@camstack/system 1.2.274 → 1.2.276

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,8 +3,8 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-C_4Xt0Ya.js");
-const require_retired_settings_keys = require("../../retired-settings-keys-6wZNp7lr.js");
+const require_dist = require("../../dist-D_OlSf31.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-LwFyTKun.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -762,6 +762,7 @@ async function resolveBindingsForDevice(deps, deviceId, row, pass) {
 	const seenCaps = /* @__PURE__ */ new Set();
 	const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
 	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
+		if (wrapperAddonId === void 0) continue;
 		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, deviceId) ?? null;
 		const remoteNative = resolveRemote(capName);
 		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
@@ -2526,28 +2527,6 @@ function splitDeviceStoreKeys(patch) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
-* Device-details aggregation + field-update routing for the device-manager
-* addon. Extracted from `device-manager.addon.ts` as free functions that
-* receive an explicit `AggregationDeps` context (DI) rather than closing over
-* the addon instance.
-*
-* This module owns the binding-driven settings/live/status aggregators
-* (`getDeviceAggregate`, `collectSystemDeviceContributions`,
-* `deriveDeviceConfigContribution`, `buildBaseDeviceSection`,
-* `getDeviceStatusAggregate`, `resolveDriverConfigSchema`) and the
-* field-update routing (`updateDeviceField`, `updateDeviceFieldsBatch`,
-* `applyGroupPatch`, `resolveContributionProvider`, `dispatchDeviceAction`)
-* plus the wrapper-activation mutators (`setWrapperActive`,
-* `listWrappersForCap`, `listBindableCapsForDeviceType`).
-*
-* Sibling aggregator functions call each other directly (passing `deps`);
-* cross-domain leaf calls (`getBindings`, `lookupPersistedStableId`,
-* `resolveRemoteNativeCapFromRegistry`, read/writeBindingsStore) route through
-* the bindings-store module via `deps.bindingsDeps`. EXACT semantics, ordering,
-* and side effects of the original class methods are preserved; the addon keeps
-* thin delegator methods over these functions.
-*/
-/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3250,39 +3229,6 @@ async function listBindableCapsForDeviceType(deps, input) {
 		wrappers: [...registry.getWrappersForCap(capName)]
 	}));
 }
-async function setWrapperActive(deps, input) {
-	const storeKey = String(input.deviceId);
-	await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
-		const store = await readBindingsStore(deps.bindingsDeps);
-		const perDevice = { ...store.deviceBindings[storeKey] };
-		if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-		else perDevice[input.capName] = { wrapperAddonId: null };
-		const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-			...store.deviceBindings,
-			[storeKey]: perDevice
-		} : (() => {
-			const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-			return rest;
-		})();
-		await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
-	});
-	deps.ctx.eventBus.emit({
-		id: (0, node_crypto.randomUUID)(),
-		timestamp: /* @__PURE__ */ new Date(),
-		source: {
-			type: "addon",
-			id: deps.ctx.id
-		},
-		category: require_dist.EventCategory.DeviceBindingsChanged,
-		data: {
-			deviceId: input.deviceId,
-			capName: input.capName,
-			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
-			addonId: input.wrapperAddonId,
-			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
-		}
-	});
-}
 /**
 * Build the wireable-cap entry for one capability definition: the status
 * schema's scalar leaf fields plus — for an item-array cap
@@ -3356,6 +3302,162 @@ async function getWireableFields(deps, input) {
 	return { caps };
 }
 //#endregion
+//#region src/builtins/device-manager/device-source-activation.ts
+/**
+* Is `source` denied for a device, given the persisted deny set?
+*
+* The ONE place the migration rule lives: an entry matches either the source's
+* own id or the id of the addon that serves it. New writes are always source
+* ids; an addon id can only be a pre-re-key entry, and it still means "every
+* source this addon serves here".
+*/
+function isSourceDenied(denied, source) {
+	if (denied.includes(source.addonId)) return true;
+	return source.sourceId !== void 0 && denied.includes(source.sourceId);
+}
+/**
+* The deny list after one toggle. Pure, order-preserving, idempotent — a
+* second "off" on an addon already off changes nothing.
