@camstack/system 1.2.304 → 1.2.306

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,5 +1,5 @@
-import { $t as siteZoneKey, A as STREAM_PROFILE_META, Bn as EventCategory, Bt as parseStreamParamsFormPatch, G as buildStreamParamsConfigSchema, Jt as runtimeStatePolicyFor, Lt as normalizeUnit, Ot as locationIconKey, Sn as WELL_KNOWN_TAB_MAP, _n as DeviceFeature, d as DAY_NAMES, dn as errMsg, h as DeviceStatusSchema, jn as isDeviceConfigCap, mt as formatMinutes, nt as deviceStateCapability, o as CAMERA_SWITCH_ORDER, ot as enumerateItemArrayFields, pn as BaseAddon, rt as deviceStatusCapability, s as CAP_NAMES_WITH_STATUS, st as enumerateSchemaFields, t as ALL_CAPABILITY_DEFINITIONS, tt as deviceManagerCapability, ut as expandContainer, vn as DeviceRole, wt as legacyAutoLinkIds, x as MINUTES_PER_DAY, y as LocationIconIdSchema, yn as DeviceType, zn as sleep$1 } from "../../dist-Duqf80QM.mjs";
-import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-CeO_dBHU.mjs";
+import { At as locationIconKey, Et as legacyAutoLinkIds, Hn as sleep$1, Ht as parseStreamParamsFormPatch, Pn as isDeviceConfigCap, Sn as DeviceType, Tn as WELL_KNOWN_TAB_MAP, Un as EventCategory, W as buildStreamParamsConfigSchema, X as createDeviceExtensionProvider, Xt as runtimeStatePolicyFor, at as deviceStatusCapability, bn as DeviceFeature, ct as enumerateItemArrayFields, d as DAY_NAMES, et as defineExtensionSlotProvider, ft as expandContainer, gn as BaseAddon, gt as formatMinutes, h as DeviceStatusSchema, it as deviceStateCapability, k as STREAM_PROFILE_META, lt as enumerateSchemaFields, mn as errMsg, nt as deviceExtensionCapability, o as CAMERA_SWITCH_ORDER, rt as deviceManagerCapability, s as CAP_NAMES_WITH_STATUS, t as ALL_CAPABILITY_DEFINITIONS, tn as siteZoneKey, x as MINUTES_PER_DAY, xn as DeviceRole, y as LocationIconIdSchema, zt as normalizeUnit } from "../../dist-CLfJMMdf.mjs";
+import { n as purgeRetiredSettingsRows } from "../../retired-settings-keys-C1ODcdnr.mjs";
 import { randomUUID } from "node:crypto";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 //#region src/builtins/device-manager/adoption-job-engine.ts
@@ -2715,6 +2715,16 @@ var LINKED_IDS_CONFIG_KEY = "_linkedDeviceIds";
 *  explicit operator OPT-IN (2026-07-22 flip: the old absent⇒ALL default
 *  auto-materialized sensor snapshots the operator never asked for). */
 var LINKED_TRACKED_IDS_CONFIG_KEY = "_linkedDeviceTrackedIds";
+/**
+* The three reserved keys, as one set: they stay with a camera's NUMBER on a
+* hardware swap, and a settings save that still carries them (a page opened
+* before D655 retired the section) is refused by name, never dropped.
+*/
+var LINKED_DEVICES_RESERVED_KEYS = new Set([
+	LINKED_MODE_CONFIG_KEY,
+	LINKED_IDS_CONFIG_KEY,
+	LINKED_TRACKED_IDS_CONFIG_KEY
+]);
 /** Parse the two reserved keys out of a device-config blob. Tolerant:
 *  ids may arrive as numbers or numeric strings (the multiselect field
 *  stores string option values); anything else is dropped. */
@@ -2764,14 +2774,24 @@ function resolveLinkedDeviceIds(params) {
 * are ignored.
