@camstack/types 1.2.232 → 1.2.234

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-D7DPSeiv.js");
+const require_sleep = require("./sleep-DImve4HM.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
@@ -297,7 +297,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 21 collection caps, 34 array methods.
+* Coverage: 22 collection caps, 36 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -333,7 +333,8 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"storage-occupancy": ["getOccupancy"],
 	"storage-provider": ["list"],
 	"turn-provider": ["getTurnServers"],
-	"user-passkeys": ["listPasskeys"]
+	"user-passkeys": ["listPasskeys"],
+	"videoclips": ["listClips", "listSources"]
 });
 /**
 * True when `method` on cap `capName` is a COLLECTION cap's array-returning

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { A as DeviceType, At as emitReadiness, Ct as DATAPLANE_SECRET_HEADER, Dt as normalizeAddonInitResult, Et as BaseAddon, G as ReadinessRegistry, H as nodePin, I as expandCapMethods, K as ReadinessTimeoutError, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as DisposerChain, U as readNodePin, Y as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-CiR4z7r9.mjs";
+import { A as DeviceType, At as emitReadiness, Ct as DATAPLANE_SECRET_HEADER, Dt as normalizeAddonInitResult, Et as BaseAddon, G as ReadinessRegistry, H as nodePin, I as expandCapMethods, K as ReadinessTimeoutError, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as DisposerChain, U as readNodePin, Y as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-CopaBJss.mjs";
 import { t as EventCategory } from "./event-category-BVDXG4tB.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -296,7 +296,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 21 collection caps, 34 array methods.
+* Coverage: 22 collection caps, 36 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -332,7 +332,8 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"storage-occupancy": ["getOccupancy"],
 	"storage-provider": ["list"],
 	"turn-provider": ["getTurnServers"],
-	"user-passkeys": ["listPasskeys"]
+	"user-passkeys": ["listPasskeys"],
+	"videoclips": ["listClips", "listSources"]
 });
 /**
 * True when `method` on cap `capName` is a COLLECTION cap's array-returning

package/dist/capabilities/cap-router-predicates.d.ts

@@ -11,6 +11,25 @@
  * (`_def.type`) and legacy Zod 3 (`_def.typeName` / `constructor.name`) shapes.
  */
 import type { CapabilityDefinition, CapabilityMethodAuth } from './capability-definition.js';
+/**
+ * True when a cap's generated router carries the COLLECTION `addonId`
+ * selector — "which provider of this collection answers".
+ *
+ * `resolveCapMount` is the authority, not `mode`: since D554 a device-scoped
+ * wrapper that is a collection (`videoclips`) keeps the PER-DEVICE mount, and
+ * its sources are resolved from the device, never picked by an addonId the
+ * caller supplies. Emitting the selector for it would advertise a routing key
+ * the runtime builder does not read — the exact type/runtime disagreement
+ * D552 removed from `generate-cap-mounts.ts`.
+ *
+ * The one exception is preserved deliberately, and it is the same one
+ * `generate-cap-mounts.ts` documents: a cap declaring `mount: { kind: 'skip' }`
+ * keeps its mode-derived shape. The builder never mounts it, so the emitted
+ * value is never called — four inert caps (`log-channels`, `login-method`,
+ * `load-contribution`, `failure-contribution`) that would otherwise change
+ * shape inside a slice that is about something else.
+ */
+export declare function emitsCollectionSelector(def: CapabilityDefinition): boolean;
 /** `z.void()` — input carries no data. */
 export declare function isVoidInput(schema: unknown): boolean;
 /** `z.object()` — supports `.loose()` for out-of-band `nodeId`/`addonId` keys. */
@@ -86,6 +105,24 @@ export declare function extractNestedAddonId(input: unknown): string | undefined
  * for non-object schemas.
  */
 export declare function objectInputDeclaresAddonId(schema: unknown): boolean;
+/**
+ * True when an OBJECT input schema declares a top-level, REQUIRED, numeric
+ * `deviceId` — i.e. the method names exactly one device on every call.
