@camstack/system 1.2.61 → 1.2.63

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-d4acYXVV.js");
+const require_manifest_python_deps = require("./manifest-python-deps-DNfmBu20.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-CX5tGRqf.mjs";
+import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-CopL1_5C.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as v8 from "node:v8";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
+import { Lt as EventCategory, dt as BaseAddon, h as addonPagesCapability, ut as errMsg } from "../../dist-BJ2w3uoN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
+import { Lt as EventCategory, _ as addonWidgetsCapability, dt as BaseAddon, ut as errMsg } from "../../dist-BJ2w3uoN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
+import { Lt as EventCategory, dt as BaseAddon, n as AlertSchema, ut as errMsg, v as alertsCapability, wt as createEvent } from "../../dist-BJ2w3uoN.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-L6QPJWsr.mjs";
+import { Lt as EventCategory, b as backupCapability, dt as BaseAddon } from "../../dist-BJ2w3uoN.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import Kt from "node:fs";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
+import { G as logDestinationCapability, dt as BaseAddon } from "../../dist-BJ2w3uoN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/block-package.d.ts

@@ -1,34 +1,16 @@
+import { coreBlockAddonId, coreBlockIdFromAddonId } from '@camstack/types';
 /**
- * Turning a stored block into something the addon runner can fork.
+ * The runner id lives on the CAPABILITY, not here.
  *
- * The runner already knows how to do everything a block needs — fork a
- * process, build the full UDS `ctx`, redirect host-provided imports, and hand
- * the whole thing to `CrashSupervisor` (D6). What it does NOT know how to do is
- * load code out of a database row: `addon-runner` reads a package.json off
- * disk. So a block is MATERIALISED as a minimal addon package and spawned like
- * any other addon. No second runner, no second supervisor, no `node:vm`.
- *
- * Two files are generated per block:
- *
- *   `dist/block.js` — the author's TypeScript, transpiled.
- *   `dist/index.js` — a generated wrapper that adapts the author's contract
- *                     (`export default (ctx) => disposer`) to `ICamstackAddon`.
- *
- * The wrapper exists so the author never writes `super({})`, which is the trap
- * that killed `CoreBlocksAddon` in production while the build stayed green and
- * the topology reported it running.
+ * It stopped being an implementation detail the day the operator surface
+ * started reading a block's logs by asking `logs.query` for
+ * `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+ * string would drift into a logs pane that is silently always empty, so these
+ * are re-exports under the names this package already used.
  */
-/** Prefix for the generated addon id AND the runner id — one addon, one
- *  process, so the two are the same string (D2). Grep-able on purpose: an
- *  operator reading `$process.list` must be able to tell a block runner from
- *  an addon runner at a glance. */
 export declare const BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-export declare function blockAddonId(blockId: string): string;
-/** The block id behind a generated addon/runner id, or null when the id
- *  belongs to something else. The inverse of {@link blockAddonId} — used to
- *  read the live process list back into block terms. */
-export declare function blockIdFromAddonId(addonId: string): string | null;
+export declare const blockAddonId: typeof coreBlockAddonId;
+export declare const blockIdFromAddonId: typeof coreBlockIdFromAddonId;
 export interface MaterializeBlockInput {
     /** Root under which every block package lives — one directory per block. */
     readonly root: string;

package/dist/builtins/core-blocks/block-supervisor.d.ts

@@ -65,6 +65,21 @@ export declare class BlockSupervisor {
      *  next one, and the reason belongs in the log, not in a rejected promise
      *  nobody awaits. */
     converge(): Promise<void>;
+    /**
+     * Stop one block's runner and let the pass that follows bring it back.
+     *
+     * The same path a code change already takes (see `stale` in `reconcile`),
+     * exposed on purpose. It writes NO state of its own: forgetting the
+     * materialised `updatedAt` is what makes the next pass treat the block as
+     * needing a launch, and that pass is still the authority — so a restart that
+     * raced a converge ends with one runner, not two.
+     *
+     * Queued on the same chain as `converge()`: a restart that interleaved with a
+     * timer tick could stop a runner the tick had just decided was healthy and
+     * then never re-launch it.
+     */
+    restart(blockId: string): Promise<void>;
+    private runRestart;
     private runPass;
     private reconcile;
     /** Compile, write the package, spawn. Each failure is reported ON the block

