@camstack/system 1.1.52 → 1.1.53

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { E as evaluateLinkExpression, J as setByPath, Ot as sleep, S as deviceStatusCapability, St as isDeviceConfigCap, T as enumerateSchemaFields, U as parseStreamParamsFormPatch, V as normalizeUnit, a as DeviceStatusSchema, b as deviceManagerCapability, c as STREAM_PROFILE_META, ct as DeviceFeature, et as toExpressionValue, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as BaseAddon, k as getByPath, kt as EventCategory, lt as DeviceRole, nt as validateExpressionSource, pt as WELL_KNOWN_TAB_MAP, rt as errMsg, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceType, w as enumerateItemArrayFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema } from "../../dist-B_PSvr-m.mjs";
+import { E as evaluateLinkExpression, J as setByPath, Ot as sleep, S as deviceStatusCapability, St as isDeviceConfigCap, T as enumerateSchemaFields, U as parseStreamParamsFormPatch, V as normalizeUnit, a as DeviceStatusSchema, b as deviceManagerCapability, c as STREAM_PROFILE_META, ct as DeviceFeature, et as toExpressionValue, g as applyTransform, i as CAP_NAMES_WITH_STATUS, it as BaseAddon, k as getByPath, kt as EventCategory, lt as DeviceRole, nt as validateExpressionSource, pt as WELL_KNOWN_TAB_MAP, rt as errMsg, t as ALL_CAPABILITY_DEFINITIONS, ut as DeviceType, w as enumerateItemArrayFields, x as deviceStateCapability, y as buildStreamParamsConfigSchema } from "../../dist-D7_69kDt.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
@@ -670,1732 +670,1742 @@ function resolveDeviceById(registry, deviceId) {
 	};
 }
 //#endregion
-//#region src/builtins/device-manager/device-bindings-store.ts
+//#region src/builtins/device-manager/device-queries.ts
 /**
-* Persisted wrapper-activation + per-device binding resolution for the
-* device-manager addon. Extracted from `device-manager.addon.ts` as free
-* functions that receive an explicit `BindingsDeps` context (dependency
-* injection) instead of closing over the addon instance — keeps the routing
-* logic cohesive and independently testable while preserving the EXACT call
-* semantics, ordering, and side effects of the original class methods.
+* Device query + live-runtime + provider/adoption operations for the
+* device-manager addon — the read/live half of the `IDeviceManagerProvider`
+* surface. Extracted verbatim from the `onInitialize` provider literal as free
+* functions taking a `ProviderContext` (DI). Input/return types are pinned to
+* the cap contract via `Parameters<IDeviceManagerProvider['x']>[0]` /
+* `ReturnType<…>` so the typed surface is identical to the inferred methods.
 *
-* The addon keeps thin delegator methods (`getBindings`, `getAllBindings`, …)
-* that build `BindingsDeps` from its own state and forward here, so every
-* existing internal + cap-router call site is unchanged.
-*/
-/**
-* Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
-* Workers emit `DeviceBindingsChanged` on `ctx.registerNativeCap` / device
-* removal; we mirror those into `remoteNativeCaps` so `getBindings` returns the
-* full cluster view. Events from the local node are ignored: hub-local natives
-* live in `capabilityRegistry` and are folded in directly by getBindings.
+* Covers: persisted/live device queries (listPersistedByAddon, listAll,
+* getDevice, getChildren), live runtime methods (getStreamSources,
+* getConfigSchema, getSettingsSchema, updateConfig, enable, disable, remove,
+* removeByIntegration, getStreamProfileMap, setStreamProfileMap, probeStreams),
+* device-provider ops (discoverDevices, adoptDevice, getCreationSchema,
+* createDevice, testCreationField), and device-adoption ops
+* (adoptionListCandidates/Refresh/Adopt/Release/Resync, testField).
 *
-* Push events are accurate in the steady state but can be lost during the
-* Moleculer transport handshake window (hub restart, crash-respawn,
-* restartAddon). The reliable replacement for lost events is the D3 re-handshake
-* (`listClusterNativeCaps()`), which `resolveNativeCapOwnerSync` /
-* `getBindings` step 4 fall through to on a push miss. The `$node.disconnected`
-* handler purges a gone node's entries; the worker re-handshakes (and re-emits
-* `native-registered`) on its next boot.
+* The hub-live-then-persisted-fallback union, the cross-process device-ops
+* dispatch, the depth-first remove cascade, and the resetToSource resync purge
+* are byte-for-byte preserved. `remove`/`removeByIntegration`/`enable`/`disable`/
+* `probeStreams`/`getStreamProfileMap` self-call sibling cap methods via
+* `pctx.provider`. Pure refactor — no behavior change.
 */
-function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
-	const localNodeId = ctx.kernel.localNodeId ?? "hub";
-	ctx.eventBus.subscribe({ category: EventCategory.DeviceBindingsChanged }, (event) => {
-		const { deviceId, capName, reason, addonId, nodeId } = event.data;
-		if (nodeId === localNodeId) return;
-		if (reason === "native-registered") {
-			let perDevice = remoteNativeCaps.get(deviceId);
-			if (!perDevice) {
-				perDevice = /* @__PURE__ */ new Map();
-				remoteNativeCaps.set(deviceId, perDevice);
-			}
-			perDevice.set(capName, {
-				addonId,
-				nodeId
-			});
-		} else if (reason === "native-unregistered") {
-			const perDevice = remoteNativeCaps.get(deviceId);
-			if (!perDevice) return;
-			perDevice.delete(capName);
-			if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
-		}
-	});
-	const cluster = ctx.kernel.cluster;
-	if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
-		const gone = payload.node.id;
-		const emptyDevices = [];
-		for (const [deviceId, perDevice] of remoteNativeCaps) {
-			const toDelete = [];
-			for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
-			for (const capName of toDelete) perDevice.delete(capName);
-			if (perDevice.size === 0) emptyDevices.push(deviceId);
-		}
-		for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
+async function listPersistedByAddon(pctx, input) {
+	const { addonId } = input;
+	const [index, meta] = await Promise.all([pctx.metaStore.readIndex(), pctx.metaStore.readMeta()]);
+	const stableIds = index[addonId] ?? [];
+	const byStableId = /* @__PURE__ */ new Map();
+	for (const m of Object.values(meta)) if (m.addonId === addonId) byStableId.set(m.stableId, m);
+	return stableIds.map((stableId) => {
+		const m = byStableId.get(stableId);
+		return {
+			id: m.id,
+			stableId,
+			type: m.type,
+			name: m.name,
+			location: m.location ?? null,
+			disabled: m.disabled ?? false,
+			parentDeviceId: m.parentDeviceId
+		};
 	});
 }
-async function readBindingsStore(deps) {
-	return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
-}
-async function writeBindingsStore(deps, next) {
-	await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
-}
-function resolveWrapperNodeId(_wrapperAddonId) {
-	return "hub";
-}
-/**
-* Reduce a provider node id to the routable form `DeviceProxy` can pin.
-*
-* Every addon runs in its own `addon-runner` with the composite node id
-* `${parentNodeId}/${runnerId}` (see `addon-runner.ts`) — e.g.
-* `hub/provider-reolink` or `dev-agent-0/provider-reolink`. That composite is
-* an IDENTITY, not a routable target: the `CapRouteResolver` reaches a child
-* only THROUGH its parent (the hub resolves a hub-local-uds child by
-* cap+device; an agent forwards to its own child). `DeviceProxy` pins
-* `entry.providerNodeId` on every cap call, so a binding entry must expose the
-* parent node id — otherwise the explicit pin classifies as `remote-moleculer`
-* to an unknown node → `no-provider`, which surfaces as
-* "this camera doesn't expose …" for client-proxy-driven widget caps
-* (motion-zones, privacy-mask). Wrappers already report the parent via
-* `resolveWrapperNodeId`; this aligns natives with the same contract.
-*
-* A flat node id (a genuine standalone node with no `/`) is returned
-* unchanged.
-*/
-function toRoutableProviderNodeId(nodeId) {
-	const slash = nodeId.indexOf("/");
-	return slash === -1 ? nodeId : nodeId.slice(0, slash);
-}
-/**
-* Resolve a remote native cap entry for a given `(capName, deviceId)` by
-* consulting the handshake-fed `HubNodeRegistry` via
-* `ctx.kernel.listClusterNativeCaps()`. Called when the push-based
-* `remoteNativeCaps` cache misses — covers the Moleculer transport
-* handshake window where `DeviceBindingsChanged` events were lost but the
-* D3 re-handshake (post device restore) has already populated the registry.
-*
-* Returns `null` when the entry is genuinely not present in the cluster
-* view (cap not registered on any worker for that device).
-*/
-function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-	if (!clusterCaps) return null;
-	for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
-		addonId: entry.addonId,
-		nodeId: entry.nodeId
-	};
-	return null;
-}
-async function getBindings(deps, input) {
-	const storeKey = String(input.deviceId);
-	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
-	const entries = [];
-	const seenCaps = /* @__PURE__ */ new Set();
-	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
-	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
-		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
-		const remoteNative = resolveRemote(capName);
-		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
-		if (wrapperAddonId === null && !nativeAddonId) {
-			seenCaps.add(capName);
-			continue;
+async function listAll(pctx, input) {
+	const { addonId } = input;
+	const results = [];
+	const seen = /* @__PURE__ */ new Set();
+	const meta = await pctx.metaStore.readMeta();
+	const metadataMap = await pctx.metaStore.readMetadataMap();
+	if (pctx.registry) {
+		const liveEntries = addonId ? pctx.registry.getAllForAddon(addonId).map((device) => ({
+			addonId,
+			device
+		})) : pctx.registry.getAllWithAddonId();
+		for (const { addonId: aid, device } of liveEntries) {
+			const key = String(device.id);
+			const metadata = metadataMap[key] ?? null;
+			const metaRow = meta[key] ?? null;
+			results.push(toDeviceInfo(aid, device, metadata, metaRow));
+			seen.add(key);
 		}
-		entries.push({
-			capName,
-			kind: wrapperAddonId ? "wrapped" : "native",
-			providerAddonId: wrapperAddonId ?? nativeAddonId,
-			providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
-			nativeAddonId
-		});
-		seenCaps.add(capName);
-	}
-	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
-		if (seenCaps.has(capName)) continue;
-		const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
-		if (!defaultWrapperAddonId) continue;
-		const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
-		const remoteNative = resolveRemote(capName);
-		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
-		entries.push({
-			capName,
-			kind: "wrapped",
-			providerAddonId: defaultWrapperAddonId,
-			providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
-			nativeAddonId
-		});
-		seenCaps.add(capName);
 	}
-	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
-		if (seenCaps.has(capName)) continue;
-		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
-		entries.push({
-			capName,
-			kind: "native",
-			providerAddonId: nativeAddonId,
-			providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
-			nativeAddonId
+	const index = await pctx.metaStore.readIndex();
+	const metaByAddonStable = /* @__PURE__ */ new Map();
+	for (const m of Object.values(meta)) metaByAddonStable.set(`${m.addonId}${m.stableId}`, m);
+	const targetAddons = addonId ? [addonId] : Object.keys(index);
+	for (const aid of targetAddons) for (const stableId of index[aid] ?? []) {
+		const m = metaByAddonStable.get(`${aid}${stableId}`);
+		const key = String(m.id);
+		if (seen.has(key)) continue;
+		const persistedType = m.type;
+		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+		const metadata = metadataMap[key] ?? null;
+		results.push({
+			id: m.id,
+			stableId,
+			addonId: aid,
+			type: persistedType,
+			name: m?.name ?? stableId,
+			location: m?.location ?? null,
+			disabled: m?.disabled ?? false,
+			parentDeviceId: m?.parentDeviceId ?? null,
+			role: toDeviceRole(m?.role),
+			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
+			probed: pctx.host.resolveDeviceProbed(m.id),
+			features: persistedFeatures(m?.features),
+			isCamera: persistedType === DeviceType.Camera,
+			config: persistedConfig ?? {},
+			metadata,
+			...m?.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
+			...m?.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
+			...m?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
+			...m?.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
+			...m?.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
+			...m?.display !== void 0 ? { display: m.display } : {},
+			...(() => {
+				const si = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
+				return si !== void 0 ? { sourceInfo: si } : {};
+			})()
 		});
-		seenCaps.add(capName);
 	}
-	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
-	if (pushFed) for (const [capName, info] of pushFed) {
-		if (seenCaps.has(capName)) continue;
-		entries.push({
-			capName,
-			kind: "native",
-			providerAddonId: info.addonId,
-			providerNodeId: toRoutableProviderNodeId(info.nodeId),
-			nativeAddonId: info.addonId
-		});
-		seenCaps.add(capName);
+	return results;
+}
+async function getDevice(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) {
+			const key = String(found.device.id);
+			const [map, metaMap] = await Promise.all([pctx.metaStore.readMetadataMap(), pctx.metaStore.readMeta()]);
+			const metadata = map[key] ?? null;
+			const metaRow = metaMap[key] ?? null;
+			return toDeviceInfo(found.addonId, found.device, metadata, metaRow);
+		}
 	}
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
-	if (clusterCaps) for (const entry of clusterCaps) {
-		if (entry.deviceId !== input.deviceId) continue;
-		if (seenCaps.has(entry.capName)) continue;
-		if (!entry.addonId) continue;
-		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
-		if (entry.nodeId === localNodeId) continue;
-		entries.push({
-			capName: entry.capName,
-			kind: "native",
-			providerAddonId: entry.addonId,
-			providerNodeId: toRoutableProviderNodeId(entry.nodeId),
-			nativeAddonId: entry.addonId
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted) return null;
+	const { addonId: aid, stableId, meta: m } = persisted;
+	const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+	const key = String(deviceId);
+	const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
+	const sourceInfoGetDevice = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
+	return {
+		id: deviceId,
+		stableId,
+		addonId: aid,
+		type: m.type,
+		name: m.name,
+		location: m.location ?? null,
+		disabled: m.disabled ?? false,
+		parentDeviceId: m.parentDeviceId,
+		role: toDeviceRole(m.role),
+		online: pctx.host.resolveDeviceOnline(deviceId, true),
+		probed: pctx.host.resolveDeviceProbed(deviceId),
+		features: persistedFeatures(m.features),
+		isCamera: false,
+		config: persistedConfig ?? {},
+		metadata,
+		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
+		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
+		...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
+		...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
+		...m.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
+		...m.display !== void 0 ? { display: m.display } : {},
+		...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
+	};
+}
+async function getChildren(pctx, input) {
+	const { parentDeviceId } = input;
+	let ownerAddonId = null;
+	if (pctx.registry) {
+		if (pctx.registry.getById(parentDeviceId)) ownerAddonId = pctx.registry.getAddonId(parentDeviceId);
+	}
+	if (!ownerAddonId) {
+		const persisted = await pctx.metaStore.resolvePersistedById(parentDeviceId);
+		if (!persisted) return [];
+		ownerAddonId = persisted.addonId;
+	}
+	const results = [];
+	const seen = /* @__PURE__ */ new Set();
+	const [index, meta, metadataMap] = await Promise.all([
+		pctx.metaStore.readIndex(),
+		pctx.metaStore.readMeta(),
+		pctx.metaStore.readMetadataMap()
+	]);
+	if (pctx.registry) {
+		const liveChildren = pctx.registry.getChildren(parentDeviceId);
+		for (const device of liveChildren) {
+			const key = String(device.id);
+			const metadata = metadataMap[key] ?? null;
+			const metaRow = meta[key] ?? null;
+			results.push(toDeviceInfo(ownerAddonId, device, metadata, metaRow));
+			seen.add(key);
+		}
+	}
+	const ownerMetaByStableId = /* @__PURE__ */ new Map();
+	for (const m of Object.values(meta)) if (m.addonId === ownerAddonId) ownerMetaByStableId.set(m.stableId, m);
+	const persistedChildren = (index[ownerAddonId] ?? []).filter((sid) => ownerMetaByStableId.get(sid)?.parentDeviceId === parentDeviceId);
+	for (const childStableId of persistedChildren) {
+		const m = ownerMetaByStableId.get(childStableId);
+		const key = String(m.id);
+		if (seen.has(key)) continue;
+		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
+		const metadata = metadataMap[key] ?? null;
+		const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
+		results.push({
+			id: m.id,
+			stableId: childStableId,
+			addonId: ownerAddonId,
+			type: m.type,
+			name: m.name,
+			location: m.location ?? null,
+			disabled: m.disabled ?? false,
+			parentDeviceId,
+			role: toDeviceRole(m.role),
+			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
+			probed: pctx.host.resolveDeviceProbed(m.id),
+			features: persistedFeatures(m.features),
+			isCamera: false,
+			config: persistedConfig ?? {},
+			metadata,
+			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
+			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
+			...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
+			...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
+			...m.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
+			...m.display !== void 0 ? { display: m.display } : {},
+			...sourceInfoChild !== void 0 ? { sourceInfo: sourceInfoChild } : {}
 		});
-		seenCaps.add(entry.capName);
 	}
-	if (deps.devicesWithLinks?.has(input.deviceId)) {
-		const row = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(input.deviceId)];
-		for (const link of row?.deviceLinks ?? []) {
-			const capName = link.target.cap;
-			if (seenCaps.has(capName)) continue;
-			entries.push({
-				capName,
-				kind: "linked",
-				providerAddonId: deps.ctx.id,
-				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
-				nativeAddonId: ""
-			});
-			seenCaps.add(capName);
+	return results;
+}
+async function getStreamSources(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) {
+			if (!isCameraDevice(found.device)) return [];
+			return (await found.device.getStreamSources()).map((s) => ({
+				id: s.id,
+				label: s.label,
+				protocol: s.protocol,
+				url: s.url,
+				resolution: s.resolution,
+				fps: s.fps,
+				bitrate: s.bitrate,
+				codec: s.codec,
+				profileHint: s.profileHint
+			}));
 		}
 	}
-	return {
-		deviceId: input.deviceId,
-		entries
-	};
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	return (await pctx.requireDeviceOps(deviceId).getStreamSources({ deviceId })).map((s) => ({ ...s }));
 }
-/**
-* Whole-fleet binding dump. Iterates every device known to the
-* deviceRegistry and reuses the per-device `getBindings` resolver
-* for each — same routing rules, single round-trip. Used by
-* `SystemManager.init()` for warm-boot.
