@camstack/server 1.2.410 → 1.2.412

package/dist/api/core/cap-providers.js

@@ -80,7 +80,7 @@ const addon_package_service_js_1 = require("../../core/addon/addon-package.servi
 const lifecycle_runner_singleton_js_1 = require("../../core/lifecycle/lifecycle-runner.singleton.js");
 const agent_installed_packages_js_1 = require("../../core/updates/agent-installed-packages.js");
 const http_request_census_singleton_js_1 = require("../trpc/http-request-census.singleton.js");
-const collection_preference_js_1 = require("./collection-preference.js");
+const capability_preference_writes_js_1 = require("./capability-preference-writes.js");
 const failure_contributions_js_1 = require("./failure-contributions.js");
 const load_contributions_js_1 = require("./load-contributions.js");
 const logging_settings_js_1 = require("./logging-settings.js");
@@ -1444,38 +1444,14 @@ function buildAddonsProvider(ar, ps, ls, moleculer, configService, ctx) {
             }));
         },
         setCapabilityProviderEnabled: async (input) => {
-            const registry = ar.getCapabilityRegistry();
-            const caps = registry.listCapabilities();
-            const found = caps.find((c) => c.name === input.capName);
-            if (!found) {
-                throw new server_1.TRPCError({
-                    code: 'NOT_FOUND',
-                    message: `Unknown capability: ${input.capName}`,
-                });
-            }
-            if (found.mode !== 'collection') {
-                throw new server_1.TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: `Capability "${input.capName}" is not a collection`,
-                });
-            }
-            if (!found.providers.includes(input.addonId)) {
-                throw new server_1.TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: `Provider "${input.addonId}" is not registered for "${input.capName}"`,
-                });
-            }
-            if (input.enabled) {
-                registry.enableCollectionProvider(input.capName, input.addonId);
-            }
-            else {
-                registry.disableCollectionProvider(input.capName, input.addonId);
-            }
-            // Persist the new disabled-set so the choice survives a hub reboot.
-            // Reuses the same `capabilities.collection.<cap>` key/format the
-            // `capabilities` core router writes — via the shared canonical writer.
-            const updated = registry.listCapabilities().find((c) => c.name === input.capName);
-            await (0, collection_preference_js_1.persistCollectionDisabled)(configService, input.capName, updated?.disabledProviders ?? []);
+            // Refused (unknown cap, not a collection, unregistered provider) before
+            // anything is written; otherwise the new disabled-set is PERSISTED first
+            // and applied live only once the write landed (D675 amendment).
+            await (0, capability_preference_writes_js_1.writeCollectionToggle)(configService, ar.getCapabilityRegistry(), {
+                capability: input.capName,
+                addonId: input.addonId,
+                enabled: input.enabled,
+            });
             return { success: true };
         },
         getVersions: async (input) => ps.getPackageVersions(input.name),

package/dist/api/core/capabilities.router.js

@@ -9,6 +9,7 @@ exports.createCapabilitiesRouter = createCapabilitiesRouter;
  */
 const zod_1 = require("zod");
 const trpc_middleware_js_1 = require("../trpc/trpc.middleware.js");
+const capability_preference_writes_js_1 = require("./capability-preference-writes.js");
 function createCapabilitiesRouter(registry, config) {
     return (0, trpc_middleware_js_1.trpcRouter)({
         listCapabilities: trpc_middleware_js_1.adminProcedure
@@ -29,17 +30,14 @@ function createCapabilitiesRouter(registry, config) {
             .mutation(async ({ input }) => {
             if (!registry)
                 throw new Error('Capability registry unavailable');
-            await registry.setActiveSingleton(input.capability, input.addonId, input.nodeId);
-            if (input.nodeId !== undefined) {
-                // Per-node override: persist under the node-qualified key so the boot
-                // restorer (`setNodeConfigReader`) replays it on restart.
-                await config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, input.addonId);
-            }
-            else {
-                // Cluster-global default: persist to the SAME key the boot restorer reads
-                // (addon-registry `setConfigReader` → `capabilities.singleton.<cap>`).