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BN681PgO.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -27,23 +27,18 @@ node_fs_promises = require_chunk.__toESM(node_fs_promises);
 * that killed `CoreBlocksAddon` in production while the build stayed green and
 * the topology reported it running.
 */
-/** Prefix for the generated addon id AND the runner id — one addon, one
-*  process, so the two are the same string (D2). Grep-able on purpose: an
-*  operator reading `$process.list` must be able to tell a block runner from
-*  an addon runner at a glance. */
-var BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-function blockAddonId(blockId) {
-	return `${BLOCK_ADDON_PREFIX}${blockId}`;
-}
-/** The block id behind a generated addon/runner id, or null when the id
-*  belongs to something else. The inverse of {@link blockAddonId} — used to
-*  read the live process list back into block terms. */
-function blockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
-}
+/**
+* The runner id lives on the CAPABILITY, not here.
+*
+* It stopped being an implementation detail the day the operator surface
+* started reading a block's logs by asking `logs.query` for
+* `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+* string would drift into a logs pane that is silently always empty, so these
+* are re-exports under the names this package already used.
+*/
+var BLOCK_ADDON_PREFIX = require_dist.CORE_BLOCK_ADDON_PREFIX;
+var blockAddonId = require_dist.coreBlockAddonId;
+var blockIdFromAddonId = require_dist.coreBlockIdFromAddonId;
 /**
 * The wrapper module, generated verbatim.
 *
@@ -207,6 +202,36 @@ var BlockSupervisor = class {
 		this.inFlight = this.inFlight.then(() => this.runPass(), () => this.runPass());
 		return this.inFlight;
 	}
+	/**
+	* Stop one block's runner and let the pass that follows bring it back.
+	*
+	* The same path a code change already takes (see `stale` in `reconcile`),
+	* exposed on purpose. It writes NO state of its own: forgetting the
+	* materialised `updatedAt` is what makes the next pass treat the block as
+	* needing a launch, and that pass is still the authority — so a restart that
+	* raced a converge ends with one runner, not two.
+	*
+	* Queued on the same chain as `converge()`: a restart that interleaved with a
+	* timer tick could stop a runner the tick had just decided was healthy and
+	* then never re-launch it.
+	*/
+	restart(blockId) {
+		this.inFlight = this.inFlight.then(() => this.runRestart(blockId), () => this.runRestart(blockId));
+		return this.inFlight;
+	}
+	async runRestart(blockId) {
+		try {
+			await this.deps.host.stop(blockAddonId(blockId));
+			this.deps.logger.info("core block runner stopped for restart", { meta: { blockId } });
+		} catch (err) {
+			this.deps.logger.warn("could not stop the core block runner before restart", { meta: {
+				blockId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+		this.materialized.delete(blockId);
+		await this.runPass();
+	}
 	async runPass() {
 		try {
 			await this.reconcile();
@@ -821,6 +846,27 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 				this.convergeSoon();
 				return { block: updated };
 			},
+			/**
+			* Awaited, unlike every other write here.
+			*
+			* `create`/`update` deliberately do not wait — the write is already
+			* durable and converging forks a process. A restart has no durable half:
+			* the whole thing IS the converge, so returning before it ran would hand
+			* the operator the old status and read as "nothing happened".
+			*/
+			restart: async ({ blockId }) => {
+				const store = this.requireStore();
+				const block = store.get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				if (!block.enabled) throw new Error(`core-blocks: "${block.name}" is disabled — enable it instead of restarting it`);
+				if (this.supervisor === null) throw new Error("core-blocks: no block supervisor runs on this node — nothing here can restart a block");
+				this.ctx.logger.info("core block restart requested", { meta: {
+					blockId,
+					name: block.name
+				} });
+				await this.supervisor.restart(blockId);
+				return { block: store.get(blockId) ?? block };
+			},
 			compile: async ({ code }) => {
 				if (this.transpiler === null) return {
 					ok: false,
@@ -866,16 +912,37 @@ function createBrokerProcessHost(broker) {
 		}
 	};
 }
-/** Load esbuild lazily. Returns null — never throws — so a node without it
-*  still boots, with the compile gate refusing writes rather than the node
-*  refusing to start. */
+/**
+* Load esbuild lazily, and PROVE IT WORKS before trusting it.
+*
+* Returns null — never throws — so a node without a usable compiler still
+* boots, with the compile gate refusing writes rather than the node refusing
+* to start.
+*
+* The probe is not defensive decoration. On the live hub, 2026-08-08, the
+* import succeeded and `transform()` threw *"The esbuild JavaScript API cannot
+* be bundled"* (it had been inlined into `@camstack/system`'s dist, so it could
+* no longer find its own native binary). Importing successfully was therefore
+* NOT evidence the compiler worked — and because the failure arrived at
+* transform time, every save came back as
+* `core-blocks: the code does not compile: …`, which blames the author for a
+* broken node. Nobody could have written source that passed. One transform at
+* boot converts that into the honest answer the rest of this file already
+* gives: the compiler is unavailable here.
+*/
 async function loadTranspiler(logger) {
 	try {
-		const transform = (await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("../../main-CVLq8IzA.js").default))).transform;
+		const transform = (await import("esbuild")).transform;
 		if (typeof transform !== "function") return null;
-		return { transform };
+		const transpiler = { transform };
+		await transpiler.transform("export default 0", {
+			loader: "ts",
+			format: "esm",
+			target: "node22"
+		});
+		return transpiler;
 	} catch (err) {
-		logger.warn("core-blocks: esbuild unavailable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		logger.warn("core-blocks: esbuild unusable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		return null;
 	}
 }