-*
-* Bindings change rarely (wrapper toggle, device add/remove) so
-* clients invalidate via the existing
-* `capability.binding-changed` event rather than re-fetching this
-* payload periodically.
-*/
-async function getAllBindings(deps) {
-	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-	if (!hubRegistry) return [];
-	const out = [];
-	for (const device of hubRegistry.getAll()) out.push(await getBindings(deps, { deviceId: device.id }));
-	return out;
+async function getConfigSchema(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) return found.device.config.entries().map((entry) => ({
+			key: entry.key,
+			value: entry.value,
+			...entry.description !== void 0 ? { description: entry.description } : {}
+		}));
+	}
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	return (await pctx.requireDeviceOps(deviceId).getConfigEntries({ deviceId })).map((e) => ({ ...e }));
 }
-/**
-* Resolve a numeric deviceId to a stableId via persisted meta.
-* Used only by the device-identity section of the device-details
-* aggregator (see `buildBaseDeviceSection`) to surface the stableId as
-* a readonly display field. All runtime/registry lookups are keyed by
-* numeric deviceId; this helper is display-only.
-*/
-async function lookupPersistedStableId(deps, deviceId) {
-	return ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.stableId;
+async function getSettingsSchema(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) return found.device.getSettingsUISchema();
+	}
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) return null;
+	return await pctx.requireDeviceOps(deviceId).getSettingsSchema({ deviceId }) ?? null;
 }
-//#endregion
-//#region src/builtins/device-manager/device-aggregation.ts
-/**
-* Device-details aggregation + field-update routing for the device-manager
-* addon. Extracted from `device-manager.addon.ts` as free functions that
-* receive an explicit `AggregationDeps` context (DI) rather than closing over
-* the addon instance.
-*
-* This module owns the binding-driven settings/live/status aggregators
-* (`getDeviceAggregate`, `collectSystemDeviceContributions`,
-* `deriveDeviceConfigContribution`, `buildBaseDeviceSection`,
-* `getDeviceStatusAggregate`, `resolveDriverConfigSchema`) and the
-* field-update routing (`updateDeviceField`, `updateDeviceFieldsBatch`,
-* `applyGroupPatch`, `resolveContributionProvider`, `dispatchDeviceAction`)
-* plus the wrapper-activation mutators (`setWrapperActive`,
-* `listWrappersForCap`, `listBindableCapsForDeviceType`).
-*
-* Sibling aggregator functions call each other directly (passing `deps`);
-* cross-domain leaf calls (`getBindings`, `lookupPersistedStableId`,
-* `resolveRemoteNativeCapFromRegistry`, read/writeBindingsStore) route through
-* the bindings-store module via `deps.bindingsDeps`. EXACT semantics, ordering,
-* and side effects of the original class methods are preserved; the addon keeps
-* thin delegator methods over these functions.
-*/
-async function getDeviceAggregate(deps, deviceId, kind) {
-	const registry = deps.capabilityRegistry;
-	if (!registry) {
-		deps.ctx.logger.debug("capability registry unavailable — aggregate empty", { meta: { kind } });
-		return null;
+async function updateConfig(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) {
+			await found.device.config.setAll(input.values);
+			return { success: true };
+		}
 	}
-	const method = kind === "settings" ? "getDeviceSettingsContribution" : "getDeviceLiveContribution";
-	const { entries: bindingEntries } = await getBindings(deps.bindingsDeps, { deviceId });
-	const seenCaps = new Set(bindingEntries.map((e) => e.capName));
-	const results = await Promise.all(bindingEntries.map(async (entry) => {
-		const def = registry.getDefinition(entry.capName);
-		if (isDeviceConfigCap(def)) return deriveDeviceConfigContribution(deps, registry, def, entry, deviceId, kind);
-		if (!def?.exposesDeviceSettings) return null;
-		const provider = registry.getProviderByAddon(entry.capName, entry.providerAddonId);
-		if (!provider) return null;
-		try {
-			const contribution = await provider[method]({ deviceId });
-			if (!contribution) return null;
-			return tagContribution(toWireShape(contribution), entry.capName, entry.providerAddonId, kind);
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	await pctx.requireDeviceOps(deviceId).setConfig({
+		deviceId,
+		values: input.values
+	});
+	return { success: true };
+}
+async function enable(pctx, input) {
+	await pctx.provider.setDisabled({
+		deviceId: input.deviceId,
+		disabled: false
+	});
+	return { success: true };
+}
+async function disable(pctx, input) {
+	await pctx.provider.setDisabled({
+		deviceId: input.deviceId,
+		disabled: true
+	});
+	return { success: true };
+}
+async function remove(pctx, input) {
+	const { deviceId } = input;
+	const removeOne = async (id) => {
+		if (pctx.registry) {
+			const live = resolveDeviceById(pctx.registry, id);
+			if (live) {
+				const deviceName = live.device.name;
+				await live.device.removeDevice();
+				pctx.registry.remove(id);
+				await pctx.provider.removeDevice({ deviceId: id });
+				pctx.host.ctx.logger.info("removed hub-local device", { tags: {
+					deviceId: id,
+					deviceName
+				} });
+				return;
+			}
+		}
+		const persisted = await pctx.metaStore.resolvePersistedById(id);
+		if (!persisted) return;
+		const { meta: persistedMeta } = persisted;
+		try {
+			await pctx.requireDeviceOps(id).removeDevice({ deviceId: id });
 		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			deps.ctx.logger.warn("contribution method failed", {
+			pctx.host.ctx.logger.warn("remove via device-ops failed — clearing persistence anyway", {
 				tags: {
-					deviceId,
-					addonId: entry.providerAddonId
+					deviceId: id,
+					deviceName: persistedMeta.name
 				},
-				meta: {
-					capName: entry.capName,
-					method,
-					error: msg
-				}
+				meta: { error: errMsg(err) }
 			});
-			return null;
 		}
-	}));
-	const base = kind === "settings" ? await buildBaseDeviceSection(deps, deviceId) : null;
-	const systemResults = await collectSystemDeviceContributions(deps, deviceId, kind, seenCaps);
-	const parts = [
-		...base ? [tagContribution(base, "device-manager", "device-manager", kind)] : [],
-		...results.filter((r) => r !== null),
-		...systemResults
-	];
-	if (parts.length === 0) return null;
-	return mergeAggregates(parts);
+		await pctx.provider.removeDevice({ deviceId: id });
+	};
+	const removeCascade = async (id) => {
+		for (const childId of await pctx.metaStore.directChildIds(id)) await removeCascade(childId);
+		await removeOne(id);
+	};
+	await removeCascade(deviceId);
+	return { success: true };
 }
 /**
-* System-scoped per-device contributions — the deliberate exception to
-* binding-driven aggregation (D12).
-*
-* A `scope: 'system'` cap with `exposesDeviceSettings: true` holds per-device
-* state but is NOT bound per-device: it is a system addon, not a BaseDevice,
-* so it never calls `registerNativeCap` and never appears in
-* `getBindings(deviceId)`. The binding-driven loop therefore skips it and its
-* per-device panel never renders. Two such caps ship today:
-*   - `stream-broker` (singleton) — the RTSP-restream / pre-buffer settings
-*     tab, scoped to the cameras whose streams it serves.
-*   - `device-export` (collection) — the "Export" panel; a device can be
-*     exposed to MULTIPLE exporters at once (Alexa + HomeKit + HA-MQTT).
-*
-* D12 bans fanning a per-device call out to every same-named provider of a
-* `scope: 'device'` cap, because vendor providers SHARE cap names
-* (`stream-params`/`ptz` from reolink AND hikvision). System caps are NOT
-* vendor-shared — a system cap name maps to one active provider (singleton)
-* or one declared collection — so consulting the cap's own provider(s)
-* directly is safe. Each provider gates internally by deviceId and returns
-* null for devices it does not own.
-*
-* `seenCaps` skips any system cap that already contributed via a binding so
-* its section is never duplicated.
+* Cascade-delete every top-level device whose `integrationId`
+* matches. Enumerates a SNAPSHOT of the meta map so concurrent
+* removals don't clobber each other. Only top-level parents are
+* enumerated — children cascade via the per-parent `removeCascade`
+* inside the delegated `remove` call. Idempotent: devices with no
+* `integrationId` never match.
 */
-async function collectSystemDeviceContributions(deps, deviceId, kind, seenCaps) {
-	const registry = deps.capabilityRegistry;
-	if (!registry) return [];
-	const method = kind === "settings" ? "getDeviceSettingsContribution" : "getDeviceLiveContribution";
-	const tasks = [];
-	for (const info of registry.listCapabilities()) {
-		const def = registry.getDefinition(info.name);
-		if (!def || def.scope !== "system" || !def.exposesDeviceSettings) continue;
-		if (seenCaps.has(info.name)) continue;
-		const addonIds = def.mode === "collection" ? info.providers : info.activeProvider ? [info.activeProvider] : [];
-		for (const addonId of addonIds) tasks.push((async () => {
-			const provider = registry.getProviderByAddon(info.name, addonId);
-			if (!provider) return null;
-			try {
-				const contribution = await provider[method]({ deviceId });
-				if (!contribution) return null;
-				return tagContribution(toWireShape(contribution), info.name, addonId, kind);
-			} catch (err) {
-				deps.ctx.logger.warn("system device-settings contribution skipped", {
-					tags: {
-						deviceId,
-						addonId
-					},
-					meta: {
-						capName: info.name,
-						method,
-						error: err instanceof Error ? err.message : String(err)
-					}
-				});
-				return null;
-			}
-		})());
+async function removeByIntegration(pctx, input) {
+	const { integrationId } = input;
+	const meta = await pctx.metaStore.readMeta();
+	const parentKeys = Object.keys(meta).filter((key) => {
+		const m = meta[key];
+		return m !== void 0 && m.integrationId === integrationId && m.parentDeviceId === null;
+	});
+	let removed = 0;
+	for (const _key of parentKeys) {
+		const m = meta[_key];
+		if (!m) continue;
+		await pctx.provider.remove({ deviceId: m.id });
+		removed++;
 	}
-	return (await Promise.all(tasks)).filter((r) => r !== null);
+	return { removed };
 }
-/**
-* D14: framework-derived device-config contribution.
-*
-* `kind === 'live'` — device-config caps contribute nothing to the live
-* aggregate (they hold editable config, not live observables).
-*
-* `ui.kind === 'widget'` — emits a single structural `type:'widget'`
-* section; the widget self-persists via the cap's own mutations.
-*
-* `ui.kind === 'derived-form'` — calls `getOptions`/`getStatus` on the
-* bound provider, runs the registered pure builder, and returns the
-* derived form sections. Returns null when the camera exposes nothing
-* configurable or the provider is not yet registered.
-*/
-async function deriveDeviceConfigContribution(deps, registry, def, entry, deviceId, kind) {
-	if (kind === "live") return null;
-	const ui = def.deviceConfig.ui;
-	if (ui.kind === "widget") return tagContribution({ sections: [{
-		id: `${entry.capName}-widget`,
-		title: ui.label,
-		tab: ui.tab,
-		order: ui.order ?? 0,
-		...ui.topTab ? { location: "top-tab" } : {},
-		fields: [{
-			type: "widget",
-			key: `${entry.capName}Widget`,
-			label: ui.label,
-			widgetId: ui.widgetId
-		}]
-	}] }, entry.capName, entry.providerAddonId, kind);
-	const provider = registry.getProviderForDevice(entry.capName, deviceId);
-	if (!provider || typeof provider.getOptions !== "function") return null;
-	try {
-		const options = await provider.getOptions({ deviceId });
-		const status = typeof provider.getStatus === "function" ? await provider.getStatus({ deviceId }) : null;
-		const derived = deriveFormContribution(ui.builderId, options, status ?? null);
-		if (!derived) return null;
-		return tagContribution({
-			...derived.tabs ? { tabs: derived.tabs.map((t) => ({ ...t })) } : {},
-			sections: derived.sections.map((s) => ({
-				id: s.id,
-				title: s.title,
-				...s.tab !== void 0 ? { tab: s.tab } : {},
-				...s.order !== void 0 ? { order: s.order } : {},
-				...s.description !== void 0 ? { description: s.description } : {},
-				...s.columns !== void 0 ? { columns: s.columns } : {},
-				fields: [...s.fields]
-			}))
-		}, entry.capName, entry.providerAddonId, kind);
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		deps.ctx.logger.warn("device-config derivation failed", {
-			tags: {
-				deviceId,
-				addonId: entry.providerAddonId
-			},
-			meta: {
-				capName: entry.capName,
-				error: msg
-			}
-		});
-		return null;
+async function getStreamProfileMap(pctx, input) {
+	if (!pctx.registry) return {};
+	const found = resolveDeviceById(pctx.registry, input.deviceId);
+	if (!found) return {};
+	const storedMap = found.device.config.entries().find((e) => e.key === "_profileMap")?.value;
+	if (storedMap !== void 0 && typeof storedMap === "object" && storedMap !== null) return storedMap;
+	if (!isCameraDevice(found.device)) return {};
+	const sources = await found.device.getStreamSources();
+	const profileMap = {};
+	for (const s of sources) if (s.profileHint && s.id) profileMap[s.profileHint] = s.id;
+	return profileMap;
+}
+async function setStreamProfileMap(pctx, input) {
+	const { deviceId } = input;
+	if (pctx.registry) {
+		const found = resolveDeviceById(pctx.registry, deviceId);
+		if (found) {
+			await found.device.config.setAll({ _profileMap: input.profileMap });
+			return { success: true };
+		}
 	}
+	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
+	await pctx.requireDeviceOps(deviceId).setConfig({
+		deviceId,
+		values: { _profileMap: input.profileMap }
+	});
+	return { success: true };
 }
-/**
-* Build the device-manager's own contribution to the aggregator — the
-* device identity (id, stableId, addonId, type, online) + the
-* driver-specific config exposed by the device class via
-* `zodEntriesToConfigUI`.
-*
-* Two paths, deliberately symmetric with `getSettingsSchema`:
-*
-*  - Hub-local: device's IDevice instance lives in this process'
-*    DeviceRegistry, we read config + schema directly by reference.
-*  - Cross-process: device lives in a forked worker (RtspCamera on
-*    provider-rtsp, ONVIF on provider-onvif, …). We ask the worker's
-*    `device-ops.getSettingsSchema` native provider for a wire-
-*    serializable ConfigUISchema and merge it in under the same
-*    "Driver Config" section, so the UI sees the same shape regardless
-*    of where the IDevice physically runs.
-*
-*  Returns `null` only when the device genuinely doesn't exist anywhere
-*  (no hub-local, no persisted ownership, no device-ops native). The
-*  aggregator falls back to contributor sections only in that case.
