@camstack/system 1.1.32 → 1.1.34

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-jWKVwa7t.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CAnO1wPx.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-DXMKBZW1.mjs";
+import { F as createUdsLoggerWithControl, I as LocalChildClient, i as createUdsAddonContext, it as setWorkerNativeCapsChangeListener, nt as getWorkerNativeCapSnapshot, ot as validateProviderRegistrations, t as installManifestPythonDeps, tt as getWorkerNativeCapProvider, vt as installManifestNativeDeps, yt as resolveAddonClass } from "./manifest-python-deps-u-AQBQY6.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { register } from "node:module";
 import * as fs from "node:fs";

package/dist/builtins/snapshot/index.js

@@ -28,8 +28,18 @@ var BATTERY_DEFAULT_MAX_AGE_S = 3600;
 * ffmpeg fallback, caching) is this addon's concern; stream-broker only
 * publishes stream endpoints.
 */
-var SnapshotAddon = class extends _camstack_types.BaseAddon {
+var SnapshotAddon = class SnapshotAddon extends _camstack_types.BaseAddon {
 	cache = /* @__PURE__ */ new Map();
+	/**
+	* Cached resolution of `pipelineOrchestrator.getIngestOwner` — SnapshotAddon
+	* has no per-request attach hook to resolve this fresh, so it's cached with
+	* a short TTL and invalidated on `onConfigChanged` (covers the common case
+	* of an operator re-saving cluster/agent settings). A stale owner for up to
+	* `OWNER_CACHE_TTL_MS` just means a snapshot fallback briefly targets the
+	* previous ingest owner — self-heals on the next resolve.
+	*/
+	ownerCache = null;
+	static OWNER_CACHE_TTL_MS = 3e4;
 	constructor() {
 		super({ staleTtlMs: 6e4 });
 	}
@@ -49,6 +59,18 @@ var SnapshotAddon = class extends _camstack_types.BaseAddon {
 	}
 	async onShutdown() {
 		this.cache.clear();
+		this.ownerCache = null;
+	}
+	/**
+	* Drop the cached ingest owner whenever addon-level settings change —
+	* cheap, correct-by-construction refresh point (BaseAddon calls this
+	* after every `updateGlobalSettings`/`updateAddonSettings`). Combined
+	* with the TTL in `resolveIngestOwner`, a cluster topology change is
+	* picked up either on the next settings save or within
+	* `OWNER_CACHE_TTL_MS`, whichever comes first.
+	*/
+	async onConfigChanged() {
+		this.ownerCache = null;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
@@ -191,11 +213,24 @@ var SnapshotAddon = class extends _camstack_types.BaseAddon {
 	* first to go idle, racing every snapshot with a broker resume.
 	* Now we ask the orchestrator of streams which one is warm and grab
 	* from there.
+	*
+	* Source acquisition is pinned to the cluster's ingest owner (the node
+	* the stream-broker actually runs on) instead of the device-scoped
+	* `dev.cameraStreams` facade — `dev.cameraStreams` resolves against
+	* whichever node the cap-router picks by default, which double-pulls
+	* the camera (or dials a hub-local restream that isn't serving) when
+	* `ingestNode != hub`. `fetchSnapshotBrokerEntries` does the pinned
+	* fetch + owner-relative URL host rewrite; hub-owner + no reachable
+	* host is byte-identical to the previous unpinned call.
 	*/
 	async grabFrameFromBroker(deviceId, preferredStreamId) {
-		const dev = await this.ctx.fetchDevice(deviceId);
 		const prefix = `${deviceId}/`;
-		const [deviceEntries, profileSlots] = await Promise.all([dev.cameraStreams?.getRtspEntries({}) ?? [], dev.cameraStreams?.getBrokerStreams({}) ?? []]);
+		const owner = await this.resolveIngestOwner();
+		const { entries: deviceEntries, slots: profileSlots } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+			deviceId,
+			ownerNodeId: owner.ownerNodeId,
+			reachableHost: owner.reachableHost
+		});
 		const usable = deviceEntries.filter((e) => e.enabled && !!e.url);
 		if (usable.length === 0) return null;
 		if (preferredStreamId && preferredStreamId !== "auto") {
@@ -225,6 +260,35 @@ var SnapshotAddon = class extends _camstack_types.BaseAddon {
 		return null;
 	}
 	/**
+	* Cached, TTL-bounded resolution of the cluster's camera-source owner.
+	* See `ownerCache` doc for the invalidation story.
+	*/
+	async resolveIngestOwner() {
+		const now = Date.now();
+		if (this.ownerCache && now - this.ownerCache.ts < SnapshotAddon.OWNER_CACHE_TTL_MS) return this.ownerCache.owner;
+		const owner = await this.fetchIngestOwner();
+		this.ownerCache = {
+			owner,
+			ts: now
+		};
+		return owner;
+	}
+	/**
+	* Same graceful degrade as the recorder's `resolveIngestOwner`
+	* (`packages/addon-pipeline/src/recorder/addon/index.ts`) — the cap may
+	* not be mounted yet (pre-image-release) or the pipeline-orchestrator
+	* addon may be absent entirely; either way we fall back to `'hub'`,
+	* which is byte-identical to the previous hardcoded hub-only behaviour.
+	*/
+	async fetchIngestOwner() {
+		try {
+			return await this.ctx.api.pipelineOrchestrator.getIngestOwner.query();
+		} catch (err) {
+			this.ctx.logger.warn("snapshot: getIngestOwner unavailable — defaulting to hub (cap not mounted yet?)", { meta: { error: (0, _camstack_types.errMsg)(err) } });
+			return { ownerNodeId: "hub" };
