@camstack/core 0.1.14 → 0.1.15

package/dist/index.d.ts

@@ -1,71 +1,10 @@
-import { IScopedLogger, ModelDownloadOptions, ModelDownloadResult, IAddonModelManager, ModelCatalogEntry, ModelFormat, IPythonEnvironment, PythonProbeResult, PythonEnvReady, PipelineConfig, ValidationResult, FrameInput, PipelineResult, AudioChunkInput, PipelineNode, ElementState as ElementState$1, LoggerFactory, ProcessConfig, ManagedProcessStatus, INetworkQualityTracker, ClientNetworkStats, DeviceNetworkStats, ReplResult, AgentInfo, AgentEntry, AgentStatus, AgentTask, TaskDispatchOptions, AgentTaskResult, LogEntry, LogFilter, AgentRegistrationInfo, AgentToHubMessage, HubToAgentMessage, AgentRuntimeStatus, ITaskHandler, TaskContext, IEventBus, FeatureManifest, FeatureFlag, SystemEvent, EventFilter, IStorageProvider as IStorageProvider$1, ISettingsBackend, TokenScope, ScopedToken, TokenPayload, UserRole, UserRecord, INotificationOutput, Notification, Toast, IAddonRouteProvider, IAddonHttpRoute, PlatformCapabilities, HardwareInfo, PlatformScore, ModelRequirement, ResolvedInferenceConfig, IIntegrationRegistry, CreateIntegrationInput, Integration, CreateDeviceInput, Device, ProviderListItem } from '@camstack/types';
-export { AgentEntry, AgentInfo, AgentResources, AgentStatus, AgentTask, AgentTaskResult, BackupManifest, ClientNetworkStats, DeviceNetworkStats, EventFilter, EventSource, FeatureFlag, FeatureManifest, INetworkQualityTracker, IScopedLogger, LogEntry, LogFilter, LogLevel, ManagedProcessStatus, ProcessConfig, ProcessStats, ProviderListItem, ReplResult, StreamNetworkStats, SystemEvent, TaskDispatchOptions, TokenPayload, UserRecord, UserRole, ValidationIssue, ValidationResult } from '@camstack/types';
+import { FilesystemStorageProvider } from '@camstack/types/node';
+export { FilesystemStorageProvider, PYTHON_VERSION, PlatformInfo, buildBinaryPath, downloadBinary, ensureBinary, ensureFfmpeg, ensurePython, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, installPythonRequirements } from '@camstack/types/node';
+import * as _camstack_types from '@camstack/types';
+import { ModelCatalogEntry, ModelFormat, ModelDownloadOptions, ModelDownloadResult, IAddonModelManager, IPythonEnvironment, PythonProbeResult, PythonEnvReady, PipelineConfig, ValidationResult, IAddonResolver, FrameInput, PipelineResult, IEngineManager, IAddonCaller, INetworkQualityTracker, ClientNetworkStats, DeviceNetworkStats, ReplResult, BaseAddon, ProviderRegistration, ISettingsBackend, SettingsGetInput, SettingsSetInput, SettingsQueryInput, SettingsRecord, SettingsInsertInput, SettingsUpdateInput, SettingsDeleteInput, SettingsCountInput, SettingsIsEmptyInput, CollectionColumn, CollectionIndex, TableSchema, TableQueryOptions, ILogDestination as ILogDestination$1, LogEntry, LogFilter, IScopedLogger, IClusterBroker, IEventBus, BackupManifest, Alert, SystemResourceSnapshot, DiskSpaceInfo, MetricsGpuInfo, PidResourceStats, MemoryInfo, ConfigUISchemaWithValues, DeviceBindingEntry, FeatureManifest, FeatureFlag, SystemEvent, EventFilter, LogTags, LogExtras, IStorageProvider as IStorageProvider$1, SettingsStoreClient, TokenScope, ScopedToken, TokenPayload, UserRole, ApiKeyRecord, UserRecord, ICapabilityRegistry, INotificationOutput, Notification, Toast, IAddonRouteProvider, IAddonHttpRoute, IIntegrationRegistry, CreateIntegrationInput, Integration, CreateDeviceInput, PersistedDevice } from '@camstack/types';
+export { ApiKeyRecord, BackupManifest, ClientNetworkStats, DeviceNetworkStats, EventFilter, EventSource, FeatureFlag, FeatureManifest, INetworkQualityTracker, IScopedLogger, LogEntry, LogFilter, LogLevel, ReplResult, StreamNetworkStats, SystemEvent, TokenPayload, UserRecord, UserRole, ValidationIssue, ValidationResult } from '@camstack/types';
 import { ChildProcess } from 'node:child_process';
-import { AddonLoader, AddonEngineManager, CapabilityRegistry } from '@camstack/kernel';
-export { A as AddonTableSchema, C as CORE_TABLE_DDL, F as FileSystemStorage, S as SettingsStore, a as SqliteStorageAddon, b as SqliteStorageProvider, c as addonTableToDdl } from './sql-schema-CKz78rId.js';
-export { WinstonDestination, WinstonLoggingAddon } from './builtins/winston-logging/index.js';
-export { BackupConfig, LocalBackupAddon, LocalBackupService } from './builtins/local-backup/index.js';
-
-interface PlatformInfo {
-    readonly platform: NodeJS.Platform;
-    readonly arch: NodeJS.Architecture;
-}
-declare function getPlatformInfo(): PlatformInfo;
-declare function buildBinaryPath(dataDir: string, name: string, platform?: string): string;
-/** Check if a binary exists in PATH */
-declare function findInPath(name: string): string | null;
-interface DownloadOptions {
-    readonly name: string;
-    readonly url: string;
-    readonly targetDir: string;
-    readonly targetName: string;
-    readonly logger: IScopedLogger;
-    readonly isArchive?: boolean;
-    readonly archiveFormat?: 'zip' | 'tar.gz' | 'tar.xz';
-    /** Relative path within archive to the binary (e.g., 'ffmpeg-6.1/bin/ffmpeg') */
-    readonly archiveInnerPath?: string;
-}
-/**
- * Download a binary to the target directory.
- * Handles archives (zip, tar.gz, tar.xz) and raw binaries.
- */
-declare function downloadBinary(opts: DownloadOptions): Promise<string>;
-/**
- * Ensure a binary is available. Checks:
- * 1. Target path (already downloaded)
- * 2. System PATH
- * 3. Download from URL
- */
-declare function ensureBinary(opts: {
-    readonly name: string;
-    readonly targetDir: string;
-    readonly downloadUrl: string;
-    readonly logger: IScopedLogger;
-    readonly isArchive?: boolean;
-    readonly archiveFormat?: 'zip' | 'tar.gz' | 'tar.xz';
-    readonly archiveInnerPath?: string;
-}): Promise<string>;
-
-declare function getFfmpegDownloadUrl(platform: string, arch: string): string;
-/**
- * Ensure ffmpeg binary is available.
- * Checks: deps dir → system PATH → download.
- */
-declare function ensureFfmpeg(dataDir: string, logger: IScopedLogger): Promise<string>;
-
-declare const PYTHON_VERSION = "3.12.12";
-declare function getPythonDownloadUrl(platform: string, arch: string): string;
-/**
- * Ensure a portable Python is available.
- * Checks: embedded python → system PATH → download portable.
- *
- * Returns the path to the python3 binary.
- */
-declare function ensurePython(dataDir: string, logger: IScopedLogger): Promise<string | null>;
-/**
- * Install Python packages into the portable Python environment.
- */
-declare function installPythonPackages(pythonPath: string, packages: readonly string[], logger: IScopedLogger): Promise<void>;
+import Database from 'better-sqlite3';
 
 type EventCallback<T = unknown> = (data: T) => void;
 declare class EventBus {
@@ -93,6 +32,20 @@ declare function fetchJson(url: string): Promise<unknown>;
  * Legacy API preserved for backward compatibility -- delegates to downloadFile().
  */
 declare function downloadModel(options: ModelDownloadOptions): Promise<ModelDownloadResult>;
+/** Progress callback: (downloadedBytes, totalBytes | undefined) */
+type DownloadProgressCallback = (downloaded: number, total: number | undefined) => void;
+/**
+ * Resolve a `ModelCatalogEntry` against `modelsDir`: download model file
+ * (or directory bundle) + extra files (labels JSON, charset dict, …),
+ * skip if already on disk. Returns the local model path.
+ */
+declare function ensureModel(modelsDir: string, entry: ModelCatalogEntry, format: ModelFormat, onProgress?: DownloadProgressCallback): Promise<string>;
+/** Compute the on-disk path for a given model + format, even when not yet downloaded. */
+declare function getModelFilePath(modelsDir: string, entry: ModelCatalogEntry, format: ModelFormat): string | null;
+/** True iff the model file (or `Manifest.json` for directory bundles) exists and is non-empty. */
+declare function isModelDownloaded(modelsDir: string, entry: ModelCatalogEntry, format: ModelFormat): boolean;
+/** Remove the on-disk model file/directory. Returns true if something was deleted. */
+declare function deleteModelFromDisk(modelsDir: string, entry: ModelCatalogEntry, format: ModelFormat): boolean;
 
 /**
  * Unified model download service.
@@ -122,11 +75,6 @@ declare class ModelDownloadService implements IAddonModelManager {
     getModelsDir(): string;
     /** Check if a model file is already present on disk. */
     isDownloaded(modelId: string, format?: ModelFormat): boolean;
-    /**
-     * Legacy API: download a model by ID (delegates to ensure with default format).
-     * Required by IAddonModelManager interface.
-     */
-    downloadModel(id: string): Promise<string>;
     /** Get the catalog entry for a model by ID. */
     getEntry(modelId: string): ModelCatalogEntry | undefined;
     private pickDefaultFormat;
@@ -141,7 +89,6 @@ declare class ModelDownloadService implements IAddonModelManager {
 }
 
 declare class PythonEnvManager implements IPythonEnvironment {
-    private readonly dataDir;
     private venvPath;
     private cachedProbe;
     constructor(dataDir: string);
@@ -152,79 +99,59 @@ declare class PythonEnvManager implements IPythonEnvironment {
     spawn(script: string, args: readonly string[]): ChildProcess;
 }
 
+/**
+ * Check if a pipeline step is available in the system.
+ * Implementations should check the capability registry for `pipeline-step:{stepId}`.
+ */
+type StepExistsFn = (stepId: string) => boolean;
 declare class PipelineValidator {
-    private readonly loader;
-    constructor(loader: AddonLoader);
+    private readonly stepExists;
+    constructor(stepExists: StepExistsFn);
     validate(config: PipelineConfig): ValidationResult;
     private validateNode;
 }
 
 declare class PipelineRunner {
-    private readonly engineManager;
-    private readonly addonConfigs;
-    constructor(engineManager: AddonEngineManager, addonConfigs: Map<string, Record<string, unknown>>);
+    private readonly addonResolver;
+    constructor(addonResolver: IAddonResolver);
     run(frame: FrameInput, config: PipelineConfig): Promise<PipelineResult>;
-    /**
-     * Run only the audio classification node on an audio chunk.
-     * Used by the audio path in DetectionWiringService (separate from video pipeline).
-     */
-    runAudioNode(chunk: AudioChunkInput, audioNode: PipelineNode): Promise<PipelineResult>;
     private executeNode;
     private executeChildren;
 }
 
