@camstack/types 1.2.233 → 1.2.235

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-D7DPSeiv.js");
+const require_sleep = require("./sleep-CsgPITp-.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
@@ -297,7 +297,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 21 collection caps, 34 array methods.
+* Coverage: 22 collection caps, 36 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -333,7 +333,8 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"storage-occupancy": ["getOccupancy"],
 	"storage-provider": ["list"],
 	"turn-provider": ["getTurnServers"],
-	"user-passkeys": ["listPasskeys"]
+	"user-passkeys": ["listPasskeys"],
+	"videoclips": ["listClips", "listSources"]
 });
 /**
 * True when `method` on cap `capName` is a COLLECTION cap's array-returning

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { A as DeviceType, At as emitReadiness, Ct as DATAPLANE_SECRET_HEADER, Dt as normalizeAddonInitResult, Et as BaseAddon, G as ReadinessRegistry, H as nodePin, I as expandCapMethods, K as ReadinessTimeoutError, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as DisposerChain, U as readNodePin, Y as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-CiR4z7r9.mjs";
+import { A as DeviceType, At as emitReadiness, Ct as DATAPLANE_SECRET_HEADER, Dt as normalizeAddonInitResult, Et as BaseAddon, G as ReadinessRegistry, H as nodePin, I as expandCapMethods, K as ReadinessTimeoutError, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as DisposerChain, U as readNodePin, Y as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-7AN_Txmu.mjs";
 import { t as EventCategory } from "./event-category-BVDXG4tB.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -296,7 +296,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 21 collection caps, 34 array methods.
+* Coverage: 22 collection caps, 36 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -332,7 +332,8 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"storage-occupancy": ["getOccupancy"],
 	"storage-provider": ["list"],
 	"turn-provider": ["getTurnServers"],
-	"user-passkeys": ["listPasskeys"]
+	"user-passkeys": ["listPasskeys"],
+	"videoclips": ["listClips", "listSources"]
 });
 /**
 * True when `method` on cap `capName` is a COLLECTION cap's array-returning

package/dist/capabilities/cap-router-predicates.d.ts

@@ -11,6 +11,25 @@
  * (`_def.type`) and legacy Zod 3 (`_def.typeName` / `constructor.name`) shapes.
  */
 import type { CapabilityDefinition, CapabilityMethodAuth } from './capability-definition.js';
+/**
+ * True when a cap's generated router carries the COLLECTION `addonId`
+ * selector — "which provider of this collection answers".
+ *
+ * `resolveCapMount` is the authority, not `mode`: since D554 a device-scoped
+ * wrapper that is a collection (`videoclips`) keeps the PER-DEVICE mount, and
+ * its sources are resolved from the device, never picked by an addonId the
+ * caller supplies. Emitting the selector for it would advertise a routing key
+ * the runtime builder does not read — the exact type/runtime disagreement
+ * D552 removed from `generate-cap-mounts.ts`.
+ *
+ * The one exception is preserved deliberately, and it is the same one
+ * `generate-cap-mounts.ts` documents: a cap declaring `mount: { kind: 'skip' }`
+ * keeps its mode-derived shape. The builder never mounts it, so the emitted
+ * value is never called — four inert caps (`log-channels`, `login-method`,
+ * `load-contribution`, `failure-contribution`) that would otherwise change
+ * shape inside a slice that is about something else.
+ */
+export declare function emitsCollectionSelector(def: CapabilityDefinition): boolean;
 /** `z.void()` — input carries no data. */
 export declare function isVoidInput(schema: unknown): boolean;
 /** `z.object()` — supports `.loose()` for out-of-band `nodeId`/`addonId` keys. */
@@ -86,6 +105,24 @@ export declare function extractNestedAddonId(input: unknown): string | undefined
  * for non-object schemas.
  */
 export declare function objectInputDeclaresAddonId(schema: unknown): boolean;
+/**
+ * True when an OBJECT input schema declares a top-level, REQUIRED, numeric
+ * `deviceId` — i.e. the method names exactly one device on every call.
+ *
+ * This is the question the per-device dispatcher asks at runtime
+ * (`requireDeviceScoped`: `typeof input.deviceId !== 'number'` → BAD_REQUEST),
+ * asked once at build time instead. A `device-scoped` cap's method that cannot
+ * answer it has no device to resolve for and therefore resolves through the
+ * cap's SYSTEM provider (`cap-router-builder.ts`) — the same destination
+ * `systemOnly` names explicitly. Without this, flipping the mount would 400
+ * every batch (`deviceIds`), fleet-wide (`z.void()`) and job-keyed method on
+ * the eight device-scoped wrapper caps.
+ *
+ * Structural, never a name heuristic over source text: the field must resolve
+ * to `z.number()` and must NOT be wrapped in `optional` / `nullable` /
+ * `default` — an absent value is exactly the input the dispatcher rejects.
+ */
+export declare function objectInputDeclaresRequiredDeviceId(schema: unknown): boolean;
 /**
  * Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
  *

