@camstack/types 1.2.260 → 1.2.262

package/dist/addon/base-addon.d.ts

@@ -1,5 +1,5 @@
 import type { ZodType } from 'zod';
-import type { AddonContext, AddonInitResult, CapabilitiesAccess, ProviderRegistration } from '../interfaces/addon.js';
+import type { AddonContext, AddonInitResult, CapabilitiesAccess, ProviderRegistration, StoredKeyRead } from '../interfaces/addon.js';
 import type { ConfigField, ConfigSection, ConfigUISchema, ConfigUISchemaWithValues } from '../interfaces/config-ui.js';
 import { type DurableState } from './durable-state.js';
 export type { CapabilitiesAccess };
@@ -261,6 +261,14 @@ export declare abstract class BaseAddon<TConfig extends object = Record<string,
      * `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
      */
     protected resolveGlobalStore(nodeId?: string, cap?: string): Promise<Record<string, unknown>>;
+    /**
+     * Whether ONE global key of this addon's store was written, read three-way
+     * (D651). For a question a hydrated view cannot answer: `getGlobalSettings`
+     * reports `value ?? default`, so "the operator chose the default" and "nobody
+     * chose" look the same, and a failed read looks like both. A `perNode` key is
+     * not supported here: its stored name is scoped.
+     */
+    protected readStoredGlobalKey(key: string): Promise<StoredKeyRead>;
     updateGlobalSettings(patch: Partial<TConfig>, nodeId?: string): Promise<void>;
     /**
      * The set of field keys the global settings schema declares `perNode: true`

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-BDYxE1ax.js");
+const require_sleep = require("./sleep-8K9gue-H.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts
@@ -150,10 +150,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"listRecentTracks": { "limit": 200 },
 		"listSummaries": { "limit": 50 },
 		"reclaimDebugMedia": { "mode": "report" },
-		"searchObjectEvents": {
-			"limit": 50,
-			"minScore": .2
-		}
+		"searchObjectEvents": { "limit": 50 }
 	},
 	"pipeline-runner": {
 		"attachCamera": {
@@ -307,7 +304,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 23 collection caps, 37 array methods.
+* Coverage: 24 collection caps, 39 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -317,6 +314,7 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"custom-model-registry": ["listModels"],
 	"data-store-provider": ["histogram", "query"],
 	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
+	"device-extension": ["listSlots", "listSources"],
 	"device-provider": ["discoverDevices", "getDevices"],
 	"failure-contribution": ["list"],
 	"llm": [

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { A as DeviceType, At as DATAPLANE_SECRET_HEADER, Dt as PEER_BYTES_STALL_MS, Et as PEER_BYTES_MAX_OUTSTANDING, G as readNodePin, J as ReadinessTimeoutError, L as expandCapMethods, Lt as emitReadiness, Mt as DisposerChain, Nt as BaseAddon, Ot as PEER_BYTES_TICKET_TTL_MS, Pt as normalizeAddonInitResult, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, W as nodePin, Z as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, q as ReadinessRegistry, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-BaRu0bS5.mjs";
+import { A as DeviceType, At as DATAPLANE_SECRET_HEADER, Dt as PEER_BYTES_STALL_MS, Et as PEER_BYTES_MAX_OUTSTANDING, G as readNodePin, J as ReadinessTimeoutError, L as expandCapMethods, Mt as DisposerChain, Nt as BaseAddon, Ot as PEER_BYTES_TICKET_TTL_MS, Pt as normalizeAddonInitResult, Rt as emitReadiness, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, W as nodePin, Z as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, q as ReadinessRegistry, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-DC-wdyeS.mjs";
 import { t as EventCategory } from "./event-category-BVDXG4tB.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts
@@ -149,10 +149,7 @@ var CAP_INPUT_DEFAULTS = Object.freeze({
 		"listRecentTracks": { "limit": 200 },
 		"listSummaries": { "limit": 50 },
 		"reclaimDebugMedia": { "mode": "report" },
-		"searchObjectEvents": {
-			"limit": 50,
-			"minScore": .2
-		}
+		"searchObjectEvents": { "limit": 50 }
 	},
 	"pipeline-runner": {
 		"attachCamera": {
@@ -306,7 +303,7 @@ function materialise(defaults) {
 * barrel (`ALL_CAPABILITY_DEFINITIONS`), which would cost ~144MB RSS per
 * forked runner. See docs/decisions/adr-0028.md.