+		}
+	}
+	/**
 	* Ffmpeg grab with one retry on the broker-cold-start error
 	* signature. Covers the window between "client connected" and
 	* "first keyframe" when a suspended broker resumes.
@@ -264,10 +328,24 @@ var SnapshotAddon = class extends _camstack_types.BaseAddon {
 	* grabbing a frame is free (a consumer is already keeping the
 	* stream warm). When everything is suspended, the fallback would
 	* dial the camera and wake it — defeats the sleeping cache.
+	*
+	* Pinned to the ingest owner via `fetchSnapshotBrokerEntries` — same
+	* rationale as `grabFrameFromBroker`: the device-scoped
+	* `dev.cameraStreams` facade resolves against whichever node the
+	* cap-router picks by default, which is wrong once `ingestNode !=
+	* hub` (queries the hub for slots that only exist on the agent,
+	* always reporting no streaming broker). Owner === hub (no reachable
+	* host) is byte-identical to the previous unpinned call.
 	*/
 	async hasStreamingBrokerForDevice(deviceId) {
 		try {
-			return (await (await this.ctx.fetchDevice(deviceId)).cameraStreams?.getBrokerStreams({}) ?? []).some((s) => s.status === "streaming");
+			const owner = await this.resolveIngestOwner();
+			const { slots } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+				deviceId,
+				ownerNodeId: owner.ownerNodeId,
+				reachableHost: owner.reachableHost
+			});
+			return slots.some((s) => s.status === "streaming");
 		} catch {
 			return false;
 		}
@@ -379,13 +457,27 @@ var SnapshotAddon = class extends _camstack_types.BaseAddon {
 	async isDeviceBattery(deviceId) {
 		return (await this.lookupDeviceMeta(deviceId))?.isBattery ?? false;
 	}
+	/**
+	* Feeds the settings-UI stream picker. Pinned to the ingest owner via
+	* `fetchSnapshotBrokerEntries` — the device-scoped `dev.cameraStreams`
+	* facade this used to call resolves against whichever node the
+	* cap-router picks by default, which is empty once `ingestNode !=
+	* hub` (the picker would render nothing but "Auto"). Owner === hub
+	* (no reachable host) is byte-identical to the previous unpinned call.
+	*/
 	async getStreamOptions(deviceId) {
 		const prefix = `${deviceId}/`;
 		try {
+			const owner = await this.resolveIngestOwner();
+			const { entries } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+				deviceId,
+				ownerNodeId: owner.ownerNodeId,
+				reachableHost: owner.reachableHost
+			});
 			return [{
 				value: "auto",
 				label: "Auto"
-			}, ...(await (await this.ctx.fetchDevice(deviceId)).cameraStreams?.getRtspEntries({}) ?? []).filter((e) => e.enabled).map((e) => e.brokerId.slice(prefix.length)).map((id) => ({
+			}, ...entries.filter((e) => e.enabled).map((e) => e.brokerId.slice(prefix.length)).map((id) => ({
 				value: id,
 				label: (0, _camstack_types.streamQualityLabel)(id)
 			}))];
@@ -422,6 +514,39 @@ function isAbsentNativeError(msg) {
 	return msg.includes("no provider for") || msg.includes("no native provider for capability");
 }
 /**
+* Pinned, testable fetch of this device's RTSP restream entries + profile
+* slots from the system `streamBroker` cap. Module-level (not a class
+* method) so `grabFrameFromBroker`'s owner-pin + host-rewrite contract is
+* directly unit-testable without instantiating the addon — mirrors
+* `acquireSessionDecodeRestreamFrom` in `pipeline-runner/index.ts`.
+*
+* Replaces the former `dev.cameraStreams.getRtspEntries({})` /
+* `getBrokerStreams({})` device-scoped facade calls, which resolve against
+* whichever node the cap-router picks by default — wrong once
+* `ingestNode != hub` (double-pulls the camera, or dials a hub-local
+* restream nobody is serving). `getAllRtspEntries`/`listAllProfileSlots`
+* are cluster-wide system-cap methods; pinning the call with `nodePin` +
+* filtering by the `${deviceId}/` brokerId prefix reproduces the exact
+* device-scoped result set the facade used to return.
+*
+* `reachableHost`, when present, rides as the cap's own `hostname` input —
+* the broker rewrites the returned URLs' host itself (same mechanism
+* `getStreamWithCodec` callers use for cross-node pulls), so no separate
+* client-side host-substitution is needed here. Omitting `hostname`
+* (owner === hub, no reachable host registered) leaves the broker's
+* default `127.0.0.1` URLs untouched — byte-identical to today.
+*/
+async function fetchSnapshotBrokerEntries(api, params) {
+	const { deviceId, ownerNodeId, reachableHost } = params;
+	const prefix = `${deviceId}/`;
+	const pin = (0, _camstack_types.nodePin)(ownerNodeId);
+	const [allEntries, allSlots] = await Promise.all([api.streamBroker.getAllRtspEntries.query(reachableHost !== void 0 ? { hostname: reachableHost } : {}, pin), api.streamBroker.listAllProfileSlots.query(void 0, pin)]);
+	return {
+		entries: allEntries.filter((e) => e.brokerId.startsWith(prefix)),
+		slots: allSlots.filter((s) => s.deviceId === deviceId)
+	};
+}
+/**
 * Quality ordering for broker picker: `high` > `mid` > `low` > other.
 * The streamId is the suffix after `${deviceId}/` in the brokerId.
 * Unknown labels fall through to 0 so they land at the bottom of the