package/dist/capabilities/capability-definition.d.ts

@@ -612,7 +612,23 @@ export interface CapabilityDefinition<TName extends string = string, TMethods ex
  * `device-native` are the auto-derivable defaults; the rest are explicit
  * opt-ins for caps that today need a hand-written override.
  */
-export type CapabilityMountKind = 'singleton' | 'collection' | 'device-native' | 'server-provided' | 'hub-only' | 'skip'
+export type CapabilityMountKind = 'singleton' | 'collection' | 'device-native'
+/**
+ * `scope: 'device'` + `kind: 'wrapper'` — ONE active provider PER DEVICE,
+ * substitutable through `deviceManager.setWrapperActive`. NOT
+ * `device-native`: there is no native provider (the provider is an addon,
+ * not the device), so resolution goes through the D13 resolver
+ * `CapabilityRegistry.getProviderForDevice(cap, deviceId)`, which falls back
+ * to the global active singleton for a device with no binding.
+ *
+ * Only a method that NAMES a device can be dispatched per device — the
+ * per-device dispatcher demands a numeric `deviceId` on every call. A method
+ * whose input carries no required numeric `deviceId` (a batch over
+ * `deviceIds`, a fleet-wide count, a job id) resolves through the cap's
+ * SYSTEM provider instead, exactly as `systemOnly` does; the builder makes
+ * that call per method (`cap-router-builder.ts`).
+ */
+ | 'device-scoped' | 'server-provided' | 'hub-only' | 'skip'
 /**
  * @deprecated Legacy alias for `server-provided` (renamed in SP1). Retained
  * ONLY so the runtime tolerates version skew across the framework-live-update

package/dist/capabilities/device-manager.cap.d.ts

@@ -1361,14 +1361,29 @@ export declare const deviceManagerCapability: {
             }, z.core.$strip>>;
         }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
         /**
-         * Activate (or deactivate) a wrapper addon for a (device, cap) pair.
-         * Persists the binding via ctx.settings. active=false clears the wrapper
-         * (falls back to native if registered).
+         * Activate (or deactivate) a wrapper addon — or ONE of its sources — for a
+         * (device, cap) pair.
+         *
+         * Persists the binding via ctx.settings; `active: false` on a SINGLETON cap
+         * clears the wrapper (falling back to native if one is registered). On a
+         * COLLECTION cap it adds to the per-device DENY set instead, and the
+         * wrapper binding is left exactly as it was — a cap with several sources
+         * has no "which one" for `getBindings` to answer (D556).
+         *
+         * `sourceId` is what makes the switch match its label. One addon can serve
+         * several of a device's sources (`addon-provider-reolink` answers a hub
+         * child with `native:reolink:onboard` AND `native:reolink:hub`), so a
+         * toggle keyed by addon would turn off both while saying it turned off one
+         * — the D62 defect with the polarity reversed (D557). Naming the source
+         * denies exactly that source. OMITTING it keeps the cap-wide meaning
+         * D556 shipped: every source this addon serves for this device, which is
+         * also how a deny entry persisted before the re-key is still read.
          */
         readonly setWrapperActive: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             capName: z.ZodString;
             wrapperAddonId: z.ZodString;
+            sourceId: z.ZodOptional<z.ZodString>;
             active: z.ZodBoolean;
         }, z.core.$strip>, z.ZodVoid, "mutation">;
         /**

package/dist/capabilities/index.d.ts

@@ -36,7 +36,7 @@ export { BrokerAddInputSchema, BrokerGetStateInputSchema, type BrokerInfo as Uni
 export { cameraPipelineConfigCapability, type ICameraPipelineConfigProvider, } from './camera-pipeline-config.cap.js';
 export { streamSignalsCapability, type IStreamSignalsProvider, type StreamSignal, StreamSignalSchema, type StreamSignalsStatus, StreamSignalsStatusSchema, } from './stream-signals.cap.js';
 export { cameraStreamsCapability, type ICameraStreamsProvider, type PickedCamStream, PickedCamStreamSchema, type PickStreamPreferences, PickStreamPreferencesSchema, type PickStreamRequirements, PickStreamRequirementsSchema, type StreamCodec, StreamCodecSchema, } from './camera-streams.cap.js';
-export { extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, procedureAuthKey, resolveMethodAuth, } from './cap-router-predicates.js';
+export { emitsCollectionSelector, extractNestedAddonId, isArrayOutputSchema, isCollectionArrayMethod, isObjectInput, isVoidInput, kebabToCamel, looseSchema, objectInputDeclaresAddonId, objectInputDeclaresRequiredDeviceId, procedureAuthKey, resolveMethodAuth, } from './cap-router-predicates.js';
 export type { CapabilityDefinition, CapabilityEventSchema, CapabilityMethodAuth, CapabilityMethodCaller, CapabilityMethodKind, CapabilityMethodOptions, CapabilityMethodSchema, CapabilityMountHint, CapabilityMountKind, CapabilityStatusItemArray, CapabilityStatusKind, CapabilityStatusSchema, CapCaller, DeviceConfigDerivedFormUi, DeviceConfigSpec, DeviceConfigUiSpec, DeviceConfigWidgetUi, DeviceSettingsContribution, InferDeviceProxyCap, InferEvents, InferName, InferNativeProvider, InferProvider, InferRuntimeState, ProviderKind, RuntimeStateDurability, UiContribution, UiContributionKind, UiContributionRemote, } from './capability-definition.js';
 export { DEFAULT_RUNTIME_STATE_DURABILITY, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, event, expandCapMethods, isDeviceConfigCap, method, resolveCapMount, } from './capability-definition.js';
 export { CORE_BLOCK_ADDON_PREFIX, CORE_BLOCKS_ADDON_ID, type CoreBlock, type CoreBlockCompileResult, CoreBlockCompileResultSchema, type CoreBlockInput, CoreBlockInputSchema, type CoreBlockPlacement, CoreBlockPlacementSchema, CoreBlockSchema, type CoreBlockStatus, CoreBlockStatusSchema, coreBlockAddonId, coreBlockIdFromAddonId, coreBlocksCapability, type ICoreBlocksProvider, } from './core-blocks.cap.js';
@@ -116,8 +116,8 @@ export type { IUserPasskeysProvider, PasskeySummary } from './user-passkeys.cap.
 export { PasskeySummarySchema, userPasskeysCapability } from './user-passkeys.cap.js';
 export type { IVectorStoreProvider } from './vector-store.cap.js';
 export { VectorDeclareIndexInputSchema, VectorDeleteByFilterInputSchema, VectorDeleteInputSchema, VectorDeleteResultSchema, type VectorFilter, VectorFilterSchema, VectorGetInputSchema, VectorGetResultSchema, type VectorItem, VectorItemSchema, type VectorMatch, VectorMatchSchema, type VectorMetadata, VectorMetadataSchema, type VectorMetric, VectorMetricSchema, VectorQueryInputSchema, VectorQueryResultSchema, VectorStatsInputSchema, VectorStatsResultSchema, VectorUpsertInputSchema, VectorUpsertResultSchema, vectorStoreCapability, } from './vector-store.cap.js';
-export type { Clip, ClipPlayback, IVideoclipsProvider } from './videoclips.cap.js';
-export { ClipPlaybackSchema, ClipSchema, MAX_CLIP_EVENT_IDS, MAX_CLIP_LABELS, videoclipsCapability, } from './videoclips.cap.js';
+export type { Clip, ClipPlayback, ClipSource, ClipSourceAvailability, IVideoclipsProvider, } from './videoclips.cap.js';
+export { ClipPlaybackSchema, ClipSchema, ClipSourceAvailabilitySchema, ClipSourceSchema, MAX_CLIP_EVENT_IDS, MAX_CLIP_LABELS, videoclipsCapability, } from './videoclips.cap.js';
 export type { IViewerUiProvider } from './viewer-ui.cap.js';
 export { viewerUiCapability } from './viewer-ui.cap.js';
 export { type IWebrtcSessionProvider, type WebrtcClientHints, type WebrtcLadderDecision, WebrtcLadderDecisionSchema, type WebrtcSessionDebug, WebrtcSessionDebugSchema, type WebrtcStreamChoice, WebrtcStreamChoiceSchema, type WebrtcStreamTarget, WebrtcStreamTargetSchema, type WebrtcTierFailure, WebrtcTierFailureSchema, webrtcClientHintsSchema, webrtcSessionCapability, } from './webrtc-session.cap.js';

package/dist/capabilities/videoclips.cap.d.ts

@@ -4,13 +4,29 @@ import { type InferProvider } from './capability-definition.js';
 /**
  * `videoclips` — the unified, navigable-clip surface for a camera.
  *
- * A device-scoped WRAPPER cap (like `pipeline-analytics`): exactly one active
- * provider per device, substitutable. The DEFAULT provider (registered by
+ * A device-scoped wrapper COLLECTION (D549 decision 2, D554): every provider a
+ * camera has is a SOURCE, and they are listed beside each other — never one
+ * substituted for another. The DEFAULT provider (registered by
  * `addon-post-analysis`, `defaultActive: true`) composes the analytics event
  * log (markers + thumbnails) with the recorder's `getPlaybackManifest` — a clip
  * is a time-WINDOW over existing footage, never a separate file. A camera that
- * exposes NATIVE onboard clips (Reolink/Hikvision NVR) can later substitute the
- * wrapper provider for its device and serve its own clip catalog + URLs.
+ * exposes NATIVE onboard clips (Reolink SD card, a hub's storage, HKSV) adds
+ * its own catalog ALONGSIDE that one.
+ *
+ * The mount stays per-device (`resolveCapMount` → `device-scoped`), and a
+ * device's SOURCES are its BINDINGS: `deviceManager.getBindings(deviceId)` is
+ * what says a provider serves this camera, never the set of addons that
+ * happen to have registered the capability somewhere in the cluster. That is
+ * what stopped one addon appearing three times on 592 — as the device's
+ * native provider, as the hub-local registration and as
+ * `pipeline-analytics@little-unraid` (D554 amended 2026-09-20).
+ *
+ * `listClips` is asked of ONE provider at a time
+ * ({@link videoclipsCapability.methods.listClips} `provider`), defaulting to
+ * the bound one, which is CamStack on every camera today. It is NOT a union
+ * over everything a camera has: *"l'utilizzatore è uno solo"*.
+ * {@link videoclipsCapability.methods.getClipPlayback} dispatches by the
+ * source namespace inside the clip id, which is why ids are self-contained.
  *
  * A `Clip` is purely time-based (subtree-blind): playback resolves segments by
  * temporal overlap, so the API never decides `continuous` vs `events`.
@@ -46,30 +62,158 @@ export declare const ClipSchema: z.ZodObject<{
         startMs: z.ZodNumber;
         endMs: z.ZodNumber;
     }, z.core.$strip>>>;
+    thumbnailMint: z.ZodOptional<z.ZodString>;
+    thumbnailUnavailable: z.ZodOptional<z.ZodObject<{
+        reason: z.ZodEnum<{
+            sleeping: "sleeping";
+            unsupported: "unsupported";
+            "camera-refused": "camera-refused";
+            "no-keyframe": "no-keyframe";
+        }>;
+    }, z.core.$strip>>;
+    catalogAsOf: z.ZodOptional<z.ZodNumber>;
+    nativeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    behaviours: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    streams: z.ZodOptional<z.ZodObject<{
+        sub: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            bytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        main: z.ZodOptional<z.ZodObject<{
+            id: z.ZodString;
+            bytes: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    supportSub: z.ZodOptional<z.ZodBoolean>;
+    playable: z.ZodOptional<z.ZodBoolean>;
+    unplayableReason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type Clip = z.infer<typeof ClipSchema>;
 export declare const ClipPlaybackSchema: z.ZodObject<{
     playbackUrl: z.ZodString;
+    format: z.ZodOptional<z.ZodEnum<{
+        hls: "hls";
+        mp4: "mp4";
+    }>>;
+    served: z.ZodOptional<z.ZodEnum<{
+        high: "high";
+        mid: "mid";
+        low: "low";
+    }>>;
     playbackEndpoints: z.ZodOptional<z.ZodArray<z.ZodString>>;
     token: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ClipPlayback = z.infer<typeof ClipPlaybackSchema>;
+/**
+ * Why a source cannot answer right now — per SOURCE, never fleet-wide.
+ *
+ * `ok` is the only state whose clip list may be read as complete. The other
+ * three exist because an empty list from a sleeping camera reads as "this
+ * camera has no recordings", which is the defect this whole line of work is
+ * about: a battery camera nobody woke (`sleeping`), a camera that could not be
+ * reached at all (`unreachable`, also what a provider that THREW reports), a
+ * camera whose SD card is not mounted (`no-storage`, measured on 640 —
+ * `HddInfo mount 0`, honestly nothing to list rather than "no clips"), and a
+ * camera whose OWN index disagrees with its OWN calendar (`index-empty`,
+ * measured on 618: the calendar marks 3–20 September, days 6–20 list zero
+ * files on both streams and both filters, with 177 GB free). That last one is
+ * a defect ON THE CAMERA, and the only honest thing a provider can do is say
+ * which days it asked for and got nothing — "no clips" would be a lie about a
+ * card that is full of them.
+ */
+export declare const ClipSourceAvailabilitySchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        ok: "ok";
+        sleeping: "sleeping";
+        unreachable: "unreachable";
+        "no-storage": "no-storage";
+        "index-empty": "index-empty";
+    }>;
+    reason: z.ZodOptional<z.ZodString>;
+    catalogAsOf: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type ClipSourceAvailability = z.infer<typeof ClipSourceAvailabilitySchema>;
+/**
+ * One SOURCE of clips for a camera — a row of the picker, and the namespace
+ * every clip id from it is prefixed with (`analytics`,
+ * `native:reolink:onboard`, `hksv`, …).
+ *
+ * A provider lists the sources IT serves for that device, and answers for each
+ * of them whether it can answer at all. A provider with nothing to offer on a
+ * camera returns `[]` — it is not that camera's business.
+ */
+export declare const ClipSourceSchema: z.ZodObject<{
+    source: z.ZodString;
+    label: z.ZodString;
+    addonId: z.ZodOptional<z.ZodString>;
+    via: z.ZodOptional<z.ZodString>;
+    availability: z.ZodObject<{
+        state: z.ZodEnum<{
+            ok: "ok";
+            sleeping: "sleeping";
+            unreachable: "unreachable";
+            "no-storage": "no-storage";
+            "index-empty": "index-empty";
+        }>;
+        reason: z.ZodOptional<z.ZodString>;
+        catalogAsOf: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    switchedOff: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type ClipSource = z.infer<typeof ClipSourceSchema>;
 export declare const videoclipsCapability: {
     readonly name: "videoclips";
     readonly scope: "device";
-    readonly mode: "singleton";
+    readonly mode: "collection";
     readonly kind: "wrapper";
     readonly defaultActive: true;
     /** A clip is a window over a camera's footage — the cap is meaningless on a
      *  sensor, a button or an event emitter, and the `defaultActive` auto-bind
      *  reads this to decide which devices it may claim. */
     readonly deviceTypes: readonly [DeviceType.Camera];
+    /**
+     * The Clips section of a camera's device details is FRAMEWORK-DERIVED (D14):
+     * the aggregator turns this declaration into the `type:'widget'` section and
+     * `DeviceDetail.tsx` is never edited. `videoclips` is the first WRAPPER cap
+     * to declare one — every previous `host/` widget cap is `deviceNative` — so
+     * `device-config-widget-wrapped-binding.spec.ts` pins that a `kind:'wrapped'`
+     * binding entry derives the same section a native one does.
+     *
+     * **It is a SECTION of the Recording tab, at the end of it — not a tab of
+     * its own.** It shipped as a `clips` top-tab and the operator rejected the
+     * placement: *"utilizzerei la stessa tab recordings, lì abbiamo già tutto il
+     * necessario, una nuova sezione alla fine per le clips"*. The Recording tab
+     * already holds the recorder's panel, the schedule bands and the unified
+     * retention policy; footage the camera itself holds is the same question,
+     * asked of a different store. `order: 100` puts it after all of them with
+     * room left in front. The `clips` entry in `WELL_KNOWN_TABS` went with it —
+     * a well-known id nobody declares is an invitation to mint the tab again.
+     *
+     * `topTab` stays: the browser owns a pane (a day's tiles, a source list and
+     * a player) and the Config tab's inner bar has no room for one. The widget
+     * itself is `host/clips-browser` in ui-library's `HOST_WIDGETS`, and because
+     * the admin Recordings page renders every `location:'top-tab'` +
+     * `tab:'recording'` section behind its camera picker
+     * (`CameraRecordingSettingsSection`), this declaration lands the section on
+     * BOTH surfaces with no second wiring.
+     */
+    readonly deviceConfig: {
+        readonly ui: {
+            readonly kind: "widget";
+            readonly widgetId: "host/clips-browser";
+            readonly tab: "recording";
+            readonly topTab: true;
+            readonly label: "Clips";
+            readonly order: 100;
+        };
+    };
     readonly methods: {
         readonly listClips: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             since: z.ZodNumber;
             until: z.ZodNumber;
             limit: z.ZodOptional<z.ZodNumber>;
+            provider: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             source: z.ZodString;
@@ -92,12 +236,80 @@ export declare const videoclipsCapability: {
                 startMs: z.ZodNumber;
                 endMs: z.ZodNumber;
             }, z.core.$strip>>>;
+            thumbnailMint: z.ZodOptional<z.ZodString>;
+            thumbnailUnavailable: z.ZodOptional<z.ZodObject<{
+                reason: z.ZodEnum<{
+                    sleeping: "sleeping";
+                    unsupported: "unsupported";
+                    "camera-refused": "camera-refused";
+                    "no-keyframe": "no-keyframe";
+                }>;
+            }, z.core.$strip>>;
+            catalogAsOf: z.ZodOptional<z.ZodNumber>;
+            nativeTypes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            behaviours: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            streams: z.ZodOptional<z.ZodObject<{
+                sub: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    bytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>;
+                main: z.ZodOptional<z.ZodObject<{
+                    id: z.ZodString;
+                    bytes: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>;
+            }, z.core.$strip>>;
+            supportSub: z.ZodOptional<z.ZodBoolean>;
+            playable: z.ZodOptional<z.ZodBoolean>;
+            unplayableReason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * The sources this camera has, WITH the reason any of them cannot answer.
+         *
+         * Asked separately from `listClips` because an empty clip list is
+         * ambiguous and this is the only place the ambiguity is resolved: every
+         * bound provider contributes its own rows, and a provider that could not
+         * be reached at all still produces one row saying so. A surface that draws
+         * "no clips" without reading this is drawing a guess.
+         */
+        readonly listSources: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            label: z.ZodString;
+            addonId: z.ZodOptional<z.ZodString>;
+            via: z.ZodOptional<z.ZodString>;
+            availability: z.ZodObject<{
+                state: z.ZodEnum<{
+                    ok: "ok";
+                    sleeping: "sleeping";
+                    unreachable: "unreachable";
+                    "no-storage": "no-storage";
+                    "index-empty": "index-empty";
+                }>;
+                reason: z.ZodOptional<z.ZodString>;
+                catalogAsOf: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            switchedOff: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>, "query">;
         readonly getClipPlayback: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;
             clipId: z.ZodString;
+            profile: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>;
         }, z.core.$strip>, z.ZodObject<{
             playbackUrl: z.ZodString;
+            format: z.ZodOptional<z.ZodEnum<{
+                hls: "hls";
+                mp4: "mp4";
+            }>>;
+            served: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>;
             playbackEndpoints: z.ZodOptional<z.ZodArray<z.ZodString>>;
             token: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>, "query">;

package/dist/generated/addon-api.d.ts

@@ -9059,6 +9059,13 @@ export type AppRouter = TrpcCoreRouter<{
             output: z.infer<typeof videoclipsCapability.methods.listClips.output>;
             meta: object;
         }>;
+        listSources: TRPCQueryProcedure<{
+            input: {
+                [x: string]: unknown;
+            } & z.input<typeof videoclipsCapability.methods.listSources.input>;
+            output: z.infer<typeof videoclipsCapability.methods.listSources.output>;
+            meta: object;
+        }>;
         getClipPlayback: TRPCQueryProcedure<{
             input: {
                 [x: string]: unknown;
@@ -9791,23 +9798,6 @@ export type AppRouter = TrpcCoreRouter<{
             output: Record<string, string>;
             meta: object;
         }>;
-        setDeviceCollectionFilter: import("@trpc/server").TRPCMutationProcedure<{
-            input: {
-                deviceId: string;
-                capability: string;
-                addonIds: string[];
-            };
-            output: void;
-            meta: object;
-        }>;
-        clearDeviceCollectionFilter: import("@trpc/server").TRPCMutationProcedure<{
-            input: {
-                deviceId: string;
-                capability: string;
-            };
-            output: void;
-            meta: object;
-        }>;
     }>> & import("@trpc/server").TRPCDecorateCreateRouterOptions<{
         listCapabilities: import("@trpc/server").TRPCQueryProcedure<{
             input: void;
@@ -9870,23 +9860,6 @@ export type AppRouter = TrpcCoreRouter<{
             output: Record<string, string>;
             meta: object;
         }>;
-        setDeviceCollectionFilter: import("@trpc/server").TRPCMutationProcedure<{
-            input: {
-                deviceId: string;
-                capability: string;
-                addonIds: string[];
-            };
-            output: void;
-            meta: object;
-        }>;
-        clearDeviceCollectionFilter: import("@trpc/server").TRPCMutationProcedure<{
-            input: {
-                deviceId: string;
-                capability: string;
-            };
-            output: void;
-            meta: object;
-        }>;
     }>;
     logs: import("@trpc/server/unstable-core-do-not-import").Router<{
         ctx: any;

package/dist/generated/capability-router-map.d.ts

@@ -488,12 +488,12 @@ export interface CapabilityRouterMap<TRouter = unknown> {
     readonly zoneRules: TRouter;
     readonly zones: TRouter;
 }
-/** Capability names whose mode is `singleton` (130 caps). */
-export declare const SINGLETON_CAPABILITY_NAMES: readonly ["accessories", "addon-pages", "addon-settings", "addon-widgets", "addons", "admin-ui", "air-quality-sensor", "alarm-panel", "alerts", "ambient-light-sensor", "audio-analysis", "audio-analyzer", "audio-codec", "audio-metrics", "automation-control", "backup", "battery", "binary", "brightness", "button", "camera-credentials", "camera-grid-layout", "camera-pipeline-config", "camera-streams", "carbon-monoxide", "climate-control", "color", "connectivity", "consumables", "contact", "control", "core-blocks", "cover", "day-night", "decoder", "detection-pipeline", "device-adoption", "device-discovery", "device-manager", "device-ops", "device-state", "device-status", "doorbell", "enum-sensor", "event-emitter", "events", "face-gallery", "fan-control", "feature-probe", "filesystem-browse", "flood", "gas", "humidifier", "humidity-sensor", "image", "image-settings", "integrations", "intercom", "lawn-mower-control", "llm-runtime", "local-network", "lock-control", "media-player", "metrics-provider", "model-convert", "model-distributor", "motion", "motion-detection", "motion-trigger", "motion-zones", "native-object-detection", "navigation", "network-link", "network-quality", "nodes", "notification-rules", "notifier", "numeric-sensor", "osd", "osd-manager", "pet-feeder", "pipeline-analytics", "pipeline-executor", "pipeline-orchestrator", "pipeline-runner", "plate-gallery", "platform-probe", "power-meter", "presence", "pressure-sensor", "privacy-mask", "ptz", "ptz-autotrack", "reboot", "recording", "recording-export", "recording-signal", "scene-monitor", "script-runner", "server-management", "settings-store", "smoke", "snapshot", "sso-bridge", "storage", "storage-migration", "stream-broker", "stream-catalog", "stream-params", "stream-signals", "switch", "system", "tamper", "temperature-sensor", "terminal-session", "toast", "update", "user-management", "vacuum-control", "valve", "vector-store", "vibration", "videoclips", "viewer-ui", "water-heater", "weather", "webrtc-session", "zone-analytics", "zone-rules", "zones"];
+/** Capability names whose mode is `singleton` (129 caps). */
+export declare const SINGLETON_CAPABILITY_NAMES: readonly ["accessories", "addon-pages", "addon-settings", "addon-widgets", "addons", "admin-ui", "air-quality-sensor", "alarm-panel", "alerts", "ambient-light-sensor", "audio-analysis", "audio-analyzer", "audio-codec", "audio-metrics", "automation-control", "backup", "battery", "binary", "brightness", "button", "camera-credentials", "camera-grid-layout", "camera-pipeline-config", "camera-streams", "carbon-monoxide", "climate-control", "color", "connectivity", "consumables", "contact", "control", "core-blocks", "cover", "day-night", "decoder", "detection-pipeline", "device-adoption", "device-discovery", "device-manager", "device-ops", "device-state", "device-status", "doorbell", "enum-sensor", "event-emitter", "events", "face-gallery", "fan-control", "feature-probe", "filesystem-browse", "flood", "gas", "humidifier", "humidity-sensor", "image", "image-settings", "integrations", "intercom", "lawn-mower-control", "llm-runtime", "local-network", "lock-control", "media-player", "metrics-provider", "model-convert", "model-distributor", "motion", "motion-detection", "motion-trigger", "motion-zones", "native-object-detection", "navigation", "network-link", "network-quality", "nodes", "notification-rules", "notifier", "numeric-sensor", "osd", "osd-manager", "pet-feeder", "pipeline-analytics", "pipeline-executor", "pipeline-orchestrator", "pipeline-runner", "plate-gallery", "platform-probe", "power-meter", "presence", "pressure-sensor", "privacy-mask", "ptz", "ptz-autotrack", "reboot", "recording", "recording-export", "recording-signal", "scene-monitor", "script-runner", "server-management", "settings-store", "smoke", "snapshot", "sso-bridge", "storage", "storage-migration", "stream-broker", "stream-catalog", "stream-params", "stream-signals", "switch", "system", "tamper", "temperature-sensor", "terminal-session", "toast", "update", "user-management", "vacuum-control", "valve", "vector-store", "vibration", "viewer-ui", "water-heater", "weather", "webrtc-session", "zone-analytics", "zone-rules", "zones"];
 /** Union of singleton capability names (literal string union). */
 export type SingletonCapabilityName = typeof SINGLETON_CAPABILITY_NAMES[number];
-/** Capability names whose mode is `collection` (28 caps). */
-export declare const COLLECTION_CAPABILITY_NAMES: readonly ["addon-pages-source", "addon-routes", "addon-widgets-source", "auth-provider", "broker", "connection-test", "custom-model-registry", "data-store-provider", "device-export", "device-provider", "embedding-encoder", "failure-contribution", "llm", "load-contribution", "log-channels", "log-destination", "login-method", "mesh-network", "mqtt-broker", "network-access", "notification-output", "oauth-integration", "smtp-provider", "storage-evictable", "storage-occupancy", "storage-provider", "turn-provider", "user-passkeys"];
+/** Capability names whose mode is `collection` (29 caps). */
+export declare const COLLECTION_CAPABILITY_NAMES: readonly ["addon-pages-source", "addon-routes", "addon-widgets-source", "auth-provider", "broker", "connection-test", "custom-model-registry", "data-store-provider", "device-export", "device-provider", "embedding-encoder", "failure-contribution", "llm", "load-contribution", "log-channels", "log-destination", "login-method", "mesh-network", "mqtt-broker", "network-access", "notification-output", "oauth-integration", "smtp-provider", "storage-evictable", "storage-occupancy", "storage-provider", "turn-provider", "user-passkeys", "videoclips"];
 /** Union of collection capability names (literal string union). */
 export type CollectionCapabilityName = typeof COLLECTION_CAPABILITY_NAMES[number];
 /** Capability mode lookup at runtime — mirrors the `.cap.ts` definitions. */