-type ProcessState = ElementState$1;
-
-/** Event emitter for process lifecycle events */
-type ProcessEventEmitter = {
-    emitProcessCrashed(processId: string, code: number | null, signal: string | null, restartCount: number): void;
-    emitProcessRestartScheduled(processId: string, restartCount: number, delayMs: number): void;
-    emitProcessRestarted(processId: string, restartCount: number): void;
-};
-/** Re-export LoggerFactory as ProcessLoggerFactory for backward compatibility */
-type ProcessLoggerFactory = LoggerFactory;
-
-declare class ManagedProcess {
-    private readonly config;
-    private readonly events;
-    private readonly logger;
-    private childProcess;
-    private _state;
-    private _startedAt?;
-    private restartTimer?;
-    private _restartCount;
-    private _lastCrashAt?;
-    private _lastCrashError?;
-    constructor(config: ProcessConfig, events: ProcessEventEmitter, logger: IScopedLogger);
-    get state(): ProcessState;
-    start(): Promise<void>;
-    stop(): Promise<void>;
-    getStatus(): ManagedProcessStatus;
-    private scheduleRestart;
-    private getStats;
-    private getNextRestartTime;
+/**
+ * Adapter that wraps an IEngineManager + addonConfigs as an IAddonResolver.
+ *
+ * Used for backwards compatibility — the in-process AddonEngineManager
+ * still uses the old getOrCreateEngine(addonId, globalConfig, override) API.
+ * This adapter bridges it to the new resolve(addonId, config) interface.
+ */
+declare class EngineManagerResolver implements IAddonResolver {
+    private readonly engineManager;
+    private readonly addonConfigs;
+    constructor(engineManager: IEngineManager, addonConfigs: Map<string, Record<string, unknown>>);
+    resolve(addonId: string, config: Record<string, unknown>): Promise<IAddonCaller>;
+    shutdownAll(): Promise<void>;
 }
 
-declare class ProcessManager {
-    private readonly events;
-    private readonly loggerFactory;
-    private readonly processes;
-    constructor(events: ProcessEventEmitter, loggerFactory: ProcessLoggerFactory);
-    register(config: ProcessConfig): ManagedProcess;
-    start(id: string): Promise<void>;
-    stop(id: string): Promise<void>;
-    restart(id: string): Promise<void>;
-    get(id: string): ManagedProcess;
-    listAll(): readonly ManagedProcessStatus[];
-    shutdownAll(): Promise<void>;
+interface PidStats {
+    cpu: number;
+    memory: number;
 }
+/**
+ * Get CPU% and memory RSS for one or more PIDs.
+ * Returns a map of pid → stats. Missing/dead PIDs are silently omitted.
+ */
+declare function getPidStats(pids: number | readonly number[]): Promise<ReadonlyMap<number, PidStats>>;
+/** Get CPU% and memory RSS for a single PID. Returns null if dead. */
+declare function getSinglePidStats(pid: number): Promise<PidStats | null>;
 
 declare class NetworkQualityTracker implements INetworkQualityTracker {
     private readonly devices;
     private static readonly MAX_SAMPLES;
-    reportStreamStats(deviceId: string, streamId: string, bitrateKbps: number, packetLoss?: number): void;
-    reportClientStats(deviceId: string, stats: Omit<ClientNetworkStats, 'lastUpdated'>): void;
-    getDeviceStats(deviceId: string): DeviceNetworkStats | null;
+    reportStreamStats(deviceId: number, streamId: string, bitrateKbps: number, packetLoss?: number): void;
+    reportClientStats(deviceId: number, stats: Omit<ClientNetworkStats, 'lastUpdated'>): void;
+    getDeviceStats(deviceId: number): DeviceNetworkStats | null;
     getAllStats(): readonly DeviceNetworkStats[];
     private getOrCreateDevice;
 }
@@ -232,7 +159,7 @@ declare class NetworkQualityTracker implements INetworkQualityTracker {
 interface ReplScope {
     readonly type: 'system' | 'provider' | 'device' | 'addon';
     readonly providerId?: string;
-    readonly deviceId?: string;
+    readonly deviceId?: number;
     readonly addonId?: string;
 }
 interface ReplSessionContext {
@@ -248,12 +175,16 @@ interface IReplEngine {
 /**
  * Context provider that the server kernel implements.
  * The REPL engine calls this to build the sandbox for each scope type.
+ *
+ * Methods may return a Promise so the kernel can warm up async
+ * resources (e.g. `SystemManager.init()`) before exposing them — the
+ * engine awaits each before evaluating user code.
  */
 interface IReplContextProvider {
-    getSystemSandbox(): Record<string, unknown>;
-    getDeviceSandbox(deviceId: string): Record<string, unknown>;
-    getProviderSandbox(providerId: string): Record<string, unknown>;
-    getAddonSandbox(addonId: string): Record<string, unknown>;
+    getSystemSandbox(): Record<string, unknown> | Promise<Record<string, unknown>>;
+    getDeviceSandbox(deviceId: number): Record<string, unknown> | Promise<Record<string, unknown>>;
+    getProviderSandbox(providerId: string): Record<string, unknown> | Promise<Record<string, unknown>>;
+    getAddonSandbox(addonId: string): Record<string, unknown> | Promise<Record<string, unknown>>;
 }
 
 declare class ReplEngine implements IReplEngine {
@@ -264,203 +195,866 @@ declare class ReplEngine implements IReplEngine {
     private buildSandbox;
 }
 
-/** Event emitter for agent lifecycle and task events */
-type AgentEventEmitter = {
-    emitAgentRegistered(agentId: string, capabilities: readonly string[]): void;
-    emitAgentUnregistered(agentId: string): void;
-    emitAgentOnline(agentId: string): void;
-    emitAgentOffline(agentId: string): void;
-    emitTaskDispatched(taskId: string, agentId: string, capability: string): void;
-};
+interface FilesystemStorageConfig {
+    readonly rootPath: string;
+}
+/**
+ * Filesystem Storage addon — provides local disk storage for all location types.
+ * Capability: 'storage' (collection)
+ */
+declare class FilesystemStorageAddon extends BaseAddon<FilesystemStorageConfig> {
+    private provider;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    getProvider(): FilesystemStorageProvider | null;
+}
 
-declare class AgentRegistry {
-    private readonly events;
-    private readonly heartbeatTimeoutMs;
-    private readonly heartbeatCheckIntervalMs;
-    private readonly agents;
-    private readonly heartbeatIntervals;
-    constructor(events: AgentEventEmitter, heartbeatTimeoutMs?: number, heartbeatCheckIntervalMs?: number);
-    /** Register a new agent */
-    registerAgent(info: AgentInfo): void;
-    /** Remove agent */
-    unregisterAgent(id: string): void;
-    /** Update heartbeat timestamp */
-    heartbeat(id: string): void;
-    /** Find agents with a specific capability */
-    getAgentsWithCapability(capability: string): readonly AgentEntry[];
-    /** Get best agent for a task (least loaded) */
-    selectAgent(capability: string, preferredId?: string): AgentEntry | null;
-    /** List all agents with status */
-    listAgents(): readonly AgentStatus[];
-    /** Get single agent */
-    getAgent(id: string): AgentEntry | null;
-    /** Destroy all heartbeat intervals */
-    destroy(): void;
-    private startHeartbeatCheck;
+/**
+ * SQLite implementation of ISettingsBackend.
+ *
+ * Every collection is structured: declared at boot (canonical KV
+ * collections) or via `declareCollection` (typed schemas like
+ * `pipeline-analytics:tracks`). The legacy auto-create-on-first-access
+ * path was removed — see commit history for the migration. Operations
+ * on undeclared collections throw at runtime so callers fail fast.
+ *
+ * WAL mode for concurrent reads.
+ */
+declare class SqliteSettingsBackend implements ISettingsBackend {
+    private readonly dbPath;
+    private db;
+    private readonly structuredTables;
+    /** Map from scoped collection name → set of column names (non-id) that
+     *  the structured schema owns. Routes set/get/insert/update/query to
+     *  typed columns. Every collection MUST be declared here before use. */
+    private readonly declaredCollections;
+    private readonly runtimeDefaults;
+    /**
+     * Canonical key/value collections — declared with a `(id TEXT PK,
+     * data TEXT NOT NULL)` schema at boot so existing JSON-blob rows
+     * keep working through the structured path. Generates SQL identical
+     * to the previous legacy path; only the routing is unified.
+     */
+    private static readonly CANONICAL_KV_COLLECTIONS;
+    constructor(dbPath: string, runtimeDefaults?: Record<string, unknown>);
+    initialize(): Promise<void>;
+    private requireDeclared;
+    shutdown(): Promise<void>;
+    get({ namespace, collection, key }: SettingsGetInput): Promise<unknown>;
+    set({ namespace, collection, key, value }: SettingsSetInput): Promise<void>;
+    query<T extends object = Record<string, unknown>>({ namespace, collection, filter }: SettingsQueryInput): Promise<readonly SettingsRecord<T>[]>;
+    insert<T extends object = Record<string, unknown>>({ namespace, collection, record }: SettingsInsertInput<T>): Promise<void>;
+    update({ namespace, collection, id, data }: SettingsUpdateInput): Promise<void>;
+    delete({ namespace, collection, key }: SettingsDeleteInput): Promise<void>;
+    count({ namespace, collection, filter }: SettingsCountInput): Promise<number>;
+    isEmpty({ namespace, collection }: SettingsIsEmptyInput): Promise<boolean>;
+    private queryDeclared;
+    /** Get a system setting by dot-notation key */
+    getSystem(key: string): unknown;
+    /** Set a system setting */
+    setSystem(key: string, value: unknown): void;
+    /** Get all system settings as flat key-value */
+    getAllSystem(): Record<string, unknown>;
+    /** Get all settings for an addon */
+    getAllAddon(addonId: string): Record<string, unknown>;
+    /** Bulk-set all settings for an addon */
+    setAllAddon(addonId: string, config: Record<string, unknown>): void;
+    /** Get all settings for a provider */
+    getAllProvider(providerId: string): Record<string, unknown>;
+    /** Set a provider setting */
+    setProvider(providerId: string, key: string, value: unknown): void;
+    /** Get all settings for a device */
+    getAllDevice(deviceId: string): Record<string, unknown>;
+    /** Set a device setting */
+    setDevice(deviceId: string, key: string, value: unknown): void;
+    getAddonDevice(addonId: string, deviceId: string): Record<string, unknown>;
+    setAddonDevice(addonId: string, deviceId: string, values: Record<string, unknown>): void;
+    clearAddonDevice(addonId: string, deviceId: string): void;
+    /** Seed system-settings with runtime defaults (first boot) */
+    private seedDefaults;
+    /**
+     * Expose the raw better-sqlite3 Database instance for components that
+     * need direct SQL access (e.g. DeviceStore, ConfigStore).
+     * Returns null if the backend has not been initialized yet.
+     */
+    getDatabase(): Database.Database | null;
+    private getDb;
+    private getAllScoped;
+    private setScopedKey;
+    private scopedName;
+    declareCollection(input: {
+        namespace?: string;
+        collection: string;
+        columns: readonly CollectionColumn[];
+        indexes?: readonly CollectionIndex[];
+    }): Promise<void>;
+    /** Serialise per-column values for SQL binding: objects → JSON, booleans → 0/1. */
+    private serializeColumnValue;
+    ensureTable(table: string, schema: TableSchema): Promise<void>;
+    tableInsert(table: string, row: Record<string, unknown>): Promise<void>;
+    tableUpdate(table: string, filter: Record<string, unknown>, updates: Record<string, unknown>): Promise<number>;
+    tableDelete(table: string, filter: Record<string, unknown>): Promise<number>;
+    tableQuery(table: string, options?: TableQueryOptions): Promise<readonly Record<string, unknown>[]>;
+    tableGet(table: string, filter: Record<string, unknown>): Promise<Record<string, unknown> | null>;
+    tableCount(table: string, filter?: Record<string, unknown>): Promise<number>;
+    private buildWhere;
 }
 