-*/
-async function buildBaseDeviceSection(deps, deviceId) {
-	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-	const hubLocal = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-	const stableId = hubLocal?.device.stableId ?? await lookupPersistedStableId(deps.bindingsDeps, deviceId);
-	const nativeOwner = resolveNativeDeviceOwner(deps, deviceId);
-	const addonId = hubLocal?.addonId ?? nativeOwner?.addonId ?? null;
-	if (!hubLocal && !nativeOwner) return null;
-	const sections = [{
-		id: "device-identity",
-		title: "Identity",
-		tab: "general",
-		order: 0,
-		fields: [
-			{
-				type: "text",
-				key: "_deviceId",
-				label: "Device ID",
-				readonlyField: true,
-				value: String(deviceId)
-			},
-			{
-				type: "text",
-				key: "_stableId",
-				label: "Stable ID",
-				readonlyField: true,
-				value: stableId ?? ""
-			},
-			{
-				type: "text",
-				key: "_addonId",
-				label: "Driver",
-				readonlyField: true,
-				value: addonId ?? "unknown"
+async function probeStreams(pctx, input) {
+	const streamProbe = pctx.host.ctx.kernel.streamProbe;
+	if (!streamProbe) return [];
+	const sources = await pctx.provider.getStreamSources({ deviceId: input.deviceId });
+	const results = [];
+	for (const s of sources) {
+		if (!s.url) continue;
+		try {
+			const metadata = await streamProbe.probe(s.url, { force: true });
+			results.push({
+				streamId: s.id,
+				width: metadata.width,
+				height: metadata.height,
+				codec: metadata.codec,
+				fps: metadata.fps,
+				bitrateKbps: metadata.bitrateKbps
+			});
+		} catch (err) {
+			pctx.host.ctx.logger.debug("streamProbe.probe failed — returning placeholder", { meta: {
+				deviceId: input.deviceId,
+				streamId: s.id,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			results.push({ streamId: s.id });
+		}
+	}
+	return results;
+}
+async function discoverDevices(pctx, input) {
+	const dp = await pctx.host.requireDeviceProvider(input.addonId);
+	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device discovery`);
+	return (await dp.discoverDevices({})).map((d) => ({
+		stableId: d.stableId,
+		type: d.type,
+		suggestedName: d.suggestedName,
+		prefilledConfig: d.prefilledConfig
+	}));
+}
+async function adoptDevice(pctx, input) {
+	const dp = await pctx.host.requireDeviceProvider(input.addonId);
+	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device adoption`);
+	const summary = await dp.adoptDiscoveredDevice({ candidate: input.candidate });
+	if (input.integrationId !== void 0) try {
+		await pctx.stampIntegrationId(summary.id, input.integrationId);
+	} catch (err) {
+		pctx.host.ctx.logger.warn("adoptDevice: integrationId stamp failed (device adopted)", {
+			tags: {
+				deviceId: summary.id,
+				integrationId: input.integrationId
 			},
-			...hubLocal ? [{
-				type: "text",
-				key: "_type",
-				label: "Type",
-				readonlyField: true,
-				value: hubLocal.device.type
-			}, {
-				type: "text",
-				key: "_online",
-				label: "Online",
-				readonlyField: true,
-				value: hubLocal.device.online ? "yes" : "no"
-			}] : []
-		]
-	}];
-	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
-	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
-		id: section.id,
-		title: section.title,
-		tab: section.tab ?? "general",
-		order: section.order ?? 1,
-		fields: [...section.fields],
-		...section.description !== void 0 ? { description: section.description } : {},
-		...section.columns !== void 0 ? { columns: section.columns } : {}
+			meta: { error: errMsg(err) }
+		});
+	}
+	return summary;
+}
+async function getCreationSchema(pctx, input) {
+	const dp = await pctx.host.requireDeviceProvider(input.addonId);
+	if (!await dp.supportsManualCreation({})) return null;
+	return await dp.getChildCreationSchema({ type: input.type }) ?? null;
+}
+async function createDevice(pctx, input) {
+	const dp = await pctx.host.requireDeviceProvider(input.addonId);
+	if (!await dp.supportsManualCreation({})) throw new Error(`Addon "${input.addonId}" does not support manual device creation`);
+	const summary = await dp.createDevice({
+		type: input.type,
+		config: input.config
 	});
-	else if (driverResult.status === "unavailable") sections.push({
-		id: "driver-settings-unavailable",
-		title: "Driver Settings",
-		tab: "general",
-		order: 1,
-		fields: [{
-			type: "info",
-			key: "driver-settings-unavailable-notice",
-			label: "Temporarily unavailable",
-			content: "Driver settings are temporarily unavailable — the addon may be restarting. Refresh the page in a moment.",
-			variant: "warning"
-		}]
+	if (input.integrationId !== void 0) try {
+		await pctx.stampIntegrationId(summary.id, input.integrationId);
+	} catch (err) {
+		pctx.host.ctx.logger.warn("createDevice: integrationId stamp failed (device created)", {
+			tags: {
+				deviceId: summary.id,
+				integrationId: input.integrationId
+			},
+			meta: { error: errMsg(err) }
+		});
+	}
+	return summary;
+}
+async function testCreationField(pctx, input) {
+	return (await pctx.host.requireDeviceProvider(input.addonId)).testCreationField({
+		type: input.type,
+		key: input.key,
+		value: input.value,
+		...input.formValues !== void 0 ? { formValues: input.formValues } : {}
 	});
+}
+async function adoptionListCandidates(pctx, input) {
+	const { addonId, ...rest } = input;
+	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).listCandidates(rest);
+}
+async function adoptionRefresh(pctx, input) {
+	const { addonId, integrationId } = input;
+	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).refresh({ integrationId });
+}
+async function adoptionAdopt(pctx, input) {
+	const { addonId, ...rest } = input;
+	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).adopt(rest);
+}
+async function adoptionRelease(pctx, input) {
+	const { addonId, ...rest } = input;
+	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).release(rest);
+}
+async function adoptionResync(pctx, input) {
+	const { camDeviceId, resetToSource } = input;
+	let owningAddonId = pctx.registry?.getAddonId(camDeviceId) ?? null;
+	if (!owningAddonId) owningAddonId = (await pctx.metaStore.resolvePersistedById(camDeviceId))?.addonId ?? null;
+	if (!owningAddonId) throw new Error(`adoptionResync: device ${camDeviceId} not found`);
+	let removedChildren = 0;
+	if (resetToSource === true) {
+		const childIds = await pctx.metaStore.directChildIds(camDeviceId);
+		for (const childId of childIds) {
+			await pctx.provider.remove({ deviceId: childId });
+			removedChildren += 1;
+		}
+		pctx.host.ctx.logger.info("resetToSource purge before resync", { tags: {
+			deviceId: camDeviceId,
+			removedChildren
+		} });
+	}
 	return {
-		sections,
-		...driverResult.status === "ok" && driverResult.schema.tabs ? { tabs: [...driverResult.schema.tabs] } : {}
+		...await (await pctx.host.requireDeviceAdoptionProvider(owningAddonId)).resync({
+			camDeviceId,
+			resetToSource
+		}),
+		removedChildren
 	};
 }
-/**
-* Lookup the native owner for `device-ops` on `deviceId` — the native-cap
-* registry (hub-local and remote) is keyed by numeric id.
-*/
-function resolveNativeDeviceOwner(deps, deviceId) {
-	const local = deps.capabilityRegistry?.getNativeAddonId("device-ops", deviceId) ?? null;
-	if (local) return {
-		addonId: local,
-		nodeId: deps.ctx.kernel.localNodeId ?? "hub"
+async function testField(pctx, input) {
+	const { deviceId } = input;
+	let owningAddonId = null;
+	if (pctx.registry) owningAddonId = pctx.registry.getAddonId(deviceId);
+	if (!owningAddonId) owningAddonId = (await pctx.metaStore.resolvePersistedById(deviceId))?.addonId ?? null;
+	if (!owningAddonId) throw new Error(`Device with id ${deviceId} not found`);
+	const dp = await pctx.host.waitDeviceProvider(owningAddonId);
+	if (!dp) return {
+		status: "ok",
+		labels: [],
+		error: void 0
+	};
+	if (typeof dp.testCreationField !== "function") return {
+		status: "ok",
+		labels: [],
+		error: void 0
+	};
+	return dp.testCreationField({
+		type: DeviceType.Camera,
+		key: input.key,
+		value: input.value
+	});
+}
+//#endregion
+//#region src/builtins/device-manager/device-linked-devices.ts
+/** Reserved device-config keys (cf. `_profileMap`). */
+var LINKED_MODE_CONFIG_KEY = "_linkedDevicesMode";
+var LINKED_IDS_CONFIG_KEY = "_linkedDeviceIds";
+/** Parse the two reserved keys out of a device-config blob. Tolerant:
+*  ids may arrive as numbers or numeric strings (the multiselect field
+*  stores string option values); anything else is dropped. */
+function parseLinkedDevicesConfig(blob) {
+	const mode = blob["_linkedDevicesMode"] === "manual" ? "manual" : "auto";
+	const rawIds = blob[LINKED_IDS_CONFIG_KEY];
+	const manualIds = [];
+	if (Array.isArray(rawIds)) for (const v of rawIds) {
+		const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
+		if (Number.isInteger(n) && !manualIds.includes(n)) manualIds.push(n);
+	}
+	return {
+		mode,
+		manualIds
 	};
-	const remote = deps.remoteNativeCaps.get(deviceId)?.get("device-ops") ?? resolveRemoteNativeCapFromRegistry(deps.bindingsDeps, "device-ops", deviceId);
-	return remote ? {
-		addonId: remote.addonId,
-		nodeId: remote.nodeId
-	} : null;
 }
 /**
-* Aggregate `status` across every registered cap for a device.
-*
-* Walks the supplied cap list (or `CAP_NAMES_WITH_STATUS` when
-* omitted), looks up a native provider per cap via the capability
-* registry, calls `provider.getStatus({ deviceId })`, and validates
-* the return against the cap's own `status.schema`. Validation
-* failures log a warning and yield `null` for that cap so the
-* overall aggregate stays usable — a single misbehaving provider
-* must not blank out a device's entire status view.
-*
-* Returned shape is `Record<capName, unknown | null>`; the client-
-* side hook tightens this to `CapStatusTypeMap` via the generated
-* `cap-status-types.ts`.
+* Pure resolution core: children ∪ (auto → same-location | manual → list),
+* minus self, deduped. Order: children first, then mode additions.
 */
-async function getDeviceStatusAggregate(deps, input) {
-	const capNames = input.caps ?? CAP_NAMES_WITH_STATUS;
-	const registry = deps.capabilityRegistry;
-	const out = {};
-	if (!registry) {
-		for (const name of capNames) out[name] = null;
-		return out;
-	}
-	await Promise.all(capNames.map(async (capName) => {
-		try {
-			const def = registry.getDefinition(capName);
-			if (!def?.status) {
-				out[capName] = null;
-				return;
-			}
-			const provider = registry.getProviderForDevice(capName, input.deviceId);
-			if (!provider || typeof provider.getStatus !== "function") {
-				out[capName] = null;
-				return;
-			}
-			const raw = await provider.getStatus({ deviceId: input.deviceId });
-			if (raw == null) {
-				out[capName] = null;
-				return;
-			}
-			const parsed = def.status.schema.safeParse(raw);
-			if (!parsed.success) {
-				deps.ctx.logger.warn("getDeviceStatusAggregate: provider returned invalid status, dropping", {
-					tags: { deviceId: input.deviceId },
-					meta: {
-						capName,
-						issues: parsed.error.issues.slice(0, 3)
-					}
-				});
-				out[capName] = null;
-				return;
-			}
-			out[capName] = parsed.data;
-		} catch (err) {
-			deps.ctx.logger.warn("getDeviceStatusAggregate: provider threw, dropping", {
-				tags: { deviceId: input.deviceId },
-				meta: {
-					capName,
-					error: errMsg(err)
-				}
-			});
-			out[capName] = null;
+function resolveLinkedDeviceIds(params) {
+	const { selfId, selfLocation, config, candidates } = params;
+	const ids = /* @__PURE__ */ new Set();
+	for (const c of candidates) if (c.parentDeviceId === selfId) ids.add(c.id);
+	if (config.mode === "auto") {
+		if (selfLocation !== null && selfLocation.length > 0) {
+			for (const c of candidates) if (c.location === selfLocation) ids.add(c.id);
 		}
+	} else {
+		const known = new Set(candidates.map((c) => c.id));
+		for (const id of config.manualIds) if (known.has(id)) ids.add(id);
+	}
+	ids.delete(selfId);
+	return [...ids];
+}
+/** Cap implementation of `getLinkedDevices`. */
+async function getLinkedDevices(pctx, input) {
+	const { deviceId } = input;
+	const [all, blob] = await Promise.all([listAll(pctx, {}), pctx.settings.readDeviceStore(deviceId)]);
+	const config = parseLinkedDevicesConfig(blob);
+	const byId = new Map(all.map((d) => [d.id, d]));
+	const ids = resolveLinkedDeviceIds({
+		selfId: deviceId,
+		selfLocation: byId.get(deviceId)?.location ?? null,
+		config,
+		candidates: all
+	});
+	const devices = [];
+	for (const id of ids) {
+		const d = byId.get(id);
+		if (!d) continue;
+		devices.push({
+			deviceId: d.id,
+			name: d.name,
+			location: d.location,
+			features: d.features
+		});
+	}
+	return {
+		mode: config.mode,
+		devices
+	};
+}
+/**
+* "Linked devices" settings section for a CAMERA (null for every other
+* device type — the association is camera-anchored). Contributed through
+* `collectSystemDeviceContributions`; saves route through the existing
+* `writerCapName: 'device-manager'` path into the device config blob.
+*/
+async function buildLinkedDevicesContribution(pctx, deviceId) {
+	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
+	if (!persisted || persisted.meta.type !== DeviceType.Camera) return null;
+	const [all, blob] = await Promise.all([listAll(pctx, {}), pctx.settings.readDeviceStore(deviceId)]);
+	const config = parseLinkedDevicesConfig(blob);
+	const options = all.filter((d) => d.id !== deviceId).map((d) => ({
+		value: String(d.id),
+		label: d.location !== null ? `${d.name} (${d.location})` : d.name
 	}));
-	return out;
+	return { sections: [{
+		id: "linked-devices",
+		title: "Linked devices",
+		description: "Companion devices associated with this camera. Device-tree children are always linked; auto mode also links every device sharing the camera location, manual mode links the picked list instead.",
+		order: 70,
+		fields: [{
+			type: "select",
+			key: LINKED_MODE_CONFIG_KEY,
+			label: "Link mode",
+			description: "Auto: children + same-location devices. Manual: children + the list below.",
+			options: [{
+				value: "auto",
+				label: "Auto (location-based)"
+			}, {
+				value: "manual",
+				label: "Manual"
+			}],
+			value: config.mode
+		}, {
+			type: "multiselect",
+			key: LINKED_IDS_CONFIG_KEY,
+			label: "Manually linked devices",
+			description: "Used in manual mode (children stay linked regardless).",
+			showWhen: {
+				field: LINKED_MODE_CONFIG_KEY,
+				equals: "manual"
+			},
+			options,
+			value: config.manualIds.map(String)
+		}]
+	}] };
 }
 /**
-* Return the driver-specific device-settings contribution. Hub-local
-* devices call `getSettingsUISchema()` directly; forked-worker devices
-* go through the `device-ops.getSettingsSchema` cap method on the
-* numeric-id-keyed native registry.
+* Direct `applyDeviceSettingsPatch` normalization for the two reserved keys.
+* The admin-ui save path reaches the device config blob via the
+* `writerCapName: 'device-manager'` routing (never this method), but the cap
+* contract includes the method — keep it correct for direct callers.
+*/
+async function applyLinkedDevicesPatch(pctx, deviceId, patch) {
+	const next = { ...await pctx.settings.readDeviceStore(deviceId) };
+	if ("_linkedDevicesMode" in patch) next[LINKED_MODE_CONFIG_KEY] = patch["_linkedDevicesMode"] === "manual" ? "manual" : "auto";
+	if ("_linkedDeviceIds" in patch) next[LINKED_IDS_CONFIG_KEY] = [...parseLinkedDevicesConfig({ [LINKED_IDS_CONFIG_KEY]: patch[LINKED_IDS_CONFIG_KEY] }).manualIds];
+	await pctx.settings.writeDeviceStore(deviceId, next);
+	return { success: true };
+}
+//#endregion
+//#region src/builtins/device-manager/device-bindings-store.ts
+/**
+* Persisted wrapper-activation + per-device binding resolution for the
+* device-manager addon. Extracted from `device-manager.addon.ts` as free
+* functions that receive an explicit `BindingsDeps` context (dependency
+* injection) instead of closing over the addon instance — keeps the routing
+* logic cohesive and independently testable while preserving the EXACT call
+* semantics, ordering, and side effects of the original class methods.
 *
-* Returns a discriminated result so callers can distinguish three states:
-*   'ok'          – schema obtained successfully
-*   'none'        – driver genuinely has no settings schema
-*   'unavailable' – worker was unreachable after retries (transient)
+* The addon keeps thin delegator methods (`getBindings`, `getAllBindings`, …)
+* that build `BindingsDeps` from its own state and forward here, so every
+* existing internal + cap-router call site is unchanged.