package/dist/generated/collection-array-methods.d.ts

@@ -8,7 +8,7 @@
  * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
  * forked runner. See docs/decisions/adr-0028.md.
  *
- * Coverage: 21 collection caps, 34 array methods.
+ * Coverage: 22 collection caps, 36 array methods.
  */
 export declare const COLLECTION_ARRAY_METHODS: Readonly<Record<string, readonly string[]>>;
 /**

package/dist/generated/method-access-map.d.ts

@@ -6,7 +6,7 @@
  * scope+access check inside `protectedProcedure` (see
  * `server/backend/src/api/trpc/trpc.middleware.ts`).
  *
- * Coverage: 1056 method paths across 131 capabilities.
+ * Coverage: 1057 method paths across 131 capabilities.
  */
 import type { CapabilityMethodAccess } from '../capabilities/capability-definition.js';
 export interface MethodAccessRecord {

package/dist/generated/method-device-selectors.d.ts

@@ -6,7 +6,7 @@
  * system-scope cap that takes a deviceId was previously never device-filtered
  * — see the generator header).
  *
- * Coverage: 388 methods carry a device reference, of which
+ * Coverage: 389 methods carry a device reference, of which
  * 141 are on SYSTEM-scope caps.
  *
  * Top-level fields, number arrays, and one-level arrays of objects carrying