+ *
+ * This is the question the per-device dispatcher asks at runtime
+ * (`requireDeviceScoped`: `typeof input.deviceId !== 'number'` → BAD_REQUEST),
+ * asked once at build time instead. A `device-scoped` cap's method that cannot
+ * answer it has no device to resolve for and therefore resolves through the
+ * cap's SYSTEM provider (`cap-router-builder.ts`) — the same destination
+ * `systemOnly` names explicitly. Without this, flipping the mount would 400
+ * every batch (`deviceIds`), fleet-wide (`z.void()`) and job-keyed method on
+ * the eight device-scoped wrapper caps.
+ *
+ * Structural, never a name heuristic over source text: the field must resolve
+ * to `z.number()` and must NOT be wrapped in `optional` / `nullable` /
+ * `default` — an absent value is exactly the input the dispatcher rejects.
+ */
+export declare function objectInputDeclaresRequiredDeviceId(schema: unknown): boolean;
 /**
  * Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
  *

package/dist/capabilities/capability-definition.d.ts

@@ -612,7 +612,23 @@ export interface CapabilityDefinition<TName extends string = string, TMethods ex
  * `device-native` are the auto-derivable defaults; the rest are explicit
  * opt-ins for caps that today need a hand-written override.
  */
-export type CapabilityMountKind = 'singleton' | 'collection' | 'device-native' | 'server-provided' | 'hub-only' | 'skip'
+export type CapabilityMountKind = 'singleton' | 'collection' | 'device-native'
+/**
+ * `scope: 'device'` + `kind: 'wrapper'` — ONE active provider PER DEVICE,
+ * substitutable through `deviceManager.setWrapperActive`. NOT
+ * `device-native`: there is no native provider (the provider is an addon,
+ * not the device), so resolution goes through the D13 resolver
+ * `CapabilityRegistry.getProviderForDevice(cap, deviceId)`, which falls back
+ * to the global active singleton for a device with no binding.
+ *
+ * Only a method that NAMES a device can be dispatched per device — the
+ * per-device dispatcher demands a numeric `deviceId` on every call. A method
+ * whose input carries no required numeric `deviceId` (a batch over
+ * `deviceIds`, a fleet-wide count, a job id) resolves through the cap's
+ * SYSTEM provider instead, exactly as `systemOnly` does; the builder makes
+ * that call per method (`cap-router-builder.ts`).
+ */
+ | 'device-scoped' | 'server-provided' | 'hub-only' | 'skip'
 /**
  * @deprecated Legacy alias for `server-provided` (renamed in SP1). Retained
  * ONLY so the runtime tolerates version skew across the framework-live-update

package/dist/capabilities/device-manager.cap.d.ts

@@ -1361,14 +1361,29 @@ export declare const deviceManagerCapability: {
             }, z.core.$strip>>;
         }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
         /**
-         * Activate (or deactivate) a wrapper addon for a (device, cap) pair.
-         * Persists the binding via ctx.settings. active=false clears the wrapper
-         * (falls back to native if registered).
+         * Activate (or deactivate) a wrapper addon — or ONE of its sources — for a
+         * (device, cap) pair.
+         *
+         * Persists the binding via ctx.settings; `active: false` on a SINGLETON cap
+         * clears the wrapper (falling back to native if one is registered). On a
+         * COLLECTION cap it adds to the per-device DENY set instead, and the
+         * wrapper binding is left exactly as it was — a cap with several sources
+         * has no "which one" for `getBindings` to answer (D556).
+         *
+         * `sourceId` is what makes the switch match its label. One addon can serve
+         * several of a device's sources (`addon-provider-reolink` answers a hub
+         * child with `native:reolink:onboard` AND `native:reolink:hub`), so a
+         * toggle keyed by addon would turn off both while saying it turned off one
+         * — the D62 defect with the polarity reversed (D557). Naming the source
+         * denies exactly that source. OMITTING it keeps the cap-wide meaning
+         * D556 shipped: every source this addon serves for this device, which is
+         * also how a deny entry persisted before the re-key is still read.