 */
 function resolveTrackedEventDeviceIds(config, linkedIds) {
+	const picked = new Set(parseTrackedOptIn(config));
+	return linkedIds.filter((id) => picked.has(id));
+}
+/**
+* The persisted tracked-event opt-in AS STORED — not intersected with the
+* linked set, which is the resolver's job. Absent / non-array ⇒ `[]` (NONE,
+* the same answer the resolver gives). Ids may be numbers or numeric strings;
+* anything else is dropped; deduped, in stored order.
+*/
+function parseTrackedOptIn(config) {
 	const raw = config[LINKED_TRACKED_IDS_CONFIG_KEY];
 	if (!Array.isArray(raw)) return [];
-	const picked = /* @__PURE__ */ new Set();
+	const out = [];
 	for (const v of raw) {
 		const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
-		if (Number.isInteger(n)) picked.add(n);
+		if (Number.isInteger(n) && !out.includes(n)) out.push(n);
 	}
-	return linkedIds.filter((id) => picked.has(id));
+	return out;
 }
 /**
 * The fleet listing every function here needs, and the ONLY projection any of
@@ -2864,115 +2884,56 @@ async function getLinkedDevicesBatch(pctx, input) {
 	});
 }
 /**
-* "Linked devices" settings section for a CAMERA (null for every other
-* device type — the association is camera-anchored). Contributed through
-* `collectSystemDeviceContributions`; saves route through the existing
-* `writerCapName: 'device-manager'` path into the device config blob.
-*/
-async function buildLinkedDevicesContribution(pctx, deviceId) {
-	const persisted = await pctx.metaStore.resolvePersistedById(deviceId);
-	if (!persisted || persisted.meta.type !== DeviceType.Camera) return null;
-	const [all, blob] = await Promise.all([listAll(pctx, LINK_CANDIDATE_PROJECTION), pctx.settings.readDeviceStore(deviceId)]);
-	const config = parseLinkedDevicesConfig(blob);
-	const self = all.find((d) => d.id === deviceId);
-	const linkedIds = resolveLinkedDeviceIds({
-		selfId: deviceId,
-		config,
-		candidates: all
-	});
-	const byId = new Map(all.map((d) => [d.id, d]));
-	const trackedOptions = linkedIds.flatMap((id) => {
-		const d = byId.get(id);
-		if (!d) return [];
-		return [{
-			value: String(d.id),
-			label: d.location !== null ? `${d.name} (${d.location})` : d.name
-		}];
-	});
-	const trackedValue = resolveTrackedEventDeviceIds(blob, linkedIds).map(String);
-	return { sections: [{
-		id: "linked-devices",
-		title: "Linked devices",
-		description: "Companion devices associated with this camera. Device-tree children are always linked; everything else is the list you pick below. Devices in the same location are suggested first, never linked on their own (D356).",
-		order: 70,
-		fields: [{
-			type: "device-multiselect",
-			key: LINKED_IDS_CONFIG_KEY,
-			label: "Linked devices",
-			description: "Pick the companions of this camera. Same-location devices are suggested; device-tree children stay linked regardless.",
-			deviceFilter: {
-				excludeDeviceId: deviceId,
-				excludeTypes: [DeviceType.Container]
-			},
-			suggestLocation: self?.location ?? null,
-			value: config.manualIds.map(String)
-		}, {
-			type: "multiselect",
-			key: LINKED_TRACKED_IDS_CONFIG_KEY,
-			label: "Devices that produce tracked events",
-			description: "Linked devices whose state changes materialize a synthetic tracked event on this camera. Default: none (opt-in).",
-			options: trackedOptions,
-			value: trackedValue
-		}]
-	}] };
-}
-/**
-* Direct `applyDeviceSettingsPatch` normalization for the two reserved keys.
-* The admin-ui save path reaches the device config blob via the
-* `writerCapName: 'device-manager'` routing (never this method), but the cap
-* contract includes the method — keep it correct for direct callers.
