@camstack/system 1.2.389 → 1.2.391

package/dist/builtins/device-manager/device-sync-resolvers.d.ts

@@ -1,30 +1,30 @@
-import { ProviderContext } from './device-provider-context.js';
+import type { ProviderContext } from "./device-provider-context.js";
 /**
- * Sync ownership lookup backing persistence fallbacks (e.g. remove()
- * when the owning worker is offline). Ownership is keyed by numeric
- * deviceId → owning addonId as recorded in the persisted meta. NOT
- * a native-cap lookup: an addon can own a device without registering
- * every possible cap natively (e.g. RtspCamera without snapshotUrl
- * doesn't register the snapshot cap). Use `resolveNativeCapOwnerSync`
- * for cap-resolution paths.
- */
+* Sync ownership lookup backing persistence fallbacks (e.g. remove()
+* when the owning worker is offline). Ownership is keyed by numeric
+* deviceId → owning addonId as recorded in the persisted meta. NOT
+* a native-cap lookup: an addon can own a device without registering
+* every possible cap natively (e.g. RtspCamera without snapshotUrl
+* doesn't register the snapshot cap). Use `resolveNativeCapOwnerSync`
+* for cap-resolution paths.
+*/
 export declare function resolveDeviceOwnerSync(pctx: ProviderContext, deviceId: number): string | null;
 /**
- * Sync lookup for the addon that registered a native provider for
- * `(capName, deviceId)`. Backs `CapabilityRegistry`'s native fallback
- * so the hub only synthesizes a cross-process proxy when the cap is
- * actually published — never on speculative device ownership.
- *
- * Resolution order:
- *  1. Hub-local `capabilityRegistry` (in-process natives — fastest path).
- *  2. Push-fed `remoteNativeCaps` cache (`DeviceBindingsChanged` events
- *     from forked workers — accurate in steady state).
- *  3. Handshake-fed `HubNodeRegistry` via `listClusterNativeCaps()`
- *     (D3 re-handshake after device restore — covers the Moleculer
- *     transport window where push events were lost). This is the
- *     reliable replacement for the deleted `syncWorkerNativeCaps` pull.
- */
+* Sync lookup for the addon that registered a native provider for
+* `(capName, deviceId)`. Backs `CapabilityRegistry`'s native fallback
+* so the hub only synthesizes a cross-process proxy when the cap is
+* actually published — never on speculative device ownership.
+*
+* Resolution order:
+*  1. Hub-local `capabilityRegistry` (in-process natives — fastest path).
+*  2. Push-fed `remoteNativeCaps` cache (`DeviceBindingsChanged` events
+*     from forked workers — accurate in steady state).
+*  3. Handshake-fed `HubNodeRegistry` via `listClusterNativeCaps()`
+*     (D3 re-handshake after device restore — covers the Moleculer
+*     transport window where push events were lost). This is the
+*     reliable replacement for the deleted `syncWorkerNativeCaps` pull.
+*/
 export declare function resolveNativeCapOwnerSync(pctx: ProviderContext, capName: string, deviceId: number): {
-    addonId: string;
-    nodeId: string;
+	addonId: string;
+	nodeId: string;
 } | null;