          */
         readonly setWrapperActive: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             capName: z.ZodString;
             wrapperAddonId: z.ZodString;
+            sourceId: z.ZodOptional<z.ZodString>;
             active: z.ZodBoolean;
         }, z.core.$strip>, z.ZodVoid, "mutation">;
         /**

package/dist/capabilities/index.d.ts

@@ -36,7 +36,7 @@ export { BrokerAddInputSchema, BrokerGetStateInputSchema, type BrokerInfo as Uni
 export { cameraPipelineConfigCapability, type ICameraPipelineConfigProvider, } from './camera-pipeline-config.cap.js';
 export { streamSignalsCapability, type IStreamSignalsProvider, type StreamSignal, StreamSignalSchema, type StreamSignalsStatus, StreamSignalsStatusSchema, } from './stream-signals.cap.js';
 export { cameraStreamsCapability, type ICameraStreamsProvider, type PickedCamStream, PickedCamStreamSchema, type PickStreamPreferences, PickStreamPreferencesSchema, type PickStreamRequirements, PickStreamRequirementsSchema, type StreamCodec, StreamCodecSchema, } from './camera-streams.cap.js';
-export { extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, procedureAuthKey, resolveMethodAuth, } from './cap-router-predicates.js';
+export { emitsCollectionSelector, extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, objectInputDeclaresRequiredDeviceId, procedureAuthKey, resolveMethodAuth, } from './cap-router-predicates.js';
 export type { CapabilityDefinition, CapabilityEventSchema, CapabilityMethodAuth, CapabilityMethodCaller, CapabilityMethodKind, CapabilityMethodOptions, CapabilityMethodSchema, CapabilityMountHint, CapabilityMountKind, CapabilityStatusItemArray, CapabilityStatusKind, CapabilityStatusSchema, CapCaller, DeviceConfigDerivedFormUi, DeviceConfigSpec, DeviceConfigUiSpec, DeviceConfigWidgetUi, DeviceSettingsContribution, InferDeviceProxyCap, InferEvents, InferName, InferNativeProvider, InferProvider, InferRuntimeState, ProviderKind, RuntimeStateDurability, UiContribution, UiContributionKind, UiContributionRemote, } from './capability-definition.js';
 export { DEFAULT_RUNTIME_STATE_DURABILITY, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, event, expandCapMethods, isDeviceConfigCap, method, resolveCapMount, } from './capability-definition.js';
 export { CORE_BLOCK_ADDON_PREFIX, CORE_BLOCKS_ADDON_ID, type CoreBlock, type CoreBlockCompileResult, CoreBlockCompileResultSchema, type CoreBlockInput, CoreBlockInputSchema, type CoreBlockPlacement, CoreBlockPlacementSchema, CoreBlockSchema, type CoreBlockStatus, CoreBlockStatusSchema, coreBlockAddonId, coreBlockIdFromAddonId, coreBlocksCapability, type ICoreBlocksProvider, } from './core-blocks.cap.js';
@@ -95,7 +95,7 @@ export { CameraMetricsSchema, CameraMetricsWithDeviceIdSchema, OrchestratorMetri
 export type { CameraStream, CamProfile, CamStreamKind, DecodedAudioChunkWire, FrameHandleFormat, ProfileRtspEntry, ProfileSlot, AudioStreamPick, ProfileSlotStatus, SubscribeAudioChunksInput, SubscribeAudioChunksResult, SubscribeFramesInput, SubscribeFramesResult, } from './schemas/streaming-shared.js';
 export { AudioChunkFormatSchema, AudioStreamPickSchema, BrokerStatsSchema, BrokerStatusSchema, CAM_PROFILE_ORDER, CameraStreamSchema, CamProfileSchema, CamStreamKindSchema, CamStreamResolutionSchema, DecodedAudioChunkSchema, DecodedFrameSchema, EncodedPacketSchema, FrameHandleFormatSchema, FrameHandleSchema, makeProfileBrokerId, makeSourceBrokerId, ProfileRtspEntrySchema, ProfileSlotSchema, ProfileSlotStatusSchema, parseProfileBrokerId, StreamSourceEntrySchema, StreamSourceSchema, SubscribeAudioChunksInputSchema, SubscribeAudioChunksResultSchema, SubscribeFramesInputSchema, SubscribeFramesResultSchema, selectAssignedProfileSlots, } from './schemas/streaming-shared.js';
 export { buildEventKindDescriptor, EVENT_KIND_BY_CAP, EVENTFUL_CAP_NAMES, type SensorEventKindDescriptor, } from './sensor-event-kinds.js';