+*/
+function nextDisabledSources(current, key, active) {
+	if (active) return current.filter((id) => id !== key);
+	return current.includes(key) ? current : [...current, key];
+}
+/** Is `capName` a COLLECTION cap — a cap whose device has several SOURCES? */
+function isCollectionCap(registry, capName) {
+	return registry?.getDefinition(capName)?.mode === "collection";
+}
+/**
+* The persisted deny list for one `(device, cap)`, empty when never written.
+*
+* Reads the current field AND the pre-re-key one, unioned: a legacy addon id
+* is still an entry and still denies every source that addon serves here. The
+* union is what makes the migration a read rule rather than a data rewrite —
+* nothing has to walk a thousand cameras to keep an operator's decision.
+*/
+function disabledSourcesOf(record) {
+	const current = record?.disabledSourceIds ?? [];
+	const legacy = record?.disabledSourceAddonIds ?? [];
+	const out = [...current];
+	for (const id of legacy) if (!out.includes(id)) out.push(id);
+	return out;
+}
+/**
+* Push ONE device's persisted source deactivations onto the resolution path.
+* The only writer of the registry's per-device source set.
+*/
+function mirrorDeviceSources(registry, deviceId, capName, disabledAddonIds) {
+	registry?.setDeviceDisabledSources(String(deviceId), capName, disabledAddonIds);
+}
+/**
+* Replay the whole persisted store onto a fresh registry.
+*
+* The projection is in-memory, so a hub restart starts it empty — and an empty
+* deny list means "every source", which would silently switch every source the
+* operator turned off back ON. That is precisely the D62 failure (an off switch
+* that reports on), so the replay is not an optimisation: it is what makes the
+* authority durable. Called from the device-manager's `onInitialize`, before
+* any camera can be asked for its clips, and safe to call again.
+*/
+function restoreDeviceSourceActivations(registry, store, logger) {
+	const deviceBindings = store.deviceBindings;
+	if (deviceBindings === void 0) return 0;
+	let restored = 0;
+	for (const [deviceKey, perDevice] of Object.entries(deviceBindings)) {
+		const deviceId = Number(deviceKey);
+		for (const [capName, record] of Object.entries(perDevice)) {
+			const disabled = disabledSourcesOf(record);
+			if (disabled.length === 0) continue;
+			registry.setDeviceDisabledSources(deviceKey, capName, disabled);
+			restored += 1;
+			logger.info("restored per-device source deactivations", {
+				tags: { deviceId },
+				meta: {
+					capability: capName,
+					disabledSourceIds: disabled
+				}
+			});
+		}
+	}
+	return restored;
+}
+/**
+* Activate or deactivate a wrapper for one device.
+*
+* Singleton caps keep the shape D62 fixed: one `wrapperAddonId`, or the
+* explicit `null` marker that stops `getBindings` step 2 re-binding a
+* `defaultActive` wrapper. Collection caps write `disabledSourceAddonIds`
+* instead — their `wrapperAddonId` is left exactly as it was, because a cap
+* with several sources has no "which one" for `getBindings` to answer (D554
+* context 3) and inventing one would turn a source toggle into a cap-wide off
+* switch.
