@camstack/system 1.2.275 → 1.2.277

package/dist/{dist-DWSJVcZe.mjs → dist-DOF9wnat.mjs}

@@ -691,7 +691,7 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	return EventCategory;
 }({});
 //#endregion
-//#region ../types/dist/sleep-CiR4z7r9.mjs
+//#region ../types/dist/sleep-7AN_Txmu.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -2724,6 +2724,7 @@ function toNodeId(idOrRunnerId) {
 function resolveCapMount(def) {
 	if (def.mount) return def.mount;
 	if (def.deviceNative === true) return { kind: "device-native" };
+	if (def.scope === "device" && def.kind === "wrapper") return { kind: "device-scoped" };
 	if (def.mode === "collection") return { kind: "collection" };
 	return { kind: "singleton" };
 }
@@ -10380,6 +10381,33 @@ function objectInputDeclaresAddonId(schema) {
 	const shape = direct !== void 0 && direct !== null ? direct : resolveDefShape(schema._def?.shape);
 	return shape !== void 0 && shape !== null && typeof shape === "object" && Object.prototype.hasOwnProperty.call(shape, "addonId");
 }
+/**
+* True when an OBJECT input schema declares a top-level, REQUIRED, numeric
+* `deviceId` — i.e. the method names exactly one device on every call.
+*
+* This is the question the per-device dispatcher asks at runtime
+* (`requireDeviceScoped`: `typeof input.deviceId !== 'number'` → BAD_REQUEST),
+* asked once at build time instead. A `device-scoped` cap's method that cannot
+* answer it has no device to resolve for and therefore resolves through the
+* cap's SYSTEM provider (`cap-router-builder.ts`) — the same destination
+* `systemOnly` names explicitly. Without this, flipping the mount would 400
+* every batch (`deviceIds`), fleet-wide (`z.void()`) and job-keyed method on
+* the eight device-scoped wrapper caps.
+*
+* Structural, never a name heuristic over source text: the field must resolve
+* to `z.number()` and must NOT be wrapped in `optional` / `nullable` /
+* `default` — an absent value is exactly the input the dispatcher rejects.
+*/
+function objectInputDeclaresRequiredDeviceId(schema) {
+	if (schema === null || typeof schema !== "object" && typeof schema !== "function") return false;
+	const direct = schema.shape;
+	const shape = direct !== void 0 && direct !== null ? direct : resolveDefShape(schema._def?.shape);
+	if (shape === void 0 || shape === null || typeof shape !== "object") return false;
+	const field = shape["deviceId"];
+	if (field === void 0 || field === null) return false;
+	const def = field._def;
+	return field.constructor?.name === "ZodNumber" || def?.type === "number" || def?.typeName === "ZodNumber";
+}
 /** `_def.shape` may be a thunk (Zod defers object-shape evaluation) or a plain record. */
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
@@ -13210,14 +13238,30 @@ var deviceManagerCapability = {
 		*/
 		getAllBindings: method(z.object({}), z.array(DeviceBindingsForDeviceSchema)),
 		/**
-		* Activate (or deactivate) a wrapper addon for a (device, cap) pair.
-		* Persists the binding via ctx.settings. active=false clears the wrapper
-		* (falls back to native if registered).
+		* Activate (or deactivate) a wrapper addon — or ONE of its sources — for a
+		* (device, cap) pair.
+		*
+		* Persists the binding via ctx.settings; `active: false` on a SINGLETON cap
+		* clears the wrapper (falling back to native if one is registered). On a
+		* COLLECTION cap it adds to the per-device DENY set instead, and the
+		* wrapper binding is left exactly as it was — a cap with several sources
+		* has no "which one" for `getBindings` to answer (D556).
+		*
+		* `sourceId` is what makes the switch match its label. One addon can serve
+		* several of a device's sources (`addon-provider-reolink` answers a hub
+		* child with `native:reolink:onboard` AND `native:reolink:hub`), so a
+		* toggle keyed by addon would turn off both while saying it turned off one
+		* — the D62 defect with the polarity reversed (D557). Naming the source
+		* denies exactly that source. OMITTING it keeps the cap-wide meaning
+		* D556 shipped: every source this addon serves for this device, which is
+		* also how a deny entry persisted before the re-key is still read.
 		*/
 		setWrapperActive: method(z.object({
 			deviceId: z.number(),
 			capName: z.string(),
 			wrapperAddonId: z.string(),
+			/** The `ClipSource.source` id to toggle. Absent = all of the addon's. */
+			sourceId: z.string().optional(),
 			active: z.boolean()
 		}), z.void(), {
 			kind: "mutation",
@@ -25975,41 +26019,323 @@ var ClipSchema = z.object({
 	holes: z.array(z.object({
 		startMs: z.number(),
 		endMs: z.number()
-	})).optional()
+	})).optional(),
+	/**
+	* A URL that MAY produce this clip's still, asked only for rows actually on
+	* screen. The opposite of {@link ClipSchema.thumbnail}: that one is VOUCHED
+	* (a JPEG is already on disk), this one is an offer. The route answers 200
+	* with the image, or 204 with `x-camstack-reason` when it could not mint one
+	* — a surface latches that refusal to the instant rather than retrying.