-export { type ImageContract, ImageContractSchema, type ImageContractState, ImageContractStateSchema, type IServerManagementProvider, type ServerBootMode, ServerBootModeSchema, type ServerPackageStatus, ServerPackageStatusSchema, type ServerRollbackInfo, ServerRollbackInfoSchema, type ServerUpdateActionResult, ServerUpdateActionResultSchema, type ServerUpdateCheckResult, ServerUpdateCheckResultSchema, type ServerUpdateState, ServerUpdateStateSchema, serverManagementCapability, type WrapperEvidence, WrapperEvidenceSchema, type WrapperIdentity, WrapperIdentitySchema, type WrapperKind, WrapperKindSchema, } from './server-management.cap.js';
+export { type ImageContract, ImageContractSchema, type ImageContractState, ImageContractStateSchema, type IServerManagementProvider, type ServerBootMode, ServerBootModeSchema, type ServerPackageStatus, ServerPackageStatusSchema, type ServerRollbackInfo, ServerRollbackInfoSchema, type ServerUpdateActionResult, ServerUpdateActionResultSchema, type ServerUpdateCheckResult, ServerUpdateCheckResultSchema, type ServerUpdateOutcome, ServerUpdateOutcomeSchema, type ServerUpdateState, ServerUpdateStateSchema, serverManagementCapability, type WrapperEvidence, WrapperEvidenceSchema, type WrapperIdentity, WrapperIdentitySchema, type WrapperKind, WrapperKindSchema, } from './server-management.cap.js';
 export { type BulkRecord, BulkRecordSchema, type CollectionColumn, CollectionColumnSchema, type CollectionIndex, CollectionIndexSchema, type ISettingsStoreProvider, type MutationFilter, MutationFilterSchema, QueryFilterSchema, SettingsRecordSchema, type SettingsStoreClient, settingsStoreCapability, } from './settings-store.cap.js';
 export type { ISmtpProvider } from './smtp-provider.cap.js';
 export { SendEmailInputSchema, SendEmailResultSchema, SmtpStatusSchema, smtpProviderCapability, } from './smtp-provider.cap.js';
@@ -116,8 +116,8 @@ export type { IUserPasskeysProvider, PasskeySummary } from './user-passkeys.cap.
 export { PasskeySummarySchema, userPasskeysCapability } from './user-passkeys.cap.js';
 export type { IVectorStoreProvider } from './vector-store.cap.js';
 export { VectorDeclareIndexInputSchema, VectorDeleteByFilterInputSchema, VectorDeleteInputSchema, VectorDeleteResultSchema, type VectorFilter, VectorFilterSchema, VectorGetInputSchema, VectorGetResultSchema, type VectorItem, VectorItemSchema, type VectorMatch, VectorMatchSchema, type VectorMetadata, VectorMetadataSchema, type VectorMetric, VectorMetricSchema, VectorQueryInputSchema, VectorQueryResultSchema, VectorStatsInputSchema, VectorStatsResultSchema, VectorUpsertInputSchema, VectorUpsertResultSchema, vectorStoreCapability, } from './vector-store.cap.js';
-export type { Clip, ClipPlayback, IVideoclipsProvider } from './videoclips.cap.js';
-export { ClipPlaybackSchema, ClipSchema, MAX_CLIP_EVENT_IDS, MAX_CLIP_LABELS, videoclipsCapability, } from './videoclips.cap.js';
+export type { Clip, ClipPlayback, ClipSource, ClipSourceAvailability, IVideoclipsProvider, } from './videoclips.cap.js';
+export { ClipPlaybackSchema, ClipSchema, ClipSourceAvailabilitySchema, ClipSourceSchema, MAX_CLIP_EVENT_IDS, MAX_CLIP_LABELS, videoclipsCapability, } from './videoclips.cap.js';
 export type { IViewerUiProvider } from './viewer-ui.cap.js';
 export { viewerUiCapability } from './viewer-ui.cap.js';
 export { type IWebrtcSessionProvider, type WebrtcClientHints, type WebrtcLadderDecision, WebrtcLadderDecisionSchema, type WebrtcSessionDebug, WebrtcSessionDebugSchema, type WebrtcStreamChoice, WebrtcStreamChoiceSchema, type WebrtcStreamTarget, WebrtcStreamTargetSchema, type WebrtcTierFailure, WebrtcTierFailureSchema, webrtcClientHintsSchema, webrtcSessionCapability, } from './webrtc-session.cap.js';

package/dist/capabilities/server-management.cap.d.ts

@@ -43,10 +43,9 @@ declare const ServerBootModeSchema: z.ZodEnum<{
  *  - `idle` / `checking` / `staging` — steady / in-flight registry work.