+*/
+async function setWrapperActive(deps, input) {
+	const storeKey = String(input.deviceId);
+	const collection = isCollectionCap(deps.capabilityRegistry, input.capName);
+	let mirrored = [];
+	await deps.withAddonStoreWriteLock(async () => {
+		const store = await readBindingsStore(deps);
+		const perDevice = { ...store.deviceBindings[storeKey] };
+		const existing = perDevice[input.capName];
+		if (collection) {
+			const key = input.sourceId ?? input.wrapperAddonId;
+			const disabled = nextDisabledSources(disabledSourcesOf(existing), key, input.active);
+			mirrored = disabled;
+			const wrapperAddonId = existing?.wrapperAddonId;
+			perDevice[input.capName] = {
+				...wrapperAddonId === void 0 ? {} : { wrapperAddonId },
+				...disabled.length === 0 ? {} : { disabledSourceIds: disabled }
+			};
+			if (Object.keys(perDevice[input.capName] ?? {}).length === 0) delete perDevice[input.capName];
+		} else if (input.active) perDevice[input.capName] = {
+			...existing,
+			wrapperAddonId: input.wrapperAddonId
+		};
+		else perDevice[input.capName] = {
+			...existing,
+			wrapperAddonId: null
+		};
+		await writeBindingsStore(deps, { deviceBindings: Object.keys(perDevice).length > 0 ? {
+			...store.deviceBindings,
+			[storeKey]: perDevice
+		} : (() => {
+			const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+			return rest;
+		})() });
+	});
+	if (collection) {
+		mirrorDeviceSources(deps.capabilityRegistry, input.deviceId, input.capName, mirrored);
+		deps.ctx.logger.info(input.active ? "source activated for device" : "source deactivated for device", {
+			tags: {
+				deviceId: input.deviceId,
+				addonId: input.wrapperAddonId
+			},
+			meta: {
+				capability: input.capName,
+				sourceId: input.sourceId ?? null,
+				disabledSourceIds: [...mirrored]
+			}
+		});
+	}
+	deps.ctx.eventBus.emit({
+		id: (0, node_crypto.randomUUID)(),
+		timestamp: /* @__PURE__ */ new Date(),
+		source: {
+			type: "addon",
+			id: deps.ctx.id
+		},
+		category: require_dist.EventCategory.DeviceBindingsChanged,
+		data: {
+			deviceId: input.deviceId,
+			capName: input.capName,
+			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
+			addonId: input.wrapperAddonId,
+			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
+		}
+	});
+}
+//#endregion
 //#region src/builtins/device-manager/device-event-propagator.ts
 /**
 * Walks the parent chain for every device-sourced event and re-emits a
@@ -7327,7 +7429,15 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 		return listBindableCapsForDeviceType(this.aggregationDeps, input);
 	}
 	async setWrapperActive(input) {
-		return setWrapperActive(this.aggregationDeps, input);
+		return setWrapperActive(this.wrapperActivationDeps, input);
+	}
+	/** The narrow dependency bag the activation verb needs (D556). */
+	get wrapperActivationDeps() {
+		return {
+			ctx: this.ctx,
+			capabilityRegistry: this.capabilityRegistry,
+			withAddonStoreWriteLock: this.addonStoreWriteLock
+		};
 	}
 	async onInitialize() {
 		const settings = this.ctx.settings;
@@ -7348,6 +7458,11 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 		const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
 		await deviceRows.declare();
 		this.deviceRows = deviceRows;
+		const capRegistryForRestore = this.capabilityRegistry;
+		if (capRegistryForRestore) {
+			const restored = restoreDeviceSourceActivations(capRegistryForRestore, await readBindingsStore({ ctx: this.ctx }), this.ctx.logger);
+			if (restored > 0) this.ctx.logger.info("per-device source deactivations restored", { meta: { rows: restored } });
+		}
 		try {
 			await require_retired_settings_keys.purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
 		} catch (err) {
@@ -7602,4 +7717,8 @@ var DeviceManagerAddon = class extends require_dist.BaseAddon {
 //#endregion
 exports.DeviceManagerAddon = DeviceManagerAddon;
 exports.default = DeviceManagerAddon;
+exports.isSourceDenied = isSourceDenied;