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,4 @@
-import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-L6QPJWsr.mjs";
+import { C as coreBlockAddonId, T as coreBlocksCapability, dt as BaseAddon, o as CORE_BLOCK_ADDON_PREFIX, s as CoreBlockSchema, w as coreBlockIdFromAddonId } from "../../dist-BJ2w3uoN.mjs";
 import { randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
@@ -24,23 +23,18 @@ import * as fs from "node:fs/promises";
 * that killed `CoreBlocksAddon` in production while the build stayed green and
 * the topology reported it running.
 */
-/** Prefix for the generated addon id AND the runner id — one addon, one
-*  process, so the two are the same string (D2). Grep-able on purpose: an
-*  operator reading `$process.list` must be able to tell a block runner from
-*  an addon runner at a glance. */
-var BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-function blockAddonId(blockId) {
-	return `${BLOCK_ADDON_PREFIX}${blockId}`;
-}
-/** The block id behind a generated addon/runner id, or null when the id
-*  belongs to something else. The inverse of {@link blockAddonId} — used to
-*  read the live process list back into block terms. */
-function blockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
-}
+/**
+* The runner id lives on the CAPABILITY, not here.
+*
+* It stopped being an implementation detail the day the operator surface
+* started reading a block's logs by asking `logs.query` for
+* `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+* string would drift into a logs pane that is silently always empty, so these
+* are re-exports under the names this package already used.
+*/
+var BLOCK_ADDON_PREFIX = CORE_BLOCK_ADDON_PREFIX;
+var blockAddonId = coreBlockAddonId;
+var blockIdFromAddonId = coreBlockIdFromAddonId;
 /**
 * The wrapper module, generated verbatim.
 *
@@ -204,6 +198,36 @@ var BlockSupervisor = class {
 		this.inFlight = this.inFlight.then(() => this.runPass(), () => this.runPass());
 		return this.inFlight;
 	}
+	/**
+	* Stop one block's runner and let the pass that follows bring it back.
+	*
+	* The same path a code change already takes (see `stale` in `reconcile`),
+	* exposed on purpose. It writes NO state of its own: forgetting the
+	* materialised `updatedAt` is what makes the next pass treat the block as
+	* needing a launch, and that pass is still the authority — so a restart that
+	* raced a converge ends with one runner, not two.
+	*
+	* Queued on the same chain as `converge()`: a restart that interleaved with a
+	* timer tick could stop a runner the tick had just decided was healthy and
+	* then never re-launch it.
+	*/
+	restart(blockId) {
+		this.inFlight = this.inFlight.then(() => this.runRestart(blockId), () => this.runRestart(blockId));
+		return this.inFlight;
+	}
+	async runRestart(blockId) {
+		try {
+			await this.deps.host.stop(blockAddonId(blockId));
+			this.deps.logger.info("core block runner stopped for restart", { meta: { blockId } });
+		} catch (err) {
+			this.deps.logger.warn("could not stop the core block runner before restart", { meta: {
+				blockId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+		this.materialized.delete(blockId);
+		await this.runPass();
+	}