+	*
+	* Never both: a clip with a vouched `thumbnail` needs no mint.
+	*/
+	thumbnailMint: z.string().optional(),
+	/**
+	* Why no still will be produced for this clip RIGHT NOW — set when the
+	* provider already knows, so the surface draws the glyph and the reason
+	* instead of firing a mint that cannot succeed.
+	*
+	* `sleeping` — a standalone battery camera; a read would be a wake (D549 4).
+	* `camera-refused` — the camera answered the CoverPreview with a refusal.
+	* `no-keyframe` — the window holds no decodable I-frame (an event that sits
+	*   inside no file is the measured case).
+	* `unsupported` — this source cannot mint stills at all.
+	*/
+	thumbnailUnavailable: z.object({ reason: z.enum([
+		"sleeping",
+		"camera-refused",
+		"no-keyframe",
+		"unsupported"
+	]) }).optional(),
+	/**
+	* When the catalog this row came from was last CONFIRMED against the device.
+	* Absent means "this row was read live". A persisted catalog served while a
+	* camera sleeps carries the age it really has — a cached list is never drawn
+	* as current (D549 13).
+	*/
+	catalogAsOf: z.number().optional(),
+	/**
+	* The camera's OWN type strings for this clip, all of them, unmapped
+	* (`md`, `people`, `dog_cat`, `sched`, …). Kept beside {@link labels}
+	* because a firmware inventing a type must not vanish: the mapping into our
+	* filter vocabulary is lossy on purpose and this is the lossless copy
+	* (D549 20).
+	*/
+	nativeTypes: z.array(z.string()).optional(),
+	/**
+	* What the subject DID — `crossline`, `intrude`, `loitering`. A behaviour
+	* travels BESIDE a class, never instead of one, and the class filter ignores
+	* it: "a person crossed a line" is still a person (D549 20).
+	*/
+	behaviours: z.array(z.string()).optional(),
+	/**
+	* The same recording as two files — the sub twin (what the row and its
+	* thumbnail are) and its main twin, matched at listing time so a quality
+	* change never re-searches the camera (D549 15). `getClipPlayback`'s
+	* `profile` picks between them: `low | mid` → sub, `high` → main.
+	*/
+	streams: z.object({
+		sub: z.object({
+			id: z.string(),
+			bytes: z.number().optional()
+		}).optional(),
+		main: z.object({
+			id: z.string(),
+			bytes: z.number().optional()
+		}).optional()
+	}).optional(),
+	/** The camera says it holds a sub-stream copy of this recording. */
+	supportSub: z.boolean().optional(),
+	/**
+	* Whether this row has bytes behind it. ABSENT means yes — every clip that
+	* IS a file is playable, and only a source that lists EVENTS can produce a
+	* row with nothing to play (the measured case: 1 of 29 hub events on 3628
+	* fell inside no file). Such a row is shown, never dropped and never offered
+	* as playable-then-failing (D549 19).
+	*/
+	playable: z.boolean().optional(),
+	/** Why {@link playable} is false, verbatim (`no-file-for-window`). */
+	unplayableReason: z.string().optional()
 });
 var ClipPlaybackSchema = z.object({
-	/** HLS master URL through the hub data-plane (Range + token in path). */
+	/**
+	* A media URL through the hub data-plane. {@link ClipPlaybackSchema.format}
+	* says what kind — an HLS master playlist for a recording-derived clip, a
+	* progressive MP4 for a native file the vendor addon muxed and serves with
+	* `Range`. The URL is NOT a credential: both planes are registered
+	* `access: 'authenticated'` and the hub's `/addon/<id>/<prefix>` proxy takes
+	* the session cookie, so nothing is appended to it (D549 22).
+	*/
 	playbackUrl: z.string(),
+	/**
+	* How to play {@link playbackUrl}. Absent means `hls` — the shape every
+	* existing consumer already assumes. A player that branches on this is the
+	* one change a native clip needs; a player that ignores it will hand an MP4
+	* to hls.js and fail parsing it as a manifest.
+	*/
+	format: z.enum(["hls", "mp4"]).optional(),
+	/**
+	* Which twin was actually served. A clip that holds only one stream answers
+	* with the one it has, and the surface SAYS so — a missing main twin is
+	* never served silently as if it were the asked-for quality (D549 15).
