@camstack/system 1.0.2

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -0,0 +1,236 @@
+import { IScopedLogger, IStorageProviderImpl, StorageLocation, StorageLocationDeclaration, StorageLocationRef } from '@camstack/types';
+import { ILocationStore } from './location-store.js';
+export interface ListLocationsFilter {
+    readonly type?: string;
+}
+/**
+ * Minimal structural shape the orchestrator needs from the kernel's
+ * `StorageLocationRegistry` — the cardinality lookup plus the full
+ * declaration list (the admin-UI Data screen renders one group per
+ * declaration). Declared locally so core's builtins don't import the
+ * kernel's registry type directly; the addon passes the real
+ * `buildStorageLocationRegistry(...)` result, which structurally
+ * satisfies this interface.
+ */
+export interface DeclarationSource {
+    cardinalityOf(id: string): 'single' | 'multi' | null;
+    list(): readonly StorageLocationDeclaration[];
+}
+/**
+ * Provider lookup callback. Returns the live set of `storage-provider`
+ * registrants. Called per-dispatch (cheap registry scan) so newly
+ * loaded addons surface immediately.
+ */
+export type StorageProviderLookup = () => readonly IStorageProviderImpl[];
+/**
+ * Synchronous `providerId → nodeLocal` resolver, injected by the addon
+ * from a cached snapshot of `storage-provider.getProviderInfo()` (the
+ * `getProviderInfo` round-trip is async, so a sync cache keeps
+ * `upsertLocation` synchronous — the contract its many callers rely on).
+ *
+ * Returns:
+ *   - `true`  — node-local provider (filesystem): its locations bind to a
+ *     single node, so a `nodeId` is required.
+ *   - `false` — node-agnostic provider (S3/SFTP/WebDAV): `nodeId` optional.
+ *   - `undefined` — provider not (yet) known. Treated as non-node-local:
+ *     validation does not reject (the provider may register later / be
+ *     remote), the safe default for the early-boot / in-memory path.
+ */
+export type NodeLocalResolver = (providerId: string) => boolean | undefined;
+export declare class StorageOrchestratorService {
+    private readonly logger;
+    private readonly getProviders;
+    /**
+     * Optional persistence backend. When supplied, `initialize()`
+     * hydrates the in-memory map from the store, and every mutation
+     * (upsert/delete) mirrors to it. When `null` / `undefined`, the
+     * service is in-memory only — the contract used by the existing
+     * routing tests, where re-creating the service deliberately
+     * forgets every location.
+     *
+     * Mutable because production boot wires it late: the `settings-store`
+     * cap often isn't registered when the orchestrator initializes, so the
+     * service starts store-less and the addon calls {@link attachStore} once
+     * the provider appears. See {@link attachStore}.
+     */
+    private locationStore;
+    private readonly locations;
+    /**
+     * Declaration-driven cardinality source, injected by the addon after
+     * the kernel aggregates `storageLocations` declarations. `null` until
+     * `setRegistry` runs — `upsertLocation` then treats every type as
+     * `'multi'` (no singleton enforcement), the safe default for the
+     * in-memory-only / early-boot path.
+     */
+    private registry;
+    /**
+     * Injected `providerId → nodeLocal` resolver (see {@link NodeLocalResolver}).
+     * `null` until {@link setNodeLocalResolver} runs — `upsertLocation` then
+     * skips the node-local requirement check entirely (every provider is
+     * treated as node-agnostic), the safe default for the in-memory-only /
+     * early-boot path that predates the resolver wiring.
+     */
+    private nodeLocalResolver;
+    constructor(logger: IScopedLogger, getProviders: StorageProviderLookup, 
+    /**
+     * Optional persistence backend. When supplied, `initialize()`
+     * hydrates the in-memory map from the store, and every mutation
+     * (upsert/delete) mirrors to it. When `null` / `undefined`, the
+     * service is in-memory only — the contract used by the existing
+     * routing tests, where re-creating the service deliberately