 	async runPass() {
 		try {
 			await this.reconcile();
@@ -818,6 +842,27 @@ var CoreBlocksAddon = class extends BaseAddon {
 				this.convergeSoon();
 				return { block: updated };
 			},
+			/**
+			* Awaited, unlike every other write here.
+			*
+			* `create`/`update` deliberately do not wait — the write is already
+			* durable and converging forks a process. A restart has no durable half:
+			* the whole thing IS the converge, so returning before it ran would hand
+			* the operator the old status and read as "nothing happened".
+			*/
+			restart: async ({ blockId }) => {
+				const store = this.requireStore();
+				const block = store.get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				if (!block.enabled) throw new Error(`core-blocks: "${block.name}" is disabled — enable it instead of restarting it`);
+				if (this.supervisor === null) throw new Error("core-blocks: no block supervisor runs on this node — nothing here can restart a block");
+				this.ctx.logger.info("core block restart requested", { meta: {
+					blockId,
+					name: block.name
+				} });
+				await this.supervisor.restart(blockId);
+				return { block: store.get(blockId) ?? block };
+			},
 			compile: async ({ code }) => {
 				if (this.transpiler === null) return {
 					ok: false,
@@ -863,16 +908,37 @@ function createBrokerProcessHost(broker) {
 		}
 	};
 }
-/** Load esbuild lazily. Returns null — never throws — so a node without it
-*  still boots, with the compile gate refusing writes rather than the node
-*  refusing to start. */
+/**
+* Load esbuild lazily, and PROVE IT WORKS before trusting it.
+*
+* Returns null — never throws — so a node without a usable compiler still
+* boots, with the compile gate refusing writes rather than the node refusing
+* to start.
+*
+* The probe is not defensive decoration. On the live hub, 2026-08-08, the
+* import succeeded and `transform()` threw *"The esbuild JavaScript API cannot
+* be bundled"* (it had been inlined into `@camstack/system`'s dist, so it could
+* no longer find its own native binary). Importing successfully was therefore
+* NOT evidence the compiler worked — and because the failure arrived at
+* transform time, every save came back as
+* `core-blocks: the code does not compile: …`, which blames the author for a
+* broken node. Nobody could have written source that passed. One transform at
+* boot converts that into the honest answer the rest of this file already
+* gives: the compiler is unavailable here.
+*/
 async function loadTranspiler(logger) {
 	try {
-		const transform = (await import("../../main-CzH19GkU.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).transform;
+		const transform = (await import("esbuild")).transform;
 		if (typeof transform !== "function") return null;
-		return { transform };
+		const transpiler = { transform };
+		await transpiler.transform("export default 0", {
+			loader: "ts",
+			format: "esm",
+			target: "node22"
+		});
+		return transpiler;
 	} catch (err) {
-		logger.warn("core-blocks: esbuild unavailable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		logger.warn("core-blocks: esbuild unusable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		return null;
 	}
 }

