@camstack/system 1.2.136 → 1.2.137

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { Gt as EventCategory, v as addonPagesCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { Gt as EventCategory, b as addonWidgetsCapability, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { Gt as EventCategory, Mt as createEvent, n as AlertSchema, vt as errMsg, x as alertsCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 let node_crypto = require("node:crypto");
 let buffer = require("buffer");
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { C as backupCapability, Gt as EventCategory, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import { Buffer as Buffer$1 } from "buffer";
 import * as fsp from "node:fs/promises";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,4 +1,4 @@
-import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { D as coreBlockAddonId, O as coreBlockIdFromAddonId, c as CoreBlockSchema, k as coreBlocksCapability, l as DeclaredDevices, o as CORE_BLOCKS_ADDON_ID, s as CORE_BLOCK_ADDON_PREFIX, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/device-manager/device-bindings-store.d.ts

@@ -137,10 +137,16 @@ export declare function getBindings(deps: BindingsDeps, input: {
  * caller needing seventy-five paid either 75 round-trips (1211 ms / 118 KB) or
  * `getAllBindings` (511 ms / 679 KB of mostly-unwanted rows).
  *
- * Sequential on purpose, like `getAllBindings`: `getBindings` is a pair of
- * store reads on this process's own event loop, so concurrency buys nothing
- * and a fan-out of `Promise.all` over hundreds of ids only makes the queue
- * less fair to everything else on it.
+ * Sequential on purpose, like `getAllBindings`: `resolveBindingsForDevice`'s
+ * remaining per-device work (the bindings-store read, the routing rules) runs
+ * on this process's own event loop, so concurrency buys nothing there and a
+ * fan-out of `Promise.all` over hundreds of ids only makes the queue less fair
+ * to everything else on it. The one part that DOES amortise across the whole
+ * set — the device row lookup — is fetched ONCE, ahead of the loop
+ * ({@link DeviceRowStore.getMany}), rather than once per iteration: measured
+ * on the live hub 2026-08-25, `get device-manager:devices` ran 1 656
+ * calls/min steady-state, one row per call, which is exactly what looping
+ * `getBindings`'s own `rows.get(deviceId)` here produced.
  */
 export declare function getBindingsBatch(deps: BindingsDeps, input: {
     deviceIds: readonly number[];

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-CqD6rSQx.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-Dvkcu_zf.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -594,16 +594,33 @@ function capAppliesToDeviceType(def, deviceType) {
 	return declared.some((t) => t === deviceType);
 }
 async function getBindings(deps, input) {
-	const storeKey = String(input.deviceId);
-	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
 	const row = await deps.rows.get(input.deviceId);
-	const deviceType = resolveDeviceType(deps, row, input.deviceId);
-	const presence = await resolveDevicePresence(deps, row, input.deviceId);
+	return resolveBindingsForDevice(deps, input.deviceId, row);
+}
+/**
+* The `getBindings` resolver, taking the device's row as a PARAMETER instead
+* of fetching it.
+*
+* `getBindings` (one device) and `getBindingsBatch` / `getAllBindings` (many)
+* share this — the routing rules and the per-device shape stay identical by
+* construction. The split exists so the batch callers can resolve every row
+* they need in ONE store round trip ({@link DeviceRowStore.getMany} /
+* {@link DeviceRowStore.listAll}) instead of looping this function's own
+* `deps.rows.get(deviceId)`, which is the primary-key-lookup-per-loop-
+* iteration shape measured on the live hub 2026-08-25: `get
+* device-manager:devices` at 1 656 calls/min steady-state and 17 687 during
+* boot, one row per call.