  *  - `pending-restart` — a version is staged and the node has NOT yet
  *    restarted onto it (still running the OLD version).
- *  - `awaiting-confirmation` — the node HAS restarted onto the staged version
- *    (it is the active probation boot) and is waiting to confirm boot-health.
- *    Apply/rollback are refused in this state and the node must NOT be
- *    manually restarted, or the probation boot auto-rolls-back.
+ *  - `awaiting-confirmation` — RETIRED with the probation boot (single-copy
+ *    collapse, 2026-07-18). Kept in the enum so an older client still parses;
+ *    no provider emits it.
  */
 declare const ServerUpdateStateSchema: z.ZodEnum<{
     idle: "idle";
@@ -209,6 +208,8 @@ declare const ServerPackageStatusSchema: z.ZodObject<{
     runningVersion: z.ZodNullable<z.ZodString>;
     nodeRuntimeVersion: z.ZodNullable<z.ZodString>;
     activeVersion: z.ZodNullable<z.ZodString>;
+    installedVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    restartRequired: z.ZodOptional<z.ZodBoolean>;
     previousVersion: z.ZodNullable<z.ZodString>;
     seedVersion: z.ZodNullable<z.ZodString>;
     latestVersion: z.ZodNullable<z.ZodString>;
@@ -282,12 +283,46 @@ declare const ServerUpdateCheckResultSchema: z.ZodObject<{
     updateAvailable: z.ZodBoolean;
     checkedAtMs: z.ZodNumber;
     error: z.ZodNullable<z.ZodString>;
+    pendingVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    restartRequired: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
+/**
+ * What an action DID — the discriminant `accepted` cannot carry. Before
+ * 2026-09-20 `applyServerUpdate` answered `accepted:false` both for a refusal
+ * where nothing was wrong (already current, already staged) and for a staging
+ * install that died on `npm error code ECONNRESET`; the only difference was
+ * prose in `message`, and an operator restarted a container on the strength of
+ * it, booting the previous version.
+ *
+ *  - `staged`            — the closure is installed and validated; the node
+ *                          restarts to apply it (`restarting:true`). NOTHING
+ *                          runs the new code until that restart completes.
+ *  - `restart-scheduled` — a plain, version-preserving restart was accepted.
+ *  - `already-current`   — the target IS the running version; nothing done.
+ *  - `refused`           — dropped by a gate; `reason` names which.
+ *  - `failed`            — attempted and did not land; `error` says why.
+ */
+declare const ServerUpdateOutcomeSchema: z.ZodEnum<{
+    failed: "failed";
+    refused: "refused";
+    staged: "staged";
+    "restart-scheduled": "restart-scheduled";
+    "already-current": "already-current";
+}>;
 declare const ServerUpdateActionResultSchema: z.ZodObject<{
     accepted: z.ZodBoolean;
     targetVersion: z.ZodNullable<z.ZodString>;
     restarting: z.ZodBoolean;
     message: z.ZodString;
+    outcome: z.ZodOptional<z.ZodEnum<{
+        failed: "failed";
+        refused: "refused";
+        staged: "staged";
+        "restart-scheduled": "restart-scheduled";
+        "already-current": "already-current";
+    }>>;
+    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 export declare const serverManagementCapability: {
     readonly name: "server-management";
@@ -299,6 +334,8 @@ export declare const serverManagementCapability: {
             runningVersion: z.ZodNullable<z.ZodString>;
             nodeRuntimeVersion: z.ZodNullable<z.ZodString>;
             activeVersion: z.ZodNullable<z.ZodString>;
+            installedVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            restartRequired: z.ZodOptional<z.ZodBoolean>;
             previousVersion: z.ZodNullable<z.ZodString>;
             seedVersion: z.ZodNullable<z.ZodString>;
             latestVersion: z.ZodNullable<z.ZodString>;
@@ -372,6 +409,8 @@ export declare const serverManagementCapability: {
             updateAvailable: z.ZodBoolean;
             checkedAtMs: z.ZodNumber;
             error: z.ZodNullable<z.ZodString>;
+            pendingVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            restartRequired: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>, "mutation">;
