@camstack/kernel 0.1.7 → 0.1.9

package/dist/index.mjs

@@ -1,1522 +1,1313 @@
 import {
-  require_worker_process_manager
-} from "./chunk-RHK5CCAL.mjs";
+  WorkerProcessManager
+} from "./chunk-S5YWNNPK.mjs";
 import {
-  require_addon_installer,
-  require_fs_utils
-} from "./chunk-GJ3DKNOD.mjs";
-import {
-  __commonJS,
-  __require,
-  __toESM
-} from "./chunk-LZOMFHX3.mjs";
+  AddonInstaller,
+  copyDirRecursive,
+  copyExtraFileDirs,
+  ensureDir,
+  ensureLibraryBuilt,
+  installPackageFromNpmSync,
+  isSourceNewer,
+  stripCamstackDeps,
+  symlinkAddonsToNodeModules
+} from "./chunk-67QMERMP.mjs";
 
-// src/addon-loader.js
-var require_addon_loader = __commonJS({
-  "src/addon-loader.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
+// src/addon-loader.ts
+import * as fs from "fs";
+import * as path from "path";
+function resolveAddonClass(mod) {
+  let candidate = mod["default"] ?? mod[Object.keys(mod)[0]];
+  if (candidate && typeof candidate === "object" && "default" in candidate) {
+    candidate = candidate["default"];
+  }
+  return typeof candidate === "function" ? candidate : void 0;
+}
+var AddonLoader = class {
+  addons = /* @__PURE__ */ new Map();
+  /** Scan addons directory and load all addon packages.
+   *  Supports scoped layout: addons/@scope/package-name/ */
+  async loadFromDirectory(addonsDir) {
+    if (!fs.existsSync(addonsDir)) return;
+    const entries = fs.readdirSync(addonsDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith("@")) {
+        const scopeDir = path.join(addonsDir, entry.name);
+        const scopeEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
+        for (const scopeEntry of scopeEntries) {
+          if (!scopeEntry.isDirectory()) continue;
+          await this.tryLoadAddon(path.join(scopeDir, scopeEntry.name));
+        }
+        continue;
+      }
+      await this.tryLoadAddon(path.join(addonsDir, entry.name));
+    }
+  }
+  async tryLoadAddon(addonDir) {
+    const pkgJsonPath = path.join(addonDir, "package.json");
+    if (!fs.existsSync(pkgJsonPath)) return;
+    try {
+      await this.loadFromAddonDir(addonDir);
+    } catch (err) {
+      console.warn(`Failed to load addon from ${addonDir}: ${err}`);
+    }
+  }
+  /** Load addon from a specific directory (package.json + dist/) */
+  async loadFromAddonDir(addonDir) {
+    const pkgJsonPath = path.join(addonDir, "package.json");
+    const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    const packageName = pkgJson["name"];
+    const packageVersion = pkgJson["version"] ?? "0.0.0";
+    const manifest = pkgJson["camstack"];
+    if (!manifest?.addons?.length) return;
+    for (const declaration of manifest.addons) {
+      const entryFile = declaration.entry.replace(/^\.\//, "").replace(/^src\//, "dist/").replace(/\.ts$/, ".js");
+      let entryPath = path.resolve(addonDir, entryFile);
+      if (!fs.existsSync(entryPath)) {
+        const base = entryPath.replace(/\.(js|cjs|mjs)$/, "");
+        const alternatives = [
+          `${base}.cjs`,
+          `${base}.mjs`,
+          path.resolve(addonDir, "dist", "index.js"),
+          path.resolve(addonDir, "dist", "index.cjs"),
+          path.resolve(addonDir, "dist", "index.mjs"),
+          path.resolve(addonDir, declaration.entry)
+        ];
+        entryPath = alternatives.find((p) => fs.existsSync(p)) ?? entryPath;
+      }
+      if (!fs.existsSync(entryPath)) {
+        throw new Error(`Entry not found: ${entryPath}`);
+      }
+      const mod = await import(entryPath);
+      const AddonClass = resolveAddonClass(mod);
+      if (!AddonClass) {
+        throw new Error(`No addon class in ${entryPath}`);
+      }
+      this.addons.set(declaration.id, {
+        declaration,
+        packageName,
+        packageVersion,
+        packageDisplayName: manifest.displayName,
+        addonClass: AddonClass
+      });
+    }
+  }
+  /** Load addon from a direct path (for development/testing) */
+  async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
+    const mod = await import(modulePath);
+    const AddonClass = resolveAddonClass(mod);
+    if (!AddonClass) {
+      throw new Error(`Module ${modulePath} has no default export`);
+    }
+    this.addons.set(addonId, {
+      declaration: {
+        id: addonId,
+        entry: modulePath,
+        slot: "detector",
+        ...declaration
+      },
+      packageName,
+      packageVersion,
+      addonClass: AddonClass
     });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AddonLoader = void 0;
-    var fs = __importStar(__require("fs"));
-    var path = __importStar(__require("path"));
-    function resolveAddonClass(mod) {
-      let candidate = mod["default"] ?? mod[Object.keys(mod)[0]];
-      if (candidate && typeof candidate === "object" && "default" in candidate) {
-        candidate = candidate["default"];
-      }
-      return typeof candidate === "function" ? candidate : void 0;
+  }
+  /** Get a registered addon by ID */
+  getAddon(addonId) {
+    return this.addons.get(addonId);
+  }
+  /** List all registered addons */
+  listAddons() {
+    return [...this.addons.values()];
+  }
+  /** Check if an addon is registered */
+  hasAddon(addonId) {
+    return this.addons.has(addonId);
+  }
+  /** Create a new instance of an addon (not yet initialized) */
+  createInstance(addonId) {
+    const registered = this.addons.get(addonId);
+    if (!registered) {
+      throw new Error(`Addon "${addonId}" is not registered`);
     }
-    var AddonLoader2 = class {
-      addons = /* @__PURE__ */ new Map();
-      /** Scan addons directory and load all addon packages.
-       *  Supports scoped layout: addons/@scope/package-name/ */
-      async loadFromDirectory(addonsDir) {
-        if (!fs.existsSync(addonsDir))
-          return;
-        const entries = fs.readdirSync(addonsDir, { withFileTypes: true });
-        for (const entry of entries) {
-          if (!entry.isDirectory())
-            continue;
-          if (entry.name.startsWith("@")) {
-            const scopeDir = path.join(addonsDir, entry.name);
-            const scopeEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
-            for (const scopeEntry of scopeEntries) {
-              if (!scopeEntry.isDirectory())
-                continue;
-              await this.tryLoadAddon(path.join(scopeDir, scopeEntry.name));
-            }
-            continue;
-          }
-          await this.tryLoadAddon(path.join(addonsDir, entry.name));
-        }
-      }
-      async tryLoadAddon(addonDir) {
-        const pkgJsonPath = path.join(addonDir, "package.json");
-        if (!fs.existsSync(pkgJsonPath))
-          return;
-        try {
-          await this.loadFromAddonDir(addonDir);
-        } catch (err) {
-          console.warn(`Failed to load addon from ${addonDir}: ${err}`);
-        }
-      }
-      /** Load addon from a specific directory (package.json + dist/) */
-      async loadFromAddonDir(addonDir) {
-        const pkgJsonPath = path.join(addonDir, "package.json");
-        const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
-        const packageName = pkgJson["name"];
-        const packageVersion = pkgJson["version"] ?? "0.0.0";
-        const manifest = pkgJson["camstack"];
-        if (!manifest?.addons?.length)
-          return;
-        for (const declaration of manifest.addons) {
-          const entryFile = declaration.entry.replace(/^\.\//, "").replace(/^src\//, "dist/").replace(/\.ts$/, ".js");
-          let entryPath = path.resolve(addonDir, entryFile);
-          if (!fs.existsSync(entryPath)) {
-            const base = entryPath.replace(/\.(js|cjs|mjs)$/, "");
-            const alternatives = [
-              `${base}.cjs`,
-              `${base}.mjs`,
-              path.resolve(addonDir, "dist", "index.js"),
-              path.resolve(addonDir, "dist", "index.cjs"),
-              path.resolve(addonDir, "dist", "index.mjs"),
-              path.resolve(addonDir, declaration.entry)
-            ];
-            entryPath = alternatives.find((p) => fs.existsSync(p)) ?? entryPath;
-          }
-          if (!fs.existsSync(entryPath)) {
-            throw new Error(`Entry not found: ${entryPath}`);
-          }
-          const mod = await Promise.resolve(`${entryPath}`).then((s) => __importStar(__require(s)));
-          const AddonClass = resolveAddonClass(mod);
-          if (!AddonClass) {
-            throw new Error(`No addon class in ${entryPath}`);
-          }
-          this.addons.set(declaration.id, {
-            declaration,
-            packageName,
-            packageVersion,
-            packageDisplayName: manifest.displayName,
-            addonClass: AddonClass
-          });
-        }
-      }
-      /** Load addon from a direct path (for development/testing) */
-      async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
-        const mod = await Promise.resolve(`${modulePath}`).then((s) => __importStar(__require(s)));
-        const AddonClass = resolveAddonClass(mod);
-        if (!AddonClass) {
-          throw new Error(`Module ${modulePath} has no default export`);
-        }
-        this.addons.set(addonId, {
-          declaration: {
-            id: addonId,
-            entry: modulePath,
-            slot: "detector",
-            ...declaration
-          },
-          packageName,
-          packageVersion,
-          addonClass: AddonClass
-        });
-      }
-      /** Get a registered addon by ID */
-      getAddon(addonId) {
-        return this.addons.get(addonId);
-      }
-      /** List all registered addons */
-      listAddons() {
-        return [...this.addons.values()];
-      }
-      /** Check if an addon is registered */
-      hasAddon(addonId) {
-        return this.addons.has(addonId);
-      }
-      /** Create a new instance of an addon (not yet initialized) */
-      createInstance(addonId) {
-        const registered = this.addons.get(addonId);
-        if (!registered) {
-          throw new Error(`Addon "${addonId}" is not registered`);
-        }
-        return new registered.addonClass();
-      }
-    };
-    exports.AddonLoader = AddonLoader2;
+    return new registered.addonClass();
   }
-});
+};
 
-// src/addon-engine-manager.js
-var require_addon_engine_manager = __commonJS({
-  "src/addon-engine-manager.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AddonEngineManager = void 0;
-    var node_crypto_1 = __require("crypto");
-    var AddonEngineManager2 = class {
-      loader;
-      baseContext;
-      engines = /* @__PURE__ */ new Map();
-      constructor(loader, baseContext) {
-        this.loader = loader;
-        this.baseContext = baseContext;
-      }
-      /**
-       * Get or create an addon engine for the given effective config.
-       * Cameras with the same addonId + effective config share the same engine.
-       */
-      async getOrCreateEngine(addonId, globalConfig, cameraOverride) {
-        const effectiveConfig = { ...globalConfig, ...cameraOverride };
-        const configKey = `${addonId}:${this.hashConfig(effectiveConfig)}`;
-        const existing = this.engines.get(configKey);
-        if (existing)
-          return existing;
-        const addon = this.loader.createInstance(addonId);
-        await addon.initialize({ ...this.baseContext, addonConfig: effectiveConfig });
-        this.engines.set(configKey, addon);
-        return addon;
-      }
-      /** Get all active engines */
-      getActiveEngines() {
-        return new Map(this.engines);
-      }
-      /** Shutdown a specific engine by its config key */
-      async shutdownEngine(configKey) {
-        const engine = this.engines.get(configKey);
-        if (engine) {
-          await engine.shutdown();
-          this.engines.delete(configKey);
-        }
-      }
-      /** Shutdown all engines */
-      async shutdownAll() {
-        for (const [, engine] of this.engines) {
-          await engine.shutdown();
-        }
-        this.engines.clear();
-      }
-      /** Compute a deterministic config key (visible for tests) */
-      computeConfigKey(addonId, effectiveConfig) {
-        return `${addonId}:${this.hashConfig(effectiveConfig)}`;
-      }
-      hashConfig(config) {
-        const sorted = JSON.stringify(config, Object.keys(config).sort());
-        return (0, node_crypto_1.createHash)("md5").update(sorted).digest("hex").slice(0, 12);
-      }
-    };
-    exports.AddonEngineManager = AddonEngineManager2;
+// src/addon-engine-manager.ts
+import { createHash } from "crypto";
+var AddonEngineManager = class {
+  constructor(loader, baseContext) {
+    this.loader = loader;
+    this.baseContext = baseContext;
   }
-});
+  engines = /* @__PURE__ */ new Map();
+  /**
+   * Get or create an addon engine for the given effective config.
+   * Cameras with the same addonId + effective config share the same engine.