-                await config.set(`capabilities.singleton.${input.capability}`, input.addonId);
-            }
+            // Persist FIRST, under the key the boot restorer reads
+            // (`capabilities.singleton.<cap>` / `capabilities.singletonNode.<cap>.<node>`),
+            // then switch live: a write that fails changes nothing (D675 amendment).
+            await (0, capability_preference_writes_js_1.writeSingletonPreference)(config, registry, {
+                capability: input.capability,
+                addonId: input.addonId,
+                ...(input.nodeId !== undefined ? { nodeId: input.nodeId } : {}),
+            });
         }),
         clearSingletonNodeOverride: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ capability: zod_1.z.string(), nodeId: zod_1.z.string() }))
@@ -47,10 +45,10 @@ function createCapabilitiesRouter(registry, config) {
             .mutation(async ({ input }) => {
             if (!registry)
                 throw new Error('Capability registry unavailable');
+            // Persist the cleared state as null FIRST so the boot restorer doesn't
+            // re-apply a stale override; only a write that landed clears it live.
+            await config.set((0, capability_preference_writes_js_1.singletonPreferenceKey)(input.capability, input.nodeId), null);
             registry.clearSingletonNodeOverride(input.capability, input.nodeId);
-            // Persist the cleared state as null so the boot restorer doesn't re-apply
-            // a stale override on restart.
-            await config.set(`capabilities.singletonNode.${input.capability}.${input.nodeId}`, null);
         }),
         /**
          * Set the enabled set of providers for a collection capability in
@@ -65,25 +63,13 @@ function createCapabilitiesRouter(registry, config) {
             enabledAddonIds: zod_1.z.array(zod_1.z.string()),
         }))
             .output(zod_1.z.void())
-            .mutation(({ input }) => {
+            .mutation(async ({ input }) => {
             if (!registry)
                 throw new Error('Capability registry unavailable');
-            const caps = registry.listCapabilities();
-            const entry = caps.find((c) => c.name === input.capability);
-            if (!entry)
-                throw new Error(`Capability "${input.capability}" not declared`);
-            if (entry.mode !== 'collection') {
-                throw new Error(`Capability "${input.capability}" is not a collection`);
-            }
-            const wanted = new Set(input.enabledAddonIds);
-            for (const providerId of entry.providers) {
-                if (wanted.has(providerId)) {
-                    registry.enableCollectionProvider(input.capability, providerId);
-                }
-                else {
-                    registry.disableCollectionProvider(input.capability, providerId);
-                }
-            }
+            // Persisted under `capabilities.collection.<cap>` BEFORE the live
+            // switch. It used to switch live only, so the operator's pick
+            // reverted at the next boot (D62's defect, D675 amendment).
+            await (0, capability_preference_writes_js_1.writeCollectionEnabledSet)(config, registry, input.capability, input.enabledAddonIds);
         }),
         setDeviceCapability: trpc_middleware_js_1.adminProcedure
             .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string(), addonId: zod_1.z.string() }))

package/dist/api/core/capability-preference-writes.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.singletonPreferenceKey = singletonPreferenceKey;
+exports.singletonSwitchRefusal = singletonSwitchRefusal;
+exports.writeSingletonPreference = writeSingletonPreference;
+exports.writeCollectionToggle = writeCollectionToggle;
+exports.writeCollectionEnabledSet = writeCollectionEnabledSet;
+/**
+ * The ONE write order for an operator's capability preference: PERSIST, then
+ * switch the live registry (D675 amendment, 2026-09-29).
+ *
+ * Every caller used to switch the registry first and persist second. Since
+ * D675 `ConfigManager.set` awaits the settings door and REJECTS when the write
+ * does not land, so that order produced a mutation that reported an error
+ * while the live switch had already happened — and silently reverted at the
+ * next boot, because the boot restorer reads the store the write never
+ * reached. The operator saw an error for a change that was visibly in effect.
