@camstack/server 0.1.7 → 0.1.8

package/src/api/trpc/trpc.router.ts

@@ -11,7 +11,7 @@ import { trpcRouter } from './trpc.middleware'
 //   streaming → `streamingManagement` cap, events → `eventQuery` cap,
 //   logs → kept manual, live → kept manual, processes → `processMgmt`
 //   cap, agents → `nodes` cap, sessions → `session` cap, trackMedia /
-//   trackTrail → caps, recording → `recordingEngine` cap, network →
+//   trackTrail → caps, network →
 //   `networkQuality` cap, addons → `addons` cap, bridgePipeline removed
 //   (legacy), detection → `detectionConfig` cap, capabilities → kept
 //   manual, update → addons cap, addonPages → cap, notification →
@@ -20,7 +20,7 @@ import { trpcRouter } from './trpc.middleware'
 //   `pipelineExecutor` cap, pipeline → `pipelineConfig` cap,
 //   systemEvents → kept manual.
 import type { CapabilityRegistry } from '@camstack/kernel'
-import type { InferProvider } from '@camstack/types'
+import type { InferProvider, BrokerConsumerAttribution } from '@camstack/types'
 import {
   pipelineExecutorCapability,
   pipelineRunnerCapability,
@@ -76,6 +76,7 @@ import { createCapabilitiesRouter } from '../core/capabilities.router.js'
 import { createStreamProbeRouter } from '../core/stream-probe.router.js'
 import { createHwAccelRouter } from '../core/hwaccel.router.js'
 import { requireSingleton, firstSupported, anySupports } from './cap-mount-helpers.js'
+import { extractUserAgent } from './client-ip.js'
 import type { TrpcContext } from './trpc.context.js'
 import type { AuthService } from '../../core/auth/auth.service'
 import type { ConfigService } from '../../core/config/config.service'
@@ -112,6 +113,28 @@ export interface RouterServices {
 }
 
 type WebrtcSessionProvider = InferProvider<typeof webrtcSessionCapability>
+type CreateSessionInput = Parameters<WebrtcSessionProvider['createSession']>[0]
+type HandleOfferInput = Parameters<WebrtcSessionProvider['handleOffer']>[0]
+
+/**
+ * Merge the server-read User-Agent into a signaling call's
+ * `consumerAttribution`, building a NEW input object (immutable — never
+ * mutates the caller's input). When `userAgent` is null (mesh-originated
+ * call, or a client that omits the header) the input passes through
+ * unchanged. Any client-supplied `userAgent` is OVERWRITTEN — the hub
+ * trusts only the request context, never the client.
+ */
+export function enrichInputWithUserAgent<TInput extends { consumerAttribution?: BrokerConsumerAttribution }>(
+  input: TInput,
+  userAgent: string | null,
+): TInput {
+  if (userAgent === null) return input
+  const base: BrokerConsumerAttribution = input.consumerAttribution ?? { kind: 'webrtc-browser' }
+  return {
+    ...input,
+    consumerAttribution: { ...base, userAgent },
+  }
+}
 
 /**
  * Relay-only forcing for remote viewers is DISABLED (2026-05-26).
@@ -124,13 +147,26 @@ type WebrtcSessionProvider = InferProvider<typeof webrtcSessionCapability>
  * advertised Tailscale address, srflx, relay) and let ICE nominate the best
  * reachable pair: direct when possible, relay only as a fallback. The
  * `relayOnly` cap field + broker support remain for when relay media-forward
- * is fixed; this wrapper is a pass-through for now.
+ * is fixed.
+ *
+ * The wrapper additionally enriches the `createSession` / `handleOffer`
+ * subscriber attribution with the originating client's User-Agent, read
+ * from the tRPC request context (browser sessions). All OTHER methods
+ * delegate straight through — auth, the remote-proxy factory and every
+ * signaling behaviour are untouched.
  */
-function wrapWebrtcSessionProviderWithRelay(
+export function wrapWebrtcSessionProviderWithRelay(
   provider: WebrtcSessionProvider,
-  _ctx: TrpcContext,
+  ctx: TrpcContext,
 ): WebrtcSessionProvider {
-  return provider
+  const userAgent = extractUserAgent(ctx.req)
+  return {
+    ...provider,
+    createSession: (input: CreateSessionInput) =>
+      provider.createSession(enrichInputWithUserAgent(input, userAgent)),
+    handleOffer: (input: HandleOfferInput) =>
+      provider.handleOffer(enrichInputWithUserAgent(input, userAgent)),
+  }
 }
 