+	*/
+	served: CamProfileSchema.optional(),
 	/** Optional LAN/remote alternates for the same clip. */
 	playbackEndpoints: z.array(z.string()).optional(),
 	token: z.string().optional()
 });
+/**
+* Why a source cannot answer right now — per SOURCE, never fleet-wide.
+*
+* `ok` is the only state whose clip list may be read as complete. The other
+* three exist because an empty list from a sleeping camera reads as "this
+* camera has no recordings", which is the defect this whole line of work is
+* about: a battery camera nobody woke (`sleeping`), a camera that could not be
+* reached at all (`unreachable`, also what a provider that THREW reports), a
+* camera whose SD card is not mounted (`no-storage`, measured on 640 —
+* `HddInfo mount 0`, honestly nothing to list rather than "no clips"), and a
+* camera whose OWN index disagrees with its OWN calendar (`index-empty`,
+* measured on 618: the calendar marks 3–20 September, days 6–20 list zero
+* files on both streams and both filters, with 177 GB free). That last one is
+* a defect ON THE CAMERA, and the only honest thing a provider can do is say
+* which days it asked for and got nothing — "no clips" would be a lie about a
+* card that is full of them.
+*/
+var ClipSourceAvailabilitySchema = z.object({
+	state: z.enum([
+		"ok",
+		"sleeping",
+		"unreachable",
+		"no-storage",
+		"index-empty"
+	]),
+	/** Free text, shown verbatim. Names the camera's own refusal when there is one. */
+	reason: z.string().optional(),
+	/** When this source's catalog was last CONFIRMED. A cached list is never
+	*  drawn as current: the surface shows the age whenever it is older than the
+	*  refresh interval. */
+	catalogAsOf: z.number().optional()
+});
+/**
+* One SOURCE of clips for a camera — a row of the picker, and the namespace
+* every clip id from it is prefixed with (`analytics`,
+* `native:reolink:onboard`, `hksv`, …).
+*
+* A provider lists the sources IT serves for that device, and answers for each
+* of them whether it can answer at all. A provider with nothing to offer on a
+* camera returns `[]` — it is not that camera's business.
+*/
+var ClipSourceSchema = z.object({
+	/** The value this source stamps on {@link ClipSchema.source}, and the prefix
+	*  of every clip id it mints. `getClipPlayback` routes on it. */
+	source: z.string(),
+	/** Operator-facing name of the source ("CamStack recordings", "SD card"). */
+	label: z.string(),
+	/**
+	* The addon that SERVES this row.
+	*
+	* A surface cannot otherwise resolve a source to who answers it, and the
+	* alternative — a `native:reolink:* → provider-reolink` table inside the
+	* widget — is a second authority on provider identity living in the one
+	* package with no business knowing it, wrong the day a third source appears
+	* (D557). One addon may serve SEVERAL sources: `addon-provider-reolink`
+	* answers a hub child with both `native:reolink:onboard` and
+	* `native:reolink:hub`, which is why the per-device switch is keyed by
+	* SOURCE and not by this (D555).
+	*
+	* Optional for version skew only. The collection dispatcher stamps it from
+	* the registry, so a row that travelled through the fan-out carries the
+	* authoritative id whatever the provider filled in.
+	*/
+	addonId: z.string().optional(),
+	/**
+	* Which API this source resolved to FOR THIS CAMERA, when it has a choice.
+	*
+	* A source may cover one store through more than one surface — the Reolink
+	* provider reads a hub child through the parent's event log and a standalone
+	* through its own file list, because that is what each camera answers. The
+	* CHOICE is the provider's, made from what the camera is, and is never a row
+	* the operator has to understand; but it is REPORTED, because a source that
+	* silently reads a different API on two cameras and then behaves differently
+	* is the thing nobody can debug later. Absent when the source has only one
+	* way to read its store.
+	*/
+	via: z.string().optional(),
+	availability: ClipSourceAvailabilitySchema,
+	/**
+	* The operator switched this source OFF for this camera.
+	*
+	* Deliberately NOT a member of {@link ClipSourceAvailabilitySchema}'s
+	* vocabulary. That enum models what the source CAN do — a sleeping camera, an
+	* unmounted card, an index that disagrees with its own calendar — and a
+	* switched-off source could answer perfectly well; the operator decided it
+	* should not. Folding the choice in is how `disabled` and `broken` stop being
+	* distinguishable, which is the D62 rule this repo has already paid for twice:
+	* an off switch is REPORTED off (`CameraStatus.switchedOff`, the same word),
+	* and disabled must never look like broken. It is also what lets every
+	* exhaustive consumer of the availability enum keep compiling.
+	*
+	* A switched-off source contributes NO clips (`listClips` never calls it) and
+	* its row carries no `catalogAsOf`: nothing confirms a catalog it is not
+	* allowed to serve, and a frozen age that can only grow draws a stalling
+	* source rather than an off switch.