package/dist/builtins/device-manager/field-claims-index.d.ts

@@ -1,69 +1,96 @@
-import { ClaimsListing, FieldClaim, IScopedLogger } from '@camstack/types';
-import { DeviceManagerSettings } from './device-meta-store.js';
-import { ClaimsIndexView } from './device-state-mirror.js';
-import { WriteLock } from './write-lock.js';
+/**
+* The claims INDEX (D663): which (device, cap) pairs carry a per-field claim,
+* by whom, in which mode, over which fields — one blob on the device-manager's
+* own settings store, key `field-claims-index`.
+*
+* It is a LISTING PROJECTION, not an authority (rulings D3/D62, preflight
+* §4-4): the merge authority is the device's row (`$owned`, `DeviceStateMirror`).
+* The index answers two questions the row cannot answer cheaply: "which devices
+* have claims at all?" (the boot seed asks it before reading any row — S6,
+* D447) and "list every claim" (`deviceState.listClaims`).
+*
+* Write order keeps it a SUPERSET of the rows' claims: written BEFORE the row on
+* a claim, AFTER the row on a release. A crash between the two leaves at worst
+* an index entry with no row claim — never a row claim the index misses, which
+* would let a claimed device seed without its row and answer the native for a
+* claimed field. Three conditions keep the projection honest: `removeDevice`
+* prunes it (`pruneDevice`); a `releaseClaim` that finds no claim on the row
+* removes the stale entry (the caller does that with `remove`); and D663 names
+* it a projection with this write order.
+*
+* It loads once at init and never on a timer (D3): until a load has SUCCEEDED,
+* `view()` is `not-loaded` (every seed reads its row, as before the index
+* existed) and `list()` says so with the reason — never `[]` (D315). A blob
+* that READS but does not PARSE is the same state: unknown, not empty (D49).
+* Each caller that needs it loaded asks `load` again; a failed read is retried
+* by the next call, not by a clock.
+*/
+import type { ClaimsListing, FieldClaim, IScopedLogger } from "@camstack/types";
+import type { DeviceManagerSettings } from "./device-meta-store.js";
+import type { ClaimsIndexView } from "./device-state-mirror.js";
+import type { WriteLock } from "./write-lock.js";
 /** The addon-store key the index lives under. */
 export declare const FIELD_CLAIMS_INDEX_KEY = "field-claims-index";
 /** One claim's identity in the index: a cap on a device has at most one owner. */
 export interface ClaimKey {
-    readonly deviceId: number;
-    readonly capName: string;
+	readonly deviceId: number;
+	readonly capName: string;
 }
 /** A read-modify-write step over the loaded entries; null means nothing to write. */
 export type IndexTransform = (current: ReadonlyMap<string, FieldClaim>) => ReadonlyMap<string, FieldClaim> | null;
 export interface FieldClaimsIndexDeps {
-    readonly logger: IScopedLogger;
-    /**
-     * The addon's own settings row-set lock, shared with every other writer of
-     * it: `writeAddonStore` is a read-modify-write of the WHOLE key range on the
-     * store side, so unordered writers destroy each other's keys.
-     */
-    readonly withAddonStoreWriteLock: WriteLock;
+	readonly logger: IScopedLogger;
+	/**
+	* The addon's own settings row-set lock, shared with every other writer of
+	* it: `writeAddonStore` is a read-modify-write of the WHOLE key range on the
+	* store side, so unordered writers destroy each other's keys.
+	*/
+	readonly withAddonStoreWriteLock: WriteLock;
 }
 export declare class FieldClaimsIndex {
-    private readonly deps;
-    /** The loaded entries by key, or null until a load has succeeded. */
-    private entries;
-    /** Devices with at least one entry — what the seed asks, per native write. */
-    private claimedDevices;
-    /** Why the last load did not succeed. */
-    private notLoadedReason;
-    /** One load in flight at a time; concurrent callers join it. */
-    private loading;
-    constructor(deps: FieldClaimsIndexDeps);
-    /**
-     * Load the blob. Resolves `true` once the index is loaded (now or already);
-     * `false` when the store could not answer — the reason is kept for `list`.