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { BaseAddon, DeviceFeature, DeviceType, errMsg, snapshotCapability, streamQualityLabel } from "@camstack/types";
+import { BaseAddon, DeviceFeature, DeviceType, errMsg, nodePin, snapshotCapability, streamQualityLabel } from "@camstack/types";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot.addon.ts
 /** Default cache window for non-battery cams (seconds). 10s feels live. */
@@ -23,8 +23,18 @@ var BATTERY_DEFAULT_MAX_AGE_S = 3600;
 * ffmpeg fallback, caching) is this addon's concern; stream-broker only
 * publishes stream endpoints.
 */
-var SnapshotAddon = class extends BaseAddon {
+var SnapshotAddon = class SnapshotAddon extends BaseAddon {
 	cache = /* @__PURE__ */ new Map();
+	/**
+	* Cached resolution of `pipelineOrchestrator.getIngestOwner` — SnapshotAddon
+	* has no per-request attach hook to resolve this fresh, so it's cached with
+	* a short TTL and invalidated on `onConfigChanged` (covers the common case
+	* of an operator re-saving cluster/agent settings). A stale owner for up to
+	* `OWNER_CACHE_TTL_MS` just means a snapshot fallback briefly targets the
+	* previous ingest owner — self-heals on the next resolve.
+	*/
+	ownerCache = null;
+	static OWNER_CACHE_TTL_MS = 3e4;
 	constructor() {
 		super({ staleTtlMs: 6e4 });
 	}
@@ -44,6 +54,18 @@ var SnapshotAddon = class extends BaseAddon {
 	}
 	async onShutdown() {
 		this.cache.clear();
+		this.ownerCache = null;
+	}
+	/**
+	* Drop the cached ingest owner whenever addon-level settings change —
+	* cheap, correct-by-construction refresh point (BaseAddon calls this
+	* after every `updateGlobalSettings`/`updateAddonSettings`). Combined
+	* with the TTL in `resolveIngestOwner`, a cluster topology change is
+	* picked up either on the next settings save or within
+	* `OWNER_CACHE_TTL_MS`, whichever comes first.
+	*/
+	async onConfigChanged() {
+		this.ownerCache = null;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
@@ -186,11 +208,24 @@ var SnapshotAddon = class extends BaseAddon {
 	* first to go idle, racing every snapshot with a broker resume.
 	* Now we ask the orchestrator of streams which one is warm and grab
 	* from there.
+	*
+	* Source acquisition is pinned to the cluster's ingest owner (the node
+	* the stream-broker actually runs on) instead of the device-scoped
+	* `dev.cameraStreams` facade — `dev.cameraStreams` resolves against
+	* whichever node the cap-router picks by default, which double-pulls
+	* the camera (or dials a hub-local restream that isn't serving) when
+	* `ingestNode != hub`. `fetchSnapshotBrokerEntries` does the pinned
+	* fetch + owner-relative URL host rewrite; hub-owner + no reachable
+	* host is byte-identical to the previous unpinned call.
 	*/
 	async grabFrameFromBroker(deviceId, preferredStreamId) {
-		const dev = await this.ctx.fetchDevice(deviceId);
 		const prefix = `${deviceId}/`;
-		const [deviceEntries, profileSlots] = await Promise.all([dev.cameraStreams?.getRtspEntries({}) ?? [], dev.cameraStreams?.getBrokerStreams({}) ?? []]);
+		const owner = await this.resolveIngestOwner();
+		const { entries: deviceEntries, slots: profileSlots } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+			deviceId,
+			ownerNodeId: owner.ownerNodeId,
+			reachableHost: owner.reachableHost
+		});
 		const usable = deviceEntries.filter((e) => e.enabled && !!e.url);
 		if (usable.length === 0) return null;
 		if (preferredStreamId && preferredStreamId !== "auto") {
@@ -220,6 +255,35 @@ var SnapshotAddon = class extends BaseAddon {
 		return null;
 	}
 	/**
+	* Cached, TTL-bounded resolution of the cluster's camera-source owner.
+	* See `ownerCache` doc for the invalidation story.
+	*/
+	async resolveIngestOwner() {
+		const now = Date.now();
+		if (this.ownerCache && now - this.ownerCache.ts < SnapshotAddon.OWNER_CACHE_TTL_MS) return this.ownerCache.owner;
+		const owner = await this.fetchIngestOwner();
+		this.ownerCache = {
+			owner,
+			ts: now
+		};
+		return owner;
+	}
+	/**
+	* Same graceful degrade as the recorder's `resolveIngestOwner`
+	* (`packages/addon-pipeline/src/recorder/addon/index.ts`) — the cap may
+	* not be mounted yet (pre-image-release) or the pipeline-orchestrator
+	* addon may be absent entirely; either way we fall back to `'hub'`,
+	* which is byte-identical to the previous hardcoded hub-only behaviour.
+	*/
+	async fetchIngestOwner() {
+		try {
+			return await this.ctx.api.pipelineOrchestrator.getIngestOwner.query();
+		} catch (err) {
+			this.ctx.logger.warn("snapshot: getIngestOwner unavailable — defaulting to hub (cap not mounted yet?)", { meta: { error: errMsg(err) } });
+			return { ownerNodeId: "hub" };
+		}
+	}
+	/**
 	* Ffmpeg grab with one retry on the broker-cold-start error
 	* signature. Covers the window between "client connected" and
 	* "first keyframe" when a suspended broker resumes.
@@ -259,10 +323,24 @@ var SnapshotAddon = class extends BaseAddon {
 	* grabbing a frame is free (a consumer is already keeping the
 	* stream warm). When everything is suspended, the fallback would
 	* dial the camera and wake it — defeats the sleeping cache.
+	*
+	* Pinned to the ingest owner via `fetchSnapshotBrokerEntries` — same
+	* rationale as `grabFrameFromBroker`: the device-scoped
+	* `dev.cameraStreams` facade resolves against whichever node the
+	* cap-router picks by default, which is wrong once `ingestNode !=
+	* hub` (queries the hub for slots that only exist on the agent,
+	* always reporting no streaming broker). Owner === hub (no reachable
+	* host) is byte-identical to the previous unpinned call.
 	*/
 	async hasStreamingBrokerForDevice(deviceId) {
 		try {
-			return (await (await this.ctx.fetchDevice(deviceId)).cameraStreams?.getBrokerStreams({}) ?? []).some((s) => s.status === "streaming");
+			const owner = await this.resolveIngestOwner();
+			const { slots } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+				deviceId,
+				ownerNodeId: owner.ownerNodeId,
+				reachableHost: owner.reachableHost
+			});
+			return slots.some((s) => s.status === "streaming");
 		} catch {
 			return false;
 		}
@@ -374,13 +452,27 @@ var SnapshotAddon = class extends BaseAddon {
 	async isDeviceBattery(deviceId) {
 		return (await this.lookupDeviceMeta(deviceId))?.isBattery ?? false;
 	}
+	/**
+	* Feeds the settings-UI stream picker. Pinned to the ingest owner via
+	* `fetchSnapshotBrokerEntries` — the device-scoped `dev.cameraStreams`
+	* facade this used to call resolves against whichever node the
+	* cap-router picks by default, which is empty once `ingestNode !=
+	* hub` (the picker would render nothing but "Auto"). Owner === hub
+	* (no reachable host) is byte-identical to the previous unpinned call.
+	*/
 	async getStreamOptions(deviceId) {
 		const prefix = `${deviceId}/`;
 		try {
+			const owner = await this.resolveIngestOwner();
+			const { entries } = await fetchSnapshotBrokerEntries(this.ctx.api, {
+				deviceId,
+				ownerNodeId: owner.ownerNodeId,
+				reachableHost: owner.reachableHost
+			});
 			return [{
 				value: "auto",
 				label: "Auto"
-			}, ...(await (await this.ctx.fetchDevice(deviceId)).cameraStreams?.getRtspEntries({}) ?? []).filter((e) => e.enabled).map((e) => e.brokerId.slice(prefix.length)).map((id) => ({
+			}, ...entries.filter((e) => e.enabled).map((e) => e.brokerId.slice(prefix.length)).map((id) => ({
 				value: id,
 				label: streamQualityLabel(id)
 			}))];
@@ -417,6 +509,39 @@ function isAbsentNativeError(msg) {
 	return msg.includes("no provider for") || msg.includes("no native provider for capability");
 }
 /**
+* Pinned, testable fetch of this device's RTSP restream entries + profile
+* slots from the system `streamBroker` cap. Module-level (not a class
+* method) so `grabFrameFromBroker`'s owner-pin + host-rewrite contract is
+* directly unit-testable without instantiating the addon — mirrors
+* `acquireSessionDecodeRestreamFrom` in `pipeline-runner/index.ts`.
+*
+* Replaces the former `dev.cameraStreams.getRtspEntries({})` /
+* `getBrokerStreams({})` device-scoped facade calls, which resolve against
+* whichever node the cap-router picks by default — wrong once
+* `ingestNode != hub` (double-pulls the camera, or dials a hub-local
+* restream nobody is serving). `getAllRtspEntries`/`listAllProfileSlots`
+* are cluster-wide system-cap methods; pinning the call with `nodePin` +
+* filtering by the `${deviceId}/` brokerId prefix reproduces the exact
+* device-scoped result set the facade used to return.
+*
+* `reachableHost`, when present, rides as the cap's own `hostname` input —
+* the broker rewrites the returned URLs' host itself (same mechanism
+* `getStreamWithCodec` callers use for cross-node pulls), so no separate
+* client-side host-substitution is needed here. Omitting `hostname`
+* (owner === hub, no reachable host registered) leaves the broker's
+* default `127.0.0.1` URLs untouched — byte-identical to today.
+*/
+async function fetchSnapshotBrokerEntries(api, params) {
+	const { deviceId, ownerNodeId, reachableHost } = params;
+	const prefix = `${deviceId}/`;
+	const pin = nodePin(ownerNodeId);
+	const [allEntries, allSlots] = await Promise.all([api.streamBroker.getAllRtspEntries.query(reachableHost !== void 0 ? { hostname: reachableHost } : {}, pin), api.streamBroker.listAllProfileSlots.query(void 0, pin)]);
+	return {
+		entries: allEntries.filter((e) => e.brokerId.startsWith(prefix)),
+		slots: allSlots.filter((s) => s.deviceId === deviceId)
+	};
+}
+/**
 * Quality ordering for broker picker: `high` > `mid` > `low` > other.
 * The streamId is the suffix after `${deviceId}/` in the brokerId.
 * Unknown labels fall through to 0 so they land at the bottom of the