 exports.mergeAggregates = mergeAggregates;
+exports.nextDisabledSources = nextDisabledSources;
+exports.restoreDeviceSourceActivations = restoreDeviceSourceActivations;
+exports.setWrapperActive = setWrapperActive;

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as deviceStateCapability, D as STREAM_PROFILE_META, H as buildStreamParamsConfigSchema, Ht as runtimeStatePolicyFor, Nn as sleep$1, Nt as parseStreamParamsFormPatch, Pn as EventCategory, Q as deviceManagerCapability, St as locationIconKey, Tn as isDeviceConfigCap, an as errMsg, dn as DeviceFeature, et as deviceStatusCapability, fn as DeviceRole, gn as WELL_KNOWN_TAB_MAP, it as enumerateSchemaFields, jt as normalizeUnit, m as DeviceStatusSchema, o as CAMERA_SWITCH_ORDER, pn as DeviceType, qt as siteZoneKey, rt as enumerateItemArrayFields, s as CAP_NAMES_WITH_STATUS, sn as BaseAddon, t as ALL_CAPABILITY_DEFINITIONS, v as LocationIconIdSchema, zt as resolveContainerPrimaryChild } from "../../dist-DchKwh_m.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-DPSHUHMu.mjs";
+import { $ as deviceStateCapability, Bt as resolveContainerPrimaryChild, D as STREAM_PROFILE_META, En as isDeviceConfigCap, Fn as EventCategory, H as buildStreamParamsConfigSchema, Jt as siteZoneKey, Pn as sleep$1, Pt as parseStreamParamsFormPatch, Q as deviceManagerCapability, St as locationIconKey, Ut as runtimeStatePolicyFor, _n as WELL_KNOWN_TAB_MAP, cn as BaseAddon, et as deviceStatusCapability, fn as DeviceFeature, it as enumerateSchemaFields, jt as normalizeUnit, m as DeviceStatusSchema, mn as DeviceType, o as CAMERA_SWITCH_ORDER, on as errMsg, pn as DeviceRole, rt as enumerateItemArrayFields, s as CAP_NAMES_WITH_STATUS, t as ALL_CAPABILITY_DEFINITIONS, v as LocationIconIdSchema } from "../../dist-AHdiIdJH.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-Cp3oG_aH.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -757,6 +757,7 @@ async function resolveBindingsForDevice(deps, deviceId, row, pass) {
 	const seenCaps = /* @__PURE__ */ new Set();
 	const resolveRemote = (capName) => deps.remoteNativeCaps.get(deviceId)?.get(capName) ?? resolveRemoteNativeCapFromRegistry(deps, capName, deviceId);
 	for (const [capName, { wrapperAddonId }] of Object.entries(perDevice)) {
+		if (wrapperAddonId === void 0) continue;
 		const hubLocalNative = deps.capabilityRegistry?.getNativeAddonId(capName, deviceId) ?? null;
 		const remoteNative = resolveRemote(capName);
 		const nativeAddonId = hubLocalNative ?? remoteNative?.addonId ?? "";
@@ -2521,28 +2522,6 @@ function splitDeviceStoreKeys(patch) {
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
 /**
-* Device-details aggregation + field-update routing for the device-manager
-* addon. Extracted from `device-manager.addon.ts` as free functions that
-* receive an explicit `AggregationDeps` context (DI) rather than closing over
-* the addon instance.
-*
-* This module owns the binding-driven settings/live/status aggregators
-* (`getDeviceAggregate`, `collectSystemDeviceContributions`,
-* `deriveDeviceConfigContribution`, `buildBaseDeviceSection`,
-* `getDeviceStatusAggregate`, `resolveDriverConfigSchema`) and the
-* field-update routing (`updateDeviceField`, `updateDeviceFieldsBatch`,
-* `applyGroupPatch`, `resolveContributionProvider`, `dispatchDeviceAction`)
-* plus the wrapper-activation mutators (`setWrapperActive`,
-* `listWrappersForCap`, `listBindableCapsForDeviceType`).
-*
-* Sibling aggregator functions call each other directly (passing `deps`);
-* cross-domain leaf calls (`getBindings`, `lookupPersistedStableId`,
-* `resolveRemoteNativeCapFromRegistry`, read/writeBindingsStore) route through
-* the bindings-store module via `deps.bindingsDeps`. EXACT semantics, ordering,
-* and side effects of the original class methods are preserved; the addon keeps
-* thin delegator methods over these functions.
-*/
-/**
 * One process-wide cache behind every device-details fan-out.