+ *
+ * Here a refused switch (unknown cap, wrong mode, provider not registered)
+ * persists NOTHING, a failed write changes NOTHING live, and only a write that
+ * landed is applied. Writes to one capability are serialised, because a
+ * collection write computes its next disabled-set from the live one: two
+ * toggles planned against the same base would each persist half of the
+ * answer.
+ *
+ * Callers: `capabilities` core router (`setActiveSingleton`,
+ * `clearSingletonNodeOverride` via `singletonPreferenceKey`,
+ * `setCollectionEnabledProviders`) and the `addons` cap's
+ * `setCapabilityProviderEnabled`.
+ */
+const server_1 = require("@trpc/server");
+const collection_preference_1 = require("./collection-preference");
+/** ConfigService key holding a singleton preference (global or per-node). */
+function singletonPreferenceKey(capability, nodeId) {
+    return nodeId === undefined
+        ? `capabilities.singleton.${capability}`
+        : `capabilities.singletonNode.${capability}.${nodeId}`;
+}
+/**
+ * One write chain per capability, MODULE-LEVEL on purpose: the routers that
+ * write preferences are built per request, so the chain cannot live on them.
+ * It serialises only within this process — correct because only hub-main
+ * mounts these routers; a second process writing preferences would need the
+ * store itself to arbitrate.
+ */
+const writeChains = new Map();
+/** Run `work` after every earlier write to the same capability has settled. */
+async function serialised(capability, work) {
+    const previous = writeChains.get(capability) ?? Promise.resolve();
+    const next = previous.then(work, work);
+    const settled = next.then(() => undefined, () => undefined);
+    writeChains.set(capability, settled);
+    try {
+        await next;
+    }
+    finally {
+        if (writeChains.get(capability) === settled)
+            writeChains.delete(capability);
+    }
+}
+function findCapability(registry, capability) {
+    return registry.listCapabilities().find((c) => c.name === capability) ?? null;
+}
+/**
+ * The refusal `setActiveSingleton` would raise, asked BEFORE anything is
+ * persisted — so a switch the registry would refuse never reaches the store.
+ * Reads the registry's own projection (`providers`, `perNode`), the same sets
+ * `setActiveSingleton` checks.
+ */
+function singletonSwitchRefusal(registry, write) {
+    const cap = findCapability(registry, write.capability);
+    if (cap === null) {
+        return { code: 'NOT_FOUND', message: `Unknown capability: ${write.capability}` };
+    }
+    if (cap.mode !== 'singleton') {
+        return { code: 'BAD_REQUEST', message: `"${write.capability}" is not a singleton` };
+    }
+    if (write.nodeId !== undefined) {
+        const onNode = cap.perNode?.find((n) => n.nodeId === write.nodeId);
+        if (onNode === undefined || !onNode.providers.includes(write.addonId)) {
+            return {
+                code: 'BAD_REQUEST',
+                message: `Provider "${write.addonId}" is not available on node "${write.nodeId}" for "${write.capability}"`,
+            };
+        }
+        return null;
+    }
+    if (!cap.providers.includes(write.addonId)) {
+        return {
+            code: 'BAD_REQUEST',
+            message: `Provider "${write.addonId}" is not registered for "${write.capability}"`,
+        };
+    }
+    return null;
+}
+function refuse(refusal) {
+    throw new server_1.TRPCError({ code: refusal.code, message: refusal.message });
+}
+/** Persist a singleton preference, then switch the registry. */
+async function writeSingletonPreference(store, registry, write) {