 */
-async function resolveDriverConfigSchema(deps, deviceId, hubLocal) {
-	if (hubLocal) {
-		const schema = hubLocal.device.getSettingsUISchema();
-		return schema.sections.length === 0 ? { status: "none" } : {
-			status: "ok",
-			schema: toWireShape(schema)
-		};
-	}
-	const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-	if (!ops) return { status: "none" };
-	const MAX_RETRIES = 2;
-	const RETRY_DELAY_MS = 750;
-	let lastErr;
-	for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
-		if (attempt > 0) await sleep(RETRY_DELAY_MS);
-		try {
-			const schema = await ops.getSettingsSchema({ deviceId });
-			if (!schema) return { status: "none" };
-			const wire = schema;
-			return wire.sections.length === 0 ? { status: "none" } : {
-				status: "ok",
-				schema: toWireShape(wire)
-			};
-		} catch (err) {
-			lastErr = err;
-			if (!isTransientMoleculerError(err)) break;
-			if (attempt < MAX_RETRIES) deps.ctx.logger.debug("cross-process getSettingsSchema transient failure, retrying", {
-				tags: { deviceId },
-				meta: {
-					attempt: attempt + 1,
-					maxRetries: MAX_RETRIES,
-					error: errMsg(err)
-				}
+/**
+* Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
+* Workers emit `DeviceBindingsChanged` on `ctx.registerNativeCap` / device
+* removal; we mirror those into `remoteNativeCaps` so `getBindings` returns the
+* full cluster view. Events from the local node are ignored: hub-local natives
+* live in `capabilityRegistry` and are folded in directly by getBindings.
+*
+* Push events are accurate in the steady state but can be lost during the
+* Moleculer transport handshake window (hub restart, crash-respawn,
+* restartAddon). The reliable replacement for lost events is the D3 re-handshake
+* (`listClusterNativeCaps()`), which `resolveNativeCapOwnerSync` /
+* `getBindings` step 4 fall through to on a push miss. The `$node.disconnected`
+* handler purges a gone node's entries; the worker re-handshakes (and re-emits
+* `native-registered`) on its next boot.
+*/
+function wireRemoteNativeCapSync(ctx, remoteNativeCaps) {
+	const localNodeId = ctx.kernel.localNodeId ?? "hub";
+	ctx.eventBus.subscribe({ category: EventCategory.DeviceBindingsChanged }, (event) => {
+		const { deviceId, capName, reason, addonId, nodeId } = event.data;
+		if (nodeId === localNodeId) return;
+		if (reason === "native-registered") {
+			let perDevice = remoteNativeCaps.get(deviceId);
+			if (!perDevice) {
+				perDevice = /* @__PURE__ */ new Map();
+				remoteNativeCaps.set(deviceId, perDevice);
+			}
+			perDevice.set(capName, {
+				addonId,
+				nodeId
 			});
+		} else if (reason === "native-unregistered") {
+			const perDevice = remoteNativeCaps.get(deviceId);
+			if (!perDevice) return;
+			perDevice.delete(capName);
+			if (perDevice.size === 0) remoteNativeCaps.delete(deviceId);
 		}
-	}
-	const msg = errMsg(lastErr);
-	deps.ctx.logger.warn("cross-process getSettingsSchema failed after retries — driver settings temporarily unavailable", {
-		tags: { deviceId },
-		meta: { error: msg }
 	});
-	return { status: "unavailable" };
-}
-/**
-* Route a `derived-form` device-config cap's flat form patch to whichever
-* mutation the bound provider actually exposes — inspecting the
-* provider's method surface, not the cap name. `setSettings` fires once
-* with the parsed flat patch; `setProfile` fans the patch out per-profile
-* via the registered builderId reducer.
-*/
-async function dispatchDerivedFormSave(builderId, deviceId, patch, dcProvider, capName) {
-	if (typeof dcProvider.setSettings === "function") {
-		const settings = parseDerivedFormSettingsPatch(builderId, patch);
-		await dcProvider.setSettings({
-			deviceId,
-			settings
-		});
-		return;
-	}
-	if (typeof dcProvider.setProfile === "function") {
-		const setProfile = dcProvider.setProfile;
-		await applyDerivedFormProfilePatch(builderId, patch, (profile, profilePatch) => setProfile({
-			deviceId,
-			profile,
-			patch: profilePatch
-		}));
-		return;
-	}
-	throw new Error(`[device-manager] device-config cap "${capName}" provider exposes neither setSettings nor setProfile`);
-}
-async function updateDeviceField(deps, input) {
-	if (input.writerCapName === "device-manager") {
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, input.deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch({ [input.key]: input.value });
-			return { success: true };
+	const cluster = ctx.kernel.cluster;
+	if (cluster) cluster.broker.localBus.on("$node.disconnected", (payload) => {
+		const gone = payload.node.id;
+		const emptyDevices = [];
+		for (const [deviceId, perDevice] of remoteNativeCaps) {
+			const toDelete = [];
+			for (const [capName, entry] of perDevice) if (entry.nodeId === gone) toDelete.push(capName);
+			for (const capName of toDelete) perDevice.delete(capName);
+			if (perDevice.size === 0) emptyDevices.push(deviceId);
 		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", input.deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${input.deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId: input.deviceId,
-			values: { [input.key]: input.value }
-		});
-		return { success: true };
-	}
-	const registry = deps.capabilityRegistry;
-	if (!registry) throw new Error("[device-manager] updateDeviceField requires capability registry — unavailable on this node");
-	const def = registry.getDefinition(input.writerCapName);
-	if (isDeviceConfigCap(def)) {
-		if (def.deviceConfig.ui.kind === "widget") return { success: true };
-		const dcProvider = registry.getProviderForDevice(input.writerCapName, input.deviceId);
-		if (!dcProvider) throw new Error(`[device-manager] no provider for device-config cap "${input.writerCapName}" on device ${input.deviceId}`);
-		await dispatchDerivedFormSave(def.deviceConfig.ui.builderId, input.deviceId, { [input.key]: input.value }, dcProvider, input.writerCapName);
-		return { success: true };
-	}
-	if (!def?.exposesDeviceSettings) throw new Error(`[device-manager] cap "${input.writerCapName}" does not expose device settings`);
-	await resolveContributionProvider(registry, def, input.writerCapName, input.writerAddonId, input.deviceId).applyDeviceSettingsPatch({
-		deviceId: input.deviceId,
-		patch: { [input.key]: input.value }
+		for (const deviceId of emptyDevices) remoteNativeCaps.delete(deviceId);
 	});
-	return { success: true };
 }
-/**
-* Dispatch a device custom action. Hub-local devices run it directly;
-* forked/remote devices route through the `device-ops` native cap
-* (`runAction`) — the same hub-local-then-device-ops fan-out that
-* `updateDeviceField` uses for `applySettingsPatch`.
-*/
-async function dispatchDeviceAction(deps, deviceId, action, input) {
-	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-	const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-	if (found) return found.device.runDeviceAction(action, input);
-	const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-	if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found for runDeviceAction (no hub-local entry, no device-ops native provider)`);
-	return ops.runAction({
-		deviceId,
-		action,
-		input
-	});
+async function readBindingsStore(deps) {
+	return { deviceBindings: (await deps.ctx.settings.readAddonStore()).deviceBindings ?? {} };
+}
+async function writeBindingsStore(deps, next) {
+	await deps.ctx.settings.writeAddonStore({ deviceBindings: next.deviceBindings });
+}
+function resolveWrapperNodeId(_wrapperAddonId) {
+	return "hub";
 }
 /**
-* Resolve the `DeviceSettingsContribution` provider that owns a tagged
-* field. The `writerAddonId` on a tagged field equals `entry.providerAddonId`
-* from the binding that produced it — for `kind:'wrapped'` entries, that is
-* the wrapper addon id (e.g. 'snapshot-addon'); for native-only entries,
-* the system addon id.
+* Reduce a provider node id to the routable form `DeviceProxy` can pin.
 *
-* Resolution order (Bug-3 fix):
-*  1. `getProviderByAddon(capName, writerAddonId)` — resolves the
-*     system-registered provider by the addon id from the tagged field.
-*     For wrapper bindings (snapshot, motion-detection, etc.) this directly
-*     returns the wrapper provider, bypassing the native-first resolution
-*     order of `getProviderForDevice` that caused "method not found".
-*  2. `getSingleton(capName)` — fallback for stale/mismatched writerAddonIds.
-*     The active singleton handles the contribution even if the addonId
-*     stored in the field is out of date (e.g. after an addon rename).
+* Every addon runs in its own `addon-runner` with the composite node id
+* `${parentNodeId}/${runnerId}` (see `addon-runner.ts`) — e.g.
+* `hub/provider-reolink` or `dev-agent-0/provider-reolink`. That composite is
+* an IDENTITY, not a routable target: the `CapRouteResolver` reaches a child
+* only THROUGH its parent (the hub resolves a hub-local-uds child by
+* cap+device; an agent forwards to its own child). `DeviceProxy` pins
+* `entry.providerNodeId` on every cap call, so a binding entry must expose the
+* parent node id — otherwise the explicit pin classifies as `remote-moleculer`
+* to an unknown node → `no-provider`, which surfaces as
+* "this camera doesn't expose …" for client-proxy-driven widget caps
+* (motion-zones, privacy-mask). Wrappers already report the parent via
+* `resolveWrapperNodeId`; this aligns natives with the same contract.
 *
-* `getProviderForDevice` is intentionally NOT used here: it returns the
-* per-device native first when present (e.g. Reolink/ONVIF), and the native
-* does NOT implement contribution methods — the root cause of Bug-3.
+* A flat node id (a genuine standalone node with no `/`) is returned
+* unchanged.
 */
-function resolveContributionProvider(registry, _def, writerCapName, writerAddonId, deviceId) {
-	const byAddon = registry.getProviderByAddon(writerCapName, writerAddonId);
-	if (byAddon) return byAddon;
-	const singleton = registry.getSingleton(writerCapName);
-	if (singleton) return singleton;
-	throw new Error(`[device-manager] no provider for cap "${writerCapName}" (addon "${writerAddonId}") on device ${deviceId}`);
+function toRoutableProviderNodeId(nodeId) {
+	const slash = nodeId.indexOf("/");
+	return slash === -1 ? nodeId : nodeId.slice(0, slash);
 }
 /**
-* Batched counterpart of `updateDeviceField`. Groups changes by
-* `(writerCapName, writerAddonId)` so each contributor receives a
-* single `applyDeviceSettingsPatch` with all of its updates merged —
-* avoids N round-trips for simultaneous edits in the same save.
+* Resolve a remote native cap entry for a given `(capName, deviceId)` by
+* consulting the handshake-fed `HubNodeRegistry` via
+* `ctx.kernel.listClusterNativeCaps()`. Called when the push-based
+* `remoteNativeCaps` cache misses — covers the Moleculer transport
+* handshake window where `DeviceBindingsChanged` events were lost but the
+* D3 re-handshake (post device restore) has already populated the registry.
 *
-* Per-provider failures are captured in the `failures[]` output so the
-* admin UI can highlight which sections didn't persist; a failure on
-* one provider does NOT abort the others.
+* Returns `null` when the entry is genuinely not present in the cluster
+* view (cap not registered on any worker for that device).
 */
-async function updateDeviceFieldsBatch(deps, input) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const change of input.changes) {
-		const key = `${change.writerCapName}::${change.writerAddonId}`;
-		const existing = groups.get(key);
-		if (existing) existing.patch[change.key] = change.value;
-		else groups.set(key, {
-			writerCapName: change.writerCapName,
-			writerAddonId: change.writerAddonId,
-			patch: { [change.key]: change.value }
-		});
-	}
-	const failures = [];
-	for (const group of groups.values()) try {
-		await applyGroupPatch(deps, input.deviceId, group);
-	} catch (err) {
-		failures.push({
-			writerCapName: group.writerCapName,
-			writerAddonId: group.writerAddonId,
-			error: err instanceof Error ? err.message : String(err)
-		});
-	}
-	return {
-		success: true,
-		failures
+function resolveRemoteNativeCapFromRegistry(deps, capName, deviceId) {
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	if (!clusterCaps) return null;
+	for (const entry of clusterCaps) if (entry.capName === capName && entry.deviceId === deviceId && entry.addonId) return {
+		addonId: entry.addonId,
+		nodeId: entry.nodeId
 	};
+	return null;
 }
-/** Apply a single grouped patch to the appropriate provider. Mirrors
-* `updateDeviceField` routing (special-case device-manager, else
-* registry lookup). Used by `updateDeviceFieldsBatch`. */
-async function applyGroupPatch(deps, deviceId, group) {
-	if (group.writerCapName === "device-manager") {
-		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
-		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
-		if (found) {
-			await found.device.applySettingsPatch(group.patch);
-			return;
+async function getBindings(deps, input) {
+	const storeKey = String(input.deviceId);
+	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+	const entries = [];
+	const seenCaps = /* @__PURE__ */ new Set();
+	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
+	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
+		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
+		const remoteNative = resolveRemote(capName);
+		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
+		if (wrapperAddonId === null && !nativeAddonId) {
+			seenCaps.add(capName);
+			continue;
 		}
-		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
-		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
-		await ops.setConfig({
-			deviceId,
-			values: group.patch
+		entries.push({
+			capName,
+			kind: wrapperAddonId ? "wrapped" : "native",
+			providerAddonId: wrapperAddonId ?? nativeAddonId,
+			providerNodeId: wrapperAddonId ? resolveWrapperNodeId(wrapperAddonId) : toRoutableProviderNodeId(nativeNodeId),
+			nativeAddonId
 		});
-		return;
+		seenCaps.add(capName);
 	}
-	const registry = deps.capabilityRegistry;
-	if (!registry) throw new Error("[device-manager] capability registry unavailable");
-	const def = registry.getDefinition(group.writerCapName);
-	if (isDeviceConfigCap(def)) {
-		if (def.deviceConfig.ui.kind === "widget") return;
-		const dcProvider = registry.getProviderForDevice(group.writerCapName, deviceId);
-		if (!dcProvider) throw new Error(`[device-manager] no provider for device-config cap "${group.writerCapName}" on device ${deviceId}`);
-		await dispatchDerivedFormSave(def.deviceConfig.ui.builderId, deviceId, group.patch, dcProvider, group.writerCapName);
-		return;
+	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
+		if (seenCaps.has(capName)) continue;
+		const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
+		if (!defaultWrapperAddonId) continue;
+		const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
+		const remoteNative = resolveRemote(capName);
+		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
+		entries.push({
+			capName,
+			kind: "wrapped",
+			providerAddonId: defaultWrapperAddonId,
+			providerNodeId: resolveWrapperNodeId(defaultWrapperAddonId),
+			nativeAddonId
+		});
+		seenCaps.add(capName);
 	}
-	if (!def?.exposesDeviceSettings) throw new Error(`[device-manager] cap "${group.writerCapName}" does not expose device settings`);
-	await resolveContributionProvider(registry, def, group.writerCapName, group.writerAddonId, deviceId).applyDeviceSettingsPatch({
-		deviceId,
-		patch: group.patch
-	});
-}
-async function listWrappersForCap(deps, input) {
-	return [...deps.capabilityRegistry?.getWrappersForCap(input.capName) ?? []];
-}
-async function listBindableCapsForDeviceType(deps, input) {
-	const registry = deps.capabilityRegistry;
-	if (!registry) return [];
-	return registry.listDeviceScopedCapsForType(input.deviceType).map((capName) => ({
-		capName,
-		wrappers: [...registry.getWrappersForCap(capName)]
-	}));
-}
-async function setWrapperActive(deps, input) {
-	const storeKey = String(input.deviceId);
-	const store = await readBindingsStore(deps.bindingsDeps);
-	const perDevice = { ...store.deviceBindings[storeKey] };
-	if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-	else perDevice[input.capName] = { wrapperAddonId: null };
-	const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-		...store.deviceBindings,
-		[storeKey]: perDevice
-	} : (() => {
-		const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-		return rest;
-	})();
-	await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
-	deps.ctx.eventBus.emit({
-		id: randomUUID(),
-		timestamp: /* @__PURE__ */ new Date(),
-		source: {
-			type: "addon",
-			id: deps.ctx.id
-		},
-		category: EventCategory.DeviceBindingsChanged,
-		data: {
-			deviceId: input.deviceId,
-			capName: input.capName,
-			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
-			addonId: input.wrapperAddonId,
-			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
+	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
+		if (seenCaps.has(capName)) continue;
+		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
+		entries.push({
+			capName,
+			kind: "native",
+			providerAddonId: nativeAddonId,
+			providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
+			nativeAddonId
+		});
+		seenCaps.add(capName);
+	}
+	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
+	if (pushFed) for (const [capName, info] of pushFed) {
+		if (seenCaps.has(capName)) continue;
+		entries.push({
+			capName,
+			kind: "native",
+			providerAddonId: info.addonId,
+			providerNodeId: toRoutableProviderNodeId(info.nodeId),
+			nativeAddonId: info.addonId
+		});
+		seenCaps.add(capName);
+	}
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	if (clusterCaps) for (const entry of clusterCaps) {
+		if (entry.deviceId !== input.deviceId) continue;
+		if (seenCaps.has(entry.capName)) continue;
+		if (!entry.addonId) continue;
+		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
+		if (entry.nodeId === localNodeId) continue;
+		entries.push({
+			capName: entry.capName,
+			kind: "native",
+			providerAddonId: entry.addonId,
+			providerNodeId: toRoutableProviderNodeId(entry.nodeId),
+			nativeAddonId: entry.addonId
+		});
+		seenCaps.add(entry.capName);
+	}
+	if (deps.devicesWithLinks?.has(input.deviceId)) {
+		const row = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(input.deviceId)];
+		for (const link of row?.deviceLinks ?? []) {
+			const capName = link.target.cap;
+			if (seenCaps.has(capName)) continue;
+			entries.push({
+				capName,
+				kind: "linked",
+				providerAddonId: deps.ctx.id,
+				providerNodeId: deps.ctx.kernel.localNodeId ?? "hub",
+				nativeAddonId: ""
+			});
+			seenCaps.add(capName);
 		}
-	});
-}
-/**
-* Build the wireable-cap entry for one capability definition: the status
-* schema's scalar leaf fields plus — for an item-array cap
-* (`status.itemArray`) — the per-item fields tagged `item: true` (a link
-* targeting one must carry a `target.itemKey`) and the cap-level `itemArray`
-* descriptor so the UI can address items. Returns null when the cap exposes
-* nothing wireable (no status schema / no leaf fields).