-     * Never throws: an index that cannot load is a state, not a failure.
-     */
-    load(settings: DeviceManagerSettings): Promise<boolean>;
-    /** What the seed consults: loaded with a device predicate, or not loaded. */
-    view(): ClaimsIndexView;
-    /** Every entry, optionally those whose owner starts with `ownerPrefix`; or why there is no answer. */
-    list(ownerPrefix?: string): ClaimsListing;
-    /** The entry for a key, when the index is loaded and has one. */
-    entry(key: ClaimKey): FieldClaim | undefined;
-    /** Add or replace one entry — written before the row it announces. Throws when the index cannot be loaded or written. */
-    upsert(claim: FieldClaim, settings: DeviceManagerSettings): Promise<void>;
-    /** Remove one entry — written after the row no longer carries the claim. No write when absent. */
-    remove(key: ClaimKey, settings: DeviceManagerSettings): Promise<void>;
-    /**
-     * Drop every entry of a removed device (condition i). Best effort: an index
-     * that cannot be loaded or written keeps a stale entry, which costs the next
-     * seed of that number one row read and is removed by the next release that
-     * answers `not-claimed` — so it is logged, never thrown, and the removal
-     * proceeds.
-     */
-    pruneDevice(deviceId: number, settings: DeviceManagerSettings): Promise<void>;
-    /**
-     * Read-modify-write of the whole blob under the addon-store lock, from the
-     * LOADED entries: the index is never written from a partial picture. `next`
-     * returning null means nothing to write.
-     */
-    private mutate;
-    private install;
-    /** The three-way read (D651): a failed read is a REASON, never an empty index. */
-    private readBlob;
-    /** Not loaded, by name: the index stays unknown and says why. */
-    private refuseMalformed;
+	private readonly deps;
+	/** The loaded entries by key, or null until a load has succeeded. */
+	private entries;
+	/** Devices with at least one entry — what the seed asks, per native write. */
+	private claimedDevices;
+	/** Why the last load did not succeed. */
+	private notLoadedReason;
+	/** One load in flight at a time; concurrent callers join it. */
+	private loading;
+	constructor(deps: FieldClaimsIndexDeps);
+	/**
+	* Load the blob. Resolves `true` once the index is loaded (now or already);
+	* `false` when the store could not answer — the reason is kept for `list`.
+	* Never throws: an index that cannot load is a state, not a failure.
+	*/
+	load(settings: DeviceManagerSettings): Promise<boolean>;
+	/** What the seed consults: loaded with a device predicate, or not loaded. */
+	view(): ClaimsIndexView;
+	/** Every entry, optionally those whose owner starts with `ownerPrefix`; or why there is no answer. */
+	list(ownerPrefix?: string): ClaimsListing;
+	/** The entry for a key, when the index is loaded and has one. */
+	entry(key: ClaimKey): FieldClaim | undefined;
+	/** Add or replace one entry — written before the row it announces. Throws when the index cannot be loaded or written. */
+	upsert(claim: FieldClaim, settings: DeviceManagerSettings): Promise<void>;
+	/** Remove one entry — written after the row no longer carries the claim. No write when absent. */
+	remove(key: ClaimKey, settings: DeviceManagerSettings): Promise<void>;
+	/**
+	* Drop every entry of a removed device (condition i). Best effort: an index
+	* that cannot be loaded or written keeps a stale entry, which costs the next
+	* seed of that number one row read and is removed by the next release that
+	* answers `not-claimed` — so it is logged, never thrown, and the removal
+	* proceeds.
+	*/
+	pruneDevice(deviceId: number, settings: DeviceManagerSettings): Promise<void>;
+	/**
+	* Read-modify-write of the whole blob under the addon-store lock, from the
+	* LOADED entries: the index is never written from a partial picture. `next`
+	* returning null means nothing to write.
+	*/
+	private mutate;
+	private install;
+	/** The three-way read (D651): a failed read is a REASON, never an empty index. */
+	private readBlob;
+	/** Not loaded, by name: the index stays unknown and says why. */
+	private refuseMalformed;
 }

