@camstack/core 0.1.14 → 0.1.16

package/dist/storage/fs-storage-backend.d.ts

@@ -0,0 +1,41 @@
+export interface IStorageBackend {
+    /** Backend type identifier */
+    readonly type: string;
+    /** Base path of this backend */
+    readonly basePath: string;
+    /** Resolve a subpath to an absolute path */
+    resolve(subpath: string): string;
+    /**
+     * Check whether the backend is usable: either the base directory
+     * already exists and is writable, OR we can create it on first
+     * write (i.e. the nearest existing ancestor is writable).
+     */
+    isAvailable(): boolean;
+    /** No-op for lazy backends. Kept for API compatibility. */
+    initialize(): Promise<void>;
+}
+/**
+ * Filesystem storage backend — lazy by design.
+ *
+ * `initialize()` does NOT create the base directory eagerly. Instead,
+ * consumers that write via `FilesystemStorageProvider` (and other write
+ * helpers in storage-manager.ts) run `fs.mkdir(dirname(filePath), { recursive: true })`
+ * right before every `writeFile`, so the directory tree appears on demand.
+ *
+ * The previous behaviour eagerly mkdir'd every location declared in
+ * `StorageLocationManager.initializeDefaults()` — six directories (`db`,
+ * `media`, `recordings`, `models`, `cache`, `logs`) got created at boot
+ * even if the installation had no cameras, no recording addon, no
+ * analytics addon, etc. That meant every fresh install looked like it
+ * was producing data when it had nothing to write. Laziness fixes that:
+ * a directory only exists once an addon decides to put a file there.
+ */
+export declare class FsStorageBackend implements IStorageBackend {
+    readonly type = "local";
+    readonly basePath: string;
+    constructor(basePath: string);
+    resolve(subpath: string): string;
+    isAvailable(): boolean;
+    initialize(): Promise<void>;
+}
+//# sourceMappingURL=fs-storage-backend.d.ts.map

package/dist/storage/fs-storage-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-storage-backend.d.ts","sourceRoot":"","sources":["../../src/storage/fs-storage-backend.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gCAAgC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,4CAA4C;IAC5C,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAA;IAChC;;;;OAIG;IACH,WAAW,IAAI,OAAO,CAAA;IACtB,2DAA2D;IAC3D,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gBAAiB,YAAW,eAAe;IACtD,QAAQ,CAAC,IAAI,WAAU;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;gBAEb,QAAQ,EAAE,MAAM;IAI5B,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM;IAKhC,WAAW,IAAI,OAAO;IAwBhB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CAIlC"}

package/dist/storage/storage-location-manager.d.ts

@@ -0,0 +1,24 @@
+import { IStorageBackend } from './fs-storage-backend.js';
+export type StorageLocationName = 'data' | 'media' | 'recordings' | 'models' | 'cache' | 'logs';
+export declare class StorageLocationManager {
+    private readonly backends;
+    private readonly dataPath;
+    constructor(dataPath: string);
+    /** Initialize all locations with default paths */
+    initializeDefaults(): Promise<void>;
+    /** Override a specific location's backend path */
+    setLocationPath(name: StorageLocationName, basePath: string): Promise<void>;
+    /** Get the backend for a location */
+    getBackend(name: StorageLocationName): IStorageBackend;
+    /** Resolve a path within a location */
+    resolve(location: StorageLocationName, subpath: string): string;
+    /** Check if all locations are available */
+    getStatus(): Array<{
+        name: StorageLocationName;
+        available: boolean;
+        path: string;
+    }>;
+    /** All location names */
+    getLocationNames(): StorageLocationName[];
+}
+//# sourceMappingURL=storage-location-manager.d.ts.map

package/dist/storage/storage-location-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-location-manager.d.ts","sourceRoot":"","sources":["../../src/storage/storage-location-manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEhF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;AAE/F,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuD;IAChF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,QAAQ,EAAE,MAAM;IAI5B,kDAAkD;IAC5C,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAiBzC,kDAAkD;IAC5C,eAAe,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOjF,qCAAqC;IACrC,UAAU,CAAC,IAAI,EAAE,mBAAmB,GAAG,eAAe;IAMtD,uCAAuC;IACvC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAI/D,2CAA2C;IAC3C,SAAS,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAQnF,yBAAyB;IACzB,gBAAgB,IAAI,mBAAmB,EAAE;CAG1C"}