package/dist/builtins/snapshot/snapshot.addon.d.ts

@@ -1,4 +1,4 @@
-import { ProviderRegistration, BaseAddon } from '@camstack/types';
+import { AddonApi, ProfileSlot, ProviderRegistration, RtspRestreamEntry, BaseAddon } from '@camstack/types';
 interface SnapshotAddonConfig {
     /**
      * Last-resort cache age (ms): if every live capture path fails
@@ -30,9 +30,28 @@ interface SnapshotAddonConfig {
  */
 export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
     private readonly cache;
+    /**
+     * Cached resolution of `pipelineOrchestrator.getIngestOwner` — SnapshotAddon
+     * has no per-request attach hook to resolve this fresh, so it's cached with
+     * a short TTL and invalidated on `onConfigChanged` (covers the common case
+     * of an operator re-saving cluster/agent settings). A stale owner for up to
+     * `OWNER_CACHE_TTL_MS` just means a snapshot fallback briefly targets the
+     * previous ingest owner — self-heals on the next resolve.
+     */
+    private ownerCache;
+    private static readonly OWNER_CACHE_TTL_MS;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
     protected onShutdown(): Promise<void>;
+    /**
+     * Drop the cached ingest owner whenever addon-level settings change —
+     * cheap, correct-by-construction refresh point (BaseAddon calls this
+     * after every `updateGlobalSettings`/`updateAddonSettings`). Combined
+     * with the TTL in `resolveIngestOwner`, a cluster topology change is
+     * picked up either on the next settings save or within
+     * `OWNER_CACHE_TTL_MS`, whichever comes first.
+     */
+    protected onConfigChanged(): Promise<void>;
     protected globalSettingsSchema(): import('@camstack/types').ConfigUISchema;
     private getSnapshot;
     /**
@@ -63,8 +82,30 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      * first to go idle, racing every snapshot with a broker resume.
      * Now we ask the orchestrator of streams which one is warm and grab
      * from there.
+     *
+     * Source acquisition is pinned to the cluster's ingest owner (the node
+     * the stream-broker actually runs on) instead of the device-scoped
+     * `dev.cameraStreams` facade — `dev.cameraStreams` resolves against
+     * whichever node the cap-router picks by default, which double-pulls
+     * the camera (or dials a hub-local restream that isn't serving) when
+     * `ingestNode != hub`. `fetchSnapshotBrokerEntries` does the pinned
+     * fetch + owner-relative URL host rewrite; hub-owner + no reachable
+     * host is byte-identical to the previous unpinned call.
      */
     private grabFrameFromBroker;
+    /**
+     * Cached, TTL-bounded resolution of the cluster's camera-source owner.
+     * See `ownerCache` doc for the invalidation story.
+     */
+    private resolveIngestOwner;
+    /**
+     * Same graceful degrade as the recorder's `resolveIngestOwner`
+     * (`packages/addon-pipeline/src/recorder/addon/index.ts`) — the cap may
+     * not be mounted yet (pre-image-release) or the pipeline-orchestrator
+     * addon may be absent entirely; either way we fall back to `'hub'`,
+     * which is byte-identical to the previous hardcoded hub-only behaviour.
+     */
+    private fetchIngestOwner;
     /**
      * Ffmpeg grab with one retry on the broker-cold-start error
      * signature. Covers the window between "client connected" and
@@ -87,6 +128,14 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
      * grabbing a frame is free (a consumer is already keeping the
      * stream warm). When everything is suspended, the fallback would
      * dial the camera and wake it — defeats the sleeping cache.
+     *
+     * Pinned to the ingest owner via `fetchSnapshotBrokerEntries` — same
+     * rationale as `grabFrameFromBroker`: the device-scoped
+     * `dev.cameraStreams` facade resolves against whichever node the
+     * cap-router picks by default, which is wrong once `ingestNode !=
+     * hub` (queries the hub for slots that only exist on the agent,
+     * always reporting no streaming broker). Owner === hub (no reachable
+     * host) is byte-identical to the previous unpinned call.
      */
     private hasStreamingBrokerForDevice;
     /**
@@ -114,7 +163,48 @@ export declare class SnapshotAddon extends BaseAddon<SnapshotAddonConfig> {
     private lookupDeviceMeta;
     /** Settings-UI helper — battery flag drives the default max-age in the field description. */
     private isDeviceBattery;
+    /**
+     * Feeds the settings-UI stream picker. Pinned to the ingest owner via
+     * `fetchSnapshotBrokerEntries` — the device-scoped `dev.cameraStreams`
+     * facade this used to call resolves against whichever node the
+     * cap-router picks by default, which is empty once `ingestNode !=
+     * hub` (the picker would render nothing but "Auto"). Owner === hub
+     * (no reachable host) is byte-identical to the previous unpinned call.
+     */
     private getStreamOptions;
     private saveDeviceSettingsPatch;
 }
+/** Result of {@link fetchSnapshotBrokerEntries} — this device's RTSP entries + profile slots. */
+interface SnapshotBrokerEntries {
+    readonly entries: readonly RtspRestreamEntry[];
+    readonly slots: readonly ProfileSlot[];
+}
+/**
+ * Pinned, testable fetch of this device's RTSP restream entries + profile
+ * slots from the system `streamBroker` cap. Module-level (not a class
+ * method) so `grabFrameFromBroker`'s owner-pin + host-rewrite contract is
+ * directly unit-testable without instantiating the addon — mirrors
+ * `acquireSessionDecodeRestreamFrom` in `pipeline-runner/index.ts`.
+ *
+ * Replaces the former `dev.cameraStreams.getRtspEntries({})` /
+ * `getBrokerStreams({})` device-scoped facade calls, which resolve against
+ * whichever node the cap-router picks by default — wrong once
+ * `ingestNode != hub` (double-pulls the camera, or dials a hub-local
+ * restream nobody is serving). `getAllRtspEntries`/`listAllProfileSlots`
+ * are cluster-wide system-cap methods; pinning the call with `nodePin` +
+ * filtering by the `${deviceId}/` brokerId prefix reproduces the exact
+ * device-scoped result set the facade used to return.
+ *
+ * `reachableHost`, when present, rides as the cap's own `hostname` input —
+ * the broker rewrites the returned URLs' host itself (same mechanism
+ * `getStreamWithCodec` callers use for cross-node pulls), so no separate
+ * client-side host-substitution is needed here. Omitting `hostname`
+ * (owner === hub, no reachable host registered) leaves the broker's
+ * default `127.0.0.1` URLs untouched — byte-identical to today.
+ */
+export declare function fetchSnapshotBrokerEntries(api: AddonApi, params: {
+    readonly deviceId: number;
+    readonly ownerNodeId: string;
+    readonly reachableHost?: string;
+}): Promise<SnapshotBrokerEntries>;
 export {};