-declare class TaskDispatcher {
-    private readonly agentRegistry;
-    private readonly events;
-    private readonly pendingTasks;
-    private readonly localExecutors;
-    constructor(agentRegistry: AgentRegistry, events: AgentEventEmitter);
-    /** Dispatch a task to the best available agent */
-    dispatch(task: AgentTask, options?: TaskDispatchOptions): Promise<AgentTaskResult>;
-    /** Register a local executor for a capability (in-process fallback) */
-    registerLocalExecutor(capability: string, executor: (input: Record<string, unknown>) => Promise<Record<string, unknown>>): void;
-    /** Called when an agent returns a result */
-    handleTaskResult(result: AgentTaskResult): void;
-    private executeLocally;
-    private sendToAgent;
+/**
+ * SQLite Settings addon — provides persistent settings storage.
+ * Capability: 'settings-store' (singleton)
+ */
+declare class SqliteSettingsAddon extends BaseAddon {
+    private backend;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    getBackend(): SqliteSettingsBackend | null;
 }
 
-declare class LogRingBuffer {
-    private readonly capacity;
-    private readonly buffer;
-    private head;
-    private count;
-    constructor(capacity?: number);
-    push(entry: LogEntry): void;
-    getAll(): LogEntry[];
-    query(filter: LogFilter): LogEntry[];
+/**
+ * Thin wrapper over better-sqlite3 that manages the four settings tables:
+ * system_settings, addon_settings, provider_settings, device_settings.
+ *
+ * All values are stored as JSON text and deserialized on read.
+ */
+declare class SettingsStore {
+    private readonly db;
+    constructor(dbPath: string);
+    getSystem(key: string): unknown;
+    setSystem(key: string, value: unknown): void;
+    getAllSystem(): Record<string, unknown>;
+    getAddon(addonId: string, key: string): unknown;
+    setAddon(addonId: string, key: string, value: unknown): void;
+    getAllAddon(addonId: string): Record<string, unknown>;
+    /** Bulk-replace all keys for an addon (within a transaction). */
+    setAllAddon(addonId: string, config: Record<string, unknown>): void;
+    getProvider(providerId: string, key: string): unknown;
+    setProvider(providerId: string, key: string, value: unknown): void;
+    getAllProvider(providerId: string): Record<string, unknown>;
+    getDevice(deviceId: string, key: string): unknown;
+    setDevice(deviceId: string, key: string, value: unknown): void;
+    getAllDevice(deviceId: string): Record<string, unknown>;
+    getAddonDevice(addonId: string, deviceId: string): Record<string, unknown>;
+    /**
+     * Bulk-replace all per-device overrides for (addonId, deviceId) in a
+     * single transaction. Empty input clears the override set — caller
+     * should use `clearAddonDevice` for explicit resets.
+     */
+    setAddonDevice(addonId: string, deviceId: string, values: Record<string, unknown>): void;
+    clearAddonDevice(addonId: string, deviceId: string): void;
+    /** Close the SQLite connection (call on shutdown). */
+    close(): void;
+    /** Check if system_settings is empty (used for first-boot seeding). */
+    isSystemSettingsEmpty(): boolean;
+    /** Seed system_settings with RUNTIME_DEFAULTS (only on first boot). */
+    seedDefaults(): void;
+    private initTables;
 }
 
-declare class ScopedLogger implements IScopedLogger {
-    private readonly scope;
-    private readonly writeFn;
-    constructor(scope: string[], writeFn: (entry: LogEntry) => void);
-    debug(message: string, meta?: Record<string, unknown>): void;
-    info(message: string, meta?: Record<string, unknown>): void;
-    warn(message: string, meta?: Record<string, unknown>): void;
-    error(message: string, meta?: Record<string, unknown>): void;
-    child(childScope: string): IScopedLogger;
-    private write;
+/** Core table DDL statements -- executed on first boot */
+declare const CORE_TABLE_DDL: readonly string[];
+/** Addon table schema declaration */
+interface AddonTableSchema {
+    readonly name: string;
+    readonly columns: ReadonlyArray<{
+        readonly name: string;
+        readonly type: 'TEXT' | 'INTEGER' | 'REAL' | 'JSON';
+        readonly primaryKey?: boolean;
+        readonly notNull?: boolean;
+    }>;
+    readonly indexes?: ReadonlyArray<{
+        readonly name: string;
+        readonly columns: readonly string[];
+        readonly unique?: boolean;
+    }>;
+}
+/** Generate CREATE TABLE DDL from addon schema */
+declare function addonTableToDdl(schema: AddonTableSchema): string[];
+
+interface DeviceRow {
+    readonly stableId: string;
+    readonly type: string;
+    readonly name: string;
+    readonly parentStableId: string | null;
+    readonly enabled: boolean;
+}
+interface InsertInput {
+    readonly stableId: string;
+    readonly type: string;
+    readonly name: string;
+    readonly parentStableId: string | null;
+}
+declare class DeviceStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    insert(addonId: string, device: InsertInput): void;
+    listByAddon(addonId: string): readonly DeviceRow[];
+    listChildren(addonId: string, parentStableId: string): readonly DeviceRow[];
+    remove(addonId: string, stableId: string): void;
 }
 
-interface AgentClientConfig {
-    readonly hubUrl: string;
-    readonly token?: string;
-    readonly logger: IScopedLogger;
-    readonly registrationInfo: AgentRegistrationInfo;
-}
-type MessageHandler = (msg: HubToAgentMessage) => void;
-type BinaryHandler = (data: Buffer) => void;
-type ConnectionHandler = () => void;
+declare class ConfigStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    save(addonId: string, stableId: string | null, data: Record<string, unknown>): void;
+    load(addonId: string, stableId: string | null): Record<string, unknown>;
+    remove(addonId: string, stableId: string | null): void;
+}
+
+interface WinstonConfig$1 {
+    readonly level: string;
+    readonly retentionDays: number;
+    /** Resolved absolute path to the logs directory (replaces the old dataPath field). */
+    readonly logsDir: string;
+}
 /**
- * WebSocket client for agent mode. Framework-agnostic (no NestJS).
- * Connects to the hub, sends registration, handles messages,
- * reconnects with exponential backoff.
+ * Rotated-file log destination. Console output goes through the shared
+ * `formatLogLine` so every console sink (Winston, ConsoleDestination,
+ * HubForwarderDestination) emits identical lines. File output keeps a
+ * structured JSON shape so log tooling can query tags/meta.
  */
-declare class AgentClient {
-    private ws;
-    private reconnectAttempt;
-    private reconnectTimer;
-    private heartbeatTimer;
-    private destroyed;
-    private readonly messageHandlers;
-    private readonly binaryHandlers;
-    private readonly connectHandlers;
-    private readonly disconnectHandlers;
-    private readonly logger;
-    private readonly hubUrl;
-    private readonly token?;
-    private readonly registrationInfo;
-    private runtimeStatus;
-    constructor(config: AgentClientConfig);
-    /** Connect to the hub WebSocket */
-    connect(): Promise<void>;
-    /** Disconnect and stop reconnecting */
-    disconnect(): void;
-    /** Send a JSON control message to the hub */
-    send(msg: AgentToHubMessage): void;
-    /** Send a binary frame to the hub */
-    sendBinary(data: Buffer): void;
-    /** Register a handler for JSON messages from hub */
-    onMessage(handler: MessageHandler): void;
-    /** Register a handler for binary frames from hub */
-    onBinaryFrame(handler: BinaryHandler): void;
-    /** Register a handler for successful connection */
-    onConnect(handler: ConnectionHandler): void;
-    /** Register a handler for disconnection */
-    onDisconnect(handler: ConnectionHandler): void;
-    /** Update the runtime status (used in heartbeat) */
-    updateStatus(status: AgentRuntimeStatus): void;
-    /** Whether currently connected */
-    get connected(): boolean;
-    private doConnect;
-    private handleBuiltinMessage;
-    private scheduleReconnect;
-    private startHeartbeat;
-    private stopHeartbeat;
-    private clearTimers;
+declare class WinstonDestination implements ILogDestination$1 {
+    private logger;
+    initialize(config?: WinstonConfig$1): Promise<void>;
+    write(entry: LogEntry): void;
+    query(_filter: LogFilter): Promise<readonly LogEntry[]>;
+    shutdown(): Promise<void>;
+}
+
+interface WinstonConfig {
+    readonly level: string;
+    readonly retentionDays: number;
+}
+/**
+ * Winston logging addon — rotated log files + console output.
+ * Settings appear under Cluster → NodeDetail → Settings.
+ */
+declare class WinstonLoggingAddon extends BaseAddon<WinstonConfig> {
+    private destination;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    getDestination(): WinstonDestination;
+    protected globalSettingsSchema(): _camstack_types.ConfigUISchema;
+}
+
+/**
+ * Zero-dependency log destination that writes every entry to stdout /
+ * stderr via the shared `formatLogLine` formatter. Same surface as
+ * `WinstonDestination` (full `ILogDestination` contract) but without
+ * the rotating-file transport — ideal fallback when the Winston addon
+ * is disabled or unavailable (e.g. bare-bones agents, tests).
+ */
+
+interface ConsoleConfig$1 {
+    /** Minimum log level to emit. Entries below this level are dropped. */
+    readonly level?: 'debug' | 'info' | 'warn' | 'error';
+}
+declare class ConsoleDestination implements ILogDestination$1 {
+    private minLevel;
+    initialize(config?: ConsoleConfig$1): Promise<void>;
+    write(entry: LogEntry): void;
+    query(_filter: LogFilter): Promise<readonly LogEntry[]>;
+    shutdown(): Promise<void>;
+}
+
+interface ConsoleConfig {
+    readonly level: 'debug' | 'info' | 'warn' | 'error';
+}
+/**
+ * Console logging addon — zero-dependency stdout/stderr sink that
+ * produces the same canonical line format as the Winston built-in.
+ * Registers as a `log-destination` capability provider so the shared
+ * LogManager fans every entry to both sinks when both are active.
+ *
+ * Settings live under Cluster → NodeDetail → Settings alongside the
+ * Winston addon. Disable one without disabling the other — the
+ * LogManager keeps working as long as at least one destination is
+ * registered.
+ */
+declare class ConsoleLoggingAddon extends BaseAddon<ConsoleConfig> {
+    private destination;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    getDestination(): ConsoleDestination;
+    protected globalSettingsSchema(): _camstack_types.ConfigUISchema;
+}
+
+/**
+ * Log destination for agent mode.
+ *
+ * - Writes to console ONLY when hub is not yet reachable (cold-start
+ *   fallback). Forked-worker agents share stdout with their parent
+ *   hub, so logging to local console AND forwarding to hub's
+ *   `log-receiver` would print the entry twice on the hub terminal.
+ *   Once the hub is discovered, local console output stops and the
+ *   hub's own ConsoleDestination owns the render.
+ * - When a Moleculer broker is connected and the hub node is reachable,
+ *   forwards every log entry to the hub via `log-receiver.ingest`.
+ * - Entries written before the hub is reachable are buffered internally
+ *   (ring-buffered to `DEFAULT_OUTBOUND_BUFFER_SIZE`) and flushed on connect,
+ *   so boot-time logs still reach the hub without any external replay trigger.
+ */
+declare class HubForwarderDestination implements ILogDestination$1 {
+    private broker;
+    private hubConnected;
+    private readonly outboundBuffer;
+    private statusLogger;
+    initialize(): Promise<void>;
+    /**
+     * Provide a logger for the destination's own status messages
+     * (discovery, disconnect, reconnect). Routed through the agent's
+     * LogManager but never through this same destination — the owning
+     * addon must hand in a logger that does NOT route back here, or
+     * status writes will recurse.
+     */
+    setStatusLogger(logger: IScopedLogger): void;
+    private status;
+    /**
+     * Attach the Moleculer broker so hub forwarding can start.
+     * Called by the owning addon from `onInitialize(ctx)` with
+     * `ctx.kernel.cluster?.broker`.
+     */
+    connectBroker(broker: IClusterBroker): void;
+    write(entry: LogEntry): void;
+    query(_filter: LogFilter): Promise<readonly LogEntry[]>;
+    shutdown(): Promise<void>;
+    private bufferOutbound;
+    private flushOutbound;
+    private forward;
 }
 