package/dist/builtins/device-manager/field-ownership.d.ts

@@ -1,53 +1,71 @@
-import { z } from 'zod';
-import { FieldClaimMode } from '@camstack/types';
-import { RuntimeStatePolicyLookup } from './runtime-state-persist-gate.js';
+/**
+* Per-field ownership of a runtime-state slice (D663) — the pure half.
+*
+* A composition may claim fields of a cap on an existing device. The native
+* provider keeps writing its slice (it never learns of the claim — D62: one
+* authority per field, and the authority for a claimed field is the owner),
+* the hub keeps that slice as a SHADOW, and what consumers read and receive is
+* the MERGE: the native slice with the owned fields replaced. The shadow is
+* readable only by the owner-side mechanism (D224), never served as a second
+* truth.
+*
+* Both halves live in the device's own runtime-state row: the native slices
+* under their cap names, the claims under `$owned`. One row, one write, so a
+* claim and the slice it governs can never disagree on disk.
+*
+* This module has no mirror, no settings store and no logger: it merges and
+* it (de)serialises. `DeviceStateMirror` owns the state and the log lines.
+*/
+import { z } from "zod";
+import { type FieldClaimMode } from "@camstack/types";
+import type { RuntimeStatePolicyLookup } from "./runtime-state-persist-gate.js";
 /** The row key under which claims travel. Not a cap name: `$` is not legal in one. */
 export declare const OWNED_FIELDS_KEY = "$owned";
 /**
- * One claimed cap. `fields` is the claimed set, `values` what has been written
- * so far — a claimed field with no value is HELD (ruling S5), never answered
- * from the native slice.
- */
+* One claimed cap. `fields` is the claimed set, `values` what has been written
+* so far — a claimed field with no value is HELD (ruling S5), never answered
+* from the native slice.
+*/
 export interface OwnedCap {
-    readonly owner: string;
-    readonly mode: FieldClaimMode;
-    readonly fields: readonly string[];
-    readonly values: Readonly<Record<string, unknown>>;
+	readonly owner: string;
+	readonly mode: FieldClaimMode;
+	readonly fields: readonly string[];
+	readonly values: Readonly<Record<string, unknown>>;
 }
 export type OwnedCaps = ReadonlyMap<string, OwnedCap>;
 export interface SplitBlob {
-    readonly native: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
-    readonly owned: OwnedCaps;
-    /** `$owned` entries that failed `OwnedCapSchema`, by cap name — logged once per device, never applied. */
-    readonly dropped: readonly string[];
+	readonly native: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+	readonly owned: OwnedCaps;
+	/** `$owned` entries that failed `OwnedCapSchema`, by cap name — logged once per device, never applied. */
+	readonly dropped: readonly string[];
 }
 export type MergedSlice = {
-    readonly kind: 'slice';
-    readonly slice: Readonly<Record<string, unknown>>;
+	readonly kind: "slice";
+	readonly slice: Readonly<Record<string, unknown>>;
 } | {
-    readonly kind: 'held';
-    readonly reason: string;
+	readonly kind: "held";
+	readonly reason: string;
 };
 export declare function isPlainRecord(value: unknown): value is Readonly<Record<string, unknown>>;
 /**
- * Split a runtime-state row into its native slices and its claims. A row with
- * no `$owned` splits to its slices and an empty map — the shape every device
- * without a claim has always had. Non-object entries are dropped, as the
- * mirror seed and `DeviceRuntimeState.fromInitial` have always dropped them.
- */
+* Split a runtime-state row into its native slices and its claims. A row with
+* no `$owned` splits to its slices and an empty map — the shape every device
+* without a claim has always had. Non-object entries are dropped, as the
+* mirror seed and `DeviceRuntimeState.fromInitial` have always dropped them.
+*/
 export declare function splitRuntimeBlob(blob: Readonly<Record<string, unknown>>): SplitBlob;
 /**
- * Join native slices and claims into one row. `values` are kept only for caps
- * whose policy is `durability: 'restored'`; a session-only cap keeps its CLAIM
- * (so a restart still knows who owns what) but not its values, and the claimed
- * fields are held after boot until the owner writes again. A device with no
- * claims gets no `$owned` key at all — its row is byte-identical to before.
- */
-export declare function joinRuntimeBlob(native: SplitBlob['native'], owned: OwnedCaps, policyFor: RuntimeStatePolicyLookup): Record<string, Record<string, unknown>>;
+* Join native slices and claims into one row. `values` are kept only for caps
+* whose policy is `durability: 'restored'`; a session-only cap keeps its CLAIM
+* (so a restart still knows who owns what) but not its values, and the claimed
+* fields are held after boot until the owner writes again. A device with no
+* claims gets no `$owned` key at all — its row is byte-identical to before.
+*/
+export declare function joinRuntimeBlob(native: SplitBlob["native"], owned: OwnedCaps, policyFor: RuntimeStatePolicyLookup): Record<string, Record<string, unknown>>;
 /**
- * The one merge. Held when a claimed field has no value yet (S5: never
- * answered from the native), when a `replace` has no native slice to overlay
- * (a partial slice is never emitted), or when the merged slice fails the cap's
- * `runtimeState` schema (the native value never leaks through a bad overlay).
- */
+* The one merge. Held when a claimed field has no value yet (S5: never
+* answered from the native), when a `replace` has no native slice to overlay
+* (a partial slice is never emitted), or when the merged slice fails the cap's
+* `runtimeState` schema (the native value never leaks through a bad overlay).
+*/
 export declare function mergeOwned(native: Readonly<Record<string, unknown>> | null, owned: OwnedCap, schema: z.ZodType | null): MergedSlice;