 *
 * Module-level on purpose: the page re-polls every 2.5 s and a per-call cache
@@ -3245,39 +3224,6 @@ async function listBindableCapsForDeviceType(deps, input) {
 		wrappers: [...registry.getWrappersForCap(capName)]
 	}));
 }
-async function setWrapperActive(deps, input) {
-	const storeKey = String(input.deviceId);
-	await deps.bindingsDeps.withAddonStoreWriteLock(async () => {
-		const store = await readBindingsStore(deps.bindingsDeps);
-		const perDevice = { ...store.deviceBindings[storeKey] };
-		if (input.active) perDevice[input.capName] = { wrapperAddonId: input.wrapperAddonId };
-		else perDevice[input.capName] = { wrapperAddonId: null };
-		const nextDeviceBindings = Object.keys(perDevice).length > 0 ? {
-			...store.deviceBindings,
-			[storeKey]: perDevice
-		} : (() => {
-			const { [storeKey]: _drop, ...rest } = store.deviceBindings;
-			return rest;
-		})();
-		await writeBindingsStore(deps.bindingsDeps, { deviceBindings: nextDeviceBindings });
-	});
-	deps.ctx.eventBus.emit({
-		id: randomUUID(),
-		timestamp: /* @__PURE__ */ new Date(),
-		source: {
-			type: "addon",
-			id: deps.ctx.id
-		},
-		category: EventCategory.DeviceBindingsChanged,
-		data: {
-			deviceId: input.deviceId,
-			capName: input.capName,
-			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
-			addonId: input.wrapperAddonId,
-			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
-		}
-	});
-}
 /**
 * Build the wireable-cap entry for one capability definition: the status
 * schema's scalar leaf fields plus — for an item-array cap
@@ -3351,6 +3297,162 @@ async function getWireableFields(deps, input) {
 	return { caps };
 }
 //#endregion
+//#region src/builtins/device-manager/device-source-activation.ts
+/**
+* Is `source` denied for a device, given the persisted deny set?
+*
+* The ONE place the migration rule lives: an entry matches either the source's
+* own id or the id of the addon that serves it. New writes are always source
+* ids; an addon id can only be a pre-re-key entry, and it still means "every
+* source this addon serves here".
+*/
+function isSourceDenied(denied, source) {
+	if (denied.includes(source.addonId)) return true;
+	return source.sourceId !== void 0 && denied.includes(source.sourceId);
+}
+/**
+* The deny list after one toggle. Pure, order-preserving, idempotent — a
+* second "off" on an addon already off changes nothing.
+*/
+function nextDisabledSources(current, key, active) {
+	if (active) return current.filter((id) => id !== key);
+	return current.includes(key) ? current : [...current, key];
+}
+/** Is `capName` a COLLECTION cap — a cap whose device has several SOURCES? */
+function isCollectionCap(registry, capName) {
+	return registry?.getDefinition(capName)?.mode === "collection";
+}
+/**
+* The persisted deny list for one `(device, cap)`, empty when never written.
+*
+* Reads the current field AND the pre-re-key one, unioned: a legacy addon id
+* is still an entry and still denies every source that addon serves here. The
+* union is what makes the migration a read rule rather than a data rewrite —
+* nothing has to walk a thousand cameras to keep an operator's decision.
+*/
+function disabledSourcesOf(record) {
+	const current = record?.disabledSourceIds ?? [];
+	const legacy = record?.disabledSourceAddonIds ?? [];
+	const out = [...current];
+	for (const id of legacy) if (!out.includes(id)) out.push(id);
+	return out;
+}
+/**
+* Push ONE device's persisted source deactivations onto the resolution path.
+* The only writer of the registry's per-device source set.
+*/
+function mirrorDeviceSources(registry, deviceId, capName, disabledAddonIds) {
+	registry?.setDeviceDisabledSources(String(deviceId), capName, disabledAddonIds);
+}
+/**
+* Replay the whole persisted store onto a fresh registry.
+*
+* The projection is in-memory, so a hub restart starts it empty — and an empty
+* deny list means "every source", which would silently switch every source the
+* operator turned off back ON. That is precisely the D62 failure (an off switch
+* that reports on), so the replay is not an optimisation: it is what makes the
+* authority durable. Called from the device-manager's `onInitialize`, before
+* any camera can be asked for its clips, and safe to call again.