-*/
-function wireableEntryForDef(capName, def) {
-	const status = def.status;
-	const schema = status?.schema;
-	if (!schema) return null;
-	const itemArray = status.itemArray;
-	const fields = [...enumerateSchemaFields(schema), ...itemArray ? enumerateItemArrayFields(itemArray) : []].map((f) => ({
-		path: f.path,
-		kind: f.kind,
-		...f.enumValues !== void 0 ? { enumValues: [...f.enumValues] } : {},
-		...f.item === true ? { item: true } : {}
-	}));
-	if (fields.length === 0) return null;
+	}
 	return {
-		cap: capName,
-		fields,
-		...itemArray ? { itemArray: {
-			path: itemArray.path,
-			keyField: itemArray.keyField
-		} } : {}
+		deviceId: input.deviceId,
+		entries
 	};
 }
 /**
-* Per-device wireable-field catalog — the domain status fields a device's
-* bound caps expose, for the operator's cross-device wiring UI. Binding-driven:
-* walks `getBindings(deviceId)`, skips wrapper caps (their status schemas are
-* internal book-keeping, not wireable domain data), and enumerates each cap's
-* status schema leaf fields (per-item fields included for item-array caps).
+* Whole-fleet binding dump. Iterates every device known to the
+* deviceRegistry and reuses the per-device `getBindings` resolver
+* for each — same routing rules, single round-trip. Used by
+* `SystemManager.init()` for warm-boot.
 *
-* `includeSynthesizable: true` (TARGET pickers only) additionally unions in
-* UNBOUND device-scoped caps that declare `status.empty` (the synthesize-target
-* marker) and whose `deviceTypes` admit this device's persisted type — so the
-* FIRST link to a synthesize-only cap (consumables on an HA vacuum) can be
-* authored before any binding exists. Default (absent/false) behavior is
-* byte-identical to the binding-driven catalog.
+* Bindings change rarely (wrapper toggle, device add/remove) so
+* clients invalidate via the existing
+* `capability.binding-changed` event rather than re-fetching this
+* payload periodically.
 */
-async function getWireableFields(deps, input) {
-	const { deviceId } = input;
-	const reg = deps.capabilityRegistry;
-	if (!reg) return { caps: [] };
-	const { entries } = await getBindings(deps.bindingsDeps, { deviceId });
-	const seen = /* @__PURE__ */ new Set();
-	const caps = [];
-	for (const entry of entries) {
-		if (seen.has(entry.capName)) continue;
-		seen.add(entry.capName);
-		const def = reg.getDefinition(entry.capName);
-		if (!def || def.kind === "wrapper") continue;
-		const wireable = wireableEntryForDef(entry.capName, def);
-		if (wireable) caps.push(wireable);
-	}
-	if (input.includeSynthesizable === true) {
-		const deviceType = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.type;
-		if (deviceType !== void 0) for (const def of ALL_CAPABILITY_DEFINITIONS) {
-			if (seen.has(def.name)) continue;
-			if (def.scope !== "device" || def.kind === "wrapper") continue;
-			if (def.status?.empty === void 0) continue;
-			if (def.deviceTypes && !def.deviceTypes.some((t) => t === deviceType)) continue;
-			seen.add(def.name);
-			const wireable = wireableEntryForDef(def.name, def);
-			if (wireable) caps.push(wireable);
-		}
-	}
-	return { caps };
+async function getAllBindings(deps) {
+	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+	if (!hubRegistry) return [];
+	const out = [];
+	for (const device of hubRegistry.getAll()) out.push(await getBindings(deps, { deviceId: device.id }));
+	return out;
+}
+/**
+* Resolve a numeric deviceId to a stableId via persisted meta.
+* Used only by the device-identity section of the device-details
+* aggregator (see `buildBaseDeviceSection`) to surface the stableId as
+* a readonly display field. All runtime/registry lookups are keyed by
+* numeric deviceId; this helper is display-only.
+*/
+async function lookupPersistedStableId(deps, deviceId) {
+	return ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.stableId;
 }
 //#endregion
-//#region src/builtins/device-manager/device-event-propagator.ts
+//#region src/builtins/device-manager/device-aggregation.ts
 /**
-* Walks the parent chain for every device-sourced event and re-emits a
-* copy on each ancestor scope with `via[]` populated.
-*
-* Design goals:
-*   - Transparent: drivers emit once on their own device scope; the
-*     framework handles fan-out. Zero provider boilerplate.
-*   - Anti-loop: events that already carry `via[]` are skipped (we only
-*     propagate ORIGINAL emissions).
-*   - Anti-cycle: the parent chain is bounded — if the device registry
-*     is corrupt and has a cycle, the walker caps at `MAX_CHAIN_DEPTH`
-*     and logs a warning.
-*   - Lazy: parent chain is resolved on-demand per event (no cached
-*     topology). The lookup is O(depth) which is ≤2 in practice.
-*
-* `via` contract (from SystemEvent.via JSDoc):
-*   - `via[0]` is the originating source (the device that produced the
-*     event). Subsequent entries walk up the parent chain.
-*   - On the re-emission, `source` is the ancestor at that level and
-*     `via[0..i]` is the prefix of the chain up to and including the
-*     first N ancestors below the current one.
+* Device-details aggregation + field-update routing for the device-manager
+* addon. Extracted from `device-manager.addon.ts` as free functions that
+* receive an explicit `AggregationDeps` context (DI) rather than closing over
+* the addon instance.
 *
-* Example (grandchild → parent → grandparent):
-*   Original:  { source: {id: 7}, data: {...}, via: undefined }
-*   Re-emit 1: { source: {id: 4}, data: {...}, via: [{id: 7}] }
-*   Re-emit 2: { source: {id: 1}, data: {...}, via: [{id: 7}, {id: 4}] }
+* This module owns the binding-driven settings/live/status aggregators
+* (`getDeviceAggregate`, `collectSystemDeviceContributions`,
+* `deriveDeviceConfigContribution`, `buildBaseDeviceSection`,
+* `getDeviceStatusAggregate`, `resolveDriverConfigSchema`) and the
+* field-update routing (`updateDeviceField`, `updateDeviceFieldsBatch`,
+* `applyGroupPatch`, `resolveContributionProvider`, `dispatchDeviceAction`)
+* plus the wrapper-activation mutators (`setWrapperActive`,
+* `listWrappersForCap`, `listBindableCapsForDeviceType`).
 *
-* A consumer listening at `source.id === 1` receives re-emit 2 (with
-* `via` showing the chain). A consumer listening at `source.id === 7`
-* with `via === undefined` receives the original only.
+* Sibling aggregator functions call each other directly (passing `deps`);
+* cross-domain leaf calls (`getBindings`, `lookupPersistedStableId`,
+* `resolveRemoteNativeCapFromRegistry`, read/writeBindingsStore) route through
+* the bindings-store module via `deps.bindingsDeps`. EXACT semantics, ordering,
+* and side effects of the original class methods are preserved; the addon keeps
+* thin delegator methods over these functions.
 */
-/** Bounded walk — paranoia against corrupt device registries with cycles. */
-var MAX_CHAIN_DEPTH = 16;
-var DeviceEventPropagator = class {
-	opts;
-	unsubscribe = null;
-	constructor(opts) {
-		this.opts = opts;
-	}
-	start() {
-		if (this.unsubscribe) return;
-		const unsub = this.opts.eventBus.subscribe({}, (ev) => this.handle(ev));
-		this.unsubscribe = unsub;
-	}
-	stop() {
-		if (!this.unsubscribe) return;
-		this.unsubscribe();
-		this.unsubscribe = null;
+async function getDeviceAggregate(deps, deviceId, kind) {
+	const registry = deps.capabilityRegistry;
+	if (!registry) {
+		deps.ctx.logger.debug("capability registry unavailable — aggregate empty", { meta: { kind } });
+		return null;
 	}
-	/** Exposed for tests — lets them inject events without the full bus. */
-	handle(ev) {
-		if (ev.via !== void 0) return;
-		if (ev.source.type !== "device") return;
-		const rawId = ev.source.id;
-		const deviceId = typeof rawId === "number" ? rawId : Number(rawId);
-		if (!Number.isFinite(deviceId)) return;
-		const chain = this.resolveParentChain(deviceId);
-		if (chain.length === 0) return;
-		const via = [ev.source];
-		for (const ancestorId of chain) {
-			const reEmission = {
-				...ev,
-				source: {
-					type: "device",
-					id: ancestorId
+	const method = kind === "settings" ? "getDeviceSettingsContribution" : "getDeviceLiveContribution";
+	const { entries: bindingEntries } = await getBindings(deps.bindingsDeps, { deviceId });
+	const seenCaps = new Set(bindingEntries.map((e) => e.capName));
+	const results = await Promise.all(bindingEntries.map(async (entry) => {
+		const def = registry.getDefinition(entry.capName);
+		if (isDeviceConfigCap(def)) return deriveDeviceConfigContribution(deps, registry, def, entry, deviceId, kind);
+		if (!def?.exposesDeviceSettings) return null;
+		const provider = registry.getProviderByAddon(entry.capName, entry.providerAddonId);
+		if (!provider) return null;
+		try {
+			const contribution = await provider[method]({ deviceId });
+			if (!contribution) return null;
+			return tagContribution(toWireShape(contribution), entry.capName, entry.providerAddonId, kind);
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			deps.ctx.logger.warn("contribution method failed", {
+				tags: {
+					deviceId,
+					addonId: entry.providerAddonId
 				},
-				via: [...via]
-			};
-			this.opts.eventBus.emit(reEmission);
-			via.push({
-				type: "device",
-				id: ancestorId
+				meta: {
+					capName: entry.capName,
+					method,
+					error: msg
+				}
 			});
+			return null;
 		}
-	}
-	resolveParentChain(deviceId) {
-		const chain = [];
-		const seen = new Set([deviceId]);
-		let current = this.opts.getParentOf(deviceId);
-		while (current != null) {
-			if (seen.has(current)) {
-				this.opts.logger.warn("device-event-propagator: cycle detected in parent chain — aborting propagation", {
-					tags: { deviceId },
-					meta: {
-						cycleAt: current,
-						chainSoFar: [...chain]
-					}
-				});
-				return chain;
-			}
-			seen.add(current);
-			chain.push(current);
-			if (chain.length >= MAX_CHAIN_DEPTH) {
-				this.opts.logger.warn("device-event-propagator: chain depth limit hit — truncating", {
-					tags: { deviceId },
+	}));
+	const base = kind === "settings" ? await buildBaseDeviceSection(deps, deviceId) : null;
+	const systemResults = await collectSystemDeviceContributions(deps, deviceId, kind, seenCaps);
+	const parts = [
+		...base ? [tagContribution(base, "device-manager", "device-manager", kind)] : [],
+		...results.filter((r) => r !== null),
+		...systemResults
+	];
+	if (parts.length === 0) return null;
+	return mergeAggregates(parts);
+}
+/**
+* System-scoped per-device contributions — the deliberate exception to
+* binding-driven aggregation (D12).
+*
+* A `scope: 'system'` cap with `exposesDeviceSettings: true` holds per-device
+* state but is NOT bound per-device: it is a system addon, not a BaseDevice,
+* so it never calls `registerNativeCap` and never appears in
+* `getBindings(deviceId)`. The binding-driven loop therefore skips it and its
+* per-device panel never renders. Two such caps ship today:
+*   - `stream-broker` (singleton) — the RTSP-restream / pre-buffer settings
+*     tab, scoped to the cameras whose streams it serves.
+*   - `device-export` (collection) — the "Export" panel; a device can be
+*     exposed to MULTIPLE exporters at once (Alexa + HomeKit + HA-MQTT).
+*
+* D12 bans fanning a per-device call out to every same-named provider of a
+* `scope: 'device'` cap, because vendor providers SHARE cap names
+* (`stream-params`/`ptz` from reolink AND hikvision). System caps are NOT
+* vendor-shared — a system cap name maps to one active provider (singleton)
+* or one declared collection — so consulting the cap's own provider(s)
+* directly is safe. Each provider gates internally by deviceId and returns
+* null for devices it does not own.
+*
+* `seenCaps` skips any system cap that already contributed via a binding so
+* its section is never duplicated.
+*/
+async function collectSystemDeviceContributions(deps, deviceId, kind, seenCaps) {
+	const registry = deps.capabilityRegistry;
+	if (!registry) return [];
+	const method = kind === "settings" ? "getDeviceSettingsContribution" : "getDeviceLiveContribution";
+	const tasks = [];
+	for (const info of registry.listCapabilities()) {
+		const def = registry.getDefinition(info.name);
+		if (!def || def.scope !== "system" || !def.exposesDeviceSettings) continue;
+		if (seenCaps.has(info.name)) continue;
+		const addonIds = def.mode === "collection" ? info.providers : info.activeProvider ? [info.activeProvider] : [];
+		for (const addonId of addonIds) tasks.push((async () => {
+			const provider = registry.getProviderByAddon(info.name, addonId);
+			if (!provider) return null;
+			try {
+				const contribution = await provider[method]({ deviceId });
+				if (!contribution) return null;
+				return tagContribution(toWireShape(contribution), info.name, addonId, kind);
+			} catch (err) {
+				deps.ctx.logger.warn("system device-settings contribution skipped", {
+					tags: {
+						deviceId,
+						addonId
+					},
 					meta: {
-						depth: chain.length,
-						max: MAX_CHAIN_DEPTH
+						capName: info.name,
+						method,
+						error: err instanceof Error ? err.message : String(err)
 					}
 				});
-				break;
+				return null;
 			}
-			current = this.opts.getParentOf(current);
-		}
-		return chain;
+		})());
 	}
-};
-//#endregion
-//#region src/builtins/device-manager/device-queries.ts
+	return (await Promise.all(tasks)).filter((r) => r !== null);
+}
 /**
-* Device query + live-runtime + provider/adoption operations for the
-* device-manager addon — the read/live half of the `IDeviceManagerProvider`
-* surface. Extracted verbatim from the `onInitialize` provider literal as free
-* functions taking a `ProviderContext` (DI). Input/return types are pinned to
-* the cap contract via `Parameters<IDeviceManagerProvider['x']>[0]` /
-* `ReturnType<…>` so the typed surface is identical to the inferred methods.
+* D14: framework-derived device-config contribution.
 *
-* Covers: persisted/live device queries (listPersistedByAddon, listAll,
-* getDevice, getChildren), live runtime methods (getStreamSources,
-* getConfigSchema, getSettingsSchema, updateConfig, enable, disable, remove,
-* removeByIntegration, getStreamProfileMap, setStreamProfileMap, probeStreams),
-* device-provider ops (discoverDevices, adoptDevice, getCreationSchema,
-* createDevice, testCreationField), and device-adoption ops
-* (adoptionListCandidates/Refresh/Adopt/Release/Resync, testField).
+* `kind === 'live'` — device-config caps contribute nothing to the live
+* aggregate (they hold editable config, not live observables).
 *
-* The hub-live-then-persisted-fallback union, the cross-process device-ops
-* dispatch, the depth-first remove cascade, and the resetToSource resync purge
-* are byte-for-byte preserved. `remove`/`removeByIntegration`/`enable`/`disable`/
-* `probeStreams`/`getStreamProfileMap` self-call sibling cap methods via
-* `pctx.provider`. Pure refactor — no behavior change.
+* `ui.kind === 'widget'` — emits a single structural `type:'widget'`
+* section; the widget self-persists via the cap's own mutations.
+*
+* `ui.kind === 'derived-form'` — calls `getOptions`/`getStatus` on the
+* bound provider, runs the registered pure builder, and returns the
+* derived form sections. Returns null when the camera exposes nothing
+* configurable or the provider is not yet registered.