 /**
- * Receives task assignments from hub, routes to registered ITaskHandler instances.
- * Maintains handler registry, manages task lifecycle.
- * Framework-agnostic (no NestJS).
+ * Agent-only addon that provides the `log-destination` capability.
+ * Writes all logs to the console and forwards to the hub via Moleculer when
+ * reachable. The broker is read from `ctx.kernel.cluster?.broker`; outbound
+ * log replay on hub-connect is handled internally by the destination.
  */
-declare class AgentTaskRunner {
-    private readonly agentId;
-    private readonly client;
-    private readonly handlers;
-    private readonly runningTasks;
+declare class HubForwarderAddon extends BaseAddon {
+    private destination;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    getDestination(): HubForwarderDestination | null;
+    protected onShutdown(): Promise<void>;
+}
+
+interface BackupConfig {
+    readonly backupDir: string;
+    readonly retentionCount: number;
+}
+declare class LocalBackupService {
+    private readonly config;
     private readonly logger;
-    constructor(agentId: string, client: AgentClient, logger: IScopedLogger);
-    /** Register a task handler for a given task type */
-    registerHandler(handler: ITaskHandler): void;
-    /** Unregister a task handler */
-    unregisterHandler(taskType: string): void;
-    /** Get all registered task types */
-    getTaskTypes(): readonly string[];
-    /** Get a handler by task type */
-    getHandler(taskType: string): ITaskHandler | undefined;
+    private readonly eventBus;
+    private manifests;
+    constructor(config: BackupConfig, logger: IScopedLogger, eventBus: IEventBus);
+    /** Create a backup of specified locations */
+    backup(options?: {
+        locations?: string[];
+        label?: string;
+    }): Promise<BackupManifest>;
+    /** Restore from a backup */
+    restore(backupId: string): Promise<void>;
+    /** List all backups sorted by timestamp descending */
+    list(): readonly BackupManifest[];
+    /** Delete a specific backup */
+    delete(backupId: string): Promise<void>;
+    private pruneOldBackups;
+}
+
+interface LocalBackupAddonConfig {
+    readonly retentionCount: number;
+}
+/**
+ * Local backup addon — snapshot-based backup/restore of camstack data.
+ * Settings appear under Cluster → NodeDetail → Settings.
+ */
+declare class LocalBackupAddon extends BaseAddon<LocalBackupAddonConfig> {
+    private service;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    getService(): LocalBackupService;
+    protected globalSettingsSchema(): _camstack_types.ConfigUISchema;
+}
+
+interface NativeMetricsConfig {
+    readonly samplingIntervalMs: number;
+}
+/**
+ * Native metrics — CPU, memory, disk usage sampling.
+ * Settings appear under Cluster → NodeDetail → Settings.
+ */
+declare class NativeMetricsAddon extends BaseAddon<NativeMetricsConfig> {
+    private provider;
+    private startedAtMs;
+    private snapshotTimer;
     /**
-     * Execute a task dispatched from the hub.
-     * Sends result or error back to hub via the AgentClient.
+     * Snapshot-equality cache for the resources + processes emit.
+     * Stores the coarsened JSON and timestamp; a tick where the
+     * coarsened payload matches the cache (and the heartbeat hasn't
+     * elapsed) is skipped.
      */
-    executeTask(taskId: string, taskType: string, payload: unknown): Promise<void>;
-    /** Cancel a running task */
-    cancelTask(taskId: string): Promise<void>;
-    /** Number of currently running tasks */
-    get activeTaskCount(): number;
-    /** Destroy: cancel all running tasks */
-    destroy(): Promise<void>;
+    private lastResourcesEmit;
+    private lastProcessesEmit;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    /**
+     * Emit one `metrics.node-resources-snapshot` + one
+     * `metrics.node-processes-snapshot` for this node. UI consumers
+     * subscribe and read state directly from the payload.
+     */
+    private emitMetricsSnapshots;
+    protected onConfigChanged(): Promise<void>;
+    private listWorkerInstances;
+    private listAddonInstances;
+    private getAddonStats;
+    /**
+     * Walk the OS process table and classify each camstack-shaped process.
+     *
+     * Classification (ancestry-driven, NOT pattern-driven):
+     *  - root    — the current node's own pid (`process.pid`).
+     *  - managed — pid is registered in the kernel's `$process.list`
+     *              (forked addon worker spawned by this hub).
+     *  - system  — ancestry walk crosses a SUPERVISOR_BOUNDARY_RE match
+     *              (tsx-watch launcher, agent CLI, concurrently, vite,
+     *              npm exec wrapper). The process belongs to the dev
+     *              tree even if not in `$process.list`. NEVER killable.
+     *  - ghost   — ancestry walk reaches `ppid=1` without crossing any
+     *              supervisor boundary AND the parent isn't visible in
+     *              `ps`. A truly orphaned camstack-shaped process. The
+     *              ONLY classification that's eligible for kill.
+     *
+     * Old pattern-only ghost detection produced false positives: every
+     * monorepo-path process matched CAMSTACK_CMD_RE, ancestry walk
+     * stopping at ppid=hub returned false-positive ghosts whenever a
+     * concurrently sibling sat above hub. Ancestry-driven classification
+     * fixes that.
+     */
+    private listNodeProcesses;
+    /**
+     * Send SIGTERM / SIGKILL to a pid. Refuses pids that don't appear in
+     * `listNodeProcesses()` to prevent arbitrary system kills — a dedicated
+     * admin-path for resurrected zombies, not a generic shell replacement.
+     *
+     * `root`-classified pids (the running launcher / agent CLI / hub itself)
+     * are also refused: killing them tears down the whole node and the
+     * operator's intent is almost always to nuke a leaked child, not the
+     * supervisor that keeps the rest alive. Process restart goes through
+     * the dedicated `$process.restart` action, not this kill API.
+     */
+    private killProcess;
+    /** Raw `ps` scan returning every pid + command + resource stats. */
+    private runPs;
+    protected globalSettingsSchema(): _camstack_types.ConfigUISchema;
 }
 