+    await serialised(write.capability, async () => {
+        const refusal = singletonSwitchRefusal(registry, write);
+        if (refusal !== null)
+            refuse(refusal);
+        await store.set(singletonPreferenceKey(write.capability, write.nodeId), write.addonId);
+        await registry.setActiveSingleton(write.capability, write.addonId, write.nodeId);
+    });
+}
+function requireCollection(registry, capability) {
+    const cap = findCapability(registry, capability);
+    if (cap === null)
+        refuse({ code: 'NOT_FOUND', message: `Unknown capability: ${capability}` });
+    if (cap.mode !== 'collection') {
+        refuse({ code: 'BAD_REQUEST', message: `"${capability}" is not a collection` });
+    }
+    return cap;
+}
+/** Switch the live registry from `current` to `next` — only after the write landed. */
+function applyDisabledSet(registry, capability, current, next) {
+    for (const addonId of next) {
+        if (!current.has(addonId))
+            registry.disableCollectionProvider(capability, addonId);
+    }
+    for (const addonId of current) {
+        if (!next.has(addonId))
+            registry.enableCollectionProvider(capability, addonId);
+    }
+}
+/** Persist one collection provider's enable/disable, then apply it live. */
+async function writeCollectionToggle(store, registry, toggle) {
+    await serialised(toggle.capability, async () => {
+        const cap = requireCollection(registry, toggle.capability);
+        if (!cap.providers.includes(toggle.addonId)) {
+            refuse({
+                code: 'BAD_REQUEST',
+                message: `Provider "${toggle.addonId}" is not registered for "${toggle.capability}"`,
+            });
+        }
+        const current = new Set(cap.disabledProviders);
+        const next = new Set(current);
+        if (toggle.enabled)
+            next.delete(toggle.addonId);
+        else
+            next.add(toggle.addonId);
+        await (0, collection_preference_1.persistCollectionDisabled)(store, toggle.capability, [...next]);
+        applyDisabledSet(registry, toggle.capability, current, next);
+    });
+}
+/**
+ * Persist the enabled set of a collection in one shot, then apply it live.
+ * Registered providers outside `enabledAddonIds` are disabled; a disabled id
+ * whose provider is not registered right now keeps its disabled mark.
+ */
+async function writeCollectionEnabledSet(store, registry, capability, enabledAddonIds) {
+    await serialised(capability, async () => {
+        const cap = requireCollection(registry, capability);
+        const wanted = new Set(enabledAddonIds);
+        const current = new Set(cap.disabledProviders);
+        const next = new Set(current);
+        for (const providerId of cap.providers) {
+            if (wanted.has(providerId))
+                next.delete(providerId);
+            else
+                next.add(providerId);
+        }
+        await (0, collection_preference_1.persistCollectionDisabled)(store, capability, [...next]);
+        applyDisabledSet(registry, capability, current, next);
+    });
+}

package/dist/api/core/collection-preference.js

@@ -7,10 +7,8 @@ function collectionPreferenceKey(capability) {
     return `capabilities.collection.${capability}`;
 }
 /**
- * Persist the disabled-addonId set for a collection capability. Pass the
- * authoritative set straight from `registry.listCapabilities()` after the
- * enable/disable mutation so the stored value always mirrors the live
- * registry state.
+ * Persist the disabled-addonId set for a collection capability: the set the
+ * registry WILL hold once the write has landed and is applied.