+   */
+  async getOrCreateEngine(addonId, globalConfig, cameraOverride) {
+    const effectiveConfig = { ...globalConfig, ...cameraOverride };
+    const configKey = `${addonId}:${this.hashConfig(effectiveConfig)}`;
+    const existing = this.engines.get(configKey);
+    if (existing) return existing;
+    const addon = this.loader.createInstance(addonId);
+    await addon.initialize({ ...this.baseContext, addonConfig: effectiveConfig });
+    this.engines.set(configKey, addon);
+    return addon;
+  }
+  /** Get all active engines */
+  getActiveEngines() {
+    return new Map(this.engines);
+  }
+  /** Shutdown a specific engine by its config key */
+  async shutdownEngine(configKey) {
+    const engine = this.engines.get(configKey);
+    if (engine) {
+      await engine.shutdown();
+      this.engines.delete(configKey);
+    }
+  }
+  /** Shutdown all engines */
+  async shutdownAll() {
+    for (const [, engine] of this.engines) {
+      await engine.shutdown();
+    }
+    this.engines.clear();
+  }
+  /** Compute a deterministic config key (visible for tests) */
+  computeConfigKey(addonId, effectiveConfig) {
+    return `${addonId}:${this.hashConfig(effectiveConfig)}`;
+  }
+  hashConfig(config) {
+    const sorted = JSON.stringify(config, Object.keys(config).sort());
+    return createHash("md5").update(sorted).digest("hex").slice(0, 12);
+  }
+};
 
-// src/workspace-detect.js
-var require_workspace_detect = __commonJS({
-  "src/workspace-detect.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
+// src/workspace-detect.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+function detectWorkspacePackagesDir(startDir) {
+  let current = path2.resolve(startDir);
+  for (let i = 0; i < 6; i++) {
+    current = path2.dirname(current);
+    const packagesDir = path2.join(current, "packages");
+    const rootPkgJson = path2.join(current, "package.json");
+    if (fs2.existsSync(packagesDir) && fs2.existsSync(rootPkgJson)) {
+      try {
+        const rootPkg = JSON.parse(fs2.readFileSync(rootPkgJson, "utf-8"));
+        if (rootPkg.workspaces || rootPkg.name === "camstack-server" || rootPkg.name === "camstack") {
+          return packagesDir;
+        }
+      } catch {
       }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
+    }
+  }
+  return null;
+}
+
+// src/capability-registry.ts
+var CapabilityRegistry = class {
+  constructor(logger, configReader) {
+    this.logger = logger;
+    this.configReader = configReader;
+  }
+  capabilities = /* @__PURE__ */ new Map();
+  /** Per-device singleton overrides: deviceId → (capability → addonId) */
+  deviceOverrides = /* @__PURE__ */ new Map();
+  /** Per-device collection filters: deviceId → (capability → addonIds[]) */
+  deviceCollectionFilters = /* @__PURE__ */ new Map();
+  /**
+   * Declare a capability (typically called when addon manifests are loaded).
+   * Must be called before registerProvider/registerConsumer for that capability.
+   */
+  declareCapability(declaration) {
+    if (this.capabilities.has(declaration.name)) {
+      this.logger.debug(`Capability "${declaration.name}" already declared, skipping`);
+      return;
+    }
+    this.capabilities.set(declaration.name, {
+      declaration,
+      available: /* @__PURE__ */ new Map(),
+      activeAddonId: null,
+      activeProvider: null,
+      activeCollection: [],
+      consumers: /* @__PURE__ */ new Set()
     });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir2;
-    var fs = __importStar(__require("fs"));
-    var path = __importStar(__require("path"));
-    function detectWorkspacePackagesDir2(startDir) {
-      let current = path.resolve(startDir);
-      for (let i = 0; i < 6; i++) {
-        current = path.dirname(current);
-        const packagesDir = path.join(current, "packages");
-        const rootPkgJson = path.join(current, "package.json");
-        if (fs.existsSync(packagesDir) && fs.existsSync(rootPkgJson)) {
+    this.logger.debug(`Capability declared: ${declaration.name} (mode=${declaration.mode})`);
+  }
+  /**
+   * Register a capability provider (called by addon loader when addon is enabled).
+   * For singleton: auto-activates if user-preferred or first registered.
+   * For collection: adds to active set and notifies consumers.
+   */
+  registerProvider(capability, addonId, provider) {
+    const state = this.capabilities.get(capability);
+    if (!state) {
+      this.logger.warn(`Cannot register provider for undeclared capability "${capability}"`);
+      return;
+    }
+    state.available.set(addonId, provider);
+    this.logger.info(`Provider registered: ${addonId} \u2192 ${capability}`);
+    if (state.declaration.mode === "singleton") {
+      const userChoice = this.configReader(capability);
+      if (userChoice === addonId) {
+        this.activateSingleton(state, addonId, provider);
+      } else if (userChoice === void 0 && state.activeAddonId === null) {
+        this.activateSingleton(state, addonId, provider);
+      }
+    } else {
+      state.activeCollection.push({ addonId, provider });
+      for (const consumer of state.consumers) {
+        if (consumer.onAdded) {
           try {
-            const rootPkg = JSON.parse(fs.readFileSync(rootPkgJson, "utf-8"));
-            if (rootPkg.workspaces || rootPkg.name === "camstack-server" || rootPkg.name === "camstack") {
-              return packagesDir;
-            }
-          } catch {
+            consumer.onAdded(provider);
+          } catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            this.logger.error(`Consumer onAdded failed for ${capability}: ${msg}`);
           }
         }
       }
-      return null;
     }
   }
-});
-
-// src/capability-registry.js
-var require_capability_registry = __commonJS({
-  "src/capability-registry.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.CapabilityRegistry = void 0;
-    var CapabilityRegistry2 = class {
-      logger;
-      configReader;
-      capabilities = /* @__PURE__ */ new Map();
-      /** Per-device singleton overrides: deviceId → (capability → addonId) */
-      deviceOverrides = /* @__PURE__ */ new Map();
-      /** Per-device collection filters: deviceId → (capability → addonIds[]) */
-      deviceCollectionFilters = /* @__PURE__ */ new Map();
-      constructor(logger, configReader) {
-        this.logger = logger;
-        this.configReader = configReader;
-      }
-      /**
-       * Declare a capability (typically called when addon manifests are loaded).
-       * Must be called before registerProvider/registerConsumer for that capability.
-       */
-      declareCapability(declaration) {
-        if (this.capabilities.has(declaration.name)) {
-          this.logger.debug(`Capability "${declaration.name}" already declared, skipping`);
-          return;
-        }
-        this.capabilities.set(declaration.name, {
-          declaration,
-          available: /* @__PURE__ */ new Map(),
-          activeAddonId: null,
-          activeProvider: null,
-          activeCollection: [],
-          consumers: /* @__PURE__ */ new Set()
-        });
-        this.logger.debug(`Capability declared: ${declaration.name} (mode=${declaration.mode})`);
-      }
-      /**
-       * Register a capability provider (called by addon loader when addon is enabled).
-       * For singleton: auto-activates if user-preferred or first registered.
-       * For collection: adds to active set and notifies consumers.
-       */
-      registerProvider(capability, addonId, provider) {
-        const state = this.capabilities.get(capability);
-        if (!state) {
-          this.logger.warn(`Cannot register provider for undeclared capability "${capability}"`);
-          return;
-        }
-        state.available.set(addonId, provider);
-        this.logger.info(`Provider registered: ${addonId} \u2192 ${capability}`);
-        if (state.declaration.mode === "singleton") {
-          const userChoice = this.configReader(capability);
-          if (userChoice === addonId) {
-            this.activateSingleton(state, addonId, provider);
-          } else if (userChoice === void 0 && state.activeAddonId === null) {
-            this.activateSingleton(state, addonId, provider);
-          }
-        } else {
-          state.activeCollection.push({ addonId, provider });
-          for (const consumer of state.consumers) {
-            if (consumer.onAdded) {
-              try {
-                consumer.onAdded(provider);
-              } catch (error) {
-                const msg = error instanceof Error ? error.message : String(error);
-                this.logger.error(`Consumer onAdded failed for ${capability}: ${msg}`);
-              }
-            }
-          }
-        }
-      }
-      /**
-       * Unregister a provider (called when addon is disabled/uninstalled).
-       */
-      unregisterProvider(capability, addonId) {
-        const state = this.capabilities.get(capability);
-        if (!state)
-          return;
-        const provider = state.available.get(addonId);
-        state.available.delete(addonId);
-        if (state.declaration.mode === "singleton") {
-          if (state.activeAddonId === addonId) {
-            state.activeAddonId = null;
-            state.activeProvider = null;
-            this.logger.info(`Singleton deactivated: ${capability} (was ${addonId})`);
-          }
-        } else {
-          const idx = state.activeCollection.findIndex((e) => e.addonId === addonId);
-          if (idx !== -1) {
-            state.activeCollection.splice(idx, 1);
-            for (const consumer of state.consumers) {
-              if (consumer.onRemoved && provider !== void 0) {
-                try {
-                  consumer.onRemoved(provider);
-                } catch (error) {
-                  const msg = error instanceof Error ? error.message : String(error);
-                  this.logger.error(`Consumer onRemoved failed for ${capability}: ${msg}`);
-                }
-              }
-            }
-          }
-        }
-      }
-      /**
-       * Register a consumer that wants to be notified when providers change.
-       * If a provider is already active, the consumer is immediately notified.
-       * Returns a disposer function for cleanup.
-       */
-      registerConsumer(registration) {
-        const state = this.capabilities.get(registration.capability);
-        if (!state) {
-          this.logger.debug(`Consumer registered for undeclared capability "${registration.capability}" \u2014 auto-declaring`);
-          this.declareCapability({ name: registration.capability, mode: "singleton" });
-          return this.registerConsumer(registration);
-        }
-        const untypedReg = registration;
-        state.consumers.add(untypedReg);
-        if (state.declaration.mode === "singleton") {
-          if (state.activeProvider !== null && registration.onSet) {
+  /**
+   * Unregister a provider (called when addon is disabled/uninstalled).
+   */
+  unregisterProvider(capability, addonId) {
+    const state = this.capabilities.get(capability);
+    if (!state) return;
+    const provider = state.available.get(addonId);
+    state.available.delete(addonId);
+    if (state.declaration.mode === "singleton") {
+      if (state.activeAddonId === addonId) {
+        state.activeAddonId = null;
+        state.activeProvider = null;
+        this.logger.info(`Singleton deactivated: ${capability} (was ${addonId})`);
+      }
+    } else {
+      const idx = state.activeCollection.findIndex((e) => e.addonId === addonId);
+      if (idx !== -1) {
+        state.activeCollection.splice(idx, 1);
+        for (const consumer of state.consumers) {
+          if (consumer.onRemoved && provider !== void 0) {
             try {
-              registration.onSet(state.activeProvider);
+              consumer.onRemoved(provider);
             } catch (error) {
               const msg = error instanceof Error ? error.message : String(error);
-              this.logger.error(`Consumer onSet (immediate) failed for ${registration.capability}: ${msg}`);
-            }
-          }
-        } else {
-          if (registration.onAdded) {
-            for (const entry of state.activeCollection) {
-              try {
-                registration.onAdded(entry.provider);
-              } catch (error) {
-                const msg = error instanceof Error ? error.message : String(error);
-                this.logger.error(`Consumer onAdded (immediate) failed for ${registration.capability}: ${msg}`);
-              }
-            }
-          }
-        }
-        return () => {
-          state.consumers.delete(untypedReg);
-        };
-      }
-      /**
-       * Get the active singleton provider for a capability.
-       * Returns null if none set.
-       */
-      getSingleton(capability) {
-        const state = this.capabilities.get(capability);
-        if (!state || state.declaration.mode !== "singleton")
-          return null;
-        return state.activeProvider ?? null;
-      }
-      /**
-       * Get all active collection providers for a capability.
-       */
-      getCollection(capability) {
-        const state = this.capabilities.get(capability);
-        if (!state || state.declaration.mode !== "collection")
-          return [];
-        return state.activeCollection.map((e) => e.provider);
-      }
-      /**
-       * Set which addon should be the active singleton for a capability.
-       * Call with `immediate: true` to also swap the runtime provider now
-       * (consumers' onSet will be awaited).
-       */
-      async setActiveSingleton(capability, addonId, immediate = false) {
-        const state = this.capabilities.get(capability);
-        if (!state) {
-          throw new Error(`Unknown capability: ${capability}`);
-        }
-        if (state.declaration.mode !== "singleton") {
-          throw new Error(`Capability "${capability}" is not a singleton`);
-        }
-        const provider = state.available.get(addonId);
-        if (!provider) {
-          throw new Error(`No provider "${addonId}" registered for capability "${capability}"`);
-        }
-        if (immediate) {
-          await this.activateSingletonAsync(state, addonId, provider);
-        }
-        this.logger.info(`Singleton preference set: ${capability} \u2192 ${addonId}`);
-      }
-      /**
-       * Get the mode declared for a capability.
-       */
-      getMode(capability) {
-        return this.capabilities.get(capability)?.declaration.mode;
-      }
-      /**
-       * List all registered capabilities with their providers.
-       */
-      listCapabilities() {
-        const result = [];
-        for (const [name, state] of this.capabilities) {
-          result.push({
-            name,
-            mode: state.declaration.mode,
-            providers: [...state.available.keys()],
-            activeProvider: state.activeAddonId
-          });
-        }
-        return result;
-      }
-      /**
-       * Check if all dependencies for a capability are satisfied (have active providers).