+*/
+async function resolveBindingsForDevice(deps, deviceId, row) {
+	const storeKey = String(deviceId);
+	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+	const deviceType = resolveDeviceType(deps, row, deviceId);
+	const presence = await resolveDevicePresence(deps, row, deviceId);
 	const entries = [];
 	const seenCaps = /* @__PURE__ */ new Set();
-	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
+	const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
 	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
-		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
+		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, deviceId) ?? null;
 		const remoteNative = resolveRemote(capName);
 		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
 		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
@@ -620,7 +637,7 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId: input.deviceId } });
+	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId } });
 	else if (deps.capabilityRegistry) {
 		const skippedForType = [];
 		for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
@@ -631,7 +648,7 @@ async function getBindings(deps, input) {
 			}
 			const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
 			if (!defaultWrapperAddonId) continue;
-			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
+			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, deviceId) ?? null;
 			const remoteNative = resolveRemote(capName);
 			const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
 			entries.push({
@@ -644,16 +661,16 @@ async function getBindings(deps, input) {
 			seenCaps.add(capName);
 		}
 		if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped — deviceTypes mismatch", {
-			tags: { deviceId: input.deviceId },
+			tags: { deviceId },
 			meta: {
 				deviceType,
 				skipped: skippedForType
 			}
 		});
 	}
-	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
+	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(deviceId)) {
 		if (seenCaps.has(capName)) continue;
-		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
+		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, deviceId) ?? "";
 		entries.push({
 			capName,
 			kind: "native",
@@ -663,7 +680,7 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
+	const pushFed = deps.remoteNativeCaps.get(deviceId);
 	if (pushFed) for (const [capName, info] of pushFed) {
 		if (seenCaps.has(capName)) continue;
 		entries.push({
@@ -675,9 +692,9 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
 	if (clusterCaps) for (const entry of clusterCaps) {
-		if (entry.deviceId !== input.deviceId) continue;
+		if (entry.deviceId !== deviceId) continue;
 		if (seenCaps.has(entry.capName)) continue;
 		if (!entry.addonId) continue;
 		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
@@ -692,7 +709,7 @@ async function getBindings(deps, input) {
 		seenCaps.add(entry.capName);
 	}
 	return {
-		deviceId: input.deviceId,
+		deviceId,
 		entries
 	};
 }
@@ -705,14 +722,22 @@ async function getBindings(deps, input) {
 * caller needing seventy-five paid either 75 round-trips (1211 ms / 118 KB) or
 * `getAllBindings` (511 ms / 679 KB of mostly-unwanted rows).
 *
-* Sequential on purpose, like `getAllBindings`: `getBindings` is a pair of
-* store reads on this process's own event loop, so concurrency buys nothing
-* and a fan-out of `Promise.all` over hundreds of ids only makes the queue
-* less fair to everything else on it.
+* Sequential on purpose, like `getAllBindings`: `resolveBindingsForDevice`'s
+* remaining per-device work (the bindings-store read, the routing rules) runs
+* on this process's own event loop, so concurrency buys nothing there and a
+* fan-out of `Promise.all` over hundreds of ids only makes the queue less fair
+* to everything else on it. The one part that DOES amortise across the whole
+* set — the device row lookup — is fetched ONCE, ahead of the loop
+* ({@link DeviceRowStore.getMany}), rather than once per iteration: measured
+* on the live hub 2026-08-25, `get device-manager:devices` ran 1 656
+* calls/min steady-state, one row per call, which is exactly what looping
+* `getBindings`'s own `rows.get(deviceId)` here produced.
 */
 async function getBindingsBatch(deps, input) {
+	const ids = [...new Set(input.deviceIds)];
+	const rows = await deps.rows.getMany(ids);
 	const out = [];
-	for (const deviceId of new Set(input.deviceIds)) out.push(await getBindings(deps, { deviceId }));
+	for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
 	return out;
 }
 /**
@@ -727,8 +752,13 @@ async function getBindingsBatch(deps, input) {
 * payload periodically.
 */
 async function getAllBindings(deps) {
+	const fleet = await deps.rows.listAll();
+	const rowById = /* @__PURE__ */ new Map();
 	const ids = /* @__PURE__ */ new Set();
-	for (const row of await deps.rows.listAll()) ids.add(row.meta.id);
+	for (const row of fleet) {
+		rowById.set(row.meta.id, row);
+		ids.add(row.meta.id);
+	}
 	const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
 	for (const device of registered) ids.add(device.id);
 	if (ids.size === 0) {
@@ -736,7 +766,7 @@ async function getAllBindings(deps) {
 		return [];
 	}
 	const out = [];
-	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
+	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
 	return out;
 }
 /**
@@ -4329,6 +4359,24 @@ var DeviceRowStore = class {
 		}, opts.slim === true ? DEVICE_ROWS_SLIM_COLUMNS : void 0);
 	}
 	/**
+	* Many devices, by numeric id, in ONE query.