package/dist/index.js

@@ -20,7 +20,7 @@ const require_builtins_local_auth_local_auth_addon = require("./builtins/local-a
 require("./builtins/local-auth/index.js");
 const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
 require("./builtins/device-manager/index.js");
-const require_manifest_python_deps = require("./manifest-python-deps-jWKVwa7t.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CAnO1wPx.js");
 const require_custom_action_registry = require("./custom-action-registry-vLYEFTtv.js");
 let _camstack_types_node = require("@camstack/types/node");
 let node_http = require("node:http");
@@ -4917,13 +4917,24 @@ var CapabilityRegistry = class CapabilityRegistry {
 *     this builder's output to that static type at the single documented
 *     boundary, so the SDK keeps full procedure inference.
 *
-* Behaviour MUST stay byte-identical to the codegen output
-* (`scripts/generate-cap-routers.ts`). The per-method procedure shape is
-* mechanically derived from each `cap.methods.*` (input/output zod schema
-* + kind) + the auto-injected `getStatus` / 3 settings-contribution
-* methods (via `expandCapMethods`). Provider resolution is derived from
-* the declarative `mount` hint (`resolveCapMount`) — the same decision the
-* codegen `generate-cap-mounts.ts` baked in.
+* The per-method procedure shape is mechanically derived from each
+* `cap.methods.*` (input zod schema + kind) + the auto-injected
+* `getStatus` / 3 settings-contribution methods (via `expandCapMethods`).
+* Provider resolution is derived from the declarative `mount` hint
+* (`resolveCapMount`) — the same decision the codegen
+* `generate-cap-mounts.ts` baked in.
+*
+* OUTPUT PASS-THROUGH (2026-07-11): unlike the historical codegen, the
+* builder deliberately does NOT apply `.output(schema)`. Re-validating an
+* output the hub does not own against the hub's OWN (framework-versioned,
+* therefore potentially stale) copy of the cap def silently STRIPS fields
+* a fresher addon added (a self-contained addon bundles its own newer
+* `@camstack/types`; the hub-closure copy lags). That is exactly how
+* `models[].group.resolution` vanished from `pipelineExecutor.getSchema`.
+* Cap dispatch is structural (CLAUDE.md invariant): the owning provider is
+* typed to return a complete `z.infer<output>` and is the SOLE authority
+* for the payload shape, so the hub forwards it verbatim. Input validation
+* is retained (`.input(...)`) — the hub still guards the client boundary.
 *
 * This module owns NO tRPC primitives of its own: `@camstack/system`
 * cannot import the server's `TrpcContext`-bound procedures. The server
@@ -4931,32 +4942,6 @@ var CapabilityRegistry = class CapabilityRegistry {
 * `buildCapRouters(t, services)` contract), keeping the kernel free of any
 * backend coupling (self-sufficiency invariant).
 */
-/** Auth level → procedure key. Mirrors codegen's AUTH_PROCEDURE_MAP. */
-function procedureKeyFor(auth) {
-	if (auth === "public") return "public";
-	if (auth === "admin" || auth === "superAdmin") return "admin";
-	return "protected";
-}
-/** Zod schema is `z.void()` — input carries no data. Mirrors codegen's isVoidInput. */
-function isVoidInput(schema) {
-	const def = schema._def;
-	return schema.constructor?.name === "ZodVoid" || def?.type === "void" || def?.typeName === "ZodVoid";
-}
-/** Zod schema is `z.object()` — supports `.loose()` for nodeId passthrough. Mirrors codegen's isObjectInput. */
-function isObjectInput(schema) {
-	const def = schema._def;
-	return schema.constructor?.name === "ZodObject" || def?.type === "object" || def?.typeName === "ZodObject";
-}
-/**
-* Apply `.loose()` to an object input schema when available (Zod 4) so the
-* router accepts the out-of-band `nodeId` / `addonId` selector keys
-* without stripping them — matching the codegen's `.input(schema.loose())`.
-* Falls back to the schema unchanged when `.loose()` is absent.
-*/
-function looseSchema(schema) {
-	const loose = schema.loose;
-	return typeof loose === "function" ? loose.call(schema) : schema;
-}
 function methodsFor(def) {
 	const effective = (0, _camstack_types.expandCapMethods)(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -4966,8 +4951,8 @@ function methodsFor(def) {
 			kind: m.kind ?? "query",
 			auth: m.auth ?? "protected",
 			schema: m,
-			isVoid: isVoidInput(m.input),
-			isObject: isObjectInput(m.input)
+			isVoid: (0, _camstack_types.isVoidInput)(m.input),
+			isObject: (0, _camstack_types.isObjectInput)(m.input)
 		};
 	});
 }
@@ -5020,9 +5005,8 @@ function buildOneCapRouter(def, primitives, services) {
 	const procedures = {};
 	const getLocal = (ctx, addonId) => services.getLocalProvider(capName, mount.kind, ctx, addonId);
 	for (const method of methodsFor(def)) {
-		const base = primitives.procedures[procedureKeyFor(method.auth)];
+		const base = primitives.procedures[(0, _camstack_types.procedureAuthKey)(method.auth)];
 		const inputSchema = method.schema.input;
-		const outputSchema = method.schema.output;
 		if (method.kind === "subscription") {
 			procedures[method.name] = base.input(inputSchema).subscription(({ input, ctx }) => {
 				const provider = requireLocal(capName, () => getLocal(ctx), services);
@@ -5040,15 +5024,15 @@ function buildOneCapRouter(def, primitives, services) {
 				nodeId: zod.z.string().optional(),
 				addonId: zod.z.string().optional()
 			}).optional() : zod.z.object({ nodeId: zod.z.string().optional() }).optional();
-			procedures[method.name] = base.input(voidSelector).output(outputSchema)[procKind](({ input, ctx }) => {
+			procedures[method.name] = base.input(voidSelector)[procKind](({ input, ctx }) => {
 				const sel = input ?? {};
 				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services))[method.name]?.();
 			});
 			continue;
 		}
 		if (method.isObject) {
-			const schema = nodeIdData ? inputSchema : looseSchema(inputSchema);
-			procedures[method.name] = base.input(schema).output(outputSchema)[procKind](({ input, ctx }) => {
+			const schema = nodeIdData ? inputSchema : (0, _camstack_types.looseSchema)(inputSchema);
+			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
 				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
@@ -5061,26 +5045,21 @@ function buildOneCapRouter(def, primitives, services) {
 			});
 			continue;
 		}
-		procedures[method.name] = base.input(inputSchema).output(outputSchema)[procKind](({ input, ctx }) => {
+		procedures[method.name] = base.input(inputSchema)[procKind](({ input, ctx }) => {
 			return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
 		});
 	}
 	return primitives.router(procedures);
 }
-/** kebab-case → camelCase, matching the codegen router-map key naming. */
-function kebabToCamel(s) {
-	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
-}
 /**
-* Mount kinds the runtime builder constructs. `service-backed` IS built
-* (the server supplies the provider via `getLocalProvider`); `custom` and
-* `skip` are NOT (the server's hand-written override fills the slot for
-* `custom`; `skip` is never mounted). `hub-only` is built but its remote
-* leg is `null` — handled by the server's `remoteProxy` returning null for
-* that cap.
+* Mount kinds the runtime builder constructs. Everything EXCEPT `skip` is
+* built. `server-provided` IS built (the server supplies the provider via
+* `getLocalProvider`'s server-factory map); `skip` is never mounted (legacy
+* provider shapes). `hub-only` is built but its remote leg is `null` — handled
+* by the server's `remoteProxy` returning null for that cap.
 */
 function isBuilderMounted(kind) {
-	return kind !== "custom" && kind !== "skip";
+	return kind !== "skip";
 }
 /**
 * Build the runtime cap-router map: `{ <camelCapName>: <router> }` for
@@ -5095,7 +5074,7 @@ function buildCapRouters(primitives, services) {
 		if (!isBuilderMounted((0, _camstack_types.resolveCapMount)(def).kind)) continue;
 		const effective = (0, _camstack_types.expandCapMethods)(def);
 		if (Object.keys(effective).length === 0) continue;
-		out[kebabToCamel(def.name)] = buildOneCapRouter(def, primitives, services);
+		out[(0, _camstack_types.kebabToCamel)(def.name)] = buildOneCapRouter(def, primitives, services);
 	}
 	return out;
 }
@@ -5105,7 +5084,7 @@ function builderMountedCapNames() {
 	for (const def of _camstack_types.ALL_CAPABILITY_DEFINITIONS) {
 		if (!isBuilderMounted((0, _camstack_types.resolveCapMount)(def).kind)) continue;
 		if (Object.keys((0, _camstack_types.expandCapMethods)(def)).length === 0) continue;
-		names.push(kebabToCamel(def.name));
+		names.push((0, _camstack_types.kebabToCamel)(def.name));
 	}
 	return names;
 }