+     * forgets every location.
+     *
+     * Mutable because production boot wires it late: the `settings-store`
+     * cap often isn't registered when the orchestrator initializes, so the
+     * service starts store-less and the addon calls {@link attachStore} once
+     * the provider appears. See {@link attachStore}.
+     */
+    locationStore?: ILocationStore | null);
+    /** True once a persistence store is wired (constructor or {@link attachStore}). */
+    hasStore(): boolean;
+    /**
+     * Late-bind the persistence store (production boot: the `settings-store`
+     * cap registers after the orchestrator initializes, so the service runs
+     * in-memory-only until then). Idempotent — a second call once a store is
+     * wired is a no-op.
+     *
+     * Reconciles both directions so operator edits survive a reboot:
+     *   1. hydrate — DB rows win over any early in-memory seed (restores
+     *      operator config like `minFreePercent` that the pre-store boot
+     *      can't see), with the same `isSystem` upgrade as {@link initialize};
+     *   2. backfill — in-memory locations the DB doesn't have yet (the
+     *      pre-store seed defaults on a fresh install) are persisted, so the
+     *      store becomes the durable source of truth from here on.
+     */
+    attachStore(store: ILocationStore): Promise<void>;
+    /**
+     * Inject the declaration-driven cardinality source. Called once by the
+     * addon after the kernel aggregates every addon's `storageLocations`
+     * declarations into a `StorageLocationRegistry`.
+     */
+    setRegistry(registry: DeclarationSource | null): void;
+    /**
+     * Inject the synchronous `providerId → nodeLocal` resolver (SP1). Called
+     * by the addon from a cached snapshot of every `storage-provider`'s
+     * `getProviderInfo().nodeLocal`, refreshed when the provider collection
+     * changes. Powers the node-local upsert guard and the boot backfill.
+     */
+    setNodeLocalResolver(resolver: NodeLocalResolver | null): void;
+    /**
+     * The full set of addon-declared storage locations, as aggregated by
+     * the kernel and injected via {@link setRegistry}. Powers the admin-UI
+     * Data screen's per-declaration grouping. Empty until the registry is
+     * injected (early-boot / in-memory-only path).
+     */
+    listDeclarations(): readonly StorageLocationDeclaration[];
+    /**
+     * Hydrate the in-memory map from the persistence layer. Called once
+     * by the addon during `onInitialize`, before the eager seed pass.
+     * Idempotent — running it twice with the same store contents
+     * produces the same map. No-op when the service was constructed
+     * without a store.
+     *
+     * Errors loading individual rows are tolerated: the bad row is
+     * skipped and logged so a single corrupted record doesn't lock the
+     * whole orchestrator out of boot. (The store-side validation pass
+     * before insert means only schema-invalid SQL state can produce
+     * such a row.)
+     */
+    initialize(): Promise<void>;
+    /**
+     * Boot backfill (SP1): stamp `nodeId` on every persisted node-local
+     * location that lacks one. Single-node deployments seeded their
+     * filesystem locations before `nodeId` existed — they live on `hubNodeId`
+     * (the hub). Node-agnostic (remote) locations are left untouched: their
+     * absent `nodeId` is correct (reachable from any node).
+     *
+     * Idempotent — a location that already carries a `nodeId` (any value) is
+     * never re-touched, so re-running on a populated map (or a re-boot) is a
+     * no-op. A plain local update, not versioned-migration machinery: only
+     * the rows missing `nodeId` are mutated + persisted.
+     *
+     * No-op until the node-local resolver is wired (it classifies which
+     * providers are node-local).
+     */
+    backfillNodeIds(hubNodeId: string): Promise<void>;
+    listLocations(filter?: ListLocationsFilter): readonly StorageLocation[];
+    getDefaultLocation(type: string): StorageLocation | null;
+    /**
+     * Insert or update a location. If `isDefault: true`, atomically