+	*
+	* `get(id)` called once per id in a loop is the primary-key lookup this
+	* store exists to make cheap, repeated until it isn't — measured on the
+	* live hub 2026-08-25: `get device-manager:devices` at 1 656 calls/min
+	* steady-state and 17 687 during boot, exactly one row per call. This
+	* collapses that into the same `whereIn` {@link listFleet} already does for
+	* a fleet read, keyed by id.
+	*
+	* A requested id the fleet does not know is simply ABSENT from the map —
+	* never a fabricated row, matching {@link get}'s `null`. An empty `ids`
+	* reads nothing at all, same as `listFleet({ deviceIds: [] })`.
+	*/
+	async getMany(ids) {
+		const rows = await this.listFleet({ deviceIds: ids });
+		return new Map(rows.map((row) => [row.meta.id, row]));
+	}
+	/**
 	* The device an addon knows as `stableId`, or `null`.
 	*
 	* `(addonId, stableId)` is the addon-facing identity — unique by

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-Bh25kEUH.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-BZbOXqch.mjs";
+import { Ct as DeviceFeature, E as buildStreamParamsConfigSchema, F as deviceStatusCapability, Gt as EventCategory, Lt as isDeviceConfigCap, N as deviceManagerCapability, Ot as WELL_KNOWN_TAB_MAP, P as deviceStateCapability, R as enumerateItemArrayFields, Tt as DeviceType, Wt as sleep, a as CAP_NAMES_WITH_STATUS, at as runtimeStatePolicyFor, et as normalizeUnit, nt as parseStreamParamsFormPatch, p as STREAM_PROFILE_META, t as ALL_CAPABILITY_DEFINITIONS, u as DeviceStatusSchema, vt as errMsg, wt as DeviceRole, yt as BaseAddon, z as enumerateSchemaFields } from "../../dist-DMOTtKH8.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CPRvyt-E.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -589,16 +589,33 @@ function capAppliesToDeviceType(def, deviceType) {
 	return declared.some((t) => t === deviceType);
 }
 async function getBindings(deps, input) {
-	const storeKey = String(input.deviceId);
-	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
 	const row = await deps.rows.get(input.deviceId);
-	const deviceType = resolveDeviceType(deps, row, input.deviceId);
-	const presence = await resolveDevicePresence(deps, row, input.deviceId);
+	return resolveBindingsForDevice(deps, input.deviceId, row);
+}
+/**
+* The `getBindings` resolver, taking the device's row as a PARAMETER instead
+* of fetching it.
+*
+* `getBindings` (one device) and `getBindingsBatch` / `getAllBindings` (many)
+* share this — the routing rules and the per-device shape stay identical by
+* construction. The split exists so the batch callers can resolve every row
+* they need in ONE store round trip ({@link DeviceRowStore.getMany} /
+* {@link DeviceRowStore.listAll}) instead of looping this function's own
+* `deps.rows.get(deviceId)`, which is the primary-key-lookup-per-loop-
+* iteration shape measured on the live hub 2026-08-25: `get
+* device-manager:devices` at 1 656 calls/min steady-state and 17 687 during
+* boot, one row per call.