+* THE write path for the linked-devices keys — the `linked-devices` slot's
+* `set` lands here (D648). Normalizes the pick list and the tracked-event
+* opt-in; an EXPLICIT empty opt-in is stored as `[]`, never deleted, because
+* an absent key and an empty one are read alike today but only `[]` says the
+* operator chose "none".
 */
 async function applyLinkedDevicesPatch(pctx, deviceId, patch) {
 	const next = { ...await pctx.settings.readDeviceStore(deviceId) };
 	if ("_linkedDeviceIds" in patch) next[LINKED_IDS_CONFIG_KEY] = [...parseLinkedDevicesConfig({ [LINKED_IDS_CONFIG_KEY]: patch[LINKED_IDS_CONFIG_KEY] }).manualIds];
-	if ("_linkedDeviceTrackedIds" in patch) {
-		const raw = patch[LINKED_TRACKED_IDS_CONFIG_KEY];
-		const ids = [];
-		if (Array.isArray(raw)) for (const v of raw) {
-			const n = typeof v === "number" ? v : typeof v === "string" ? Number(v) : NaN;
-			if (Number.isInteger(n) && !ids.includes(n)) ids.push(n);
-		}
-		next[LINKED_TRACKED_IDS_CONFIG_KEY] = ids;
-	}
+	if ("_linkedDeviceTrackedIds" in patch) next[LINKED_TRACKED_IDS_CONFIG_KEY] = [...parseTrackedOptIn(patch)];
 	await pctx.settings.writeDeviceStore(deviceId, next);
 	return { success: true };
 }
-//#endregion
-//#region src/builtins/device-manager/device-store-sections.ts
-/** The device-manager's device-store-backed sections. Add an entry to extend. */
-var DEVICE_STORE_SECTIONS = [{
-	keys: [
-		LINKED_MODE_CONFIG_KEY,
-		LINKED_IDS_CONFIG_KEY,
-		LINKED_TRACKED_IDS_CONFIG_KEY
-	],
-	apply: (pctx, deviceId, patch) => applyLinkedDevicesPatch(pctx, deviceId, patch)
-}];
-/**
-* Split a `writerCapName: 'device-manager'` patch into device-store slices
-* (one per matching registered section) and the leftover driver patch.
-* Generic — consults {@link DEVICE_STORE_SECTIONS}, no hardcoded key list.
-*/
-function splitDeviceStoreKeys(patch) {
-	const claimed = /* @__PURE__ */ new Set();
-	const storeGroups = [];
-	for (const section of DEVICE_STORE_SECTIONS) {
-		const slice = {};
-		for (const key of section.keys) if (key in patch) {
-			slice[key] = patch[key];
-			claimed.add(key);
+/**
+* Which NEW picks a linked-devices write must refuse: the camera itself, a
+* container (never a pick — its children are, D356 and the file header), and
+* an id no device has.
+*
+* Only ids that are not ALREADY persisted are judged. A list written before
+* this rule existed may hold a container or a device that has since been
+* deleted; the editor shows those as unavailable / missing, and keeping them
+* is not a new link. Removing them is the operator's call, never this
+* function's (a missing source is shown, never silently dropped).
+*
+* Since D655 every write of the list goes through the slot, the Locations
+* page's room rebuild included, so this is the only gate a pick passes.