+*/
+function restoreDeviceSourceActivations(registry, store, logger) {
+	const deviceBindings = store.deviceBindings;
+	if (deviceBindings === void 0) return 0;
+	let restored = 0;
+	for (const [deviceKey, perDevice] of Object.entries(deviceBindings)) {
+		const deviceId = Number(deviceKey);
+		for (const [capName, record] of Object.entries(perDevice)) {
+			const disabled = disabledSourcesOf(record);
+			if (disabled.length === 0) continue;
+			registry.setDeviceDisabledSources(deviceKey, capName, disabled);
+			restored += 1;
+			logger.info("restored per-device source deactivations", {
+				tags: { deviceId },
+				meta: {
+					capability: capName,
+					disabledSourceIds: disabled
+				}
+			});
+		}
+	}
+	return restored;
+}
+/**
+* Activate or deactivate a wrapper for one device.
+*
+* Singleton caps keep the shape D62 fixed: one `wrapperAddonId`, or the
+* explicit `null` marker that stops `getBindings` step 2 re-binding a
+* `defaultActive` wrapper. Collection caps write `disabledSourceAddonIds`
+* instead — their `wrapperAddonId` is left exactly as it was, because a cap
+* with several sources has no "which one" for `getBindings` to answer (D554
+* context 3) and inventing one would turn a source toggle into a cap-wide off
+* switch.
+*/
+async function setWrapperActive(deps, input) {
+	const storeKey = String(input.deviceId);
+	const collection = isCollectionCap(deps.capabilityRegistry, input.capName);
+	let mirrored = [];
+	await deps.withAddonStoreWriteLock(async () => {
+		const store = await readBindingsStore(deps);
+		const perDevice = { ...store.deviceBindings[storeKey] };
+		const existing = perDevice[input.capName];
+		if (collection) {
+			const key = input.sourceId ?? input.wrapperAddonId;
+			const disabled = nextDisabledSources(disabledSourcesOf(existing), key, input.active);
+			mirrored = disabled;
+			const wrapperAddonId = existing?.wrapperAddonId;
+			perDevice[input.capName] = {
+				...wrapperAddonId === void 0 ? {} : { wrapperAddonId },
+				...disabled.length === 0 ? {} : { disabledSourceIds: disabled }
+			};
+			if (Object.keys(perDevice[input.capName] ?? {}).length === 0) delete perDevice[input.capName];
+		} else if (input.active) perDevice[input.capName] = {
+			...existing,
+			wrapperAddonId: input.wrapperAddonId
+		};
+		else perDevice[input.capName] = {
+			...existing,
+			wrapperAddonId: null
+		};
+		await writeBindingsStore(deps, { deviceBindings: Object.keys(perDevice).length > 0 ? {
+			...store.deviceBindings,
+			[storeKey]: perDevice
+		} : (() => {
+			const { [storeKey]: _drop, ...rest } = store.deviceBindings;
+			return rest;
+		})() });
+	});
+	if (collection) {
+		mirrorDeviceSources(deps.capabilityRegistry, input.deviceId, input.capName, mirrored);
+		deps.ctx.logger.info(input.active ? "source activated for device" : "source deactivated for device", {
+			tags: {
+				deviceId: input.deviceId,
+				addonId: input.wrapperAddonId
+			},
+			meta: {
+				capability: input.capName,
+				sourceId: input.sourceId ?? null,
+				disabledSourceIds: [...mirrored]
+			}
+		});
+	}
+	deps.ctx.eventBus.emit({
+		id: randomUUID(),
+		timestamp: /* @__PURE__ */ new Date(),
+		source: {
+			type: "addon",
+			id: deps.ctx.id
+		},
+		category: EventCategory.DeviceBindingsChanged,
+		data: {
+			deviceId: input.deviceId,
+			capName: input.capName,
+			reason: input.active ? "wrapper-activated" : "wrapper-deactivated",
+			addonId: input.wrapperAddonId,
+			nodeId: resolveWrapperNodeId(input.wrapperAddonId)
+		}
+	});
+}
+//#endregion
 //#region src/builtins/device-manager/device-event-propagator.ts
 /**
 * Walks the parent chain for every device-sourced event and re-emits a
