@camstack/system 1.2.62 → 1.2.63

package/dist/addon-runner.js

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_manifest_python_deps = require("./manifest-python-deps-d4acYXVV.js");
+const require_manifest_python_deps = require("./manifest-python-deps-DNfmBu20.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let node_v8 = require("node:v8");
 node_v8 = require_chunk.__toESM(node_v8);

package/dist/addon-runner.mjs

@@ -1,4 +1,4 @@
-import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-CX5tGRqf.mjs";
+import { Ct as resolveAddonClass, I as createUdsLoggerWithControl, L as LocalChildClient, at as setWorkerNativeCapsChangeListener, bt as installManifestNativeDeps, i as createUdsAddonContext, nt as getWorkerNativeCapProvider, rt as getWorkerNativeCapSnapshot, st as validateProviderRegistrations, t as installManifestPythonDeps } from "./manifest-python-deps-CopL1_5C.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { register } from "node:module";
 import * as v8 from "node:v8";

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, m as addonPagesCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-DnKpFaP1.mjs";
+import { Lt as EventCategory, dt as BaseAddon, h as addonPagesCapability, ut as errMsg } from "../../dist-BJ2w3uoN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { ft as errMsg, g as addonWidgetsCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-DnKpFaP1.mjs";
+import { Lt as EventCategory, _ as addonWidgetsCapability, dt as BaseAddon, ut as errMsg } from "../../dist-BJ2w3uoN.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import { createHash, randomUUID } from "node:crypto";
 import * as fs from "node:fs";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as createEvent, _ as alertsCapability, ft as errMsg, n as AlertSchema, pt as BaseAddon, zt as EventCategory } from "../../dist-DnKpFaP1.mjs";
+import { Lt as EventCategory, dt as BaseAddon, n as AlertSchema, ut as errMsg, v as alertsCapability, wt as createEvent } from "../../dist-BJ2w3uoN.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { b as backupCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-DnKpFaP1.mjs";
+import { Lt as EventCategory, b as backupCapability, dt as BaseAddon } from "../../dist-BJ2w3uoN.mjs";
 import { randomBytes, randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import Kt from "node:fs";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { G as logDestinationCapability, pt as BaseAddon } from "../../dist-DnKpFaP1.mjs";
+import { G as logDestinationCapability, dt as BaseAddon } from "../../dist-BJ2w3uoN.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/block-package.d.ts

@@ -1,34 +1,16 @@
+import { coreBlockAddonId, coreBlockIdFromAddonId } from '@camstack/types';
 /**
- * Turning a stored block into something the addon runner can fork.
+ * The runner id lives on the CAPABILITY, not here.
  *
- * The runner already knows how to do everything a block needs — fork a
- * process, build the full UDS `ctx`, redirect host-provided imports, and hand
- * the whole thing to `CrashSupervisor` (D6). What it does NOT know how to do is
- * load code out of a database row: `addon-runner` reads a package.json off
- * disk. So a block is MATERIALISED as a minimal addon package and spawned like
- * any other addon. No second runner, no second supervisor, no `node:vm`.
- *
- * Two files are generated per block:
- *
- *   `dist/block.js` — the author's TypeScript, transpiled.
- *   `dist/index.js` — a generated wrapper that adapts the author's contract
- *                     (`export default (ctx) => disposer`) to `ICamstackAddon`.
- *
- * The wrapper exists so the author never writes `super({})`, which is the trap
- * that killed `CoreBlocksAddon` in production while the build stayed green and
- * the topology reported it running.
+ * It stopped being an implementation detail the day the operator surface
+ * started reading a block's logs by asking `logs.query` for
+ * `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+ * string would drift into a logs pane that is silently always empty, so these
+ * are re-exports under the names this package already used.
  */
-/** Prefix for the generated addon id AND the runner id — one addon, one
- *  process, so the two are the same string (D2). Grep-able on purpose: an
- *  operator reading `$process.list` must be able to tell a block runner from
- *  an addon runner at a glance. */
 export declare const BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-export declare function blockAddonId(blockId: string): string;
-/** The block id behind a generated addon/runner id, or null when the id
- *  belongs to something else. The inverse of {@link blockAddonId} — used to
- *  read the live process list back into block terms. */
-export declare function blockIdFromAddonId(addonId: string): string | null;
+export declare const blockAddonId: typeof coreBlockAddonId;
+export declare const blockIdFromAddonId: typeof coreBlockIdFromAddonId;
 export interface MaterializeBlockInput {
     /** Root under which every block package lives — one directory per block. */
     readonly root: string;