+*/
+function refusedLinkedPicks(params) {
+	const kept = new Set(params.persisted);
+	const out = [];
+	for (const deviceId of params.picked) {
+		if (kept.has(deviceId)) continue;
+		if (deviceId === params.selfId) {
+			out.push({
+				deviceId,
+				reason: "self"
+			});
+			continue;
 		}
-		if (Object.keys(slice).length > 0) storeGroups.push({
-			section,
-			patch: slice
+		const device = params.fleet.get(deviceId);
+		if (device === void 0) out.push({
+			deviceId,
+			reason: "unknown"
+		});
+		else if (device.type === DeviceType.Container) out.push({
+			deviceId,
+			reason: "container"
 		});
 	}
-	const driverPatch = {};
-	for (const [key, value] of Object.entries(patch)) if (!claimed.has(key)) driverPatch[key] = value;
-	return {
-		storeGroups,
-		driverPatch
-	};
+	return out;
 }
 //#endregion
 //#region src/builtins/device-manager/device-aggregation.ts
@@ -3639,12 +3600,15 @@ async function updateDeviceFieldsBatch(deps, input) {
 * registry lookup). Used by `updateDeviceFieldsBatch`. */
 async function applyGroupPatch(deps, deviceId, group) {
 	if (group.writerCapName === "device-manager") {
-		const { storeGroups, driverPatch } = splitDeviceStoreKeys(group.patch);
-		if (storeGroups.length > 0) {
-			const settings = deps.ctx.settings;
-			if (!settings) throw new Error("[device-manager] device-store save requires the settings surface");
-			for (const { section, patch } of storeGroups) await section.apply({ settings }, deviceId, patch);
+		const retired = Object.keys(group.patch).filter((key) => LINKED_DEVICES_RESERVED_KEYS.has(key));
+		if (retired.length > 0) {
+			deps.ctx.logger.warn("device-manager: a save of the retired linked-devices section refused", {
+				tags: { deviceId },
+				meta: { keys: retired }
+			});
+			throw new Error(`[device-manager] ${retired.join(", ")} can no longer be saved from the settings section (D655) — reload the page and use the Extensions section`);
 		}
+		const driverPatch = group.patch;
 		if (Object.keys(driverPatch).length === 0) return;
 		const hubRegistry = deps.ctx.kernel?.deviceRegistry;
 		const found = hubRegistry ? resolveDeviceById(hubRegistry, deviceId) : null;
@@ -3926,6 +3890,226 @@ var DeviceEventPropagator = class {
 		return chain;
 	}
 };
+//#endregion
+//#region src/builtins/device-manager/device-extension-linked-slot.ts
+/** The routing prefix of this owner's `slotRef`s. */
+var DEVICE_MANAGER_EXTENSION_SOURCE = "device-manager";
+/** The store the slot reads and writes, named (D62). */
+var LINKED_DEVICES_AUTHORITY = `device-manager:${LINKED_IDS_CONFIG_KEY}`;
+/**
+* The picked ids' ledger fields, from ONE indexed read of the device manager's
+* own store (`rows.getMany`) — never the whole fleet to label a handful of ids.
+* An id no device has is absent from the map.
+*/
+function pickedFrom(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [id, row] of rows) out.set(id, {
+		name: row.meta.name,
+		type: row.meta.type
+	});
+	return out;
+}
+/** What a camera's picked id is, said once for the editor. */
+function sourceOf(deviceId, byId) {
+	const device = byId.get(deviceId);
+	if (device === void 0) return {
+		deviceId,
+		name: null,
+		health: "missing",
+		detail: "No device has this id any more — it links nothing until removed."
+	};
+	if (device.type === DeviceType.Container) return {
+		deviceId,
+		name: device.name,
+		health: "unavailable",
+		detail: "A container is never a pick (D356): its children are linked in its place. Pick the children instead."
+	};
+	return {
+		deviceId,
+		name: device.name,
+		health: "ok"
+	};
+}
+/**
+* Which ids of a written opt-in must be refused: a NEW opt-in for a device the
+* camera does not link. An id already stored is never refused — whatever was
+* read can be written back unchanged (a stale opt-in is removed by leaving it
+* out, never by being unable to save). The written list REPLACES the stored
+* one: since D655 the editor shows every stored opt-in, so nothing it sends
+* back is written blind.