+*/
+async function resolveBindingsForDevice(deps, deviceId, row) {
+	const storeKey = String(deviceId);
+	const perDevice = (await readBindingsStore(deps)).deviceBindings[storeKey] ?? {};
+	const deviceType = resolveDeviceType(deps, row, deviceId);
+	const presence = await resolveDevicePresence(deps, row, deviceId);
 	const entries = [];
 	const seenCaps = /* @__PURE__ */ new Set();
-	const resolveRemote = (capName) => deps.remoteNativeCaps.get(input.deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, input.deviceId);
+	const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
 	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
-		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, input.deviceId) ?? null;
+		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, deviceId) ?? null;
 		const remoteNative = resolveRemote(capName);
 		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
 		const nativeNodeId = hubLocalNative ? deps.ctx.kernel.localNodeId ?? "hub" : remoteNative?.nodeId ?? deps.ctx.kernel.localNodeId ?? "hub";
@@ -615,7 +632,7 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId: input.deviceId } });
+	if (presence === "absent") deps.ctx.logger.debug("bindings requested for absent device — returning none", { tags: { deviceId } });
 	else if (deps.capabilityRegistry) {
 		const skippedForType = [];
 		for (const capName of deps.capabilityRegistry.getCapsWithDefaultWrapper()) {
@@ -626,7 +643,7 @@ async function getBindings(deps, input) {
 			}
 			const defaultWrapperAddonId = deps.capabilityRegistry.getDefaultWrapperForCap(capName);
 			if (!defaultWrapperAddonId) continue;
-			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? null;
+			const hubLocalNative = deps.capabilityRegistry.getNativeAddonId(capName, deviceId) ?? null;
 			const remoteNative = resolveRemote(capName);
 			const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
 			entries.push({
@@ -639,16 +656,16 @@ async function getBindings(deps, input) {
 			seenCaps.add(capName);
 		}
 		if (skippedForType.length > 0) deps.ctx.logger.debug("getBindings: default wrappers skipped — deviceTypes mismatch", {
-			tags: { deviceId: input.deviceId },
+			tags: { deviceId },
 			meta: {
 				deviceType,
 				skipped: skippedForType
 			}
 		});
 	}
-	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(input.deviceId)) {
+	if (deps.capabilityRegistry) for (const capName of deps.capabilityRegistry.getNativeCapsForDevice(deviceId)) {
 		if (seenCaps.has(capName)) continue;
-		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, input.deviceId) ?? "";
+		const nativeAddonId = deps.capabilityRegistry.getNativeAddonId(capName, deviceId) ?? "";
 		entries.push({
 			capName,
 			kind: "native",
@@ -658,7 +675,7 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	const pushFed = deps.remoteNativeCaps.get(input.deviceId);
+	const pushFed = deps.remoteNativeCaps.get(deviceId);
 	if (pushFed) for (const [capName, info] of pushFed) {
 		if (seenCaps.has(capName)) continue;
 		entries.push({
@@ -670,9 +687,9 @@ async function getBindings(deps, input) {
 		});
 		seenCaps.add(capName);
 	}
-	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(input.deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
+	const clusterCaps = deps.ctx.kernel.listClusterNativeCapsForDevice?.(deviceId) ?? deps.ctx.kernel.listClusterNativeCaps?.();
 	if (clusterCaps) for (const entry of clusterCaps) {
-		if (entry.deviceId !== input.deviceId) continue;
+		if (entry.deviceId !== deviceId) continue;
 		if (seenCaps.has(entry.capName)) continue;
 		if (!entry.addonId) continue;
 		const localNodeId = deps.ctx.kernel.localNodeId ?? "hub";
@@ -687,7 +704,7 @@ async function getBindings(deps, input) {
 		seenCaps.add(entry.capName);
 	}
 	return {
-		deviceId: input.deviceId,
+		deviceId,
 		entries
 	};
 }
@@ -700,14 +717,22 @@ async function getBindings(deps, input) {
 * caller needing seventy-five paid either 75 round-trips (1211 ms / 118 KB) or
 * `getAllBindings` (511 ms / 679 KB of mostly-unwanted rows).
 *
-* Sequential on purpose, like `getAllBindings`: `getBindings` is a pair of
-* store reads on this process's own event loop, so concurrency buys nothing
-* and a fan-out of `Promise.all` over hundreds of ids only makes the queue
-* less fair to everything else on it.
+* Sequential on purpose, like `getAllBindings`: `resolveBindingsForDevice`'s
+* remaining per-device work (the bindings-store read, the routing rules) runs
+* on this process's own event loop, so concurrency buys nothing there and a
+* fan-out of `Promise.all` over hundreds of ids only makes the queue less fair
+* to everything else on it. The one part that DOES amortise across the whole
+* set — the device row lookup — is fetched ONCE, ahead of the loop
+* ({@link DeviceRowStore.getMany}), rather than once per iteration: measured
+* on the live hub 2026-08-25, `get device-manager:devices` ran 1 656
+* calls/min steady-state, one row per call, which is exactly what looping
+* `getBindings`'s own `rows.get(deviceId)` here produced.
 */
 async function getBindingsBatch(deps, input) {
+	const ids = [...new Set(input.deviceIds)];
+	const rows = await deps.rows.getMany(ids);
 	const out = [];
-	for (const deviceId of new Set(input.deviceIds)) out.push(await getBindings(deps, { deviceId }));
+	for (const deviceId of ids) out.push(await resolveBindingsForDevice(deps, deviceId, rows.get(deviceId) ?? null));
 	return out;
 }
 /**
@@ -722,8 +747,13 @@ async function getBindingsBatch(deps, input) {
 * payload periodically.