+	*
+	* The row survives BECAUSE it is the control the operator switches the source
+	* back on from — D554 decision 4's rule ("a source that cannot answer
+	* produces a ROW, not an absence") applied to the one case D556 carved out of
+	* it, and D557's own kept property ("a source is never hidden, only its
+	* rows"). Absent means on.
+	*
+	* A provider never sets this — like {@link ClipSourceSchema.addonId} it is
+	* stamped by the collection dispatcher, which holds the registry's projection
+	* of the persisted authority (D556) and is the only place that knows it.
+	*/
+	switchedOff: z.boolean().optional()
+});
 var videoclipsCapability = {
 	name: "videoclips",
 	scope: "device",
-	mode: "singleton",
+	mode: "collection",
 	kind: "wrapper",
 	defaultActive: true,
 	/** A clip is a window over a camera's footage — the cap is meaningless on a
 	*  sensor, a button or an event emitter, and the `defaultActive` auto-bind
 	*  reads this to decide which devices it may claim. */
 	deviceTypes: [DeviceType.Camera],
+	/**
+	* The Clips section of a camera's device details is FRAMEWORK-DERIVED (D14):
+	* the aggregator turns this declaration into the `type:'widget'` section and
+	* `DeviceDetail.tsx` is never edited. `videoclips` is the first WRAPPER cap
+	* to declare one — every previous `host/` widget cap is `deviceNative` — so
+	* `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
+	* binding entry derives the same section a native one does.
+	*
+	* **It is a SECTION of the Recording tab, at the end of it — not a tab of
+	* its own.** It shipped as a `clips` top-tab and the operator rejected the
+	* placement: *"utilizzerei la stessa tab recordings, lì abbiamo già tutto il
+	* necessario, una nuova sezione alla fine per le clips"*. The Recording tab
+	* already holds the recorder's panel, the schedule bands and the unified
+	* retention policy; footage the camera itself holds is the same question,
+	* asked of a different store. `order: 100` puts it after all of them with
+	* room left in front. The `clips` entry in `WELL_KNOWN_TABS` went with it —
+	* a well-known id nobody declares is an invitation to mint the tab again.
+	*
+	* `topTab` stays: the browser owns a pane (a day's tiles, a source list and
+	* a player) and the Config tab's inner bar has no room for one. The widget
+	* itself is `host/clips-browser` in ui-library's `HOST_WIDGETS`, and because
+	* the admin Recordings page renders every `location:'top-tab'` +
+	* `tab:'recording'` section behind its camera picker
+	* (`CameraRecordingSettingsSection`), this declaration lands the section on
+	* BOTH surfaces with no second wiring.
+	*/
+	deviceConfig: { ui: {
+		kind: "widget",
+		widgetId: "host/clips-browser",
+		tab: "recording",
+		topTab: true,
+		label: "Clips",
+		order: 100
+	} },
 	methods: {
 		listClips: method(z.object({
 			deviceId: z.number(),
 			since: z.number(),
 			until: z.number(),
-			limit: z.number().int().positive().optional()
+			limit: z.number().int().positive().optional(),
+			/**
+			* WHICH provider to ask — the `addonId` a {@link ClipSourceSchema} row
+			* carries, never a source id and never a list.
+			*
+			* Absent means the device's BOUND provider, which is CamStack on every
+			* camera today because that is what `deviceManager.getBindings`
+			* answers with. A provider the device is not bound to is refused by
+			* name rather than answered by another one (D552's
+			* `rejectUnresolvedAddonPin` rule).
+			*
+			* It replaced `sources?: string[]`, a VIEW filter over source ids that
+			* assumed the answer was a fan-out over everything a camera has. The
+			* operator settled otherwise on 2026-09-20 — *"il get videoclips
+			* prendere un provider opzionale, di default va su camstack"*,
+			* *"l'utilizzatore è uno solo"* — so the list is asked of one provider
+			* at a time and there is nothing to filter out of it.
+			*/
+			provider: z.string().optional()
 		}), z.array(ClipSchema).readonly(), {
 			kind: "query",
-			auth: "admin"
+			auth: "protected"
+		}),
+		/**
+		* The sources this camera has, WITH the reason any of them cannot answer.
+		*
+		* Asked separately from `listClips` because an empty clip list is
+		* ambiguous and this is the only place the ambiguity is resolved: every
+		* bound provider contributes its own rows, and a provider that could not
+		* be reached at all still produces one row saying so. A surface that draws
+		* "no clips" without reading this is drawing a guess.
