@camstack/system 1.2.66 → 1.2.67

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CIkGOAcz.js");
+const require_dist = require("./dist-NRYjb8qK.js");
 const require_model_download_service = require("./model-download-service-Caj1kaSi.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BE6l8Y4W.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
@@ -6043,6 +6043,23 @@ var CapabilityRegistry = class CapabilityRegistry {
 		if (!state) return null;
 		return state.providers.get(addonId) ?? null;
 	}
+	/**
+	* Every registry KEY currently registered for `capability`, disabled ones
+	* included — i.e. exactly the ids {@link getProviderByAddonId} can resolve.
+	* Keys are bare (`homeassistant-export`) for hub-local providers and
+	* `<addonId>@<nodeId>` for providers that registered from another node.
+	*
+	* Exists so an unresolvable `{ addonId }` pin can REFUSE with the valid ids
+	* spelled out (the `addons.custom` unknown-id posture) instead of silently
+	* degrading to another provider's answer — a fabricated `addonId` used to
+	* return the first-registered provider's status, indistinguishable from
+	* success (2026-08-09).
+	*/
+	getProviderAddonIds(capability) {
+		const state = this.capabilities.get(capability);
+		if (!state) return [];
+		return [...state.providers.keys()];
+	}
 	/** Bare addonId from a registry key (`webrtc-native@dev-agent-0` → `webrtc-native`). */
 	bareAddonId(key) {
 		const at = key.indexOf("@");
@@ -6602,11 +6619,18 @@ function stripKeys(input, keys) {
 * the same local-first → remote-proxy routing the codegen's
 * `resolveProvider` does. `nodeId` undefined / `'hub'` resolves the local
 * provider; otherwise it crosses to the named node via the proxy.
+*
+* `pinnedAddonId` is the EXPLICIT top-level `{ addonId }` collection selector
+* (never the one recovered from a nested mutation payload). When it is set and
+* the local lookup misses, {@link CapRouterServices.rejectUnresolvedAddonPin}
+* gets to refuse before the hub-proxy fallthrough turns a wrong id into
+* another provider's answer.
 */
-function resolveProviderForCall(capName, nodeId, getLocal, services) {
+function resolveProviderForCall(capName, nodeId, getLocal, services, pinnedAddonId) {
 	if (!nodeId || nodeId === "hub") {
 		const local = getLocal();
 		if (local !== null && local !== void 0) return local;
+		if (pinnedAddonId !== void 0) services.rejectUnresolvedAddonPin?.(capName, pinnedAddonId);
 		const proxy = services.remoteProxy(capName, "hub");
 		if (proxy) return proxy;
 		return services.noProvider(capName);
@@ -6661,7 +6685,7 @@ function buildOneCapRouter(def, primitives, services) {
 			}).optional() : zod.z.object({ nodeId: zod.z.string().optional() }).optional();
 			procedures[method.name] = base.input(voidSelector)[procKind](({ input, ctx }) => {
 				const sel = input ?? {};
-				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services))[method.name]?.();
+				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services, isCollection ? sel.addonId : void 0))[method.name]?.();
 			});
 			continue;
 		}
@@ -6679,7 +6703,7 @@ function buildOneCapRouter(def, primitives, services) {
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !require_dist.isArrayOutputSchema(method.schema.output) && !require_dist.objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? require_dist.extractNestedAddonId(rest) : void 0);
-					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, topLevelAddonId);
 					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
 					return provider[method.name]?.(payload);
 				}

