@camstack/system 1.2.275 → 1.2.277

package/dist/index.mjs

@@ -1,12 +1,12 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { An as readinessKey, Cn as expandCapMethods, F as addonSettingsCapability, Ft as procedureAuthKey, Mn as scopeKey, Mt as objectInputDeclaresAddonId, On as parseJsonObject, Pn as EventCategory$1, S as RUNTIME_DEFAULTS, Tt as looseSchema, Ut as scopesAllowAddon, Vt as resolveMethodAuth, Wt as scopesAllowDeviceCap, _n as asJsonObject$1, _t as isVoidInput, an as errMsg$1, bn as createEvent, bt as lifecycleJobSchema, cn as DATAPLANE_SECRET_HEADER$1, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, hn as ReadinessTimeoutError, jn as resolveCapMount, kn as parseJsonUnknown, ln as DEVICE_SETTINGS_CONTRIBUTION_METHODS, mn as ReadinessRegistry, mt as isObjectInput, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_STATUS_METHOD, vn as asNumber, vt as kebabToCamel, wt as logLevelAtMost, xn as emitDownForOwnedCaps, y as METHOD_ACCESS_MAP, yn as asString$1 } from "./dist-DWSJVcZe.mjs";
+import { An as parseJsonUnknown, F as addonSettingsCapability, Fn as EventCategory$1, Gt as scopesAllowDeviceCap, Ht as resolveMethodAuth, It as procedureAuthKey, Mn as resolveCapMount, Mt as objectInputDeclaresAddonId, Nn as scopeKey, Nt as objectInputDeclaresRequiredDeviceId, S as RUNTIME_DEFAULTS, Sn as emitDownForOwnedCaps, Tt as looseSchema, Wt as scopesAllowAddon, _t as isVoidInput, bn as asString$1, bt as lifecycleJobSchema, dn as DEVICE_STATUS_METHOD, dt as isArrayOutputSchema, ft as isCollectionArrayMethod, g as LOG_LEVEL_RANK, gn as ReadinessTimeoutError, hn as ReadinessRegistry, jn as readinessKey, kn as parseJsonObject, ln as DATAPLANE_SECRET_HEADER$1, mt as isObjectInput, on as errMsg$1, st as extractNestedAddonId, t as ALL_CAPABILITY_DEFINITIONS, un as DEVICE_SETTINGS_CONTRIBUTION_METHODS, vn as asJsonObject$1, vt as kebabToCamel, wn as expandCapMethods, wt as logLevelAtMost, xn as createEvent, y as METHOD_ACCESS_MAP, yn as asNumber } from "./dist-DOF9wnat.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
 import { ConsoleDestination, ConsoleLoggingAddon } from "./builtins/console-logging/index.mjs";
 import { CoreBlocksAddon } from "./builtins/core-blocks/core-blocks.addon.mjs";
 import "./builtins/core-blocks/index.mjs";
-import { DeviceManagerAddon } from "./builtins/device-manager/device-manager.addon.mjs";
+import { DeviceManagerAddon, t as setWrapperActive } from "./builtins/device-manager/device-manager.addon.mjs";
 import "./builtins/device-manager/index.mjs";
 import { HubForwarderAddon, HubForwarderDestination } from "./builtins/hub-forwarder/index.mjs";
 import { LivenessMonitorAddon } from "./builtins/liveness-monitor/liveness-monitor.addon.mjs";
@@ -5885,8 +5885,22 @@ var CapabilityRegistry = class CapabilityRegistry {
 	singletonNodeOverrides = /* @__PURE__ */ new Map();
 	/** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
 	nodeConfigReader = null;
-	/** Per-device collection filters: deviceId → (capability → addonIds[]) */
-	deviceCollectionFilters = /* @__PURE__ */ new Map();
+	/**
+	* Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+	*
+	* The in-memory PROJECTION of the persisted wrapper activation
+	* (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+	* `setWrapperActive`), and never an authority of its own —
+	* [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+	* Nothing but `device-source-activation.ts` writes it: the operator's verb
+	* is `deviceManager.setWrapperActive`, and a second writable surface here is
+	* exactly the two-authorities defect D62 exists for.