package/dist/builtins/core-blocks/block-supervisor.d.ts

@@ -65,6 +65,21 @@ export declare class BlockSupervisor {
      *  next one, and the reason belongs in the log, not in a rejected promise
      *  nobody awaits. */
     converge(): Promise<void>;
+    /**
+     * Stop one block's runner and let the pass that follows bring it back.
+     *
+     * The same path a code change already takes (see `stale` in `reconcile`),
+     * exposed on purpose. It writes NO state of its own: forgetting the
+     * materialised `updatedAt` is what makes the next pass treat the block as
+     * needing a launch, and that pass is still the authority — so a restart that
+     * raced a converge ends with one runner, not two.
+     *
+     * Queued on the same chain as `converge()`: a restart that interleaved with a
+     * timer tick could stop a runner the tick had just decided was healthy and
+     * then never re-launch it.
+     */
+    restart(blockId: string): Promise<void>;
+    private runRestart;
     private runPass;
     private reconcile;
     /** Compile, write the package, spawn. Each failure is reported ON the block

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-DgPUarcs.js");
+const require_dist = require("../../dist-LDrOFrd-.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
@@ -27,23 +27,18 @@ node_fs_promises = require_chunk.__toESM(node_fs_promises);
 * that killed `CoreBlocksAddon` in production while the build stayed green and
 * the topology reported it running.
 */
-/** Prefix for the generated addon id AND the runner id — one addon, one
-*  process, so the two are the same string (D2). Grep-able on purpose: an
-*  operator reading `$process.list` must be able to tell a block runner from
-*  an addon runner at a glance. */
-var BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-function blockAddonId(blockId) {
-	return `${BLOCK_ADDON_PREFIX}${blockId}`;
-}
-/** The block id behind a generated addon/runner id, or null when the id
-*  belongs to something else. The inverse of {@link blockAddonId} — used to
-*  read the live process list back into block terms. */
-function blockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
-}
+/**
+* The runner id lives on the CAPABILITY, not here.
+*
+* It stopped being an implementation detail the day the operator surface
+* started reading a block's logs by asking `logs.query` for
+* `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+* string would drift into a logs pane that is silently always empty, so these
+* are re-exports under the names this package already used.
+*/
+var BLOCK_ADDON_PREFIX = require_dist.CORE_BLOCK_ADDON_PREFIX;
+var blockAddonId = require_dist.coreBlockAddonId;
+var blockIdFromAddonId = require_dist.coreBlockIdFromAddonId;
 /**
 * The wrapper module, generated verbatim.
 *
@@ -207,6 +202,36 @@ var BlockSupervisor = class {
 		this.inFlight = this.inFlight.then(() => this.runPass(), () => this.runPass());
 		return this.inFlight;
 	}
+	/**
+	* Stop one block's runner and let the pass that follows bring it back.
+	*
+	* The same path a code change already takes (see `stale` in `reconcile`),
+	* exposed on purpose. It writes NO state of its own: forgetting the
+	* materialised `updatedAt` is what makes the next pass treat the block as
+	* needing a launch, and that pass is still the authority — so a restart that
+	* raced a converge ends with one runner, not two.
+	*
+	* Queued on the same chain as `converge()`: a restart that interleaved with a
+	* timer tick could stop a runner the tick had just decided was healthy and
+	* then never re-launch it.
+	*/
+	restart(blockId) {
+		this.inFlight = this.inFlight.then(() => this.runRestart(blockId), () => this.runRestart(blockId));