  */
 async function persistCollectionDisabled(configService, capability, disabled) {
     await configService.set(collectionPreferenceKey(capability), JSON.stringify({ disabled: [...disabled] }));

package/dist/api/trpc/generated-cap-routers.js

@@ -6393,33 +6393,6 @@ function createCapRouter_pipelineAnalytics(getProvider, createRemoteProxy) {
             // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
             return p.listRecentTracks(methodInput);
         }),
-        listSummaries: trpc_middleware_js_1.protectedProcedure
-            .input(types_89.pipelineAnalyticsCapability.methods.listSummaries.input.loose())
-            .output(types_89.pipelineAnalyticsCapability.methods.listSummaries.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.listSummaries(methodInput);
-        }),
-        listRecentSummaries: trpc_middleware_js_1.protectedProcedure
-            .input(types_89.pipelineAnalyticsCapability.methods.listRecentSummaries.input.loose())
-            .output(types_89.pipelineAnalyticsCapability.methods.listRecentSummaries.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.listRecentSummaries(methodInput);
-        }),
-        getSummary: trpc_middleware_js_1.protectedProcedure
-            .input(types_89.pipelineAnalyticsCapability.methods.getSummary.input.loose())
-            .output(types_89.pipelineAnalyticsCapability.methods.getSummary.output)
-            .query(async ({ input, ctx }) => {
-            const { nodeId, ...methodInput } = input;
-            const p = resolveProvider('pipeline-analytics', nodeId, () => getProvider(ctx), createRemoteProxy);
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-argument
-            return p.getSummary(methodInput);
-        }),
         clearTracks: trpc_middleware_js_1.adminProcedure
             .input(types_89.pipelineAnalyticsCapability.methods.clearTracks.input.loose())
             .output(types_89.pipelineAnalyticsCapability.methods.clearTracks.output)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/server",
-  "version": "1.2.410",
+  "version": "1.2.412",
   "license": "MIT",
   "private": false,
   "files": [
@@ -37,18 +37,18 @@
     ]
   },
   "dependencies": {
-    "@camstack/addon-admin-ui": "1.2.286",
-    "@camstack/addon-agent-ui": "1.2.155",
+    "@camstack/addon-admin-ui": "1.2.287",
+    "@camstack/addon-agent-ui": "1.2.156",
     "@camstack/addon-auth": "1.2.123",
     "@camstack/addon-decoder-nodeav": "1.2.115",
     "@camstack/addon-notifiers": "1.2.121",
-    "@camstack/addon-pipeline": "1.2.305",
-    "@camstack/addon-pipeline-orchestrator": "1.2.262",
-    "@camstack/addon-post-analysis": "1.2.297",
+    "@camstack/addon-pipeline": "1.2.306",
+    "@camstack/addon-pipeline-orchestrator": "1.2.263",
+    "@camstack/addon-post-analysis": "1.2.298",
     "@camstack/sdk": "1.2.118",
-    "@camstack/system": "1.2.318",
-    "@camstack/types": "1.2.272",
-    "@camstack/ui-library": "1.2.213",
+    "@camstack/system": "1.2.320",
+    "@camstack/types": "1.2.273",
+    "@camstack/ui-library": "1.2.214",
     "@fastify/compress": "^9.0.0",
     "@fastify/cookie": "^11.0.2",
     "@fastify/cors": "^11.2.0",

package/dist/api/capabilities.router.js

@@ -1,246 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCapabilitiesRouter = createCapabilitiesRouter;
-const zod_1 = require("zod");
-const server_1 = require("@trpc/server");
-const trpc_middleware_1 = require("./trpc/trpc.middleware");
-const system_1 = require("@camstack/system");
-const collection_preference_1 = require("./core/collection-preference");
-// ─── Zod Schemas ───────────────────────────────────────────────────────────
-const setPreferenceInput = zod_1.z.discriminatedUnion('mode', [
-    zod_1.z.object({
-        mode: zod_1.z.literal('singleton'),
-        capability: zod_1.z.string(),
-        addonId: zod_1.z.string(),
-    }),
-    zod_1.z.object({
-        mode: zod_1.z.literal('collection'),
-        capability: zod_1.z.string(),
-        addonId: zod_1.z.string(),
-        enabled: zod_1.z.boolean(),
-    }),
-]);
-// ─── Router ────────────────────────────────────────────────────────────────
-function createCapabilitiesRouter(addonRegistry, configService, loggingService) {
-    const logger = loggingService.createLogger('CapabilitiesRouter');
-    /** Build enriched provider details from addon metadata */
-    function getProviderDetails(addonIds) {
-        const allAddons = addonRegistry.listAllAddons();
-        return addonIds.map((addonId) => {
-            const addon = allAddons.find((a) => a.manifest.id === addonId);
-            return {
-                addonId,
-                displayName: addon?.manifest.name ?? addonId,
-                packageName: addon?.manifest.packageName ?? addonId,
-            };
-        });
-    }
-    return (0, trpc_middleware_1.trpcRouter)({
-        // ─── List all capabilities with enriched metadata ──────────────────
-        list: trpc_middleware_1.adminProcedure.query(() => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            const caps = registry.listCapabilities();
-            return caps.map((cap) => ({
-                ...cap,
-                providerDetails: getProviderDetails(cap.providers),
-                isInfra: (0, system_1.isInfraCapability)(cap.name),
-            }));
-        }),
-        // ─── Get current preference for a capability ──────────────────────
-        //
-        // `state` separates "the operator set nothing" (`known`, `preference`
-        // null / no disabled ids) from "the persisted preference cannot be read"
-        // (`unknown` — the boot read of the settings store is pending or failed,
-        // D675). The latter used to be reported as `null`: an unset preference.