package/dist/index.mjs

@@ -18,7 +18,7 @@ import { LocalAuthAddon, a as require_ms, c as __esmMin, d as __toCommonJS, f as
 import "./builtins/local-auth/index.mjs";
 import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
-import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-DXMKBZW1.mjs";
+import { $ as buildUdsNativeCapProxy, A as createParentUnownedCallHandler, B as AGENT_CAP_FWD_SERVICE, C as buildLinkChain, D as HUB_CAP_FWD_ACTION, E as localProviderLink, F as createUdsLoggerWithControl, G as createLocalTransport, H as CapRouteError, I as LocalChildClient, J as SocketChannel, K as UdsLocalTransportClient, L as LocalChildRegistry, M as createUdsEventBus, N as udsChildLogToWorkerEntry, O as HUB_CAP_FWD_SERVICE, P as createUdsLogger, Q as buildNativeCapProxy, R as UDS_NO_ROUTE_PREFIX, S as brokerTransportLink, T as ipcParentLink, U as classifyCapRoute, V as CapRouteResolver, W as callWithServiceDiscovery, X as FrameDecoder, Y as localEndpointPath, Z as encodeFrame, _ as resolveHwAccel, _t as CapabilityUnavailableError, a as getWorkerDeviceRegistry, at as createAddonService, b as getCapUsageRegistry, c as setHubConnected, ct as capActionName, d as getMoleculerEventStats, dt as capServiceName, et as createBrokerDeviceManagerApi, f as registerEventBusService, ft as parseCapAction, g as createKernelHwAccel, gt as CapabilityHandle, h as AddonDepsManager, ht as DeviceRegistry, i as createUdsAddonContext, j as createUdsEventBridge, k as createHubCapForwardService, l as EVENT_TOPIC_PREFIX, lt as capActionSuffix, m as subscribePassthrough, mt as serializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as validateProviderRegistrations, p as setNodeEventInterest, pt as deserializeTypedArrays, q as UdsLocalTransportServer, r as createAddonContext, rt as mountNativeCapService, s as getOrInitReadinessRegistryForClient, st as NATIVE_PROVIDER_SERVICE_INFIX, t as installManifestPythonDeps, u as getBrokerEventBus, ut as capBareAction, v as CapUsageRegistry, vt as installManifestNativeDeps, w as ipcChildLink, x as brokerCallForCap, y as __resetCapUsageRegistryForTests, yt as resolveAddonClass, z as AGENT_CAP_FWD_ACTION } from "./manifest-python-deps-u-AQBQY6.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-BEXwC-oo.mjs";
 import { PYTHON_VERSION, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from "@camstack/types/node";
 import { request } from "node:http";
@@ -26,7 +26,7 @@ import * as fs$17 from "node:fs";
 import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
 import * as path$39 from "node:path";
 import { dirname, isAbsolute, join, posix, resolve, win32 } from "node:path";
-import { ALL_CAPABILITY_DEFINITIONS, DATAPLANE_SECRET_HEADER, EventCategory, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, asJsonObject, asNumber, asString, createEvent, emitDownForOwnedCaps, errMsg, expandCapMethods, lifecycleJobSchema, parseJsonObject, parseJsonUnknown, readinessKey, resolveCapMount, scopeKey } from "@camstack/types";
+import { ALL_CAPABILITY_DEFINITIONS, DATAPLANE_SECRET_HEADER, EventCategory, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, asJsonObject, asNumber, asString, createEvent, emitDownForOwnedCaps, errMsg, expandCapMethods, isObjectInput, isVoidInput, kebabToCamel, lifecycleJobSchema, looseSchema, parseJsonObject, parseJsonUnknown, procedureAuthKey, readinessKey, resolveCapMount, scopeKey } from "@camstack/types";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import { execFile, spawn } from "node:child_process";
 import * as util$10 from "node:util";
@@ -4909,13 +4909,24 @@ var CapabilityRegistry = class CapabilityRegistry {
 *     this builder's output to that static type at the single documented
 *     boundary, so the SDK keeps full procedure inference.
 *
-* Behaviour MUST stay byte-identical to the codegen output
-* (`scripts/generate-cap-routers.ts`). The per-method procedure shape is
-* mechanically derived from each `cap.methods.*` (input/output zod schema
-* + kind) + the auto-injected `getStatus` / 3 settings-contribution
-* methods (via `expandCapMethods`). Provider resolution is derived from
-* the declarative `mount` hint (`resolveCapMount`) — the same decision the
-* codegen `generate-cap-mounts.ts` baked in.
+* The per-method procedure shape is mechanically derived from each
+* `cap.methods.*` (input zod schema + kind) + the auto-injected
+* `getStatus` / 3 settings-contribution methods (via `expandCapMethods`).
+* Provider resolution is derived from the declarative `mount` hint
+* (`resolveCapMount`) — the same decision the codegen
+* `generate-cap-mounts.ts` baked in.
+*
+* OUTPUT PASS-THROUGH (2026-07-11): unlike the historical codegen, the
+* builder deliberately does NOT apply `.output(schema)`. Re-validating an
+* output the hub does not own against the hub's OWN (framework-versioned,
+* therefore potentially stale) copy of the cap def silently STRIPS fields
+* a fresher addon added (a self-contained addon bundles its own newer
+* `@camstack/types`; the hub-closure copy lags). That is exactly how
+* `models[].group.resolution` vanished from `pipelineExecutor.getSchema`.
+* Cap dispatch is structural (CLAUDE.md invariant): the owning provider is
+* typed to return a complete `z.infer<output>` and is the SOLE authority
+* for the payload shape, so the hub forwards it verbatim. Input validation
+* is retained (`.input(...)`) — the hub still guards the client boundary.