+	*
+	* A DENY list, not an allow list, and that is the deliberate answer to what
+	* "unset" means: a source nobody has ruled out is a source. An untouched
+	* camera keeps every provider it has today, and a provider that registers
+	* after the operator's last toggle needs no second write to be seen.
+	*/
 	/** autoActivate flags per (capability, addonId) — from addon manifests */
 	autoActivateFlags = /* @__PURE__ */ new Map();
 	/**
@@ -6782,54 +6796,24 @@ var CapabilityRegistry = class CapabilityRegistry {
 		for (const [addonId, provider] of state.providers) if (this.isActiveForSystem(capability, addonId)) return asProvider(provider);
 		return null;
 	}
-	/** Set a per-device collection filter. */
-	setDeviceCollectionFilter(deviceId, capability, addonIds) {
-		if (!this.capabilities.get(capability)) {
-			this.logger.warn("Cannot set device collection filter for undeclared capability", { meta: { capability } });
-			return;
-		}
-		let deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) {
-			deviceMap = /* @__PURE__ */ new Map();
-			this.deviceCollectionFilters.set(deviceId, deviceMap);
-		}
-		deviceMap.set(capability, [...addonIds]);
-		this.logger.info("Device collection filter set", {
-			tags: { deviceId: Number(deviceId) },
-			meta: {
-				capability,
-				addonIds
-			}
-		});
-	}
-	/** Clear a per-device collection filter. */
-	clearDeviceCollectionFilter(deviceId, capability) {
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (!deviceMap) return;
-		deviceMap.delete(capability);
-		if (deviceMap.size === 0) this.deviceCollectionFilters.delete(deviceId);
-		this.logger.info("Device collection filter cleared", {
-			tags: { deviceId: Number(deviceId) },
-			meta: { capability }
-		});
-	}
 	/**
 	* Resolve collection providers for a specific device.
-	* Filters by activation (the manifest's autoActivate) and optional collection filter.
+	*
+	* Filters by activation (the manifest's autoActivate) and by nothing else.
+	* The per-device DENY set that used to filter here is gone with the switch
+	* it projected (2026-09-20): *"tutti i providers funzionano sempre"*. WHICH
+	* providers a device has is now answered by its BINDINGS
+	* (`device-bindings-store.ts` step 0), which is a different question from
+	* which of them are registered and running — this one.
+	*
+	* `deviceId` is kept in the signature and deliberately unused: the resolution
+	* is per-device by CONTRACT, and a caller that stops passing one is a caller
+	* that has stopped asking about a device.
 	*/
-	resolveCollectionForDevice(capability, deviceId) {
+	resolveCollectionForDevice(capability, _deviceId) {
 		const state = this.capabilities.get(capability);
 		if (!state || state.definition.mode !== "collection") return [];
-		let entries = [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId));
-		const deviceMap = this.deviceCollectionFilters.get(deviceId);
-		if (deviceMap) {
-			const filterAddonIds = deviceMap.get(capability);
-			if (filterAddonIds) {
-				const filterSet = new Set(filterAddonIds);
-				entries = entries.filter(([addonId]) => filterSet.has(addonId));
-			}
-		}
-		return entries.map(([, provider]) => asProvider(provider));
+		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId)).filter(([addonId]) => this.isActiveForSystem(capability, addonId)).map(([, provider]) => asProvider(provider));
 	}
 	/** Check if all dependencies for a capability are satisfied. */
 	areDependenciesMet(capabilityName) {
@@ -6993,6 +6977,35 @@ var CapabilityRegistry = class CapabilityRegistry {
 function systemMountKindFor(def) {
 	return def.mode === "collection" ? "collection" : "singleton";
 }
+/**
+* The mount kind ONE method resolves through — the cap's mount, except where
+* the method cannot be dispatched per device.