 */
-async function listPersistedByAddon(pctx, input) {
-	const { addonId } = input;
-	const [index, meta] = await Promise.all([pctx.metaStore.readIndex(), pctx.metaStore.readMeta()]);
-	const stableIds = index[addonId] ?? [];
-	const byStableId = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) if (m.addonId === addonId) byStableId.set(m.stableId, m);
-	return stableIds.map((stableId) => {
-		const m = byStableId.get(stableId);
-		return {
-			id: m.id,
-			stableId,
-			type: m.type,
-			name: m.name,
-			location: m.location ?? null,
-			disabled: m.disabled ?? false,
-			parentDeviceId: m.parentDeviceId
-		};
-	});
-}
-async function listAll(pctx, input) {
-	const { addonId } = input;
-	const results = [];
-	const seen = /* @__PURE__ */ new Set();
-	const meta = await pctx.metaStore.readMeta();
-	const metadataMap = await pctx.metaStore.readMetadataMap();
-	if (pctx.registry) {
-		const liveEntries = addonId ? pctx.registry.getAllForAddon(addonId).map((device) => ({
-			addonId,
-			device
-		})) : pctx.registry.getAllWithAddonId();
-		for (const { addonId: aid, device } of liveEntries) {
-			const key = String(device.id);
-			const metadata = metadataMap[key] ?? null;
-			const metaRow = meta[key] ?? null;
-			results.push(toDeviceInfo(aid, device, metadata, metaRow));
-			seen.add(key);
-		}
+async function deriveDeviceConfigContribution(deps, registry, def, entry, deviceId, kind) {
+	if (kind === "live") return null;
+	const ui = def.deviceConfig.ui;
+	if (ui.kind === "widget") return tagContribution({ sections: [{
+		id: `${entry.capName}-widget`,
+		title: ui.label,
+		tab: ui.tab,
+		order: ui.order ?? 0,
+		...ui.topTab ? { location: "top-tab" } : {},
+		fields: [{
+			type: "widget",
+			key: `${entry.capName}Widget`,
+			label: ui.label,
+			widgetId: ui.widgetId
+		}]
+	}] }, entry.capName, entry.providerAddonId, kind);
+	const provider = registry.getProviderForDevice(entry.capName, deviceId);
+	if (!provider || typeof provider.getOptions !== "function") return null;
+	try {
+		const options = await provider.getOptions({ deviceId });
+		const status = typeof provider.getStatus === "function" ? await provider.getStatus({ deviceId }) : null;
+		const derived = deriveFormContribution(ui.builderId, options, status ?? null);
+		if (!derived) return null;
+		return tagContribution({
+			...derived.tabs ? { tabs: derived.tabs.map((t) => ({ ...t })) } : {},
+			sections: derived.sections.map((s) => ({
+				id: s.id,
+				title: s.title,
+				...s.tab !== void 0 ? { tab: s.tab } : {},
+				...s.order !== void 0 ? { order: s.order } : {},
+				...s.description !== void 0 ? { description: s.description } : {},
+				...s.columns !== void 0 ? { columns: s.columns } : {},
+				fields: [...s.fields]
+			}))
+		}, entry.capName, entry.providerAddonId, kind);
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		deps.ctx.logger.warn("device-config derivation failed", {
+			tags: {
+				deviceId,
+				addonId: entry.providerAddonId
+			},
+			meta: {
+				capName: entry.capName,
+				error: msg
+			}
+		});
+		return null;
 	}
-	const index = await pctx.metaStore.readIndex();
-	const metaByAddonStable = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) metaByAddonStable.set(`${m.addonId}${m.stableId}`, m);
-	const targetAddons = addonId ? [addonId] : Object.keys(index);
-	for (const aid of targetAddons) for (const stableId of index[aid] ?? []) {
-		const m = metaByAddonStable.get(`${aid}${stableId}`);
-		const key = String(m.id);
-		if (seen.has(key)) continue;
-		const persistedType = m.type;
-		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-		const metadata = metadataMap[key] ?? null;
-		results.push({
-			id: m.id,
-			stableId,
-			addonId: aid,
-			type: persistedType,
-			name: m?.name ?? stableId,
-			location: m?.location ?? null,
-			disabled: m?.disabled ?? false,
-			parentDeviceId: m?.parentDeviceId ?? null,
-			role: toDeviceRole(m?.role),
-			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
-			probed: pctx.host.resolveDeviceProbed(m.id),
-			features: persistedFeatures(m?.features),
-			isCamera: persistedType === DeviceType.Camera,
-			config: persistedConfig ?? {},
-			metadata,
-			...m?.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
-			...m?.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
-			...m?.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
-			...m?.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
-			...m?.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
-			...m?.display !== void 0 ? { display: m.display } : {},
-			...(() => {
-				const si = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
-				return si !== void 0 ? { sourceInfo: si } : {};
-			})()
-		});
-	}
-	return results;
 }
-async function getDevice(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) {
-			const key = String(found.device.id);
-			const [map, metaMap] = await Promise.all([pctx.metaStore.readMetadataMap(), pctx.metaStore.readMeta()]);
-			const metadata = map[key] ?? null;
-			const metaRow = metaMap[key] ?? null;
-			return toDeviceInfo(found.addonId, found.device, metadata, metaRow);
-		}
-	}
-	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-	if (!persisted) return null;
-	const { addonId: aid, stableId, meta: m } = persisted;
-	const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-	const key = String(deviceId);
-	const metadata = (await pctx.metaStore.readMetadataMap())[key] ?? null;
-	const sourceInfoGetDevice = buildSourceInfoFromConfig(persistedConfig ?? {}, stableId, aid);
+/**
+* Build the device-manager's own contribution to the aggregator — the
+* device identity (id, stableId, addonId, type, online) + the
+* driver-specific config exposed by the device class via
+* `zodEntriesToConfigUI`.
+*
+* Two paths, deliberately symmetric with `getSettingsSchema`:
+*
+*  - Hub-local: device's IDevice instance lives in this process'
+*    DeviceRegistry, we read config + schema directly by reference.
+*  - Cross-process: device lives in a forked worker (RtspCamera on
+*    provider-rtsp, ONVIF on provider-onvif, …). We ask the worker's
+*    `device-ops.getSettingsSchema` native provider for a wire-
+*    serializable ConfigUISchema and merge it in under the same
+*    "Driver Config" section, so the UI sees the same shape regardless
+*    of where the IDevice physically runs.
+*
+*  Returns `null` only when the device genuinely doesn't exist anywhere
+*  (no hub-local, no persisted ownership, no device-ops native). The
+*  aggregator falls back to contributor sections only in that case.
+*/
+async function buildBaseDeviceSection(deps, deviceId) {
+	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+	const hubLocal = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+	const stableId = hubLocal?.device.stableId ?? await lookupPersistedStableId(deps.bindingsDeps, deviceId);
+	const nativeOwner = resolveNativeDeviceOwner(deps, deviceId);
+	const addonId = hubLocal?.addonId ?? nativeOwner?.addonId ?? null;
+	if (!hubLocal && !nativeOwner) return null;
+	const sections = [{
+		id: "device-identity",
+		title: "Identity",
+		tab: "general",
+		order: 0,
+		fields: [
+			{
+				type: "text",
+				key: "_deviceId",
+				label: "Device ID",
+				readonlyField: true,
+				value: String(deviceId)
+			},
+			{
+				type: "text",
+				key: "_stableId",
+				label: "Stable ID",
+				readonlyField: true,
+				value: stableId ?? ""
+			},
+			{
+				type: "text",
+				key: "_addonId",
+				label: "Driver",
+				readonlyField: true,
+				value: addonId ?? "unknown"
+			},
+			...hubLocal ? [{
+				type: "text",
+				key: "_type",
+				label: "Type",
+				readonlyField: true,
+				value: hubLocal.device.type
+			}, {
+				type: "text",
+				key: "_online",
+				label: "Online",
+				readonlyField: true,
+				value: hubLocal.device.online ? "yes" : "no"
+			}] : []
+		]
+	}];
+	const driverResult = await resolveDriverConfigSchema(deps, deviceId, hubLocal);
+	if (driverResult.status === "ok") for (const section of driverResult.schema.sections) sections.push({
+		id: section.id,
+		title: section.title,
+		tab: section.tab ?? "general",
+		order: section.order ?? 1,
+		fields: [...section.fields],
+		...section.description !== void 0 ? { description: section.description } : {},
+		...section.columns !== void 0 ? { columns: section.columns } : {}
+	});
+	else if (driverResult.status === "unavailable") sections.push({
+		id: "driver-settings-unavailable",
+		title: "Driver Settings",
+		tab: "general",
+		order: 1,
+		fields: [{
+			type: "info",
+			key: "driver-settings-unavailable-notice",
+			label: "Temporarily unavailable",
+			content: "Driver settings are temporarily unavailable — the addon may be restarting. Refresh the page in a moment.",
+			variant: "warning"
+		}]
+	});
 	return {
-		id: deviceId,
-		stableId,
-		addonId: aid,
-		type: m.type,
-		name: m.name,
-		location: m.location ?? null,
-		disabled: m.disabled ?? false,
-		parentDeviceId: m.parentDeviceId,
-		role: toDeviceRole(m.role),
-		online: pctx.host.resolveDeviceOnline(deviceId, true),
-		probed: pctx.host.resolveDeviceProbed(deviceId),
-		features: persistedFeatures(m.features),
-		isCamera: false,
-		config: persistedConfig ?? {},
-		metadata,
-		...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
-		...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
-		...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
-		...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
-		...m.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
-		...m.display !== void 0 ? { display: m.display } : {},
-		...sourceInfoGetDevice !== void 0 ? { sourceInfo: sourceInfoGetDevice } : {}
+		sections,
+		...driverResult.status === "ok" && driverResult.schema.tabs ? { tabs: [...driverResult.schema.tabs] } : {}
 	};
 }
-async function getChildren(pctx, input) {
-	const { parentDeviceId } = input;
-	let ownerAddonId = null;
-	if (pctx.registry) {
-		if (pctx.registry.getById(parentDeviceId)) ownerAddonId = pctx.registry.getAddonId(parentDeviceId);
-	}
-	if (!ownerAddonId) {
-		const persisted = await pctx.metaStore.resolvePersistedById(parentDeviceId);
-		if (!persisted) return [];
-		ownerAddonId = persisted.addonId;
-	}
-	const results = [];
-	const seen = /* @__PURE__ */ new Set();
-	const [index, meta, metadataMap] = await Promise.all([
-		pctx.metaStore.readIndex(),
-		pctx.metaStore.readMeta(),
-		pctx.metaStore.readMetadataMap()
-	]);
-	if (pctx.registry) {
-		const liveChildren = pctx.registry.getChildren(parentDeviceId);
-		for (const device of liveChildren) {
-			const key = String(device.id);
-			const metadata = metadataMap[key] ?? null;
-			const metaRow = meta[key] ?? null;
-			results.push(toDeviceInfo(ownerAddonId, device, metadata, metaRow));
-			seen.add(key);
-		}
-	}
-	const ownerMetaByStableId = /* @__PURE__ */ new Map();
-	for (const m of Object.values(meta)) if (m.addonId === ownerAddonId) ownerMetaByStableId.set(m.stableId, m);
-	const persistedChildren = (index[ownerAddonId] ?? []).filter((sid) => ownerMetaByStableId.get(sid)?.parentDeviceId === parentDeviceId);
-	for (const childStableId of persistedChildren) {
-		const m = ownerMetaByStableId.get(childStableId);
-		const key = String(m.id);
-		if (seen.has(key)) continue;
-		const persistedConfig = await pctx.settings.readDeviceStore(m.id);
-		const metadata = metadataMap[key] ?? null;
-		const sourceInfoChild = buildSourceInfoFromConfig(persistedConfig ?? {}, childStableId, ownerAddonId);
-		results.push({
-			id: m.id,
-			stableId: childStableId,
-			addonId: ownerAddonId,
-			type: m.type,
-			name: m.name,
-			location: m.location ?? null,
-			disabled: m.disabled ?? false,
-			parentDeviceId,
-			role: toDeviceRole(m.role),
-			online: pctx.host.resolveDeviceOnline(m.id, pctx.registry !== null),
-			probed: pctx.host.resolveDeviceProbed(m.id),
-			features: persistedFeatures(m.features),
-			isCamera: false,
-			config: persistedConfig ?? {},
-			metadata,
-			...m.integrationId !== void 0 ? { integrationId: m.integrationId } : {},
-			...m.linkDeviceId !== void 0 ? { linkDeviceId: m.linkDeviceId } : {},
-			...m.primaryChildEntityId !== void 0 ? { primaryChildEntityId: m.primaryChildEntityId } : {},
-			...m.childLayout !== void 0 ? { childLayout: m.childLayout } : {},
-			...m.deviceLinks !== void 0 ? { deviceLinks: m.deviceLinks } : {},
-			...m.display !== void 0 ? { display: m.display } : {},
-			...sourceInfoChild !== void 0 ? { sourceInfo: sourceInfoChild } : {}
-		});
-	}
-	return results;
-}
-async function getStreamSources(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) {
-			if (!isCameraDevice(found.device)) return [];
-			return (await found.device.getStreamSources()).map((s) => ({
-				id: s.id,
-				label: s.label,
-				protocol: s.protocol,
-				url: s.url,
-				resolution: s.resolution,
-				fps: s.fps,
-				bitrate: s.bitrate,
-				codec: s.codec,
-				profileHint: s.profileHint
-			}));
-		}
-	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
-	return (await pctx.requireDeviceOps(deviceId).getStreamSources({ deviceId })).map((s) => ({ ...s }));
-}
-async function getConfigSchema(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) return found.device.config.entries().map((entry) => ({
-			key: entry.key,
-			value: entry.value,
-			...entry.description !== void 0 ? { description: entry.description } : {}
-		}));
-	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
-	return (await pctx.requireDeviceOps(deviceId).getConfigEntries({ deviceId })).map((e) => ({ ...e }));
-}
-async function getSettingsSchema(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) return found.device.getSettingsUISchema();
-	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) return null;
-	return await pctx.requireDeviceOps(deviceId).getSettingsSchema({ deviceId }) ?? null;
+/**
+* Lookup the native owner for `device-ops` on `deviceId` — the native-cap
+* registry (hub-local and remote) is keyed by numeric id.
+*/
+function resolveNativeDeviceOwner(deps, deviceId) {
+	const local = deps.capabilityRegistry?.getNativeAddonId("device-ops", deviceId) ?? null;
+	if (local) return {
+		addonId: local,
+		nodeId: deps.ctx.kernel.localNodeId ?? "hub"
+	};
+	const remote = deps.remoteNativeCaps.get(deviceId)?.get("device-ops") ?? resolveRemoteNativeCapFromRegistry(deps.bindingsDeps, "device-ops", deviceId);
+	return remote ? {
+		addonId: remote.addonId,
+		nodeId: remote.nodeId
+	} : null;
 }
-async function updateConfig(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) {
-			await found.device.config.setAll(input.values);
-			return { success: true };
-		}
+/**
+* Aggregate `status` across every registered cap for a device.
+*
+* Walks the supplied cap list (or `CAP_NAMES_WITH_STATUS` when
+* omitted), looks up a native provider per cap via the capability
+* registry, calls `provider.getStatus({ deviceId })`, and validates
+* the return against the cap's own `status.schema`. Validation
+* failures log a warning and yield `null` for that cap so the
+* overall aggregate stays usable — a single misbehaving provider
+* must not blank out a device's entire status view.
+*
+* Returned shape is `Record<capName, unknown | null>`; the client-
+* side hook tightens this to `CapStatusTypeMap` via the generated
+* `cap-status-types.ts`.