@@ -7322,7 +7424,15 @@ var DeviceManagerAddon = class extends BaseAddon {
 		return listBindableCapsForDeviceType(this.aggregationDeps, input);
 	}
 	async setWrapperActive(input) {
-		return setWrapperActive(this.aggregationDeps, input);
+		return setWrapperActive(this.wrapperActivationDeps, input);
+	}
+	/** The narrow dependency bag the activation verb needs (D556). */
+	get wrapperActivationDeps() {
+		return {
+			ctx: this.ctx,
+			capabilityRegistry: this.capabilityRegistry,
+			withAddonStoreWriteLock: this.addonStoreWriteLock
+		};
 	}
 	async onInitialize() {
 		const settings = this.ctx.settings;
@@ -7343,6 +7453,11 @@ var DeviceManagerAddon = class extends BaseAddon {
 		const deviceRows = new DeviceRowStore(deviceRowBackendOf(settingsStoreApi), this.ctx.logger.child("rows"));
 		await deviceRows.declare();
 		this.deviceRows = deviceRows;
+		const capRegistryForRestore = this.capabilityRegistry;
+		if (capRegistryForRestore) {
+			const restored = restoreDeviceSourceActivations(capRegistryForRestore, await readBindingsStore({ ctx: this.ctx }), this.ctx.logger);
+			if (restored > 0) this.ctx.logger.info("per-device source deactivations restored", { meta: { rows: restored } });
+		}
 		try {
 			await purgeRetiredSettingsRows(deviceRows.retiredRowStore(), this.ctx.logger.child("RetiredRows"));
 		} catch (err) {
@@ -7595,4 +7710,4 @@ var DeviceManagerAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { DeviceManagerAddon, DeviceManagerAddon as default, mergeAggregates };
+export { DeviceManagerAddon, DeviceManagerAddon as default, setWrapperActive as i, mergeAggregates, nextDisabledSources as n, restoreDeviceSourceActivations as r, isSourceDenied as t };

package/dist/builtins/device-manager/device-meta-types.d.ts

@@ -43,10 +43,43 @@ export type DriverConfigSchemaResult = {
 } | {
     status: 'unavailable';
 };
+/**
+ * One `(device, capability)` row of the persisted wrapper-activation store —
+ * the authority for every per-camera function switch (D62) and, since D556,
+ * for which SOURCES a camera's collection cap has.
+ *
+ * The two fields answer two different cardinalities and are never both the
+ * answer for one cap:
+ *
+ * - `wrapperAddonId` — a SINGLETON cap's bound wrapper, or the explicit
+ *   `null` "operator disabled" marker that stops `getBindings` step 2
+ *   re-binding a `defaultActive` wrapper. Absent means the operator never
+ *   touched this cap on this device.
+ * - `disabledSourceIds` — a COLLECTION cap's switched-OFF sources. A DENY
+ *   list on purpose: absence means every source the camera has, which is both
+ *   today's behaviour and the only shape under which a provider registered
+ *   later is seen without a second write (D556).
+ *
+ * `disabledSourceIds` holds SOURCE ids (`native:reolink:hub`), not addon ids.
+ * One addon can serve several of a device's sources, so an addon-keyed entry
+ * could only ever mean "all of them" — which is exactly how a LEGACY entry is
+ * still read: {@link DeviceCapBinding.disabledSourceAddonIds} is never written
+ * any more and every id in it denies every source that addon serves for this
+ * device. One predicate, stated once, so an operator's existing decision does
+ * not silently stop applying (D555).
+ */
+export interface DeviceCapBinding {
+    readonly wrapperAddonId?: string | null;
+    /** SOURCE ids the operator switched off for this device. */
+    readonly disabledSourceIds?: readonly string[];
+    /**
+     * @deprecated Pre-re-key entries, keyed by ADDON id. Read, never written:
+     *   an id here denies every source that addon serves for this device.