+		*/
+		listSources: method(z.object({ deviceId: z.number() }), z.array(ClipSourceSchema).readonly(), {
+			kind: "query",
+			auth: "protected"
 		}),
 		getClipPlayback: method(z.object({
 			deviceId: z.number(),
-			clipId: z.string()
+			clipId: z.string(),
+			/**
+			* Which twin to serve, on the ONE quality scale the system already has
+			* (`CamProfileSchema`). `low | mid` → the sub file, `high` → the main
+			* twin; both ids are already on the row so this never re-searches the
+			* camera. Absent means the provider's own default (the sub file, which
+			* every source is measured to hold).
+			*
+			* `auto` is deliberately NOT accepted here: a stored file has no
+			* broker session, so the adaptive tier cannot be resolved for it. The
+			* viewer resolves `auto` to a profile the same way live does, before
+			* it calls (D549 15).
+			*/
+			profile: CamProfileSchema.optional()
 		}), ClipPlaybackSchema, {
 			kind: "query",
-			auth: "admin"
+			auth: "protected"
 		})
 	}
 };
@@ -45989,6 +46315,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"videoclips.listSources": {
+		capName: "videoclips",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"viewerUi.getStaticDir": {
 		capName: "viewer-ui",
 		capScope: "system",
@@ -47997,6 +48329,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"videoclips.listSources": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"waterHeater.setAway": [{
 		name: "deviceId",
 		form: "single",
@@ -49119,4 +49456,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { deviceStateCapability as $, streamCatalogCapability as $t, StorageLocationModeSchema as A, readinessKey as An, motionCapability as At, bareAddonId as B, resolveLocationMode as Bt, RecordingStatusSchema as C, expandCapMethods as Cn, logDestinationCapability as Ct, STREAM_PROFILE_META as D, nodePin as Dn, mayWriteToLocation as Dt, STORAGE_ACCESS_FALLBACK as E, isEvent as En, mayReadLocation as Et, addonSettingsCapability as F, procedureAuthKey as Ft, coreBlockAddonId as G, scoreRuntimes as Gt, buildStreamParamsConfigSchema as H, runtimeStatePolicyFor as Ht, addonWidgetsCapability as I, ptzAutotrackCapability as It, dataStoreProviderCapability as J, snapshotCapability as Jt, coreBlockIdFromAddonId as K, settingsStoreCapability as Kt, alertsCapability as L, reducePoints as Lt, StorageMigrationJobSchema as M, scopeKey as Mn, objectInputDeclaresAddonId as Mt, UserRecordSchema as N, sleep as Nn, parseStreamParamsFormPatch as Nt, ScopedTokenSchema as O, parseJsonObject as On, metricsProviderCapability as Ot, addonPagesCapability as P, EventCategory as Pn, platformProbeCapability as Pt, deviceManagerCapability as Q, storageProviderCapability as Qt, authProviderCapability as R, resolveBucketMs as Rt, RUNTIME_DEFAULTS as S, emitReadiness as Sn, locationIconKey as St, SOURCE_DEVICE_TYPES as T, isDeviceConfigCap as Tn, looseSchema as Tt, cameraGridLayoutCapability as U, scopesAllowAddon as Ut, batteryCapability as V, resolveMethodAuth as Vt, collectSecretConfigKeys as W, scopesAllowDeviceCap as Wt, decodeVectorBase64 as X, storageMigrationCapability as Xt, declarationOwnerNodeId as Y, storageCapability as Yt, deriveBatteryPresence as Z, storageOccupancyCapability as Zt, LegacyStorageLocationDefaultSchema as _, asJsonObject as _n, isVoidInput as _t, BatteryStatusSchema as a, errMsg as an, evaluateSensorEdge as at, MOTION_CLOSE_AFTER_MS as b, createEvent as bn, lifecycleJobSchema as bt, CORE_BLOCKS_ADDON_ID as c, DATAPLANE_SECRET_HEADER as cn, filesystemBrowseCapability as ct, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as d, DeviceFeature as dn, isArrayOutputSchema as dt, streamQualityLabel as en, deviceStatusCapability as et, DERIVED_CAMERA_SILENCED_CAP_NAMES as f, DeviceRole as fn, isCollectionArrayMethod as ft, LOG_LEVEL_RANK as g, WELL_KNOWN_TAB_MAP as gn, isSourceCap as gt, FIRST_LEVEL_MACRO_CLASSES as h, ReadinessTimeoutError as hn, isSameAddonId as ht, BaseDevice as i, withLocationMode as in, enumerateSchemaFields as it, StorageLocationTypeSchema as j, resolveCapMount as jn, normalizeUnit as jt, StorageCleanupJobSchema as k, parseJsonUnknown as kn, modeMayWrite as kt, CORE_BLOCK_ADDON_PREFIX as l, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ln, foldSnapshotByFunction as