 *
 * This module owns NO tRPC primitives of its own: `@camstack/system`
 * cannot import the server's `TrpcContext`-bound procedures. The server
@@ -4923,32 +4934,6 @@ var CapabilityRegistry = class CapabilityRegistry {
 * `buildCapRouters(t, services)` contract), keeping the kernel free of any
 * backend coupling (self-sufficiency invariant).
 */
-/** Auth level → procedure key. Mirrors codegen's AUTH_PROCEDURE_MAP. */
-function procedureKeyFor(auth) {
-	if (auth === "public") return "public";
-	if (auth === "admin" || auth === "superAdmin") return "admin";
-	return "protected";
-}
-/** Zod schema is `z.void()` — input carries no data. Mirrors codegen's isVoidInput. */
-function isVoidInput(schema) {
-	const def = schema._def;
-	return schema.constructor?.name === "ZodVoid" || def?.type === "void" || def?.typeName === "ZodVoid";
-}
-/** Zod schema is `z.object()` — supports `.loose()` for nodeId passthrough. Mirrors codegen's isObjectInput. */
-function isObjectInput(schema) {
-	const def = schema._def;
-	return schema.constructor?.name === "ZodObject" || def?.type === "object" || def?.typeName === "ZodObject";
-}
-/**
-* Apply `.loose()` to an object input schema when available (Zod 4) so the
-* router accepts the out-of-band `nodeId` / `addonId` selector keys
-* without stripping them — matching the codegen's `.input(schema.loose())`.
-* Falls back to the schema unchanged when `.loose()` is absent.
-*/
-function looseSchema(schema) {
-	const loose = schema.loose;
-	return typeof loose === "function" ? loose.call(schema) : schema;
-}
 function methodsFor(def) {
 	const effective = expandCapMethods(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -5012,9 +4997,8 @@ function buildOneCapRouter(def, primitives, services) {
 	const procedures = {};
 	const getLocal = (ctx, addonId) => services.getLocalProvider(capName, mount.kind, ctx, addonId);
 	for (const method of methodsFor(def)) {
-		const base = primitives.procedures[procedureKeyFor(method.auth)];
+		const base = primitives.procedures[procedureAuthKey(method.auth)];
 		const inputSchema = method.schema.input;
-		const outputSchema = method.schema.output;
 		if (method.kind === "subscription") {
 			procedures[method.name] = base.input(inputSchema).subscription(({ input, ctx }) => {
 				const provider = requireLocal(capName, () => getLocal(ctx), services);
@@ -5032,7 +5016,7 @@ function buildOneCapRouter(def, primitives, services) {
 				nodeId: z.string().optional(),
 				addonId: z.string().optional()
 			}).optional() : z.object({ nodeId: z.string().optional() }).optional();
-			procedures[method.name] = base.input(voidSelector).output(outputSchema)[procKind](({ input, ctx }) => {
+			procedures[method.name] = base.input(voidSelector)[procKind](({ input, ctx }) => {
 				const sel = input ?? {};
 				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services))[method.name]?.();
 			});
@@ -5040,7 +5024,7 @@ function buildOneCapRouter(def, primitives, services) {
 		}
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : looseSchema(inputSchema);
-			procedures[method.name] = base.input(schema).output(outputSchema)[procKind](({ input, ctx }) => {
+			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
 				if (nodeIdData) return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
@@ -5053,26 +5037,21 @@ function buildOneCapRouter(def, primitives, services) {
 			});
 			continue;
 		}
-		procedures[method.name] = base.input(inputSchema).output(outputSchema)[procKind](({ input, ctx }) => {
+		procedures[method.name] = base.input(inputSchema)[procKind](({ input, ctx }) => {
 			return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
 		});
 	}
 	return primitives.router(procedures);
 }
-/** kebab-case → camelCase, matching the codegen router-map key naming. */
-function kebabToCamel(s) {
-	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
-}
 /**
-* Mount kinds the runtime builder constructs. `service-backed` IS built
-* (the server supplies the provider via `getLocalProvider`); `custom` and
-* `skip` are NOT (the server's hand-written override fills the slot for
-* `custom`; `skip` is never mounted). `hub-only` is built but its remote
-* leg is `null` — handled by the server's `remoteProxy` returning null for
-* that cap.
+* Mount kinds the runtime builder constructs. Everything EXCEPT `skip` is
+* built. `server-provided` IS built (the server supplies the provider via
+* `getLocalProvider`'s server-factory map); `skip` is never mounted (legacy
+* provider shapes). `hub-only` is built but its remote leg is `null` — handled
+* by the server's `remoteProxy` returning null for that cap.
 */
 function isBuilderMounted(kind) {
-	return kind !== "custom" && kind !== "skip";
+	return kind !== "skip";
 }
 /**
 * Build the runtime cap-router map: `{ <camelCapName>: <router> }` for

package/dist/kernel/cap-router-builder.d.ts

@@ -51,7 +51,7 @@ export interface CapRouterServices {
     /**
      * Resolve the LOCAL provider for a cap given the effective mount kind.
      * Returns null on miss (the procedure surfaces PRECONDITION_FAILED).
-     * For `service-backed` caps this calls the server-supplied service
+     * For `server-provided` caps this calls the server-supplied service
      * provider factory; for `singleton` / `device-native` / `collection`
      * it goes through the registry.
      */