package/dist/storage/storage-manager.d.ts

@@ -0,0 +1,77 @@
+import { StorageLocationManager, StorageLocationName } from './storage-location-manager.js';
+import { IStorageProvider as INewStorageProvider, ISettingsBackend } from '@camstack/types';
+export interface IStorageProvider {
+    initialize(): Promise<void>;
+    shutdown(): Promise<void>;
+    getLocation(name: StorageLocationName): IStorageLocation;
+    export?(locationName: StorageLocationName): Promise<Buffer>;
+    import?(locationName: StorageLocationName, data: Buffer): Promise<void>;
+}
+export interface QueryFilter {
+    where?: Record<string, unknown>;
+    whereIn?: Record<string, unknown[]>;
+    whereBetween?: Record<string, [unknown, unknown]>;
+    orderBy?: {
+        field: string;
+        direction: 'asc' | 'desc';
+    };
+    limit?: number;
+    offset?: number;
+}
+export interface StorageRecord {
+    collection: string;
+    id: string;
+    data: Record<string, unknown>;
+}
+export interface IStructuredStorage {
+    query(collection: string, filter?: QueryFilter): Promise<readonly StorageRecord[]>;
+    insert(record: StorageRecord): Promise<StorageRecord>;
+    update(collection: string, id: string, data: Record<string, unknown>): Promise<StorageRecord>;
+    delete(collection: string, id: string): Promise<void>;
+    count(collection: string, filter?: QueryFilter): Promise<number>;
+}
+export interface IFileStorage {
+    readFile(path: string): Promise<Buffer>;
+    writeFile(path: string, data: Buffer): Promise<void>;
+    deleteFile(path: string): Promise<void>;
+    listFiles(prefix?: string): Promise<readonly string[]>;
+    getFileUrl(path: string): Promise<string>;
+    exists(path: string): Promise<boolean>;
+}
+export interface IStorageLocation {
+    structured?: IStructuredStorage;
+    files?: IFileStorage;
+}
+/**
+ * StorageManager — bridge between legacy code (getLocation/getLocationPath)
+ * and the new capability-based storage system.
+ *
+ * Legacy consumers call getLocation('addon', namespace) to get structured + file storage.
+ * This manager builds the response from:
+ *   - SettingsBackend (for structured queries) — provided by sqlite-settings addon
+ *   - LocationManager (for file paths) — set during Phase 2 boot
+ */
+export declare class StorageManager {
+    private legacyProvider;
+    private locationManager;
+    private newStorageProvider;
+    private settingsBackend;
+    /** @deprecated Set by legacy capability consumer — use setNewStorageProvider instead */
+    setProvider(provider: IStorageProvider | INewStorageProvider): void;
+    setNewStorageProvider(provider: INewStorageProvider): void;
+    setSettingsBackend(backend: ISettingsBackend): void;
+    getSettingsBackend(): ISettingsBackend;
+    getProvider(): IStorageProvider;
+    setLocationManager(manager: StorageLocationManager): void;
+    getLocationManager(): StorageLocationManager;
+    initializeLocations(dataPath: string): Promise<void>;
+    getLocationPath(name: StorageLocationName): string;
+    /**
+     * Get a storage location with optional namespace scoping.
+     * Builds IStorageLocation from settingsBackend (structured) + locationManager (files).
+     */
+    getLocation(name: StorageLocationName | string, namespace?: string): IStorageLocation;
+    private createLegacyShim;
+    private createNamespacedLocation;
+}
+//# sourceMappingURL=storage-manager.d.ts.map