+*
+* Two ways a method leaves a per-device mount for the cap's SYSTEM provider:
+*
+*  - `systemOnly: true` — declared via the `systemMethod()` factory. The
+*    author said so; it wins everywhere, including on a `device-native` cap
+*    (`snapshot.getSnapshotOverview`).
+*  - a `device-scoped` cap's method whose input declares no top-level REQUIRED
+*    numeric `deviceId`. The per-device dispatcher demands one on every call
+*    (`requireDeviceScoped`), so such a method would answer BAD_REQUEST
+*    "input must carry numeric deviceId" for every caller — unreachable. It
+*    names no device, so there is no per-device provider to resolve: the cap's
+*    hub-resident system/wrapper provider is the only honest destination, and
+*    it is where that method already resolved before the mount was fixed.
+*
+* NOT applied to `device-native`, deliberately: there the native IS the device
+* and a deviceId-less method is a definition error the author must resolve
+* with `systemMethod()` — which is what `snapshot` does. This rule exists for
+* the mount kind that was DERIVED under caps that never opted in, where a
+* silent 400 would be a regression introduced by the derivation itself.
+*/
+function methodMountKindFor(def, mountKind, method) {
+	if (method.schema.systemOnly === true) return systemMountKindFor(def);
+	if (mountKind !== "device-scoped") return mountKind;
+	if (objectInputDeclaresRequiredDeviceId(method.schema.input)) return mountKind;
+	return systemMountKindFor(def);
+}
 function methodsFor(def) {
 	const effective = expandCapMethods(def);
 	return Object.entries(effective).map(([name, schema]) => {
@@ -7119,12 +7132,11 @@ function requireLocal(capName, getLocal, services) {
 function buildOneCapRouter(def, primitives, services) {
 	const capName = def.name;
 	const mount = resolveCapMount(def);
-	const systemMountKind = systemMountKindFor(def);
 	const nodeIdData = def.nodeIdMode === "data";
 	const procedures = {};
 	for (const method of methodsFor(def)) {
 		if (method.callerRequired && (method.kind === "subscription" || !method.isObject)) throw new Error(`Cap "${capName}" method "${method.name}": caller: 'required' is only supported on query/mutation methods with an object input schema`);
-		const effectiveMountKind = method.schema.systemOnly === true ? systemMountKind : mount.kind;
+		const effectiveMountKind = methodMountKindFor(def, mount.kind, method);
 		const isCollection = effectiveMountKind === "collection";
 		const getLocal = (ctx, addonId) => services.getLocalProvider(capName, effectiveMountKind, ctx, addonId);
 		const base = primitives.procedures[procedureAuthKey(method.auth)];
@@ -95817,4 +95829,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, ARRAY_BUFFER_CENSUS_COOLDOWN_MS, ARRAY_BUFFER_CENSUS_SUSTAIN_MS, ARRAY_BUFFER_CENSUS_THRESHOLD_MB, ARRAY_BUFFER_RELEASE_MIN_DROP_RATIO, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CAP_ACTION_OVERFLOW_LABEL, CAP_ACTION_UNLABELLED, CA_COMMON_NAME, CA_VALIDITY_DAYS, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DECISIVE_HEAP_SPACES, DEFAULT_DATA_PATH, DEFAULT_LAN_HTTP_PORT, DEFAULT_LOG_LEVEL, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EMPTY_CAP_ACTION_READING, EMPTY_SOCKET_DIRECTION, EMPTY_SOCKET_PLANE_BASELINE, EVENT_PLANE_TOP_N, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_SPACE_REPORT_MIN_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HUB_MAIN_HEAP_WATCH_LABEL, HUB_MAIN_RSS_BUDGET_MB, HUB_RSS_BUDGET_ENV, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LEAF_RENEWAL_WINDOW_DAYS, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LoggingGate, LokiDestination, LokiLoggingAddon, MAX_CAP_ACTIONS_PER_PEER, MAX_LEAF_VALIDITY_DAYS, MESH_QUEUE_TOP_N, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, OUTBOUND_QUEUE_COOLDOWN_MS, OUTBOUND_QUEUE_SUSTAIN_MS, OUTBOUND_QUEUE_THRESHOLD_BYTES, PARENT_ROUTED_PROVIDER_ADDON_ID, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RSS_BUDGET_REANNOUNCE_MIN_MS, RSS_BUDGET_RELEASE_RATIO, RUNNER_HEAP_WATCH_INTERVAL_MS, RUNNER_RSS_BUDGET_ENV, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, SERVER_AUTH_OID, SOCKET_PLANE_TOP_N, SOCKET_QUEUE_TOP_N, STALL_REPORT_MS, STALL_TICK_MS, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, ZERO_LOOP_DELAY, __resetCapUsageRegistryForTests, __resetLoggingGateForTests, adaptBrokerToCluster, addonSettingsCapability, allFamiliesListenHost, applyLanHttp, attributeStall, bindPendingLanHttp, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildNpmChildEnv, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, canServeDataPlane, capActionLabel, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, closeLanHttp, clusterEventTopic, clusterSecretMatches, collectCertIdentity, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createArrayBufferCensusGate, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCapActionCensus, createCoreCapService, createDeferredHeapWatchSink, createDoorSettingsView, createEventPlaneMeter, createEventPlaneReader, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createInspectorArrayBufferCensus, createKernelHwAccel, createLocalTransport, createLoopDelayMeter, createMeshQueueReader, createOutboundQueueGate, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createSocketDirectionCounters, createSocketPlaneMeter, createSocketPlaneReader, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, describeRss, detectWorkspacePackagesDir, deviceCapResolverLink, diffCapActionCensus, diffEventPlane, diffSocketPlane, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, emitHeapDiagnosticReport, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, evaluateExistingCert, expandCapMethods, fetchJson, findInPath, formatArrayBufferCensus, formatEventPlane, formatHeapSpaces, formatLogLine, formatMeshQueue, formatOutboundQueueVerdict, formatSocketPlane, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getLoggingGate, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, heapSpaceField, hubMainRssBudget, installManifestNativeDeps, installManifestPythonDeps, installManifestSystemDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcParentLink, isAddonDeploySource, isArrayBufferCensusReport, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, isolatedBuiltinPhase, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, nextRssBudgetState, parseCapAction, parseRangeHeader, parseRssBudgetMb, parseTokenizedUrl, partitionIsolatedBuiltinIds, proxyToUpstream, quarantineAddonResidue, readExtraSans, readHeapSpaces, readLanHttpState, readMoleculerFanoutMode, readPendingRestart, readSocketQueues, readTlsAccessStatus, readTlsMode, readinessKey, reclaimIntervalMs, recordSocketFrame, registerEventBusService, registerLanHttpHandler, reissueTlsLeaf, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runHubAddonBoot, runNpm, sampleSocketDirection, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, selectReportedSpaces, serializeTypedArrays, setHubConnected, setNodeEventInterest, setWrapperActive, shouldReclaim, socketDirectionBytes, socketDirectionMessages, startEventLoopStallMonitor, startHeapWatch, startRunnerHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, validateUploadedTls, waitUntilReady, writeExtraSans, writePendingRestart, writeTlsMode };

package/dist/kernel/capability-registry.d.ts

@@ -59,8 +59,22 @@ export declare class CapabilityRegistry {
     private readonly singletonNodeOverrides;
     /** Optional reader for persisted per-node overrides: (cap, nodeId) → addonId. */
     private nodeConfigReader;
-    /** Per-device collection filters: deviceId → (capability → addonIds[]) */
-    private readonly deviceCollectionFilters;
+    /**
+     * Per-device SOURCE deactivations: deviceId → (capability → disabled addon ids).