package/dist/builtins/device-manager/fleet-read-census.d.ts

@@ -1,66 +1,104 @@
-import { IScopedLogger } from '@camstack/types';
+/**
+* Which CALL SITE reads the whole fleet — measured, never inferred.
+*
+* ## The number this exists to explain
+*
+* The sqlite profiler measured `query device-manager:devices`, shape
+* `SELECT … ORDER BY "deviceId" ASC LIMIT ?`, at **4 149 calls and 4 219 533
+* rows in one 66-second boot window** (2026-08-25). Steady state is 39/min. The
+* comment in `device-queries.ts#listAll` has said "~3 000 for a 974-device boot"
+* for weeks and names nobody, because the engine reports an
+* `(op, collection, shape)` tuple — a statement, not a caller.
+*
+* Two candidates were read and EXCLUDED by hand: `device-manager.addon.ts`'s
+* `idToAddonId` warm and `device-bindings-store.ts`'s `getAllBindings`. Both are
+* boot one-shots. Picking the next most plausible reader is exactly what this
+* repo did twice in one afternoon and got wrong twice, at half a day each. An
+* attribution is a measurement or it is a guess.
+*
+* ## Why an env var, and not a `debug.*` action
+*
+* `pipeline-analytics`'s {@link StoreReadCensus} is armed through a custom
+* action, which is the right shape for a steady-state mystery: you notice, you
+* arm, you read. It cannot work here. **The storm is at BOOT** — by the time a
+* process is up enough to receive an action, the window being investigated has
+* closed. So this arms at CONSTRUCTION from `CAMSTACK_FLEET_READ_CENSUS_MS` and
+* closes itself after that many milliseconds.
+*
+* A bad value **disarms**. An env var someone fat-fingered must not quietly
+* install a stack capture on the fleet-read path until the next container
+* recreation.
+*
+* ## Why it reports through the logger
+*
+* The hub's in-memory log ring holds roughly 35 minutes. A boot measurement
+* asked about an hour later is simply gone — that is what turned the
+* native-capture question into an UNKNOWN until Loki was used instead. A logged
+* report lands in Loki, which carries 12 h and more.
+*/
+import type { IScopedLogger } from "@camstack/types";
 /** One attributed call site. */
 export interface FleetCensusRow {
-    readonly site: string;
-    readonly calls: number;
-    readonly rows: number;
+	readonly site: string;
+	readonly calls: number;
+	readonly rows: number;
 }
 export declare class FleetReadCensus {
-    /**
-     * Longest window the census may be armed for.
-     *
-     * Ten minutes covers a boot several times over and bounds what an operator
-     * pays if they set the variable and forget it. A diagnostic that can be left
-     * on becomes a tax nobody remembers enabling.
-     */
-    static readonly MAX_WINDOW_MS: number;
-    readonly windowMs: number;
-    private readonly closesAt;
-    private readonly counts;
-    private reported;
-    constructor(rawEnv: string | undefined, nowMs: number);
-    get armed(): boolean;
-    /** Test seam: pretend the window closed. Production reads the clock. */
-    closeAt(nowMs: number): void;
-    private forceClosed;
-    private isOpen;
-    /**
-     * Capture the caller, or `null` when the window is shut.
-     *
-     * Called at the START of a read. A read that began inside the window belongs
-     * to it even if it lands after the close — otherwise the slow reads at the
-     * edge would be attributed to nobody, and the slow ones are the interesting
-     * ones.
-     *
-     * `callerAddonId`, when given, is formatted as the site VERBATIM instead of
-     * walking the local stack. A call that arrived over the cap channel — a
-     * forked addon's `ctx.api.deviceManager.listAll.query()`, routed through
-     * `LocalChildRegistry` → `onUnownedCall` → `CapRouteResolver` — carries its
-     * origin as DATA (the registered `childId` the parent captured off the UDS
-     * connection), and no amount of stack depth would ever recover it: every
-     * frame between the socket read and this call is the SAME generic
-     * dispatcher code (`onUnownedCall`, `dispatch`, `invoke`) regardless of