         readonly applyServerUpdate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             version: z.ZodOptional<z.ZodString>;
@@ -380,12 +419,30 @@ export declare const serverManagementCapability: {
             targetVersion: z.ZodNullable<z.ZodString>;
             restarting: z.ZodBoolean;
             message: z.ZodString;
+            outcome: z.ZodOptional<z.ZodEnum<{
+                failed: "failed";
+                refused: "refused";
+                staged: "staged";
+                "restart-scheduled": "restart-scheduled";
+                "already-current": "already-current";
+            }>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>, "mutation">;
         readonly rollbackServerUpdate: import("./capability-definition.js").CapabilityMethodSchema<z.ZodVoid, z.ZodObject<{
             accepted: z.ZodBoolean;
             targetVersion: z.ZodNullable<z.ZodString>;
             restarting: z.ZodBoolean;
             message: z.ZodString;
+            outcome: z.ZodOptional<z.ZodEnum<{
+                failed: "failed";
+                refused: "refused";
+                staged: "staged";
+                "restart-scheduled": "restart-scheduled";
+                "already-current": "already-current";
+            }>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>, "mutation">;
         /**
          * Plain process restart of the node's root process — no version change.
@@ -399,6 +456,15 @@ export declare const serverManagementCapability: {
             targetVersion: z.ZodNullable<z.ZodString>;
             restarting: z.ZodBoolean;
             message: z.ZodString;
+            outcome: z.ZodOptional<z.ZodEnum<{
+                failed: "failed";
+                refused: "refused";
+                staged: "staged";
+                "restart-scheduled": "restart-scheduled";
+                "already-current": "already-current";
+            }>>;
+            reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            error: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>, "mutation">;
     };
     /** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
@@ -417,5 +483,6 @@ export type WrapperIdentity = z.infer<typeof WrapperIdentitySchema>;
 export type ServerRollbackInfo = z.infer<typeof ServerRollbackInfoSchema>;
 export type ServerPackageStatus = z.infer<typeof ServerPackageStatusSchema>;
 export type ServerUpdateCheckResult = z.infer<typeof ServerUpdateCheckResultSchema>;
+export type ServerUpdateOutcome = z.infer<typeof ServerUpdateOutcomeSchema>;
 export type ServerUpdateActionResult = z.infer<typeof ServerUpdateActionResultSchema>;
-export { ServerBootModeSchema, ServerUpdateStateSchema, ImageContractStateSchema, ImageContractSchema, WrapperKindSchema, WrapperEvidenceSchema, WrapperIdentitySchema, ServerRollbackInfoSchema, ServerPackageStatusSchema, ServerUpdateCheckResultSchema, ServerUpdateActionResultSchema, };
+export { ServerBootModeSchema, ServerUpdateStateSchema, ImageContractStateSchema, ImageContractSchema, WrapperKindSchema, WrapperEvidenceSchema, WrapperIdentitySchema, ServerRollbackInfoSchema, ServerPackageStatusSchema, ServerUpdateCheckResultSchema, ServerUpdateOutcomeSchema, ServerUpdateActionResultSchema, };

package/dist/capabilities/videoclips.cap.d.ts

@@ -4,13 +4,24 @@ import { type InferProvider } from './capability-definition.js';
 /**
  * `videoclips` — the unified, navigable-clip surface for a camera.
  *
- * A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
- * provider per device, substitutable. The DEFAULT provider (registered by
+ * A device-scoped wrapper COLLECTION (D549 decision 2, D554): every provider a
+ * camera has is a SOURCE, and they are listed beside each other — never one
+ * substituted for another. The DEFAULT provider (registered by
  * `addon-post-analysis`, `defaultActive: true`) composes the analytics event
  * log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
  * is a time-WINDOW over existing footage, never a separate file. A camera that
- * exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
- * wrapper provider for its device and serve its own clip catalog + URLs.
+ * exposes NATIVE onboard clips (Reolink SD card, a hub's storage, HKSV) adds
+ * its own catalog ALONGSIDE that one.