lt, DeviceStatusSchema as m, ReadinessRegistry as mn, isObjectInput as mt, AlertSchema as n, vectorDimFromBase64 as nn, enumerateInferenceDevices as nt, CAMERA_SWITCH_ORDER as o, buildFfmpegArgs as on, evictionPolicyOfLocation as ot, DeclaredDevices as p, DeviceType as pn, isLocationEnabled as pt, coreBlocksCapability as q, siteZoneKey as qt, ApiKeyRecordSchema as r, vectorStoreCapability as rn, enumerateItemArrayFields as rt, CAP_NAMES_WITH_STATUS as s, BaseAddon as sn, extractNestedAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, userManagementCapability as tn, doorbellCapability as tt, CoreBlockSchema as u, DEVICE_STATUS_METHOD as un, gbToBytes as ut, LocationIconIdSchema as v, asNumber as vn, kebabToCamel as vt, SOURCE_CAPS as w, hydrateSchema as wn, logLevelAtMost as wt, REDACTED_SECRET as x, emitDownForOwnedCaps as xn, localNetworkCapability as xt, METHOD_ACCESS_MAP as y, asString as yn, legacyModeOf as yt, backupCapability as z, resolveContainerPrimaryChild as zt };
+export { deviceStateCapability as $, storageProviderCapability as $t, StorageLocationModeSchema as A, parseJsonUnknown as An, motionCapability as At, bareAddonId as B, resolveContainerPrimaryChild as Bt, RecordingStatusSchema as C, emitReadiness as Cn, logDestinationCapability as Ct, STREAM_PROFILE_META as D, isEvent as Dn, mayWriteToLocation as Dt, STORAGE_ACCESS_FALLBACK as E, isDeviceConfigCap as En, mayReadLocation as Et, addonSettingsCapability as F, EventCategory as Fn, platformProbeCapability as Ft, coreBlockAddonId as G, scopesAllowDeviceCap as Gt, buildStreamParamsConfigSchema as H, resolveMethodAuth as Ht, addonWidgetsCapability as I, procedureAuthKey as It, dataStoreProviderCapability as J, siteZoneKey as Jt, coreBlockIdFromAddonId as K, scoreRuntimes as Kt, alertsCapability as L, ptzAutotrackCapability as Lt, StorageMigrationJobSchema as M, resolveCapMount as Mn, objectInputDeclaresAddonId as Mt, UserRecordSchema as N, scopeKey as Nn, objectInputDeclaresRequiredDeviceId as Nt, ScopedTokenSchema as O, nodePin as On, metricsProviderCapability as Ot, addonPagesCapability as P, sleep as Pn, parseStreamParamsFormPatch as Pt, deviceManagerCapability as Q, storageOccupancyCapability as Qt, authProviderCapability as R, reducePoints as Rt, RUNTIME_DEFAULTS as S, emitDownForOwnedCaps as Sn, locationIconKey as St, SOURCE_DEVICE_TYPES as T, hydrateSchema as Tn, looseSchema as Tt, cameraGridLayoutCapability as U, runtimeStatePolicyFor as Ut, batteryCapability as V, resolveLocationMode as Vt, collectSecretConfigKeys as W, scopesAllowAddon as Wt, decodeVectorBase64 as X, storageCapability as Xt, declarationOwnerNodeId as Y, snapshotCapability as Yt, deriveBatteryPresence as Z, storageMigrationCapability as Zt, LegacyStorageLocationDefaultSchema as _, WELL_KNOWN_TAB_MAP as _n, isVoidInput as _t, BatteryStatusSchema as a, withLocationMode as an, evaluateSensorEdge as at, MOTION_CLOSE_AFTER_MS as b, asString as bn, lifecycleJobSchema as bt, CORE_BLOCKS_ADDON_ID as c, BaseAddon as cn, filesystemBrowseCapability as ct, DEFAULT_FIRST_SIGHTING_FRESHNESS_MS as d, DEVICE_STATUS_METHOD as dn, isArrayOutputSchema as dt, streamCatalogCapability as en, deviceStatusCapability as et, DERIVED_CAMERA_SILENCED_CAP_NAMES as f, DeviceFeature as fn, isCollectionArrayMethod as ft, LOG_LEVEL_RANK as g, ReadinessTimeoutError as gn, isSourceCap as gt, FIRST_LEVEL_MACRO_CLASSES as h, ReadinessRegistry as hn, isSameAddonId as ht, BaseDevice as i, vectorStoreCapability as in, enumerateSchemaFields as it, StorageLocationTypeSchema as j, readinessKey as jn, normalizeUnit as jt, StorageCleanupJobSchema as k, parseJsonObject as kn, modeMayWrite as kt, CORE_BLOCK_ADDON_PREFIX as l, DATAPLANE_SECRET_HEADER as ln, foldSnapshotByFunction as lt, DeviceStatusSchema as m, DeviceType as mn, isObjectInput as mt, AlertSchema as n, userManagementCapability as nn, enumerateInferenceDevices as nt, CAMERA_SWITCH_ORDER as o, errMsg as on, evictionPolicyOfLocation as ot, DeclaredDevices as p, DeviceRole as pn, isLocationEnabled as pt, coreBlocksCapability as q, settingsStoreCapability as qt, ApiKeyRecordSchema as r, vectorDimFromBase64 as rn, enumerateItemArrayFields as rt, CAP_NAMES_WITH_STATUS as s, buildFfmpegArgs as sn, extractNestedAddonId as st, ALL_CAPABILITY_DEFINITIONS as t, streamQualityLabel as tn, doorbellCapability as tt, CoreBlockSchema as u, DEVICE_SETTINGS_CONTRIBUTION_METHODS as un, gbToBytes as ut, LocationIconIdSchema as v, asJsonObject as vn, kebabToCamel as vt, SOURCE_CAPS as w, expandCapMethods as wn, logLevelAtMost as wt, REDACTED_SECRET as x, createEvent as xn, localNetworkCapability as xt, METHOD_ACCESS_MAP as y, asNumber as yn, legacyModeOf as yt, backupCapability as z, resolveBucketMs as zt };