package/dist/storage/storage-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage-manager.d.ts","sourceRoot":"","sources":["../../src/storage/storage-manager.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,KAAK,mBAAmB,EAAE,MAAM,+BAA+B,CAAA;AAChG,OAAO,KAAK,EACV,gBAAgB,IAAI,mBAAmB,EACvC,gBAAgB,EACjB,MAAM,iBAAiB,CAAA;AAGxB,MAAM,WAAW,gBAAgB;IAC/B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,gBAAgB,CAAA;IACxD,MAAM,CAAC,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;IACnC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACjD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAA;IACtD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAA;IAClF,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IACrD,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAC7F,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrD,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjE;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACtD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,kBAAkB,CAAA;IAC/B,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,cAAc,CAAgC;IACtD,OAAO,CAAC,eAAe,CAAsC;IAC7D,OAAO,CAAC,kBAAkB,CAAmC;IAC7D,OAAO,CAAC,eAAe,CAAgC;IAEvD,wFAAwF;IACxF,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,IAAI;IASnE,qBAAqB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,IAAI;IAI1D,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI;IAInD,kBAAkB,IAAI,gBAAgB;IAOtC,WAAW,IAAI,gBAAgB;IAS/B,kBAAkB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI;IAIzD,kBAAkB,IAAI,sBAAsB;IAOtC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAW1D,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM;IAIlD;;;OAGG;IACH,WAAW,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,gBAAgB;IAgFrF,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,wBAAwB;CAgCjC"}

package/dist/tls/cert-manager.d.ts

@@ -0,0 +1,27 @@
+export interface TlsCertPair {
+    readonly cert: Buffer;
+    readonly key: Buffer;
+}
+export interface EnsureTlsResult {
+    readonly certPath: string;
+    readonly keyPath: string;
+    readonly generated: boolean;
+}
+export interface CertOptions {
+    /** Common Name for the cert (default: 'camstack.local') */
+    readonly commonName?: string;
+    /** Validity in days (default: 825 — max for browsers) */
+    readonly validDays?: number;
+    /** Additional SANs (DNS names or IPs) */
+    readonly extraSans?: readonly string[];
+}
+/**
+ * Ensure a self-signed TLS certificate exists in the given directory.
+ * Generates one if missing. Returns paths to cert and key files.
+ */
+export declare function ensureTlsCert(dataDir: string, options?: CertOptions): Promise<EnsureTlsResult>;
+/**
+ * Load TLS cert+key from files. Returns Buffers suitable for Node.js TLS options.
+ */
+export declare function loadTlsCert(certPath: string, keyPath: string): TlsCertPair;
+//# sourceMappingURL=cert-manager.d.ts.map

package/dist/tls/cert-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cert-manager.d.ts","sourceRoot":"","sources":["../../src/tls/cert-manager.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,WAAW,GACpB,OAAO,CAAC,eAAe,CAAC,CA4E1B;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CAK1E"}

package/dist/tls/index.d.ts

@@ -0,0 +1,2 @@
+export { ensureTlsCert, loadTlsCert, type TlsCertPair, type EnsureTlsResult, type CertOptions } from './cert-manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tls/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tls/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/core",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -30,41 +30,251 @@
     "addons": [
       {
         "id": "filesystem-storage",
+        "name": "Filesystem Storage",
         "entry": "./dist/builtins/sqlite-storage/filesystem-storage.addon.js",
         "capabilities": [
           {
-            "name": "storage",
-            "mode": "collection"
+            "name": "storage-provider"
           }
         ]
       },
       {
         "id": "sqlite-settings",
+        "name": "SQLite Settings",
         "entry": "./dist/builtins/sqlite-storage/sqlite-settings.addon.js",
         "capabilities": [
           {
-            "name": "settings-store",
-            "mode": "singleton"
+            "name": "settings-store"
           }
         ]
       },
       {
         "id": "winston-logging",
+        "name": "Winston Logging",
         "entry": "./dist/builtins/winston-logging/index.js",
         "capabilities": [
           {
-            "name": "log-destination",
-            "mode": "collection"
+            "name": "log-destination"
           }
         ]
       },
       {
-        "id": "local-backup",
-        "entry": "./dist/builtins/local-backup/index.js",
+        "id": "console-logging",
+        "name": "Console Logging",
+        "entry": "./dist/builtins/console-logging/index.js",
         "capabilities": [
           {
-            "name": "backup",
-            "mode": "collection"
+            "name": "log-destination"
+          }
+        ]
+      },
+      {
+        "id": "hub-forwarder",
+        "name": "Hub Log Forwarder",
+        "description": "Agent-only log destination — forwards every log entry to the hub via the cluster broker. Never runs on the hub itself (the hub already owns the log-receiver, registering hub-forwarder there would create a write→ingest→write feedback loop).",
+        "entry": "./dist/builtins/hub-forwarder/index.js",
+        "execution": {
+          "placement": "agent-only"
+        },
+        "capabilities": [
+          {
+            "name": "log-destination"
+          }
+        ]
+      },
+      {
+        "id": "backup-orchestrator",
+        "name": "Backup Orchestrator",
+        "description": "System singleton that owns the schedule, builds the archive once, and fans it out to every enabled `backup-destination` provider (local, S3, rsync, …).",
+        "entry": "./dist/builtins/backup-orchestrator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "backup"
+          }
+        ]
+      },
+      {
+        "id": "storage-orchestrator",
+        "name": "Storage Orchestrator",
+        "description": "Hub-only singleton that owns the consumer-facing `storage` cap. Holds the `locationId → StorageLocation` map (Task 6 will persist to SQLite), resolves `StorageLocationRef` to concrete locations, and dispatches every call to the matching `storage-provider` collection registrant (`filesystem-storage` today; future SFTP / S3 / WebDAV addons plug in alongside).",
+        "entry": "./dist/builtins/storage-orchestrator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "storage"
+          }
+        ]
+      },
+      {
+        "id": "metrics-native",
+        "name": "Native Metrics",
+        "entry": "./dist/builtins/native-metrics/native-metrics.addon.js",
+        "capabilities": [
+          {
+            "name": "metrics-provider"
+          }
+        ]
+      },
+      {
+        "id": "snapshot",
+        "name": "Snapshot",
+        "entry": "./dist/builtins/snapshot/index.js",
+        "capabilities": [
+          {
+            "name": "snapshot"
+          }
+        ]
+      },
+      {
+        "id": "alert-center",
+        "name": "Alert Center",
+        "entry": "./dist/builtins/alerts/index.js",
+        "capabilities": [
+          {
+            "name": "alerts"
+          }
+        ]
+      },
+      {
+        "id": "system-config",
+        "name": "System Config",
+        "description": "Exposes cluster-wide yml-backed configuration sections (server, auth, ffmpeg, logging, recording, retention) via the three-level settings API. Hub-only.",
+        "entry": "./dist/builtins/system-config/index.js",
+        "protected": true
+      },
+      {
+        "id": "addon-pages-aggregator",
+        "name": "Addon Pages Aggregator",
+        "description": "Hub-local singleton that aggregates `addon-pages-source` (collection) providers and emits the public `addon-pages.listPages` surface with versioned bundleUrls.",
+        "entry": "./dist/builtins/addon-pages-aggregator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "addon-pages"
+          }
+        ]
+      },
+      {
+        "id": "addon-widgets-aggregator",
+        "name": "Addon Widgets Aggregator",
+        "description": "Hub-local singleton that aggregates `addon-widgets-source` (collection) providers and emits the public `addon-widgets.listWidgets` surface with versioned bundleUrls.",
+        "entry": "./dist/builtins/addon-widgets-aggregator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "addon-widgets"
+          }
+        ]
+      },
+      {
+        "id": "device-manager",
+        "name": "Device Manager",
+        "description": "Hub-side singleton that unifies device persistence and management. Uses ctx.settings for storage — no direct SQLite access. Replaces device-persistence cap (Phase 2 will delete device-persistence once all consumers are migrated).",
+        "entry": "./dist/builtins/device-manager/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "device-manager"
+          },
+          {
+            "name": "device-state"
+          }
+        ]
+      },
+      {
+        "id": "local-auth",
+        "name": "Local Auth",
+        "description": "Built-in local username/password authentication. Implements the auth-provider capability as the default login path. OIDC and other providers can register alongside via the same capability.",
+        "entry": "./dist/builtins/local-auth/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "auth-provider"
+          },
+          {
+            "name": "user-management"
+          }
+        ]
+      },
+      {
+        "id": "platform-probe",
+        "name": "Platform Probe (Native)",
+        "description": "Probes hardware and inference runtimes on the local node. Registers the `platform-probe` capability consumed by every inference addon on this node.",
+        "entry": "./dist/builtins/platform-probe/index.js",
+        "protected": true,
+        "execution": {
+          "placement": "any-node"
+        },
+        "capabilities": [
+          {
+            "name": "platform-probe"
+          }
+        ]
+      },
+      {
+        "id": "local-network",
+        "name": "Local Network",
+        "description": "Enumerates the hub's network interfaces, classifies them (LAN / Wi-Fi / Docker / VPN / loopback), and ranks connection-endpoints for SDK clients. Hub-only — agents are not directly addressable.",
+        "entry": "./dist/builtins/local-network/index.js",
+        "protected": true,
+        "execution": {
+          "placement": "hub-only"
+        },
+        "capabilities": [
+          {
+            "name": "local-network"
+          }
+        ]
+      },
+      {
+        "id": "auth-orchestrator",
+        "name": "Authentication Orchestrator",
+        "description": "Hub-only singleton facade over the auth-provider collection. Surfaces a unified provider list to the admin UI's Authentication page and the login screen's provider picker.",
+        "entry": "./dist/builtins/auth-orchestrator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "authentication"
+          }
+        ]
+      },
+      {
+        "id": "mesh-orchestrator",
+        "name": "Mesh Orchestrator",
+        "description": "Hub-only singleton facade over the mesh-network collection. Aggregates Tailscale / Headscale / ZeroTier providers for the admin UI's Mesh Networks page.",
+        "entry": "./dist/builtins/mesh-orchestrator/index.js",
+        "protected": true,
+        "execution": {
+          "placement": "hub-only"
+        },
+        "capabilities": [
+          {
+            "name": "mesh-orchestrator"
+          }
+        ]
+      },
+      {
+        "id": "remote-access-orchestrator",
+        "name": "Remote Access Orchestrator",
+        "description": "Hub-only singleton facade over the network-access collection (Cloudflare Tunnel, ngrok, …). Surfaces a unified provider list to the admin UI's Remote Access page.",
+        "entry": "./dist/builtins/remote-access-orchestrator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "remote-access"
+          }
+        ]
+      },
+      {
+        "id": "turn-orchestrator",
+        "name": "TURN Orchestrator",
+        "description": "Hub-only singleton facade over the turn-provider collection. Aggregates ICE servers from all enabled TURN providers; consumed by the WebRTC layer at session creation.",
+        "entry": "./dist/builtins/turn-orchestrator/index.js",
+        "protected": true,
+        "capabilities": [
+          {
+            "name": "turn-orchestrator"
           }
         ]
       }
@@ -74,7 +284,7 @@
     "dist"
   ],
   "scripts": {
-    "build": "tsup",
+    "build": "vite build",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
@@ -85,8 +295,10 @@
     "@camstack/kernel": "*",
     "bcryptjs": "^2.4.3",
     "better-sqlite3": "^12.8.0",
+    "croner": "^10.0.1",
     "jsonwebtoken": "^9.0.0",
-    "systeminformation": "^5.31.5",
+    "systeminformation": "^5.0.0",
+    "tar": "^6.2.1",
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^5.0.0"
   },
@@ -94,11 +306,16 @@
     "@camstack/types": "^0.1.0"
   },
   "devDependencies": {
+    "@camstack/addon-test-integration": "*",
     "@camstack/types": "*",
     "@types/bcryptjs": "^2.4.6",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/jsonwebtoken": "^9.0.0",
+    "@types/tar": "^6.1.13",
     "tsup": "^8.0.0",
     "typescript": "~5.9.0",
+    "vite": "^8.0.11",
+    "vite-plugin-dts": "^5.0.0",
     "vitest": "^3.0.0"
   }
 }

package/dist/builtins/local-backup/index.d.mts

@@ -1,42 +0,0 @@
-import { IScopedLogger, IEventBus, IStorageLocation, BackupManifest, ICamstackAddon, IConfigurable, AddonManifest, AddonContext, CapabilityProviderMap, ConfigUISchema } from '@camstack/types';
-export { BackupManifest } from '@camstack/types';
-
-interface BackupConfig {
-    readonly backupDir: string;
-    readonly retentionCount: number;
-}
-declare class LocalBackupService {
-    private readonly config;
-    private readonly logger;
-    private readonly eventBus;
-    private readonly storage;
-    private manifests;
-    constructor(config: BackupConfig, logger: IScopedLogger, eventBus: IEventBus, storage: IStorageLocation);
-    /** Create a backup of specified locations */
-    backup(options?: {
-        locations?: string[];
-        label?: string;
-    }): Promise<BackupManifest>;
-    /** Restore from a backup */
-    restore(backupId: string): Promise<void>;
-    /** List all backups sorted by timestamp descending */
-    list(): readonly BackupManifest[];
-    /** Delete a specific backup */
-    delete(backupId: string): Promise<void>;
-    private pruneOldBackups;
-}
-
-declare class LocalBackupAddon implements ICamstackAddon, IConfigurable {
-    readonly manifest: AddonManifest;
-    private service;
-    private currentConfig;
-    initialize(context: AddonContext): Promise<void>;
-    shutdown(): Promise<void>;
-    getService(): LocalBackupService;
-    getCapabilityProvider<K extends keyof CapabilityProviderMap>(name: K): CapabilityProviderMap[K] | null;
-    getConfigSchema(): ConfigUISchema;
-    getConfig(): Record<string, unknown>;
-    onConfigChange(config: Record<string, unknown>): Promise<void>;
-}
-
-export { type BackupConfig, LocalBackupAddon, LocalBackupService, LocalBackupAddon as default };

package/dist/builtins/local-backup/index.d.ts

@@ -1,42 +0,0 @@
-import { IScopedLogger, IEventBus, IStorageLocation, BackupManifest, ICamstackAddon, IConfigurable, AddonManifest, AddonContext, CapabilityProviderMap, ConfigUISchema } from '@camstack/types';
-export { BackupManifest } from '@camstack/types';
-
-interface BackupConfig {
-    readonly backupDir: string;
-    readonly retentionCount: number;
-}
-declare class LocalBackupService {
-    private readonly config;
-    private readonly logger;
-    private readonly eventBus;
-    private readonly storage;
-    private manifests;
-    constructor(config: BackupConfig, logger: IScopedLogger, eventBus: IEventBus, storage: IStorageLocation);
-    /** Create a backup of specified locations */
-    backup(options?: {
-        locations?: string[];
-        label?: string;
-    }): Promise<BackupManifest>;
-    /** Restore from a backup */
-    restore(backupId: string): Promise<void>;
-    /** List all backups sorted by timestamp descending */
-    list(): readonly BackupManifest[];
-    /** Delete a specific backup */
-    delete(backupId: string): Promise<void>;
-    private pruneOldBackups;
-}
-
-declare class LocalBackupAddon implements ICamstackAddon, IConfigurable {
-    readonly manifest: AddonManifest;
-    private service;
-    private currentConfig;
-    initialize(context: AddonContext): Promise<void>;
-    shutdown(): Promise<void>;
-    getService(): LocalBackupService;
-    getCapabilityProvider<K extends keyof CapabilityProviderMap>(name: K): CapabilityProviderMap[K] | null;
-    getConfigSchema(): ConfigUISchema;
-    getConfig(): Record<string, unknown>;
-    onConfigChange(config: Record<string, unknown>): Promise<void>;
-}
-
-export { type BackupConfig, LocalBackupAddon, LocalBackupService, LocalBackupAddon as default };