+ *
+ * The mount stays per-device (`resolveCapMount` → `device-scoped`): the fan-out
+ * is over the DEVICE's sources, resolved from the registry's per-device
+ * collection, never over every provider in the cluster. `listClips` is the
+ * union of those sources, in newest-first order, with NO dedup and no
+ * best-source pick — a clip held in two storages appears twice, once per
+ * source, and every row's {@link ClipSchema.source} says which. That is the
+ * operator's decision, stated so it is not "fixed" later.
+ * {@link videoclipsCapability.methods.getClipPlayback} dispatches by the
+ * source namespace inside the clip id, which is why ids are self-contained.
  *
  * A `Clip` is purely time-based (subtree-blind): playback resolves segments by
  * temporal overlap, so the API never decides `continuous` vs `events`.
@@ -46,30 +57,144 @@ export declare const ClipSchema: z.ZodObject<{
         startMs: z.ZodNumber;
         endMs: z.ZodNumber;
     }, z.core.$strip>>>;
+    thumbnailMint: z.ZodOptional<z.ZodString>;
+    thumbnailUnavailable: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodEnum<{
+            sleeping: "sleeping";
+            unsupported: "unsupported";
+            "camera-refused": "camera-refused";
+            "no-keyframe": "no-keyframe";
+        }>;
+    }, z.core.$strip>>;
+    catalogAsOf: z.ZodOptional<z.ZodNumber>;
+    nativeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    behaviours: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    streams: z.ZodOptional<z.ZodObject<{
+        sub: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            bytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        main: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            bytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    supportSub: z.ZodOptional<z.ZodBoolean>;
+    playable: z.ZodOptional<z.ZodBoolean>;
+    unplayableReason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type Clip = z.infer<typeof ClipSchema>;
 export declare const ClipPlaybackSchema: z.ZodObject<{
     playbackUrl: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        hls: "hls";
+        mp4: "mp4";
+    }>>;
+    served: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        mid: "mid";
+        low: "low";
+    }>>;
     playbackEndpoints: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ClipPlayback = z.infer<typeof ClipPlaybackSchema>;
+/**
+ * Why a source cannot answer right now — per SOURCE, never fleet-wide.
+ *
+ * `ok` is the only state whose clip list may be read as complete. The other
+ * three exist because an empty list from a sleeping camera reads as "this
+ * camera has no recordings", which is the defect this whole line of work is
+ * about: a battery camera nobody woke (`sleeping`), a camera that could not be
+ * reached at all (`unreachable`, also what a provider that THREW reports), a
+ * camera whose SD card is not mounted (`no-storage`, measured on 640 —
+ * `HddInfo mount 0`, honestly nothing to list rather than "no clips"), and a
+ * camera whose OWN index disagrees with its OWN calendar (`index-empty`,
+ * measured on 618: the calendar marks 3–20 September, days 6–20 list zero
+ * files on both streams and both filters, with 177 GB free). That last one is
+ * a defect ON THE CAMERA, and the only honest thing a provider can do is say
+ * which days it asked for and got nothing — "no clips" would be a lie about a
+ * card that is full of them.
+ */
+export declare const ClipSourceAvailabilitySchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        ok: "ok";
+        sleeping: "sleeping";
+        unreachable: "unreachable";
+        "no-storage": "no-storage";
+        "index-empty": "index-empty";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+    catalogAsOf: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type ClipSourceAvailability = z.infer<typeof ClipSourceAvailabilitySchema>;
+/**
+ * One SOURCE of clips for a camera — a row of the picker, and the namespace
+ * every clip id from it is prefixed with (`analytics`,
+ * `native:reolink:onboard`, `hksv`, …).
+ *
+ * A provider lists the sources IT serves for that device, and answers for each
+ * of them whether it can answer at all. A provider with nothing to offer on a
+ * camera returns `[]` — it is not that camera's business.