package/dist/index.d.ts

@@ -16,6 +16,13 @@ export { AlertCenterAddon } from './builtins/alerts/index.js';
 export { ConsoleDestination, ConsoleLoggingAddon } from './builtins/console-logging/index.js';
 export { CoreBlocksAddon } from './builtins/core-blocks/index.js';
 export { DeviceManagerAddon } from './builtins/device-manager/index.js';
+/**
+ * The per-device wrapper activation (D556). Exported because it is the
+ * OPERATOR-FACING verb and the only writer of the registry's per-device source
+ * projection — a spec that proves "activate, then list" must be able to drive
+ * the real one, not a re-implementation of it.
+ */
+export { setWrapperActive, type WrapperActivationDeps, type WrapperActivationInput, } from './builtins/device-manager/device-source-activation.js';
 export { HubForwarderAddon, HubForwarderDestination } from './builtins/hub-forwarder/index.js';
 export { LivenessMonitorAddon } from './builtins/liveness-monitor/index.js';
 export { LocalAuthAddon } from './builtins/local-auth/index.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CYXhwfDf.js");
+const require_dist = require("./dist-Bu8HN-KS.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -5892,8 +5892,22 @@ var CapabilityRegistry = class CapabilityRegistry {
 	singletonNodeOverrides = /* @__PURE__ */ new Map();
 	/** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
 	nodeConfigReader = null;
-	/** Per-device collection filters: deviceId → (capability → addonIds[]) */
-	deviceCollectionFilters = /* @__PURE__ */ new Map();
+	/**
+	* Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+	*
+	* The in-memory PROJECTION of the persisted wrapper activation
+	* (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+	* `setWrapperActive`), and never an authority of its own —
+	* [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+	* Nothing but `device-source-activation.ts` writes it: the operator's verb
+	* is `deviceManager.setWrapperActive`, and a second writable surface here is
+	* exactly the two-authorities defect D62 exists for.
+	*
+	* A DENY list, not an allow list, and that is the deliberate answer to what
+	* "unset" means: a source nobody has ruled out is a source. An untouched
+	* camera keeps every provider it has today, and a provider that registers
+	* after the operator's last toggle needs no second write to be seen.
+	*/
 	/** autoActivate flags per (capability, addonId) — from addon manifests */
 	autoActivateFlags = /* @__PURE__ */ new Map();
 	/**
@@ -6789,54 +6803,24 @@ var CapabilityRegistry = class CapabilityRegistry {
 		for (const [addonId, provider] of state.providers) if (this.isActiveForSystem(capability, addonId)) return asProvider(provider);
 		return null;
 	}
-	/** Set a per-device collection filter. */
-	setDeviceCollectionFilter(deviceId, capability, addonIds) {
-		if (!this.capabilities.get(capability)) {
-			this.logger.warn("Cannot set device collection filter for undeclared capability", { meta: { capability } });
-			return;
-		}
-		let deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) {
-			deviceMap = /* @__PURE__ */ new Map();
-			this.deviceCollectionFilters.set(deviceId, deviceMap);
-		}
-		deviceMap.set(capability, [...addonIds]);
-		this.logger.info("Device collection filter set", {
-			tags: { deviceId: Number(deviceId) },
-			meta: {
-				capability,
-				addonIds
-			}
-		});
-	}
-	/** Clear a per-device collection filter. */
-	clearDeviceCollectionFilter(deviceId, capability) {
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) return;
-		deviceMap.delete(capability);
-		if (deviceMap.size === 0) this.deviceCollectionFilters.delete(deviceId);
-		this.logger.info("Device collection filter cleared", {
-			tags: { deviceId: Number(deviceId) },
-			meta: { capability }
-		});
-	}
 	/**
 	* Resolve collection providers for a specific device.