+     *
+     * The in-memory PROJECTION of the persisted wrapper activation
+     * (`deviceBindings[deviceId][capName].disabledSourceAddonIds`, written by
+     * `setWrapperActive`), and never an authority of its own —
+     * [D556](../../../../docs/decisions/adr-0556-a-per-device-source-switch-is-the-wrapper-activation-and-the-registry-holds-only-its-projection.md).
+     * Nothing but `device-source-activation.ts` writes it: the operator's verb
+     * is `deviceManager.setWrapperActive`, and a second writable surface here is
+     * exactly the two-authorities defect D62 exists for.
+     *
+     * A DENY list, not an allow list, and that is the deliberate answer to what
+     * "unset" means: a source nobody has ruled out is a source. An untouched
+     * camera keeps every provider it has today, and a provider that registers
+     * after the operator's last toggle needs no second write to be seen.
+     */
     /** autoActivate flags per (capability, addonId) — from addon manifests */
     private readonly autoActivateFlags;
     /**
@@ -465,15 +479,21 @@ export declare class CapabilityRegistry {
      * singleton override — the in-memory provider pin, not a persisted flag.
      */
     resolveForDevice<T = unknown>(capability: string, deviceId: string): T | null;
-    /** Set a per-device collection filter. */
-    setDeviceCollectionFilter(deviceId: string, capability: string, addonIds: string[]): void;
-    /** Clear a per-device collection filter. */
-    clearDeviceCollectionFilter(deviceId: string, capability: string): void;
     /**
      * Resolve collection providers for a specific device.
-     * Filters by activation (the manifest's autoActivate) and optional collection filter.
+     *
+     * Filters by activation (the manifest's autoActivate) and by nothing else.
+     * The per-device DENY set that used to filter here is gone with the switch
+     * it projected (2026-09-20): *"tutti i providers funzionano sempre"*. WHICH
+     * providers a device has is now answered by its BINDINGS
+     * (`device-bindings-store.ts` step 0), which is a different question from
+     * which of them are registered and running — this one.
+     *
+     * `deviceId` is kept in the signature and deliberately unused: the resolution
+     * is per-device by CONTRACT, and a caller that stops passing one is a caller
+     * that has stopped asking about a device.
      */
-    resolveCollectionForDevice<T = unknown>(capability: string, deviceId: string): readonly T[];
+    resolveCollectionForDevice<T = unknown>(capability: string, _deviceId: string): readonly T[];
     /** Check if all dependencies for a capability are satisfied. */
     areDependenciesMet(capabilityName: string): boolean;
     /** Get topologically sorted boot order based on dependsOn. */

package/dist/{retired-settings-keys-DEFtUH8o.js → retired-settings-keys-BwE6S2eQ.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-CYXhwfDf.js");
+const require_dist = require("./dist-Bu8HN-KS.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-BHGnCLW0.mjs → retired-settings-keys-DXMfts8c.mjs}

@@ -1,4 +1,4 @@
-import { _n as asJsonObject } from "./dist-DWSJVcZe.mjs";
+import { vn as asJsonObject } from "./dist-DOF9wnat.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.275",
+  "version": "1.2.277",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -392,7 +392,6 @@
     "@camstack/sdk": "*",
     "@camstack/types": "*",
     "@msgpack/msgpack": "^3.1.3",
-    "@peculiar/x509": "^1.14.3",
     "@trpc/client": "^11.16.0",
     "@trpc/server": "^11.16.0",
     "bcryptjs": "^3.0.3",
@@ -416,6 +415,7 @@
   },
   "devDependencies": {
     "@camstack/types": "*",
+    "@peculiar/x509": "^1.14.3",
     "@types/bcryptjs": "^2.4.6",
     "@types/better-sqlite3": "^7.6.13",
     "@types/js-yaml": "^4.0.9",