+interface AlertCenterConfig {
+    readonly maxAlerts: number;
+    readonly retentionDays: number;
+}
 /**
- * Stub task handler for pipeline.decode.
- * In the full implementation, this would start a StreamBroker for a camera
- * and send decoded frames to the hub via the AgentClient.
+ * Alert Center addon — core builtin that persists alerts in a
+ * structured SQLite table and serves them to the admin UI.
+ *
+ * Registers as an `alerts` collection provider and subscribes to
+ * important EventBus categories to create/update alerts automatically.
  */
-declare class DecodeTaskHandler implements ITaskHandler {
-    readonly taskType = "pipeline.decode";
-    readonly description = "Decode an RTSP stream and produce JPEG frames";
-    handle(payload: unknown, context: TaskContext): Promise<unknown>;
-    cancel(): Promise<void>;
+declare class AlertCenterAddon extends BaseAddon<AlertCenterConfig> {
+    private unsubscribers;
+    constructor();
+    /**
+     * Per `(category, source.id)` counter used to rate-limit chatty
+     * events. Entries are pruned lazily when they age out of
+     * `RATE_LIMIT_WINDOW_MS`; see `shouldSuppressByRate()` below.
+     */
+    private readonly rateLimitCounters;
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
+    protected globalSettingsSchema(): _camstack_types.ConfigUISchema;
+    listAlerts(filter?: {
+        unreadOnly?: boolean;
+        limit?: number;
+    }): Promise<readonly Alert[]>;
+    getUnreadCount(): Promise<number>;
+    markRead(alertId: string): Promise<void>;
+    markAllRead(): Promise<void>;
+    dismiss(alertId: string): Promise<void>;
+    private handleEvent;
+    private handleModelDownload;
+    /**
+     * `[ALERT-CENTER-EVENTS]` — rate limit a `(category, source.id)`
+     * tuple. Returns `true` when the caller should DROP this event
+     * without persisting an alert, and `false` when the alert should
+     * proceed normally.
+     *
+     * Heuristic: the first `RATE_LIMIT_MAX_PER_SOURCE` events within a
+     * `RATE_LIMIT_WINDOW_MS` window go through. Once the threshold is
+     * crossed, subsequent events are suppressed until the window rolls
+     * over. When the threshold is first crossed, the suppression is
+     * logged once so operators know why they're not seeing the follow-
+     * up alerts; after the window rolls over the next event is
+     * un-suppressed and starts a new window.
+     */
+    private shouldSuppressByRate;
+    private buildMessage;
+    private emitAlert;
+    private updateAlert;
+    /**
+     * Read-merge-write: SettingsBackend.update() replaces the entire `data` blob,
+     * so we must read the existing record, merge the patch, and write back.
+     */
+    private mergeUpdate;
+    private persistAlert;
+    private emitAlertCreatedEvent;
+    private emitAlertUpdatedEvent;
+    private enforceMaxAlerts;
+    private enforceRetention;
 }
+
+interface SamplingDiagnostics {
+    warn(message: string, meta?: Record<string, unknown>): void;
+}
+declare class NativeMetricsProvider {
+    readonly id = "native";
+    private cachedSnapshot;
+    private samplingTimer;
+    private macMemTimer;
+    private prevCpu;
+    private diagnostics;
+    private consecutiveSampleErrors;
+    constructor();
+    /**
+     * Optional diagnostics sink for sampling errors. The first failure and
+     * every Nth failure thereafter are reported so a permanently-broken
+     * collector doesn't spam logs but is still observable.
+     */
+    setDiagnostics(diag: SamplingDiagnostics): void;
+    startSampling(intervalMs: number): void;
+    private reportSampleError;
+    stopSampling(): void;
+    collectSnapshot(): Promise<SystemResourceSnapshot>;
+    getCached(): Promise<SystemResourceSnapshot | null>;
+    getCurrent(): Promise<{
+        cpuPercent: number;
+        memoryPercent: number;
+        memoryUsedMB: number;
+        memoryTotalMB: number;
+        diskPercent?: number;
+        temperature?: number;
+        gpuPercent?: number;
+        gpuMemoryPercent?: number;
+    }>;
+    getDiskSpace(input: {
+        dirPath: string;
+    }): Promise<DiskSpaceInfo>;
+    getGpuInfo(): Promise<MetricsGpuInfo | null>;
+    getCpuTemperature(): Promise<number | null>;
+    getProcessStats(input: {
+        pids: number[];
+    }): Promise<PidResourceStats[]>;
+    private sampleCpu;
+    /** Cached macOS memory (set by sampleMacMemory timer). */
+    _cachedMacMem: MemoryInfo | null;
+    private getMemoryInfo;
+}
+
+declare class SystemConfigAddon extends BaseAddon {
+    readonly id = "system-config";
+    constructor();
+    protected onInitialize(): Promise<void>;
+    private buildGlobalSchema;
+    getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
+    updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
+}
+
 /**
- * Stub task handler for pipeline.detect.
- * In the full implementation, this would receive frames (via binary WS),
- * run them through the detection engine, and send results back.
+ * Local Auth Addon — owns user accounts, API keys, scoped tokens,
+ * and local password authentication.
+ *
+ * Capabilities registered:
+ *   - `auth-provider` (collection) — local password authentication
+ *   - `user-management` (singleton) — user CRUD, API keys, scoped tokens
+ *
+ * Extension: an OIDC addon can register another `auth-provider` entry.
+ * The server's login flow iterates the `auth-provider` collection.
  */
-declare class DetectTaskHandler implements ITaskHandler {
-    readonly taskType = "pipeline.detect";
-    readonly description = "Run object detection on received frames";
-    handle(payload: unknown, context: TaskContext): Promise<unknown>;
-    cancel(): Promise<void>;
+
+interface LocalAuthConfig {
+    jwtSecret?: string;
+    adminUsername?: string;
+    adminPassword?: string;
+}
+declare class LocalAuthAddon extends BaseAddon<LocalAuthConfig> {
+    private authManager;
+    private userManager;
+    private apiKeyManager;
+    private scopedTokenManager;
+    constructor();
+    protected onInitialize(): Promise<ProviderRegistration[]>;
+    protected onShutdown(): Promise<void>;
 }
+
 /**
- * Stub task handler for pipeline.record.
- * In the full implementation, this would start recording an RTSP stream
- * to disk in segments and report segment metadata back to the hub.
+ * Wire shape matching `z.infer<typeof SettingsSchemaWithValuesSchema>` —
+ * duplicated as a plain interface because importing the Zod schema across
+ * package boundaries confuses `tsc` when the types package pins a
+ * different `zod` minor than the core package. Keeping the shape local
+ * keeps the addon decoupled from the schema's internal type encoding.
  */
-declare class RecordTaskHandler implements ITaskHandler {
-    readonly taskType = "pipeline.record";
-    readonly description = "Record an RTSP stream to disk segments";
-    handle(payload: unknown, context: TaskContext): Promise<unknown>;
-    cancel(): Promise<void>;
+interface ContributionShape {
+    tabs?: Array<{
+        id: string;
+        label: string;
+        icon: string;
+        order?: number;
+    }>;
+    sections: Array<{
+        id: string;
+        title: string;
+        description?: string;
+        style?: 'card' | 'accordion';
+        defaultCollapsed?: boolean;
+        columns?: 1 | 2 | 3 | 4;
+        tab?: string;
+        /** Where the section renders. Default 'settings' (Config tab); 'top-tab' hoists into the device-detail tab bar via DeviceDetail discovery. */
+        location?: 'settings' | 'top-tab';
+        order?: number;
+        fields: unknown[];
+    }>;
+}
+
+declare class DeviceManagerAddon extends BaseAddon {
+    constructor();
+    /** Shorthand for the kernel-injected capability registry. */
+    private get capabilityRegistry();
+    /**
+     * Parent-chain event propagator. Started in `onInitialize` once the
+     * hub's `deviceRegistry` is available; listens to every device-sourced
+     * event and re-emits a copy on each ancestor scope with `via[]`
+     * populated. Stopped in `onShutdown`.
+     */
+    private propagator;
+    /**
+     * Hub-side mirror of every device's cap-keyed runtime state.
+     * Populated whenever any caller writes via `deviceState.setCapSlice`
+     * (the canonical cross-layer write entrypoint) and on first load
+     * via `loadRuntimeState`. Cross-process consumers reach the mirror
+     * through the `deviceState` cap router; per-cap event subscribers
+     * (e.g. `battery.onStatusChanged`) get the same data via
+     * cap-specific events still emitted by the owning device.
+     *
+     * Key: deviceId. Value: per-cap slice map. Empty by default —
+     * slices show up as `setCapSlice` calls trickle in.
+     */
+    private readonly stateMirror;
+    /**
+     * Per-device disk-write debouncer for runtime-state. `setCapSlice`
+     * updates the in-memory mirror synchronously and emits the change
+     * event immediately, but the disk write is coalesced — frequent
+     * back-to-back writes (motion phase transitions, battery pushes,
+     * etc.) collapse to one `writeDeviceRuntimeState` per
+     * `RUNTIME_STATE_DEBOUNCE_MS` window. `flushRuntimeStateWrites`
+     * awaits any in-flight write + scheduled flush so shutdown is
+     * lossless.
+     */
+    private readonly runtimeStateDebounce;
+    private static readonly RUNTIME_STATE_DEBOUNCE_MS;
+    /**
+     * Cross-process native-provider cache: deviceId (numeric) → capName → { addonId, nodeId }.
+     * Kept in sync with `device.bindings-changed` events emitted by forked
+     * workers. Union'd into `getBindings` so hub-side consumers see every
+     * native cap regardless of which process owns the IDevice. No persistence
+     * — entries re-register when the worker restarts. Purged on
+     * `$node.disconnected` to avoid stale routing after a worker crash.
+     */
+    private remoteNativeCaps;
+    /** Wait for a device-provider by addonId, returning null on timeout. */
+    private waitDeviceProvider;
+    /** Require a device-provider by addonId — throws if not found. */
+    private requireDeviceProvider;
+    private readBindingsStore;
+    private writeBindingsStore;
+    private resolveWrapperNodeId;
+    /**
+     * Active discovery of native caps registered on a worker node.
+     * Called from the `$node.connected` handler to recover from lost
+     * `DeviceBindingsChanged` broadcasts after worker restart.
+     *
+     * Iterates the broker's service registry, picks
+     * `<addonId>.native-provider.<capName>` services owned by the
+     * connected node, calls each service's `$listDeviceIds` action to
+     * fetch the deviceIds the worker has registered that cap on, then
+     * writes entries into `remoteNativeCaps`.
+     *
+     * Best-effort: per-service failures are logged and swallowed so a
+     * single bad service doesn't abort the whole rebuild.
+     */
+    private discoverWorkerNativeCaps;
+    getBindings(input: {
+        deviceId: number;
+    }): Promise<{
+        deviceId: number;
+        entries: DeviceBindingEntry[];
+    }>;
+    /**
+     * Whole-fleet binding dump. Iterates every device known to the
+     * deviceRegistry and reuses the per-device `getBindings` resolver
+     * for each — same routing rules, single round-trip. Used by
+     * `SystemManager.init()` for warm-boot.
+     *
+     * Bindings change rarely (wrapper toggle, device add/remove) so
+     * clients invalidate via the existing
+     * `capability.binding-changed` event rather than re-fetching this
+     * payload periodically.
+     */
+    getAllBindings(): Promise<Array<{
+        deviceId: number;
+        entries: DeviceBindingEntry[];
+    }>>;
+    /**
+     * Resolve a numeric deviceId to a stableId via persisted meta.
+     * Used only by the device-identity section of the device-details
+     * aggregator (see `buildBaseDeviceSection`) to surface the stableId as
+     * a readonly display field. All runtime/registry lookups are keyed by
+     * numeric deviceId; this helper is display-only.
+     */
+    private lookupPersistedStableId;
+    getDeviceAggregate(deviceId: number, kind: 'settings' | 'live'): Promise<ContributionShape | null>;
+    /**
+     * Build the device-manager's own contribution to the aggregator — the
+     * device identity (id, stableId, addonId, type, online) + the
+     * driver-specific config exposed by the device class via
+     * `zodEntriesToConfigUI`.
+     *
+     * Two paths, deliberately symmetric with `getSettingsSchema`:
+     *
+     *  - Hub-local: device's IDevice instance lives in this process'
+     *    DeviceRegistry, we read config + schema directly by reference.
+     *  - Cross-process: device lives in a forked worker (RtspCamera on
+     *    provider-rtsp, ONVIF on provider-onvif, …). We ask the worker's
+     *    `device-ops.getSettingsSchema` native provider for a wire-
+     *    serializable ConfigUISchema and merge it in under the same
+     *    "Driver Config" section, so the UI sees the same shape regardless
+     *    of where the IDevice physically runs.
+     *
+     *  Returns `null` only when the device genuinely doesn't exist anywhere
+     *  (no hub-local, no persisted ownership, no device-ops native). The
+     *  aggregator falls back to contributor sections only in that case.
+     */
+    private buildBaseDeviceSection;
+    /**
+     * Lookup the native owner for `device-ops` on `deviceId` — the native-cap
+     * registry (hub-local and remote) is keyed by numeric id.
+     */
+    private resolveNativeDeviceOwner;
+    /**
+     * Aggregate `status` across every registered cap for a device.
+     *
+     * Walks the supplied cap list (or `CAP_NAMES_WITH_STATUS` when
+     * omitted), looks up a native provider per cap via the capability
+     * registry, calls `provider.getStatus({ deviceId })`, and validates
+     * the return against the cap's own `status.schema`. Validation
+     * failures log a warning and yield `null` for that cap so the
+     * overall aggregate stays usable — a single misbehaving provider
+     * must not blank out a device's entire status view.
+     *
+     * Returned shape is `Record<capName, unknown | null>`; the client-
+     * side hook tightens this to `CapStatusTypeMap` via the generated
+     * `cap-status-types.ts`.
+     */
+    private getDeviceStatusAggregate;
+    /**
+     * Return the driver-specific device-settings contribution. Hub-local
+     * devices call `getSettingsUISchema()` directly; forked-worker devices
+     * go through the `device-ops.getSettingsSchema` cap method on the
+     * numeric-id-keyed native registry.
+     */
+    private resolveDriverConfigSchema;
+    updateDeviceField(input: {
+        deviceId: number;
+        writerCapName: string;
+        writerAddonId: string;
+        key: string;
+        value: unknown;
+    }): Promise<{
+        success: true;
+    }>;
+    /**
+     * Batched counterpart of `updateDeviceField`. Groups changes by
+     * `(writerCapName, writerAddonId)` so each contributor receives a
+     * single `applyDeviceSettingsPatch` with all of its updates merged —
+     * avoids N round-trips for simultaneous edits in the same save.
+     *
+     * Per-provider failures are captured in the `failures[]` output so the
+     * admin UI can highlight which sections didn't persist; a failure on
+     * one provider does NOT abort the others.
+     */
+    updateDeviceFieldsBatch(input: {
+        deviceId: number;
+        changes: ReadonlyArray<{
+            writerCapName: string;
+            writerAddonId: string;
+            key: string;
+            value: unknown;
+        }>;
+    }): Promise<{
+        success: true;
+        failures: {
+            writerCapName: string;
+            writerAddonId: string;
+            error: string;
+        }[];
+    }>;
+    /** Apply a single grouped patch to the appropriate provider. Mirrors
+     * `updateDeviceField` routing (special-case device-manager, else
+     * registry lookup). Used by `updateDeviceFieldsBatch`. */
+    private applyGroupPatch;
+    listWrappersForCap(input: {
+        capName: string;
+    }): Promise<string[]>;
+    listBindableCapsForDeviceType(input: {
+        deviceType: string;
+    }): Promise<Array<{
+        capName: string;
+        wrappers: string[];
+    }>>;
+    setWrapperActive(input: {
+        deviceId: number;
+        capName: string;
+        wrapperAddonId: string;
+        active: boolean;
+    }): Promise<void>;
+    protected onInitialize(): Promise<ProviderRegistration[] | void>;
+    /**
+     * Single-cap mirror update — diff against the current mirror,
+     * persist the new slice in-memory, emit `DeviceStateChanged` for
+     * this cap. No-op on identical writes (both same shape and same
+     * values). Called by `setCapSlice` provider.
+     */
+    private applySingleCapUpdate;
+    /**
+     * Debounced disk writer. Coalesces frequent writes (motion phase
+     * transitions, battery pushes) into one `writeDeviceRuntimeState`
+     * per `RUNTIME_STATE_DEBOUNCE_MS` window. Reads the per-device
+     * blob from the live mirror at flush time so the disk picture is
+     * always the latest state — no risk of writing a stale snapshot.
+     */
+    private scheduleRuntimeStateDiskWrite;
+    /**
+     * One-shot mirror seed used by `loadRuntimeState` at boot so the
+     * hub knows about every persisted slice without waiting for the
+     * first `setCapSlice` call. No events emitted — this is
+     * initial-state population, not a transition.
+     */
+    private seedMirror;
+    private snapshotForDevice;
+    private emitStateChanged;
+    protected onShutdown(): Promise<void>;
 }
 