-        getPreference: trpc_middleware_1.adminProcedure.input(zod_1.z.object({ capability: zod_1.z.string() })).query(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            const mode = registry.getMode(input.capability);
-            if (!mode)
-                return null;
-            let raw;
-            try {
-                raw = configService.get(mode === 'singleton'
-                    ? `capabilities.singleton.${input.capability}`
-                    : (0, collection_preference_1.collectionPreferenceKey)(input.capability));
-            }
-            catch (err) {
-                if (!(0, system_1.isSettingsReadUnavailable)(err))
-                    throw err;
-                return {
-                    capability: input.capability,
-                    mode,
-                    state: 'unknown',
-                    reason: err.reason,
-                    preference: null,
-                };
-            }
-            if (mode === 'singleton') {
-                return {
-                    capability: input.capability,
-                    mode: 'singleton',
-                    state: 'known',
-                    preference: raw ? { addonId: raw } : null,
-                };
-            }
-            // collection
-            let disabled = [];
-            if (raw) {
-                try {
-                    const parsed = JSON.parse(raw);
-                    if (typeof parsed === 'object' && parsed !== null && 'disabled' in parsed) {
-                        const list = parsed.disabled;
-                        disabled = Array.isArray(list)
-                            ? list.filter((id) => typeof id === 'string')
-                            : [];
-                    }
-                }
-                catch {
-                    /* ignore malformed */
-                }
-            }
-            return {
-                capability: input.capability,
-                mode: 'collection',
-                state: 'known',
-                preference: { disabled },
-            };
-        }),
-        // ─── Set preference (singleton switch or collection toggle) ───────
-        setPreference: trpc_middleware_1.adminProcedure.input(setPreferenceInput).mutation(async ({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            if (input.mode === 'singleton') {
-                const { capability, addonId } = input;
-                const caps = registry.listCapabilities();
-                const cap = caps.find((c) => c.name === capability);
-                if (!cap)
-                    throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Unknown capability: ${capability}` });
-                if (cap.mode !== 'singleton')
-                    throw new server_1.TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `"${capability}" is not a singleton`,
-                    });
-                if (!cap.providers.includes(addonId)) {
-                    throw new server_1.TRPCError({
-                        code: 'BAD_REQUEST',
-                        message: `Provider "${addonId}" is not registered for "${capability}"`,
-                    });
-                }
-                const requiresRestart = (0, system_1.isInfraCapability)(capability);
-                if (!requiresRestart) {
-                    // Hot-swap at runtime
-                    await registry.setActiveSingleton(capability, addonId);
-                }
-                // Persist preference
-                await configService.set(`capabilities.singleton.${capability}`, addonId);
-                logger.info('Singleton preference set', {
-                    tags: { addonId },
-                    meta: { capability, requiresRestart },
-                });
-                return { success: true, requiresRestart };
-            }
-            // collection toggle
-            const { capability, addonId, enabled } = input;
-            const caps = registry.listCapabilities();
-            const cap = caps.find((c) => c.name === capability);
-            if (!cap)
-                throw new server_1.TRPCError({ code: 'NOT_FOUND', message: `Unknown capability: ${capability}` });
-            if (cap.mode !== 'collection')
-                throw new server_1.TRPCError({ code: 'BAD_REQUEST', message: `"${capability}" is not a collection` });
-            if (!cap.providers.includes(addonId)) {
-                throw new server_1.TRPCError({
-                    code: 'BAD_REQUEST',
-                    message: `Provider "${addonId}" is not registered for "${capability}"`,
-                });
-            }
-            if (enabled) {
-                registry.enableCollectionProvider(capability, addonId);
-            }
-            else {
-                registry.disableCollectionProvider(capability, addonId);
-            }
-            // Persist disabled list via the shared canonical writer.