-       */
-      areDependenciesMet(declaration) {
-        if (!declaration.dependsOn?.length)
-          return true;
-        return declaration.dependsOn.every((dep) => {
-          const state = this.capabilities.get(dep);
-          if (!state)
-            return false;
-          if (state.declaration.mode === "singleton") {
-            return state.activeProvider !== null;
-          }
-          return state.activeCollection.length > 0;
-        });
-      }
-      /**
-       * Get the dependency-ordered list of capability names for boot sequencing.
-       * Returns capabilities sorted topologically by dependsOn.
-       * Throws if a cycle is detected.
-       */
-      getBootOrder() {
-        const visited = /* @__PURE__ */ new Set();
-        const visiting = /* @__PURE__ */ new Set();
-        const order = [];
-        const visit = (name) => {
-          if (visited.has(name))
-            return;
-          if (visiting.has(name)) {
-            throw new Error(`Circular dependency detected involving capability "${name}"`);
-          }
-          visiting.add(name);
-          const state = this.capabilities.get(name);
-          if (state?.declaration.dependsOn) {
-            for (const dep of state.declaration.dependsOn) {
-              visit(dep);
+              this.logger.error(`Consumer onRemoved failed for ${capability}: ${msg}`);
             }
           }
-          visiting.delete(name);
-          visited.add(name);
-          order.push(name);
-        };
-        for (const name of this.capabilities.keys()) {
-          visit(name);
         }
-        return order;
       }
-      // ---- Per-device overrides ----
-      /**
-       * Set a per-device singleton override. When resolveForDevice is called for
-       * this device + capability, the specified addon's provider is returned
-       * instead of the global singleton.
-       */
-      setDeviceOverride(deviceId, capability, addonId) {
-        const state = this.capabilities.get(capability);
-        if (!state) {
-          this.logger.warn(`Cannot set device override for undeclared capability "${capability}"`);
-          return;
-        }
-        if (!state.available.has(addonId)) {
-          this.logger.warn(`Cannot set device override: addon "${addonId}" not registered for "${capability}"`);
-          return;
-        }
-        let deviceMap = this.deviceOverrides.get(deviceId);
-        if (!deviceMap) {
-          deviceMap = /* @__PURE__ */ new Map();
-          this.deviceOverrides.set(deviceId, deviceMap);
-        }
-        deviceMap.set(capability, addonId);
-        this.logger.info(`Device override set: ${deviceId} \u2192 ${capability} = ${addonId}`);
-      }
-      /**
-       * Clear a per-device singleton override, reverting to the global singleton.
-       */
-      clearDeviceOverride(deviceId, capability) {
-        const deviceMap = this.deviceOverrides.get(deviceId);
-        if (!deviceMap)
-          return;
-        deviceMap.delete(capability);
-        if (deviceMap.size === 0) {
-          this.deviceOverrides.delete(deviceId);
-        }
-        this.logger.info(`Device override cleared: ${deviceId} \u2192 ${capability}`);
-      }
-      /**
-       * Get all per-device singleton overrides for a device.
-       * Returns a Map of capability name to addon ID.
-       */
-      getDeviceOverrides(deviceId) {
-        return new Map(this.deviceOverrides.get(deviceId) ?? []);
-      }
-      /**
-       * Resolve a singleton provider for a specific device.
-       * 1. Check device override — return that addon's provider
-       * 2. Fallback to global singleton
-       */
-      resolveForDevice(capability, deviceId) {
-        const state = this.capabilities.get(capability);
-        if (!state || state.declaration.mode !== "singleton")
-          return null;
-        const deviceMap = this.deviceOverrides.get(deviceId);
-        if (deviceMap) {
-          const overrideAddonId = deviceMap.get(capability);
-          if (overrideAddonId) {
-            const provider = state.available.get(overrideAddonId);
-            if (provider)
-              return provider;
-            this.logger.warn(`Device override for ${deviceId}/${capability} references unregistered addon "${overrideAddonId}" \u2014 falling back to global`);
-          }
-        }
-        return state.activeProvider ?? null;
-      }
-      /**
-       * Set a per-device collection filter. When resolveCollectionForDevice is called
-       * for this device + capability, only providers from the specified addon IDs
-       * are returned instead of the full collection.
-       */
-      setDeviceCollectionFilter(deviceId, capability, addonIds) {
-        const state = this.capabilities.get(capability);
-        if (!state) {
-          this.logger.warn(`Cannot set device collection filter for undeclared capability "${capability}"`);
-          return;
-        }
-        let deviceMap = this.deviceCollectionFilters.get(deviceId);
-        if (!deviceMap) {
-          deviceMap = /* @__PURE__ */ new Map();
-          this.deviceCollectionFilters.set(deviceId, deviceMap);
-        }
-        deviceMap.set(capability, [...addonIds]);
-        this.logger.info(`Device collection filter set: ${deviceId} \u2192 ${capability} = [${addonIds.join(", ")}]`);
-      }
-      /**
-       * Clear a per-device collection filter, reverting to the full collection.
-       */
-      clearDeviceCollectionFilter(deviceId, capability) {
-        const deviceMap = this.deviceCollectionFilters.get(deviceId);
-        if (!deviceMap)
-          return;
-        deviceMap.delete(capability);
-        if (deviceMap.size === 0) {
-          this.deviceCollectionFilters.delete(deviceId);
-        }
-        this.logger.info(`Device collection filter cleared: ${deviceId} \u2192 ${capability}`);
-      }
-      /**
-       * Resolve collection providers for a specific device.
-       * If a filter exists for the device + capability, only those addon's providers are returned.
-       * If no filter exists, the full collection is returned.
-       */
-      resolveCollectionForDevice(capability, deviceId) {
-        const state = this.capabilities.get(capability);
-        if (!state || state.declaration.mode !== "collection")
-          return [];
-        const deviceMap = this.deviceCollectionFilters.get(deviceId);
-        if (deviceMap) {
-          const filterAddonIds = deviceMap.get(capability);
-          if (filterAddonIds) {
-            const filterSet = new Set(filterAddonIds);
-            return state.activeCollection.filter((e) => filterSet.has(e.addonId)).map((e) => e.provider);
-          }
-        }
-        return state.activeCollection.map((e) => e.provider);
-      }
-      /**
-       * Get a specific addon's provider by addon ID, regardless of whether it's the active singleton.
-       * Useful for per-device overrides that need to look up any registered provider.
-       */
-      getProviderByAddonId(capability, addonId) {
-        const state = this.capabilities.get(capability);
-        if (!state)
-          return null;
-        const provider = state.available.get(addonId);
-        return provider ?? null;
-      }
-      activateSingleton(state, addonId, provider) {
-        state.activeAddonId = addonId;
-        state.activeProvider = provider;
-        this.logger.info(`Singleton activated: ${state.declaration.name} \u2192 ${addonId}`);
-        for (const consumer of state.consumers) {
-          if (consumer.onSet) {
-            try {
-              consumer.onSet(provider);
-            } catch (error) {
-              const msg = error instanceof Error ? error.message : String(error);
-              this.logger.error(`Consumer onSet failed for ${state.declaration.name}: ${msg}`);
-            }
-          }
+    }
+  }
+  /**
+   * Register a consumer that wants to be notified when providers change.
+   * If a provider is already active, the consumer is immediately notified.
+   * Returns a disposer function for cleanup.
+   */
+  registerConsumer(registration) {
+    const state = this.capabilities.get(registration.capability);
+    if (!state) {
+      this.logger.debug(`Consumer registered for undeclared capability "${registration.capability}" \u2014 auto-declaring`);
+      this.declareCapability({ name: registration.capability, mode: "singleton" });
+      return this.registerConsumer(registration);
+    }
+    const untypedReg = registration;
+    state.consumers.add(untypedReg);
+    if (state.declaration.mode === "singleton") {
+      if (state.activeProvider !== null && registration.onSet) {
+        try {
+          registration.onSet(state.activeProvider);
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          this.logger.error(`Consumer onSet (immediate) failed for ${registration.capability}: ${msg}`);
         }
       }
-      async activateSingletonAsync(state, addonId, provider) {
-        state.activeAddonId = addonId;
-        state.activeProvider = provider;
-        this.logger.info(`Singleton activated (async): ${state.declaration.name} \u2192 ${addonId}`);
-        for (const consumer of state.consumers) {
-          if (consumer.onSet) {
-            try {
-              await consumer.onSet(provider);
-            } catch (error) {
-              const msg = error instanceof Error ? error.message : String(error);
-              this.logger.error(`Consumer onSet (async) failed for ${state.declaration.name}: ${msg}`);
-            }
+    } else {
+      if (registration.onAdded) {
+        for (const entry of state.activeCollection) {
+          try {
+            registration.onAdded(entry.provider);
+          } catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            this.logger.error(`Consumer onAdded (immediate) failed for ${registration.capability}: ${msg}`);
           }
         }
       }
+    }
+    return () => {
+      state.consumers.delete(untypedReg);
     };
-    exports.CapabilityRegistry = CapabilityRegistry2;
   }
-});
-
-// src/infra-capabilities.js
-var require_infra_capabilities = __commonJS({
-  "src/infra-capabilities.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.INFRA_CAPABILITIES = void 0;
-    exports.isInfraCapability = isInfraCapability2;
-    exports.INFRA_CAPABILITIES = [
-      { name: "storage", required: true },
-      { name: "settings-store", required: true },
-      { name: "log-destination", required: false }
-    ];
-    var infraNames = new Set(exports.INFRA_CAPABILITIES.map((c) => c.name));
-    function isInfraCapability2(name) {
-      return infraNames.has(name);
+  /**
+   * Get the active singleton provider for a capability.
+   * Returns null if none set.
+   */
+  getSingleton(capability) {
+    const state = this.capabilities.get(capability);
+    if (!state || state.declaration.mode !== "singleton") return null;
+    return state.activeProvider ?? null;
+  }
+  /**
+   * Get all active collection providers for a capability.
+   */
+  getCollection(capability) {
+    const state = this.capabilities.get(capability);
+    if (!state || state.declaration.mode !== "collection") return [];
+    return state.activeCollection.map((e) => e.provider);
+  }
+  /**
+   * Set which addon should be the active singleton for a capability.
+   * Call with `immediate: true` to also swap the runtime provider now
+   * (consumers' onSet will be awaited).
+   */
+  async setActiveSingleton(capability, addonId, immediate = false) {
+    const state = this.capabilities.get(capability);
+    if (!state) {
+      throw new Error(`Unknown capability: ${capability}`);
+    }
+    if (state.declaration.mode !== "singleton") {
+      throw new Error(`Capability "${capability}" is not a singleton`);
     }
+    const provider = state.available.get(addonId);
+    if (!provider) {
+      throw new Error(`No provider "${addonId}" registered for capability "${capability}"`);
+    }
+    if (immediate) {
+      await this.activateSingletonAsync(state, addonId, provider);
+    }
+    this.logger.info(`Singleton preference set: ${capability} \u2192 ${addonId}`);
   }
-});
-
-// src/config-schema.js
-var require_config_schema = __commonJS({
-  "src/config-schema.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.RUNTIME_DEFAULTS = exports.bootstrapSchema = exports.DEFAULT_DATA_PATH = void 0;
-    var zod_1 = __require("zod");
-    exports.DEFAULT_DATA_PATH = "camstack-data";
-    exports.bootstrapSchema = zod_1.z.object({
-      /** Server mode: 'hub' (full server) or 'agent' (worker node) */
-      mode: zod_1.z.enum(["hub", "agent"]).default("hub"),
-      server: zod_1.z.object({
-        port: zod_1.z.number().default(4443),
-        host: zod_1.z.string().default("0.0.0.0"),
-        dataPath: zod_1.z.string().default(exports.DEFAULT_DATA_PATH)
-      }).default({}),
-      auth: zod_1.z.object({
-        jwtSecret: zod_1.z.string().nullable().default(null),
-        adminUsername: zod_1.z.string().default("admin"),
-        adminPassword: zod_1.z.string().default(process.env.ADMIN_PASSWORD ?? "changeme")
-      }).default({}),
-      /** Hub connection config — only used when mode='agent' */
-      hub: zod_1.z.object({
-        url: zod_1.z.string().default("ws://localhost:4443/agent"),
-        token: zod_1.z.string().default("")
-      }).default({}),
-      /** Agent-specific config — only used when mode='agent' */
-      agent: zod_1.z.object({
-        name: zod_1.z.string().default(""),
-        /** Port for the agent status page (minimal HTML) */
-        statusPort: zod_1.z.number().default(4444)
-      }).default({}),
-      /** TLS configuration */
-      tls: zod_1.z.object({
-        /** Enable HTTPS (default: true) */
-        enabled: zod_1.z.boolean().default(true),
-        /** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
-        certPath: zod_1.z.string().optional(),
-        /** Path to custom key file (PEM). Required if certPath is set. */
-        keyPath: zod_1.z.string().optional()
-      }).default({})
-    });
-    exports.RUNTIME_DEFAULTS = {
-      "features.streaming": true,
-      "features.notifications": true,
-      "features.objectDetection": false,
-      "features.remoteAccess": true,
-      "features.agentCluster": false,
-      "features.smartHome": true,
-      "features.recordings": true,
-      "features.backup": true,
-      "features.repl": true,
-      "retention.detectionEventsDays": 30,
-      "retention.audioLevelsDays": 7,
-      "logging.level": "info",
-      "logging.retentionDays": 30,
-      "eventBus.ringBufferSize": 1e4,
-      "storage.provider": "sqlite-storage",
-      "storage.locations": {
-        data: "camstack-data/data",
-        media: "camstack-data/media",
-        recordings: "camstack-data/recordings",
-        cache: "/tmp/camstack-cache",
-        logs: "camstack-data/logs",
-        models: "camstack-data/models"
-      },
-      "providers": [],
-      // Recording
-      "recording.segmentDurationSeconds": 4,
-      "recording.defaultRetentionDays": 30,
-      // Streaming ports are addon-specific (go2rtc owns its defaults)
-      // FFmpeg
-      "ffmpeg.binaryPath": "ffmpeg",
-      "ffmpeg.hwAccel": "auto",
-      "ffmpeg.threadCount": 0,
-      // Detection defaults
-      "detection.defaultMotionFps": 2,
-      "detection.defaultDetectionFps": 5,
-      "detection.defaultCooldownSeconds": 10,
-      "detection.defaultConfidenceThreshold": 0.4,
-      "detection.trackerMaxAgeFrames": 30,
-      "detection.trackerMinHits": 3,
-      "detection.trackerIouThreshold": 0.3,
-      // Backup retention is addon-specific (local-backup owns its default)
-      // Auth (runtime)
-      "auth.tokenExpiry": "24h"
-    };
+  /**
+   * Get the mode declared for a capability.