+*/
+async function getDeviceStatusAggregate(deps, input) {
+	const capNames = input.caps ?? CAP_NAMES_WITH_STATUS;
+	const registry = deps.capabilityRegistry;
+	const out = {};
+	if (!registry) {
+		for (const name of capNames) out[name] = null;
+		return out;
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
-	await pctx.requireDeviceOps(deviceId).setConfig({
-		deviceId,
-		values: input.values
-	});
-	return { success: true };
-}
-async function enable(pctx, input) {
-	await pctx.provider.setDisabled({
-		deviceId: input.deviceId,
-		disabled: false
-	});
-	return { success: true };
-}
-async function disable(pctx, input) {
-	await pctx.provider.setDisabled({
-		deviceId: input.deviceId,
-		disabled: true
-	});
-	return { success: true };
-}
-async function remove(pctx, input) {
-	const { deviceId } = input;
-	const removeOne = async (id) => {
-		if (pctx.registry) {
-			const live = resolveDeviceById(pctx.registry, id);
-			if (live) {
-				const deviceName = live.device.name;
-				await live.device.removeDevice();
-				pctx.registry.remove(id);
-				await pctx.provider.removeDevice({ deviceId: id });
-				pctx.host.ctx.logger.info("removed hub-local device", { tags: {
-					deviceId: id,
-					deviceName
-				} });
+	await Promise.all(capNames.map(async (capName) => {
+		try {
+			const def = registry.getDefinition(capName);
+			if (!def?.status) {
+				out[capName] = null;
+				return;
+			}
+			const provider = registry.getProviderForDevice(capName, input.deviceId);
+			if (!provider || typeof provider.getStatus !== "function") {
+				out[capName] = null;
 				return;
 			}
-		}
-		const persisted = await pctx.metaStore.resolvePersistedById(id);
-		if (!persisted) return;
-		const { meta: persistedMeta } = persisted;
-		try {
-			await pctx.requireDeviceOps(id).removeDevice({ deviceId: id });
+			const raw = await provider.getStatus({ deviceId: input.deviceId });
+			if (raw == null) {
+				out[capName] = null;
+				return;
+			}
+			const parsed = def.status.schema.safeParse(raw);
+			if (!parsed.success) {
+				deps.ctx.logger.warn("getDeviceStatusAggregate: provider returned invalid status, dropping", {
+					tags: { deviceId: input.deviceId },
+					meta: {
+						capName,
+						issues: parsed.error.issues.slice(0, 3)
+					}
+				});
+				out[capName] = null;
+				return;
+			}
+			out[capName] = parsed.data;
 		} catch (err) {
-			pctx.host.ctx.logger.warn("remove via device-ops failed — clearing persistence anyway", {
-				tags: {
-					deviceId: id,
-					deviceName: persistedMeta.name
-				},
-				meta: { error: errMsg(err) }
+			deps.ctx.logger.warn("getDeviceStatusAggregate: provider threw, dropping", {
+				tags: { deviceId: input.deviceId },
+				meta: {
+					capName,
+					error: errMsg(err)
+				}
 			});
+			out[capName] = null;
 		}
-		await pctx.provider.removeDevice({ deviceId: id });
-	};
-	const removeCascade = async (id) => {
-		for (const childId of await pctx.metaStore.directChildIds(id)) await removeCascade(childId);
-		await removeOne(id);
-	};
-	await removeCascade(deviceId);
-	return { success: true };
+	}));
+	return out;
 }
 /**
-* Cascade-delete every top-level device whose `integrationId`
-* matches. Enumerates a SNAPSHOT of the meta map so concurrent
-* removals don't clobber each other. Only top-level parents are
-* enumerated — children cascade via the per-parent `removeCascade`
-* inside the delegated `remove` call. Idempotent: devices with no
-* `integrationId` never match.
+* Return the driver-specific device-settings contribution. Hub-local
+* devices call `getSettingsUISchema()` directly; forked-worker devices
+* go through the `device-ops.getSettingsSchema` cap method on the
+* numeric-id-keyed native registry.
+*
+* Returns a discriminated result so callers can distinguish three states:
+*   'ok'          – schema obtained successfully
+*   'none'        – driver genuinely has no settings schema
+*   'unavailable' – worker was unreachable after retries (transient)
 */
-async function removeByIntegration(pctx, input) {
-	const { integrationId } = input;
-	const meta = await pctx.metaStore.readMeta();
-	const parentKeys = Object.keys(meta).filter((key) => {
-		const m = meta[key];
-		return m !== void 0 && m.integrationId === integrationId && m.parentDeviceId === null;
-	});
-	let removed = 0;
-	for (const _key of parentKeys) {
-		const m = meta[_key];
-		if (!m) continue;
-		await pctx.provider.remove({ deviceId: m.id });
-		removed++;
-	}
-	return { removed };
-}
-async function getStreamProfileMap(pctx, input) {
-	if (!pctx.registry) return {};
-	const found = resolveDeviceById(pctx.registry, input.deviceId);
-	if (!found) return {};
-	const storedMap = found.device.config.entries().find((e) => e.key === "_profileMap")?.value;
-	if (storedMap !== void 0 && typeof storedMap === "object" && storedMap !== null) return storedMap;
-	if (!isCameraDevice(found.device)) return {};
-	const sources = await found.device.getStreamSources();
-	const profileMap = {};
-	for (const s of sources) if (s.profileHint && s.id) profileMap[s.profileHint] = s.id;
-	return profileMap;
-}
-async function setStreamProfileMap(pctx, input) {
-	const { deviceId } = input;
-	if (pctx.registry) {
-		const found = resolveDeviceById(pctx.registry, deviceId);
-		if (found) {
-			await found.device.config.setAll({ _profileMap: input.profileMap });
-			return { success: true };
-		}
+async function resolveDriverConfigSchema(deps, deviceId, hubLocal) {
+	if (hubLocal) {
+		const schema = hubLocal.device.getSettingsUISchema();
+		return schema.sections.length === 0 ? { status: "none" } : {
+			status: "ok",
+			schema: toWireShape(schema)
+		};
 	}
-	if (!await pctx.metaStore.resolvePersistedById(deviceId)) throw new Error(`[device-manager] Device with id ${deviceId} not found`);
-	await pctx.requireDeviceOps(deviceId).setConfig({
-		deviceId,
-		values: { _profileMap: input.profileMap }
-	});
-	return { success: true };
-}
-async function probeStreams(pctx, input) {
-	const streamProbe = pctx.host.ctx.kernel.streamProbe;
-	if (!streamProbe) return [];
-	const sources = await pctx.provider.getStreamSources({ deviceId: input.deviceId });
-	const results = [];
-	for (const s of sources) {
-		if (!s.url) continue;
+	const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+	if (!ops) return { status: "none" };
+	const MAX_RETRIES = 2;
+	const RETRY_DELAY_MS = 750;
+	let lastErr;
+	for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+		if (attempt > 0) await sleep(RETRY_DELAY_MS);
 		try {
-			const metadata = await streamProbe.probe(s.url, { force: true });
-			results.push({
-				streamId: s.id,
-				width: metadata.width,
-				height: metadata.height,
-				codec: metadata.codec,
-				fps: metadata.fps,
-				bitrateKbps: metadata.bitrateKbps
-			});
+			const schema = await ops.getSettingsSchema({ deviceId });
+			if (!schema) return { status: "none" };
+			const wire = schema;
+			return wire.sections.length === 0 ? { status: "none" } : {
+				status: "ok",
+				schema: toWireShape(wire)
+			};
 		} catch (err) {
-			pctx.host.ctx.logger.debug("streamProbe.probe failed — returning placeholder", { meta: {
-				deviceId: input.deviceId,
-				streamId: s.id,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-			results.push({ streamId: s.id });
+			lastErr = err;
+			if (!isTransientMoleculerError(err)) break;
+			if (attempt < MAX_RETRIES) deps.ctx.logger.debug("cross-process getSettingsSchema transient failure, retrying", {
+				tags: { deviceId },
+				meta: {
+					attempt: attempt + 1,
+					maxRetries: MAX_RETRIES,
+					error: errMsg(err)
+				}
+			});
 		}
 	}
-	return results;
-}
-async function discoverDevices(pctx, input) {
-	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device discovery`);
-	return (await dp.discoverDevices({})).map((d) => ({
-		stableId: d.stableId,
-		type: d.type,
-		suggestedName: d.suggestedName,
-		prefilledConfig: d.prefilledConfig
-	}));
+	const msg = errMsg(lastErr);
+	deps.ctx.logger.warn("cross-process getSettingsSchema failed after retries — driver settings temporarily unavailable", {
+		tags: { deviceId },
+		meta: { error: msg }
+	});
+	return { status: "unavailable" };
 }
-async function adoptDevice(pctx, input) {
-	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsDiscovery({})) throw new Error(`Addon "${input.addonId}" does not support device adoption`);
-	const summary = await dp.adoptDiscoveredDevice({ candidate: input.candidate });
-	if (input.integrationId !== void 0) try {
-		await pctx.stampIntegrationId(summary.id, input.integrationId);
-	} catch (err) {
-		pctx.host.ctx.logger.warn("adoptDevice: integrationId stamp failed (device adopted)", {
-			tags: {
-				deviceId: summary.id,
-				integrationId: input.integrationId
-			},
-			meta: { error: errMsg(err) }
+/**
+* Route a `derived-form` device-config cap's flat form patch to whichever
+* mutation the bound provider actually exposes — inspecting the
+* provider's method surface, not the cap name. `setSettings` fires once
+* with the parsed flat patch; `setProfile` fans the patch out per-profile
+* via the registered builderId reducer.
+*/
+async function dispatchDerivedFormSave(builderId, deviceId, patch, dcProvider, capName) {
+	if (typeof dcProvider.setSettings === "function") {
+		const settings = parseDerivedFormSettingsPatch(builderId, patch);
+		await dcProvider.setSettings({
+			deviceId,
+			settings
 		});
+		return;
 	}
-	return summary;
-}
-async function getCreationSchema(pctx, input) {
-	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsManualCreation({})) return null;
-	return await dp.getChildCreationSchema({ type: input.type }) ?? null;
+	if (typeof dcProvider.setProfile === "function") {
+		const setProfile = dcProvider.setProfile;
+		await applyDerivedFormProfilePatch(builderId, patch, (profile, profilePatch) => setProfile({
+			deviceId,
+			profile,
+			patch: profilePatch
+		}));
+		return;
+	}
+	throw new Error(`[device-manager] device-config cap "${capName}" provider exposes neither setSettings nor setProfile`);
 }
-async function createDevice(pctx, input) {
-	const dp = await pctx.host.requireDeviceProvider(input.addonId);
-	if (!await dp.supportsManualCreation({})) throw new Error(`Addon "${input.addonId}" does not support manual device creation`);
-	const summary = await dp.createDevice({
-		type: input.type,
-		config: input.config
-	});
-	if (input.integrationId !== void 0) try {
-		await pctx.stampIntegrationId(summary.id, input.integrationId);
-	} catch (err) {
-		pctx.host.ctx.logger.warn("createDevice: integrationId stamp failed (device created)", {
-			tags: {
-				deviceId: summary.id,
-				integrationId: input.integrationId
-			},
-			meta: { error: errMsg(err) }
+async function updateDeviceField(deps, input) {
+	if (input.writerCapName === "device-manager") {
+		if (input.key === "_linkedDevicesMode" || input.key === "_linkedDeviceIds") {
+			const settings = deps.ctx.settings;
+			if (!settings) throw new Error("[device-manager] linked-devices save requires the settings surface");
+			await applyLinkedDevicesPatch({ settings }, input.deviceId, { [input.key]: input.value });
+			return { success: true };
+		}
+		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+		const found = hubRegistry ? resolveDeviceById(hubRegistry, input.deviceId) : null;
+		if (found) {
+			await found.device.applySettingsPatch({ [input.key]: input.value });
+			return { success: true };
+		}
+		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", input.deviceId);
+		if (!ops) throw new Error(`[device-manager] device "${input.deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+		await ops.setConfig({
+			deviceId: input.deviceId,
+			values: { [input.key]: input.value }
 		});
+		return { success: true };
+	}
+	const registry = deps.capabilityRegistry;
+	if (!registry) throw new Error("[device-manager] updateDeviceField requires capability registry — unavailable on this node");
+	const def = registry.getDefinition(input.writerCapName);
+	if (isDeviceConfigCap(def)) {
+		if (def.deviceConfig.ui.kind === "widget") return { success: true };
+		const dcProvider = registry.getProviderForDevice(input.writerCapName, input.deviceId);
+		if (!dcProvider) throw new Error(`[device-manager] no provider for device-config cap "${input.writerCapName}" on device ${input.deviceId}`);
+		await dispatchDerivedFormSave(def.deviceConfig.ui.builderId, input.deviceId, { [input.key]: input.value }, dcProvider, input.writerCapName);
+		return { success: true };
 	}
-	return summary;
-}
-async function testCreationField(pctx, input) {
-	return (await pctx.host.requireDeviceProvider(input.addonId)).testCreationField({
-		type: input.type,
-		key: input.key,
-		value: input.value,
-		...input.formValues !== void 0 ? { formValues: input.formValues } : {}
+	if (!def?.exposesDeviceSettings) throw new Error(`[device-manager] cap "${input.writerCapName}" does not expose device settings`);
+	await resolveContributionProvider(registry, def, input.writerCapName, input.writerAddonId, input.deviceId).applyDeviceSettingsPatch({
+		deviceId: input.deviceId,
+		patch: { [input.key]: input.value }
 	});
+	return { success: true };
 }
-async function adoptionListCandidates(pctx, input) {
-	const { addonId, ...rest } = input;
-	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).listCandidates(rest);
-}
-async function adoptionRefresh(pctx, input) {
-	const { addonId, integrationId } = input;
-	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).refresh({ integrationId });
-}
-async function adoptionAdopt(pctx, input) {
-	const { addonId, ...rest } = input;
-	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).adopt(rest);
+/**
+* Dispatch a device custom action. Hub-local devices run it directly;
+* forked/remote devices route through the `device-ops` native cap
+* (`runAction`) — the same hub-local-then-device-ops fan-out that
+* `updateDeviceField` uses for `applySettingsPatch`.
+*/
+async function dispatchDeviceAction(deps, deviceId, action, input) {
+	const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+	const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+	if (found) return found.device.runDeviceAction(action, input);
+	const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+	if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found for runDeviceAction (no hub-local entry, no device-ops native provider)`);
+	return ops.runAction({
+		deviceId,
+		action,
+		input
+	});
 }
-async function adoptionRelease(pctx, input) {
-	const { addonId, ...rest } = input;
-	return (await pctx.host.requireDeviceAdoptionProvider(addonId)).release(rest);
+/**
+* Resolve the `DeviceSettingsContribution` provider that owns a tagged
+* field. The `writerAddonId` on a tagged field equals `entry.providerAddonId`
+* from the binding that produced it — for `kind:'wrapped'` entries, that is
+* the wrapper addon id (e.g. 'snapshot-addon'); for native-only entries,
+* the system addon id.
+*
+* Resolution order (Bug-3 fix):
+*  1. `getProviderByAddon(capName, writerAddonId)` — resolves the
+*     system-registered provider by the addon id from the tagged field.
+*     For wrapper bindings (snapshot, motion-detection, etc.) this directly
+*     returns the wrapper provider, bypassing the native-first resolution
+*     order of `getProviderForDevice` that caused "method not found".
+*  2. `getSingleton(capName)` — fallback for stale/mismatched writerAddonIds.
+*     The active singleton handles the contribution even if the addonId
+*     stored in the field is out of date (e.g. after an addon rename).
+*
+* `getProviderForDevice` is intentionally NOT used here: it returns the
+* per-device native first when present (e.g. Reolink/ONVIF), and the native
+* does NOT implement contribution methods — the root cause of Bug-3.
+*/
+function resolveContributionProvider(registry, _def, writerCapName, writerAddonId, deviceId) {
+	const byAddon = registry.getProviderByAddon(writerCapName, writerAddonId);
+	if (byAddon) return byAddon;
+	const singleton = registry.getSingleton(writerCapName);
+	if (singleton) return singleton;
+	throw new Error(`[device-manager] no provider for cap "${writerCapName}" (addon "${writerAddonId}") on device ${deviceId}`);
 }
-async function adoptionResync(pctx, input) {
-	const { camDeviceId, resetToSource } = input;
-	let owningAddonId = pctx.registry?.getAddonId(camDeviceId) ?? null;
-	if (!owningAddonId) owningAddonId = (await pctx.metaStore.resolvePersistedById(camDeviceId))?.addonId ?? null;
-	if (!owningAddonId) throw new Error(`adoptionResync: device ${camDeviceId} not found`);
-	let removedChildren = 0;
-	if (resetToSource === true) {
-		const childIds = await pctx.metaStore.directChildIds(camDeviceId);
-		for (const childId of childIds) {
-			await pctx.provider.remove({ deviceId: childId });
-			removedChildren += 1;
-		}
-		pctx.host.ctx.logger.info("resetToSource purge before resync", { tags: {
-			deviceId: camDeviceId,
-			removedChildren
-		} });
+/**
+* Batched counterpart of `updateDeviceField`. Groups changes by
+* `(writerCapName, writerAddonId)` so each contributor receives a
+* single `applyDeviceSettingsPatch` with all of its updates merged —
+* avoids N round-trips for simultaneous edits in the same save.
+*
+* Per-provider failures are captured in the `failures[]` output so the
+* admin UI can highlight which sections didn't persist; a failure on
+* one provider does NOT abort the others.
