@camstack/core 0.1.35 → 0.1.37

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EAIT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AA2BxB,qBAAa,qBAAsB,SAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;cAKzD,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAkB/D,OAAO,CAAC,WAAW;YAML,aAAa;CAsC5B;AAED,eAAe,qBAAqB,CAAA"}
+{"version":3,"file":"mesh-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EAKT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAqCxB,qBAAa,qBAAsB,SAAQ,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;;cAKzD,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsC/D,OAAO,CAAC,WAAW;YAML,aAAa;CAqD5B;AAED,eAAe,qBAAqB,CAAA"}

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.js

@@ -29,6 +29,22 @@ var MeshOrchestratorAddon = class extends _camstack_types.BaseAddon {
 				const impl = this.resolveImpl(addonId);
 				if (impl?.leave) await impl.leave();
 				return { success: true };
+			},
+			startLoginProvider: async ({ addonId, hostname }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.startLogin) throw new Error(`Mesh provider "${addonId}" does not support startLogin`);
+				return await impl.startLogin(hostname ? { hostname } : {});
+			},
+			logoutProvider: async ({ addonId }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.logout) throw new Error(`Mesh provider "${addonId}" does not support logout`);
+				await impl.logout();
+				return { loggedOut: true };
+			},
+			listProviderPeers: async ({ addonId }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.listPeers) return { peers: [] };
+				return await impl.listPeers();
 			}
 		};
 		this.ctx.logger.info("Mesh orchestrator initialized");
@@ -50,6 +66,11 @@ var MeshOrchestratorAddon = class extends _camstack_types.BaseAddon {
 			let peerCount = 0;
 			let endpoints = [];
 			let error;
+			let tenantName = "";
+			let magicDnsSuffix = "";
+			let userLogin = null;
+			let controlPlaneUrl = "";
+			let keyExpiry = null;
 			if (impl.getStatus) try {
 				const s = await impl.getStatus();
 				joined = s.joined;
@@ -58,6 +79,11 @@ var MeshOrchestratorAddon = class extends _camstack_types.BaseAddon {
 				peerCount = s.peerCount;
 				endpoints = s.endpoints;
 				error = s.error;
+				tenantName = s.tenantName;
+				magicDnsSuffix = s.magicDnsSuffix;
+				userLogin = s.userLogin;
+				controlPlaneUrl = s.controlPlaneUrl;
+				keyExpiry = s.keyExpiry;
 			} catch (err) {
 				error = err instanceof Error ? err.message : String(err);
 			}
@@ -69,7 +95,12 @@ var MeshOrchestratorAddon = class extends _camstack_types.BaseAddon {
 				magicDnsHostname,
 				peerCount,
 				endpoints,
-				...error !== void 0 ? { error } : {}
+				...error !== void 0 ? { error } : {},
+				tenantName,
+				magicDnsSuffix,
+				userLogin,
+				controlPlaneUrl,
+				keyExpiry
 			});
 		}
 		return out;

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.js.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"sourcesContent":["/**\n * Mesh orchestrator — singleton facade over the `mesh-network`\n * collection. One row per provider (Tailscale, Headscale, ZeroTier),\n * aggregated for the admin UI's Mesh Networks page.\n */\nimport {\n  BaseAddon,\n  meshOrchestratorCapability,\n  type IMeshOrchestrator,\n  type MeshProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface MeshNetworkLike {\n  getStatus?: () => Promise<{\n    joined: boolean\n    meshIp: string\n    magicDnsHostname: string\n    peerCount: number\n    endpoints: readonly {\n      id: string\n      label: string\n      scope: 'mesh' | 'public'\n      url: string\n      hostname: string\n      port: number\n      protocol: 'http' | 'https'\n    }[]\n    error?: string\n  }>\n  join?: (input: { authKey: string; hostname?: string }) => Promise<{ joined: true }>\n  leave?: () => Promise<{ left: true }>\n}\n\ninterface MeshRegistrationMeta {\n  readonly displayName?: string\n}\n\nexport class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IMeshOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      joinProvider: async ({ addonId, authKey, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.join) throw new Error(`Mesh provider \"${addonId}\" does not support join`)\n        return await impl.join({ authKey, ...(hostname ? { hostname } : {}) })\n      },\n      leaveProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.leave) await impl.leave()\n        return { success: true as const }\n      },\n    }\n    this.ctx.logger.info('Mesh orchestrator initialized')\n    return [{ capability: meshOrchestratorCapability, provider }]\n  }\n\n  private resolveImpl(addonId: string): MeshNetworkLike | null {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike>('mesh-network') ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly MeshProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike & MeshRegistrationMeta>(\n      'mesh-network',\n    ) ?? []\n    const out: MeshProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let joined = false\n      let meshIp = ''\n      let magicDnsHostname = ''\n      let peerCount = 0\n      let endpoints: MeshProviderInfo['endpoints'] = []\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          joined = s.joined\n          meshIp = s.meshIp\n          magicDnsHostname = s.magicDnsHostname\n          peerCount = s.peerCount\n          endpoints = s.endpoints\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        joined,\n        meshIp,\n        magicDnsHostname,\n        peerCount,\n        endpoints,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default MeshOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;AAsCA,IAAa,wBAAb,cAA2C,gBAAA,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAA8B;GAClC,eAAe,YAAY,KAAK,eAAe;GAC/C,cAAc,OAAO,EAAE,SAAS,SAAS,eAAe;IACtD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,yBAAyB;IACpF,OAAO,MAAM,KAAK,KAAK;KAAE;KAAS,GAAI,WAAW,EAAE,UAAU,GAAG,EAAE;KAAG,CAAC;;GAExE,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;IACnC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,gCAAgC;EACrD,OAAO,CAAC;GAAE,YAAY,gBAAA;GAA4B;GAAU,CAAC;;CAG/D,YAAoB,SAAyC;EAG3D,QAFgB,KAAK,cAAc,qBAAsC,eAAe,IAAI,EAAE,EACxE,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBACjC,eACD,IAAI,EAAE;EACP,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,mBAAmB;GACvB,IAAI,YAAY;GAChB,IAAI,YAA2C,EAAE;GACjD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,SAAS,EAAE;IACX,SAAS,EAAE;IACX,mBAAmB,EAAE;IACrB,YAAY,EAAE;IACd,YAAY,EAAE;IACd,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IACjC;IACA;IACA;IACA;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"mesh-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"sourcesContent":["/**\n * Mesh orchestrator — singleton facade over the `mesh-network`\n * collection. One row per provider (Tailscale, Headscale, ZeroTier),\n * aggregated for the admin UI's Mesh Networks page.\n */\nimport {\n  BaseAddon,\n  meshOrchestratorCapability,\n  type IMeshOrchestrator,\n  type MeshPeer,\n  type MeshProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface MeshStatusLike {\n  joined: boolean\n  meshIp: string\n  magicDnsHostname: string\n  peerCount: number\n  endpoints: readonly {\n    id: string\n    label: string\n    scope: 'mesh' | 'public'\n    url: string\n    hostname: string\n    port: number\n    protocol: 'http' | 'https'\n  }[]\n  error?: string\n  tenantName: string\n  magicDnsSuffix: string\n  userLogin: string | null\n  controlPlaneUrl: string\n  keyExpiry: number | null\n}\n\ninterface MeshNetworkLike {\n  getStatus?: () => Promise<MeshStatusLike>\n  join?: (input: { authKey: string; hostname?: string }) => Promise<{ joined: true }>\n  startLogin?: (input: { hostname?: string }) => Promise<{ loginUrl: string }>\n  leave?: () => Promise<{ left: true }>\n  logout?: () => Promise<{ loggedOut: true }>\n  listPeers?: () => Promise<{ peers: readonly MeshPeer[] }>\n}\n\ninterface MeshRegistrationMeta {\n  readonly displayName?: string\n}\n\nexport class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IMeshOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      joinProvider: async ({ addonId, authKey, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.join) throw new Error(`Mesh provider \"${addonId}\" does not support join`)\n        return await impl.join({ authKey, ...(hostname ? { hostname } : {}) })\n      },\n      leaveProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.leave) await impl.leave()\n        return { success: true as const }\n      },\n      startLoginProvider: async ({ addonId, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.startLogin) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support startLogin`)\n        }\n        return await impl.startLogin(hostname ? { hostname } : {})\n      },\n      logoutProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.logout) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support logout`)\n        }\n        await impl.logout()\n        return { loggedOut: true as const }\n      },\n      listProviderPeers: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.listPeers) return { peers: [] }\n        return await impl.listPeers()\n      },\n    }\n    this.ctx.logger.info('Mesh orchestrator initialized')\n    return [{ capability: meshOrchestratorCapability, provider }]\n  }\n\n  private resolveImpl(addonId: string): MeshNetworkLike | null {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike>('mesh-network') ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly MeshProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike & MeshRegistrationMeta>(\n      'mesh-network',\n    ) ?? []\n    const out: MeshProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let joined = false\n      let meshIp = ''\n      let magicDnsHostname = ''\n      let peerCount = 0\n      let endpoints: MeshProviderInfo['endpoints'] = []\n      let error: string | undefined\n      let tenantName = ''\n      let magicDnsSuffix = ''\n      let userLogin: string | null = null\n      let controlPlaneUrl = ''\n      let keyExpiry: number | null = null\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          joined = s.joined\n          meshIp = s.meshIp\n          magicDnsHostname = s.magicDnsHostname\n          peerCount = s.peerCount\n          endpoints = s.endpoints\n          error = s.error\n          tenantName = s.tenantName\n          magicDnsSuffix = s.magicDnsSuffix\n          userLogin = s.userLogin\n          controlPlaneUrl = s.controlPlaneUrl\n          keyExpiry = s.keyExpiry\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        joined,\n        meshIp,\n        magicDnsHostname,\n        peerCount,\n        endpoints,\n        ...(error !== undefined ? { error } : {}),\n        tenantName,\n        magicDnsSuffix,\n        userLogin,\n        controlPlaneUrl,\n        keyExpiry,\n      })\n    }\n    return out\n  }\n}\n\nexport default MeshOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;AAiDA,IAAa,wBAAb,cAA2C,gBAAA,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAA8B;GAClC,eAAe,YAAY,KAAK,eAAe;GAC/C,cAAc,OAAO,EAAE,SAAS,SAAS,eAAe;IACtD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,yBAAyB;IACpF,OAAO,MAAM,KAAK,KAAK;KAAE;KAAS,GAAI,WAAW,EAAE,UAAU,GAAG,EAAE;KAAG,CAAC;;GAExE,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;IACnC,OAAO,EAAE,SAAS,MAAe;;GAEnC,oBAAoB,OAAO,EAAE,SAAS,eAAe;IACnD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,YACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,+BAA+B;IAE3E,OAAO,MAAM,KAAK,WAAW,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC;;GAE5D,gBAAgB,OAAO,EAAE,cAAc;IACrC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,QACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,2BAA2B;IAEvE,MAAM,KAAK,QAAQ;IACnB,OAAO,EAAE,WAAW,MAAe;;GAErC,mBAAmB,OAAO,EAAE,cAAc;IACxC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,WAAW,OAAO,EAAE,OAAO,EAAE,EAAE;IAC1C,OAAO,MAAM,KAAK,WAAW;;GAEhC;EACD,KAAK,IAAI,OAAO,KAAK,gCAAgC;EACrD,OAAO,CAAC;GAAE,YAAY,gBAAA;GAA4B;GAAU,CAAC;;CAG/D,YAAoB,SAAyC;EAG3D,QAFgB,KAAK,cAAc,qBAAsC,eAAe,IAAI,EAAE,EACxE,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBACjC,eACD,IAAI,EAAE;EACP,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,mBAAmB;GACvB,IAAI,YAAY;GAChB,IAAI,YAA2C,EAAE;GACjD,IAAI;GACJ,IAAI,aAAa;GACjB,IAAI,iBAAiB;GACrB,IAAI,YAA2B;GAC/B,IAAI,kBAAkB;GACtB,IAAI,YAA2B;GAC/B,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,SAAS,EAAE;IACX,SAAS,EAAE;IACX,mBAAmB,EAAE;IACrB,YAAY,EAAE;IACd,YAAY,EAAE;IACd,QAAQ,EAAE;IACV,aAAa,EAAE;IACf,iBAAiB,EAAE;IACnB,YAAY,EAAE;IACd,kBAAkB,EAAE;IACpB,YAAY,EAAE;YACP,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IACjC;IACA;IACA;IACA;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACxC;IACA;IACA;IACA;IACA;IACD,CAAC;;EAEJ,OAAO"}

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.mjs

@@ -24,6 +24,22 @@ var MeshOrchestratorAddon = class extends BaseAddon {
 				const impl = this.resolveImpl(addonId);
 				if (impl?.leave) await impl.leave();
 				return { success: true };
+			},
+			startLoginProvider: async ({ addonId, hostname }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.startLogin) throw new Error(`Mesh provider "${addonId}" does not support startLogin`);
+				return await impl.startLogin(hostname ? { hostname } : {});
+			},
+			logoutProvider: async ({ addonId }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.logout) throw new Error(`Mesh provider "${addonId}" does not support logout`);
+				await impl.logout();
+				return { loggedOut: true };
+			},
+			listProviderPeers: async ({ addonId }) => {
+				const impl = this.resolveImpl(addonId);
+				if (!impl?.listPeers) return { peers: [] };
+				return await impl.listPeers();
 			}
 		};
 		this.ctx.logger.info("Mesh orchestrator initialized");
@@ -45,6 +61,11 @@ var MeshOrchestratorAddon = class extends BaseAddon {
 			let peerCount = 0;
 			let endpoints = [];
 			let error;
+			let tenantName = "";
+			let magicDnsSuffix = "";
+			let userLogin = null;
+			let controlPlaneUrl = "";
+			let keyExpiry = null;
 			if (impl.getStatus) try {
 				const s = await impl.getStatus();
 				joined = s.joined;
@@ -53,6 +74,11 @@ var MeshOrchestratorAddon = class extends BaseAddon {
 				peerCount = s.peerCount;
 				endpoints = s.endpoints;
 				error = s.error;
+				tenantName = s.tenantName;
+				magicDnsSuffix = s.magicDnsSuffix;
+				userLogin = s.userLogin;
+				controlPlaneUrl = s.controlPlaneUrl;
+				keyExpiry = s.keyExpiry;
 			} catch (err) {
 				error = err instanceof Error ? err.message : String(err);
 			}
@@ -64,7 +90,12 @@ var MeshOrchestratorAddon = class extends BaseAddon {
 				magicDnsHostname,
 				peerCount,
 				endpoints,
-				...error !== void 0 ? { error } : {}
+				...error !== void 0 ? { error } : {},
+				tenantName,
+				magicDnsSuffix,
+				userLogin,
+				controlPlaneUrl,
+				keyExpiry
 			});
 		}
 		return out;

package/dist/builtins/mesh-orchestrator/mesh-orchestrator.addon.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mesh-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"sourcesContent":["/**\n * Mesh orchestrator — singleton facade over the `mesh-network`\n * collection. One row per provider (Tailscale, Headscale, ZeroTier),\n * aggregated for the admin UI's Mesh Networks page.\n */\nimport {\n  BaseAddon,\n  meshOrchestratorCapability,\n  type IMeshOrchestrator,\n  type MeshProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface MeshNetworkLike {\n  getStatus?: () => Promise<{\n    joined: boolean\n    meshIp: string\n    magicDnsHostname: string\n    peerCount: number\n    endpoints: readonly {\n      id: string\n      label: string\n      scope: 'mesh' | 'public'\n      url: string\n      hostname: string\n      port: number\n      protocol: 'http' | 'https'\n    }[]\n    error?: string\n  }>\n  join?: (input: { authKey: string; hostname?: string }) => Promise<{ joined: true }>\n  leave?: () => Promise<{ left: true }>\n}\n\ninterface MeshRegistrationMeta {\n  readonly displayName?: string\n}\n\nexport class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IMeshOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      joinProvider: async ({ addonId, authKey, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.join) throw new Error(`Mesh provider \"${addonId}\" does not support join`)\n        return await impl.join({ authKey, ...(hostname ? { hostname } : {}) })\n      },\n      leaveProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.leave) await impl.leave()\n        return { success: true as const }\n      },\n    }\n    this.ctx.logger.info('Mesh orchestrator initialized')\n    return [{ capability: meshOrchestratorCapability, provider }]\n  }\n\n  private resolveImpl(addonId: string): MeshNetworkLike | null {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike>('mesh-network') ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly MeshProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike & MeshRegistrationMeta>(\n      'mesh-network',\n    ) ?? []\n    const out: MeshProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let joined = false\n      let meshIp = ''\n      let magicDnsHostname = ''\n      let peerCount = 0\n      let endpoints: MeshProviderInfo['endpoints'] = []\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          joined = s.joined\n          meshIp = s.meshIp\n          magicDnsHostname = s.magicDnsHostname\n          peerCount = s.peerCount\n          endpoints = s.endpoints\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        joined,\n        meshIp,\n        magicDnsHostname,\n        peerCount,\n        endpoints,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default MeshOrchestratorAddon\n"],"mappings":";;;;;;;AAsCA,IAAa,wBAAb,cAA2C,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAA8B;GAClC,eAAe,YAAY,KAAK,eAAe;GAC/C,cAAc,OAAO,EAAE,SAAS,SAAS,eAAe;IACtD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,yBAAyB;IACpF,OAAO,MAAM,KAAK,KAAK;KAAE;KAAS,GAAI,WAAW,EAAE,UAAU,GAAG,EAAE;KAAG,CAAC;;GAExE,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;IACnC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,gCAAgC;EACrD,OAAO,CAAC;GAAE,YAAY;GAA4B;GAAU,CAAC;;CAG/D,YAAoB,SAAyC;EAG3D,QAFgB,KAAK,cAAc,qBAAsC,eAAe,IAAI,EAAE,EACxE,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBACjC,eACD,IAAI,EAAE;EACP,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,mBAAmB;GACvB,IAAI,YAAY;GAChB,IAAI,YAA2C,EAAE;GACjD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,SAAS,EAAE;IACX,SAAS,EAAE;IACX,mBAAmB,EAAE;IACrB,YAAY,EAAE;IACd,YAAY,EAAE;IACd,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IACjC;IACA;IACA;IACA;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"mesh-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/mesh-orchestrator/mesh-orchestrator.addon.ts"],"sourcesContent":["/**\n * Mesh orchestrator — singleton facade over the `mesh-network`\n * collection. One row per provider (Tailscale, Headscale, ZeroTier),\n * aggregated for the admin UI's Mesh Networks page.\n */\nimport {\n  BaseAddon,\n  meshOrchestratorCapability,\n  type IMeshOrchestrator,\n  type MeshPeer,\n  type MeshProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface MeshStatusLike {\n  joined: boolean\n  meshIp: string\n  magicDnsHostname: string\n  peerCount: number\n  endpoints: readonly {\n    id: string\n    label: string\n    scope: 'mesh' | 'public'\n    url: string\n    hostname: string\n    port: number\n    protocol: 'http' | 'https'\n  }[]\n  error?: string\n  tenantName: string\n  magicDnsSuffix: string\n  userLogin: string | null\n  controlPlaneUrl: string\n  keyExpiry: number | null\n}\n\ninterface MeshNetworkLike {\n  getStatus?: () => Promise<MeshStatusLike>\n  join?: (input: { authKey: string; hostname?: string }) => Promise<{ joined: true }>\n  startLogin?: (input: { hostname?: string }) => Promise<{ loginUrl: string }>\n  leave?: () => Promise<{ left: true }>\n  logout?: () => Promise<{ loggedOut: true }>\n  listPeers?: () => Promise<{ peers: readonly MeshPeer[] }>\n}\n\ninterface MeshRegistrationMeta {\n  readonly displayName?: string\n}\n\nexport class MeshOrchestratorAddon extends BaseAddon<Record<string, never>> {\n  constructor() {\n    super({})\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IMeshOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      joinProvider: async ({ addonId, authKey, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.join) throw new Error(`Mesh provider \"${addonId}\" does not support join`)\n        return await impl.join({ authKey, ...(hostname ? { hostname } : {}) })\n      },\n      leaveProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.leave) await impl.leave()\n        return { success: true as const }\n      },\n      startLoginProvider: async ({ addonId, hostname }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.startLogin) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support startLogin`)\n        }\n        return await impl.startLogin(hostname ? { hostname } : {})\n      },\n      logoutProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.logout) {\n          throw new Error(`Mesh provider \"${addonId}\" does not support logout`)\n        }\n        await impl.logout()\n        return { loggedOut: true as const }\n      },\n      listProviderPeers: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.listPeers) return { peers: [] }\n        return await impl.listPeers()\n      },\n    }\n    this.ctx.logger.info('Mesh orchestrator initialized')\n    return [{ capability: meshOrchestratorCapability, provider }]\n  }\n\n  private resolveImpl(addonId: string): MeshNetworkLike | null {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike>('mesh-network') ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly MeshProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<MeshNetworkLike & MeshRegistrationMeta>(\n      'mesh-network',\n    ) ?? []\n    const out: MeshProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let joined = false\n      let meshIp = ''\n      let magicDnsHostname = ''\n      let peerCount = 0\n      let endpoints: MeshProviderInfo['endpoints'] = []\n      let error: string | undefined\n      let tenantName = ''\n      let magicDnsSuffix = ''\n      let userLogin: string | null = null\n      let controlPlaneUrl = ''\n      let keyExpiry: number | null = null\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          joined = s.joined\n          meshIp = s.meshIp\n          magicDnsHostname = s.magicDnsHostname\n          peerCount = s.peerCount\n          endpoints = s.endpoints\n          error = s.error\n          tenantName = s.tenantName\n          magicDnsSuffix = s.magicDnsSuffix\n          userLogin = s.userLogin\n          controlPlaneUrl = s.controlPlaneUrl\n          keyExpiry = s.keyExpiry\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        joined,\n        meshIp,\n        magicDnsHostname,\n        peerCount,\n        endpoints,\n        ...(error !== undefined ? { error } : {}),\n        tenantName,\n        magicDnsSuffix,\n        userLogin,\n        controlPlaneUrl,\n        keyExpiry,\n      })\n    }\n    return out\n  }\n}\n\nexport default MeshOrchestratorAddon\n"],"mappings":";;;;;;;AAiDA,IAAa,wBAAb,cAA2C,UAAiC;CAC1E,cAAc;EACZ,MAAM,EAAE,CAAC;;CAGX,MAAgB,eAAgD;EAC9D,MAAM,WAA8B;GAClC,eAAe,YAAY,KAAK,eAAe;GAC/C,cAAc,OAAO,EAAE,SAAS,SAAS,eAAe;IACtD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,MAAM,kBAAkB,QAAQ,yBAAyB;IACpF,OAAO,MAAM,KAAK,KAAK;KAAE;KAAS,GAAI,WAAW,EAAE,UAAU,GAAG,EAAE;KAAG,CAAC;;GAExE,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,OAAO,MAAM,KAAK,OAAO;IACnC,OAAO,EAAE,SAAS,MAAe;;GAEnC,oBAAoB,OAAO,EAAE,SAAS,eAAe;IACnD,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,YACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,+BAA+B;IAE3E,OAAO,MAAM,KAAK,WAAW,WAAW,EAAE,UAAU,GAAG,EAAE,CAAC;;GAE5D,gBAAgB,OAAO,EAAE,cAAc;IACrC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,QACT,MAAM,IAAI,MAAM,kBAAkB,QAAQ,2BAA2B;IAEvE,MAAM,KAAK,QAAQ;IACnB,OAAO,EAAE,WAAW,MAAe;;GAErC,mBAAmB,OAAO,EAAE,cAAc;IACxC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,WAAW,OAAO,EAAE,OAAO,EAAE,EAAE;IAC1C,OAAO,MAAM,KAAK,WAAW;;GAEhC;EACD,KAAK,IAAI,OAAO,KAAK,gCAAgC;EACrD,OAAO,CAAC;GAAE,YAAY;GAA4B;GAAU,CAAC;;CAG/D,YAAoB,SAAyC;EAG3D,QAFgB,KAAK,cAAc,qBAAsC,eAAe,IAAI,EAAE,EACxE,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAAsD;EAClE,MAAM,UAAU,KAAK,cAAc,qBACjC,eACD,IAAI,EAAE;EACP,MAAM,MAA0B,EAAE;EAClC,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,SAAS;GACb,IAAI,SAAS;GACb,IAAI,mBAAmB;GACvB,IAAI,YAAY;GAChB,IAAI,YAA2C,EAAE;GACjD,IAAI;GACJ,IAAI,aAAa;GACjB,IAAI,iBAAiB;GACrB,IAAI,YAA2B;GAC/B,IAAI,kBAAkB;GACtB,IAAI,YAA2B;GAC/B,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,SAAS,EAAE;IACX,SAAS,EAAE;IACX,mBAAmB,EAAE;IACrB,YAAY,EAAE;IACd,YAAY,EAAE;IACd,QAAQ,EAAE;IACV,aAAa,EAAE;IACf,iBAAiB,EAAE;IACnB,YAAY,EAAE;IACd,kBAAkB,EAAE;IACpB,YAAY,EAAE;YACP,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IACjC;IACA;IACA;IACA;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACxC;IACA;IACA;IACA;IACA;IACD,CAAC;;EAEJ,OAAO"}

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,SAAS,EAIT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAgBxB,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,qBAAa,6BAA8B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;;cAK1E,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAgCjD,yBAAyB;YAiCzB,WAAW;IAQzB,OAAO,CAAC,WAAW;YAQL,aAAa;CAkC5B;AAED,eAAe,6BAA6B,CAAA"}
+{"version":3,"file":"remote-access-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,SAAS,EAIT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAgBxB,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,qBAAa,6BAA8B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;;cAK1E,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAyDjD,yBAAyB;YA8CzB,WAAW;IAQzB,OAAO,CAAC,WAAW;YAQL,aAAa;CAkC5B;AAED,eAAe,6BAA6B,CAAA"}

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -43,6 +43,12 @@ var RemoteAccessOrchestratorAddon = class extends _camstack_types.BaseAddon {
 		setImmediate(() => {
 			this.autoStartEnabledProviders();
 		});
+		this.watchCapability("network-access", { onReady: () => {
+			this.autoStartEnabledProviders();
+		} });
+		this.watchCapability("mesh-network", { onReady: () => {
+			this.autoStartEnabledProviders();
+		} });
 		return [{
 			capability: _camstack_types.remoteAccessCapability,
 			provider
@@ -62,6 +68,16 @@ var RemoteAccessOrchestratorAddon = class extends _camstack_types.BaseAddon {
 				} });
 				continue;
 			}
+			if (impl.getStatus) {
+				const status = await impl.getStatus().catch(() => null);
+				if (status?.connected) {
+					this.ctx.logger.info("autostart: provider already connected — skipping", { meta: {
+						addonId,
+						url: status.endpoint?.url
+					} });
+					continue;
+				}
+			}
 			const endpoint = await impl.start();
 			this.ctx.logger.info("autostart: provider started", { meta: {
 				addonId,

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log + skip; the operator can\n          // retry from the UI when the addon is ready.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,gBAAA,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EACxD,OAAO,CAAC;GAAE,YAAY,gBAAA;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAIhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAEF,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"remote-access-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at debug level — the\n          // provider-registered subscription below will retry as soon\n          // as the addon appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every provider-registered event\n        // and prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,gBAAA,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EASxD,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAEF,OAAO,CAAC;GAAE,YAAY,gBAAA;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -38,6 +38,12 @@ var RemoteAccessOrchestratorAddon = class extends BaseAddon {
 		setImmediate(() => {
 			this.autoStartEnabledProviders();
 		});
+		this.watchCapability("network-access", { onReady: () => {
+			this.autoStartEnabledProviders();
+		} });
+		this.watchCapability("mesh-network", { onReady: () => {
+			this.autoStartEnabledProviders();
+		} });
 		return [{
 			capability: remoteAccessCapability,
 			provider
@@ -57,6 +63,16 @@ var RemoteAccessOrchestratorAddon = class extends BaseAddon {
 				} });
 				continue;
 			}
+			if (impl.getStatus) {
+				const status = await impl.getStatus().catch(() => null);
+				if (status?.connected) {
+					this.ctx.logger.info("autostart: provider already connected — skipping", { meta: {
+						addonId,
+						url: status.endpoint?.url
+					} });
+					continue;
+				}
+			}
 			const endpoint = await impl.start();
 			this.ctx.logger.info("autostart: provider started", { meta: {
 				addonId,

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log + skip; the operator can\n          // retry from the UI when the addon is ready.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EACxD,OAAO,CAAC;GAAE,YAAY;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAIhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAEF,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"remote-access-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at debug level — the\n          // provider-registered subscription below will retry as soon\n          // as the addon appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every provider-registered event\n        // and prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EASxD,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAEF,OAAO,CAAC;GAAE,YAAY;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}

package/dist/index.js

@@ -37,7 +37,7 @@ let node_vm = require("node:vm");
 node_vm = require_chunk.__toESM(node_vm);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-//#region ../types/dist/index-BBVUwOlZ.mjs
+//#region ../types/dist/index-Ce7RZWP4.mjs
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -2654,10 +2654,30 @@ var LinkStateSchema = zod.z.enum([
 	"linked",
 	"error"
 ]);
+var ExportSetupFieldSchema = zod.z.object({
+	label: zod.z.string(),
+	value: zod.z.string(),
+	/** Mask the value by default + render a reveal toggle (client id, secrets). */
+	secret: zod.z.boolean().optional()
+});
+var ExportSetupSchema = zod.z.object({
+	/** A string to render as a scannable QR — HAP `X-HM://…` URI, a pairing URL, etc. Omitted when there's nothing to scan. */
+	qr: zod.z.string().optional(),
+	/** Label/value rows shown with a copy button (HAP setup code, OAuth URLs, client id, linked-account count, …). */
+	fields: zod.z.array(ExportSetupFieldSchema).readonly().optional(),
+	/** Free-form operator instructions rendered above the fields. */
+	note: zod.z.string().optional()
+});
 var DeviceExportStatusSchema = zod.z.object({
 	linkState: LinkStateSchema,
 	exposedDeviceCount: zod.z.number(),
-	error: zod.z.string().optional()
+	error: zod.z.string().optional(),
+	/**
+	* Optional pairing/account info the panel renders in a generic
+	* "Setup" section. Addon-agnostic — the addon id identifies the
+	* export target, never an `ecosystem` key here.
+	*/
+	setup: ExportSetupSchema.optional()
 });
 var DeviceKindSchema = zod.z.string();
 var ExposedDeviceSchema = zod.z.object({
@@ -4814,7 +4834,9 @@ var MeshPeerSchema = zod.z.object({
 	id: zod.z.string(),
 	/** Hostname / device name as shown in the mesh dashboard. */
 	hostname: zod.z.string(),
-	/** Mesh IP(s). Multiple when the peer is dual-stacked. */
+	/** MagicDNS / mesh DNS name (e.g. `peer-foo.tail-abc.ts.net`). Empty when the provider doesn't support DNS or peer-side resolution is disabled. */
+	magicDns: zod.z.string(),
+	/** Mesh IPv4 / IPv6 addresses combined. Multiple when dual-stacked. */
 	addresses: zod.z.array(zod.z.string()).readonly(),
 	/** Operating system reported by the peer (informational). */
 	os: zod.z.string().optional(),
@@ -4823,7 +4845,36 @@ var MeshPeerSchema = zod.z.object({
 	/** Last-seen timestamp (epoch ms). 0 when never seen. */
 	lastSeenMs: zod.z.number(),
 	/** True for the row representing the current host. */
-	isSelf: zod.z.boolean()
+	isSelf: zod.z.boolean(),
+	/**
+	* Connection mode to this peer:
+	*   - `direct`: NAT-traversed P2P (UDP punched)
+	*   - `relay`: traffic relayed through provider edge (Tailscale DERP)
+	*   - `idle`: peer reachable but no recent traffic / handshake
+	*/
+	connection: zod.z.enum([
+		"direct",
+		"relay",
+		"idle"
+	]),
+	/** DERP region / relay node identifier when `connection: relay`. Null otherwise. */
+	relay: zod.z.string().nullable(),
+	/** Last successful handshake timestamp (epoch ms). 0 when never. */
+	lastHandshakeMs: zod.z.number(),
+	/** Bytes received from this peer since the daemon started. */
+	rxBytes: zod.z.number(),
+	/** Bytes transmitted to this peer since the daemon started. */
+	txBytes: zod.z.number(),
+	/** ACL tags this peer carries (e.g. `["tag:server"]`). Empty when human-owned. */
+	tags: zod.z.array(zod.z.string()).readonly(),
+	/** True when the peer advertises itself as an exit-node candidate. */
+	exitNodeOption: zod.z.boolean(),
+	/** Subnet routes the peer advertises (e.g. `["192.168.1.0/24"]`). */
+	advertisedRoutes: zod.z.array(zod.z.string()).readonly(),
+	/** Owner account login (e.g. `foo@example.com`). Null for tagged peers. */
+	userLogin: zod.z.string().nullable(),
+	/** Pre-auth key / machine-key expiry (epoch ms). Null when keys don't expire. */
+	keyExpiry: zod.z.number().nullable()
 });
 var MeshStatusSchema = zod.z.object({
 	/** True when the host is joined and the daemon reports healthy. */
@@ -4837,7 +4888,54 @@ var MeshStatusSchema = zod.z.object({
 	/** Every endpoint this provider exposes for the current host. */
 	endpoints: zod.z.array(MeshEndpointSchema$1).readonly(),
 	/** Last error from the daemon, when not joined. */
-	error: zod.z.string().optional()
+	error: zod.z.string().optional(),
+	/**
+	* Tenant / tailnet / network display name (Tailscale = tailnet
+	* domain, Headscale = namespace, ZeroTier = network name). Empty
+	* pre-join. Per-provider semantics, common slot.
+	*/
+	tenantName: zod.z.string(),
+	/**
+	* Mesh DNS suffix when the provider exposes peer-resolvable DNS
+	* (Tailscale MagicDNS, Headscale MagicDNS, …). Empty when the
+	* provider doesn't ship DNS (e.g. ZeroTier).
+	*/
+	magicDnsSuffix: zod.z.string(),
+	/**
+	* Authenticated user / account login bound to this host. Null when
+	* the provider authenticates with a long-lived network token rather
+	* than a user account (e.g. ZeroTier API token).
+	*/
+	userLogin: zod.z.string().nullable(),
+	/**
+	* Provider control-plane URL (Tailscale SaaS `https://login.tailscale.com`,
+	* self-hosted Headscale, ZeroTier Central, …). Empty when not
+	* applicable (rare).
+	*/
+	controlPlaneUrl: zod.z.string(),
+	/**
+	* Machine-key / node-key expiry (epoch ms). Null when the provider
+	* doesn't rotate keys for the bound host. Operator-facing surface
+	* for "your access expires on …" banners.
+	*/
+	keyExpiry: zod.z.number().nullable(),
+	/**
+	* When the provider runs its OWN mesh daemon (e.g. the Tailscale
+	* client addon in `onboard` mode spawns a private `tailscaled`),
+	* this carries the local control-socket path. Companion addons that
+	* must drive the SAME daemon — chiefly `tailscale-ingress` for
+	* Serve/Funnel — read it to point their CLI at the right socket
+	* instead of the system default. Empty when the provider uses the
+	* host's system daemon (or doesn't have the concept).
+	*/
+	daemonSocket: zod.z.string().optional(),
+	/**
+	* Path to the mesh CLI binary the provider downloaded for onboard
+	* mode. Companion addons reuse it so they don't need a system
+	* install when the operator chose a fully self-contained mesh.
+	* Empty in host mode.
+	*/
+	daemonCliPath: zod.z.string().optional()
 });
 method(zod.z.void(), MeshStatusSchema), method(zod.z.object({
 	/** Provider-specific auth key. For Tailscale this is the
@@ -4849,7 +4947,7 @@ method(zod.z.void(), MeshStatusSchema), method(zod.z.object({
 /** Optional hostname override the host should advertise once joined. */
 hostname: zod.z.string().optional() }), zod.z.object({ 
 /** Authentication URL the operator should open in a browser. */
-loginUrl: zod.z.string() }), { kind: "mutation" }), method(zod.z.void(), zod.z.object({ left: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.void(), zod.z.object({ peers: zod.z.array(MeshPeerSchema).readonly() })), method(zod.z.object({ 
+loginUrl: zod.z.string() }), { kind: "mutation" }), method(zod.z.void(), zod.z.object({ left: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.void(), zod.z.object({ loggedOut: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.void(), zod.z.object({ peers: zod.z.array(MeshPeerSchema).readonly() })), method(zod.z.object({ 
 /** Optional auth key — when provided, probes the key validity
 *  against the provider's API. Omit when already joined to
 *  just ping the daemon. */
@@ -4888,13 +4986,26 @@ var MeshProviderInfoSchema = zod.z.object({
 	/** Active endpoints (mesh IP + MagicDNS + optional public Funnel). */
 	endpoints: zod.z.array(MeshEndpointSchema).readonly(),
 	/** Last error reported by the provider. */
-	error: zod.z.string().optional()
+	error: zod.z.string().optional(),
+	/** Tenant / tailnet / network display name. Empty pre-join. */
+	tenantName: zod.z.string(),
+	/** Mesh DNS suffix (e.g. tailXXXX.ts.net). Empty when not configured. */
+	magicDnsSuffix: zod.z.string(),
+	/** Authenticated user / account login. Null for token-only providers. */
+	userLogin: zod.z.string().nullable(),
+	/** Provider control-plane URL. */
+	controlPlaneUrl: zod.z.string(),
+	/** Machine-key expiry (epoch ms). Null when keys don't rotate. */
+	keyExpiry: zod.z.number().nullable()
 });
 method(zod.z.void(), zod.z.array(MeshProviderInfoSchema).readonly()), method(zod.z.object({
 	addonId: zod.z.string(),
 	authKey: zod.z.string().min(8),
 	hostname: zod.z.string().optional()
-}), zod.z.object({ joined: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" });
+}), zod.z.object({ joined: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({
+	addonId: zod.z.string(),
+	hostname: zod.z.string().optional()
+}), zod.z.object({ loginUrl: zod.z.string() }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ loggedOut: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ peers: zod.z.array(MeshPeerSchema).readonly() }));
 var MethodAccessSchema = zod.z.enum([
 	"view",
 	"create",
@@ -4981,6 +5092,13 @@ var UserSummarySchema = zod.z.object({
 	allowedProviders: zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")]),
 	allowedDevices: zod.z.record(zod.z.string(), zod.z.union([zod.z.array(zod.z.string()), zod.z.literal("*")])),
 	scopes: zod.z.array(TokenScopeSchema).default([]),
+	/**
+	* True iff this user has a CONFIRMED TOTP enrollment. Surfaced on
+	* `listUsers` so the admin Users page can render the "Remove 2FA"
+	* action conditionally without firing one `getTotpStatus` query per
+	* row. Self-service enrollment lives on the user's profile page.
+	*/
+	totpEnabled: zod.z.boolean().default(false),
 	createdAt: zod.z.number(),
 	updatedAt: zod.z.number()
 });
@@ -5243,6 +5361,12 @@ var NodeAddonInputSchema = zod.z.object({
 	nodeId: zod.z.string(),
 	addonId: zod.z.string()
 });
+var NodeAddonEntrySchema = zod.z.object({
+	id: zod.z.string(),
+	status: zod.z.string(),
+	version: zod.z.string().optional(),
+	packageName: zod.z.string().optional()
+});
 var SuccessSchema = zod.z.object({ success: zod.z.boolean() });
 var RestartProcessResultSchema = zod.z.object({
 	success: zod.z.boolean(),
@@ -5283,7 +5407,7 @@ method(zod.z.void(), zod.z.array(TopologyNodeSchema).readonly(), { auth: "admin"
 }), RenameNodeResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(zod.z.void(), zod.z.record(zod.z.string(), ClusterAddonStatusEntrySchema), { auth: "admin" }), method(zod.z.object({
+}), method(zod.z.void(), zod.z.record(zod.z.string(), ClusterAddonStatusEntrySchema), { auth: "admin" }), method(zod.z.object({ nodeId: zod.z.string() }), zod.z.array(NodeAddonEntrySchema).readonly(), { auth: "admin" }), method(zod.z.object({
 	nodeId: zod.z.string(),
 	level: zod.z.string()
 }), SuccessSchema, {
@@ -5493,6 +5617,21 @@ var AddonAutoUpdateSchema = ChannelWithInheritSchema;
 var RestartAddonResultSchema = zod.z.unknown();
 var InstallPackageResultSchema = zod.z.unknown();
 var ReloadPackagesResultSchema = zod.z.unknown();
+var UpdateFrameworkPackageResultSchema = zod.z.object({
+	packageName: zod.z.string(),
+	fromVersion: zod.z.string(),
+	toVersion: zod.z.string(),
+	/** Ms-epoch the server scheduled its self-restart. */
+	restartingAt: zod.z.number()
+});
+var FrameworkPackageStatusSchema = zod.z.object({
+	packageName: zod.z.string(),
+	currentVersion: zod.z.string(),
+	latestVersion: zod.z.string().nullable(),
+	hasUpdate: zod.z.boolean(),
+	/** Optional manifest description for the row tooltip. */
+	description: zod.z.string().optional()
+});
 var LogStreamEntrySchema = zod.z.object({
 	timestamp: zod.z.string(),
 	level: zod.z.string(),
@@ -5524,21 +5663,43 @@ method(zod.z.void(), zod.z.array(AddonListItemSchema).readonly()), method(zod.z.
 }), method(zod.z.void(), ReloadPackagesResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(zod.z.object({ query: zod.z.string().optional() }), zod.z.array(SearchResultSchema)), method(zod.z.void(), zod.z.array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(zod.z.object({
+}), method(zod.z.object({ query: zod.z.string().optional() }), zod.z.array(SearchResultSchema)), method(zod.z.object({ nodeId: zod.z.string().optional() }), zod.z.array(PackageUpdateSchema).readonly(), { auth: "admin" }), method(zod.z.object({
 	name: zod.z.string().min(1),
-	version: zod.z.string().optional()
+	version: zod.z.string().optional(),
+	nodeId: zod.z.string().optional()
 }), zod.z.unknown(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(zod.z.object({ name: zod.z.string().min(1) }), zod.z.object({ rolledBackTo: zod.z.string().nullable() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(zod.z.void(), zod.z.unknown(), {
+}), method(zod.z.object({ nodeId: zod.z.string().optional() }), zod.z.unknown(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(zod.z.object({ confirm: zod.z.literal(true) }), zod.z.unknown(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(zod.z.void(), zod.z.object({
+	kind: zod.z.enum([
+		"framework-update",
+		"manual",
+		"system"
+	]),
+	packageName: zod.z.string().optional(),
+	fromVersion: zod.z.string().optional(),
+	toVersion: zod.z.string().optional(),
+	requestedBy: zod.z.string().optional(),
+	requestedAt: zod.z.number()
+}).nullable(), { auth: "admin" }), method(zod.z.void(), zod.z.array(FrameworkPackageStatusSchema).readonly(), { auth: "admin" }), method(zod.z.object({ capName: zod.z.string().min(1) }), zod.z.array(zod.z.object({
+	addonId: zod.z.string(),
+	mode: zod.z.enum(["singleton", "collection"]),
+	isActive: zod.z.boolean()
+})).readonly()), method(zod.z.object({
+	packageName: zod.z.string().min(1),
+	version: zod.z.string().optional()
+}), UpdateFrameworkPackageResultSchema, {
+	kind: "mutation",
+	auth: "admin"
 }), method(zod.z.object({ name: zod.z.string() }), zod.z.array(PackageVersionInfoSchema).readonly()), method(zod.z.object({ addonId: zod.z.string() }), RestartAddonResultSchema, {
 	kind: "mutation",
 	auth: "admin"