 type ElementState = 'stopped' | 'starting' | 'running' | 'stopping' | 'error' | 'disabled';
@@ -506,10 +1100,52 @@ declare class SystemEventBus implements IEventBus {
     private readonly subscribers;
     constructor(bufferSize?: number);
     emit(event: SystemEvent): void;
+    /**
+     * Subscribe to events matching a filter.
+     * When called with a typed category filter, the handler receives typed event data.
+     */
     subscribe(filter: EventFilter, handler: (event: SystemEvent) => void): () => void;
     getRecent(filter?: EventFilter, limit?: number): readonly SystemEvent[];
 }
 
+declare class LogRingBuffer {
+    private readonly capacity;
+    private readonly buffer;
+    private head;
+    private count;
+    constructor(capacity?: number);
+    push(entry: LogEntry): void;
+    getAll(): LogEntry[];
+    query(filter: LogFilter): LogEntry[];
+    /**
+     * Drop entries that match `filter`. Returns the number of entries
+     * removed. Triggered by the UI's "Clear logs" button so the operator
+     * can wipe the historical buffer for a specific scope (per-device,
+     * per-addon, per-agent) — without it, closing and reopening the
+     * panel re-populates the cleared rows from the server's ring buffer.
+     *
+     * Filter semantics mirror `query` (same level / since / until / tags
+     * handling) — whatever you'd see listed by `query(filter)` is what
+     * gets removed.
+     */
+    clear(filter?: LogFilter): number;
+}
+
+declare class ScopedLogger implements IScopedLogger {
+    private readonly scope;
+    private readonly writeFn;
+    private readonly tags?;
+    constructor(scope: string | undefined, writeFn: (entry: LogEntry) => void, tags?: LogTags | undefined);
+    debug(message: string, extras?: LogExtras): void;
+    info(message: string, extras?: LogExtras): void;
+    warn(message: string, extras?: LogExtras): void;
+    error(message: string, extras?: LogExtras): void;
+    child(childScope: string): IScopedLogger;
+    withTags(tags: LogTags): IScopedLogger;
+    private write;
+    private mergeTags;
+}
+
 interface ILogDestination {
     initialize(): Promise<void>;
     shutdown(): Promise<void>;
@@ -520,15 +1156,103 @@ declare class LogManager {
     private readonly ringBuffer;
     private readonly destinations;
     private readonly subscribers;
+    private deviceNameLookup;
     constructor(bufferSize?: number);
-    createLogger(scope: string): IScopedLogger;
+    /**
+     * Register a callback that resolves `deviceId → deviceName`. Called
+     * for every emitted entry that carries `tags.deviceId` but no
+     * explicit `tags.deviceName` — the LogManager injects the resolved
+     * name directly into the entry's tags BEFORE ring-buffer / destination
+     * write, so every destination (local console, file, remote forwarder,
+     * addon-bundled copies of core) sees the enriched shape regardless of
+     * which module instance the destination was built from.
+     */
+    setDeviceNameLookup(lookup: ((deviceId: number) => string | null) | null): void;
+    createLogger(scope?: string): IScopedLogger;
+    private enrichDeviceName;
     /** Subscribe to live logs matching a filter. Returns an unsubscribe function. */
     subscribe(filter: Partial<LogFilter>, callback: (entry: LogEntry) => void): () => void;
     private matchesFilter;
-    addDestination(dest: ILogDestination): void;
+    /**
+     * Register a log destination.
+     *
+     * @param opts.replay  If true (default), replay every entry currently in
+     *                     the ring buffer to the new destination before live
+     *                     traffic starts. Lets a destination added mid-boot
+     *                     still receive boot-time log entries.
+     */
+    addDestination(dest: ILogDestination, opts?: {
+        replay?: boolean;
+    }): void;
     removeDestination(dest: ILogDestination): void;
     query(filter: LogFilter): LogEntry[];
+    /**
+     * Drop ring-buffer entries matching `filter`. Returns the count
+     * removed. Backs the UI's "Clear logs" admin action so an operator
+     * can wipe the historical window for a scope (per-device, per-addon,
+     * agent-level) without restarting the server. External destinations
+     * (file, forwarder) are NOT touched — only the in-memory ring.
+     */
+    clear(filter?: LogFilter): number;
+}
+
+/**
+ * Canonical single-line formatter for every `LogEntry` that reaches a
+ * console transport — hub-side `WinstonDestination` +
+ * `ConsoleDestination`, agent-side `HubForwarderDestination`. One
+ * definition so the three paths can't drift.
+ *
+ * Layout mirrors NestJS `ConsoleLogger` output:
+ *
+ *   [Nest] 54994  - 04/20/2026, 12:45:53 AM     LOG [InstanceLoader] TrpcModule dependencies initialized +0ms
+ *
+ * Mapping for camstack — cluster-aware:
+ *   - `[Nest]` (brand bracket)   → `[<agent>/<addonId>]` so operators see
+ *                                   at a glance which node emitted the line
+ *                                   (matches the cluster topology)
+ *   - `54994` (pid)              → `process.pid`
+ *   - `<timestamp>`              → `M/D/YYYY, H:MM:SS AM`
+ *   - `LOG` / `WARN` / `ERROR`   → `entry.level` upper-cased, colour per level
+ *   - `[InstanceLoader]` (ctx)   → `[<device>]` — shown only when a device
+ *                                   tag is present; omitted otherwise
+ *   - `<message>`                → `entry.message`
+ *   - trailing `+Nms`            → we don't compute timing yet; omitted
+ *
+ * Rendered examples:
+ *   [hub/winston-logging]        71184  - 04/20/2026, 12:45:53 AM     INFO  Winston logging initialized
+ *   [hub/provider-rtsp]          71184  - 04/20/2026, 12:46:01 AM     WARN  [salone] probe failed {err="timeout"}
+ *   [dev-agent-0/detection]      12345  - 04/20/2026, 12:47:15 AM     ERROR [cortile] no detector {codec=av1}
+ */
+
+/** Options for `formatLogLine`. */
+interface FormatLogLineOptions {
+    /**
+     * Emit ANSI colour codes. When omitted, falls back to the shell-env
+     * heuristic (`NO_COLOR`/`FORCE_COLOR`/`isTTY`). Destinations that
+     * always target a console (ConsoleDestination, HubForwarderDestination)
+     * pass `true`; file sinks (Winston JSON) pass `false` so logs on disk
+     * stay plain text regardless of the shell env.
+     *
+     * `NO_COLOR=1` in the environment still wins — consumer opt-in beats
+     * producer opt-in, matching the https://no-color.org/ convention.
+     */
+    readonly colorize?: boolean;
 }
+/**
+ * Render a `LogEntry` as one complete console line — no trailing newline.
+ * Caller appends `\n` (file sinks) or relies on `console.log` (stdout sink).
+ *
+ * PID column prefers `entry.tags.pid` when set (so forked-worker entries
+ * carry the worker's OS pid even when the hub renders them), falling back
+ * to the renderer's own `process.pid`.
+ *
+ * Colours (when enabled) follow the NestJS convention: the level token
+ * AND the message body share the level colour (green/yellow/red/gray for
+ * info/warn/error/debug). Brand, device context, scope and meta keep
+ * their fixed hues so the structural fields stay visually distinct from
+ * the message content.
+ */
+declare function formatLogLine(entry: LogEntry, options?: FormatLogLineOptions): string;
 
 interface IStorageBackend {
     /** Backend type identifier */
@@ -537,11 +1261,31 @@ interface IStorageBackend {
     readonly basePath: string;
     /** Resolve a subpath to an absolute path */
     resolve(subpath: string): string;
-    /** Check if the backend path exists and is writable */
+    /**
+     * Check whether the backend is usable: either the base directory
+     * already exists and is writable, OR we can create it on first
+     * write (i.e. the nearest existing ancestor is writable).
+     */
     isAvailable(): boolean;
-    /** Ensure base directory exists (mkdir -p equivalent) */
+    /** No-op for lazy backends. Kept for API compatibility. */
     initialize(): Promise<void>;
 }
+/**
+ * Filesystem storage backend — lazy by design.
+ *
+ * `initialize()` does NOT create the base directory eagerly. Instead,
+ * consumers that write via `FilesystemStorageProvider` (and other write
+ * helpers in storage-manager.ts) run `fs.mkdir(dirname(filePath), { recursive: true })`
+ * right before every `writeFile`, so the directory tree appears on demand.
+ *
+ * The previous behaviour eagerly mkdir'd every location declared in
+ * `StorageLocationManager.initializeDefaults()` — six directories (`db`,
+ * `media`, `recordings`, `models`, `cache`, `logs`) got created at boot
+ * even if the installation had no cameras, no recording addon, no
+ * analytics addon, etc. That meant every fresh install looked like it
+ * was producing data when it had nothing to write. Laziness fixes that:
+ * a directory only exists once an addon decides to put a file there.
+ */
 declare class FsStorageBackend implements IStorageBackend {
     readonly type = "local";
     readonly basePath: string;
@@ -634,6 +1378,7 @@ declare class StorageManager {
     setProvider(provider: IStorageProvider | IStorageProvider$1): void;
     setNewStorageProvider(provider: IStorageProvider$1): void;
     setSettingsBackend(backend: ISettingsBackend): void;
+    getSettingsBackend(): ISettingsBackend;
     getProvider(): IStorageProvider;
     setLocationManager(manager: StorageLocationManager): void;
     getLocationManager(): StorageLocationManager;
@@ -650,38 +1395,18 @@ declare class StorageManager {
 