+*/
+async function updateDeviceFieldsBatch(deps, input) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const change of input.changes) {
+		const key = `${change.writerCapName}::${change.writerAddonId}`;
+		const existing = groups.get(key);
+		if (existing) existing.patch[change.key] = change.value;
+		else groups.set(key, {
+			writerCapName: change.writerCapName,
+			writerAddonId: change.writerAddonId,
+			patch: { [change.key]: change.value }
+		});
+	}
+	const failures = [];
+	for (const group of groups.values()) try {
+		await applyGroupPatch(deps, input.deviceId, group);
+	} catch (err) {
+		failures.push({
+			writerCapName: group.writerCapName,
+			writerAddonId: group.writerAddonId,
+			error: err instanceof Error ? err.message : String(err)
+		});
 	}
 	return {
-		...await (await pctx.host.requireDeviceAdoptionProvider(owningAddonId)).resync({
-			camDeviceId,
-			resetToSource
-		}),
-		removedChildren
+		success: true,
+		failures
 	};
 }
-async function testField(pctx, input) {
-	const { deviceId } = input;
-	let owningAddonId = null;
-	if (pctx.registry) owningAddonId = pctx.registry.getAddonId(deviceId);
-	if (!owningAddonId) owningAddonId = (await pctx.metaStore.resolvePersistedById(deviceId))?.addonId ?? null;
-	if (!owningAddonId) throw new Error(`Device with id ${deviceId} not found`);
-	const dp = await pctx.host.waitDeviceProvider(owningAddonId);
-	if (!dp) return {
-		status: "ok",
-		labels: [],
-		error: void 0
-	};
-	if (typeof dp.testCreationField !== "function") return {
-		status: "ok",
-		labels: [],
-		error: void 0
-	};
-	return dp.testCreationField({
-		type: DeviceType.Camera,
-		key: input.key,
-		value: input.value
+/** Apply a single grouped patch to the appropriate provider. Mirrors
+* `updateDeviceField` routing (special-case device-manager, else
+* registry lookup). Used by `updateDeviceFieldsBatch`. */
+async function applyGroupPatch(deps, deviceId, group) {
+	if (group.writerCapName === "device-manager") {
+		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
+		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
+		if (found) {
+			await found.device.applySettingsPatch(group.patch);
+			return;
+		}
+		const ops = deps.capabilityRegistry?.getNativeProvider("device-ops", deviceId);
+		if (!ops) throw new Error(`[device-manager] device "${deviceId}" not found (no hub-local entry, no device-ops native provider)`);
+		await ops.setConfig({
+			deviceId,
+			values: group.patch
+		});
+		return;
+	}
+	const registry = deps.capabilityRegistry;
+	if (!registry) throw new Error("[device-manager] capability registry unavailable");
+	const def = registry.getDefinition(group.writerCapName);
+	if (isDeviceConfigCap(def)) {
+		if (def.deviceConfig.ui.kind === "widget") return;
+		const dcProvider = registry.getProviderForDevice(group.writerCapName, deviceId);
+		if (!dcProvider) throw new Error(`[device-manager] no provider for device-config cap "${group.writerCapName}" on device ${deviceId}`);
+		await dispatchDerivedFormSave(def.deviceConfig.ui.builderId, deviceId, group.patch, dcProvider, group.writerCapName);
+		return;
+	}
+	if (!def?.exposesDeviceSettings) throw new Error(`[device-manager] cap "${group.writerCapName}" does not expose device settings`);
+	await resolveContributionProvider(registry, def, group.writerCapName, group.writerAddonId, deviceId).applyDeviceSettingsPatch({
+		deviceId,
+		patch: group.patch
 	});
 }
-//#endregion
-//#region src/builtins/device-manager/device-linked-devices.ts
-/** Reserved device-config keys (cf. `_profileMap`). */
-var LINKED_MODE_CONFIG_KEY = "_linkedDevicesMode";
-var LINKED_IDS_CONFIG_KEY = "_linkedDeviceIds";
-/** Parse the two reserved keys out of a device-config blob. Tolerant:
-*  ids may arrive as numbers or numeric strings (the multiselect field
-*  stores string option values); anything else is dropped. */
-function parseLinkedDevicesConfig(blob) {
-	const mode = blob["_linkedDevicesMode"] === "manual" ? "manual" : "auto";
-	const rawIds = blob[LINKED_IDS_CONFIG_KEY];
-	const manualIds = [];
-	if (Array.isArray(rawIds)) for (const v of rawIds) {
-		const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
-		if (Number.isInteger(n) && !manualIds.includes(n)) manualIds.push(n);
-	}
-	return {
-		mode,
-		manualIds
-	};
+async function listWrappersForCap(deps, input) {
+	return [...deps.capabilityRegistry?.getWrappersForCap(input.capName) ?? []];
 }
-/**
-* Pure resolution core: children ∪ (auto → same-location | manual → list),
-* minus self, deduped. Order: children first, then mode additions.
-*/
-function resolveLinkedDeviceIds(params) {
-	const { selfId, selfLocation, config, candidates } = params;
-	const ids = /* @__PURE__ */ new Set();
-	for (const c of candidates) if (c.parentDeviceId === selfId) ids.add(c.id);
-	if (config.mode === "auto") {
-		if (selfLocation !== null && selfLocation.length > 0) {
-			for (const c of candidates) if (c.location === selfLocation) ids.add(c.id);
+async function listBindableCapsForDeviceType(deps, input) {
+	const registry = deps.capabilityRegistry;
+	if (!registry) return [];
+	return registry.listDeviceScopedCapsForType(input.deviceType).map((capName) => ({
+		capName,
+		wrappers: [...registry.getWrappersForCap(capName)]
+	}));
+}
+async function setWrapperActive(deps, input) {
+	const storeKey = String(input.deviceId);
+	const store = await readBindingsStore(deps.bindingsDeps);
+	const perDevice = { ...store.deviceBindings[storeKey] };
+	if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
+	else perDevice[input.capName] = { wrapperAddonId: null };
+	const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
+		...store.deviceBindings,
+		[storeKey]: perDevice
+	} : (() => {
+		const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+		return rest;
+	})();
+	await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
+	deps.ctx.eventBus.emit({
+		id: randomUUID(),
+		timestamp: /* @__PURE__ */ new Date(),
+		source: {
+			type: "addon",
+			id: deps.ctx.id
+		},
+		category: EventCategory.DeviceBindingsChanged,
+		data: {
+			deviceId: input.deviceId,
+			capName: input.capName,
+			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
+			addonId: input.wrapperAddonId,
+			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
 		}
-	} else {
-		const known = new Set(candidates.map((c) => c.id));
-		for (const id of config.manualIds) if (known.has(id)) ids.add(id);
-	}
-	ids.delete(selfId);
-	return [...ids];
-}
-/** Cap implementation of `getLinkedDevices`. */
-async function getLinkedDevices(pctx, input) {
-	const { deviceId } = input;
-	const [all, blob] = await Promise.all([listAll(pctx, {}), pctx.settings.readDeviceStore(deviceId)]);
-	const config = parseLinkedDevicesConfig(blob);
-	const byId = new Map(all.map((d) => [d.id, d]));
-	const ids = resolveLinkedDeviceIds({
-		selfId: deviceId,
-		selfLocation: byId.get(deviceId)?.location ?? null,
-		config,
-		candidates: all
 	});
-	const devices = [];
-	for (const id of ids) {
-		const d = byId.get(id);
-		if (!d) continue;
-		devices.push({
-			deviceId: d.id,
-			name: d.name,
-			location: d.location,
-			features: d.features
-		});
-	}
-	return {
-		mode: config.mode,
-		devices
-	};
 }
 /**
-* "Linked devices" settings section for a CAMERA (null for every other
-* device type — the association is camera-anchored). Contributed through
-* `collectSystemDeviceContributions`; saves route through the existing
-* `writerCapName: 'device-manager'` path into the device config blob.
+* Build the wireable-cap entry for one capability definition: the status
+* schema's scalar leaf fields plus — for an item-array cap
+* (`status.itemArray`) — the per-item fields tagged `item: true` (a link
+* targeting one must carry a `target.itemKey`) and the cap-level `itemArray`
+* descriptor so the UI can address items. Returns null when the cap exposes
+* nothing wireable (no status schema / no leaf fields).
 */
-async function buildLinkedDevicesContribution(pctx, deviceId) {
-	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-	if (!persisted || persisted.meta.type !== DeviceType.Camera) return null;
-	const [all, blob] = await Promise.all([listAll(pctx, {}), pctx.settings.readDeviceStore(deviceId)]);
-	const config = parseLinkedDevicesConfig(blob);
-	const options = all.filter((d) => d.id !== deviceId).map((d) => ({
-		value: String(d.id),
-		label: d.location !== null ? `${d.name} (${d.location})` : d.name
+function wireableEntryForDef(capName, def) {
+	const status = def.status;
+	const schema = status?.schema;
+	if (!schema) return null;
+	const itemArray = status.itemArray;
+	const fields = [...enumerateSchemaFields(schema), ...itemArray ? enumerateItemArrayFields(itemArray) : []].map((f) => ({
+		path: f.path,
+		kind: f.kind,
+		...f.enumValues !== void 0 ? { enumValues: [...f.enumValues] } : {},
+		...f.item === true ? { item: true } : {}
 	}));
-	return { sections: [{
-		id: "linked-devices",
-		title: "Linked devices",
-		description: "Companion devices associated with this camera. Device-tree children are always linked; auto mode also links every device sharing the camera location, manual mode links the picked list instead.",
-		order: 70,
-		fields: [{
-			type: "select",
-			key: LINKED_MODE_CONFIG_KEY,
-			label: "Link mode",
-			description: "Auto: children + same-location devices. Manual: children + the list below.",
-			options: [{
-				value: "auto",
-				label: "Auto (location-based)"
-			}, {
-				value: "manual",
-				label: "Manual"
-			}],
-			value: config.mode
-		}, {
-			type: "multiselect",
-			key: LINKED_IDS_CONFIG_KEY,
-			label: "Manually linked devices",
-			description: "Used in manual mode (children stay linked regardless).",
-			options,
-			value: config.manualIds.map(String)
-		}]
-	}] };
+	if (fields.length === 0) return null;
+	return {
+		cap: capName,
+		fields,
+		...itemArray ? { itemArray: {
+			path: itemArray.path,
+			keyField: itemArray.keyField
+		} } : {}
+	};
 }
 /**
-* Direct `applyDeviceSettingsPatch` normalization for the two reserved keys.
-* The admin-ui save path reaches the device config blob via the
-* `writerCapName: 'device-manager'` routing (never this method), but the cap
-* contract includes the method — keep it correct for direct callers.
+* Per-device wireable-field catalog — the domain status fields a device's
+* bound caps expose, for the operator's cross-device wiring UI. Binding-driven:
+* walks `getBindings(deviceId)`, skips wrapper caps (their status schemas are
+* internal book-keeping, not wireable domain data), and enumerates each cap's
+* status schema leaf fields (per-item fields included for item-array caps).
+*
+* `includeSynthesizable: true` (TARGET pickers only) additionally unions in
+* UNBOUND device-scoped caps that declare `status.empty` (the synthesize-target
+* marker) and whose `deviceTypes` admit this device's persisted type — so the
+* FIRST link to a synthesize-only cap (consumables on an HA vacuum) can be
+* authored before any binding exists. Default (absent/false) behavior is
+* byte-identical to the binding-driven catalog.
 */
-async function applyLinkedDevicesPatch(pctx, deviceId, patch) {
-	const next = { ...await pctx.settings.readDeviceStore(deviceId) };
-	if ("_linkedDevicesMode" in patch) next[LINKED_MODE_CONFIG_KEY] = patch["_linkedDevicesMode"] === "manual" ? "manual" : "auto";
-	if ("_linkedDeviceIds" in patch) next[LINKED_IDS_CONFIG_KEY] = [...parseLinkedDevicesConfig({ [LINKED_IDS_CONFIG_KEY]: patch[LINKED_IDS_CONFIG_KEY] }).manualIds];
-	await pctx.settings.writeDeviceStore(deviceId, next);
-	return { success: true };
+async function getWireableFields(deps, input) {
+	const { deviceId } = input;
+	const reg = deps.capabilityRegistry;
+	if (!reg) return { caps: [] };
+	const { entries } = await getBindings(deps.bindingsDeps, { deviceId });
+	const seen = /* @__PURE__ */ new Set();
+	const caps = [];
+	for (const entry of entries) {
+		if (seen.has(entry.capName)) continue;
+		seen.add(entry.capName);
+		const def = reg.getDefinition(entry.capName);
+		if (!def || def.kind === "wrapper") continue;
+		const wireable = wireableEntryForDef(entry.capName, def);
+		if (wireable) caps.push(wireable);
+	}
+	if (input.includeSynthesizable === true) {
+		const deviceType = ((await deps.ctx.settings.readAddonStore()).deviceMeta ?? {})[String(deviceId)]?.type;
+		if (deviceType !== void 0) for (const def of ALL_CAPABILITY_DEFINITIONS) {
+			if (seen.has(def.name)) continue;
+			if (def.scope !== "device" || def.kind === "wrapper") continue;
+			if (def.status?.empty === void 0) continue;
+			if (def.deviceTypes && !def.deviceTypes.some((t) => t === deviceType)) continue;
+			seen.add(def.name);
+			const wireable = wireableEntryForDef(def.name, def);
+			if (wireable) caps.push(wireable);
+		}
+	}
+	return { caps };
 }
 //#endregion
+//#region src/builtins/device-manager/device-event-propagator.ts
+/**
+* Walks the parent chain for every device-sourced event and re-emits a
+* copy on each ancestor scope with `via[]` populated.
+*
+* Design goals:
+*   - Transparent: drivers emit once on their own device scope; the
+*     framework handles fan-out. Zero provider boilerplate.
+*   - Anti-loop: events that already carry `via[]` are skipped (we only
+*     propagate ORIGINAL emissions).
+*   - Anti-cycle: the parent chain is bounded — if the device registry
+*     is corrupt and has a cycle, the walker caps at `MAX_CHAIN_DEPTH`
+*     and logs a warning.
+*   - Lazy: parent chain is resolved on-demand per event (no cached
+*     topology). The lookup is O(depth) which is ≤2 in practice.
+*
+* `via` contract (from SystemEvent.via JSDoc):
+*   - `via[0]` is the originating source (the device that produced the
+*     event). Subsequent entries walk up the parent chain.
+*   - On the re-emission, `source` is the ancestor at that level and
+*     `via[0..i]` is the prefix of the chain up to and including the
+*     first N ancestors below the current one.
+*
+* Example (grandchild → parent → grandparent):
+*   Original:  { source: {id: 7}, data: {...}, via: undefined }
+*   Re-emit 1: { source: {id: 4}, data: {...}, via: [{id: 7}] }
+*   Re-emit 2: { source: {id: 1}, data: {...}, via: [{id: 7}, {id: 4}] }
+*
+* A consumer listening at `source.id === 1` receives re-emit 2 (with
+* `via` showing the chain). A consumer listening at `source.id === 7`
+* with `via === undefined` receives the original only.
+*/
+/** Bounded walk — paranoia against corrupt device registries with cycles. */
+var MAX_CHAIN_DEPTH = 16;
+var DeviceEventPropagator = class {
+	opts;
+	unsubscribe = null;
+	constructor(opts) {
+		this.opts = opts;
+	}
+	start() {
+		if (this.unsubscribe) return;
+		const unsub = this.opts.eventBus.subscribe({}, (ev) => this.handle(ev));
+		this.unsubscribe = unsub;
+	}
+	stop() {
+		if (!this.unsubscribe) return;
+		this.unsubscribe();
+		this.unsubscribe = null;
+	}
+	/** Exposed for tests — lets them inject events without the full bus. */
+	handle(ev) {
+		if (ev.via !== void 0) return;
+		if (ev.source.type !== "device") return;
+		const rawId = ev.source.id;
+		const deviceId = typeof rawId === "number" ? rawId : Number(rawId);
+		if (!Number.isFinite(deviceId)) return;
+		const chain = this.resolveParentChain(deviceId);
+		if (chain.length === 0) return;
+		const via = [ev.source];
+		for (const ancestorId of chain) {
+			const reEmission = {
+				...ev,
+				source: {
+					type: "device",
+					id: ancestorId
+				},
+				via: [...via]
+			};
+			this.opts.eventBus.emit(reEmission);
+			via.push({
+				type: "device",
+				id: ancestorId
+			});
+		}
+	}
+	resolveParentChain(deviceId) {
+		const chain = [];
+		const seen = new Set([deviceId]);
+		let current = this.opts.getParentOf(deviceId);
+		while (current != null) {
+			if (seen.has(current)) {
+				this.opts.logger.warn("device-event-propagator: cycle detected in parent chain — aborting propagation", {
+					tags: { deviceId },
+					meta: {
+						cycleAt: current,
+						chainSoFar: [...chain]
+					}
+				});
+				return chain;
+			}
+			seen.add(current);
+			chain.push(current);
+			if (chain.length >= MAX_CHAIN_DEPTH) {
+				this.opts.logger.warn("device-event-propagator: chain depth limit hit — truncating", {
+					tags: { deviceId },
+					meta: {
+						depth: chain.length,
+						max: MAX_CHAIN_DEPTH
+					}
+				});
+				break;
+			}
+			current = this.opts.getParentOf(current);
+		}
+		return chain;
+	}
+};
+//#endregion
 //#region src/builtins/device-manager/device-link-cycle.ts
 function nodeKey(deviceId, cap) {
 	return `${deviceId}:${cap}`;