-     * which addon called — the 2026-08-25 boot census measured this directly,
-     * five thousand calls landing on `listAll` with nothing nameable above it.
-     *
-     * `isOpen` is checked FIRST, before the id is even looked at — a caller
-     * threading a (cheap, already-known) `callerAddonId` through on every
-     * request, armed or not, must not pay for the template string when
-     * disarmed. This is also why formatting lives HERE rather than at the call
-     * site: `DeviceRowStore` passes the raw id through unconditionally, and
-     * only this method — which already knows whether armed — decides whether
-     * to spend anything on it.
-     */
-    siteOf(callerAddonId?: string, nowMs?: number): string | null;
-    /** Count one read at an already-captured site. A `null` site is not counted. */
-    record(site: string | null, rowCount: number): void;
-    /** Attributed sites, busiest first. */
-    rows(): readonly FleetCensusRow[];
-    /**
-     * Emit the report ONCE.
-     *
-     * `perMin` is included because the raw count is unreadable without the window
-     * it was taken over — "4 149" means nothing until you know it was 66 seconds.
-     */
-    report(logger: IScopedLogger, elapsedMs: number): void;
+	/**
+	* Longest window the census may be armed for.
+	*
+	* Ten minutes covers a boot several times over and bounds what an operator
+	* pays if they set the variable and forget it. A diagnostic that can be left
+	* on becomes a tax nobody remembers enabling.
+	*/
+	static readonly MAX_WINDOW_MS: number;
+	readonly windowMs: number;
+	private readonly closesAt;
+	private readonly counts;
+	private reported;
+	constructor(rawEnv: string | undefined, nowMs: number);
+	get armed(): boolean;
+	/** Test seam: pretend the window closed. Production reads the clock. */
+	closeAt(nowMs: number): void;
+	private forceClosed;
+	private isOpen;
+	/**
+	* Capture the caller, or `null` when the window is shut.
+	*
+	* Called at the START of a read. A read that began inside the window belongs
+	* to it even if it lands after the close — otherwise the slow reads at the
+	* edge would be attributed to nobody, and the slow ones are the interesting
+	* ones.
+	*
+	* `callerAddonId`, when given, is formatted as the site VERBATIM instead of
+	* walking the local stack. A call that arrived over the cap channel — a
+	* forked addon's `ctx.api.deviceManager.listAll.query()`, routed through
+	* `LocalChildRegistry` → `onUnownedCall` → `CapRouteResolver` — carries its
+	* origin as DATA (the registered `childId` the parent captured off the UDS
+	* connection), and no amount of stack depth would ever recover it: every
+	* frame between the socket read and this call is the SAME generic
+	* dispatcher code (`onUnownedCall`, `dispatch`, `invoke`) regardless of
+	* which addon called — the 2026-08-25 boot census measured this directly,
+	* five thousand calls landing on `listAll` with nothing nameable above it.
+	*
+	* `isOpen` is checked FIRST, before the id is even looked at — a caller
+	* threading a (cheap, already-known) `callerAddonId` through on every
+	* request, armed or not, must not pay for the template string when
+	* disarmed. This is also why formatting lives HERE rather than at the call
+	* site: `DeviceRowStore` passes the raw id through unconditionally, and
+	* only this method — which already knows whether armed — decides whether
+	* to spend anything on it.
+	*/
+	siteOf(callerAddonId?: string, nowMs?: number): string | null;
+	/** Count one read at an already-captured site. A `null` site is not counted. */
+	record(site: string | null, rowCount: number): void;
+	/** Attributed sites, busiest first. */
+	rows(): readonly FleetCensusRow[];
+	/**
+	* Emit the report ONCE.
+	*
+	* `perMin` is included because the raw count is unreadable without the window
+	* it was taken over — "4 149" means nothing until you know it was 66 seconds.
+	*/
+	report(logger: IScopedLogger, elapsedMs: number): void;
 }