 /**
  * Manages scoped API tokens with restricted addon/route/capability access.
- * Framework-agnostic — dependencies injected via constructor.
  */
 declare class ScopedTokenManager {
-    private readonly storage;
-    constructor(storage: IStructuredStorage);
-    /**
-     * Create a new scoped token. Returns the raw token string (shown once)
-     * and the stored record (with hash, not the raw token).
-     */
+    private readonly store;
+    constructor(store: SettingsStoreClient);
     create(userId: string, name: string, scopes: TokenScope[], expiresAt?: number): Promise<{
         token: string;
         record: ScopedToken;
     }>;
-    /**
-     * Validate a raw token string. Returns the token record if valid, null otherwise.
-     */
     validate(rawToken: string): Promise<ScopedToken | null>;
-    /**
-     * Check whether a token's scopes grant access to the given addon, route, or capability.
-     */
     matchesScope(token: ScopedToken, addonId?: string, routePath?: string, capability?: string): boolean;
-    /**
-     * Revoke a token by ID.
-     */
     revoke(tokenId: string): Promise<void>;
-    /**
-     * List all tokens for a user (without exposing the raw token).
-     */
     listForUser(userId: string): Promise<ScopedToken[]>;
-    /**
-     * Update the lastUsedAt timestamp for a token.
-     */
     updateLastUsed(tokenId: string): Promise<void>;
 }
 
@@ -693,7 +1418,8 @@ declare class AuthManager {
     private readonly config;
     private readonly jwtSecret;
     private scopedTokenManager;
-    constructor(config: AuthConfigReader);
+    private readonly logger;
+    constructor(config: AuthConfigReader, logger?: IScopedLogger);
     signToken(payload: Omit<TokenPayload, 'iat' | 'exp'>): string;
     verifyToken(token: string): TokenPayload;
     hashPassword(password: string): Promise<string>;
@@ -728,31 +1454,20 @@ declare class AuthManager {
     matchesScopedTokenScope(token: ScopedToken, addonId?: string, routePath?: string, capability?: string): boolean;
 }
 
-interface ApiKeyRecord {
-    id: string;
-    label: string;
-    role: UserRole;
-    allowedProviders: string[] | '*';
-    allowedDevices: Record<string, string[] | '*'>;
-    tokenHash: string;
-    tokenPrefix: string;
-    createdAt: number;
-    lastUsedAt?: number;
-}
 interface CreateApiKeyInput {
     label: string;
     role: UserRole;
     allowedProviders?: string[] | '*';
     allowedDevices?: Record<string, string[] | '*'>;
 }
-type ApiKeyStorageAccess = {
-    getStructuredStorage(): IStructuredStorage;
-};
+interface ApiKeyStorageAccess {
+    getStore(): SettingsStoreClient;
+}
 declare class ApiKeyManager {
     private readonly storageAccess;
     private readonly auth;
     constructor(storageAccess: ApiKeyStorageAccess, auth: AuthManager);
-    private get structured();
+    private get store();
     create(input: CreateApiKeyInput): Promise<{
         record: ApiKeyRecord;
         token: string;
@@ -771,18 +1486,18 @@ interface CreateUserInput {
     allowedDevices?: Record<string, string[] | '*'>;
 }
 type UpdatableUserFields = Partial<Pick<UserRecord, 'role' | 'allowedProviders' | 'allowedDevices'>>;
-type UserStorageAccess = {
-    getStructuredStorage(): IStructuredStorage;
-};
-type UserConfigReader = {
+interface UserStorageAccess {
+    getStore(): SettingsStoreClient;
+}
+interface UserConfigReader {
     get<T>(path: string): T;
-};
+}
 declare class UserManager {
     private readonly storageAccess;
     private readonly auth;
     private readonly config;
     constructor(storageAccess: UserStorageAccess, auth: AuthManager, config: UserConfigReader);
-    private get structured();
+    private get store();
     create(input: CreateUserInput): Promise<UserRecord>;
     findByUsername(username: string): Promise<UserRecord | null>;
     findById(id: string): Promise<UserRecord | null>;
@@ -798,7 +1513,7 @@ declare class UserManager {
  * Central notification service that routes notifications to configured outputs.
  * Framework-agnostic — dependencies injected via constructor.
  *
- * Outputs are resolved from the CapabilityRegistry's 'notification-output'
+ * Outputs are resolved from the ICapabilityRegistry's 'notification-output'
  * collection on each call (proxy pattern). Falls back to a local map
  * when no registry is provided (backward compat).
  */
@@ -811,13 +1526,13 @@ declare class NotificationService {
     private registry;
     constructor(logger: IScopedLogger);
     /** Set the registry for live output lookup. Called once during boot. */
-    setRegistry(registry: CapabilityRegistry): void;
+    setRegistry(registry: ICapabilityRegistry): void;
     /** Resolve all outputs — prefers registry, falls back to local map */
     private get outputs();
-    /** @deprecated Use registry-based resolution. Kept for backward compat only. */
-    addOutput(output: INotificationOutput): void;
-    /** @deprecated Use registry-based resolution. Kept for backward compat only. */
-    removeOutput(id: string): void;
+    /** Register an output in the local fallback map (used when no registry is set). */
+    registerLocalOutput(output: INotificationOutput): void;
+    /** Remove an output from the local fallback map. */
+    unregisterLocalOutput(id: string): void;
     setRouting(category: string, outputIds: string[]): void;
     setRateLimit(category: string, minIntervalMs: number): void;
     notify(notification: Notification): Promise<void>;
@@ -888,54 +1603,6 @@ declare class AddonRouteRegistry {
     }>;
 }
 
-interface IRegisteredDevice {
-    readonly id: string;
-    readonly name: string;
-    readonly providerId: string;
-    readonly capabilities: readonly string[];
-}
-declare class DeviceRegistry<T extends IRegisteredDevice = IRegisteredDevice> {
-    private readonly eventBus;
-    private readonly devices;
-    private readonly logger;
-    constructor(eventBus: IEventBus, loggingService: LoggerFactory);
-    registerDevice(device: T): void;
-    unregisterDevice(id: string): void;
-    getDevice(id: string): T | null;
-    listDevices(): T[];
-    getDevicesByProvider(providerId: string): T[];
-    getDevicesWithCapability(cap: string): T[];
-    registerProviderDevices(providerId: string, devices: readonly T[]): void;
-    unregisterProviderDevices(providerId: string): void;
-}
-
-interface IDeviceCapability {
-    kind: string;
-}
-interface CapabilityBinding {
-    source: 'native' | 'addon' | 'disabled';
-    addonId?: string;
-    config?: Record<string, unknown>;
-}
-interface IResolvableDevice {
-    readonly id: string;
-    readonly capabilities: string[];
-    getCapability<T extends IDeviceCapability>(cap: string): T | null;
-}
-interface IAddonRegistryAccess {
-    getAddon(addonId: string): unknown | null;
-}
-declare class CapabilityResolver {
-    private readonly addonRegistry;
-    private readonly bindings;
-    constructor(addonRegistry: IAddonRegistryAccess);
-    resolve<T extends IDeviceCapability>(device: IResolvableDevice, cap: string): T | null;
-    setBinding(deviceId: string, cap: string, binding: CapabilityBinding): void;
-    removeBinding(deviceId: string, cap: string): void;
-    getBindings(deviceId: string): Partial<Record<string, CapabilityBinding>>;
-    getEffectiveCapabilities(device: IResolvableDevice): string[];
-}
-
 interface TlsCertPair {
     readonly cert: Buffer;
     readonly key: Buffer;
@@ -966,9 +1633,14 @@ declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
 /**
  * Factory for creating tRPC clients for addons.
  *
- * Two modes:
- * - Direct caller (in-process): zero overhead, uses createCallerFactory
- * - WSS client (worker/agent): real WebSocket connection to the server
+ * In-process only: `createDirectCaller()` uses tRPC's `createCallerFactory`
+ * to call procedures directly (zero network overhead) and wraps the raw
+ * caller in a proxy so it matches `CreateTRPCClient<AppRouter>` shape —
+ * addons use `context.api.namespace.method.query(input)` identically to
+ * the cross-process path.
+ *
+ * Cross-process calls (forked workers, remote agents) ride the Moleculer
+ * broker via `brokerTransportLink` in the kernel — not this factory.
  */
 interface DirectCallerOptions {
     /** The tRPC router instance (from buildAppRouter) */
@@ -982,156 +1654,43 @@ interface DirectCallerOptions {
         };
     };
 }
-interface WssClientOptions {
-    /** WebSocket URL (e.g., wss://localhost:4443/trpc) */
-    readonly url: string;
-    /** Auth token for the connection */
-    readonly token: string;
-}
 declare class AddonApiFactory {
-    /**
-     * Build a WSS URL from host and port.
-     */
-    buildWssUrl(host: string, port: number): string;
     /**
      * Create a direct caller -- calls tRPC procedures directly in-process.
      * Zero network overhead. Used for in-process addons and dev mode.
      *
-     * @param options.router - The tRPC router from buildAppRouter()
-     * @param options.context - The auth context (service account)
-     * @returns A tRPC caller that can be used as context.api
-     */
-    createDirectCaller(options: DirectCallerOptions): Promise<unknown>;
-    /**
-     * Create a WSS tRPC client -- connects to the server via WebSocket.
-     * Used for forked workers and remote agents.
-     *
-     * @param options.url - WSS URL (e.g., wss://localhost:4443/trpc)
-     * @param options.token - Bearer token for authentication
-     * @returns A tRPC client that can be used as context.api
+     * Returns `AddonApi` — the same tRPC client surface that broker-routed
+     * callers get. Callers treat it uniformly as `context.api` regardless
+     * of the underlying transport.
      */
-    createWssClient(options: WssClientOptions): Promise<{
-        readonly client: unknown;
-        readonly close: () => void;
-    }>;
-}
-
-declare class PlatformScorer {
-    private cached;
-    /** Probe hardware + runtimes and score all backend combos. Cached after first call. */
-    probe(): Promise<PlatformCapabilities>;
-    probeHardware(): Promise<HardwareInfo>;
-    private probeNodeBackends;
-    private probePythonBackends;
-    private scoreBackends;
-}
-
-declare class InferenceConfigResolver {
-    private readonly scores;
-    private readonly hardware;
-    constructor(scores: readonly PlatformScore[], hardware: HardwareInfo);
-    /**
-     * Compute accuracy/backend weights based on available system RAM.
-     * availableRAM_MB is now sourced from systeminformation (reliable cross-platform),
-     * not os.freemem() which is broken on macOS.
-     *
-     * - > 16 GB available: prefer larger, more accurate models (accuracy 0.6, backend 0.4)
-     * - > 8 GB available:  balanced (accuracy 0.5, backend 0.5)
-     * - <= 8 GB available: prefer speed (accuracy 0.4, backend 0.6)
-     */
-    private getWeights;
-    /**
-     * Given an addon's model requirements, pick the best model + runtime + backend.
-     *
-     * Algorithm:
-     * 1. Filter models by available RAM (minRAM_MB < 25% of available RAM)
-     * 2. For each remaining model, find the best platform score whose format
-     *    is available in the model's formats
-     * 3. Pick the model with the highest combined score using RAM-adaptive weights:
-     *    - High RAM (>16 GB): accuracy × 0.6 + backend × 0.4  (prefer accuracy)
-     *    - Mid RAM  (>8 GB):  accuracy × 0.5 + backend × 0.5  (balanced)
-     *    - Low RAM  (<=8 GB): accuracy × 0.4 + backend × 0.6  (prefer speed)
-     */
-    resolve(requirements: readonly ModelRequirement[]): ResolvedInferenceConfig;
+    createDirectCaller(options: DirectCallerOptions): Promise<_camstack_types.AddonApi>;
 }
 