 *
-* Coverage: 23 collection caps, 37 array methods.
+* Coverage: 24 collection caps, 39 array methods.
 */
 var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"addon-pages-source": ["listPages"],
@@ -316,6 +313,7 @@ var COLLECTION_ARRAY_METHODS = Object.freeze({
 	"custom-model-registry": ["listModels"],
 	"data-store-provider": ["histogram", "query"],
 	"device-export": ["listExposedDevices", "listSupportedDeviceKinds"],
+	"device-extension": ["listSlots", "listSources"],
 	"device-provider": ["discoverDevices", "getDevices"],
 	"failure-contribution": ["list"],
 	"llm": [

package/dist/capabilities/capability-definition.d.ts

@@ -14,6 +14,7 @@
 import { z } from 'zod';
 import { DeviceType } from '../device/device-type.js';
 import type { ConfigUISchemaWithValues } from '../interfaces/config-ui.js';
+import type { ExtensionSlotDescriptor } from '../device-extension/slot-descriptor.js';
 /**
  * tRPC procedure kind.
  * - 'query': read-only, no side effects
@@ -503,6 +504,14 @@ export interface CapabilityDefinition<TName extends string = string, TMethods ex
     readonly deviceConfig?: DeviceConfigSpec;
     /** For `scope: 'device'` caps — allowed device types. Omit → applies to every type. */
     readonly deviceTypes?: readonly DeviceType[];
+    /**
+     * Extension slots this capability OWNS (D648): the ways a device of this
+     * kind can be extended by other devices, served by this cap's owner over
+     * the store it already has. Folded by `npm run codegen` into
+     * `generated/extension-slots.ts` and listed by `device-extension`.
+     * Behavioural metadata, so it lives here and only here (D4).
+     */
+    readonly extensionSlots?: readonly ExtensionSlotDescriptor[];
     /**
      * When `true`, every provider of this capability MUST implement the
      * device-settings contribution surface — three extra methods appearing

package/dist/capabilities/custom-model-registry.cap.d.ts

@@ -147,6 +147,15 @@ export declare const CustomModelDescriptorSchema: z.ZodObject<{
             }>>;
             preserveOriginal: z.ZodBoolean;
         }, z.core.$strip>>;
+        clip: z.ZodOptional<z.ZodObject<{
+            textModelId: z.ZodString;
+            embeddingDim: z.ZodNumber;
+            vectorIndex: z.ZodString;
+            tokenizerFile: z.ZodString;
+            contextLength: z.ZodNumber;
+            padId: z.ZodNumber;
+            searchMinScore: z.ZodNumber;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type CustomModelDescriptor = z.infer<typeof CustomModelDescriptorSchema>;
@@ -295,6 +304,15 @@ export declare const customModelRegistryCapability: {
                     }>>;
                     preserveOriginal: z.ZodBoolean;
                 }, z.core.$strip>>;
+                clip: z.ZodOptional<z.ZodObject<{
+                    textModelId: z.ZodString;
+                    embeddingDim: z.ZodNumber;
+                    vectorIndex: z.ZodString;
+                    tokenizerFile: z.ZodString;
+                    contextLength: z.ZodNumber;
+                    padId: z.ZodNumber;
+                    searchMinScore: z.ZodNumber;
+                }, z.core.$strip>>;
             }, z.core.$strip>;
         }, z.core.$strip>>>, import("./capability-definition.js").CapabilityMethodKind>;
     };

package/dist/capabilities/device-extension.cap.d.ts

@@ -0,0 +1,408 @@
+/**
+ * `device-extension` — ONE place to see and author what a device is extended
+ * with by OTHER devices (D648).