+   */
+  getMode(capability) {
+    return this.capabilities.get(capability)?.declaration.mode;
   }
-});
-
-// src/config-manager.js
-var require_config_manager = __commonJS({
-  "src/config-manager.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: function() {
-          return m[k];
-        } };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
+  /**
+   * List all registered capabilities with their providers.
+   */
+  listCapabilities() {
+    const result = [];
+    for (const [name, state] of this.capabilities) {
+      result.push({
+        name,
+        mode: state.declaration.mode,
+        providers: [...state.available.keys()],
+        activeProvider: state.activeAddonId
+      });
+    }
+    return result;
+  }
+  /**
+   * Check if all dependencies for a capability are satisfied (have active providers).
+   */
+  areDependenciesMet(declaration) {
+    if (!declaration.dependsOn?.length) return true;
+    return declaration.dependsOn.every((dep) => {
+      const state = this.capabilities.get(dep);
+      if (!state) return false;
+      if (state.declaration.mode === "singleton") {
+        return state.activeProvider !== null;
+      }
+      return state.activeCollection.length > 0;
     });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      };
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.ConfigManager = void 0;
-    var fs = __importStar(__require("fs"));
-    var yaml = __importStar(__require("js-yaml"));
-    var config_schema_js_1 = require_config_schema();
-    var ENV_VAR_MAP = {
-      CAMSTACK_PORT: "server.port",
-      CAMSTACK_HOST: "server.host",
-      CAMSTACK_DATA: "server.dataPath",
-      CAMSTACK_JWT_SECRET: "auth.jwtSecret",
-      CAMSTACK_ADMIN_USER: "auth.adminUsername",
-      CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+  }
+  /**
+   * Get the dependency-ordered list of capability names for boot sequencing.
+   * Returns capabilities sorted topologically by dependsOn.
+   * Throws if a cycle is detected.
+   */
+  getBootOrder() {
+    const visited = /* @__PURE__ */ new Set();
+    const visiting = /* @__PURE__ */ new Set();
+    const order = [];
+    const visit = (name) => {
+      if (visited.has(name)) return;
+      if (visiting.has(name)) {
+        throw new Error(`Circular dependency detected involving capability "${name}"`);
+      }
+      visiting.add(name);
+      const state = this.capabilities.get(name);
+      if (state?.declaration.dependsOn) {
+        for (const dep of state.declaration.dependsOn) {
+          visit(dep);
+        }
+      }
+      visiting.delete(name);
+      visited.add(name);
+      order.push(name);
     };
-    var ConfigManager2 = class _ConfigManager {
-      configPath;
-      // Non-readonly so update() can sync the in-memory view after a write.
-      bootstrapConfig;
-      settingsStore = null;
-      constructor(configPath) {
-        this.configPath = configPath;
-        const rawYaml = this.loadYaml();
-        const merged = this.applyEnvOverrides(rawYaml);
-        this.bootstrapConfig = config_schema_js_1.bootstrapSchema.parse(merged);
-        this.warnDefaultCredentials();
-      }
-      /** Called by main.ts after the SQLite DB is ready (Phase 2). */
-      setSettingsStore(store) {
-        this.settingsStore = store;
-      }
-      /**
-       * Get a config value by dot-notation path.
-       * Priority: bootstrap config -> SQL system_settings -> RUNTIME_DEFAULTS fallback.
-       */
-      get(path) {
-        const bootstrapValue = this.getFromBootstrap(path);
-        if (bootstrapValue !== void 0) {
-          return bootstrapValue;
-        }
-        if (this.settingsStore !== null) {
-          const sqlValue = this.settingsStore.getSystem(path);
-          if (sqlValue !== void 0) {
-            return sqlValue;
-          }
-          const sqlNested = this.getNestedFromSystemSettings(path);
-          if (sqlNested !== void 0) {
-            return sqlNested;
-          }
-        }
-        if (path in config_schema_js_1.RUNTIME_DEFAULTS) {
-          return config_schema_js_1.RUNTIME_DEFAULTS[path];
-        }
-        const nested = this.getFromRuntimeDefaults(path);
-        if (nested !== void 0) {
-          return nested;
-        }
-        return void 0;
-      }
-      /**
-       * Write a value to SQL system_settings.
-       * Throws if the settings store is not yet wired.
-       */
-      set(key, value) {
-        if (this.settingsStore === null) {
-          throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        }
-        this.settingsStore.setSystem(key, value);
-      }
-      /**
-       * Bulk-read all system_settings keys that belong to a logical section.
-       * A "section" is the first segment of a dot-notation key (e.g. 'features', 'logging').
-       */
-      getSection(section) {
-        if (this.settingsStore !== null) {
-          const nested = this.getNestedFromSystemSettings(section);
-          if (nested !== void 0)
-            return nested;
-        }
-        const bootstrapValue = this.bootstrapConfig[section];
-        if (bootstrapValue !== void 0 && bootstrapValue !== null && typeof bootstrapValue === "object") {
-          return bootstrapValue;
-        }
-        return this.getFromRuntimeDefaults(section) ?? {};
-      }
-      /**
-       * Bulk-write a section of runtime settings to SQL system_settings.
-       * Each entry in `data` is stored as `section.key`.
-       */
-      setSection(section, data) {
-        if (this.settingsStore === null) {
-          throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        }
-        for (const [key, value] of Object.entries(data)) {
-          this.settingsStore.setSystem(`${section}.${key}`, value);
-        }
-      }
-      // ---------------------------------------------------------------------------
-      // Addon / Provider / Device scoped config
-      // ---------------------------------------------------------------------------
-      /** Read all config for an addon from addon_settings. */
-      getAddonConfig(addonId) {
-        if (this.settingsStore !== null) {
-          return this.settingsStore.getAllAddon(addonId);
-        }
-        return this.getFromBootstrap(`addons.${addonId}`) ?? {};
-      }
-      /** Write (bulk-replace) config for an addon to addon_settings. */
-      setAddonConfig(addonId, config) {
-        if (this.settingsStore === null) {
-          throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        }
-        this.settingsStore.setAllAddon(addonId, config);
-      }
-      /** Read all config for a provider from provider_settings. */
-      getProviderConfig(providerId) {
-        if (this.settingsStore !== null) {
-          return this.settingsStore.getAllProvider(providerId);
-        }
-        return {};
-      }
-      /** Write (upsert) a single key for a provider to provider_settings. */
-      setProviderConfig(providerId, key, value) {
-        if (this.settingsStore === null) {
-          throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        }
-        this.settingsStore.setProvider(providerId, key, value);
-      }
-      /** Read all config for a device from device_settings. */
-      getDeviceConfig(deviceId) {
-        if (this.settingsStore !== null) {
-          return this.settingsStore.getAllDevice(deviceId);
-        }
-        return {};
-      }
-      /** Write (upsert) a single key for a device to device_settings. */
-      setDeviceConfig(deviceId, key, value) {
-        if (this.settingsStore === null) {
-          throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
-        }
-        this.settingsStore.setDevice(deviceId, key, value);
-      }
-      /** Get a value from the parsed bootstrap config */
-      getBootstrap(path) {
-        return this.getFromBootstrap(path);
-      }
-      /** Features accessor -- reads from SQL when available, falls back to RUNTIME_DEFAULTS */
-      get features() {
-        const g = (key) => this.get(`features.${key}`) ?? config_schema_js_1.RUNTIME_DEFAULTS[`features.${key}`];
-        return {
-          streaming: g("streaming"),
-          notifications: g("notifications"),
-          objectDetection: g("objectDetection"),
-          remoteAccess: g("remoteAccess"),
-          agentCluster: g("agentCluster"),
-          smartHome: g("smartHome"),
-          recordings: g("recordings"),
-          backup: g("backup"),
-          repl: g("repl")
-        };
-      }
-      /**
-       * Returns a merged view of bootstrap config + runtime defaults for backward compat.
-       */
-      get raw() {
-        const features = {
-          streaming: config_schema_js_1.RUNTIME_DEFAULTS["features.streaming"],
-          notifications: config_schema_js_1.RUNTIME_DEFAULTS["features.notifications"],
-          objectDetection: config_schema_js_1.RUNTIME_DEFAULTS["features.objectDetection"],
-          remoteAccess: config_schema_js_1.RUNTIME_DEFAULTS["features.remoteAccess"],
-          agentCluster: config_schema_js_1.RUNTIME_DEFAULTS["features.agentCluster"],
-          smartHome: config_schema_js_1.RUNTIME_DEFAULTS["features.smartHome"],
-          recordings: config_schema_js_1.RUNTIME_DEFAULTS["features.recordings"],
-          backup: config_schema_js_1.RUNTIME_DEFAULTS["features.backup"],
-          repl: config_schema_js_1.RUNTIME_DEFAULTS["features.repl"]
-        };
-        return {
-          ...this.bootstrapConfig,
-          features,
-          storage: config_schema_js_1.RUNTIME_DEFAULTS["storage.locations"] !== void 0 ? {
-            provider: config_schema_js_1.RUNTIME_DEFAULTS["storage.provider"],
-            locations: config_schema_js_1.RUNTIME_DEFAULTS["storage.locations"]
-          } : { provider: "sqlite-storage", locations: {} },
-          logging: {
-            level: config_schema_js_1.RUNTIME_DEFAULTS["logging.level"],
-            retentionDays: config_schema_js_1.RUNTIME_DEFAULTS["logging.retentionDays"]
-          },
-          eventBus: {
-            ringBufferSize: config_schema_js_1.RUNTIME_DEFAULTS["eventBus.ringBufferSize"]
-          },
-          retention: {
-            detectionEventsDays: config_schema_js_1.RUNTIME_DEFAULTS["retention.detectionEventsDays"],
-            audioLevelsDays: config_schema_js_1.RUNTIME_DEFAULTS["retention.audioLevelsDays"]
-          },
-          providers: config_schema_js_1.RUNTIME_DEFAULTS["providers"]
-        };
-      }
-      /** Sections that live in config.yaml. Everything else goes to SQL. */
-      static BOOTSTRAP_SECTIONS = /* @__PURE__ */ new Set(["server", "auth", "mode"]);
-      /**
-       * Atomically update one top-level section of config.yaml and sync in-memory.
-       * Only bootstrap sections (server, auth, mode) are written to YAML.
-       * Runtime settings must use setSection() which writes to SQL.
-       */
-      update(section, data) {
-        if (!_ConfigManager.BOOTSTRAP_SECTIONS.has(section)) {
-          throw new Error(`[ConfigManager] Section "${section}" is a runtime setting \u2014 use setSection() to write to DB, not update() which writes to config.yaml`);
-        }
-        let raw = {};
-        if (fs.existsSync(this.configPath)) {
-          raw = yaml.load(fs.readFileSync(this.configPath, "utf-8")) ?? {};
-        }
-        const existing = raw[section] ?? {};
-        raw[section] = { ...existing, ...data };
-        const validation = config_schema_js_1.bootstrapSchema.safeParse(raw);
-        if (!validation.success) {
-          throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
-        }
-        const tmpPath = `${this.configPath}.tmp`;
-        fs.writeFileSync(tmpPath, yaml.dump(raw, { lineWidth: 120, indent: 2, quotingType: '"' }), "utf-8");
-        fs.renameSync(tmpPath, this.configPath);
-        this.bootstrapConfig = validation.data;
-      }
-      /**
-       * Deep-set a value in a nested plain object using a dot-notation path.
-       * Returns a new object (immutable).
-       */
-      setNested(obj, path, value) {
-        const [head, ...rest] = path.split(".");
-        if (!head)
-          return obj;
-        if (rest.length === 0) {
-          return { ...obj, [head]: value };
-        }
-        const child = obj[head] ?? {};
-        return { ...obj, [head]: this.setNested(child, rest.join("."), value) };
-      }
-      /**
-       * Apply env var overrides onto the raw YAML object.
-       * Only bootstrap-level env vars are applied.
-       */
-      applyEnvOverrides(raw) {
-        let result = { ...raw };
-        for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
-          const envValue = process.env[envKey];
-          if (envValue === void 0 || envValue === "")
-            continue;
-          const coerced = configPath === "server.port" ? Number(envValue) : envValue;
-          result = this.setNested(result, configPath, coerced);
-          console.log(`[ConfigManager] Env override applied: ${envKey} \u2192 ${configPath}`);
-        }
-        return result;
-      }
-      loadYaml() {
-        if (!fs.existsSync(this.configPath)) {
-          console.warn(`[ConfigManager] Config file not found at: ${this.configPath}
-  \u2192 Using built-in defaults. Set CONFIG_PATH env var or create the file.
-  \u2192 Example path from project root: ./server/backend/data/config.yaml`);
-          return {};
-        }
-        const content = fs.readFileSync(this.configPath, "utf-8");
-        const parsed = yaml.load(content) ?? {};
-        console.log(`[ConfigManager] Loaded config from: ${this.configPath}`);
-        return parsed;
-      }
-      warnDefaultCredentials() {
-        if (this.bootstrapConfig.auth.adminPassword === "changeme") {
-          console.warn(`[ConfigManager] Warning: Using default admin password "changeme". Set auth.adminPassword in your config.yaml or the ADMIN_PASSWORD env var.`);
-        }
+    for (const name of this.capabilities.keys()) {
+      visit(name);
+    }
+    return order;
+  }
+  // ---- Per-device overrides ----
+  /**
+   * Set a per-device singleton override. When resolveForDevice is called for
+   * this device + capability, the specified addon's provider is returned
+   * instead of the global singleton.
+   */
+  setDeviceOverride(deviceId, capability, addonId) {
+    const state = this.capabilities.get(capability);
+    if (!state) {
+      this.logger.warn(`Cannot set device override for undeclared capability "${capability}"`);
+      return;
+    }
+    if (!state.available.has(addonId)) {
+      this.logger.warn(`Cannot set device override: addon "${addonId}" not registered for "${capability}"`);
+      return;
+    }
+    let deviceMap = this.deviceOverrides.get(deviceId);
+    if (!deviceMap) {
+      deviceMap = /* @__PURE__ */ new Map();
+      this.deviceOverrides.set(deviceId, deviceMap);
+    }
+    deviceMap.set(capability, addonId);
+    this.logger.info(`Device override set: ${deviceId} \u2192 ${capability} = ${addonId}`);
+  }
+  /**
+   * Clear a per-device singleton override, reverting to the global singleton.
+   */
+  clearDeviceOverride(deviceId, capability) {
+    const deviceMap = this.deviceOverrides.get(deviceId);
+    if (!deviceMap) return;
+    deviceMap.delete(capability);
+    if (deviceMap.size === 0) {
+      this.deviceOverrides.delete(deviceId);
+    }
+    this.logger.info(`Device override cleared: ${deviceId} \u2192 ${capability}`);
+  }
+  /**
+   * Get all per-device singleton overrides for a device.
+   * Returns a Map of capability name to addon ID.
+   */
+  getDeviceOverrides(deviceId) {
+    return new Map(this.deviceOverrides.get(deviceId) ?? []);
+  }
+  /**
+   * Resolve a singleton provider for a specific device.
+   * 1. Check device override — return that addon's provider
+   * 2. Fallback to global singleton
+   */
+  resolveForDevice(capability, deviceId) {
+    const state = this.capabilities.get(capability);
+    if (!state || state.declaration.mode !== "singleton") return null;
+    const deviceMap = this.deviceOverrides.get(deviceId);
+    if (deviceMap) {
+      const overrideAddonId = deviceMap.get(capability);
+      if (overrideAddonId) {
+        const provider = state.available.get(overrideAddonId);
+        if (provider) return provider;
+        this.logger.warn(
+          `Device override for ${deviceId}/${capability} references unregistered addon "${overrideAddonId}" \u2014 falling back to global`
+        );
       }
-      getFromBootstrap(path) {
-        const keys = path.split(".");
-        let current = this.bootstrapConfig;
-        for (const key of keys) {
-          if (current === null || current === void 0 || typeof current !== "object") {
-            return void 0;
-          }
-          current = current[key];
-        }
-        return current;
+    }
+    return state.activeProvider ?? null;
+  }
+  /**
+   * Set a per-device collection filter. When resolveCollectionForDevice is called
+   * for this device + capability, only providers from the specified addon IDs
+   * are returned instead of the full collection.
+   */
+  setDeviceCollectionFilter(deviceId, capability, addonIds) {
+    const state = this.capabilities.get(capability);
+    if (!state) {
+      this.logger.warn(`Cannot set device collection filter for undeclared capability "${capability}"`);
+      return;
+    }
+    let deviceMap = this.deviceCollectionFilters.get(deviceId);
+    if (!deviceMap) {
+      deviceMap = /* @__PURE__ */ new Map();
+      this.deviceCollectionFilters.set(deviceId, deviceMap);
+    }
+    deviceMap.set(capability, [...addonIds]);
+    this.logger.info(`Device collection filter set: ${deviceId} \u2192 ${capability} = [${addonIds.join(", ")}]`);
+  }
+  /**
+   * Clear a per-device collection filter, reverting to the full collection.
+   */
+  clearDeviceCollectionFilter(deviceId, capability) {
+    const deviceMap = this.deviceCollectionFilters.get(deviceId);
+    if (!deviceMap) return;
+    deviceMap.delete(capability);
+    if (deviceMap.size === 0) {
+      this.deviceCollectionFilters.delete(deviceId);
+    }
+    this.logger.info(`Device collection filter cleared: ${deviceId} \u2192 ${capability}`);
+  }
+  /**
+   * Resolve collection providers for a specific device.
+   * If a filter exists for the device + capability, only those addon's providers are returned.
+   * If no filter exists, the full collection is returned.
+   */
+  resolveCollectionForDevice(capability, deviceId) {
+    const state = this.capabilities.get(capability);
+    if (!state || state.declaration.mode !== "collection") return [];
+    const deviceMap = this.deviceCollectionFilters.get(deviceId);
+    if (deviceMap) {
+      const filterAddonIds = deviceMap.get(capability);
+      if (filterAddonIds) {
+        const filterSet = new Set(filterAddonIds);
+        return state.activeCollection.filter((e) => filterSet.has(e.addonId)).map((e) => e.provider);
       }
-      getFromRuntimeDefaults(path) {
-        const prefix = path + ".";
-        const result = {};
-        let found = false;
-        for (const [key, value] of Object.entries(config_schema_js_1.RUNTIME_DEFAULTS)) {
-          if (key.startsWith(prefix)) {
-            const subKey = key.slice(prefix.length);
-            result[subKey] = value;
-            found = true;
-          }
+    }
+    return state.activeCollection.map((e) => e.provider);
+  }
+  /**
+   * Get a specific addon's provider by addon ID, regardless of whether it's the active singleton.
+   * Useful for per-device overrides that need to look up any registered provider.
+   */
+  getProviderByAddonId(capability, addonId) {
+    const state = this.capabilities.get(capability);
+    if (!state) return null;
+    const provider = state.available.get(addonId);
+    return provider ?? null;
+  }
+  activateSingleton(state, addonId, provider) {
+    state.activeAddonId = addonId;
+    state.activeProvider = provider;
+    this.logger.info(`Singleton activated: ${state.declaration.name} \u2192 ${addonId}`);
+    for (const consumer of state.consumers) {
+      if (consumer.onSet) {
+        try {
+          consumer.onSet(provider);
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          this.logger.error(`Consumer onSet failed for ${state.declaration.name}: ${msg}`);
         }
-        return found ? result : void 0;
       }
-      /**
-       * Perform a prefix-based nested lookup against SQL system_settings.
-       * e.g. path='features' matches keys 'features.streaming', 'features.notifications', etc.
-       * Returns an object keyed by the sub-key, or undefined if nothing is found.
-       */
-      getNestedFromSystemSettings(path) {
-        if (this.settingsStore === null)
-          return void 0;
-        const all = this.settingsStore.getAllSystem();
-        const prefix = path + ".";
-        const result = {};
-        let found = false;
-        for (const [key, value] of Object.entries(all)) {
-          if (key.startsWith(prefix)) {
-            result[key.slice(prefix.length)] = value;
-            found = true;
-          }
+    }
+  }
+  async activateSingletonAsync(state, addonId, provider) {
+    state.activeAddonId = addonId;
+    state.activeProvider = provider;
+    this.logger.info(`Singleton activated (async): ${state.declaration.name} \u2192 ${addonId}`);
+    for (const consumer of state.consumers) {
+      if (consumer.onSet) {
+        try {
+          await consumer.onSet(provider);
+        } catch (error) {
+          const msg = error instanceof Error ? error.message : String(error);
+          this.logger.error(`Consumer onSet (async) failed for ${state.declaration.name}: ${msg}`);
         }
-        return found ? result : void 0;
       }
-    };
-    exports.ConfigManager = ConfigManager2;
+    }
   }
+};
+
+// src/infra-capabilities.ts
+var INFRA_CAPABILITIES = [
+  { name: "storage", required: true },
+  { name: "settings-store", required: true },
+  { name: "log-destination", required: false }
+];
+var infraNames = new Set(INFRA_CAPABILITIES.map((c) => c.name));
+function isInfraCapability(name) {
+  return infraNames.has(name);
+}
+
+// src/config-manager.ts
+import * as fs3 from "fs";
+import * as yaml from "js-yaml";
+
+// src/config-schema.ts
+import { z } from "zod";
+var DEFAULT_DATA_PATH = "camstack-data";
+var bootstrapSchema = z.object({
+  /** Server mode: 'hub' (full server) or 'agent' (worker node) */
+  mode: z.enum(["hub", "agent"]).default("hub"),
+  server: z.object({
+    port: z.number().default(4443),
+    host: z.string().default("0.0.0.0"),
+    dataPath: z.string().default(DEFAULT_DATA_PATH)
+  }).default({}),
+  auth: z.object({
+    jwtSecret: z.string().nullable().default(null),
+    adminUsername: z.string().default("admin"),
+    adminPassword: z.string().default(process.env.ADMIN_PASSWORD ?? "changeme")
+  }).default({}),
+  /** Hub connection config — only used when mode='agent' */
+  hub: z.object({
+    url: z.string().default("ws://localhost:4443/agent"),
+    token: z.string().default("")
+  }).default({}),
+  /** Agent-specific config — only used when mode='agent' */
+  agent: z.object({
+    name: z.string().default(""),
+    /** Port for the agent status page (minimal HTML) */
+    statusPort: z.number().default(4444)
+  }).default({}),
+  /** TLS configuration */
+  tls: z.object({
+    /** Enable HTTPS (default: true) */
+    enabled: z.boolean().default(true),
+    /** Path to custom cert file (PEM). If not set, auto-generates self-signed. */
+    certPath: z.string().optional(),
+    /** Path to custom key file (PEM). Required if certPath is set. */
+    keyPath: z.string().optional()
+  }).default({})
 });
+var RUNTIME_DEFAULTS = {
+  "features.streaming": true,
+  "features.notifications": true,
+  "features.objectDetection": false,
+  "features.remoteAccess": true,
+  "features.agentCluster": false,
+  "features.smartHome": true,
+  "features.recordings": true,
+  "features.backup": true,
+  "features.repl": true,
+  "retention.detectionEventsDays": 30,
+  "retention.audioLevelsDays": 7,
+  "logging.level": "info",
+  "logging.retentionDays": 30,
+  "eventBus.ringBufferSize": 1e4,
+  "storage.provider": "sqlite-storage",
+  "storage.locations": {
+    data: "camstack-data/data",
+    media: "camstack-data/media",
+    recordings: "camstack-data/recordings",
+    cache: "/tmp/camstack-cache",
+    logs: "camstack-data/logs",
+    models: "camstack-data/models"
+  },
+  "providers": [],
+  // Recording
+  "recording.segmentDurationSeconds": 4,
+  "recording.defaultRetentionDays": 30,
+  // Streaming ports are addon-specific (go2rtc owns its defaults)
+  // FFmpeg
+  "ffmpeg.binaryPath": "ffmpeg",
+  "ffmpeg.hwAccel": "auto",
+  "ffmpeg.threadCount": 0,
+  // Detection defaults
+  "detection.defaultMotionFps": 2,
+  "detection.defaultDetectionFps": 5,
+  "detection.defaultCooldownSeconds": 10,
+  "detection.defaultConfidenceThreshold": 0.4,
+  "detection.trackerMaxAgeFrames": 30,
+  "detection.trackerMinHits": 3,
+  "detection.trackerIouThreshold": 0.3,
+  // Backup retention is addon-specific (local-backup owns its default)
+  // Auth (runtime)
+  "auth.tokenExpiry": "24h"
+};
 
-// src/worker/addon-worker-host.js
-var require_addon_worker_host = __commonJS({
-  "src/worker/addon-worker-host.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.AddonWorkerHost = void 0;
-    var node_child_process_1 = __require("child_process");
-    var INFRA_ADDON_IDS = /* @__PURE__ */ new Set([
-      "filesystem-storage",
-      "sqlite-settings",
-      "winston-logging"
-    ]);
-    var AddonWorkerHost2 = class {
-      workers = /* @__PURE__ */ new Map();
-      options;
-      heartbeatTimer = null;
-      /** Set of addons that failed to fork and fell back to in-process */
-      fallbackInProcess = /* @__PURE__ */ new Set();
-      constructor(options) {
-        this.options = {
-          workerEntryPath: options.workerEntryPath,
-          devMode: options.devMode ?? false,
-          forceInProcess: options.forceInProcess ?? process.env.CAMSTACK_FORCE_INPROCESS === "true",
-          heartbeatIntervalMs: options.heartbeatIntervalMs ?? 5e3,
-          heartbeatTimeoutMs: options.heartbeatTimeoutMs ?? 3e4,
-          maxCrashesInWindow: options.maxCrashesInWindow ?? 3,
-          crashWindowMs: options.crashWindowMs ?? 6e4,
-          shutdownTimeoutMs: options.shutdownTimeoutMs ?? 1e4,
-          onWorkerLog: options.onWorkerLog
-        };
+// src/config-manager.ts
+var ENV_VAR_MAP = {
+  CAMSTACK_PORT: "server.port",
+  CAMSTACK_HOST: "server.host",
+  CAMSTACK_DATA: "server.dataPath",
+  CAMSTACK_JWT_SECRET: "auth.jwtSecret",
+  CAMSTACK_ADMIN_USER: "auth.adminUsername",
+  CAMSTACK_ADMIN_PASS: "auth.adminPassword"
+};
+var ConfigManager = class _ConfigManager {
+  constructor(configPath) {
+    this.configPath = configPath;
+    const rawYaml = this.loadYaml();
+    const merged = this.applyEnvOverrides(rawYaml);
+    this.bootstrapConfig = bootstrapSchema.parse(merged);
+    this.warnDefaultCredentials();
+  }
+  // Non-readonly so update() can sync the in-memory view after a write.
+  bootstrapConfig;
+  settingsStore = null;
+  /** Called by main.ts after the SQLite DB is ready (Phase 2). */
+  setSettingsStore(store) {
+    this.settingsStore = store;
+  }
+  /**
+   * Get a config value by dot-notation path.
+   * Priority: bootstrap config -> SQL system_settings -> RUNTIME_DEFAULTS fallback.
+   */
+  get(path3) {
+    const bootstrapValue = this.getFromBootstrap(path3);
+    if (bootstrapValue !== void 0) {
+      return bootstrapValue;
+    }
+    if (this.settingsStore !== null) {
+      const sqlValue = this.settingsStore.getSystem(path3);
+      if (sqlValue !== void 0) {
+        return sqlValue;
       }
-      /** Check if an addon is infrastructure (must stay in-process) */
-      isInfraAddon(addonId) {
-        return INFRA_ADDON_IDS.has(addonId);
+      const sqlNested = this.getNestedFromSystemSettings(path3);
+      if (sqlNested !== void 0) {
+        return sqlNested;
       }
-      /** Check if an addon fell back to in-process after fork failure */
-      isFallbackInProcess(addonId) {
-        return this.fallbackInProcess.has(addonId);
+    }
+    if (path3 in RUNTIME_DEFAULTS) {
+      return RUNTIME_DEFAULTS[path3];
+    }
+    const nested = this.getFromRuntimeDefaults(path3);
+    if (nested !== void 0) {
+      return nested;
+    }
+    return void 0;
+  }
+  /**
+   * Write a value to SQL system_settings.
+   * Throws if the settings store is not yet wired.
+   */
+  set(key, value) {
+    if (this.settingsStore === null) {
+      throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+    }
+    this.settingsStore.setSystem(key, value);
+  }
+  /**
+   * Bulk-read all system_settings keys that belong to a logical section.
+   * A "section" is the first segment of a dot-notation key (e.g. 'features', 'logging').
+   */
+  getSection(section) {
+    if (this.settingsStore !== null) {
+      const nested = this.getNestedFromSystemSettings(section);
+      if (nested !== void 0) return nested;
+    }
+    const bootstrapValue = this.bootstrapConfig[section];
+    if (bootstrapValue !== void 0 && bootstrapValue !== null && typeof bootstrapValue === "object") {
+      return bootstrapValue;
+    }
+    return this.getFromRuntimeDefaults(section) ?? {};
+  }
+  /**
+   * Bulk-write a section of runtime settings to SQL system_settings.
+   * Each entry in `data` is stored as `section.key`.
+   */
+  setSection(section, data) {
+    if (this.settingsStore === null) {
+      throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+    }
+    for (const [key, value] of Object.entries(data)) {
+      this.settingsStore.setSystem(`${section}.${key}`, value);
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Addon / Provider / Device scoped config
+  // ---------------------------------------------------------------------------
+  /** Read all config for an addon from addon_settings. */
+  getAddonConfig(addonId) {
+    if (this.settingsStore !== null) {
+      return this.settingsStore.getAllAddon(addonId);
+    }
+    return this.getFromBootstrap(`addons.${addonId}`) ?? {};
+  }
+  /** Write (bulk-replace) config for an addon to addon_settings. */
+  setAddonConfig(addonId, config) {
+    if (this.settingsStore === null) {
+      throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+    }
+    this.settingsStore.setAllAddon(addonId, config);
+  }
+  /** Read all config for a provider from provider_settings. */
+  getProviderConfig(providerId) {
+    if (this.settingsStore !== null) {
+      return this.settingsStore.getAllProvider(providerId);
+    }
+    return {};
+  }
+  /** Write (upsert) a single key for a provider to provider_settings. */
+  setProviderConfig(providerId, key, value) {
+    if (this.settingsStore === null) {
+      throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+    }
+    this.settingsStore.setProvider(providerId, key, value);
+  }
+  /** Read all config for a device from device_settings. */
+  getDeviceConfig(deviceId) {
+    if (this.settingsStore !== null) {
+      return this.settingsStore.getAllDevice(deviceId);
+    }
+    return {};
+  }
+  /** Write (upsert) a single key for a device to device_settings. */
+  setDeviceConfig(deviceId, key, value) {
+    if (this.settingsStore === null) {
+      throw new Error("[ConfigManager] SettingsStore not initialized -- call setSettingsStore() first");
+    }
+    this.settingsStore.setDevice(deviceId, key, value);
+  }
+  /** Get a value from the parsed bootstrap config */
+  getBootstrap(path3) {
+    return this.getFromBootstrap(path3);
+  }
+  /** Features accessor -- reads from SQL when available, falls back to RUNTIME_DEFAULTS */
+  get features() {
+    const g = (key) => this.get(`features.${key}`) ?? RUNTIME_DEFAULTS[`features.${key}`];
+    return {
+      streaming: g("streaming"),
+      notifications: g("notifications"),
+      objectDetection: g("objectDetection"),
+      remoteAccess: g("remoteAccess"),
+      agentCluster: g("agentCluster"),
+      smartHome: g("smartHome"),
+      recordings: g("recordings"),
+      backup: g("backup"),
+      repl: g("repl")
+    };
+  }
+  /**
+   * Returns a merged view of bootstrap config + runtime defaults for backward compat.
+   */
+  get raw() {
+    const features = {
+      streaming: RUNTIME_DEFAULTS["features.streaming"],
+      notifications: RUNTIME_DEFAULTS["features.notifications"],
+      objectDetection: RUNTIME_DEFAULTS["features.objectDetection"],
+      remoteAccess: RUNTIME_DEFAULTS["features.remoteAccess"],
+      agentCluster: RUNTIME_DEFAULTS["features.agentCluster"],
+      smartHome: RUNTIME_DEFAULTS["features.smartHome"],
+      recordings: RUNTIME_DEFAULTS["features.recordings"],
+      backup: RUNTIME_DEFAULTS["features.backup"],
+      repl: RUNTIME_DEFAULTS["features.repl"]
+    };
+    return {
+      ...this.bootstrapConfig,
+      features,
+      storage: RUNTIME_DEFAULTS["storage.locations"] !== void 0 ? {
+        provider: RUNTIME_DEFAULTS["storage.provider"],
+        locations: RUNTIME_DEFAULTS["storage.locations"]
+      } : { provider: "sqlite-storage", locations: {} },
+      logging: {
+        level: RUNTIME_DEFAULTS["logging.level"],
+        retentionDays: RUNTIME_DEFAULTS["logging.retentionDays"]
+      },
+      eventBus: {
+        ringBufferSize: RUNTIME_DEFAULTS["eventBus.ringBufferSize"]
+      },
+      retention: {
+        detectionEventsDays: RUNTIME_DEFAULTS["retention.detectionEventsDays"],
+        audioLevelsDays: RUNTIME_DEFAULTS["retention.audioLevelsDays"]
+      },
+      providers: RUNTIME_DEFAULTS["providers"]
+    };
+  }
+  /** Sections that live in config.yaml. Everything else goes to SQL. */
+  static BOOTSTRAP_SECTIONS = /* @__PURE__ */ new Set(["server", "auth", "mode"]);
+  /**
+   * Atomically update one top-level section of config.yaml and sync in-memory.
+   * Only bootstrap sections (server, auth, mode) are written to YAML.
+   * Runtime settings must use setSection() which writes to SQL.
+   */
+  update(section, data) {
+    if (!_ConfigManager.BOOTSTRAP_SECTIONS.has(section)) {
+      throw new Error(
+        `[ConfigManager] Section "${section}" is a runtime setting \u2014 use setSection() to write to DB, not update() which writes to config.yaml`
+      );
+    }
+    let raw = {};
+    if (fs3.existsSync(this.configPath)) {
+      raw = yaml.load(fs3.readFileSync(this.configPath, "utf-8")) ?? {};
+    }
+    const existing = raw[section] ?? {};
+    raw[section] = { ...existing, ...data };
+    const validation = bootstrapSchema.safeParse(raw);
+    if (!validation.success) {
+      throw new Error(`[ConfigManager] Invalid config update for section "${section}": ${validation.error.message}`);
+    }
+    const tmpPath = `${this.configPath}.tmp`;
+    fs3.writeFileSync(tmpPath, yaml.dump(raw, { lineWidth: 120, indent: 2, quotingType: '"' }), "utf-8");
+    fs3.renameSync(tmpPath, this.configPath);
+    this.bootstrapConfig = validation.data;
+  }
+  /**
+   * Deep-set a value in a nested plain object using a dot-notation path.
+   * Returns a new object (immutable).
+   */
+  setNested(obj, path3, value) {
+    const [head, ...rest] = path3.split(".");
+    if (!head) return obj;
+    if (rest.length === 0) {
+      return { ...obj, [head]: value };
+    }
+    const child = obj[head] ?? {};
+    return { ...obj, [head]: this.setNested(child, rest.join("."), value) };
+  }
+  /**
+   * Apply env var overrides onto the raw YAML object.
+   * Only bootstrap-level env vars are applied.
+   */
+  applyEnvOverrides(raw) {
+    let result = { ...raw };
+    for (const [envKey, configPath] of Object.entries(ENV_VAR_MAP)) {
+      const envValue = process.env[envKey];
+      if (envValue === void 0 || envValue === "") continue;
+      const coerced = configPath === "server.port" ? Number(envValue) : envValue;
+      result = this.setNested(result, configPath, coerced);
+      console.log(`[ConfigManager] Env override applied: ${envKey} \u2192 ${configPath}`);
+    }
+    return result;
+  }
+  loadYaml() {
+    if (!fs3.existsSync(this.configPath)) {
+      console.warn(
+        `[ConfigManager] Config file not found at: ${this.configPath}
+  \u2192 Using built-in defaults. Set CONFIG_PATH env var or create the file.
+  \u2192 Example path from project root: ./server/backend/data/config.yaml`
+      );
+      return {};
+    }
+    const content = fs3.readFileSync(this.configPath, "utf-8");
+    const parsed = yaml.load(content) ?? {};
+    console.log(`[ConfigManager] Loaded config from: ${this.configPath}`);
+    return parsed;
+  }
+  warnDefaultCredentials() {
+    if (this.bootstrapConfig.auth.adminPassword === "changeme") {
+      console.warn(
+        `[ConfigManager] Warning: Using default admin password "changeme". Set auth.adminPassword in your config.yaml or the ADMIN_PASSWORD env var.`
+      );
+    }
+  }
+  getFromBootstrap(path3) {
+    const keys = path3.split(".");
+    let current = this.bootstrapConfig;
+    for (const key of keys) {
+      if (current === null || current === void 0 || typeof current !== "object") {
+        return void 0;
       }
-      /** Mark an addon as fallen back to in-process */
-      markFallbackInProcess(addonId) {
-        this.fallbackInProcess.add(addonId);
+      current = current[key];
+    }
+    return current;
+  }
+  getFromRuntimeDefaults(path3) {
+    const prefix = path3 + ".";
+    const result = {};
+    let found = false;
+    for (const [key, value] of Object.entries(RUNTIME_DEFAULTS)) {
+      if (key.startsWith(prefix)) {
+        const subKey = key.slice(prefix.length);
+        result[subKey] = value;
+        found = true;
       }
-      /**
-       * Determine if an addon should be forked.
-       * Default: fork everything except infra addons.
-       * Addons can opt out with `inProcess: true` in declaration.
-       * Emergency fallback: CAMSTACK_FORCE_INPROCESS=true disables all forking.
-       */
-      shouldFork(addonId, declaration) {
-        if (this.options.forceInProcess)
-          return false;
-        if (this.options.devMode)
-          return false;
-        if (this.isInfraAddon(addonId))
-          return false;
-        if (this.fallbackInProcess.has(addonId))
-          return false;
-        if (declaration?.inProcess === true)
-          return false;
-        if (declaration?.forkable !== true)
-          return false;
-        return true;
+    }
+    return found ? result : void 0;
+  }
+  /**
+   * Perform a prefix-based nested lookup against SQL system_settings.
+   * e.g. path='features' matches keys 'features.streaming', 'features.notifications', etc.
+   * Returns an object keyed by the sub-key, or undefined if nothing is found.
+   */
+  getNestedFromSystemSettings(path3) {
+    if (this.settingsStore === null) return void 0;
+    const all = this.settingsStore.getAllSystem();
+    const prefix = path3 + ".";
+    const result = {};
+    let found = false;
+    for (const [key, value] of Object.entries(all)) {
+      if (key.startsWith(prefix)) {
+        result[key.slice(prefix.length)] = value;
+        found = true;
       }
-      /** Fork a worker for an addon */
-      async forkWorker(addonId, addonDir, config, storagePaths, dataDir, locationPaths, workerToken) {
-        if (this.workers.has(addonId)) {
-          throw new Error(`Worker for addon "${addonId}" already exists`);
-        }
-        const workerEnv = {
-          PATH: process.env.PATH ?? "",
-          HOME: process.env.HOME ?? "",
-          NODE_ENV: process.env.NODE_ENV ?? "production",
-          NODE_TLS_REJECT_UNAUTHORIZED: "0",
-          // Accept self-signed cert
-          CAMSTACK_WORKER_HUB_URL: `wss://localhost:${process.env.CAMSTACK_PORT ?? "4443"}/trpc`,
-          CAMSTACK_WORKER_TOKEN: workerToken ?? "",
-          CAMSTACK_ADDON_ID: addonId,
-          CAMSTACK_ADDON_DIR: addonDir,
-          CAMSTACK_ADDON_CONFIG: JSON.stringify(config),
-          CAMSTACK_DATA_DIR: dataDir ?? `camstack-data/addons-data/${addonId}`,
-          CAMSTACK_LOCATION_PATHS: JSON.stringify(locationPaths ?? storagePaths)
-        };
-        const forkOptions = {
-          stdio: ["inherit", "inherit", "inherit", "ipc"],
-          execArgv: [],
-          env: workerEnv
-        };
-        const child = (0, node_child_process_1.fork)(this.options.workerEntryPath, [], forkOptions);
-        const worker = {
+    }
+    return found ? result : void 0;
+  }
+};
+
+// src/worker/addon-worker-host.ts
+import { fork } from "child_process";
+var INFRA_ADDON_IDS = /* @__PURE__ */ new Set([
+  "filesystem-storage",
+  "sqlite-settings",
+  "winston-logging"
+]);
+var AddonWorkerHost = class {
+  workers = /* @__PURE__ */ new Map();
+  options;
+  heartbeatTimer = null;
+  /** Set of addons that failed to fork and fell back to in-process */
+  fallbackInProcess = /* @__PURE__ */ new Set();
+  constructor(options) {
+    this.options = {
+      workerEntryPath: options.workerEntryPath,
+      devMode: options.devMode ?? false,
+      forceInProcess: options.forceInProcess ?? process.env.CAMSTACK_FORCE_INPROCESS === "true",
+      heartbeatIntervalMs: options.heartbeatIntervalMs ?? 5e3,
+      heartbeatTimeoutMs: options.heartbeatTimeoutMs ?? 3e4,
+      maxCrashesInWindow: options.maxCrashesInWindow ?? 3,
+      crashWindowMs: options.crashWindowMs ?? 6e4,
+      shutdownTimeoutMs: options.shutdownTimeoutMs ?? 1e4,
+      onWorkerLog: options.onWorkerLog
+    };
+  }
+  /** Check if an addon is infrastructure (must stay in-process) */
+  isInfraAddon(addonId) {
+    return INFRA_ADDON_IDS.has(addonId);
+  }
+  /** Check if an addon fell back to in-process after fork failure */
+  isFallbackInProcess(addonId) {
+    return this.fallbackInProcess.has(addonId);
+  }
+  /** Mark an addon as fallen back to in-process */
+  markFallbackInProcess(addonId) {
+    this.fallbackInProcess.add(addonId);
+  }
+  /**
+   * Determine if an addon should be forked.
+   * Default: fork everything except infra addons.
+   * Addons can opt out with `inProcess: true` in declaration.
+   * Emergency fallback: CAMSTACK_FORCE_INPROCESS=true disables all forking.
+   */
+  shouldFork(addonId, declaration) {
+    if (this.options.forceInProcess) return false;
+    if (this.options.devMode) return false;
+    if (this.isInfraAddon(addonId)) return false;
+    if (this.fallbackInProcess.has(addonId)) return false;
+    if (declaration?.inProcess === true) return false;
+    if (declaration?.forkable !== true) return false;
+    return true;
+  }
+  /** Fork a worker for an addon */
+  async forkWorker(addonId, addonDir, config, storagePaths, dataDir, locationPaths, workerToken) {
+    if (this.workers.has(addonId)) {
+      throw new Error(`Worker for addon "${addonId}" already exists`);
+    }
+    const workerEnv = {
+      PATH: process.env.PATH ?? "",
+      HOME: process.env.HOME ?? "",
+      NODE_ENV: process.env.NODE_ENV ?? "production",
+      NODE_TLS_REJECT_UNAUTHORIZED: "0",
+      // Accept self-signed cert
+      CAMSTACK_WORKER_HUB_URL: `wss://localhost:${process.env.CAMSTACK_PORT ?? "4443"}/trpc`,
+      CAMSTACK_WORKER_TOKEN: workerToken ?? "",
+      CAMSTACK_ADDON_ID: addonId,
+      CAMSTACK_ADDON_DIR: addonDir,
+      CAMSTACK_ADDON_CONFIG: JSON.stringify(config),
+      CAMSTACK_DATA_DIR: dataDir ?? `camstack-data/addons-data/${addonId}`,
+      CAMSTACK_LOCATION_PATHS: JSON.stringify(locationPaths ?? storagePaths)
+    };
+    const forkOptions = {
+      stdio: ["inherit", "inherit", "inherit", "ipc"],
+      execArgv: [],
+      env: workerEnv
+    };
+    const child = fork(this.options.workerEntryPath, [], forkOptions);
+    const worker = {
+      addonId,
+      process: child,
+      state: "starting",
+      startedAt: Date.now(),
+      lastHeartbeat: Date.now(),
+      restartCount: 0,
+      crashTimestamps: [],
+      cpuPercent: 0,
+      memoryRss: 0,
+      workerToken,
+      forkConfig: { addonDir, config, storagePaths, dataDir, locationPaths, workerToken }
+    };
+    this.workers.set(addonId, worker);
+    child.on("message", (msg) => {
+      if (msg.type === "LOG" && this.options.onWorkerLog) {
+        this.options.onWorkerLog({
           addonId,
-          process: child,
-          state: "starting",
-          startedAt: Date.now(),
-          lastHeartbeat: Date.now(),
-          restartCount: 0,
-          crashTimestamps: [],
-          cpuPercent: 0,
-          memoryRss: 0,
-          workerToken
-        };
-        this.workers.set(addonId, worker);
-        child.on("message", (msg) => {
-          if (msg.type === "LOG" && this.options.onWorkerLog) {
-            this.options.onWorkerLog({
-              addonId,
-              level: msg.level,
-              message: msg.message,
-              scope: ["hub", addonId],
-              meta: msg.context
-            });
-          } else if (msg.type === "STATS") {
-            worker.cpuPercent = msg.cpu;
-            worker.memoryRss = msg.memory;
-          }
-        });
-        child.stdout?.on("data", (chunk) => {
-          const lines = chunk.toString().trim();
-          if (!lines)
-            return;
-          if (this.options.onWorkerLog) {
-            this.options.onWorkerLog({
-              addonId,
-              level: "info",
-              message: lines,
-              scope: ["hub", addonId, "__stdout"]
-            });
-          } else {
-            console.log(`[Worker:${addonId}] ${lines}`);
-          }
-        });
-        child.stderr?.on("data", (chunk) => {
-          const lines = chunk.toString().trim();
-          if (!lines)
-            return;
-          if (this.options.onWorkerLog) {
-            this.options.onWorkerLog({
-              addonId,
-              level: "error",
-              message: lines,
-              scope: ["hub", addonId, "__stderr"]
-            });
-          } else {
-            console.error(`[Worker:${addonId}:ERR] ${lines}`);
-          }
+          level: msg.level,
+          message: msg.message,
+          scope: ["hub", addonId],
+          meta: msg.context
         });
-        child.on("exit", (code) => {
-          this.handleWorkerExit(addonId, code, addonDir, config, storagePaths, dataDir, locationPaths, workerToken);
-        });
-        child.on("error", (err) => {
-          console.error(`[WorkerHost] Worker ${addonId} error:`, err.message);
-        });
-        await new Promise((resolve, reject) => {
-          const timeout = setTimeout(() => {
-            reject(new Error(`Worker ${addonId} did not become ready within 30s`));
-          }, 3e4);
-          const readyCheck = (msg) => {
-            if (msg.type === "READY") {
-              clearTimeout(timeout);
-              child.off("message", readyCheck);
-              worker.state = "running";
-              resolve();
-            }
-          };
-          child.on("message", readyCheck);
-        });
-      }
-      /** List all workers with stats */
-      listWorkers() {
-        return [...this.workers.values()].map((w) => ({
-          addonId: w.addonId,
-          pid: w.process.pid ?? 0,
-          state: w.state,
-          cpuPercent: w.cpuPercent,
-          memoryRss: w.memoryRss,
-          uptimeSeconds: Math.round((Date.now() - w.startedAt) / 1e3),
-          restartCount: w.restartCount,
-          subProcesses: []
-        }));
-      }
-      /** Gracefully shutdown a single worker by addon ID */
-      async shutdownWorkerById(addonId) {
-        const worker = this.workers.get(addonId);
-        if (!worker) {
-          throw new Error(`No worker found for addon "${addonId}"`);
-        }
-        await this.shutdownWorker(addonId, worker);
-        this.workers.delete(addonId);
-      }
-      /** Gracefully shutdown all workers */
-      async shutdownAll() {
-        if (this.heartbeatTimer) {
-          clearInterval(this.heartbeatTimer);
-          this.heartbeatTimer = null;
-        }
-        const shutdowns = [...this.workers.entries()].map(([addonId, worker]) => this.shutdownWorker(addonId, worker));
-        await Promise.allSettled(shutdowns);
-        this.workers.clear();
-      }
-      /** Start heartbeat monitoring — workers now report heartbeat via tRPC, not IPC PING */
-      startHeartbeatMonitoring() {
-        this.heartbeatTimer = setInterval(() => {
-          const now = Date.now();
-          for (const [addonId, worker] of this.workers) {
-            if (worker.state !== "running")
-              continue;
-            if (now - worker.lastHeartbeat > this.options.heartbeatTimeoutMs) {
-              console.warn(`[WorkerHost] Worker ${addonId} heartbeat timeout \u2014 marking unresponsive`);
-              worker.state = "crashed";
-              worker.process.kill("SIGKILL");
-            }
-          }
-        }, this.options.heartbeatIntervalMs);
+      } else if (msg.type === "STATS") {
+        worker.cpuPercent = msg.cpu;
+        worker.memoryRss = msg.memory;
       }
-      /** Update heartbeat timestamp for a worker (called when agent.heartbeat arrives) */
-      updateWorkerHeartbeat(addonId, cpuPercent, memoryRss) {
-        const worker = this.workers.get(addonId);
-        if (!worker)
-          return;
-        worker.lastHeartbeat = Date.now();
-        if (cpuPercent !== void 0)
-          worker.cpuPercent = cpuPercent;
-        if (memoryRss !== void 0)
-          worker.memoryRss = memoryRss;
-      }
-      handleWorkerExit(addonId, code, addonDir, config, storagePaths, dataDir, locationPaths, workerToken) {
-        const worker = this.workers.get(addonId);
-        if (!worker)
-          return;
-        if (worker.state === "stopping") {
-          worker.state = "stopped";
-          return;
-        }
-        worker.state = "crashed";
-        console.error(`[WorkerHost] Worker ${addonId} exited with code ${code}`);
-        const now = Date.now();
-        worker.crashTimestamps.push(now);
-        const recentCrashes = worker.crashTimestamps.filter((t) => now - t < this.options.crashWindowMs);
-        worker.crashTimestamps = recentCrashes;
-        if (recentCrashes.length >= this.options.maxCrashesInWindow) {
-          console.error(`[WorkerHost] Worker ${addonId} crashed ${recentCrashes.length} times in ${this.options.crashWindowMs}ms \u2014 not restarting`);
-          return;
-        }
-        const backoff = Math.min(2e3 * (worker.restartCount + 1), 3e4);
-        console.log(`[WorkerHost] Restarting worker ${addonId} in ${backoff}ms`);
-        setTimeout(() => {
-          worker.restartCount++;
-          this.workers.delete(addonId);
-          this.forkWorker(addonId, addonDir, config, storagePaths, dataDir, locationPaths, workerToken).catch((err) => {
-            console.error(`[WorkerHost] Failed to restart worker ${addonId}:`, err);
-          });
-        }, backoff);
+    });
+    child.stdout?.on("data", (chunk) => {
+      const lines = chunk.toString().trim();
+      if (!lines) return;
+      if (this.options.onWorkerLog) {
+        this.options.onWorkerLog({
+          addonId,
+          level: "info",
+          message: lines,
+          scope: ["hub", addonId, "__stdout"]
+        });
+      } else {
+        console.log(`[Worker:${addonId}] ${lines}`);
       }
-      async shutdownWorker(addonId, worker) {
-        worker.state = "stopping";
-        worker.process.kill("SIGTERM");
-        await new Promise((resolve) => {
-          const timeout = setTimeout(() => {
-            console.warn(`[WorkerHost] Worker ${addonId} did not exit within ${this.options.shutdownTimeoutMs}ms \u2014 SIGKILL`);
-            worker.process.kill("SIGKILL");
-            resolve();
-          }, this.options.shutdownTimeoutMs);
-          worker.process.on("exit", () => {
-            clearTimeout(timeout);
-            resolve();
-          });
+    });
+    child.stderr?.on("data", (chunk) => {
+      const lines = chunk.toString().trim();
+      if (!lines) return;
+      if (this.options.onWorkerLog) {
+        this.options.onWorkerLog({
+          addonId,
+          level: "error",
+          message: lines,
+          scope: ["hub", addonId, "__stderr"]
         });
+      } else {
+        console.error(`[Worker:${addonId}:ERR] ${lines}`);
       }
-    };
-    exports.AddonWorkerHost = AddonWorkerHost2;
+    });
+    child.on("exit", (code) => {
+      this.handleWorkerExit(addonId, code, addonDir, config, storagePaths, dataDir, locationPaths, workerToken);
+    });
+    child.on("error", (err) => {
+      console.error(`[WorkerHost] Worker ${addonId} error:`, err.message);
+    });
+    await new Promise((resolve3, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error(`Worker ${addonId} did not become ready within 30s`));
+      }, 3e4);
+      const readyCheck = (msg) => {
+        if (msg.type === "READY") {
+          clearTimeout(timeout);
+          child.off("message", readyCheck);
+          worker.state = "running";
+          resolve3();
+        }
+      };
+      child.on("message", readyCheck);
+    });
   }
-});
-
-// src/index.ts
-var import_addon_loader = __toESM(require_addon_loader());
-var import_addon_engine_manager = __toESM(require_addon_engine_manager());
-var import_addon_installer = __toESM(require_addon_installer());
-var import_fs_utils = __toESM(require_fs_utils());
-var import_workspace_detect = __toESM(require_workspace_detect());
-var import_capability_registry = __toESM(require_capability_registry());
-var import_infra_capabilities = __toESM(require_infra_capabilities());
-var import_config_manager = __toESM(require_config_manager());
-var import_config_schema = __toESM(require_config_schema());
-var import_addon_worker_host = __toESM(require_addon_worker_host());
-var import_worker_process_manager = __toESM(require_worker_process_manager());
-var export_AddonEngineManager = import_addon_engine_manager.AddonEngineManager;
-var export_AddonInstaller = import_addon_installer.AddonInstaller;
-var export_AddonLoader = import_addon_loader.AddonLoader;
-var export_AddonWorkerHost = import_addon_worker_host.AddonWorkerHost;
-var export_CapabilityRegistry = import_capability_registry.CapabilityRegistry;
-var export_ConfigManager = import_config_manager.ConfigManager;
-var export_DEFAULT_DATA_PATH = import_config_schema.DEFAULT_DATA_PATH;
-var export_INFRA_CAPABILITIES = import_infra_capabilities.INFRA_CAPABILITIES;
-var export_RUNTIME_DEFAULTS = import_config_schema.RUNTIME_DEFAULTS;
-var export_WorkerProcessManager = import_worker_process_manager.WorkerProcessManager;
-var export_bootstrapSchema = import_config_schema.bootstrapSchema;
-var export_copyDirRecursive = import_fs_utils.copyDirRecursive;
-var export_copyExtraFileDirs = import_fs_utils.copyExtraFileDirs;
-var export_detectWorkspacePackagesDir = import_workspace_detect.detectWorkspacePackagesDir;
-var export_ensureDir = import_fs_utils.ensureDir;
-var export_ensureLibraryBuilt = import_fs_utils.ensureLibraryBuilt;
-var export_installPackageFromNpmSync = import_fs_utils.installPackageFromNpmSync;
-var export_isInfraCapability = import_infra_capabilities.isInfraCapability;
-var export_isSourceNewer = import_fs_utils.isSourceNewer;
-var export_stripCamstackDeps = import_fs_utils.stripCamstackDeps;
-var export_symlinkAddonsToNodeModules = import_fs_utils.symlinkAddonsToNodeModules;
+  /** List all workers with stats */
+  listWorkers() {
+    return [...this.workers.values()].map((w) => ({
+      addonId: w.addonId,
+      pid: w.process.pid ?? 0,
+      state: w.state,
+      cpuPercent: w.cpuPercent,
+      memoryRss: w.memoryRss,
+      uptimeSeconds: Math.round((Date.now() - w.startedAt) / 1e3),
+      restartCount: w.restartCount,
+      subProcesses: []
+    }));
+  }
+  /** Gracefully shutdown a single worker by addon ID */
+  async shutdownWorkerById(addonId) {
+    const worker = this.workers.get(addonId);
+    if (!worker) {
+      throw new Error(`No worker found for addon "${addonId}"`);
+    }
+    await this.shutdownWorker(addonId, worker);
+    this.workers.delete(addonId);
+  }
+  /** Gracefully restart a single worker by addon ID (stop then re-fork with same config) */
+  async restartWorker(addonId) {
+    const worker = this.workers.get(addonId);
+    if (!worker) {
+      throw new Error(`No worker found for addon "${addonId}"`);
+    }
+    const forkConfig = worker.forkConfig;
+    if (!forkConfig) {
+      throw new Error(`No fork config stored for addon "${addonId}" \u2014 cannot restart`);
+    }
+    await this.shutdownWorker(addonId, worker);
+    this.workers.delete(addonId);
+    await this.forkWorker(
+      addonId,
+      forkConfig.addonDir,
+      forkConfig.config,
+      forkConfig.storagePaths,
+      forkConfig.dataDir,
+      forkConfig.locationPaths,
+      forkConfig.workerToken
+    );
+  }
+  /** Gracefully shutdown all workers */
+  async shutdownAll() {
+    if (this.heartbeatTimer) {
+      clearInterval(this.heartbeatTimer);
+      this.heartbeatTimer = null;
+    }
+    const shutdowns = [...this.workers.entries()].map(
+      ([addonId, worker]) => this.shutdownWorker(addonId, worker)
+    );
+    await Promise.allSettled(shutdowns);
+    this.workers.clear();
+  }
+  /** Start heartbeat monitoring — workers now report heartbeat via tRPC, not IPC PING */
+  startHeartbeatMonitoring() {
+    this.heartbeatTimer = setInterval(() => {
+      const now = Date.now();
+      for (const [addonId, worker] of this.workers) {
+        if (worker.state !== "running") continue;
+        if (now - worker.lastHeartbeat > this.options.heartbeatTimeoutMs) {
+          console.warn(`[WorkerHost] Worker ${addonId} heartbeat timeout \u2014 marking unresponsive`);
+          worker.state = "crashed";
+          worker.process.kill("SIGKILL");
+        }
+      }
+    }, this.options.heartbeatIntervalMs);
+  }
+  /** Update heartbeat timestamp for a worker (called when agent.heartbeat arrives) */
+  updateWorkerHeartbeat(addonId, cpuPercent, memoryRss) {
+    const worker = this.workers.get(addonId);
+    if (!worker) return;
+    worker.lastHeartbeat = Date.now();
+    if (cpuPercent !== void 0) worker.cpuPercent = cpuPercent;
+    if (memoryRss !== void 0) worker.memoryRss = memoryRss;
+  }
+  handleWorkerExit(addonId, code, addonDir, config, storagePaths, dataDir, locationPaths, workerToken) {
+    const worker = this.workers.get(addonId);
+    if (!worker) return;
+    if (worker.state === "stopping") {
+      worker.state = "stopped";
+      return;
+    }
+    worker.state = "crashed";
+    console.error(`[WorkerHost] Worker ${addonId} exited with code ${code}`);
+    const now = Date.now();
+    worker.crashTimestamps.push(now);
+    const recentCrashes = worker.crashTimestamps.filter(
+      (t) => now - t < this.options.crashWindowMs
+    );
+    worker.crashTimestamps = recentCrashes;
+    if (recentCrashes.length >= this.options.maxCrashesInWindow) {
+      console.error(`[WorkerHost] Worker ${addonId} crashed ${recentCrashes.length} times in ${this.options.crashWindowMs}ms \u2014 not restarting`);
+      return;
+    }
+    const backoff = Math.min(2e3 * (worker.restartCount + 1), 3e4);
+    console.log(`[WorkerHost] Restarting worker ${addonId} in ${backoff}ms`);
+    setTimeout(() => {
+      worker.restartCount++;
+      this.workers.delete(addonId);
+      this.forkWorker(addonId, addonDir, config, storagePaths, dataDir, locationPaths, workerToken).catch((err) => {
+        console.error(`[WorkerHost] Failed to restart worker ${addonId}:`, err);
+      });
+    }, backoff);
+  }
+  async shutdownWorker(addonId, worker) {
+    worker.state = "stopping";
+    worker.process.kill("SIGTERM");
+    await new Promise((resolve3) => {
+      const timeout = setTimeout(() => {
+        console.warn(`[WorkerHost] Worker ${addonId} did not exit within ${this.options.shutdownTimeoutMs}ms \u2014 SIGKILL`);
+        worker.process.kill("SIGKILL");
+        resolve3();
+      }, this.options.shutdownTimeoutMs);
+      worker.process.on("exit", () => {
+        clearTimeout(timeout);
+        resolve3();
+      });
+    });
+  }
+};
 export {
-  export_AddonEngineManager as AddonEngineManager,
-  export_AddonInstaller as AddonInstaller,
-  export_AddonLoader as AddonLoader,
-  export_AddonWorkerHost as AddonWorkerHost,
-  export_CapabilityRegistry as CapabilityRegistry,
-  export_ConfigManager as ConfigManager,
-  export_DEFAULT_DATA_PATH as DEFAULT_DATA_PATH,
-  export_INFRA_CAPABILITIES as INFRA_CAPABILITIES,
-  export_RUNTIME_DEFAULTS as RUNTIME_DEFAULTS,
-  export_WorkerProcessManager as WorkerProcessManager,
-  export_bootstrapSchema as bootstrapSchema,
-  export_copyDirRecursive as copyDirRecursive,
-  export_copyExtraFileDirs as copyExtraFileDirs,
-  export_detectWorkspacePackagesDir as detectWorkspacePackagesDir,
-  export_ensureDir as ensureDir,
-  export_ensureLibraryBuilt as ensureLibraryBuilt,
-  export_installPackageFromNpmSync as installPackageFromNpmSync,
-  export_isInfraCapability as isInfraCapability,
-  export_isSourceNewer as isSourceNewer,
-  export_stripCamstackDeps as stripCamstackDeps,
-  export_symlinkAddonsToNodeModules as symlinkAddonsToNodeModules
+  AddonEngineManager,
+  AddonInstaller,
+  AddonLoader,
+  AddonWorkerHost,
+  CapabilityRegistry,
+  ConfigManager,
+  DEFAULT_DATA_PATH,
+  INFRA_CAPABILITIES,
+  RUNTIME_DEFAULTS,
+  WorkerProcessManager,
+  bootstrapSchema,
+  copyDirRecursive,
+  copyExtraFileDirs,
+  detectWorkspacePackagesDir,
+  ensureDir,
+  ensureLibraryBuilt,
+  installPackageFromNpmSync,
+  isInfraCapability,
+  isSourceNewer,
+  stripCamstackDeps,
+  symlinkAddonsToNodeModules
 };
 //# sourceMappingURL=index.mjs.map