 declare class IntegrationRegistry implements IIntegrationRegistry {
     private readonly backend;
     constructor(backend: ISettingsBackend);
     initialize(): Promise<void>;
-    createIntegration(input: CreateIntegrationInput): Integration;
-    getIntegration(id: string): Integration | null;
-    getIntegrationByAddonId(addonId: string): Integration | null;
-    listIntegrations(): readonly Integration[];
-    updateIntegration(id: string, updates: Partial<Pick<Integration, 'name' | 'enabled' | 'info'>>): Integration | null;
-    deleteIntegration(id: string): boolean;
-    getIntegrationSettings(integrationId: string): Record<string, unknown>;
-    setIntegrationSetting(integrationId: string, key: string, value: unknown): void;
-    setIntegrationSettings(integrationId: string, settings: Record<string, unknown>): void;
-    createDevice(input: CreateDeviceInput): Device;
-    getDevice(id: string): Device | null;
-    getDeviceByStableId(stableId: string): Device | null;
-    listDevices(integrationId?: string): readonly Device[];
-    listCameras(): readonly Device[];
-    updateDevice(id: string, updates: Partial<Pick<Device, 'name' | 'enabled' | 'info'>>): Device | null;
-    deleteDevice(id: string): boolean;
-    getDeviceSettings(deviceId: string): Record<string, unknown>;
-    setDeviceSetting(deviceId: string, key: string, value: unknown): void;
-    setDeviceSettings(deviceId: string, settings: Record<string, unknown>): void;
+    createIntegration(input: CreateIntegrationInput): Promise<Integration>;
+    getIntegration(id: string): Promise<Integration | null>;
+    getIntegrationByAddonId(addonId: string): Promise<Integration | null>;
+    listIntegrations(): Promise<readonly Integration[]>;
+    updateIntegration(id: string, updates: Partial<Pick<Integration, 'name' | 'enabled' | 'info'>>): Promise<Integration | null>;
+    deleteIntegration(id: string): Promise<boolean>;
+    getIntegrationSettings(integrationId: string): Promise<Record<string, unknown>>;
+    setIntegrationSetting(integrationId: string, key: string, value: unknown): Promise<void>;
+    setIntegrationSettings(integrationId: string, settings: Record<string, unknown>): Promise<void>;
+    createDevice(input: CreateDeviceInput): Promise<PersistedDevice>;
+    getDevice(id: string): Promise<PersistedDevice | null>;
+    getDeviceByStableId(stableId: string): Promise<PersistedDevice | null>;
+    listDevices(integrationId?: string): Promise<readonly PersistedDevice[]>;
+    listCameras(): Promise<readonly PersistedDevice[]>;
+    updateDevice(id: string, updates: Partial<Pick<PersistedDevice, 'name' | 'enabled' | 'info'>>): Promise<PersistedDevice | null>;
+    deleteDevice(id: string): Promise<boolean>;
+    getDeviceSettings(deviceId: string): Promise<Record<string, unknown>>;
+    setDeviceSetting(deviceId: string, key: string, value: unknown): Promise<void>;
+    setDeviceSettings(deviceId: string, settings: Record<string, unknown>): Promise<void>;
     private mapIntegration;
     private mapDevice;
 }
 
-/** Minimal device registry interface for provider management */
-type ProviderDeviceRegistry = {
-    registerProviderDevices(providerId: string, devices: readonly IRegistrableDevice[]): void;
-    unregisterProviderDevices(providerId: string): void;
-};
-interface IRegistrableDevice {
-    readonly id: string;
-    readonly name: string;
-    readonly providerId: string;
-    readonly capabilities: readonly string[];
-}
-interface ProviderStatus {
-    connected: boolean;
-    error?: string;
-    deviceCount: number;
-}
-interface LiveEvent {
-    type: string;
-    camera: string;
-    timestamp: number;
-    data: Record<string, unknown>;
-}
-interface IManagedProvider {
-    readonly id: string;
-    readonly type: string;
-    readonly name: string;
-    start(): Promise<void>;
-    stop(): Promise<void>;
-    getStatus(): ProviderStatus;
-    getDevices(): readonly IRegistrableDevice[];
-    subscribeLiveEvents(callback: (event: LiveEvent) => void): () => void;
-}
-
-declare class ProviderManager<P extends IManagedProvider = IManagedProvider> {
-    private readonly deviceRegistry;
-    private readonly eventBus;
-    private readonly loggingService;
-    private readonly providers;
-    private readonly logger;
-    constructor(deviceRegistry: ProviderDeviceRegistry, eventBus: IEventBus, loggingService: LoggerFactory);
-    registerProvider(provider: P): void;
-    startProvider(id: string): Promise<void>;
-    stopProvider(id: string): Promise<void>;
-    disableProvider(id: string): Promise<void>;
-    enableProvider(id: string): Promise<void>;
-    restartProvider(id: string): Promise<void>;
-    getProvider(id: string): P | null;
-    getProviderStatus(id: string): ElementStatus | null;
-    listProviders(): readonly ProviderListItem[];
-    shutdownAll(): Promise<void>;
-}
-
-export { AddonApiFactory, AddonRouteRegistry, AgentClient, type AgentClientConfig, type AgentEventEmitter, AgentRegistry, AgentTaskRunner, ApiKeyManager, type ApiKeyRecord, type ApiKeyStorageAccess, type AuthConfigReader, AuthManager, type BinaryHandler, type CapabilityBinding, CapabilityResolver, type CertOptions, type ConnectionHandler, DecodeTaskHandler, DetectTaskHandler, DeviceRegistry, type DirectCallerOptions, type ElementState, type ElementStatus, type EnsureTlsResult, EventBus, type FeatureConfigReader, FeatureManager, FsStorageBackend, type IAddonRegistryAccess, type IStorageProvider as ICoreStorageProvider, type IDeviceCapability, type IFileStorage, type ILogDestination, type IManagedProvider, type IRegisteredDevice, type IReplContextProvider, type IReplEngine, type IResolvableDevice, type IStorageBackend, type IStorageLocation, type IStructuredStorage, InferenceConfigResolver, IntegrationRegistry, LifecycleStateMachine, LogManager, LogRingBuffer, ManagedProcess, type MessageHandler, ModelDownloadService, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PlatformScorer, type ProcessEventEmitter, type ProcessLoggerFactory, ProcessManager, type ProcessState, type ProviderDeviceRegistry, ProviderManager, PythonEnvManager, type QueryFilter, RecordTaskHandler, ReplEngine, type ReplScope, type ReplSessionContext, ScopedLogger, ScopedTokenManager, StorageLocationManager, type StorageLocationName, StorageManager, type StorageRecord, SystemEventBus, TaskDispatcher, type TlsCertPair, ToastService, type Unsubscribe, type UserConfigReader, UserManager, type UserStorageAccess, type WssClientOptions, buildBinaryPath, downloadBinary, downloadFile, downloadModel, ensureBinary, ensureFfmpeg, ensurePython, ensureTlsCert, fetchJson, findInPath, getFfmpegDownloadUrl, getPlatformInfo, getPythonDownloadUrl, installPythonPackages, loadTlsCert };
+export { AddonApiFactory, AddonRouteRegistry, type AddonTableSchema, AlertCenterAddon, ApiKeyManager, type ApiKeyStorageAccess, type AuthConfigReader, AuthManager, type BackupConfig, CORE_TABLE_DDL, type CertOptions, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, DeviceManagerAddon, type DeviceRow, DeviceStore, type DirectCallerOptions, type DownloadProgressCallback, type ElementState, type ElementStatus, EngineManagerResolver, type EnsureTlsResult, EventBus, type FeatureConfigReader, FeatureManager, FilesystemStorageAddon, FsStorageBackend, HubForwarderAddon, HubForwarderDestination, type IStorageProvider as ICoreStorageProvider, type IFileStorage, type ILogDestination, type IReplContextProvider, type IReplEngine, type IStorageBackend, type IStorageLocation, type IStructuredStorage, IntegrationRegistry, LifecycleStateMachine, LocalAuthAddon, LocalBackupAddon, LocalBackupService, LogManager, LogRingBuffer, ModelDownloadService, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, type PidStats, PipelineRunner, PipelineValidator, PythonEnvManager, type QueryFilter, ReplEngine, type ReplScope, type ReplSessionContext, ScopedLogger, ScopedTokenManager, SettingsStore, SqliteSettingsAddon, SqliteSettingsBackend, StorageLocationManager, type StorageLocationName, StorageManager, type StorageRecord, SystemConfigAddon, SystemEventBus, type TlsCertPair, ToastService, type Unsubscribe, type UserConfigReader, UserManager, type UserStorageAccess, WinstonDestination, WinstonLoggingAddon, addonTableToDdl, deleteModelFromDisk, downloadFile, downloadModel, ensureModel, ensureTlsCert, fetchJson, formatLogLine, getModelFilePath, getPidStats, getSinglePidStats, isModelDownloaded, loadTlsCert };