package/dist/builtins/device-manager/image-settings-config-schema.d.ts

@@ -1,12 +1,22 @@
-import { ConfigUISchema, ImageSettingsOptions, ImageSettingsPatch, ImageSettingsStatus } from '@camstack/types';
 /**
- * Build the `image-settings` `ConfigUISchema` from the camera-probed
- * options + current status. Returns `null` when the camera exposes no
- * configurable property.
- */
+* image-settings — server-side `ConfigUISchema` builder + form-patch
+* parser. Sibling of `day-night-config-schema.ts` — see that file's
+* header for why this lives in `@camstack/system` rather than
+* `@camstack/types`.
+*
+* Field keys use the `imageSettings_<prop>` prefix so a flat form patch
+* can be re-parsed into an `ImageSettingsPatch` by
+* `parseImageSettingsFormPatch`.
+*/
+import type { ConfigUISchema, ImageSettingsOptions, ImageSettingsPatch, ImageSettingsStatus } from "@camstack/types";
+/**
+* Build the `image-settings` `ConfigUISchema` from the camera-probed
+* options + current status. Returns `null` when the camera exposes no
+* configurable property.
+*/
 export declare function buildImageSettingsConfigSchema(options: ImageSettingsOptions, status: ImageSettingsStatus | null): ConfigUISchema | null;
 /**
- * Re-parse a flat `ConfigFormBuilder` patch into an `ImageSettingsPatch`.
- * Returns an empty object when no `imageSettings_*` field changed.
- */
+* Re-parse a flat `ConfigFormBuilder` patch into an `ImageSettingsPatch`.
+* Returns an empty object when no `imageSettings_*` field changed.
+*/
 export declare function parseImageSettingsFormPatch(patch: Record<string, unknown>): ImageSettingsPatch;

package/dist/builtins/device-manager/index.d.ts

@@ -1,2 +1,2 @@
-export { DeviceManagerAddon } from './device-manager.addon.js';
-export { default } from './device-manager.addon.js';
+export { DeviceManagerAddon } from "./device-manager.addon.js";
+export { default } from "./device-manager.addon.js";

package/dist/builtins/device-manager/linked-devices-manual-backfill.d.ts

@@ -1,16 +1,27 @@
-import { LinkCandidate } from './device-linked-devices.js';
-import { ProviderContext } from './device-provider-context.js';
+/**
+* One-shot boot backfill for D356: the `auto` link mode is retired, and a
+* camera that never chose `manual` was linked by location until today.
+*
+* A rule an operator relied on cannot vanish on an update — a notification
+* that named a linked siren, a tracked-event source — so what `auto`
+* resolved is written ONCE into the camera's manual list, and the operator
+* PRUNES from the picker instead of discovering an absence. A camera that
+* already said `manual` is left exactly as it is. Runs under a version
+* marker in the addon store, like the location backfill it sits next to.
+*/
+import type { LinkCandidate } from "./device-linked-devices.js";
+import type { ProviderContext } from "./device-provider-context.js";
 export declare const LINKED_MANUAL_BACKFILL_MARKER_KEY = "_linkedDevicesManualBackfillVersion";
 export declare const LINKED_MANUAL_BACKFILL_VERSION = 1;
 export interface ManualBackfillPlan {
-    /** `false` = the camera was already on `manual`; nothing to write. */
-    readonly write: boolean;
-    readonly manualIds: readonly number[];
+	/** `false` = the camera was already on `manual`; nothing to write. */
+	readonly write: boolean;
+	readonly manualIds: readonly number[];
 }
 export declare function planManualBackfill(params: {
-    readonly selfId: number;
-    readonly selfLocation: string | null;
-    readonly blob: Record<string, unknown>;
-    readonly candidates: readonly LinkCandidate[];
+	readonly selfId: number;
+	readonly selfLocation: string | null;
+	readonly blob: Record<string, unknown>;
+	readonly candidates: readonly LinkCandidate[];
 }): ManualBackfillPlan;
 export declare function runLinkedDevicesManualBackfillAtBoot(pctx: ProviderContext): Promise<void>;