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { Ct as asString$1, Dt as expandCapMethods, F as extractNestedAddonId, Ft as scopeKey, H as kebabToCamel, K as logLevelAtMost, L as isArrayOutputSchema, Lt as EventCategory$1, Mt as parseJsonUnknown$1, Nt as readinessKey, Pt as resolveCapMount, R as isCollectionArrayMethod, St as asNumber, Tt as emitDownForOwnedCaps, U as lifecycleJobSchema, V as isVoidInput, Z as objectInputDeclaresAddonId, et as procedureAuthKey, ft as DATAPLANE_SECRET_HEADER$1, g as addonSettingsCapability, jt as parseJsonObject, l as METHOD_ACCESS_MAP, mt as DEVICE_STATUS_METHOD, pt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, q as looseSchema, t as ALL_CAPABILITY_DEFINITIONS, u as RUNTIME_DEFAULTS, ut as errMsg$1, vt as ReadinessRegistry, wt as createEvent, xt as asJsonObject$1, yt as ReadinessTimeoutError, z as isObjectInput } from "./dist-DqPyKwVB.mjs";
+import { $ as objectInputDeclaresAddonId, B as isCollectionArrayMethod, Ct as asJsonObject$1, Dt as emitDownForOwnedCaps, Et as createEvent, Ft as readinessKey, G as lifecycleJobSchema, It as resolveCapMount, J as logLevelAtMost, L as extractNestedAddonId, Lt as scopeKey, Nt as parseJsonObject, Pt as parseJsonUnknown$1, Tt as asString$1, U as isVoidInput, V as isObjectInput, W as kebabToCamel, Y as looseSchema, bt as ReadinessRegistry, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, ft as errMsg$1, gt as DEVICE_STATUS_METHOD, ht as DEVICE_SETTINGS_CONTRIBUTION_METHODS, kt as expandCapMethods, mt as DATAPLANE_SECRET_HEADER$1, nt as procedureAuthKey, t as ALL_CAPABILITY_DEFINITIONS, v as addonSettingsCapability, wt as asNumber, xt as ReadinessTimeoutError, z as isArrayOutputSchema, zt as EventCategory$1 } from "./dist-CbS6uoSb.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-CTBHzORJ.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Dz1ryHIN.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
@@ -6035,6 +6035,23 @@ var CapabilityRegistry = class CapabilityRegistry {
 		if (!state) return null;
 		return state.providers.get(addonId) ?? null;
 	}
+	/**
+	* Every registry KEY currently registered for `capability`, disabled ones
+	* included — i.e. exactly the ids {@link getProviderByAddonId} can resolve.
+	* Keys are bare (`homeassistant-export`) for hub-local providers and
+	* `<addonId>@<nodeId>` for providers that registered from another node.
+	*
+	* Exists so an unresolvable `{ addonId }` pin can REFUSE with the valid ids
+	* spelled out (the `addons.custom` unknown-id posture) instead of silently
+	* degrading to another provider's answer — a fabricated `addonId` used to
+	* return the first-registered provider's status, indistinguishable from
+	* success (2026-08-09).
+	*/
+	getProviderAddonIds(capability) {
+		const state = this.capabilities.get(capability);
+		if (!state) return [];
+		return [...state.providers.keys()];
+	}
 	/** Bare addonId from a registry key (`webrtc-native@dev-agent-0` → `webrtc-native`). */
 	bareAddonId(key) {
 		const at = key.indexOf("@");
@@ -6594,11 +6611,18 @@ function stripKeys(input, keys) {
 * the same local-first → remote-proxy routing the codegen's
 * `resolveProvider` does. `nodeId` undefined / `'hub'` resolves the local
 * provider; otherwise it crosses to the named node via the proxy.
+*
+* `pinnedAddonId` is the EXPLICIT top-level `{ addonId }` collection selector
+* (never the one recovered from a nested mutation payload). When it is set and
+* the local lookup misses, {@link CapRouterServices.rejectUnresolvedAddonPin}
+* gets to refuse before the hub-proxy fallthrough turns a wrong id into
+* another provider's answer.
 */
-function resolveProviderForCall(capName, nodeId, getLocal, services) {
+function resolveProviderForCall(capName, nodeId, getLocal, services, pinnedAddonId) {
 	if (!nodeId || nodeId === "hub") {
 		const local = getLocal();
 		if (local !== null && local !== void 0) return local;
+		if (pinnedAddonId !== void 0) services.rejectUnresolvedAddonPin?.(capName, pinnedAddonId);
 		const proxy = services.remoteProxy(capName, "hub");
 		if (proxy) return proxy;
 		return services.noProvider(capName);
@@ -6653,7 +6677,7 @@ function buildOneCapRouter(def, primitives, services) {
 			}).optional() : z.object({ nodeId: z.string().optional() }).optional();
 			procedures[method.name] = base.input(voidSelector)[procKind](({ input, ctx }) => {
 				const sel = input ?? {};
-				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services))[method.name]?.();
+				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services, isCollection ? sel.addonId : void 0))[method.name]?.();
 			});
 			continue;
 		}
@@ -6671,7 +6695,7 @@ function buildOneCapRouter(def, primitives, services) {
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !isArrayOutputSchema(method.schema.output) && !objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? extractNestedAddonId(rest) : void 0);
-					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services);
+					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, topLevelAddonId);
 					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
 					return provider[method.name]?.(payload);
 				}

package/dist/kernel/cap-router-builder.d.ts

@@ -72,6 +72,25 @@ export interface CapRouterServices {
      * back to `badRequest` in that case so the call still fails closed.
      */
     readonly unauthorized?: (message: string) => never;
+    /**
+     * Called when an EXPLICIT top-level `{ addonId }` collection pin resolved to
+     * no local provider, BEFORE the hub-proxy fallthrough. Implementations throw
+     * (naming the id and enumerating the valid ones) when the cap has providers
+     * registered and none of them matches; they return normally when the cap has
+     * no local providers at all, which is the legitimate "the cap lives in a
+     * forked hub worker" case the fallthrough exists for.
+     *
+     * Why: without this the pin was simply DROPPED. `getLocalProvider` returned
+     * null for an unknown addonId, which reads identically to "not resident on
+     * the hub root", so the call fell through to `remoteProxy(cap, 'hub')` and
+     * the Moleculer prefix lookup answered from the FIRST hub-side provider.
+     * `deviceExport.getStatus { addonId: 'questo-non-esiste-affatto' }` returned
+     * Alexa's `linked / 3` — the caller could not tell it had been misrouted
+     * (2026-08-09). OPTIONAL for framework-live-update version skew: an older
+     * server hands a services object without it and the builder keeps the old
+     * fallthrough rather than crashing.
+     */
+    readonly rejectUnresolvedAddonPin?: (capName: string, addonId: string) => void;
 }
 /**
  * Build a single capability's router (the runtime equivalent of one

package/dist/kernel/capability-registry.d.ts

@@ -1,4 +1,4 @@
-import { CapabilityDefinition, CapabilityDeclaration, CapabilityMode, CapabilityInfo, CapabilityProviderMap, SingletonCapabilityMap, CollectionCapabilityMap, IScopedLogger, IEventBus } from '@camstack/types';
+import { CapabilityDeclaration, CapabilityDefinition, CapabilityInfo, CapabilityMode, CapabilityProviderMap, CollectionCapabilityMap, IEventBus, IScopedLogger, SingletonCapabilityMap } from '@camstack/types';
 import { ConfigManager } from './config-manager.js';
 /** Result of creating a capability router (opaque to the kernel). */
 export type CapabilityRouter = unknown;
@@ -327,6 +327,19 @@ export declare class CapabilityRegistry {
     /** Get a specific addon's provider by addon ID. */
     getProviderByAddonId<K extends keyof CapabilityProviderMap>(capability: K, addonId: string): CapabilityProviderMap[K] | null;
     getProviderByAddonId<T = unknown>(capability: string, addonId: string): T | null;
+    /**
+     * Every registry KEY currently registered for `capability`, disabled ones
+     * included — i.e. exactly the ids {@link getProviderByAddonId} can resolve.
+     * Keys are bare (`homeassistant-export`) for hub-local providers and
+     * `<addonId>@<nodeId>` for providers that registered from another node.
+     *
+     * Exists so an unresolvable `{ addonId }` pin can REFUSE with the valid ids
+     * spelled out (the `addons.custom` unknown-id posture) instead of silently
+     * degrading to another provider's answer — a fabricated `addonId` used to
+     * return the first-registered provider's status, indistinguishable from
+     * success (2026-08-09).
+     */
+    getProviderAddonIds(capability: string): readonly string[];
     /** Bare addonId from a registry key (`webrtc-native@dev-agent-0` → `webrtc-native`). */
     private bareAddonId;
     /** nodeId a provider key belongs to (bare → 'hub', `@node` → node). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.66",
+  "version": "1.2.67",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",