording-export') ??
             null, remoteCapProxy),
         recordingSignal: (0, generated_cap_routers_js_1.createCapRouter_recordingSignal)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'recording-signal'), remoteCapProxy),
-        sceneMonitor: (0, generated_cap_routers_js_1.createCapRouter_sceneMonitor)((_ctx) => reg?.getSingleton('scene-monitor') ?? null, remoteCapProxy),
+        sceneMonitor: (0, generated_cap_routers_js_1.createCapRouter_sceneMonitor)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'scene-monitor'), remoteCapProxy),
         scriptRunner: (0, generated_cap_routers_js_1.createCapRouter_scriptRunner)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'script-runner'), remoteCapProxy),
         serverManagement: (0, generated_cap_routers_js_1.createCapRouter_serverManagement)((_ctx) => reg?.getSingleton('server-management') ??
             null, remoteCapProxy),
@@ -542,7 +541,7 @@ function mountAllCaps(services) {
         valve: (0, generated_cap_routers_js_1.createCapRouter_valve)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'valve'), remoteCapProxy),
         vectorStore: (0, generated_cap_routers_js_1.createCapRouter_vectorStore)((_ctx) => reg?.getSingleton('vector-store') ?? null, remoteCapProxy),
         vibration: (0, generated_cap_routers_js_1.createCapRouter_vibration)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'vibration'), remoteCapProxy),
-        videoclips: (0, generated_cap_routers_js_1.createCapRouter_videoclips)((_ctx) => reg?.getSingleton('videoclips') ?? null, remoteCapProxy),
+        videoclips: (0, generated_cap_routers_js_1.createCapRouter_videoclips)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'videoclips'), remoteCapProxy),
         viewerUi: (0, generated_cap_routers_js_1.createCapRouter_viewerUi)((_ctx) => reg?.getSingleton('viewer-ui') ?? null, remoteCapProxy),
         waterHeater: (0, generated_cap_routers_js_1.createCapRouter_waterHeater)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'water-heater'), remoteCapProxy),
         weather: (0, generated_cap_routers_js_1.createCapRouter_weather)((_ctx) => (0, cap_mount_helpers_js_1.requireDeviceScoped)(reg, 'weather'), remoteCapProxy),

package/dist/api/trpc/generated-cap-routers.js

@@ -10733,7 +10733,7 @@ function createCapRouter_vibration(getProvider, createRemoteProxy) {
 }
 function createCapRouter_videoclips(getProvider, createRemoteProxy) {
     return (0, trpc_middleware_js_1.trpcRouter)({
-        listClips: trpc_middleware_js_1.adminProcedure
+        listClips: trpc_middleware_js_1.protectedProcedure
             .input(types_126.videoclipsCapability.methods.listClips.input.loose())
             .output(types_126.videoclipsCapability.methods.listClips.output)
             .query(async ({ input, ctx }) => {
@@ -10742,7 +10742,16 @@ function createCapRouter_videoclips(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listClips(methodInput);
         }),
-        getClipPlayback: trpc_middleware_js_1.adminProcedure
+        listSources: trpc_middleware_js_1.protectedProcedure
+            .input(types_126.videoclipsCapability.methods.listSources.input.loose())
+            .output(types_126.videoclipsCapability.methods.listSources.output)
+            .query(async ({ input, ctx }) => {
+            const { nodeId, ...methodInput } = input;
+            const p = resolveProvider('videoclips', nodeId, () => getProvider(ctx), createRemoteProxy);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
+            return p.listSources(methodInput);
+        }),
+        getClipPlayback: trpc_middleware_js_1.protectedProcedure
             .input(types_126.videoclipsCapability.methods.getClipPlayback.input.loose())
             .output(types_126.videoclipsCapability.methods.getClipPlayback.output)
             .query(async ({ input, ctx }) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.354",
+  "version": "1.2.356",
   "private": false,
   "files": [
     "dist",
@@ -35,18 +35,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.243",
-    "@camstack/addon-agent-ui": "1.2.131",
+    "@camstack/addon-admin-ui": "1.2.245",
+    "@camstack/addon-agent-ui": "1.2.133",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
     "@camstack/addon-notifiers": "1.2.119",
-    "@camstack/addon-pipeline": "1.2.272",
+    "@camstack/addon-pipeline": "1.2.273",
     "@camstack/addon-pipeline-orchestrator": "1.2.231",
-    "@camstack/addon-post-analysis": "1.2.271",
+    "@camstack/addon-post-analysis": "1.2.272",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.275",
-    "@camstack/types": "1.2.233",
-    "@camstack/ui-library": "1.2.189",
+    "@camstack/system": "1.2.277",
+    "@camstack/types": "1.2.235",
+    "@camstack/ui-library": "1.2.191",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",