 */
 async function getAllBindings(deps) {
+	const fleet = await deps.rows.listAll();
+	const rowById = /* @__PURE__ */ new Map();
 	const ids = /* @__PURE__ */ new Set();
-	for (const row of await deps.rows.listAll()) ids.add(row.meta.id);
+	for (const row of fleet) {
+		rowById.set(row.meta.id, row);
+		ids.add(row.meta.id);
+	}
 	const registered = deps.ctx.kernel?.deviceRegistry?.getAll() ?? [];
 	for (const device of registered) ids.add(device.id);
 	if (ids.size === 0) {
@@ -731,7 +761,7 @@ async function getAllBindings(deps) {
 		return [];
 	}
 	const out = [];
-	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await getBindings(deps, { deviceId }));
+	for (const deviceId of [...ids].sort((a, b) => a - b)) out.push(await resolveBindingsForDevice(deps, deviceId, rowById.get(deviceId) ?? null));
 	return out;
 }
 /**
@@ -4324,6 +4354,24 @@ var DeviceRowStore = class {
 		}, opts.slim === true ? DEVICE_ROWS_SLIM_COLUMNS : void 0);
 	}
 	/**
+	* Many devices, by numeric id, in ONE query.
+	*
+	* `get(id)` called once per id in a loop is the primary-key lookup this
+	* store exists to make cheap, repeated until it isn't — measured on the
+	* live hub 2026-08-25: `get device-manager:devices` at 1 656 calls/min
+	* steady-state and 17 687 during boot, exactly one row per call. This
+	* collapses that into the same `whereIn` {@link listFleet} already does for
+	* a fleet read, keyed by id.
+	*
+	* A requested id the fleet does not know is simply ABSENT from the map —
+	* never a fabricated row, matching {@link get}'s `null`. An empty `ids`
+	* reads nothing at all, same as `listFleet({ deviceIds: [] })`.
+	*/
+	async getMany(ids) {
+		const rows = await this.listFleet({ deviceIds: ids });
+		return new Map(rows.map((row) => [row.meta.id, row]));
+	}
+	/**
 	* The device an addon knows as `stableId`, or `null`.
 	*
 	* `(addonId, stableId)` is the addon-facing identity — unique by

package/dist/builtins/device-manager/device-row-store.d.ts

@@ -243,6 +243,21 @@ export declare class DeviceRowStore {
         readonly deviceIds?: readonly number[];
         readonly slim?: boolean;
     }): Promise<readonly DeviceRow[]>;
+    /**
+     * Many devices, by numeric id, in ONE query.
+     *
+     * `get(id)` called once per id in a loop is the primary-key lookup this
+     * store exists to make cheap, repeated until it isn't — measured on the
+     * live hub 2026-08-25: `get device-manager:devices` at 1 656 calls/min
+     * steady-state and 17 687 during boot, exactly one row per call. This
+     * collapses that into the same `whereIn` {@link listFleet} already does for
+     * a fleet read, keyed by id.
+     *
+     * A requested id the fleet does not know is simply ABSENT from the map —
+     * never a fabricated row, matching {@link get}'s `null`. An empty `ids`
+     * reads nothing at all, same as `listFleet({ deviceIds: [] })`.
+     */
+    getMany(ids: readonly number[]): Promise<ReadonlyMap<number, DeviceRow>>;
     /**
      * The device an addon knows as `stableId`, or `null`.
      *

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { G as isSameAddonId, Gt as EventCategory, I as doorbellCapability, Mt as createEvent, Tt as DeviceType, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { X as logDestinationCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { Gt as EventCategory, Mt as createEvent, vt as errMsg, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { S as authProviderCapability, _ as UserRecordSchema, ht as userManagementCapability, m as ScopedTokenSchema, r as ApiKeyRecordSchema, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 const require_tls = require("../../tls-u8QCJCFE.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-Bh25kEUH.mjs";
+import { Gt as EventCategory, Y as localNetworkCapability, yt as BaseAddon } from "../../dist-DMOTtKH8.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-CQhPGSJm.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D-R0SuP-.js");
+const require_dist = require("../../dist-mQ3BkrJd.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label