 /**
@@ -191,7 +227,7 @@ function buildCapabilityRouters(services: RouterServices) {
       (ctx) => buildToastProvider(services.toastService, ctx),
     ),
     integrations: createCapRouter_integrations(
-      (_ctx) => buildIntegrationsProvider(services.addonRegistry, services.eventBus, services.loggingService),
+      (_ctx) => buildIntegrationsProvider(services.addonRegistry, services.eventBus, services.loggingService, services.capabilityRegistry),
     ),
     nodes: createCapRouter_nodes(
       (_ctx) => buildNodesProvider(

package/src/boot/__tests__/integration-id-backfill.spec.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect } from 'vitest'
+import { planIntegrationIdBackfill, planDeleteTimeStamps, runIntegrationIdBackfill } from '../integration-id-backfill'
+
+describe('planDeleteTimeStamps', () => {
+  it('claims an untagged top-level device of the deleted integration\'s single-integration addon', () => {
+    const stamps = planDeleteTimeStamps(
+      'int_rtsp',
+      [{ id: 'int_rtsp', addonId: 'provider-rtsp' }],
+      [
+        { id: 4, addonId: 'provider-rtsp', parentDeviceId: null },
+        { id: 6, addonId: 'provider-rtsp', parentDeviceId: null },
+      ],
+    )
+    expect(stamps).toEqual([
+      { deviceId: 4, integrationId: 'int_rtsp' },
+      { deviceId: 6, integrationId: 'int_rtsp' },
+    ])
+  })
+
+  it('returns no stamps for a multi-integration addon (ambiguous — never auto-claim)', () => {
+    const stamps = planDeleteTimeStamps(
+      'int_a',
+      [{ id: 'int_a', addonId: 'provider-ha' }, { id: 'int_b', addonId: 'provider-ha' }],
+      [{ id: 11, addonId: 'provider-ha', parentDeviceId: null }],
+    )
+    expect(stamps).toEqual([])
+  })
+
+  it('only returns stamps for the integration being deleted, not siblings of other addons', () => {
+    const stamps = planDeleteTimeStamps(
+      'int_rtsp',
+      [{ id: 'int_rtsp', addonId: 'provider-rtsp' }, { id: 'int_onvif', addonId: 'provider-onvif' }],
+      [
+        { id: 4, addonId: 'provider-rtsp', parentDeviceId: null },
+        { id: 5, addonId: 'provider-onvif', parentDeviceId: null },
+      ],
+    )
+    expect(stamps).toEqual([{ deviceId: 4, integrationId: 'int_rtsp' }])
+  })
+
+  it('skips devices already tagged with the deleted integration', () => {
+    const stamps = planDeleteTimeStamps(
+      'int_rtsp',
+      [{ id: 'int_rtsp', addonId: 'provider-rtsp' }],
+      [{ id: 4, addonId: 'provider-rtsp', parentDeviceId: null, integrationId: 'int_rtsp' }],
+    )
+    expect(stamps).toEqual([])
+  })
+})
+
+describe('planIntegrationIdBackfill', () => {