-	* Filters by activation (the manifest's autoActivate) and optional collection filter.
+	*
+	* Filters by activation (the manifest's autoActivate) and by nothing else.
+	* The per-device DENY set that used to filter here is gone with the switch
+	* it projected (2026-09-20): *"tutti i providers funzionano sempre"*. WHICH
+	* providers a device has is now answered by its BINDINGS
+	* (`device-bindings-store.ts` step 0), which is a different question from
+	* which of them are registered and running — this one.
+	*
+	* `deviceId` is kept in the signature and deliberately unused: the resolution
+	* is per-device by CONTRACT, and a caller that stops passing one is a caller
+	* that has stopped asking about a device.
 	*/
-	resolveCollectionForDevice(capability, deviceId) {
+	resolveCollectionForDevice(capability, _deviceId) {
 		const state = this.capabilities.get(capability);
 		if (!state || state.definition.mode !== "collection") return [];
-		let entries = [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId));
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (deviceMap) {
-			const filterAddonIds = deviceMap.get(capability);
-			if (filterAddonIds) {
-				const filterSet = new Set(filterAddonIds);
-				entries = entries.filter(([addonId]) => filterSet.has(addonId));
-			}
-		}
-		return entries.map(([, provider]) => asProvider(provider));
+		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId)).map(([, provider]) => asProvider(provider));
 	}
 	/** Check if all dependencies for a capability are satisfied. */
 	areDependenciesMet(capabilityName) {
@@ -7000,6 +6984,35 @@ var CapabilityRegistry = class CapabilityRegistry {
 function systemMountKindFor(def) {
 	return def.mode === "collection" ? "collection" : "singleton";
 }
+/**
+* The mount kind ONE method resolves through — the cap's mount, except where
+* the method cannot be dispatched per device.
+*
+* Two ways a method leaves a per-device mount for the cap's SYSTEM provider:
+*
+*  - `systemOnly: true` — declared via the `systemMethod()` factory. The
+*    author said so; it wins everywhere, including on a `device-native` cap
+*    (`snapshot.getSnapshotOverview`).
+*  - a `device-scoped` cap's method whose input declares no top-level REQUIRED
+*    numeric `deviceId`. The per-device dispatcher demands one on every call
+*    (`requireDeviceScoped`), so such a method would answer BAD_REQUEST
+*    "input must carry numeric deviceId" for every caller — unreachable. It
+*    names no device, so there is no per-device provider to resolve: the cap's
+*    hub-resident system/wrapper provider is the only honest destination, and
+*    it is where that method already resolved before the mount was fixed.
+*
+* NOT applied to `device-native`, deliberately: there the native IS the device
+* and a deviceId-less method is a definition error the author must resolve
+* with `systemMethod()` — which is what `snapshot` does. This rule exists for
+* the mount kind that was DERIVED under caps that never opted in, where a
+* silent 400 would be a regression introduced by the derivation itself.
+*/
+function methodMountKindFor(def, mountKind, method) {
+	if (method.schema.systemOnly === true) return systemMountKindFor(def);
+	if (mountKind !== "device-scoped") return mountKind;
+	if (require_dist.objectInputDeclaresRequiredDeviceId(method.schema.input)) return mountKind;
+	return systemMountKindFor(def);
+}
 function methodsFor(def) {
 	const effective = require_dist.expandCapMethods(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -7126,12 +7139,11 @@ function requireLocal(capName, getLocal, services) {
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
 	const mount = require_dist.resolveCapMount(def);
-	const systemMountKind = systemMountKindFor(def);
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
 		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
-		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
+		const effectiveMountKind = methodMountKindFor(def, mount.kind, method);
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
 		const base = primitives.procedures[require_dist.procedureAuthKey(method.auth)];
@@ -96220,6 +96232,7 @@ exports.selectReportedSpaces = require_manifest_system_deps.selectReportedSpaces
 exports.serializeTypedArrays = require_manifest_system_deps.serializeTypedArrays;
 exports.setHubConnected = require_manifest_system_deps.setHubConnected;
 exports.setNodeEventInterest = require_manifest_system_deps.setNodeEventInterest;
+exports.setWrapperActive = require_builtins_device_manager_device_manager_addon.setWrapperActive;
 exports.shouldReclaim = require_manifest_system_deps.shouldReclaim;
 exports.socketDirectionBytes = require_manifest_system_deps.socketDirectionBytes;
 exports.socketDirectionMessages = require_manifest_system_deps.socketDirectionMessages;