package/dist/builtins/device-manager/device-aggregation.d.ts

@@ -88,6 +88,36 @@ export declare function resolveNativeDeviceOwner(deps: AggregationDeps, deviceId
     addonId: string;
     nodeId: string;
 } | null;
+/**
+ * How long ONE cap's `getStatus` may take before the aggregate gives up on it
+ * and reports `null`.
+ *
+ * A cap call for a device owned by another node crosses the cluster, where the
+ * transport's own ceiling is `REMOTE_CALL_TIMEOUT_MS` — SIXTY seconds. That
+ * ceiling is right for a deliberate operator action; it is catastrophic here,
+ * because this aggregate is what a camera LIST asks for on every boot, and it
+ * has no answer to give until the slowest cap replies.
+ *
+ * The failure this bounds is not a node that is DOWN — `classifyCapRoute`
+ * rejects those immediately with `node-offline`, which the catch below turns
+ * into `null` in microseconds. It is a node that is FLAPPING: a crash-looping
+ * agent re-registers every few seconds, so the registry believes it is online,
+ * the call is routed, and the peer dies mid-flight. Then nothing throws and
+ * nothing resolves. On 2026-08-08 little-unraid did exactly that for 22
+ * minutes and the viewer showed a loading skeleton the whole time.
+ *
+ * 3s is chosen against what a HEALTHY remote cap costs (a same-LAN cap call is
+ * single-digit ms; the slowest observed live is ~300ms) — so this cannot cut
+ * off a working node — and against what a human waits for a camera list.
+ */
+export declare const STATUS_CALL_DEADLINE_MS = 3000;
+/** Per-call bound for a status aggregation. Tests pass a small value; nothing
+ *  in production overrides the default. */
+export interface StatusAggregateOptions {
+    /** Deadline for a single cap's `getStatus`. Defaults to
+     *  {@link STATUS_CALL_DEADLINE_MS}. */
+    readonly deadlineMs?: number;
+}
 /**
  * Aggregate `status` across every registered cap for a device.
  *
@@ -99,6 +129,10 @@ export declare function resolveNativeDeviceOwner(deps: AggregationDeps, deviceId
  * overall aggregate stays usable — a single misbehaving provider
  * must not blank out a device's entire status view.
  *
+ * A provider that never answers is treated exactly like one that throws: it
+ * costs its own cap and nothing else. See {@link STATUS_CALL_DEADLINE_MS} for
+ * why a bound is needed at all when the transport already has one.
+ *
  * Returned shape is `Record<capName, unknown | null>`; the client-
  * side hook tightens this to `CapStatusTypeMap` via the generated
  * `cap-status-types.ts`.
@@ -106,7 +140,7 @@ export declare function resolveNativeDeviceOwner(deps: AggregationDeps, deviceId
 export declare function getDeviceStatusAggregate(deps: AggregationDeps, input: {
     readonly deviceId: number;
     readonly caps?: readonly string[];
-}): Promise<Record<string, unknown | null>>;
+}, options?: StatusAggregateOptions): Promise<Record<string, unknown | null>>;
 /**
  * `getDeviceStatusAggregate` for a LIST of devices, in one round-trip.
  *
@@ -120,11 +154,24 @@ export declare function getDeviceStatusAggregate(deps: AggregationDeps, input: {
  * A device whose whole aggregation fails still gets an ENTRY (all caps null)
  * rather than being omitted: a caller that reads a missing key as "not
  * answered yet" would keep the previous badge on screen forever.
+ *
+ * ## The response is BOUNDED, and that is load-bearing
+ *
+ * The windows are walked SEQUENTIALLY, so before the per-cap deadline existed a
+ * single unanswerable device did not merely cost its own window — it held every
+ * later window behind it, and the call never returned at all. That is the whole
+ * mechanism behind "one node offline and the app loads nothing": this is the
+ * one call a camera list makes for every card, the client has no timeout of its
+ * own, and a tRPC query that never settles is `isLoading` forever.
+ *
+ * The ceiling is now `ceil(devices / STATUS_BATCH_WINDOW) × STATUS_CALL_DEADLINE_MS`
+ * in the worst case (a dead device in every window), and unchanged when every
+ * node is healthy. It is never unbounded.
  */
 export declare function getDeviceStatusAggregateBatch(deps: AggregationDeps, input: {
     readonly deviceIds: readonly number[];
     readonly caps?: readonly string[];
-}): Promise<Record<string, Record<string, unknown | null>>>;
+}, options?: StatusAggregateOptions): Promise<Record<string, Record<string, unknown | null>>>;
 /**
  * Return the driver-specific device-settings contribution. Hub-local
  * devices call `getSettingsUISchema()` directly; forked-worker devices