+  it('stamps a top-level untagged device whose addon has exactly one integration', () => {
+    const stamps = planIntegrationIdBackfill(
+      [{ id: 'int_1', addonId: 'provider-rtsp' }],
+      [{ id: 10, addonId: 'provider-rtsp', parentDeviceId: null }],
+    )
+    expect(stamps).toEqual([{ deviceId: 10, integrationId: 'int_1' }])
+  })
+
+  it('skips devices whose addon hosts multiple integrations (ambiguous)', () => {
+    const stamps = planIntegrationIdBackfill(
+      [{ id: 'int_a', addonId: 'provider-ha' }, { id: 'int_b', addonId: 'provider-ha' }],
+      [{ id: 11, addonId: 'provider-ha', parentDeviceId: null }],
+    )
+    expect(stamps).toEqual([])
+  })
+
+  it('skips already-tagged devices and child devices', () => {
+    const stamps = planIntegrationIdBackfill(
+      [{ id: 'int_1', addonId: 'provider-rtsp' }],
+      [
+        { id: 12, addonId: 'provider-rtsp', parentDeviceId: null, integrationId: 'int_1' },
+        { id: 13, addonId: 'provider-rtsp', parentDeviceId: 12 },
+      ],
+    )
+    expect(stamps).toEqual([])
+  })
+
+  it('skips devices whose addon has no integration', () => {
+    const stamps = planIntegrationIdBackfill(
+      [{ id: 'int_1', addonId: 'provider-rtsp' }],
+      [{ id: 14, addonId: 'provider-onvif', parentDeviceId: null }],
+    )
+    expect(stamps).toEqual([])
+  })
+})
+
+describe('runIntegrationIdBackfill', () => {
+  it('applies stamps and reports the count, skipping failures', async () => {
+    const stamped: Array<{ deviceId: number; integrationId: string }> = []
+    const result = await runIntegrationIdBackfill({
+      listIntegrations: async () => [{ id: 'int_1', addonId: 'provider-rtsp' }],
+      listDevices: async () => [
+        { id: 10, addonId: 'provider-rtsp', parentDeviceId: null },
+        { id: 11, addonId: 'provider-rtsp', parentDeviceId: null },
+      ],
+      setIntegrationId: async (deviceId, integrationId) => {
+        if (deviceId === 11) throw new Error('boom')
+        stamped.push({ deviceId, integrationId })
+      },
+      logger: { info: () => {}, warn: () => {} },
+    })
+    expect(result).toEqual({ stamped: 1 })
+    expect(stamped).toEqual([{ deviceId: 10, integrationId: 'int_1' }])
+  })
+
+  it('does nothing when there is nothing to stamp', async () => {
+    const result = await runIntegrationIdBackfill({
+      listIntegrations: async () => [],
+      listDevices: async () => [],
+      setIntegrationId: async () => { throw new Error('should not be called') },
+      logger: { info: () => {}, warn: () => {} },
+    })
+    expect(result).toEqual({ stamped: 0 })
+  })
+})