+ *
+ * **A contract, not a store.** Every slot (`linked-devices`,
+ * `doorbell-source`, later `consumables-graft`) is declared by the cap that
+ * owns the function (`extensionSlots` in its `*.cap.ts`, D4) and SERVED by the
+ * addon that already owns its store, over that store and its existing write
+ * path. This cap persists nothing and has no config method (guarded by
+ * `scripts/check-extension-slots.ts`): D62 applied to the whole feature, and
+ * D3 — no shadow registry.
+ *
+ * **Shape.** A device-scoped wrapper COLLECTION, the D554 shape `videoclips`
+ * uses: `resolveCapMount` gives it the `device-scoped` mount and
+ * `requireDeviceCollection` dispatches it. Its providers are the slot owners
+ * (device-manager, virtual-doorbell, …), and a device's sources are its
+ * bindings (step 0 of `getBindings`, derived, persisted nowhere).
+ *
+ *  - `listSources` — one row per provider, the D554 source-listing convention
+ *    that lets a scalar call be routed by the prefix of its `slotRef`.
+ *  - `listSlots` — fan-out, concatenated. A provider that throws becomes ONE
+ *    `unreachable` row naming it, never an absence (D554.4, D315): "no
+ *    extensions" is claimed only from an answer.
+ *  - `listCandidates` / `setSlot` — scalar, routed by `slotRef`
+ *    (`<source>:<slotId>`). An unclaimed ref is refused by name (D554.5).
+ *
+ * The slot's value travels as the generated discriminated union
+ * (`ExtensionSlotValue`, keyed on `slot`), so a value under the wrong slot is
+ * a schema error before it reaches any owner.
+ */
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+/** Separator between the source and the slot id in a `slotRef`. It is the
+ *  D554 routing separator: the dispatcher matches `<source>:` prefixes. */
+export declare const EXTENSION_SLOT_REF_SEPARATOR = ":";
+/** The contract method whose failure BECOMES a row, like `listSources`'s. */
+export declare const EXTENSION_SLOT_LISTING_METHOD = "listSlots";
+export declare const ExtensionSourceAvailabilitySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"ok">;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unreachable">;
+    reason: z.ZodString;
+}, z.core.$strip>], "state">;
+export type ExtensionSourceAvailability = z.infer<typeof ExtensionSourceAvailabilitySchema>;
+/** One provider of slots — the D554 source-listing row. */
+export declare const ExtensionSourceSchema: z.ZodObject<{
+    source: z.ZodString;
+    label: z.ZodString;
+    addonId: z.ZodOptional<z.ZodString>;
+    availability: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        state: z.ZodLiteral<"ok">;
+    }, z.core.$strip>, z.ZodObject<{
+        state: z.ZodLiteral<"unreachable">;
+        reason: z.ZodString;
+    }, z.core.$strip>], "state">;
+}, z.core.$strip>;
+export type ExtensionSource = z.infer<typeof ExtensionSourceSchema>;
+/**
+ * How one picked source stands. `missing` — no such device (deleted, or an id
+ * that never existed); `foreign` — a device the slot's owner cannot read from
+ * (slice 2's cross-owner graft source); `unavailable` — it exists but is not a
+ * valid source now (a container, which is never a pick). A source in any of
+ * these states is SHOWN, never silently dropped or re-pointed.
+ */
+export declare const ExtensionSourceHealthSchema: z.ZodEnum<{
+    ok: "ok";
+    missing: "missing";
+    foreign: "foreign";
+    unavailable: "unavailable";
+}>;
+export type ExtensionSourceHealth = z.infer<typeof ExtensionSourceHealthSchema>;
+export declare const ExtensionSlotSourceSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    name: z.ZodNullable<z.ZodString>;
+    health: z.ZodEnum<{
+        ok: "ok";
+        missing: "missing";
+        foreign: "foreign";
+        unavailable: "unavailable";
+    }>;
+    detail: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExtensionSlotSource = z.infer<typeof ExtensionSlotSourceSchema>;
+/**
+ * A DIFFERENT authority that gates whether the slot's sources do anything —
+ * reported read-only, named, never written through this contract (D62). The
+ * virtual doorbell's sources ring only while the wrapper is bound to the
+ * camera, and that binding belongs to `deviceManager.setWrapperActive`.
+ * `unknown` means the gate could not be read; it is not "inactive" (D315).
+ */
+export declare const ExtensionSlotActivationSchema: z.ZodObject<{
+    state: z.ZodEnum<{
+        unknown: "unknown";
+        active: "active";
+        inactive: "inactive";
+    }>;
+    authority: z.ZodString;
+    detail: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ExtensionSlotActivation = z.infer<typeof ExtensionSlotActivationSchema>;
+/** One slot of one device, as its owner reads it from its own store. */
+export declare const ExtensionSlotStateSchema: z.ZodObject<{
+    state: z.ZodLiteral<"ok">;
+    slotRef: z.ZodString;
+    slot: z.ZodEnum<{
+        "linked-devices": "linked-devices";
+        "doorbell-source": "doorbell-source";
+    }>;
+    authority: z.ZodString;
+    enabled: z.ZodNullable<z.ZodBoolean>;
+    projects: z.ZodNullable<z.ZodString>;
+    activation: z.ZodNullable<z.ZodObject<{
+        state: z.ZodEnum<{
+            unknown: "unknown";
+            active: "active";
+            inactive: "inactive";
+        }>;
+        authority: z.ZodString;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        slot: z.ZodLiteral<"doorbell-source">;
+    }, z.core.$strip>, z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        slot: z.ZodLiteral<"linked-devices">;
+    }, z.core.$strip>], "slot">;
+    sources: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        name: z.ZodNullable<z.ZodString>;
+        health: z.ZodEnum<{
+            ok: "ok";
+            missing: "missing";
+            foreign: "foreign";
+            unavailable: "unavailable";
+        }>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    impliedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        name: z.ZodNullable<z.ZodString>;
+        health: z.ZodEnum<{
+            ok: "ok";
+            missing: "missing";
+            foreign: "foreign";
+            unavailable: "unavailable";
+        }>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ExtensionSlotState = z.infer<typeof ExtensionSlotStateSchema>;
+/**
+ * A provider that could not answer `listSlots` at all. It could not name its
+ * own slots, so the row names the ADDON and carries the refusal verbatim.
+ * Written by the dispatcher, never by a provider.
+ */
+export declare const ExtensionSlotUnreachableSchema: z.ZodObject<{
+    state: z.ZodLiteral<"unreachable">;
+    addonId: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type ExtensionSlotUnreachable = z.infer<typeof ExtensionSlotUnreachableSchema>;
+export declare const ExtensionSlotRowSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    state: z.ZodLiteral<"ok">;
+    slotRef: z.ZodString;
+    slot: z.ZodEnum<{
+        "linked-devices": "linked-devices";
+        "doorbell-source": "doorbell-source";
+    }>;
+    authority: z.ZodString;
+    enabled: z.ZodNullable<z.ZodBoolean>;
+    projects: z.ZodNullable<z.ZodString>;
+    activation: z.ZodNullable<z.ZodObject<{
+        state: z.ZodEnum<{
+            unknown: "unknown";
+            active: "active";
+            inactive: "inactive";
+        }>;
+        authority: z.ZodString;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        slot: z.ZodLiteral<"doorbell-source">;
+    }, z.core.$strip>, z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        slot: z.ZodLiteral<"linked-devices">;
+    }, z.core.$strip>], "slot">;
+    sources: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        name: z.ZodNullable<z.ZodString>;
+        health: z.ZodEnum<{
+            ok: "ok";
+            missing: "missing";
+            foreign: "foreign";
+            unavailable: "unavailable";
+        }>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    impliedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        name: z.ZodNullable<z.ZodString>;
+        health: z.ZodEnum<{
+            ok: "ok";
+            missing: "missing";
+            foreign: "foreign";
+            unavailable: "unavailable";
+        }>;
+        detail: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    state: z.ZodLiteral<"unreachable">;
+    addonId: z.ZodString;
+    reason: z.ZodString;
+}, z.core.$strip>], "state">;
+export type ExtensionSlotRow = z.infer<typeof ExtensionSlotRowSchema>;
+/** The row the dispatcher writes for a provider whose `listSlots` threw. */
+export declare function unreachableExtensionSlotRow(addonId: string, reason: string): ExtensionSlotUnreachable;
+/** One device the slot's editor may offer as a source. */
+export declare const ExtensionCandidateSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    name: z.ZodString;
+    type: z.ZodString;
+    location: z.ZodNullable<z.ZodString>;
+    parentName: z.ZodNullable<z.ZodString>;
+    suggested: z.ZodBoolean;
+    reason: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ExtensionCandidate = z.infer<typeof ExtensionCandidateSchema>;
+export declare const ExtensionCandidatesSchema: z.ZodObject<{
+    candidates: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        name: z.ZodString;
+        type: z.ZodString;
+        location: z.ZodNullable<z.ZodString>;
+        parentName: z.ZodNullable<z.ZodString>;
+        suggested: z.ZodBoolean;
+        reason: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ExtensionCandidates = z.infer<typeof ExtensionCandidatesSchema>;
+/**
+ * What a write did. `none` — applied in place. `host` / `parent` — the owner
+ * reloaded the host (or, for an accessory child, its parent) because the
+ * write changed what the host REGISTERS (a graft switched on or off, slice 2).
+ */
+export declare const ExtensionSetResultSchema: z.ZodObject<{
+    applied: z.ZodLiteral<true>;
+    reload: z.ZodEnum<{
+        none: "none";
+        host: "host";
+        parent: "parent";
+    }>;
+}, z.core.$strip>;
+export type ExtensionSetResult = z.infer<typeof ExtensionSetResultSchema>;
+export declare const ExtensionSlotRefInputSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    slotRef: z.ZodString;
+}, z.core.$strip>;
+export type ExtensionSlotRefInput = z.infer<typeof ExtensionSlotRefInputSchema>;
+export declare const ExtensionSetSlotInputSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    slotRef: z.ZodString;
+    value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        slot: z.ZodLiteral<"doorbell-source">;
+    }, z.core.$strip>, z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        slot: z.ZodLiteral<"linked-devices">;
+    }, z.core.$strip>], "slot">;
+}, z.core.$strip>;
+export type ExtensionSetSlotInput = z.infer<typeof ExtensionSetSlotInputSchema>;
+export declare const deviceExtensionCapability: {
+    readonly name: "device-extension";
+    readonly scope: "device";
+    readonly mode: "collection";
+    readonly kind: "wrapper";
+    readonly defaultActive: true;
+    readonly deviceTypes: readonly import("../index.js").DeviceType[];
+    readonly deviceConfig: {
+        readonly ui: {
+            readonly kind: "widget";
+            readonly widgetId: "host/extensions-panel";
+            readonly tab: "general";
+            readonly label: "Extensions";
+            readonly order: 72;
+        };
+    };
+    readonly methods: {
+        /** One row per slot owner — the D554 source listing `slotRef` routes by. */
+        readonly listSources: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodArray<z.ZodObject<{
+            source: z.ZodString;
+            label: z.ZodString;
+            addonId: z.ZodOptional<z.ZodString>;
+            availability: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                state: z.ZodLiteral<"ok">;
+            }, z.core.$strip>, z.ZodObject<{
+                state: z.ZodLiteral<"unreachable">;
+                reason: z.ZodString;
+            }, z.core.$strip>], "state">;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Every slot this device is offered, read by each owner from its own
+         * store. A provider that throws is ONE `unreachable` row (D554.4).
+         */
+        readonly listSlots: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            state: z.ZodLiteral<"ok">;
+            slotRef: z.ZodString;
+            slot: z.ZodEnum<{
+                "linked-devices": "linked-devices";
+                "doorbell-source": "doorbell-source";
+            }>;
+            authority: z.ZodString;
+            enabled: z.ZodNullable<z.ZodBoolean>;
+            projects: z.ZodNullable<z.ZodString>;
+            activation: z.ZodNullable<z.ZodObject<{
+                state: z.ZodEnum<{
+                    unknown: "unknown";
+                    active: "active";
+                    inactive: "inactive";
+                }>;
+                authority: z.ZodString;
+                detail: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                deviceIds: z.ZodArray<z.ZodNumber>;
+                slot: z.ZodLiteral<"doorbell-source">;
+            }, z.core.$strip>, z.ZodObject<{
+                deviceIds: z.ZodArray<z.ZodNumber>;
+                trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+                slot: z.ZodLiteral<"linked-devices">;
+            }, z.core.$strip>], "slot">;
+            sources: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                name: z.ZodNullable<z.ZodString>;
+                health: z.ZodEnum<{
+                    ok: "ok";
+                    missing: "missing";
+                    foreign: "foreign";
+                    unavailable: "unavailable";
+                }>;
+                detail: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>;
+            impliedSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                name: z.ZodNullable<z.ZodString>;
+                health: z.ZodEnum<{
+                    ok: "ok";
+                    missing: "missing";
+                    foreign: "foreign";
+                    unavailable: "unavailable";
+                }>;
+                detail: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>, z.ZodObject<{
+            state: z.ZodLiteral<"unreachable">;
+            addonId: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strip>], "state">>, import("./capability-definition.js").CapabilityMethodKind>;
+        /** The devices the slot's editor may offer, suggestions pre-marked (D356). */
+        readonly listCandidates: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            slotRef: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            candidates: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                name: z.ZodString;
+                type: z.ZodString;
+                location: z.ZodNullable<z.ZodString>;
+                parentName: z.ZodNullable<z.ZodString>;
+                suggested: z.ZodBoolean;
+                reason: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, import("./capability-definition.js").CapabilityMethodKind>;
+        /**
+         * Write one slot through its owner's EXISTING write path. The owner
+         * validates (a container is never a linked device, a camera is never its
+         * own source) and refuses by name before persisting.
+         */
+        readonly setSlot: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            slotRef: z.ZodString;
+            value: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                deviceIds: z.ZodArray<z.ZodNumber>;
+                slot: z.ZodLiteral<"doorbell-source">;
+            }, z.core.$strip>, z.ZodObject<{
+                deviceIds: z.ZodArray<z.ZodNumber>;
+                trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+                slot: z.ZodLiteral<"linked-devices">;
+            }, z.core.$strip>], "slot">;
+        }, z.core.$strip>, z.ZodObject<{
+            applied: z.ZodLiteral<true>;
+            reload: z.ZodEnum<{
+                none: "none";
+                host: "host";
+                parent: "parent";
+            }>;
+        }, z.core.$strip>, "mutation">;
+    };
+};
+export type IDeviceExtensionProvider = InferProvider<typeof deviceExtensionCapability>;

package/dist/capabilities/device-manager.cap.d.ts

@@ -125,6 +125,46 @@ export declare const LinkedDeviceSchema: z.ZodObject<{
     producesTrackedEvents: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type LinkedDevice = z.infer<typeof LinkedDeviceSchema>;
+/**
+ * The `linked-devices` extension slot's editable value (D648): the operator's
+ * pick list, exactly what `_linkedDeviceIds` persists. Tree children are NOT
+ * in it — they are always linked and are not a pick.
+ *
+ * `trackedDeviceIds` (D655) is the tracked-event opt-in, exactly what
+ * `_linkedDeviceTrackedIds` persists: which linked devices materialize a
+ * synthetic tracked event on the camera. A read always carries it AS STORED
+ * (an absent key reads as `[]`, which is what the resolver makes of it —
+ * NONE). On a write it is optional: absent leaves the opt-in untouched, so a
+ * card built before D655 cannot erase it by saving the pick list. A present
+ * list REPLACES the opt-in; each id must be a pick, a device the camera links
+ * by structure (the row's `impliedSources`: tree children, a picked
+ * container's child) or already stored — so what was read can always be
+ * written back unchanged, and a NEW opt-in outside the linked set is refused.
+ */
+export declare const LinkedDevicesSlotValueSchema: z.ZodObject<{
+    deviceIds: z.ZodArray<z.ZodNumber>;
+    trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+}, z.core.$strip>;
+export type LinkedDevicesSlotValue = z.infer<typeof LinkedDevicesSlotValueSchema>;
+/**
+ * The `linked-devices` slot — a camera's companion devices, owned by the
+ * device manager over `_linkedDeviceIds` (D648, D356). Any device may be a
+ * source except a container (its children are picked in its place) and the
+ * camera itself.
+ */
+export declare const LINKED_DEVICES_SLOT: {
+    readonly id: "linked-devices";
+    readonly label: "Linked devices";
+    readonly description: string;
+    readonly shape: "association";
+    readonly hostDeviceTypes: readonly [DeviceType.Camera];
+    readonly sourceCaps: "any";
+    readonly cardinality: "many";
+    readonly value: z.ZodObject<{
+        deviceIds: z.ZodArray<z.ZodNumber>;
+        trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+    }, z.core.$strip>;
+};
 /** One camera's resolved linked set, tagged with the camera it belongs to.
  *  The batch answer needs the tag; the single-device answer already has it
  *  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
@@ -309,7 +349,19 @@ export declare const deviceManagerCapability: {
     readonly name: "device-manager";
     readonly scope: "system";
     readonly mode: "singleton";
-    readonly exposesDeviceSettings: true;
+    readonly extensionSlots: readonly [{
+        readonly id: "linked-devices";
+        readonly label: "Linked devices";
+        readonly description: string;
+        readonly shape: "association";
+        readonly hostDeviceTypes: readonly [DeviceType.Camera];
+        readonly sourceCaps: "any";
+        readonly cardinality: "many";
+        readonly value: z.ZodObject<{
+            deviceIds: z.ZodArray<z.ZodNumber>;
+            trackedDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+        }, z.core.$strip>;
+    }];
     readonly methods: {
         /** Reserve (or re-resolve) a progressive numeric id for `(addonId, stableId)`.
          *  Idempotent: returns the existing id if one is already persisted for the
@@ -1134,11 +1186,12 @@ export declare const deviceManagerCapability: {
         /**
          * Resolve the devices LINKED to a camera — the single policy authority
          * both consumers call (viewer devices panel + pipeline-analytics event
-         * kinds/ingest). Device-tree children are ALWAYS included; mode 'auto'
-         * (default) adds every device sharing the camera's non-null `location`,
-         * mode 'manual' adds the persisted manual list instead. Excludes the
-         * camera itself; deduped. Configuration is standard per-device settings
-         * (see the module docblock) — there are no bespoke link mutations.
+         * kinds/ingest). Device-tree children are ALWAYS included, plus the
+         * operator's persisted pick list (`mode` is always `manual` since D356:
+         * same-location devices are suggested by the picker, never linked on
+         * their own). Excludes the camera itself; deduped. The list is written by
+         * the `linked-devices` extension slot over `_linkedDeviceIds` (see the
+         * module docblock).
          */
         readonly getLinkedDevices: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
             deviceId: z.ZodNumber;