+     */
+    readonly disabledSourceAddonIds?: readonly string[];
+}
 export interface DeviceBindingsStore {
-    readonly deviceBindings: Record<string, Record<string, {
-        wrapperAddonId: string | null;
-    }>>;
+    readonly deviceBindings: Record<string, Record<string, DeviceCapBinding>>;
 }
 export interface PersistedDeviceMeta {
     type: string;

package/dist/builtins/device-manager/device-source-activation.d.ts

@@ -0,0 +1,70 @@
+import { AddonContext, ICapabilityRegistry, IScopedLogger } from '@camstack/types';
+import { DeviceBindingsStore } from './device-meta-types.js';
+import { WriteLock } from './write-lock.js';
+/**
+ * What a wrapper-activation write needs, and nothing more.
+ *
+ * Deliberately narrower than `AggregationDeps`: the verb touches the settings
+ * door, the event bus, the registry and the addon-store write lock. Handing it
+ * the device ledger and the remote-native cache it never reads would make this
+ * loop untestable without standing up the whole addon.
+ */
+export interface WrapperActivationDeps {
+    readonly ctx: AddonContext;
+    readonly capabilityRegistry: ICapabilityRegistry | undefined;
+    /** Ordering for every read-modify-write of the fleet-wide `deviceBindings` blob (D62). */
+    readonly withAddonStoreWriteLock: WriteLock;
+}
+/** The operator-facing activation, as it arrives from the cap router. */
+export interface WrapperActivationInput {
+    readonly deviceId: number;
+    readonly capName: string;
+    readonly wrapperAddonId: string;
+    /**
+     * The SOURCE to toggle, for a collection cap. Absent keeps the cap-wide
+     * meaning D556 shipped — every source this addon serves for this device —
+     * which is also how a pre-re-key entry is read.
+     */
+    readonly sourceId?: string;
+    readonly active: boolean;
+}
+/**
+ * Is `source` denied for a device, given the persisted deny set?
+ *
+ * The ONE place the migration rule lives: an entry matches either the source's
+ * own id or the id of the addon that serves it. New writes are always source
+ * ids; an addon id can only be a pre-re-key entry, and it still means "every
+ * source this addon serves here".
+ */
+export declare function isSourceDenied(denied: readonly string[], source: {
+    readonly sourceId?: string;
+    readonly addonId: string;
+}): boolean;
+/**
+ * The deny list after one toggle. Pure, order-preserving, idempotent — a
+ * second "off" on an addon already off changes nothing.
+ */
+export declare function nextDisabledSources(current: readonly string[], key: string, active: boolean): readonly string[];
+/**
+ * Replay the whole persisted store onto a fresh registry.
+ *
+ * The projection is in-memory, so a hub restart starts it empty — and an empty
+ * deny list means "every source", which would silently switch every source the
+ * operator turned off back ON. That is precisely the D62 failure (an off switch
+ * that reports on), so the replay is not an optimisation: it is what makes the
+ * authority durable. Called from the device-manager's `onInitialize`, before
+ * any camera can be asked for its clips, and safe to call again.
+ */
+export declare function restoreDeviceSourceActivations(registry: ICapabilityRegistry, store: Partial<DeviceBindingsStore>, logger: IScopedLogger): number;
+/**
+ * Activate or deactivate a wrapper for one device.
+ *
+ * Singleton caps keep the shape D62 fixed: one `wrapperAddonId`, or the
+ * explicit `null` marker that stops `getBindings` step 2 re-binding a
+ * `defaultActive` wrapper. Collection caps write `disabledSourceAddonIds`
+ * instead — their `wrapperAddonId` is left exactly as it was, because a cap
+ * with several sources has no "which one" for `getBindings` to answer (D554
+ * context 3) and inventing one would turn a source toggle into a cap-wide off
+ * switch.
+ */
+export declare function setWrapperActive(deps: WrapperActivationDeps, input: WrapperActivationInput): Promise<void>;