package/src/boot/integration-id-backfill.ts

@@ -0,0 +1,109 @@
+/**
+ * One-time integration-id backfill for devices created before the
+ * device-manager forwarder started stamping `integrationId` (camera
+ * providers). Maps each addon that hosts EXACTLY ONE integration to that
+ * integration id, then stamps top-level untagged devices of those addons.
+ * Multi-instance addons (e.g. Home Assistant with several brokers) are
+ * ambiguous on `addonId` alone and are skipped — they stamp going forward.
+ */
+
+export interface BackfillIntegration {
+  readonly id: string
+  readonly addonId: string
+}
+
+export interface BackfillDevice {
+  readonly id: number
+  readonly addonId: string
+  readonly parentDeviceId: number | null
+  readonly integrationId?: string
+}
+
+export interface BackfillStamp {
+  readonly deviceId: number
+  readonly integrationId: string
+}
+
+export function planIntegrationIdBackfill(
+  integrations: readonly BackfillIntegration[],
+  devices: readonly BackfillDevice[],
+): readonly BackfillStamp[] {
+  const singleByAddon = new Map<string, string>()
+  const ambiguous = new Set<string>()
+  for (const integration of integrations) {
+    if (ambiguous.has(integration.addonId)) continue
+    if (singleByAddon.has(integration.addonId)) {
+      singleByAddon.delete(integration.addonId)
+      ambiguous.add(integration.addonId)
+      continue
+    }
+    singleByAddon.set(integration.addonId, integration.id)
+  }
+
+  const stamps: BackfillStamp[] = []
+  for (const device of devices) {
+    if (device.parentDeviceId !== null) continue
+    if (device.integrationId !== undefined && device.integrationId !== '') continue
+    const integrationId = singleByAddon.get(device.addonId)
+    if (integrationId === undefined) continue
+    stamps.push({ deviceId: device.id, integrationId })
+  }
+  return stamps
+}
+
+/**
+ * Stamps to apply at integration-DELETE time so a cascade removes legacy
+ * un-tagged devices too. The boot backfill only runs on startup; a device
+ * created before stamping (or whose provider never stamps, e.g. `provider-rtsp`)
+ * keeps no `integrationId`, so once its integration is deleted it would orphan
+ * forever — `removeByIntegration` matches on `integrationId` and finds nothing.
+ *
+ * Run this in the delete handler BEFORE deleting the integration record (while
+ * it is still present in `integrations`), then stamp the returned devices and
+ * let `removeByIntegration` cascade them. Reuses the boot backfill's safety
+ * rule (only addons hosting exactly ONE integration are unambiguous) and
+ * filters to the integration being deleted so siblings are never touched.
+ */
+export function planDeleteTimeStamps(
+  integrationId: string,
+  integrations: readonly BackfillIntegration[],
+  devices: readonly BackfillDevice[],
+): readonly BackfillStamp[] {
+  return planIntegrationIdBackfill(integrations, devices).filter(
+    (stamp) => stamp.integrationId === integrationId,
+  )
+}
+
+export interface BackfillLogger {
+  readonly info: (message: string, meta?: Record<string, unknown>) => void
+  readonly warn: (message: string, meta?: Record<string, unknown>) => void
+}
+
+export interface IntegrationIdBackfillDeps {
+  readonly listIntegrations: () => Promise<readonly BackfillIntegration[]>
+  readonly listDevices: () => Promise<readonly BackfillDevice[]>
+  readonly setIntegrationId: (deviceId: number, integrationId: string) => Promise<void>
+  readonly logger: BackfillLogger
+}
+
+export async function runIntegrationIdBackfill(
+  deps: IntegrationIdBackfillDeps,
+): Promise<{ stamped: number }> {
+  const [integrations, devices] = await Promise.all([deps.listIntegrations(), deps.listDevices()])
+  const stamps = planIntegrationIdBackfill(integrations, devices)
+  let stamped = 0
+  for (const stamp of stamps) {
+    try {
+      await deps.setIntegrationId(stamp.deviceId, stamp.integrationId)
+      stamped++
+    } catch (err) {
+      deps.logger.warn('integrationId backfill: stamp failed', {
+        deviceId: stamp.deviceId,
+        integrationId: stamp.integrationId,
+        error: err instanceof Error ? err.message : String(err),
+      })
+    }
+  }
+  if (stamped > 0) deps.logger.info('integrationId backfill complete', { stamped })
+  return { stamped }
+}

package/src/core/addon/__tests__/addon-row-manifest.spec.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect } from 'vitest'
+
+import { overlayDeclaration } from '../addon-row-manifest.js'
+
+/**
+ * Regression: after the HA broker rework, redeploying provider-homeassistant
+ * (broker + device-adoption) left the integration picker without Home
+ * Assistant. `loadNewAddons` refreshed `entry.declaration` to the new caps but
+ * `listAddons` built its row manifest from the STALE `entry.addon.manifest`
+ * (still [broker, ha-discovery]), so `getAvailableTypes` filtered HA out.
+ */
+interface TestManifest {
+  id: string
+  name: string
+  icon?: string
+  brokerKind?: string
+  capabilities?: ReadonlyArray<{ name: string }>
+}
+
+describe('overlayDeclaration — listAddons row manifest freshness', () => {
+  const base = { id: 'provider-homeassistant', name: 'Home Assistant' }
+
+  it('prefers the fresh declaration capabilities over the stale instance manifest', () => {
+    const instanceManifest: TestManifest = {
+      ...base,
+      capabilities: [{ name: 'broker' }, { name: 'ha-discovery' }],
+    }
+    const declaration: Partial<TestManifest> = {
+      capabilities: [{ name: 'broker' }, { name: 'device-adoption' }],
+      brokerKind: 'home-assistant',
+    }
+
+    const merged = overlayDeclaration(instanceManifest, declaration)
+
+    expect(merged.capabilities).toEqual([{ name: 'broker' }, { name: 'device-adoption' }])
+    expect(merged.brokerKind).toBe('home-assistant')
+  })
+
+  it('keeps the instance manifest when no fresh declaration exists', () => {
+    const instanceManifest: TestManifest = { ...base, capabilities: [{ name: 'broker' }] }
+
+    const merged = overlayDeclaration(instanceManifest, undefined)
+
+    expect(merged.capabilities).toEqual([{ name: 'broker' }])
+  })
+
+  it('fills gaps from the instance manifest for keys the declaration omits', () => {
+    const instanceManifest: TestManifest = {
+      ...base,
+      icon: 'assets/icon.svg',
+      capabilities: [{ name: 'broker' }],
+    }
+    const declaration: Partial<TestManifest> = {
+      capabilities: [{ name: 'broker' }, { name: 'device-adoption' }],
+    }
+
+    const merged = overlayDeclaration(instanceManifest, declaration)
+
+    expect(merged.icon).toBe('assets/icon.svg')
+    expect(merged.capabilities).toContainEqual({ name: 'device-adoption' })
+  })
+})

package/src/core/addon/addon-registry.service.ts

@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-member-access -- pre-existing lint debt across this 2200-line orchestration class. The flagged sites (StorageService.setLocationManager / setSettingsBackend, LoggingService.addDestination, RouteRegistry, etc.) are typed as `unknown` by their owning services to break circular construction-order dependencies; runtime contracts are validated structurally. Tracked separately; do not amend in unrelated edits. */
 import * as os from "node:os";
 import { ConfigService } from "../config/config.service";
+import { overlayDeclaration } from "./addon-row-manifest";
 import { LoggingService } from "../logging/logging.service";
 import { EventBusService } from "../events/event-bus.service";
 import { StorageService } from "../storage/storage.service";
@@ -60,7 +61,7 @@ import type {
   IStorageProvider as INewStorageProvider,
   ISettingsBackend,
 } from "@camstack/types";
-import { AddonRouteRegistry } from "@camstack/core";
+import { AddonRouteRegistry, DataPlaneRegistry } from "@camstack/core";
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
 import * as fs from "node:fs";
@@ -193,6 +194,29 @@ function parseSerializableRouteDescriptors(raw: unknown): readonly ParsedRouteDe
   });
 }
 
+/**
+ * Parse the wire-boundary `unknown` from `callForked(..., {target:'data-planes'})`
+ * into typed data-plane endpoint descriptors (`prefix/access/baseUrl/secret`).
+ * Pure data — the addon's `ctx.dataPlane` facility produced them.
+ */
+function parseDataPlaneEndpoints(raw: unknown): readonly import("@camstack/types").AddonDataPlaneEndpoint[] {
+  if (!Array.isArray(raw)) {
+    throw new Error("data-planes: child returned a non-array endpoint set");
+  }
+  return raw.map((entry: unknown): import("@camstack/types").AddonDataPlaneEndpoint => {
+    if (entry === null || typeof entry !== "object") {
+      throw new Error("data-planes: endpoint descriptor is not an object");
+    }
+    const prefix = Reflect.get(entry, "prefix");
+    const baseUrl = Reflect.get(entry, "baseUrl");
+    const secret = Reflect.get(entry, "secret");
+    if (typeof prefix !== "string" || typeof baseUrl !== "string" || typeof secret !== "string") {
+      throw new Error("data-planes: endpoint descriptor missing prefix/baseUrl/secret");
+    }
+    return { prefix, access: asRouteAccess(Reflect.get(entry, "access")), baseUrl, secret };
+  });
+}
+
 interface AddonEntry {
   readonly addon: ICamstackAddon;
   initialized: boolean;
@@ -240,6 +264,7 @@ export class AddonRegistryService {
   private addonLoader!: AddonLoader;
   private healthMonitor!: AddonHealthMonitor;
   private addonRouteRegistry: AddonRouteRegistry | null = null;
+  private dataPlaneRegistry: DataPlaneRegistry | null = null;
 
   // Broker-routed AddonApi proxy — every addon's `ctx.api` resolves
   // to this. Calls go through `broker.call('${addonId}.${capName}.${method}')`
@@ -1029,6 +1054,41 @@ export class AddonRegistryService {
     this.addonRouteRegistry = registry;
   }
 
+  /** Set the DataPlaneRegistry the hub's `/addon/:id/*` dispatch reverse-proxies
+   *  against (addon HTTP data-planes). */
+  setDataPlaneRegistry(registry: DataPlaneRegistry): void {
+    this.dataPlaneRegistry = registry;
+  }
+
+  /**
+   * Pull a forked addon's HTTP data-plane endpoints over UDS and register them so
+   * the hub can reverse-proxy `/addon/<addonId>/<prefix>/*` to the addon's own
+   * listener. Idempotent (replace-all); an addon with no data-plane registers an
+   * empty set (cleared). Called off the capabilities-changed signal — a data-plane
+   * isn't a cap, but the child is UDS-reachable and has served its endpoints by
+   * the time any of its caps register.
+   */
+  private async mountAddonDataPlanes(addonId: string): Promise<void> {
+    const registry = this.dataPlaneRegistry;
+    if (!registry) return;
+    const entry = this.addonEntries.get(addonId);
+    const childRegistry = this.moleculer.childRegistry;
+    // Forked addons only for now — co-located builtins would publish into the
+    // registry directly via a hub-side sink (deferred; no builtin serves a
+    // data-plane yet).
+    if (!entry || !this.isForkedAddonEntry(entry)) return;
+    if (childRegistry === null || !childRegistry.isChildKnown(addonId)) return;
+
+    const raw = await this.addonCallGateway.callForked(addonId, { target: "data-planes" });
+    const endpoints = parseDataPlaneEndpoints(raw);
+    registry.registerAddon(addonId, endpoints);
+    if (endpoints.length > 0) {
+      this.logger.info("Addon data-planes mounted (reverse-proxy)", {
+        meta: { phase: "v2", addonId, prefixes: endpoints.map((e) => e.prefix) },
+      });
+    }
+  }
+
   /**
    * Called after app.init() when the tRPC router is available.
    * No-op now: addon `ctx.api` resolves to a broker-routed proxy, so
@@ -1912,7 +1972,14 @@ export class AddonRegistryService {
         }
         return {
           manifest: {
-            ...entry.addon.manifest!,
+            // Overlay the fresh on-disk declaration (refreshed by
+            // `loadNewAddons` on every `camstack deploy`) onto the live
+            // instance manifest, so a redeployed addon's new capabilities /
+            // brokerKind surface here without a full backend restart. See
+            // `overlayDeclaration` — this is what keeps Home Assistant
+            // (post broker rework: broker + device-adoption) visible in the
+            // "+ New Integration" picker.
+            ...overlayDeclaration(entry.addon.manifest!, entry.declaration),
             packageName: entry.packageName,
             packageVersion: entry.packageVersion,
             packageDisplayName: entry.packageDisplayName,
@@ -2452,6 +2519,16 @@ export class AddonRegistryService {
           default:
             break;
         }
+
+        // HTTP data-planes aren't capabilities, so no `case` fires for them —
+        // pull them off ANY cap-changed signal for this (forked) addon. Cheap +
+        // idempotent (replace-all), and re-pulls the fresh baseUrl/secret after a
+        // restart (the child re-handshakes → caps re-register → this re-fires).
+        void this.mountAddonDataPlanes(addonId).catch((err: unknown) => {
+          this.logger.error('Failed to mount addon data-planes', {
+            meta: { phase: 'v2', addonId, error: errMsg(err) },
+          })
+        })
       },
     );
   }
@@ -2872,12 +2949,22 @@ export class AddonRegistryService {
         streamProbe: kernelStreamProbe,
         hwaccel: createKernelHwAccel(),
         capabilityRegistry: this.capabilityRegistry,
+        // Per-addon storage-location declarations across every installed
+        // addon — surfaced from the kernel's AddonLoader so the
+        // storage-orchestrator builtin can aggregate them and seed defaults.
+        listStorageLocationDeclarations: () =>
+          this.addonLoader.listStorageLocationDeclarations(),
         readinessRegistry: this.moleculer.readinessRegistry,
         // D3: handshake-fed native-cap view of the whole cluster. Backed by
         // `HubNodeRegistry.listNativeCapEntries()` populated by every
         // `$hub.registerNode` re-handshake. Used by device-manager as the
         // reliable fallback when push events were lost mid-transport.
         listClusterNativeCaps: () => this.moleculer.listClusterNativeCaps(),
+        // Per-device slice of the above — O(caps-for-device) via the registry's
+        // deviceId index. The per-device `getBindings` resolver prefers this
+        // over filtering the whole-cluster flat view.
+        listClusterNativeCapsForDevice: (deviceId: number) =>
+          this.moleculer.listClusterNativeCapsForDevice(deviceId),
       },
       registerProvider,
       resolveProvider: <T = unknown>(capName: string): T | null => {

package/src/core/addon/addon-row-manifest.ts

@@ -0,0 +1,29 @@
+/**
+ * Overlay the fresh on-disk `declaration` onto a live addon instance's
+ * `manifest` when building the rows returned by `listAddons()`.
+ *
+ * `loadNewAddons()` — invoked on every `camstack deploy` / package install —
+ * refreshes `entry.declaration` from a fresh disk scan but DELIBERATELY leaves
+ * the live `entry.addon` instance in place so `restartAddon` can shut the old
+ * instance down cleanly. Manifest-affecting changes (a newly declared
+ * capability, a new `brokerKind`) therefore land on `entry.declaration` while
+ * `entry.addon.manifest` keeps the value captured at the addon's ORIGINAL load.
+ *
+ * Consumers of `listAddons()` — notably the integration picker's
+ * `getAvailableTypes`, which gates a provider into the "+ New Integration" list
+ * by its declared capability (`device-provider` / `device-adoption`) — must see
+ * the post-deploy manifest. Otherwise a redeployed addon that gained
+ * `device-adoption` (e.g. the Home Assistant provider after the broker rework)
+ * stays invisible in the picker until a full backend restart re-reads the
+ * manifest from disk.
+ *
+ * The on-disk `declaration` is parsed from `package.json` (no `undefined`
+ * values), so the spread overlays only the keys the declaration actually
+ * defines; the instance manifest fills any gaps.
+ */
+export function overlayDeclaration<M extends object>(
+  instanceManifest: M,
+  declaration: Partial<M> | undefined,
+): M {
+  return { ...instanceManifest, ...declaration }
+}

package/src/core/logging/logging.service.ts

@@ -25,8 +25,13 @@ export class LoggingService extends LogManager {
   private readonly deviceNames = new Map<number, string>()
 