package/dist/builtins/device-manager/device-bindings-store.d.ts

@@ -1,5 +1,5 @@
-import { AddonContext, DeviceBindingEntry, ICapabilityRegistry } from '@camstack/types';
-import { DeviceBindingsStore } from './device-meta-types.js';
+import { AddonContext, CapabilityDefinition, DeviceBindingEntry, ICapabilityRegistry } from '@camstack/types';
+import { AddonStore, DeviceBindingsStore } from './device-meta-types.js';
 /** Push-fed remote native-cap cache shape (numeric deviceId → capName → owner). */
 export type RemoteNativeCaps = Map<number, Map<string, {
     addonId: string;
@@ -14,9 +14,6 @@ export interface BindingsDeps {
     readonly ctx: AddonContext;
     readonly capabilityRegistry: ICapabilityRegistry | undefined;
     readonly remoteNativeCaps: RemoteNativeCaps;
-    /** O(1) gate over devices that have `deviceLinks` (the addon's live set).
-     *  Optional: when absent, getBindings adds no virtual `linked` entries. */
-    readonly devicesWithLinks?: ReadonlySet<number>;
 }
 /**
  * Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
@@ -72,6 +69,32 @@ export declare function resolveRemoteNativeCapFromRegistry(deps: BindingsDeps, c
     addonId: string;
     nodeId: string;
 } | null;
+/**
+ * Resolve the device's declared TYPE (`'camera'`, `'event-emitter'`, …), or
+ * `undefined` when it cannot be established.
+ *
+ * The PERSISTED meta is the authority: `ctx.kernel.deviceRegistry` is hub-only
+ * and has been observed empty in the very process that answers `getBindings`
+ * correctly (see the note on `getAllBindings`). The registry is consulted only
+ * as a secondary source, for a device constructed but not yet persisted.
+ *
+ * `undefined` is a first-class answer and callers must treat it as "no
+ * filtering" — an absent row must never be the reason a device loses bindings.
+ */
+export declare function resolveDeviceType(deps: BindingsDeps, rawStore: AddonStore, deviceId: number): string | undefined;
+/**
+ * Does a capability apply to a device of type `deviceType`?
+ *
+ * The cap's `deviceTypes` is the ONLY declaration consulted (D4: behavioural
+ * cap metadata lives in the `*.cap.ts`, never in a manifest). Two deliberate
+ * fail-open cases:
+ *
+ *   - a cap that declares no `deviceTypes` (or an empty list) applies to every
+ *     device — the pre-existing, back-compatible semantics;
+ *   - an UNKNOWN `deviceType` never filters, so a missing/failed meta lookup
+ *     changes nothing (D49: a read that fails must not destroy work).
+ */
+export declare function capAppliesToDeviceType(def: CapabilityDefinition | undefined, deviceType: string | undefined): boolean;
 export declare function getBindings(deps: BindingsDeps, input: {
     deviceId: number;
 }): Promise<{

package/dist/builtins/device-manager/device-linked-devices.d.ts

@@ -1,4 +1,4 @@
-import { ConfigUISchemaWithValues, DeviceLinkMode, IDeviceManagerProvider } from '@camstack/types';
+import { ConfigUISchemaWithValues, IDeviceManagerProvider, LinkedDevicesMode } from '@camstack/types';
 import { ProviderContext } from './device-provider-context.js';
 /** Reserved device-config keys (cf. `_profileMap`). */
 export declare const LINKED_MODE_CONFIG_KEY = "_linkedDevicesMode";
@@ -9,7 +9,7 @@ export declare const LINKED_IDS_CONFIG_KEY = "_linkedDeviceIds";
  *  auto-materialized sensor snapshots the operator never asked for). */
 export declare const LINKED_TRACKED_IDS_CONFIG_KEY = "_linkedDeviceTrackedIds";
 export interface LinkedDevicesConfig {
-    readonly mode: DeviceLinkMode;
+    readonly mode: LinkedDevicesMode;
     readonly manualIds: readonly number[];
 }
 /** Parse the two reserved keys out of a device-config blob. Tolerant: