@camstack/core 0.1.37 → 0.1.38

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.d.ts

@@ -9,10 +9,16 @@ interface RemoteAccessOrchestratorConfig {
 export declare class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * Maintain the persisted `enabledProviders` set from a tunnel
+     * lifecycle event. `source.id` is `string | number`; `network-access`
+     * providers emit with `type: 'addon'` so it is always the addonId
+     * string. Non-string / non-addon sources are ignored defensively.
+     */
+    private onTunnelLifecycle;
     private autoStartEnabledProviders;
     private markEnabled;
     private resolveImpl;
-    private listProviders;
 }
 export default RemoteAccessOrchestratorAddon;
 //# sourceMappingURL=remote-access-orchestrator.addon.d.ts.map

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,SAAS,EAIT,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAgBxB,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,qBAAa,6BAA8B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;;cAK1E,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAyDjD,yBAAyB;YA8CzB,WAAW;IAQzB,OAAO,CAAC,WAAW;YAQL,aAAa;CAkC5B;AAED,eAAe,6BAA6B,CAAA"}
+{"version":3,"file":"remote-access-orchestrator.addon.d.ts","sourceRoot":"","sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EACL,SAAS,EAET,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAA;AAWxB,UAAU,8BAA8B;IACtC;;;OAGG;IACH,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAA;CAC7C;AAED,qBAAa,6BAA8B,SAAQ,SAAS,CAAC,8BAA8B,CAAC;;cAK1E,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAsD/D;;;;;OAKG;YACW,iBAAiB;YAajB,yBAAyB;YA8CzB,WAAW;IAWzB,OAAO,CAAC,WAAW;CAOpB;AAED,eAAe,6BAA6B,CAAA"}

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -6,40 +6,39 @@ require("../../chunk-C13QxCFV.js");
 let _camstack_types = require("@camstack/types");
 //#region src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts
 /**
-* Remote-access orchestrator — singleton facade over the
-* `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
-* Mirrors the auth-orchestrator and backup-orchestrator patterns.
+* Remote-access orchestrator — backend-only boot-autostart service for
+* the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
 *
-* Persistence + autostart contract:
+* Retired its `remote-access` facade cap (2026-05-15): the admin UI now
+* talks to the `network-access` collection cap directly via generic
+* per-`addonId` routing, so this addon registers NO capability.
+*
+* What it still owns — the load-bearing logic:
 *   The orchestrator owns the "operator wants this provider running"
-*   intent — a `enabledProviders: string[]` slice in its addon-store
+*   intent — an `enabledProviders: string[]` slice in its addon-store
 *   blob (BaseAddon.config). On boot we iterate the list and call
-*   `provider.start()` for each enabled entry. `startProvider` /
-*   `stopProvider` mutate this list so a Start press persists across
-*   restarts. Same shape as turn-orchestrator's setProviderEnabled.
+*   `provider.start()` for each enabled entry, so a tunnel set up once
+*   stays up across hub restarts.
+*
+*   Since start/stop no longer flow through this addon, the enabled-set
+*   is maintained purely from the event bus: every `network-access`
+*   provider emits `NetworkTunnelStarted` / `NetworkTunnelStopped` when
+*   it starts/stops. We add the emitting addonId on Started, remove it
+*   on Stopped, and persist — keeping the operator intent in sync no
+*   matter who triggered the lifecycle change.
 */
 var RemoteAccessOrchestratorAddon = class extends _camstack_types.BaseAddon {
 	constructor() {
 		super({ enabledProviders: [] });
 	}
 	async onInitialize() {
-		const provider = {
-			listProviders: async () => this.listProviders(),
-			startProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.start) throw new Error(`Remote-access provider "${addonId}" does not support start`);
-				const endpoint = await impl.start();
-				await this.markEnabled(addonId, true);
-				return endpoint;
-			},
-			stopProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (impl?.stop) await impl.stop();
-				await this.markEnabled(addonId, false);
-				return { success: true };
-			}
-		};
-		this.ctx.logger.info("Remote-access orchestrator initialized", { meta: { enabledCount: this.config.enabledProviders.length } });
+		this.ctx.logger.info("Remote-access orchestrator initialized (backend-only)", { meta: { enabledCount: this.config.enabledProviders.length } });
+		this.ctx.eventBus?.subscribe({ category: _camstack_types.EventCategory.NetworkTunnelStarted }, (event) => {
+			this.onTunnelLifecycle(event.source, true);
+		});
+		this.ctx.eventBus?.subscribe({ category: _camstack_types.EventCategory.NetworkTunnelStopped }, (event) => {
+			this.onTunnelLifecycle(event.source, false);
+		});
 		setImmediate(() => {
 			this.autoStartEnabledProviders();
 		});
@@ -49,10 +48,24 @@ var RemoteAccessOrchestratorAddon = class extends _camstack_types.BaseAddon {
 		this.watchCapability("mesh-network", { onReady: () => {
 			this.autoStartEnabledProviders();
 		} });
-		return [{
-			capability: _camstack_types.remoteAccessCapability,
-			provider
-		}];
+		return [];
+	}
+	/**
+	* Maintain the persisted `enabledProviders` set from a tunnel
+	* lifecycle event. `source.id` is `string | number`; `network-access`
+	* providers emit with `type: 'addon'` so it is always the addonId
+	* string. Non-string / non-addon sources are ignored defensively.
+	*/
+	async onTunnelLifecycle(source, started) {
+		if (source.type !== "addon" || typeof source.id !== "string") {
+			this.ctx.logger.warn("tunnel lifecycle event with non-addon source — ignoring", { meta: {
+				sourceType: source.type,
+				sourceId: source.id,
+				started
+			} });
+			return;
+		}
+		await this.markEnabled(source.id, started);
 	}
 	async autoStartEnabledProviders() {
 		const ids = this.config.enabledProviders;
@@ -96,38 +109,15 @@ var RemoteAccessOrchestratorAddon = class extends _camstack_types.BaseAddon {
 		if (enabled) current.add(addonId);
 		else current.delete(addonId);
 		if (wasEnabled === enabled) return;
+		this.ctx.logger.info("remote-access intent updated", { meta: {
+			addonId,
+			enabled
+		} });
 		await this.updateGlobalSettings({ enabledProviders: [...current] });
 	}
 	resolveImpl(addonId) {
 		return (this.capabilities?.getCollectionEntries("network-access") ?? []).find(([id]) => id === addonId)?.[1] ?? null;
 	}
-	async listProviders() {
-		const entries = this.capabilities?.getCollectionEntries("network-access") ?? [];
-		const enabled = new Set(this.config.enabledProviders);
-		const out = [];
-		for (const [addonId, impl] of entries) {
-			let connected = false;
-			let endpoint = null;
-			let error;
-			if (impl.getStatus) try {
-				const s = await impl.getStatus();
-				connected = s.connected;
-				endpoint = s.endpoint;
-				error = s.error;
-			} catch (err) {
-				error = err instanceof Error ? err.message : String(err);
-			}
-			out.push({
-				addonId,
-				displayName: impl.displayName ?? addonId,
-				enabled: enabled.has(addonId),
-				connected,
-				endpoint,
-				...error !== void 0 ? { error } : {}
-			});
-		}
-		return out;
-	}
 };
 //#endregion
 exports.RemoteAccessOrchestratorAddon = RemoteAccessOrchestratorAddon;

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at debug level — the\n          // provider-registered subscription below will retry as soon\n          // as the addon appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every provider-registered event\n        // and prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,gBAAA,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EASxD,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAEF,OAAO,CAAC;GAAE,YAAY,gBAAA;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"remote-access-orchestrator.addon.js","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — backend-only boot-autostart service for\n * the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n *\n * Retired its `remote-access` facade cap (2026-05-15): the admin UI now\n * talks to the `network-access` collection cap directly via generic\n * per-`addonId` routing, so this addon registers NO capability.\n *\n * What it still owns — the load-bearing logic:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — an `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry, so a tunnel set up once\n *   stays up across hub restarts.\n *\n *   Since start/stop no longer flow through this addon, the enabled-set\n *   is maintained purely from the event bus: every `network-access`\n *   provider emits `NetworkTunnelStarted` / `NetworkTunnelStopped` when\n *   it starts/stops. We add the emitting addonId on Started, remove it\n *   on Stopped, and persist — keeping the operator intent in sync no\n *   matter who triggered the lifecycle change.\n */\nimport {\n  BaseAddon,\n  EventCategory,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    this.ctx.logger.info('Remote-access orchestrator initialized (backend-only)', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n\n    // Track operator intent from the lifecycle events every\n    // `network-access` provider emits. The emitting addonId is carried\n    // on `event.source.id` (events are emitted with\n    // `source: { type: 'addon', id: ctx.id }`).\n    this.ctx.eventBus?.subscribe(\n      { category: EventCategory.NetworkTunnelStarted },\n      (event) => { void this.onTunnelLifecycle(event.source, true) },\n    )\n    this.ctx.eventBus?.subscribe(\n      { category: EventCategory.NetworkTunnelStopped },\n      (event) => { void this.onTunnelLifecycle(event.source, false) },\n    )\n\n    // Defer autostart to next tick so provider registrations from\n    // co-located addons settle first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { void this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Backend-only addon — registers no capability.\n    return []\n  }\n\n  /**\n   * Maintain the persisted `enabledProviders` set from a tunnel\n   * lifecycle event. `source.id` is `string | number`; `network-access`\n   * providers emit with `type: 'addon'` so it is always the addonId\n   * string. Non-string / non-addon sources are ignored defensively.\n   */\n  private async onTunnelLifecycle(\n    source: { readonly type: string; readonly id: string | number },\n    started: boolean,\n  ): Promise<void> {\n    if (source.type !== 'addon' || typeof source.id !== 'string') {\n      this.ctx.logger.warn('tunnel lifecycle event with non-addon source — ignoring', {\n        meta: { sourceType: source.type, sourceId: source.id, started },\n      })\n      return\n    }\n    await this.markEnabled(source.id, started)\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at warn level — the\n          // `watchCapability` subscriptions above retry as soon as the\n          // provider appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every ready-state event and\n        // prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    this.ctx.logger.info('remote-access intent updated', {\n      meta: { addonId, enabled },\n    })\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): NetworkAccessLike | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa,gCAAb,cAAmD,gBAAA,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,KAAK,IAAI,OAAO,KAAK,yDAAyD,EAC5E,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAMF,KAAK,IAAI,UAAU,UACjB,EAAE,UAAU,gBAAA,cAAc,sBAAsB,GAC/C,UAAU;GAAE,KAAU,kBAAkB,MAAM,QAAQ,KAAK;IAC7D;EACD,KAAK,IAAI,UAAU,UACjB,EAAE,UAAU,gBAAA,cAAc,sBAAsB,GAC/C,UAAU;GAAE,KAAU,kBAAkB,MAAM,QAAQ,MAAM;IAC9D;EAQD,mBAAmB;GAAE,KAAU,2BAA2B;IAAG;EAS7D,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAGF,OAAO,EAAE;;;;;;;;CASX,MAAc,kBACZ,QACA,SACe;EACf,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,OAAO,UAAU;GAC5D,KAAK,IAAI,OAAO,KAAK,2DAA2D,EAC9E,MAAM;IAAE,YAAY,OAAO;IAAM,UAAU,OAAO;IAAI;IAAS,EAChE,CAAC;GACF;;EAEF,MAAM,KAAK,YAAY,OAAO,IAAI,QAAQ;;CAG5C,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,KAAK,IAAI,OAAO,KAAK,gCAAgC,EACnD,MAAM;GAAE;GAAS;GAAS,EAC3B,CAAC;EACF,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA2C;EAK7D,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM"}

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,40 +1,39 @@
-import { BaseAddon, remoteAccessCapability } from "@camstack/types";
+import { BaseAddon, EventCategory } from "@camstack/types";
 //#region src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts
 /**
-* Remote-access orchestrator — singleton facade over the
-* `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
-* Mirrors the auth-orchestrator and backup-orchestrator patterns.
+* Remote-access orchestrator — backend-only boot-autostart service for
+* the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
 *
-* Persistence + autostart contract:
+* Retired its `remote-access` facade cap (2026-05-15): the admin UI now
+* talks to the `network-access` collection cap directly via generic
+* per-`addonId` routing, so this addon registers NO capability.
+*
+* What it still owns — the load-bearing logic:
 *   The orchestrator owns the "operator wants this provider running"
-*   intent — a `enabledProviders: string[]` slice in its addon-store
+*   intent — an `enabledProviders: string[]` slice in its addon-store
 *   blob (BaseAddon.config). On boot we iterate the list and call
-*   `provider.start()` for each enabled entry. `startProvider` /
-*   `stopProvider` mutate this list so a Start press persists across
-*   restarts. Same shape as turn-orchestrator's setProviderEnabled.
+*   `provider.start()` for each enabled entry, so a tunnel set up once
+*   stays up across hub restarts.
+*
+*   Since start/stop no longer flow through this addon, the enabled-set
+*   is maintained purely from the event bus: every `network-access`
+*   provider emits `NetworkTunnelStarted` / `NetworkTunnelStopped` when
+*   it starts/stops. We add the emitting addonId on Started, remove it
+*   on Stopped, and persist — keeping the operator intent in sync no
+*   matter who triggered the lifecycle change.
 */
 var RemoteAccessOrchestratorAddon = class extends BaseAddon {
 	constructor() {
 		super({ enabledProviders: [] });
 	}
 	async onInitialize() {
-		const provider = {
-			listProviders: async () => this.listProviders(),
-			startProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (!impl?.start) throw new Error(`Remote-access provider "${addonId}" does not support start`);
-				const endpoint = await impl.start();
-				await this.markEnabled(addonId, true);
-				return endpoint;
-			},
-			stopProvider: async ({ addonId }) => {
-				const impl = this.resolveImpl(addonId);
-				if (impl?.stop) await impl.stop();
-				await this.markEnabled(addonId, false);
-				return { success: true };
-			}
-		};
-		this.ctx.logger.info("Remote-access orchestrator initialized", { meta: { enabledCount: this.config.enabledProviders.length } });
+		this.ctx.logger.info("Remote-access orchestrator initialized (backend-only)", { meta: { enabledCount: this.config.enabledProviders.length } });
+		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStarted }, (event) => {
+			this.onTunnelLifecycle(event.source, true);
+		});
+		this.ctx.eventBus?.subscribe({ category: EventCategory.NetworkTunnelStopped }, (event) => {
+			this.onTunnelLifecycle(event.source, false);
+		});
 		setImmediate(() => {
 			this.autoStartEnabledProviders();
 		});
@@ -44,10 +43,24 @@ var RemoteAccessOrchestratorAddon = class extends BaseAddon {
 		this.watchCapability("mesh-network", { onReady: () => {
 			this.autoStartEnabledProviders();
 		} });
-		return [{
-			capability: remoteAccessCapability,
-			provider
-		}];
+		return [];
+	}
+	/**
+	* Maintain the persisted `enabledProviders` set from a tunnel
+	* lifecycle event. `source.id` is `string | number`; `network-access`
+	* providers emit with `type: 'addon'` so it is always the addonId
+	* string. Non-string / non-addon sources are ignored defensively.
+	*/
+	async onTunnelLifecycle(source, started) {
+		if (source.type !== "addon" || typeof source.id !== "string") {
+			this.ctx.logger.warn("tunnel lifecycle event with non-addon source — ignoring", { meta: {
+				sourceType: source.type,
+				sourceId: source.id,
+				started
+			} });
+			return;
+		}
+		await this.markEnabled(source.id, started);
 	}
 	async autoStartEnabledProviders() {
 		const ids = this.config.enabledProviders;
@@ -91,38 +104,15 @@ var RemoteAccessOrchestratorAddon = class extends BaseAddon {
 		if (enabled) current.add(addonId);
 		else current.delete(addonId);
 		if (wasEnabled === enabled) return;
+		this.ctx.logger.info("remote-access intent updated", { meta: {
+			addonId,
+			enabled
+		} });
 		await this.updateGlobalSettings({ enabledProviders: [...current] });
 	}
 	resolveImpl(addonId) {
 		return (this.capabilities?.getCollectionEntries("network-access") ?? []).find(([id]) => id === addonId)?.[1] ?? null;
 	}
-	async listProviders() {
-		const entries = this.capabilities?.getCollectionEntries("network-access") ?? [];
-		const enabled = new Set(this.config.enabledProviders);
-		const out = [];
-		for (const [addonId, impl] of entries) {
-			let connected = false;
-			let endpoint = null;
-			let error;
-			if (impl.getStatus) try {
-				const s = await impl.getStatus();
-				connected = s.connected;
-				endpoint = s.endpoint;
-				error = s.error;
-			} catch (err) {
-				error = err instanceof Error ? err.message : String(err);
-			}
-			out.push({
-				addonId,
-				displayName: impl.displayName ?? addonId,
-				enabled: enabled.has(addonId),
-				connected,
-				endpoint,
-				...error !== void 0 ? { error } : {}
-			});
-		}
-		return out;
-	}
 };
 //#endregion
 export { RemoteAccessOrchestratorAddon, RemoteAccessOrchestratorAddon as default };

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-access-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — singleton facade over the\n * `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n * Mirrors the auth-orchestrator and backup-orchestrator patterns.\n *\n * Persistence + autostart contract:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — a `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry. `startProvider` /\n *   `stopProvider` mutate this list so a Start press persists across\n *   restarts. Same shape as turn-orchestrator's setProviderEnabled.\n */\nimport {\n  BaseAddon,\n  remoteAccessCapability,\n  type IRemoteAccessOrchestrator,\n  type RemoteAccessProviderInfo,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  stop?: () => Promise<void>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface NetworkAccessRegistrationMeta {\n  readonly displayName?: string\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    const provider: IRemoteAccessOrchestrator = {\n      listProviders: async () => this.listProviders(),\n      startProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) throw new Error(`Remote-access provider \"${addonId}\" does not support start`)\n        const endpoint = await impl.start()\n        // Persist intent — next boot will auto-respawn this provider.\n        await this.markEnabled(addonId, true)\n        return endpoint\n      },\n      stopProvider: async ({ addonId }) => {\n        const impl = this.resolveImpl(addonId)\n        if (impl?.stop) await impl.stop()\n        // Clear intent — boot must NOT respawn this on next start.\n        await this.markEnabled(addonId, false)\n        return { success: true as const }\n      },\n    } satisfies IRemoteAccessOrchestrator\n    this.ctx.logger.info('Remote-access orchestrator initialized', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n    // Defer autostart to next tick so the orchestrator's own provider\n    // registration completes first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    return [{ capability: remoteAccessCapability, provider }]\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at debug level — the\n          // provider-registered subscription below will retry as soon\n          // as the addon appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every provider-registered event\n        // and prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): (NetworkAccessLike & NetworkAccessRegistrationMeta) | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n\n  private async listProviders(): Promise<readonly RemoteAccessProviderInfo[]> {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike & NetworkAccessRegistrationMeta>(\n      'network-access',\n    ) ?? []\n    const enabled = new Set(this.config.enabledProviders)\n    const out: RemoteAccessProviderInfo[] = []\n    for (const [addonId, impl] of entries) {\n      let connected = false\n      let endpoint: RemoteAccessProviderInfo['endpoint'] = null\n      let error: string | undefined\n      if (impl.getStatus) {\n        try {\n          const s = await impl.getStatus()\n          connected = s.connected\n          endpoint = s.endpoint\n          error = s.error\n        } catch (err) {\n          error = err instanceof Error ? err.message : String(err)\n        }\n      }\n      out.push({\n        addonId,\n        displayName: impl.displayName ?? addonId,\n        // `enabled` is now the operator's persisted intent — orthogonal\n        // to `connected` (which reflects the live tunnel state). Boot\n        // tries to bring enabled→connected automatically.\n        enabled: enabled.has(addonId),\n        connected,\n        endpoint,\n        ...(error !== undefined ? { error } : {}),\n      })\n    }\n    return out\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;AA2CA,IAAa,gCAAb,cAAmD,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,MAAM,WAAsC;GAC1C,eAAe,YAAY,KAAK,eAAe;GAC/C,eAAe,OAAO,EAAE,cAAc;IACpC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,2BAA2B,QAAQ,0BAA0B;IAC/F,MAAM,WAAW,MAAM,KAAK,OAAO;IAEnC,MAAM,KAAK,YAAY,SAAS,KAAK;IACrC,OAAO;;GAET,cAAc,OAAO,EAAE,cAAc;IACnC,MAAM,OAAO,KAAK,YAAY,QAAQ;IACtC,IAAI,MAAM,MAAM,MAAM,KAAK,MAAM;IAEjC,MAAM,KAAK,YAAY,SAAS,MAAM;IACtC,OAAO,EAAE,SAAS,MAAe;;GAEpC;EACD,KAAK,IAAI,OAAO,KAAK,0CAA0C,EAC7D,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAOF,mBAAmB;GAAE,KAAK,2BAA2B;IAAG;EASxD,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAEF,OAAO,CAAC;GAAE,YAAY;GAAwB;GAAU,CAAC;;CAG3D,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA6E;EAK/F,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM;;CAGvB,MAAc,gBAA8D;EAC1E,MAAM,UAAU,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE;EACP,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,MAAkC,EAAE;EAC1C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;GACrC,IAAI,YAAY;GAChB,IAAI,WAAiD;GACrD,IAAI;GACJ,IAAI,KAAK,WACP,IAAI;IACF,MAAM,IAAI,MAAM,KAAK,WAAW;IAChC,YAAY,EAAE;IACd,WAAW,EAAE;IACb,QAAQ,EAAE;YACH,KAAK;IACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;;GAG5D,IAAI,KAAK;IACP;IACA,aAAa,KAAK,eAAe;IAIjC,SAAS,QAAQ,IAAI,QAAQ;IAC7B;IACA;IACA,GAAI,UAAU,KAAA,IAAY,EAAE,OAAO,GAAG,EAAE;IACzC,CAAC;;EAEJ,OAAO"}
+{"version":3,"file":"remote-access-orchestrator.addon.mjs","names":[],"sources":["../../../src/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.ts"],"sourcesContent":["/**\n * Remote-access orchestrator — backend-only boot-autostart service for\n * the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).\n *\n * Retired its `remote-access` facade cap (2026-05-15): the admin UI now\n * talks to the `network-access` collection cap directly via generic\n * per-`addonId` routing, so this addon registers NO capability.\n *\n * What it still owns — the load-bearing logic:\n *   The orchestrator owns the \"operator wants this provider running\"\n *   intent — an `enabledProviders: string[]` slice in its addon-store\n *   blob (BaseAddon.config). On boot we iterate the list and call\n *   `provider.start()` for each enabled entry, so a tunnel set up once\n *   stays up across hub restarts.\n *\n *   Since start/stop no longer flow through this addon, the enabled-set\n *   is maintained purely from the event bus: every `network-access`\n *   provider emits `NetworkTunnelStarted` / `NetworkTunnelStopped` when\n *   it starts/stops. We add the emitting addonId on Started, remove it\n *   on Stopped, and persist — keeping the operator intent in sync no\n *   matter who triggered the lifecycle change.\n */\nimport {\n  BaseAddon,\n  EventCategory,\n  type ProviderRegistration,\n} from '@camstack/types'\n\ninterface NetworkAccessLike {\n  start?: () => Promise<{ url: string; hostname: string; port: number; protocol: 'http' | 'https' }>\n  getStatus?: () => Promise<{\n    connected: boolean\n    endpoint: { url: string; hostname: string; port: number; protocol: 'http' | 'https' } | null\n    error?: string\n  }>\n}\n\ninterface RemoteAccessOrchestratorConfig {\n  /**\n   * addonIds the operator has explicitly Started. Auto-respawned on\n   * boot so a tunnel set up once stays up across hub restarts.\n   */\n  readonly enabledProviders: readonly string[]\n}\n\nexport class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {\n  constructor() {\n    super({ enabledProviders: [] })\n  }\n\n  protected async onInitialize(): Promise<ProviderRegistration[]> {\n    this.ctx.logger.info('Remote-access orchestrator initialized (backend-only)', {\n      meta: { enabledCount: this.config.enabledProviders.length },\n    })\n\n    // Track operator intent from the lifecycle events every\n    // `network-access` provider emits. The emitting addonId is carried\n    // on `event.source.id` (events are emitted with\n    // `source: { type: 'addon', id: ctx.id }`).\n    this.ctx.eventBus?.subscribe(\n      { category: EventCategory.NetworkTunnelStarted },\n      (event) => { void this.onTunnelLifecycle(event.source, true) },\n    )\n    this.ctx.eventBus?.subscribe(\n      { category: EventCategory.NetworkTunnelStopped },\n      (event) => { void this.onTunnelLifecycle(event.source, false) },\n    )\n\n    // Defer autostart to next tick so provider registrations from\n    // co-located addons settle first. `resolveImpl` reads from the\n    // capabilities registry which only sees in-process / cluster-mirrored\n    // providers once they've ALSO registered — small delay gives the\n    // cluster bridge time to discover them on cold boot. Errors are\n    // logged but never block init.\n    setImmediate(() => { void this.autoStartEnabledProviders() })\n\n    // Lazy retry — forked providers (cloudflare-tunnel etc) typically\n    // register 15-20 s after this orchestrator boots, well past the\n    // `setImmediate` above. Hook BaseAddon's `system.ready-state`\n    // subscription so we re-run autoStart every time the\n    // `network-access` cap transitions to ready (whichever node holds\n    // it). The inner logic is idempotent + skips already-connected\n    // providers.\n    this.watchCapability('network-access', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Same watch for `mesh-network`. The tailscale-ingress provider\n    // registers `network-access` synchronously at boot, but `start()`\n    // throws when the tailnet isn't joined yet — so the boot-time\n    // autoStart call fails for tailscale ingresses if the tailscale\n    // daemon hadn't logged in by then. Watching `mesh-network` here\n    // re-triggers autoStart the moment the client transitions to\n    // joined (manual operator login or auto-rejoin), without needing\n    // a server restart. Same idempotency rules: providers already\n    // connected are skipped.\n    this.watchCapability('mesh-network', {\n      onReady: () => { void this.autoStartEnabledProviders() },\n    })\n\n    // Backend-only addon — registers no capability.\n    return []\n  }\n\n  /**\n   * Maintain the persisted `enabledProviders` set from a tunnel\n   * lifecycle event. `source.id` is `string | number`; `network-access`\n   * providers emit with `type: 'addon'` so it is always the addonId\n   * string. Non-string / non-addon sources are ignored defensively.\n   */\n  private async onTunnelLifecycle(\n    source: { readonly type: string; readonly id: string | number },\n    started: boolean,\n  ): Promise<void> {\n    if (source.type !== 'addon' || typeof source.id !== 'string') {\n      this.ctx.logger.warn('tunnel lifecycle event with non-addon source — ignoring', {\n        meta: { sourceType: source.type, sourceId: source.id, started },\n      })\n      return\n    }\n    await this.markEnabled(source.id, started)\n  }\n\n  private async autoStartEnabledProviders(): Promise<void> {\n    const ids = this.config.enabledProviders\n    if (ids.length === 0) return\n    this.ctx.logger.info('Auto-starting enabled remote-access providers', {\n      meta: { addonIds: [...ids] },\n    })\n    for (const addonId of ids) {\n      try {\n        const impl = this.resolveImpl(addonId)\n        if (!impl?.start) {\n          // Provider isn't loaded yet (worker bridge still hydrating)\n          // OR it doesn't implement start. Log at warn level — the\n          // `watchCapability` subscriptions above retry as soon as the\n          // provider appears.\n          this.ctx.logger.warn('autostart: provider not ready or unsupported', {\n            meta: { addonId, hasImpl: !!impl, hasStart: !!impl?.start },\n          })\n          continue\n        }\n        // Idempotent: skip when the provider is already connected.\n        // Avoids spamming start() on every ready-state event and\n        // prevents respawning a child process that's already alive.\n        if (impl.getStatus) {\n          const status = await impl.getStatus().catch(() => null)\n          if (status?.connected) {\n            this.ctx.logger.info('autostart: provider already connected — skipping', {\n              meta: { addonId, url: status.endpoint?.url },\n            })\n            continue\n          }\n        }\n        const endpoint = await impl.start()\n        this.ctx.logger.info('autostart: provider started', {\n          meta: { addonId, url: endpoint.url },\n        })\n      } catch (err) {\n        this.ctx.logger.error('autostart: provider start failed', {\n          meta: {\n            addonId,\n            error: err instanceof Error ? err.message : String(err),\n          },\n        })\n      }\n    }\n  }\n\n  private async markEnabled(addonId: string, enabled: boolean): Promise<void> {\n    const current = new Set(this.config.enabledProviders)\n    const wasEnabled = current.has(addonId)\n    if (enabled) current.add(addonId); else current.delete(addonId)\n    if (wasEnabled === enabled) return\n    this.ctx.logger.info('remote-access intent updated', {\n      meta: { addonId, enabled },\n    })\n    await this.updateGlobalSettings({ enabledProviders: [...current] })\n  }\n\n  private resolveImpl(addonId: string): NetworkAccessLike | null {\n    const entries = this.capabilities?.getCollectionEntries<NetworkAccessLike>(\n      'network-access',\n    ) ?? []\n    const found = entries.find(([id]) => id === addonId)\n    return found?.[1] ?? null\n  }\n}\n\nexport default RemoteAccessOrchestratorAddon\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA6CA,IAAa,gCAAb,cAAmD,UAA0C;CAC3F,cAAc;EACZ,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC;;CAGjC,MAAgB,eAAgD;EAC9D,KAAK,IAAI,OAAO,KAAK,yDAAyD,EAC5E,MAAM,EAAE,cAAc,KAAK,OAAO,iBAAiB,QAAQ,EAC5D,CAAC;EAMF,KAAK,IAAI,UAAU,UACjB,EAAE,UAAU,cAAc,sBAAsB,GAC/C,UAAU;GAAE,KAAU,kBAAkB,MAAM,QAAQ,KAAK;IAC7D;EACD,KAAK,IAAI,UAAU,UACjB,EAAE,UAAU,cAAc,sBAAsB,GAC/C,UAAU;GAAE,KAAU,kBAAkB,MAAM,QAAQ,MAAM;IAC9D;EAQD,mBAAmB;GAAE,KAAU,2BAA2B;IAAG;EAS7D,KAAK,gBAAgB,kBAAkB,EACrC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAWF,KAAK,gBAAgB,gBAAgB,EACnC,eAAe;GAAE,KAAU,2BAA2B;KACvD,CAAC;EAGF,OAAO,EAAE;;;;;;;;CASX,MAAc,kBACZ,QACA,SACe;EACf,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,OAAO,UAAU;GAC5D,KAAK,IAAI,OAAO,KAAK,2DAA2D,EAC9E,MAAM;IAAE,YAAY,OAAO;IAAM,UAAU,OAAO;IAAI;IAAS,EAChE,CAAC;GACF;;EAEF,MAAM,KAAK,YAAY,OAAO,IAAI,QAAQ;;CAG5C,MAAc,4BAA2C;EACvD,MAAM,MAAM,KAAK,OAAO;EACxB,IAAI,IAAI,WAAW,GAAG;EACtB,KAAK,IAAI,OAAO,KAAK,iDAAiD,EACpE,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI,EAAE,EAC7B,CAAC;EACF,KAAK,MAAM,WAAW,KACpB,IAAI;GACF,MAAM,OAAO,KAAK,YAAY,QAAQ;GACtC,IAAI,CAAC,MAAM,OAAO;IAKhB,KAAK,IAAI,OAAO,KAAK,gDAAgD,EACnE,MAAM;KAAE;KAAS,SAAS,CAAC,CAAC;KAAM,UAAU,CAAC,CAAC,MAAM;KAAO,EAC5D,CAAC;IACF;;GAKF,IAAI,KAAK,WAAW;IAClB,MAAM,SAAS,MAAM,KAAK,WAAW,CAAC,YAAY,KAAK;IACvD,IAAI,QAAQ,WAAW;KACrB,KAAK,IAAI,OAAO,KAAK,oDAAoD,EACvE,MAAM;MAAE;MAAS,KAAK,OAAO,UAAU;MAAK,EAC7C,CAAC;KACF;;;GAGJ,MAAM,WAAW,MAAM,KAAK,OAAO;GACnC,KAAK,IAAI,OAAO,KAAK,+BAA+B,EAClD,MAAM;IAAE;IAAS,KAAK,SAAS;IAAK,EACrC,CAAC;WACK,KAAK;GACZ,KAAK,IAAI,OAAO,MAAM,oCAAoC,EACxD,MAAM;IACJ;IACA,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IACxD,EACF,CAAC;;;CAKR,MAAc,YAAY,SAAiB,SAAiC;EAC1E,MAAM,UAAU,IAAI,IAAI,KAAK,OAAO,iBAAiB;EACrD,MAAM,aAAa,QAAQ,IAAI,QAAQ;EACvC,IAAI,SAAS,QAAQ,IAAI,QAAQ;OAAO,QAAQ,OAAO,QAAQ;EAC/D,IAAI,eAAe,SAAS;EAC5B,KAAK,IAAI,OAAO,KAAK,gCAAgC,EACnD,MAAM;GAAE;GAAS;GAAS,EAC3B,CAAC;EACF,MAAM,KAAK,qBAAqB,EAAE,kBAAkB,CAAC,GAAG,QAAQ,EAAE,CAAC;;CAGrE,YAAoB,SAA2C;EAK7D,QAJgB,KAAK,cAAc,qBACjC,iBACD,IAAI,EAAE,EACe,MAAM,CAAC,QAAQ,OAAO,QACrC,GAAQ,MAAM"}

package/dist/index.js

@@ -37,7 +37,7 @@ let node_vm = require("node:vm");
 node_vm = require_chunk.__toESM(node_vm);
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-//#region ../types/dist/index-Ce7RZWP4.mjs
+//#region ../types/dist/index-CWhQOnm9.mjs
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -3591,42 +3591,6 @@ method(zod.z.object({
 	username: zod.z.string(),
 	password: zod.z.string()
 }), AuthResultSchema.nullable(), { kind: "mutation" }), method(zod.z.object({ state: zod.z.string() }), zod.z.string()), method(zod.z.record(zod.z.string(), zod.z.string()), AuthResultSchema, { kind: "mutation" }), method(zod.z.object({ token: zod.z.string() }), AuthResultSchema.nullable());
-var AuthProviderInfoSchema = zod.z.object({
-	/** Stable id matching the addon id (used for `getLoginUrl({addonId,…})`). */
-	addonId: zod.z.string(),
-	/**
-	* Per-instance id when one addon registers multiple "logical"
-	* providers (e.g. OIDC with Google + Microsoft + custom). The login
-	* URL becomes `/addon/${addonId}/${instanceId}/start` — handler reads
-	* `:instanceId` from the route. Empty/unset means the addon is a
-	* single-instance provider; the URL is `/addon/${addonId}/start`.
-	*/
-	instanceId: zod.z.string().optional(),
-	/** Display label shown on the login button + admin row. */
-	displayName: zod.z.string(),
-	/** Optional iconography hint (lucide-react icon name OR emoji). */
-	icon: zod.z.string().optional(),
-	/** When true, the provider exposes a redirect-based login flow
-	*  (`getLoginUrl` returns a URL the browser navigates to). */
-	hasRedirectFlow: zod.z.boolean(),
-	/** When true, the provider exposes a credential-form login flow
-	*  (`validateCredentials` accepts username + password). */
-	hasCredentialFlow: zod.z.boolean(),
-	/** Provider kind, drives admin-UI hint dispatch (oidc / saml / totp / …). */
-	kind: zod.z.string().optional(),
-	/** Operator-facing status string (e.g. "Connected to https://login.acme.com"). */
-	status: zod.z.string().optional(),
-	/** When false, the provider is registered but disabled by config; the
-	*  UI surfaces it as inactive without enumerating it for login. */
-	enabled: zod.z.boolean()
-});
-method(zod.z.void(), zod.z.array(AuthProviderInfoSchema).readonly()), method(zod.z.object({
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean()
-}), zod.z.object({ success: zod.z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
 var NetworkEndpointSchema = zod.z.object({
 	url: zod.z.string(),
 	hostname: zod.z.string(),
@@ -3652,33 +3616,6 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: zod.z.number().optional()
 });
 method(zod.z.void(), NetworkEndpointSchema, { kind: "mutation" }), method(zod.z.void(), zod.z.void(), { kind: "mutation" }), method(zod.z.void(), NetworkEndpointSchema.nullable()), method(zod.z.void(), NetworkAccessStatusSchema), method(zod.z.void(), zod.z.array(NetworkEndpointEntrySchema).readonly());
-var RemoteAccessEndpointSchema = zod.z.object({
-	url: zod.z.string(),
-	hostname: zod.z.string(),
-	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
-});
-var RemoteAccessProviderInfoSchema = zod.z.object({
-	/** Stable id matching the addon id. */
-	addonId: zod.z.string(),
-	/** Display label shown on the admin row — sourced from the addon manifest. */
-	displayName: zod.z.string(),
-	/** When false, the provider is registered but disabled. */
-	enabled: zod.z.boolean(),
-	/** True when the underlying tunnel/connection is up. */
-	connected: zod.z.boolean(),
-	/** Public-facing endpoint, when connected. Null otherwise. */
-	endpoint: RemoteAccessEndpointSchema.nullable(),
-	/** Last error message (when connected=false), if available. */
-	error: zod.z.string().optional()
-});
-method(zod.z.void(), zod.z.array(RemoteAccessProviderInfoSchema).readonly()), method(zod.z.object({ addonId: zod.z.string() }), RemoteAccessEndpointSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
 var TurnServerSchema = zod.z.object({
 	/** Single URL or list of URLs (e.g. "turn:turn.example.com:3478?transport=udp"). */
 	urls: zod.z.union([zod.z.string(), zod.z.array(zod.z.string())]),
@@ -3686,33 +3623,6 @@ var TurnServerSchema = zod.z.object({
 	credential: zod.z.string().optional()
 });
 method(zod.z.void(), zod.z.array(TurnServerSchema).readonly());
-var TurnProviderInfoSchema = zod.z.object({
-	/** Stable id matching the addon id. */
-	addonId: zod.z.string(),
-	/** Display label shown on the admin row — sourced from the addon manifest. */
-	displayName: zod.z.string(),
-	/** When false, the provider is registered but disabled. */
-	enabled: zod.z.boolean(),
-	/** Number of servers this provider is currently exposing. */
-	serverCount: zod.z.number(),
-	/**
-	* Flat list of every TURN/STUN URL this provider currently exposes.
-	* One row per URL (multi-URL ICE server entries are flattened). The
-	* admin UI shows this in a compact per-provider list so operators
-	* can verify what's actually being negotiated without having to dig
-	* into the combined `getAllServers` output.
-	*/
-	urls: zod.z.array(zod.z.string()).readonly(),
-	/** Last fetch error (when serverCount=0 due to API failure), if any. */
-	error: zod.z.string().optional()
-});
-method(zod.z.void(), zod.z.array(TurnProviderInfoSchema).readonly()), method(zod.z.void(), zod.z.array(TurnServerSchema).readonly()), method(zod.z.object({
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean()
-}), zod.z.object({ success: zod.z.literal(true) }), {
-	kind: "mutation",
-	auth: "admin"
-});
 var SnapshotImageSchema = zod.z.object({
 	base64: zod.z.string(),
 	contentType: zod.z.string()
@@ -4809,7 +4719,7 @@ method(zod.z.void(), ListResultSchema), method(zod.z.void(), PreferredSchema), m
 	*  tunnel always emits `https://` regardless. */
 	scheme: zod.z.enum(["http", "https"]).optional()
 }), GetConnectionEndpointsResultSchema), method(zod.z.void(), AllowedAddressesSchema), method(AllowedAddressesSchema, zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.void(), AllowedAddressesSchema, { kind: "mutation" });
-var MeshEndpointSchema$1 = zod.z.object({
+var MeshEndpointSchema = zod.z.object({
 	/** Stable identifier within the provider (e.g. `mesh-ipv4`, `magicdns`, `funnel`). */
 	id: zod.z.string(),
 	/** Operator-facing label (e.g. "Mesh IPv4", "MagicDNS"). */
@@ -4886,7 +4796,7 @@ var MeshStatusSchema = zod.z.object({
 	/** Number of peers visible to this host (excluding self). */
 	peerCount: zod.z.number(),
 	/** Every endpoint this provider exposes for the current host. */
-	endpoints: zod.z.array(MeshEndpointSchema$1).readonly(),
+	endpoints: zod.z.array(MeshEndpointSchema).readonly(),
 	/** Last error from the daemon, when not joined. */
 	error: zod.z.string().optional(),
 	/**
@@ -4961,51 +4871,6 @@ authKey: zod.z.string().optional() }), zod.z.object({
 	/** Human-readable error when `ok: false`. */
 	error: zod.z.string().optional()
 }), { kind: "mutation" });
-var MeshEndpointSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	scope: zod.z.enum(["mesh", "public"]),
-	url: zod.z.string(),
-	hostname: zod.z.string(),
-	port: zod.z.number(),
-	protocol: zod.z.enum(["http", "https"])
-});
-var MeshProviderInfoSchema = zod.z.object({
-	/** Stable id matching the addon id. */
-	addonId: zod.z.string(),
-	/** Display label shown on the admin row — sourced from the addon manifest. */
-	displayName: zod.z.string(),
-	/** True when the host is joined to this provider's mesh. */
-	joined: zod.z.boolean(),
-	/** Local mesh IP (empty when not joined). */
-	meshIp: zod.z.string(),
-	/** MagicDNS / mesh hostname (empty when not configured). */
-	magicDnsHostname: zod.z.string(),
-	/** Peer count (excluding self). */
-	peerCount: zod.z.number(),
-	/** Active endpoints (mesh IP + MagicDNS + optional public Funnel). */
-	endpoints: zod.z.array(MeshEndpointSchema).readonly(),
-	/** Last error reported by the provider. */
-	error: zod.z.string().optional(),
-	/** Tenant / tailnet / network display name. Empty pre-join. */
-	tenantName: zod.z.string(),
-	/** Mesh DNS suffix (e.g. tailXXXX.ts.net). Empty when not configured. */
-	magicDnsSuffix: zod.z.string(),
-	/** Authenticated user / account login. Null for token-only providers. */
-	userLogin: zod.z.string().nullable(),
-	/** Provider control-plane URL. */
-	controlPlaneUrl: zod.z.string(),
-	/** Machine-key expiry (epoch ms). Null when keys don't rotate. */
-	keyExpiry: zod.z.number().nullable()
-});
-method(zod.z.void(), zod.z.array(MeshProviderInfoSchema).readonly()), method(zod.z.object({
-	addonId: zod.z.string(),
-	authKey: zod.z.string().min(8),
-	hostname: zod.z.string().optional()
-}), zod.z.object({ joined: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ success: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({
-	addonId: zod.z.string(),
-	hostname: zod.z.string().optional()
-}), zod.z.object({ loginUrl: zod.z.string() }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ loggedOut: zod.z.literal(true) }), { kind: "mutation" }), method(zod.z.object({ addonId: zod.z.string() }), zod.z.object({ peers: zod.z.array(MeshPeerSchema).readonly() }));
 var MethodAccessSchema = zod.z.enum([
 	"view",
 	"create",
@@ -5695,6 +5560,13 @@ method(zod.z.void(), zod.z.array(AddonListItemSchema).readonly()), method(zod.z.
 	mode: zod.z.enum(["singleton", "collection"]),
 	isActive: zod.z.boolean()
 })).readonly()), method(zod.z.object({
+	capName: zod.z.string().min(1),
+	addonId: zod.z.string().min(1),
+	enabled: zod.z.boolean()
+}), zod.z.object({ success: zod.z.literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(zod.z.object({
 	packageName: zod.z.string().min(1),
 	version: zod.z.string().optional()
 }), UpdateFrameworkPackageResultSchema, {