   constructor(configService: ConfigService) {
-    const bufferSize = configService.get<number>('eventBus.ringBufferSize') ?? 10000
-    super(bufferSize)
+    // The log buffer is now partitioned per addonId (see PartitionedLogBuffer):
+    // this value caps EACH addon's bucket, not the total. A chatty addon evicts
+    // only its own lines, so quiet addons (e.g. a HomeAssistant `image` entity)
+    // keep their sparse history. `eventBus.ringBufferSize` still sizes the
+    // separate system-event ring; logs get their own per-addon cap.
+    const perAddonCapacity = configService.get<number>('eventBus.perAddonLogBufferSize') ?? 5000
+    super(perAddonCapacity)
     // Enriches every emitted LogEntry with `tags.deviceName` before
     // destinations / subscribers see it — works across bundled copies
     // of `@camstack/core` (addon packages) because the mutation

package/src/core/moleculer/moleculer.service.ts

@@ -257,6 +257,14 @@ export class MoleculerService {
         getResolver: () => this.resolver,
         // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment -- moleculer types unresolvable; see `broker` getter docstring
         broker: this.broker,
+        // Single capability authority — lets the broker fallback pin a
+        // device-scoped call to its owning node instead of load-balancing it.
+        nodeRegistry: this.nodeRegistry,
+        // Hub-local UDS child dispatcher — routes a device-scoped native cap
+        // owned by a hub-local child (reolink/hikvision cameras) directly over
+        // UDS before any broker fallback. Getter: `this.localChildRegistry` is
+        // assigned later in this method, after the handler is constructed.
+        getLocalDispatcher: () => this.localChildRegistry,
         logger: {
           warn: (msg, meta) => logger.warn(msg, meta !== null && meta !== undefined ? { meta: meta as Record<string, unknown> } : undefined),
         },
@@ -267,6 +275,16 @@ export class MoleculerService {
         logger: {
           info: (msg, meta) => logger.info(msg, meta !== null && meta !== undefined ? { meta: meta as Record<string, unknown> } : undefined),
         },
+        // Hand the UDS-routing layer a view into the operator's
+        // active-singleton preference. Without this, when two local
+        // children own the same singleton cap (today: `webrtc-session`
+        // → `stream-broker` + `addon-webrtc-native`), routing returns
+        // the first-registered child by insertion order — silently
+        // bypassing `setActiveSingleton`. The closure reads the live
+        // registry on every call so a runtime swap takes effect
+        // immediately without rebuilding the resolver snapshot.
+        getActiveSingletonAddonId: (capName: string): string | null =>
+          this.capabilityService.getRegistry()?.getSingletonAddonId(capName) ?? null,
       })
       await registry.start()
       // E1: apply child manifest + cleanup from the UDS lifecycle (hub-local children).
@@ -880,6 +898,16 @@ export class MoleculerService {
     return this.nodeRegistry.listNativeCapEntries()
   }
 
+  /**
+   * Per-device slice of {@link listClusterNativeCaps}, served from the
+   * registry's `deviceId → entries` index — O(caps-for-device). Used by the
+   * per-device `getBindings` hot path so `getAllBindings` doesn't flatten the
+   * whole cluster once per device.
+   */
+  listClusterNativeCapsForDevice(deviceId: number): readonly import('@camstack/kernel').NodeNativeCapEntry[] {
+    return this.nodeRegistry.listNativeCapEntriesForDevice(deviceId)
+  }
+
   /**
    * E2: Send a `set-log-level` UDS message to a hub-local child identified by
    * `nodeId` (e.g. `hub/provider-reolink`). Extracts the `childId` from the

package/src/core/network/network-quality.service.spec.ts

@@ -32,10 +32,11 @@ describe('NetworkQualityService', () => {
   })
 
   it('should track client stats', () => {
-    service.reportClientStats(1, { rttMs: 50, jitterMs: 5, estimatedBandwidthKbps: 20000 })
+    service.reportClientStats(1, { rttMs: 50, jitterMs: 5, estimatedBandwidthKbps: 20000, packetLossPercent: 3 })
     const stats = service.getDeviceStats(1)
     expect(stats!.client?.rttMs).toBe(50)
     expect(stats!.client?.estimatedBandwidthKbps).toBe(20000)
+    expect(stats!.client?.packetLossPercent).toBe(3)
   })
 
   it('should list all device stats', () => {