+*/
+function refusedTrackedOptIns(params) {
+	const allowed = new Set([
+		...params.picked,
+		...params.implied,
+		...params.stored
+	]);
+	return params.tracked.filter((id) => !allowed.has(id));
+}
+/** A ledger row as the pure link resolver reads it, or null for an unknown type. */
+function toLinkCandidate(row) {
+	const type = Object.values(DeviceType).find((t) => t === row.meta.type);
+	if (type === void 0) return null;
+	return {
+		id: row.meta.id,
+		parentDeviceId: row.meta.parentDeviceId,
+		location: row.meta.location,
+		type,
+		stableId: row.meta.stableId,
+		...row.meta.primaryChildEntityId !== void 0 ? { primaryChildEntityId: row.meta.primaryChildEntityId } : {},
+		...row.meta.role !== void 0 ? { role: row.meta.role } : {},
+		name: row.meta.name
+	};
+}
+/** How deep a container nesting is walked — a cycle in the ledger must end. */
+var MAX_CONTAINER_DEPTH = 8;
+/**
+* The devices the camera links BY STRUCTURE, labelled: what the resolver adds
+* beyond the picks. Computed by the resolver itself (`resolveLinkedDeviceIds`)
+* over the only rows it can reach — the picks, the camera's children, and the
+* descendants of every container among them — read level by level with ONE
+* indexed `listByParentMany` each, never the fleet.
+*/
+async function impliedLinks(pctx, deviceId, manualIds, pickedRows) {
+	const rows = new Map(pickedRows);
+	let parents = [deviceId, ...[...pickedRows.values()].filter((r) => r.meta.type === DeviceType.Container).map((r) => r.meta.id)];
+	const walked = /* @__PURE__ */ new Set();
+	for (let depth = 0; depth < MAX_CONTAINER_DEPTH && parents.length > 0; depth++) {
+		for (const id of parents) walked.add(id);
+		const byParent = await pctx.metaStore.rows.listByParentMany(parents);
+		const next = [];
+		for (const children of byParent.values()) for (const child of children) {
+			rows.set(child.meta.id, child);
+			if (child.meta.type === DeviceType.Container && !walked.has(child.meta.id)) next.push(child.meta.id);
+		}
+		parents = next;
+	}
+	const candidates = [...rows.values()].flatMap((r) => {
+		const c = toLinkCandidate(r);
+		return c === null ? [] : [c];
+	});
+	const picks = new Set(manualIds);
+	return resolveLinkedDeviceIds({
+		selfId: deviceId,
+		config: {
+			mode: "manual",
+			manualIds
+		},
+		candidates
+	}).filter((id) => !picks.has(id)).map((id) => ({
+		deviceId: id,
+		name: rows.get(id)?.meta.name ?? null,
+		health: "ok"
+	}));
+}
+function describeRefusal(deviceId, reason) {
+	if (reason === "self") return `${deviceId} is the camera itself`;
+	if (reason === "container") return `${deviceId} is a container — pick its children`;
+	return `${deviceId} is not a device`;
+}
+async function fleetOf(pctx) {
+	const all = await listAll(pctx, LINK_CANDIDATE_PROJECTION);
+	return new Map(all.map((d) => [d.id, d]));
+}
+function candidatesFor(deviceId, byId) {
+	const location = byId.get(deviceId)?.location ?? null;
+	const out = [];
+	for (const device of byId.values()) {
+		if (device.id === deviceId) continue;
+		if (device.parentDeviceId === deviceId) continue;
+		if (device.type === DeviceType.Container) continue;
+		const suggested = location !== null && device.location === location;
+		const parent = device.parentDeviceId === null ? void 0 : byId.get(device.parentDeviceId);
+		out.push({
+			deviceId: device.id,
+			name: device.name,
+			type: device.type,
+			location: device.location,
+			parentName: parent?.name ?? null,
+			suggested,
+			reason: suggested ? "same location" : null
+		});
+	}
+	return out.toSorted((a, b) => Number(b.suggested) - Number(a.suggested) || a.name.localeCompare(b.name));