package/dist/kernel/transport/parent-unowned-call.d.ts

@@ -110,6 +110,30 @@ export interface ParentUnownedCallDeps {
      * `CapabilityDefinition`s and the registry) injects this.
      */
     readonly resolveEmptyCollection?: (capName: string, method: string) => readonly unknown[] | null;
+    /**
+     * Optional predicate — returns `true` when `capName` is a HUB-CORE `$`-service
+     * cap (`system`, `addons`, `nodes`, `capabilities`, `stream-probe`, …): served
+     * by the hub's `$core-caps` / `$stream-probe` Moleculer services, NOT by any
+     * addon provider. These are the ONLY legitimate consumers of the unpinned
+     * `brokerCallForCap` fallback.
+     *
+     * It generalises the per-cap patches (`isDeviceNativeCap`,
+     * `resolveEmptyCollection`) into ONE rule: for any cap the resolver misses
+     * (`no-provider`) that is NOT a core `$`-service, the unpinned broker fallback
+     * is a STRUCTURALLY DEAD path — the cap's providers are broker-less forked
+     * children that expose no Moleculer service, so discovery 30s-deadlines into
+     * the misleading `${cap}.${cap}.${method}` error. Instead the handler retries
+     * the resolver briefly (the provider registers late in the post-restart boot
+     * window) and then throws a PRECISE "not yet registered" error. A NEW
+     * multi-node addon cap is covered automatically — no allowlist entry needed —
+     * because the discriminant is the already-maintained hub-core cap set, not a
+     * per-cap flag.
+     *
+     * The kernel layer has no cap registry, so the wiring side injects it.
+     * Omitted (or returning `false` for a core cap by mistake) ⇒ legacy behaviour
+     * exactly: the miss falls straight to the broker fallback with no retry.
+     */
+    readonly isCoreServiceCap?: (capName: string) => boolean;
     /** Optional logger for the broker-fallback diagnostic line. */
     readonly logger?: ParentUnownedCallLogger;
 }

package/dist/{manifest-python-deps-jWKVwa7t.js → manifest-python-deps-CAnO1wPx.js}

@@ -4865,6 +4865,17 @@ function createUdsEventBridge(deps) {
 */
 var DEVICE_NATIVE_RETRY_ATTEMPTS = 5;
 var DEVICE_NATIVE_RETRY_DELAY_MS = 200;
+/**
+* Bounded-retry budget for the general provider-not-yet-registered recovery:
+* a forked hub-local child that PROVIDES a system/singleton cap (e.g.
+* `pipeline-orchestrator`) registers only once its (possibly heavy) boot
+* finishes, so a sibling calling it right after a hub restart briefly resolver-
+* misses. ~3s (12 × 250ms) covers a normal boot; past it the handler throws a
+* precise error (the caller — e.g. the ingest-owner gate — fail-opens) instead
+* of a 30s doubled-name broker deadline. Only engages for a NON-core cap miss.
+*/
+var ADDON_CAP_RETRY_ATTEMPTS = 12;
+var ADDON_CAP_RETRY_DELAY_MS = 250;
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
 * Build the `onUnownedCall` handler the hub / agent passes into
@@ -4936,6 +4947,22 @@ function createParentUnownedCallHandler(deps) {
 				...deviceId !== void 0 ? { deviceId } : {},
 				...nodeId !== void 0 ? { nodeId } : {}
 			});
+			if (deps.isCoreServiceCap !== void 0 && !deps.isCoreServiceCap(input.capName)) {
+				for (let attempt = 1; attempt <= ADDON_CAP_RETRY_ATTEMPTS; attempt++) {
+					await delay(ADDON_CAP_RETRY_DELAY_MS);
+					const retryResolver = deps.getResolver();
+					if (retryResolver !== null) try {
+						const route = retryResolver.resolveCapRoute(input.capName, {
+							...nodeId !== void 0 ? { nodeId } : {},
+							...deviceId !== void 0 ? { deviceId } : {}
+						});
+						return await retryResolver.dispatch(route, input.method, input.args);
+					} catch (err) {
+						if (!(err instanceof CapRouteError) || err.reason !== "no-provider") throw err;
+					}
+				}
+				throw new Error(`no provider registered for cap "${input.capName}" (resolver miss after boot-window retry; forked-addon provider not yet registered — ${input.method})`);
+			}
 			deps.logger?.warn?.("routing child unowned cap call via broker fallback", {
 				capName: input.capName,
 				method: input.method

package/dist/{manifest-python-deps-DXMKBZW1.mjs → manifest-python-deps-u-AQBQY6.mjs}

@@ -4863,6 +4863,17 @@ function createUdsEventBridge(deps) {
 */
 var DEVICE_NATIVE_RETRY_ATTEMPTS = 5;
 var DEVICE_NATIVE_RETRY_DELAY_MS = 200;
+/**
+* Bounded-retry budget for the general provider-not-yet-registered recovery:
+* a forked hub-local child that PROVIDES a system/singleton cap (e.g.
+* `pipeline-orchestrator`) registers only once its (possibly heavy) boot
+* finishes, so a sibling calling it right after a hub restart briefly resolver-
+* misses. ~3s (12 × 250ms) covers a normal boot; past it the handler throws a
+* precise error (the caller — e.g. the ingest-owner gate — fail-opens) instead
+* of a 30s doubled-name broker deadline. Only engages for a NON-core cap miss.
+*/
+var ADDON_CAP_RETRY_ATTEMPTS = 12;
+var ADDON_CAP_RETRY_DELAY_MS = 250;
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 /**
 * Build the `onUnownedCall` handler the hub / agent passes into
@@ -4934,6 +4945,22 @@ function createParentUnownedCallHandler(deps) {
 				...deviceId !== void 0 ? { deviceId } : {},
 				...nodeId !== void 0 ? { nodeId } : {}
 			});
+			if (deps.isCoreServiceCap !== void 0 && !deps.isCoreServiceCap(input.capName)) {
+				for (let attempt = 1; attempt <= ADDON_CAP_RETRY_ATTEMPTS; attempt++) {
+					await delay(ADDON_CAP_RETRY_DELAY_MS);
+					const retryResolver = deps.getResolver();
+					if (retryResolver !== null) try {
+						const route = retryResolver.resolveCapRoute(input.capName, {
+							...nodeId !== void 0 ? { nodeId } : {},
+							...deviceId !== void 0 ? { deviceId } : {}
+						});
+						return await retryResolver.dispatch(route, input.method, input.args);
+					} catch (err) {
+						if (!(err instanceof CapRouteError) || err.reason !== "no-provider") throw err;
+					}
+				}
+				throw new Error(`no provider registered for cap "${input.capName}" (resolver miss after boot-window retry; forked-addon provider not yet registered — ${input.method})`);
+			}
 			deps.logger?.warn?.("routing child unowned cap call via broker fallback", {
 				capName: input.capName,
 				method: input.method
@@ -6698,7 +6725,7 @@ function getWorkerDeviceRegistry() {
 * the property-access boundary and validate structurally.
 */
 function buildRemoteNativeProvider(api, cap, options) {
-	const capNameCamel = kebabToCamel(cap.name);
+	const capNameCamel = kebabToCamel$1(cap.name);
 	const provider = {};
 	for (const [methodName, methodSchema] of Object.entries(cap.methods)) {
 		const callKind = methodSchema.kind === "mutation" ? "mutate" : "query";
@@ -6719,7 +6746,7 @@ function buildRemoteNativeProvider(api, cap, options) {
 	}
 	return provider;
 }
-function kebabToCamel(s) {
+function kebabToCamel$1(s) {
 	return s.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.1.32",
+  "version": "1.1.34",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",