+		return this.inFlight;
+	}
+	async runRestart(blockId) {
+		try {
+			await this.deps.host.stop(blockAddonId(blockId));
+			this.deps.logger.info("core block runner stopped for restart", { meta: { blockId } });
+		} catch (err) {
+			this.deps.logger.warn("could not stop the core block runner before restart", { meta: {
+				blockId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+		this.materialized.delete(blockId);
+		await this.runPass();
+	}
 	async runPass() {
 		try {
 			await this.reconcile();
@@ -821,6 +846,27 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 				this.convergeSoon();
 				return { block: updated };
 			},
+			/**
+			* Awaited, unlike every other write here.
+			*
+			* `create`/`update` deliberately do not wait — the write is already
+			* durable and converging forks a process. A restart has no durable half:
+			* the whole thing IS the converge, so returning before it ran would hand
+			* the operator the old status and read as "nothing happened".
+			*/
+			restart: async ({ blockId }) => {
+				const store = this.requireStore();
+				const block = store.get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				if (!block.enabled) throw new Error(`core-blocks: "${block.name}" is disabled — enable it instead of restarting it`);
+				if (this.supervisor === null) throw new Error("core-blocks: no block supervisor runs on this node — nothing here can restart a block");
+				this.ctx.logger.info("core block restart requested", { meta: {
+					blockId,
+					name: block.name
+				} });
+				await this.supervisor.restart(blockId);
+				return { block: store.get(blockId) ?? block };
+			},
 			compile: async ({ code }) => {
 				if (this.transpiler === null) return {
 					ok: false,
@@ -866,16 +912,37 @@ function createBrokerProcessHost(broker) {
 		}
 	};
 }
-/** Load esbuild lazily. Returns null — never throws — so a node without it
-*  still boots, with the compile gate refusing writes rather than the node
-*  refusing to start. */
+/**
+* Load esbuild lazily, and PROVE IT WORKS before trusting it.
+*
+* Returns null — never throws — so a node without a usable compiler still
+* boots, with the compile gate refusing writes rather than the node refusing
+* to start.
+*
+* The probe is not defensive decoration. On the live hub, 2026-08-08, the
+* import succeeded and `transform()` threw *"The esbuild JavaScript API cannot
+* be bundled"* (it had been inlined into `@camstack/system`'s dist, so it could
+* no longer find its own native binary). Importing successfully was therefore
+* NOT evidence the compiler worked — and because the failure arrived at
+* transform time, every save came back as
+* `core-blocks: the code does not compile: …`, which blames the author for a
+* broken node. Nobody could have written source that passed. One transform at
+* boot converts that into the honest answer the rest of this file already
+* gives: the compiler is unavailable here.
+*/
 async function loadTranspiler(logger) {
 	try {
-		const transform = (await Promise.resolve().then(() => /* @__PURE__ */ require_chunk.__toESM(require("../../main-CVLq8IzA.js").default))).transform;
+		const transform = (await import("esbuild")).transform;
 		if (typeof transform !== "function") return null;
-		return { transform };
+		const transpiler = { transform };
+		await transpiler.transform("export default 0", {
+			loader: "ts",
+			format: "esm",
+			target: "node22"
+		});
+		return transpiler;
 	} catch (err) {
-		logger.warn("core-blocks: esbuild unavailable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		logger.warn("core-blocks: esbuild unusable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		return null;
 	}
 }

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,4 @@
-import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { C as coreBlocksCapability, o as CoreBlockSchema, pt as BaseAddon } from "../../dist-DnKpFaP1.mjs";
+import { C as coreBlockAddonId, T as coreBlocksCapability, dt as BaseAddon, o as CORE_BLOCK_ADDON_PREFIX, s as CoreBlockSchema, w as coreBlockIdFromAddonId } from "../../dist-BJ2w3uoN.mjs";
 import { randomUUID } from "node:crypto";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
@@ -24,23 +23,18 @@ import * as fs from "node:fs/promises";
 * that killed `CoreBlocksAddon` in production while the build stayed green and
 * the topology reported it running.
 */
-/** Prefix for the generated addon id AND the runner id — one addon, one
-*  process, so the two are the same string (D2). Grep-able on purpose: an
-*  operator reading `$process.list` must be able to tell a block runner from
-*  an addon runner at a glance. */
-var BLOCK_ADDON_PREFIX = "core-block-";
-/** The generated addon/runner id for a block. */
-function blockAddonId(blockId) {
-	return `${BLOCK_ADDON_PREFIX}${blockId}`;
-}
-/** The block id behind a generated addon/runner id, or null when the id
-*  belongs to something else. The inverse of {@link blockAddonId} — used to
-*  read the live process list back into block terms. */
-function blockIdFromAddonId(addonId) {
-	if (!addonId.startsWith("core-block-")) return null;
-	const rest = addonId.slice(11);
-	return rest.length > 0 ? rest : null;
-}
+/**
+* The runner id lives on the CAPABILITY, not here.
+*
+* It stopped being an implementation detail the day the operator surface
+* started reading a block's logs by asking `logs.query` for
+* `addonId = core-block-<id>` — with no cap of its own. A second copy of the
+* string would drift into a logs pane that is silently always empty, so these
+* are re-exports under the names this package already used.
+*/
+var BLOCK_ADDON_PREFIX = CORE_BLOCK_ADDON_PREFIX;
+var blockAddonId = coreBlockAddonId;
+var blockIdFromAddonId = coreBlockIdFromAddonId;
 /**
 * The wrapper module, generated verbatim.
 *
@@ -204,6 +198,36 @@ var BlockSupervisor = class {
 		this.inFlight = this.inFlight.then(() => this.runPass(), () => this.runPass());
 		return this.inFlight;
 	}
+	/**
+	* Stop one block's runner and let the pass that follows bring it back.
+	*
+	* The same path a code change already takes (see `stale` in `reconcile`),
+	* exposed on purpose. It writes NO state of its own: forgetting the
+	* materialised `updatedAt` is what makes the next pass treat the block as
+	* needing a launch, and that pass is still the authority — so a restart that
+	* raced a converge ends with one runner, not two.
+	*
+	* Queued on the same chain as `converge()`: a restart that interleaved with a
+	* timer tick could stop a runner the tick had just decided was healthy and
+	* then never re-launch it.
+	*/
+	restart(blockId) {
+		this.inFlight = this.inFlight.then(() => this.runRestart(blockId), () => this.runRestart(blockId));
+		return this.inFlight;
+	}
+	async runRestart(blockId) {
+		try {
+			await this.deps.host.stop(blockAddonId(blockId));
+			this.deps.logger.info("core block runner stopped for restart", { meta: { blockId } });
+		} catch (err) {
+			this.deps.logger.warn("could not stop the core block runner before restart", { meta: {
+				blockId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+		}
+		this.materialized.delete(blockId);
+		await this.runPass();
+	}
 	async runPass() {
 		try {
 			await this.reconcile();
@@ -818,6 +842,27 @@ var CoreBlocksAddon = class extends BaseAddon {
 				this.convergeSoon();
 				return { block: updated };
 			},
+			/**
+			* Awaited, unlike every other write here.
+			*
+			* `create`/`update` deliberately do not wait — the write is already
+			* durable and converging forks a process. A restart has no durable half:
+			* the whole thing IS the converge, so returning before it ran would hand
+			* the operator the old status and read as "nothing happened".
+			*/
+			restart: async ({ blockId }) => {
+				const store = this.requireStore();
+				const block = store.get(blockId);
+				if (block === null) throw new Error(`core-blocks: no block "${blockId}"`);
+				if (!block.enabled) throw new Error(`core-blocks: "${block.name}" is disabled — enable it instead of restarting it`);
+				if (this.supervisor === null) throw new Error("core-blocks: no block supervisor runs on this node — nothing here can restart a block");
+				this.ctx.logger.info("core block restart requested", { meta: {
+					blockId,
+					name: block.name
+				} });
+				await this.supervisor.restart(blockId);
+				return { block: store.get(blockId) ?? block };
+			},
 			compile: async ({ code }) => {
 				if (this.transpiler === null) return {
 					ok: false,
@@ -863,16 +908,37 @@ function createBrokerProcessHost(broker) {
 		}
 	};
 }
-/** Load esbuild lazily. Returns null — never throws — so a node without it
-*  still boots, with the compile gate refusing writes rather than the node
-*  refusing to start. */
+/**
+* Load esbuild lazily, and PROVE IT WORKS before trusting it.
+*
+* Returns null — never throws — so a node without a usable compiler still
+* boots, with the compile gate refusing writes rather than the node refusing
+* to start.
+*
+* The probe is not defensive decoration. On the live hub, 2026-08-08, the
+* import succeeded and `transform()` threw *"The esbuild JavaScript API cannot
+* be bundled"* (it had been inlined into `@camstack/system`'s dist, so it could
+* no longer find its own native binary). Importing successfully was therefore
+* NOT evidence the compiler worked — and because the failure arrived at
+* transform time, every save came back as
+* `core-blocks: the code does not compile: …`, which blames the author for a
+* broken node. Nobody could have written source that passed. One transform at
+* boot converts that into the honest answer the rest of this file already
+* gives: the compiler is unavailable here.
+*/
 async function loadTranspiler(logger) {
 	try {
-		const transform = (await import("../../main-CzH19GkU.mjs").then((m) => /* @__PURE__ */ __toESM(m.default))).transform;
+		const transform = (await import("esbuild")).transform;
 		if (typeof transform !== "function") return null;
-		return { transform };
+		const transpiler = { transform };
+		await transpiler.transform("export default 0", {
+			loader: "ts",
+			format: "esm",
+			target: "node22"
+		});
+		return transpiler;
 	} catch (err) {
-		logger.warn("core-blocks: esbuild unavailable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		logger.warn("core-blocks: esbuild unusable — code cannot be compiled on this node", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		return null;
 	}
 }

package/dist/builtins/device-manager/device-bindings-store.d.ts

@@ -1,5 +1,5 @@
-import { AddonContext, DeviceBindingEntry, ICapabilityRegistry } from '@camstack/types';
-import { DeviceBindingsStore } from './device-meta-types.js';
+import { AddonContext, CapabilityDefinition, DeviceBindingEntry, ICapabilityRegistry } from '@camstack/types';
+import { AddonStore, DeviceBindingsStore } from './device-meta-types.js';
 /** Push-fed remote native-cap cache shape (numeric deviceId → capName → owner). */
 export type RemoteNativeCaps = Map<number, Map<string, {
     addonId: string;
@@ -14,9 +14,6 @@ export interface BindingsDeps {
     readonly ctx: AddonContext;
     readonly capabilityRegistry: ICapabilityRegistry | undefined;
     readonly remoteNativeCaps: RemoteNativeCaps;
-    /** O(1) gate over devices that have `deviceLinks` (the addon's live set).
-     *  Optional: when absent, getBindings adds no virtual `linked` entries. */
-    readonly devicesWithLinks?: ReadonlySet<number>;
 }
 /**
  * Wire the push-fed cross-process native-cap cache (`remoteNativeCaps`).
@@ -72,6 +69,32 @@ export declare function resolveRemoteNativeCapFromRegistry(deps: BindingsDeps, c
     addonId: string;
     nodeId: string;
 } | null;
+/**
+ * Resolve the device's declared TYPE (`'camera'`, `'event-emitter'`, …), or
+ * `undefined` when it cannot be established.
+ *
+ * The PERSISTED meta is the authority: `ctx.kernel.deviceRegistry` is hub-only
+ * and has been observed empty in the very process that answers `getBindings`
+ * correctly (see the note on `getAllBindings`). The registry is consulted only
+ * as a secondary source, for a device constructed but not yet persisted.
+ *
+ * `undefined` is a first-class answer and callers must treat it as "no
+ * filtering" — an absent row must never be the reason a device loses bindings.
+ */
+export declare function resolveDeviceType(deps: BindingsDeps, rawStore: AddonStore, deviceId: number): string | undefined;
+/**
+ * Does a capability apply to a device of type `deviceType`?
+ *
+ * The cap's `deviceTypes` is the ONLY declaration consulted (D4: behavioural
+ * cap metadata lives in the `*.cap.ts`, never in a manifest). Two deliberate
+ * fail-open cases:
+ *
+ *   - a cap that declares no `deviceTypes` (or an empty list) applies to every
+ *     device — the pre-existing, back-compatible semantics;
+ *   - an UNKNOWN `deviceType` never filters, so a missing/failed meta lookup
+ *     changes nothing (D49: a read that fails must not destroy work).
+ */
+export declare function capAppliesToDeviceType(def: CapabilityDefinition | undefined, deviceType: string | undefined): boolean;
 export declare function getBindings(deps: BindingsDeps, input: {
     deviceId: number;
 }): Promise<{

package/dist/builtins/device-manager/device-linked-devices.d.ts

@@ -1,4 +1,4 @@
-import { ConfigUISchemaWithValues, DeviceLinkMode, IDeviceManagerProvider } from '@camstack/types';
+import { ConfigUISchemaWithValues, IDeviceManagerProvider, LinkedDevicesMode } from '@camstack/types';
 import { ProviderContext } from './device-provider-context.js';
 /** Reserved device-config keys (cf. `_profileMap`). */
 export declare const LINKED_MODE_CONFIG_KEY = "_linkedDevicesMode";
@@ -9,7 +9,7 @@ export declare const LINKED_IDS_CONFIG_KEY = "_linkedDeviceIds";
  *  auto-materialized sensor snapshots the operator never asked for). */
 export declare const LINKED_TRACKED_IDS_CONFIG_KEY = "_linkedDeviceTrackedIds";
 export interface LinkedDevicesConfig {
-    readonly mode: DeviceLinkMode;
+    readonly mode: LinkedDevicesMode;
     readonly manualIds: readonly number[];
 }
 /** Parse the two reserved keys out of a device-config blob. Tolerant:

package/dist/builtins/device-manager/device-manager.addon.d.ts

@@ -1,6 +1,5 @@
 import { DeviceBindingEntry, BaseAddon, ProviderRegistration } from '@camstack/types';
 import { mergeAggregates } from './device-aggregation-merge.js';
-import { DependentLink, ResolvedTargetLink } from './device-link-overlay.js';
 import { ContributionShape } from './device-meta-types.js';
 export { mergeAggregates };
 export declare class DeviceManagerAddon extends BaseAddon {
@@ -49,53 +48,14 @@ export declare class DeviceManagerAddon extends BaseAddon {
      * the D3 re-handshake after device restore is the reliable replacement.
      */
     private remoteNativeCaps;
-    /** Device ids that currently have at least one `deviceLinks` entry. O(1) gate
-     *  consulted by `resolveLinkedStatus` so the cap-mount overlay is a no-op for
-     *  the vast majority of devices that have no links. Rebuilt on restore. */
-    private readonly devicesWithLinks;
-    /** Whether a device currently has cross-device links. */
-    devicesWithLinksHas(deviceId: number): boolean;
-    /** `${targetDeviceId}:${targetCap}` → resolved links feeding that cap's slice. */
-    private linkTargets;
-    /** `${sourceDeviceId}:${sourceCap}` → targets to recompute when that source changes. */
-    private linkDependents;
-    /** Expected source `stableId`s (`${container}-${sourceKey}` for sibling
-     *  sources, the full `sourceStableId` for global sources) across all links,
-     *  resolved or not — gates the `registerDevice` rebuild so only a registering
-     *  device that IS a link source triggers a reindex (not every boot restore). */
-    private expectedSourceStableIds;
-    /** In-flight `${deviceId}:${cap}` pairs of `resolveLinkedStatus` — the P2e
-     *  defensive re-entrancy guard bounding link cycles at resolve time. Mutated
-     *  in place (never reassigned), so the host exposes a direct reference. */
-    private readonly linkResolveInFlight;
-    /** Test/diagnostic accessors. */
-    linkTargetKeys(): string[];
-    linkDependentsKeys(): string[];
-    /** Replace the cross-device link reverse-index maps in one atomic swap.
-     *  Sole writer of `linkTargets` / `linkDependents` / `expectedSourceStableIds`;
-     *  called by `DeviceMetaStore.rebuildLinkDependents` via the `LinkIndexHost`. */
-    setLinkIndexes(targets: Map<string, ResolvedTargetLink[]>, dependents: Map<string, DependentLink[]>, expectedSourceStableIds: Set<string>): void;
-    /** Build the `LinkIndexHost` the meta store mutates — exposes this addon's
-     *  `devicesWithLinks` gate (read) + `setLinkIndexes` (write) without leaking
-     *  the private maps. */
-    private get linkIndexHost();
     /** The runtime-state mirror, asserted present (constructed in onInitialize). */
     private get stateMirror();
-    /** Build the `LinkOverlayHost` the state mirror reads when overlaying linked
-     *  values — exposes the link reverse-index maps + registry via LIVE thunks
-     *  (the maps are reassigned on every `rebuildLinkDependents`). Arrow thunks
-     *  capture `this` lexically so the getters never go stale. */
-    private get linkOverlayHost();
     /** Build the `ProviderHost` the extracted provider-method modules
      *  (`device-meta-actions`, `device-queries`) reach — exposes the addon's
      *  private state/methods they need without leaking the class internals.
      *
-     *  `expectedSourceStableIds` is exposed via a LIVE thunk: the field is
-     *  reassigned to a fresh Set on every `rebuildLinkDependents`, so a captured
-     *  reference would go stale. `devicesWithLinks` / `remoteNativeCaps` are
-     *  mutated in place (never reassigned) so a direct reference preserves the
-     *  original live semantics. The overlay-emit guard now lives in the state
-     *  mirror — pruning is routed through `dropDeviceOverlays`. */
+     *  `remoteNativeCaps` is mutated in place (never reassigned) so a direct
+     *  reference preserves the live semantics. */
     private get providerHost();
     /** Wait for a device-provider by addonId, returning null on timeout. */
     private waitDeviceProvider;
@@ -109,9 +69,7 @@ export declare class DeviceManagerAddon extends BaseAddon {
     private discoveryProviderLabel;
     /** Provider ids that report `supportsDiscovery() === true` (probed in parallel). */
     private listDiscoveryCapableProviderIds;
-    /** Build the dependency context the extracted binding resolvers consume.
-     *  `devicesWithLinks` is mutated in place (never reassigned) so the direct
-     *  reference stays live — it gates the virtual `linked` binding step. */
+    /** Build the dependency context the extracted binding resolvers consume. */
     private get bindingsDeps();
     getBindings(input: {
         deviceId: number;