+}
+/** Build the `device-extension` provider the device manager registers. */
+function createDeviceManagerExtensionProvider(pctx) {
+	return createDeviceExtensionProvider({
+		source: DEVICE_MANAGER_EXTENSION_SOURCE,
+		label: "Device manager",
+		slots: [defineExtensionSlotProvider("linked-devices", {
+			list: async (deviceId) => {
+				const blob = await pctx.settings.readDeviceStore(deviceId);
+				const { manualIds } = parseLinkedDevicesConfig(blob);
+				const pickedRows = await pctx.metaStore.rows.getMany(manualIds);
+				const byId = pickedFrom(pickedRows);
+				const implied = await impliedLinks(pctx, deviceId, manualIds, pickedRows);
+				return {
+					authority: LINKED_DEVICES_AUTHORITY,
+					enabled: null,
+					activation: null,
+					value: {
+						slot: "linked-devices",
+						deviceIds: [...manualIds],
+						trackedDeviceIds: [...parseTrackedOptIn(blob)]
+					},
+					sources: manualIds.map((id) => sourceOf(id, byId)),
+					...implied.length > 0 ? { impliedSources: implied } : {}
+				};
+			},
+			set: async (deviceId, value) => {
+				const [pickedRows, blob] = await Promise.all([pctx.metaStore.rows.getMany(value.deviceIds), pctx.settings.readDeviceStore(deviceId)]);
+				const byId = pickedFrom(pickedRows);
+				const refused = refusedLinkedPicks({
+					selfId: deviceId,
+					picked: value.deviceIds,
+					persisted: parseLinkedDevicesConfig(blob).manualIds,
+					fleet: byId
+				});
+				if (refused.length > 0) {
+					pctx.host.ctx.logger.warn("linked-devices: write refused — nothing persisted", {
+						tags: { deviceId },
+						meta: { refused }
+					});
+					throw new Error(`linked-devices on ${deviceId}: refused — ` + refused.map((r) => describeRefusal(r.deviceId, r.reason)).join("; "));
+				}
+				const tracked = value.trackedDeviceIds;
+				if (tracked === void 0) {
+					await applyLinkedDevicesPatch(pctx, deviceId, { [LINKED_IDS_CONFIG_KEY]: value.deviceIds });
+					return {
+						applied: true,
+						reload: "none"
+					};
+				}
+				const implied = await impliedLinks(pctx, deviceId, value.deviceIds, pickedRows);
+				const notLinked = refusedTrackedOptIns({
+					tracked,
+					picked: value.deviceIds,
+					implied: implied.map((s) => s.deviceId),
+					stored: parseTrackedOptIn(blob)
+				});
+				if (notLinked.length > 0) {
+					pctx.host.ctx.logger.warn("linked-devices: write refused — nothing persisted", {
+						tags: { deviceId },
+						meta: { trackedNotLinked: notLinked }
+					});
+					throw new Error(`linked-devices on ${deviceId}: refused — tracked events can only be opted in for a linked device, not ${notLinked.join(", ")}`);
+				}
+				await applyLinkedDevicesPatch(pctx, deviceId, {
+					[LINKED_IDS_CONFIG_KEY]: value.deviceIds,
+					[LINKED_TRACKED_IDS_CONFIG_KEY]: [...new Set(tracked)]
+				});
+				return {
+					applied: true,
+					reload: "none"
+				};
+			},
+			candidates: async (deviceId) => candidatesFor(deviceId, await fleetOf(pctx))
+		})],
+		hostTypeOf: async (deviceId) => (await pctx.metaStore.resolvePersistedById(deviceId))?.meta.type ?? null,
+		logger: pctx.host.ctx.logger
+	});
+}
 /** A refusal that names a switch the camera does not offer, rather than one it
 *  could not be asked about. The cap documents rejecting the former; anything
 *  else is treated as the camera being out of reach, which is the safe reading:
@@ -4096,9 +4280,9 @@ async function reloadMigratedDevices(pctx, targets) {
 *
 *  - The DRIVER config keys (host, port, credentials, `deviceCache`, every
 *    schema field) SWAP — they describe the box.
-*  - The device-manager-owned section keys ({@link DEVICE_STORE_SECTIONS}:
-*    linked-devices mode/ids) STAY with the number — a sensor is linked to
-*    "the driveway camera", not to a serial number.
+*  - The device-manager-owned linked-devices keys (mode, ids, tracked-event
+*    opt-in — {@link ROLE_SCOPED_CONFIG_KEYS}) STAY with the number — a sensor
+*    is linked to "the driveway camera", not to a serial number.
 *  - `_profileMap` is DROPPED from both. It is the legacy spelling of the
 *    stream-profile assignment (the live authority is the stream broker's own
 *    map — see `StreamsTab.tsx`, which stopped writing it), and either copy
@@ -4116,7 +4300,7 @@ async function reloadMigratedDevices(pctx, targets) {
 /** Legacy stream-profile assignment key (cf. `device-queries.ts`). */
 var PROFILE_MAP_CONFIG_KEY = "_profileMap";
 /** Config keys that belong to the camera's ROLE and stay with the number. */
-var ROLE_SCOPED_CONFIG_KEYS = new Set(DEVICE_STORE_SECTIONS.flatMap((section) => [...section.keys]));
+var ROLE_SCOPED_CONFIG_KEYS = LINKED_DEVICES_RESERVED_KEYS;
 function splitConfig(config) {
 	const hardware = {};
 	const role = {};
@@ -7903,9 +8087,6 @@ var DeviceManagerAddon = class extends BaseAddon {
 			getChildrenBatch: (input) => getChildrenBatch(pctx, input),
 			getLinkedDevices: (input) => getLinkedDevices(pctx, input),
 			getLinkedDevicesBatch: (input) => getLinkedDevicesBatch(pctx, input),
-			getDeviceSettingsContribution: (input) => buildLinkedDevicesContribution(pctx, input.deviceId),
-			getDeviceLiveContribution: async () => null,
-			applyDeviceSettingsPatch: (input) => applyLinkedDevicesPatch(pctx, input.deviceId, input.patch),
 			getStreamSources: (input) => getStreamSources(pctx, input),
 			getConfigSchema: (input) => getConfigSchema(pctx, input),
 			getSettingsSchema: (input) => getSettingsSchema(pctx, input),
@@ -8044,28 +8225,35 @@ var DeviceManagerAddon = class extends BaseAddon {
 			this.propagator.start();
 			this.ctx.logger.info("device-event-propagator started");
 		}
-		return [{
-			capability: deviceManagerCapability,
-			provider
-		}, {
-			capability: deviceStateCapability,
-			provider: {
-				getSnapshot: async (input) => {
-					return stateMirror.snapshotForDevice(input.deviceId);
-				},
-				getCapSlice: async (input) => {
-					return stateMirror.capSlice(input.deviceId, input.capName);
-				},
-				getAllSnapshots: async () => {
-					return stateMirror.allSnapshots();
-				},
-				setCapSlice: async (input) => {
-					const { deviceId, capName, slice } = input;
-					if (!await resolvePersistedById(deviceId)) throw new Error(`[device-manager] setCapSlice: unknown device id=${deviceId}`);
-					if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings, capName);
+		return [
+			{
+				capability: deviceManagerCapability,
+				provider
+			},
+			{
+				capability: deviceStateCapability,
+				provider: {
+					getSnapshot: async (input) => {
+						return stateMirror.snapshotForDevice(input.deviceId);
+					},
+					getCapSlice: async (input) => {
+						return stateMirror.capSlice(input.deviceId, input.capName);
+					},
+					getAllSnapshots: async () => {
+						return stateMirror.allSnapshots();
+					},
+					setCapSlice: async (input) => {
+						const { deviceId, capName, slice } = input;
+						if (!await resolvePersistedById(deviceId)) throw new Error(`[device-manager] setCapSlice: unknown device id=${deviceId}`);
+						if (stateMirror.applySingleCapUpdate(deviceId, capName, slice)) stateMirror.scheduleRuntimeStateDiskWrite(deviceId, settings, capName);
+					}
 				}
+			},
+			{
+				capability: deviceExtensionCapability,
+				provider: createDeviceManagerExtensionProvider(pctx)
 			}
-		}];
+		];
 	}
 	async onShutdown() {
 		this.propagator?.stop();

package/dist/builtins/doorbell/binding-mirror.d.ts

@@ -24,13 +24,19 @@
  * not survive the next read. So a negative read ARMS the revocation and a
  * second consecutive negative applies it.
  *
- * ERRING. `undefined` (never read) and `unbind-pending` both ring. Reaching
- * the ring path at all means the camera has a configured trigger source,
- * and a source can only be configured through this wrapper's own
- * binding-gated settings surface — so a configured source is itself
- * evidence the wrapper was bound. The cost of erring open is a spurious
- * ring on a camera the operator unbound but left configured, for at most
- * two reload cycles. The cost of erring closed is the press.
+ * ERRING. `undefined` (never read) and `unbind-pending` both ring. The cost
+ * of erring open is a spurious ring on a camera whose wrapper is not bound
+ * but which has trigger sources, for at most two reload cycles. The cost of
+ * erring closed is the press.
+ *
+ * D655: a configured source is NO LONGER evidence of the binding. D49 leaned
+ * on "a source can only be configured through this wrapper's own
+ * binding-gated settings surface"; that surface is retired, and the
+ * `doorbell-source` extension slot that replaced it is offered on every
+ * camera, bound or not (D648). The erring-open window above is therefore
+ * reachable by configuring sources on a never-bound camera, not only by
+ * unbinding a configured one — still bounded by two reload cycles, and the
+ * slot's card says `inactive` once the reads agree.
  *
  * ─────────────────────────────────────────────────────────────────────
  * 2026-08-07 (D72). The corroboration above was DEFEATED, and the reason
@@ -113,3 +119,27 @@ export type DurableBindingVerdict = 'bound' | 'unbound' | 'unreadable';
  * from an empty snapshot, whereas a genuine unbind leaves the key present.
  */
 export declare function readDurableWrapperBinding(record: unknown, deviceId: number, capName: string, ownAddonId: string): DurableBindingVerdict;
+/**
+ * What a press on this camera would do right now.
+ *
+ * `rings` — the binding is confirmed (mirror `bound`, or the durable store
+ * rescued an `unbound` mirror). `rings-pending` — one negative read, not yet
+ * believed. `rings-unconfirmed` — no read has happened yet; the ring path errs
+ * open. `unknown` — the mirror says unbound but the durable store could not
+ * be read: a press RINGS (an unanswerable store never destroys a one-shot
+ * press), and nobody can say whether that is right. `silent` — the durable
+ * store agrees with an unbound mirror: the only verdict that drops a press.
+ */
+export type RingVerdict = 'rings' | 'rings-pending' | 'rings-unconfirmed' | 'unknown' | 'silent';
+/** Does this mirror state need the durable authority before a verdict? Only `unbound` does. */
+export declare function needsDurableRead(state: DoorbellBindingState | undefined): boolean;
+/**
+ * THE decision — the ring gate (`fireDoorbell` / `ringsDespiteUnboundMirror`)
+ * and the Extensions card's activation both call it, so what the card says
+ * and what a press does cannot disagree. `durable` is `null` when it was not
+ * read, which {@link needsDurableRead} allows for every state but `unbound`.
+ * Pure: it reads nothing and writes nothing.
+ */
+export declare function ringVerdict(state: DoorbellBindingState | undefined, durable: DurableBindingVerdict | null): RingVerdict;
+/** Whether a press proceeds under this verdict. */
+export declare function verdictRings(verdict: RingVerdict): boolean;