+     * demotes any other default for the same type — operators always see
+     * exactly one default per type.
+     *
+     * When a persistence store is wired (Task 6), the new record AND any
+     * implicitly-demoted siblings are persisted before the in-memory map
+     * mutation returns. Persistence errors propagate to the caller.
+     */
+    upsertLocation(input: Omit<StorageLocation, 'createdAt' | 'updatedAt'>): StorageLocation;
+    /**
+     * Remove a location. Refuses to remove the default of a type unless a
+     * sibling default exists (defensive — `upsertLocation` already ensures
+     * at most one default per type, but the logic guards against future
+     * bypass paths e.g. SQLite migration that imports two defaults).
+     *
+     * Persistence (Task 6) mirrors the delete asynchronously, with errors
+     * routed to the logger — see `upsertLocation` for the rationale.
+     */
+    deleteLocation(id: string): void;
+    /**
+     * Remove system-seeded locations whose type is no longer declared by any
+     * addon (stale defaults from a removed location type). Operator-added
+     * (non-system) locations of an undeclared type are KEPT but warned — the
+     * operator owns them. Requires the registry to be set first.
+     *
+     * FAIL-SAFE: if the registry is EMPTY (no addon declared any location), we
+     * refuse to prune anything. An empty registry almost always means
+     * declarations failed to load (boot ordering, a stale install) — pruning
+     * "everything undeclared" in that state would wipe every system location
+     * (data/logs/recordings/…). Better to keep stale rows than destroy live ones.
+     */
+    pruneUndeclaredSystemLocations(): void;
+    /**
+     * Resolve a `StorageLocationRef` to a concrete `StorageLocation`.
+     *  - bare type (e.g. `'backups'`) → default location of that type
+     *  - fully-qualified id (e.g. `'backups:nas-01'`) → that exact instance
+     *
+     * Throws an actionable error when nothing matches — every consumer of
+     * the singleton `storage` cap funnels through here, so the error
+     * message is what operators see when the orchestrator's view of the
+     * world doesn't match expectations.
+     */
+    resolveRef(ref: StorageLocationRef): StorageLocation;
+    /**
+     * Find the storage-provider that backs a given location. Lookup is by
+     * `location.providerId` against `getProviderInfo().providerId` from
+     * each registered collection provider. Throws with both the missing
+     * providerId and the offending location id so the operator can pick
+     * the right place to fix the config.
+     */
+    getProviderFor(location: StorageLocation): Promise<IStorageProviderImpl>;
+    /** Convenience: lookup by id (returns `undefined` if not found). */
+    getLocationById(id: string): StorageLocation | undefined;
+    /**
+     * Seed one default `StorageLocation` per addon-declared location that
+     * doesn't already have one. Idempotent — re-running with the same
+     * declarations on a populated map is a no-op (each declared `id`
+     * already resolves to an existing `<id>:default`).
+     *
+     * Convention: the bare-type ref `'recordings'` resolves via
+     * `getDefaultLocation('recordings')` (walks `isDefault === true`); the
+     * actual stored `id` is `'recordings:default'` so it satisfies the
+     * `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
+     *
+     * `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each
+     * location's `config.basePath` is `<basePath>/<id>`, except when the
+     * declaration sets `defaultsTo` — then it inherits the resolved root of
+     * the referenced location's default instance (sharing the same root
+     * directory for derivative slots like `recordingsLow` → `recordings`).
+     */
+    seedDefaults(input: {
+        readonly providerId: string;
+        readonly basePath: string;
+        readonly declarations: readonly StorageLocationDeclaration[];
+    }): void;
+    /** Internal: check whether any location of the given type exists. */
+    private hasAnyLocationOfType;
+}

package/dist/builtins/storage-orchestrator/storage-pressure-manager.d.ts

@@ -0,0 +1,38 @@
+import { IScopedLogger, IStorageEvictableProvider } from '@camstack/types';
+/**
+ * StoragePressureManager — core-owned TRIGGER for disk-space relief.
+ *
+ * Monitors free space per managed location and, when a location drops below its
+ * `minFreePercent`, asks each registered `storage-evictable` provider to free a
+ * proportional share of the byte deficit. The PROVIDER decides what to delete
+ * and does the deletion — core never deletes data it doesn't understand. This
+ * makes disk-pressure one cross-consumer concern instead of per-addon guards.
+ *
+ * Convergence: a bounded round loop re-reads free% after each fan-out and stops
+ * when the location recovers, when nothing is evictable, or when a round makes
+ * no progress (every provider exhausted). Lossless feedback (`reclaimedBytes`)
+ * drives the stop condition; the addon re-runs `sweep()` on a timer so a partial
+ * relief finishes on the next tick.
+ */
+export interface PressureManagerDeps {
+    readonly logger: IScopedLogger;
+    /** Free capacity (%) on the location's volume. */
+    readonly getFreePercent: (locationId: string) => Promise<number>;
+    /** Total bytes on the location's volume (to turn a deficit % into a byte target). */
+    readonly getVolumeTotalBytes: (locationId: string) => Promise<number>;
+    /** Registered `storage-evictable` providers (cross-process proxies). */
+    readonly getEvictableProviders: () => readonly IStorageEvictableProvider[];
+    /** locationId → minFreePercent threshold; entries with `<= 0` have the guard off. */
+    readonly getLocationThresholds: () => Promise<ReadonlyMap<string, number>>;
+    /** Max relief rounds per location per sweep (backstop, default 8). */
+    readonly maxRounds?: number;
+    /** Extra headroom % freed beyond the threshold to avoid re-breaching immediately (default 1). */
+    readonly hysteresisPercent?: number;
+}
+export declare class StoragePressureManager {
+    private readonly deps;
+    constructor(deps: PressureManagerDeps);
+    /** Relieve every managed location currently under its threshold. */
+    sweep(): Promise<void>;
+    private relieveLocation;
+}

package/dist/builtins/system-backup/system-backup.service.d.ts

@@ -0,0 +1,137 @@
+import { IScopedLogger } from '@camstack/types';
+/**
+ * Default set of paths considered part of a "system backup". Includes
+ * everything that isn't pure backend code — config, sqlite, addons
+ * (runtime overlay), addons-data (per-addon private dir), TLS certs,
+ * auto-update marker.
+ *
+ * Excluded by default: recordings/, media/, models/, logs/, cache/
+ * (too large or fully recreatable).
+ */
+export declare const DEFAULT_BACKUP_LOCATIONS: readonly ["config.yaml", "addons", "addons-data", "tls", "auto-update.json"];
+/** Path of the manifest file embedded inside every archive. */
+export declare const ARCHIVE_MANIFEST_NAME = ".camstack-backup-manifest.json";
+export type ArchiveEntryKind = 'file' | 'dir' | 'symlink';
+export interface ArchiveEntry {
+    /** Path relative to the archive root (== relative to dataDir). */
+    readonly path: string;
+    readonly kind: ArchiveEntryKind;
+    /** Content bytes. 0 for dirs / symlinks. */
+    readonly sizeBytes: number;
+    /** ms epoch from filesystem mtime. */
+    readonly mtime: number;
+}
+export interface ArchiveManifest {
+    archiveVersion: 1;
+    createdAt: number;
+    dataDir: string;
+    /**
+     * Mutable arrays — same shape as the zod-inferred type returned by
+     * `ArchiveManifestSchema.parse()`. `BaseAddon` providers receive
+     * this exact type via cap inputs, so making the interface readonly
+     * here would force callers to clone before forwarding.
+     */
+    locations: string[];
+    entries: ArchiveEntry[];
+    /** Sum of file `sizeBytes` (uncompressed). */
+    totalBytes: number;
+    totalFiles: number;
+}
+export interface CreateArchiveResult {
+    archivePath: string;
+    includedLocations: readonly string[];
+    /** Archive size in bytes (compressed, on disk). */
+    sizeBytes: number;
+    /** Embedded manifest — same shape as `getArchiveManifest()`. */
+    manifest: ArchiveManifest;
+}
+export interface RestoreMarker {
+    archivePath: string;
+    requestedAt: number;
+    /** Caller-supplied identifier (e.g. backup id) for traceability. */
+    source: string;
+    /**
+     * Optional whitelist of top-level locations to restore from the
+     * archive. When omitted the boot-time hook applies everything in
+     * the archive (full restore — same as the legacy behavior).
+     */
+    locations?: readonly string[];
+}
+export interface LocationStat {
+    readonly name: string;
+    readonly sizeBytes: number;
+    readonly fileCount: number;
+    /** False when the location doesn't exist under dataDir. */
+    readonly present: boolean;
+}
+/**
+ * System-level archive primitives. Construct one per server boot;
+ * methods are pure I/O.
+ */
+export declare class SystemBackupService {
+    private readonly dataDir;
+    private readonly logger;
+    constructor(dataDir: string, logger: IScopedLogger);
+    /**
+     * Snapshot the current size + file count of each well-known
+     * location. Used by the admin UI to render an opt-in checklist
+     * before triggering a backup, and by `createArchive` to derive the
+     * embedded manifest.
+     */
+    statLocations(locations?: readonly string[]): readonly LocationStat[];
+    /**
+     * Create a tar.gz of the given locations. Uses the `tar` npm package
+     * (used by npm itself) instead of shelling out — gives us:
+     *
+     *   - Symlink dereference (`follow: true`) so dev mode's
+     *     `addons/<name> → packages/<name>` overlay archives content,
+     *     not just link stubs.
+     *   - Programmatic walk → we build a manifest of every entry while
+     *     copying so the archive can self-describe.
+     *
+     * Locations that don't exist are silently skipped. Throws if zero
+     * locations would be included.
+     */
+    createArchive(opts: {
+        archivePath: string;
+        locations?: readonly string[];
+    }): Promise<CreateArchiveResult>;
+    /**
+     * Read the embedded manifest from a previously-created archive
+     * without extracting payload files. Streams the tar.gz, parses the
+     * one entry we care about, then aborts.
+     */
+    readArchiveManifest(archivePath: string): Promise<ArchiveManifest | null>;
+    /**
+     * Extract a previously-created archive over `targetDir`. Used at boot
+     * by the restore hook — never call from a running server (would
+     * corrupt sqlite mid-run).
+     *
+     * `locations` is an optional whitelist: only entries whose path
+     * starts with one of the locations get extracted. Used by the
+     * partial-restore flow where the operator picks a subset of the
+     * archive contents to apply (e.g. "restore my devices but keep
+     * my current TLS certs").
+     */
+    extractArchive(opts: {
+        archivePath: string;
+        targetDir: string;
+        locations?: readonly string[];
+    }): Promise<void>;
+    /**
+     * Schedule a restore for the next boot by writing a marker file.
+     * `locations` (optional) carries through to the boot-time
+     * extractArchive call so the operator's "restore only X and Y"
+     * choice survives the process restart.
+     */
+    scheduleRestoreMarker(opts: {
+        archivePath: string;
+        source: string;
+        locations?: readonly string[];
+    }): string;
+    /** Read the pending-restore marker if one is present. */
+    readPendingMarker(): RestoreMarker | null;
+    /** Drop the marker after a successful boot-time restore. */
+    clearPendingMarker(): void;
+    private getRestoreMarkerPath;
+}

package/dist/builtins/system-config/index.d.ts

@@ -0,0 +1 @@
+export { SystemConfigAddon, default } from './system-config.addon.js';

package/dist/builtins/system-config/index.js

@@ -0,0 +1,8 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+require("../../chunk-Cek0wNdY.js");
+const require_builtins_system_config_system_config_addon = require("./system-config.addon.js");
+exports.SystemConfigAddon = require_builtins_system_config_system_config_addon.SystemConfigAddon;
+exports.default = require_builtins_system_config_system_config_addon.SystemConfigAddon;

package/dist/builtins/system-config/index.mjs

@@ -0,0 +1,2 @@
+import { SystemConfigAddon } from "./system-config.addon.mjs";
+export { SystemConfigAddon, SystemConfigAddon as default };

package/dist/builtins/system-config/system-config.addon.d.ts

@@ -0,0 +1,10 @@
+import { ConfigUISchemaWithValues, BaseAddon } from '@camstack/types';
+export declare class SystemConfigAddon extends BaseAddon {
+    readonly id = "system-config";
+    constructor();
+    protected onInitialize(): Promise<void>;
+    private buildGlobalSchema;
+    getGlobalSettings(): Promise<ConfigUISchemaWithValues>;
+    updateGlobalSettings(patch: Record<string, unknown>): Promise<void>;
+}
+export default SystemConfigAddon;

package/dist/builtins/system-config/system-config.addon.js

@@ -0,0 +1,232 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+require("../../chunk-Cek0wNdY.js");
+let _camstack_types = require("@camstack/types");
+//#region src/builtins/system-config/system-config.addon.ts
+/**
+* Built-in `system-config` addon — Phase 4 of the settings redesign.
+*
+* Exposes the cluster-wide yml-backed sections that the bootstrap
+* loader reads before any addon is instantiated — things that cannot
+* live inside an addon because changing them requires a server
+* restart (port, host, dataPath) or because they own no runtime
+* state of their own (auth token expiry, global ffmpeg binary path).
+*
+* Sections exposed:
+*   - server     (port, host, dataPath — READ-ONLY, loaded from config.yaml at bootstrap)
+*   - auth       (tokenExpiry)
+*   - ffmpeg     (binaryPath, hwAccel, threadCount)
+*
+* Sections NOT exposed (each owned by the addon that implements them):
+*   - logging    → `winston-logging` addon (level + retention)
+*   - recording  → `recording` addon (segment duration, retention)
+*   - retention  → analytics / detection addons (per-table retention)
+*
+* Implementation notes:
+*   - Runs only on the hub process (yml sections are hub-side state).
+*     On agent nodes this addon would still instantiate, but every
+*     `ctx.settings.getSection(section)` call would hit an empty
+*     ConfigManager section so the UI would show the schema defaults.
+*     In practice the built-in loader can skip it on agents; for now we
+*     just let it run everywhere because it's harmless.
+*   - Reads via `ctx.settings.getSection(section)` and writes via
+*     `ctx.settings.setSection(section, patch)` — the explicit
+*     yml-section pair on `AddonSettingsApi`.
+*   - Does NOT register as a capability provider. It's a pure "settings
+*     surface" addon — its sole purpose is to expose the yml sections
+*     through the new three-level settings API.
+*
+* This addon is declared in `@camstack/system`'s package.json `camstack.addons[]`
+* and loaded automatically via AddonLoader like any other core built-in.
+*/
+/** Section key → user-facing section title. */
+var SECTION_TITLES = {
+	server: "Server",
+	auth: "Authentication",
+	ffmpeg: "FFmpeg"
+};
+/** Keys that map 1:1 to a given yml section — used by `updateGlobalSettings`
+*  to figure out which section owns each key in the incoming patch. */
+var KEY_TO_SECTION = {
+	port: "server",
+	host: "server",
+	dataPath: "server",
+	tokenExpiry: "auth",
+	binaryPath: "ffmpeg",
+	hwAccel: "ffmpeg",
+	threadCount: "ffmpeg"
+};
+var SystemConfigAddon = class extends _camstack_types.BaseAddon {
+	id = "system-config";
+	constructor() {
+		super({});
+	}
+	async onInitialize() {
+		this.ctx.logger.info("Initialized — exposes yml-backed sections via getGlobalSettings");
+	}
+	buildGlobalSchema() {
+		return { sections: [
+			{
+				id: "system-config-server",
+				title: SECTION_TITLES["server"],
+				description: "Core server connection settings — read-only, loaded from config.yaml at bootstrap.",
+				columns: 2,
+				fields: [
+					{
+						type: "info",
+						key: "server-restart-note",
+						label: "Restart required",
+						content: "Server settings are read-only. Change them in config.yaml and restart.",
+						variant: "warning"
+					},
+					{
+						type: "text",
+						key: "port",
+						label: "Port",
+						description: "Listening port",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "host",
+						label: "Host",
+						description: "Bind address",
+						disabled: true
+					},
+					{
+						type: "text",
+						key: "dataPath",
+						label: "Data Path",
+						description: "Root data directory",
+						disabled: true,
+						span: 2
+					}
+				]
+			},
+			{
+				id: "system-config-auth",
+				title: SECTION_TITLES["auth"],
+				description: "Token and session settings.",
+				columns: 1,
+				fields: [{
+					type: "text",
+					key: "tokenExpiry",
+					label: "Token Expiry",
+					description: "JWT token lifetime (e.g. 24h, 7d, 1h)",
+					placeholder: "24h",
+					default: "24h"
+				}]
+			},
+			{
+				id: "system-config-ffmpeg",
+				title: SECTION_TITLES["ffmpeg"],
+				description: "FFmpeg binary and hardware acceleration settings.",
+				columns: 2,
+				fields: [
+					{
+						type: "text",
+						key: "binaryPath",
+						label: "Binary Path",
+						description: "Path to ffmpeg executable",
+						placeholder: "ffmpeg",
+						default: "ffmpeg",
+						span: 2
+					},
+					{
+						type: "select",
+						key: "hwAccel",
+						label: "Hardware Acceleration",
+						description: "GPU decoding/encoding backend",
+						default: "auto",
+						options: [
+							{
+								value: "auto",
+								label: "Auto-detect"
+							},
+							{
+								value: "none",
+								label: "None (CPU only)"
+							},
+							{
+								value: "videotoolbox",
+								label: "VideoToolbox (macOS)"
+							},
+							{
+								value: "vaapi",
+								label: "VA-API (Linux Intel/AMD)"
+							},
+							{
+								value: "qsv",
+								label: "QSV (Intel Quick Sync)"
+							},
+							{
+								value: "cuda",
+								label: "CUDA (NVIDIA)"
+							}
+						]
+					},
+					{
+						type: "number",
+						key: "threadCount",
+						label: "Thread Count",
+						description: "0 = auto (let FFmpeg decide)",
+						min: 0,
+						max: 16,
+						step: 1,
+						default: 0
+					}
+				]
+			}
+		] };
+	}
+	async getGlobalSettings() {
+		const schema = this.buildGlobalSchema();
+		if (!this.ctx.settings) return (0, _camstack_types.hydrateSchema)(schema, {});
+		const sectionNames = Object.keys(SECTION_TITLES);
+		const merged = {};
+		for (const section of sectionNames) try {
+			const values = await this.ctx.settings.getSection(section);
+			Object.assign(merged, values);
+		} catch (err) {
+			const msg = (0, _camstack_types.errMsg)(err);
+			this.ctx.logger.debug("Failed to read section", { meta: {
+				section,
+				error: msg
+			} });
+		}
+		return (0, _camstack_types.hydrateSchema)(schema, merged);
+	}
+	async updateGlobalSettings(patch) {
+		if (!this.ctx.settings) throw new Error("system-config: ctx.settings not available — cannot write sections");
+		const perSection = /* @__PURE__ */ new Map();
+		for (const [key, value] of Object.entries(patch)) {
+			const section = KEY_TO_SECTION[key];
+			if (section === void 0) {
+				this.ctx.logger.warn("update ignored unknown key (not mapped to any section)", { meta: { key } });
+				continue;
+			}
+			if (section === "server") {
+				this.ctx.logger.warn("update ignored read-only server-section key", { meta: { key } });
+				continue;
+			}
+			let bucket = perSection.get(section);
+			if (!bucket) {
+				bucket = {};
+				perSection.set(section, bucket);
+			}
+			bucket[key] = value;
+		}
+		for (const [section, sectionPatch] of perSection) {
+			await this.ctx.settings.setSection(section, sectionPatch);
+			this.ctx.logger.info("Wrote keys to section", { meta: {
+				section,
+				keyCount: Object.keys(sectionPatch).length
+			} });
+		}
+	}
+};
+//#endregion
+exports.SystemConfigAddon = SystemConfigAddon;
+exports.default = SystemConfigAddon;