+ */
+export declare const ClipSourceSchema: z.ZodObject<{
+    source: z.ZodString;
+    label: z.ZodString;
+    addonId: z.ZodOptional<z.ZodString>;
+    via: z.ZodOptional<z.ZodString>;
+    availability: z.ZodObject<{
+        state: z.ZodEnum<{
+            ok: "ok";
+            sleeping: "sleeping";
+            unreachable: "unreachable";
+            "no-storage": "no-storage";
+            "index-empty": "index-empty";
+        }>;
+        reason: z.ZodOptional<z.ZodString>;
+        catalogAsOf: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    switchedOff: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ClipSource = z.infer<typeof ClipSourceSchema>;
 export declare const videoclipsCapability: {
     readonly name: "videoclips";
     readonly scope: "device";
-    readonly mode: "singleton";
+    readonly mode: "collection";
     readonly kind: "wrapper";
     readonly defaultActive: true;
     /** A clip is a window over a camera's footage — the cap is meaningless on a
      *  sensor, a button or an event emitter, and the `defaultActive` auto-bind
      *  reads this to decide which devices it may claim. */
     readonly deviceTypes: readonly [DeviceType.Camera];
+    /**
+     * The Clips section of a camera's device details is FRAMEWORK-DERIVED (D14):
+     * the aggregator turns this declaration into the `type:'widget'` section and
+     * `DeviceDetail.tsx` is never edited. `videoclips` is the first WRAPPER cap
+     * to declare one — every previous `host/` widget cap is `deviceNative` — so
+     * `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
+     * binding entry derives the same section a native one does.
+     *
+     * `topTab` because the browser owns the whole pane (a day's clips, a source
+     * list and a player), exactly as `ptz` does; the widget itself is
+     * `host/clips-browser` in ui-library's `HOST_WIDGETS`.
+     */
+    readonly deviceConfig: {
+        readonly ui: {
+            readonly kind: "widget";
+            readonly widgetId: "host/clips-browser";
+            readonly tab: "clips";
+            readonly topTab: true;
+            readonly label: "Clips";
+            readonly order: 0;
+        };
+    };
     readonly methods: {
         readonly listClips: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             since: z.ZodNumber;
             until: z.ZodNumber;
             limit: z.ZodOptional<z.ZodNumber>;
+            sources: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             source: z.ZodString;
@@ -92,12 +217,80 @@ export declare const videoclipsCapability: {
                 startMs: z.ZodNumber;
                 endMs: z.ZodNumber;
             }, z.core.$strip>>>;
+            thumbnailMint: z.ZodOptional<z.ZodString>;
+            thumbnailUnavailable: z.ZodOptional<z.ZodObject<{
+                reason: z.ZodEnum<{
+                    sleeping: "sleeping";
+                    unsupported: "unsupported";
+                    "camera-refused": "camera-refused";
+                    "no-keyframe": "no-keyframe";
+                }>;
+            }, z.core.$strip>>;
+            catalogAsOf: z.ZodOptional<z.ZodNumber>;
+            nativeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            behaviours: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            streams: z.ZodOptional<z.ZodObject<{
+                sub: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    bytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>;
+                main: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    bytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            supportSub: z.ZodOptional<z.ZodBoolean>;
+            playable: z.ZodOptional<z.ZodBoolean>;
+            unplayableReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * The sources this camera has, WITH the reason any of them cannot answer.
+         *
+         * Asked separately from `listClips` because an empty clip list is
+         * ambiguous and this is the only place the ambiguity is resolved: every
+         * bound provider contributes its own rows, and a provider that could not
+         * be reached at all still produces one row saying so. A surface that draws
+         * "no clips" without reading this is drawing a guess.
+         */
+        readonly listSources: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            label: z.ZodString;
+            addonId: z.ZodOptional<z.ZodString>;
+            via: z.ZodOptional<z.ZodString>;
+            availability: z.ZodObject<{
+                state: z.ZodEnum<{
+                    ok: "ok";
+                    sleeping: "sleeping";
+                    unreachable: "unreachable";
+                    "no-storage": "no-storage";
+                    "index-empty": "index-empty";
+                }>;
+                reason: z.ZodOptional<z.ZodString>;
+                catalogAsOf: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            switchedOff: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>, "query">;
         readonly getClipPlayback: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             clipId: z.ZodString;
+            profile: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>;
         }, z.core.$strip>, z.ZodObject<{
             playbackUrl: z.ZodString;
+            format: z.ZodOptional<z.ZodEnum<{
+                hls: "hls";
+                mp4: "mp4";
+            }>>;
+            served: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>;
             playbackEndpoints: z.ZodOptional<z.ZodArray<z.ZodString>>;
             token: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, "query">;