-            const updatedCap = registry.listCapabilities().find((c) => c.name === capability);
-            await (0, collection_preference_1.persistCollectionDisabled)(configService, capability, updatedCap?.disabledProviders ?? []);
-            logger.info('Collection provider toggled', {
-                tags: { addonId },
-                meta: { capability, enabled },
-            });
-            return { success: true, requiresRestart: false };
-        }),
-        // ─── Reset preference to default ──────────────────────────────────
-        resetPreference: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ capability: zod_1.z.string() }))
-            .mutation(async ({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            const mode = registry.getMode(input.capability);
-            if (!mode)
-                throw new server_1.TRPCError({
-                    code: 'NOT_FOUND',
-                    message: `Unknown capability: ${input.capability}`,
-                });
-            if (mode === 'singleton') {
-                await configService.set(`capabilities.singleton.${input.capability}`, null);
-                logger.info('Singleton preference reset (takes effect on restart)', {
-                    meta: { capability: input.capability },
-                });
-                return { success: true, requiresRestart: true };
-            }
-            // collection: re-enable all disabled providers
-            const caps = registry.listCapabilities();
-            const cap = caps.find((c) => c.name === input.capability);
-            if (cap) {
-                for (const addonId of cap.disabledProviders) {
-                    registry.enableCollectionProvider(input.capability, addonId);
-                }
-            }
-            await configService.set(`capabilities.collection.${input.capability}`, null);
-            logger.info('Collection preference reset (all providers re-enabled)', {
-                meta: { capability: input.capability },
-            });
-            return { success: true, requiresRestart: false };
-        }),
-        // ─── Per-device overrides (existing, unchanged) ───────────────────
-        listCapabilities: trpc_middleware_1.adminProcedure.query(() => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            return registry.listCapabilities();
-        }),
-        setDeviceCapability: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string(), addonId: zod_1.z.string() }))
-            .mutation(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            registry.setDeviceOverride(input.deviceId, input.capability, input.addonId);
-            logger.info('Device capability override set', {
-                tags: { deviceId: Number(input.deviceId), addonId: input.addonId },
-                meta: { capability: input.capability },
-            });
-        }),
-        clearDeviceCapability: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string(), capability: zod_1.z.string() }))
-            .mutation(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            registry.clearDeviceOverride(input.deviceId, input.capability);
-            logger.info('Device capability override cleared', {
-                tags: { deviceId: Number(input.deviceId) },
-                meta: { capability: input.capability },
-            });
-        }),
-        getDeviceCapabilities: trpc_middleware_1.adminProcedure
-            .input(zod_1.z.object({ deviceId: zod_1.z.string() }))
-            .output(zod_1.z.record(zod_1.z.string(), zod_1.z.string()))
-            .query(({ input }) => {
-            const registry = addonRegistry.getCapabilityRegistry();
-            const overrides = registry.getDeviceOverrides(input.deviceId);
-            return Object.fromEntries(overrides);
-        }),
-        /*
-         * `setDeviceCollectionFilter` / `clearDeviceCollectionFilter` were REMOVED
-         * here (D556). They wrote an in-memory per-device allow list that nothing
-         * persisted, so an operator's pick survived until the next hub restart and
-         * then silently reverted — a control that looks like it works, which is the
-         * defect D62 exists for. Which sources a camera has is now asked of the ONE
-         * authority that already owned a per-camera function switch:
-         * `deviceManager.setWrapperActive`. The registry keeps only its projection,
-         * written by `device-source-activation.ts` and by nothing else.
-         */
-    });
-}