@camstack/system 1.2.390 → 1.2.392

package/dist/builtins/platform-probe/inference-config-resolver.d.ts

@@ -1,29 +1,29 @@
-import { PlatformScore, HardwareInfo, ModelRequirement, ResolvedInferenceConfig } from '@camstack/types';
+import type { PlatformScore, HardwareInfo, ModelRequirement, ResolvedInferenceConfig } from "@camstack/types";
 export declare class InferenceConfigResolver {
-    private readonly scores;
-    private readonly hardware;
-    constructor(scores: readonly PlatformScore[], hardware: HardwareInfo);
-    /**
-     * Compute accuracy/backend weights based on available system RAM.
-     * availableRAM_MB is now sourced from systeminformation (reliable cross-platform),
-     * not os.freemem() which is broken on macOS.
-     *
-     * - > 16 GB available: prefer larger, more accurate models (accuracy 0.6, backend 0.4)
-     * - > 8 GB available:  balanced (accuracy 0.5, backend 0.5)
-     * - <= 8 GB available: prefer speed (accuracy 0.4, backend 0.6)
-     */
-    private getWeights;
-    /**
-     * Given an addon's model requirements, pick the best model + runtime + backend.
-     *
-     * Algorithm:
-     * 1. Filter models by available RAM (minRAM_MB < 25% of available RAM)
-     * 2. For each remaining model, find the best platform score whose format
-     *    is available in the model's formats
-     * 3. Pick the model with the highest combined score using RAM-adaptive weights:
-     *    - High RAM (>16 GB): accuracy × 0.6 + backend × 0.4  (prefer accuracy)
-     *    - Mid RAM  (>8 GB):  accuracy × 0.5 + backend × 0.5  (balanced)
-     *    - Low RAM  (<=8 GB): accuracy × 0.4 + backend × 0.6  (prefer speed)
-     */
-    resolve(requirements: readonly ModelRequirement[]): ResolvedInferenceConfig;
+	private readonly scores;
+	private readonly hardware;
+	constructor(scores: readonly PlatformScore[], hardware: HardwareInfo);
+	/**
+	* Compute accuracy/backend weights based on available system RAM.
+	* availableRAM_MB is now sourced from systeminformation (reliable cross-platform),
+	* not os.freemem() which is broken on macOS.
+	*
+	* - > 16 GB available: prefer larger, more accurate models (accuracy 0.6, backend 0.4)
+	* - > 8 GB available:  balanced (accuracy 0.5, backend 0.5)
+	* - <= 8 GB available: prefer speed (accuracy 0.4, backend 0.6)
+	*/
+	private getWeights;
+	/**
+	* Given an addon's model requirements, pick the best model + runtime + backend.
+	*
+	* Algorithm:
+	* 1. Filter models by available RAM (minRAM_MB < 25% of available RAM)
+	* 2. For each remaining model, find the best platform score whose format
+	*    is available in the model's formats
+	* 3. Pick the model with the highest combined score using RAM-adaptive weights:
+	*    - High RAM (>16 GB): accuracy × 0.6 + backend × 0.4  (prefer accuracy)
+	*    - Mid RAM  (>8 GB):  accuracy × 0.5 + backend × 0.5  (balanced)
+	*    - Low RAM  (<=8 GB): accuracy × 0.4 + backend × 0.6  (prefer speed)
+	*/
+	resolve(requirements: readonly ModelRequirement[]): ResolvedInferenceConfig;
 }

package/dist/builtins/platform-probe/intel-accelerators.d.ts

@@ -1,14 +1,14 @@
-import { GpuInfo } from '@camstack/types';
+import type { GpuInfo } from "@camstack/types";
 /**
- * Filesystem seam for Intel iGPU detection — the classifier stays a pure,
- * unit-testable function over injected reads. The Intel NPU ("AI Boost") is a
- * separate DRM accel device with its own classifier — see `intel-npu.ts`.
- */
+* Filesystem seam for Intel iGPU detection — the classifier stays a pure,
+* unit-testable function over injected reads. The Intel NPU ("AI Boost") is a
+* separate DRM accel device with its own classifier — see `intel-npu.ts`.
+*/
 export interface AcceleratorFs {
-    listRenderNodes(): readonly string[];
-    readVendor(renderNode: string): string;
+	listRenderNodes(): readonly string[];
+	readVendor(renderNode: string): string;
 }
 export interface IntelAccelerators {
-    gpu: GpuInfo | null;
+	gpu: GpuInfo | null;
 }
 export declare function classifyIntelAccelerators(fsx: AcceleratorFs): IntelAccelerators;

package/dist/builtins/platform-probe/intel-npu.d.ts

@@ -1,38 +1,38 @@
-import { NpuInfo } from '@camstack/types';
+import type { NpuInfo } from "@camstack/types";
 /**
- * Filesystem seam for Intel NPU detection — mirrors the `AcceleratorFs` /
- * `CoralFs` pattern so the classifier stays a pure, unit-testable function over
- * injected reads.
- */
+* Filesystem seam for Intel NPU detection — mirrors the `AcceleratorFs` /
+* `CoralFs` pattern so the classifier stays a pure, unit-testable function over
+* injected reads.
+*/
 export interface NpuFs {
-    /**
-     * Directory entries under a path (e.g. the accel char devices under
-     * `/dev/accel`). MUST return an empty list when the directory is absent.
-     */
-    listDir(path: string): readonly string[];
-    /** Whether a filesystem path exists. */
-    exists(path: string): boolean;
+	/**
+	* Directory entries under a path (e.g. the accel char devices under
+	* `/dev/accel`). MUST return an empty list when the directory is absent.
+	*/
+	listDir(path: string): readonly string[];
+	/** Whether a filesystem path exists. */
+	exists(path: string): boolean;
 }
 /** Everything the NPU classifier needs to know about the host, beside the FS. */
 export interface IntelNpuContext {
-    readonly platform: 'darwin' | 'linux' | 'win32';
-    readonly arch: 'arm64' | 'x64';
-    /**
-     * True when an Intel CPU or Intel iGPU is present. The NPU ("AI Boost") is an
-     * Intel-only accelerator, so a stray `/dev/accel` node on a non-Intel host
-     * (e.g. some other DRM accel driver) must NOT be misread as an Intel NPU.
-     */
-    readonly intelPresent: boolean;
+	readonly platform: "darwin" | "linux" | "win32";
+	readonly arch: "arm64" | "x64";
+	/**
+	* True when an Intel CPU or Intel iGPU is present. The NPU ("AI Boost") is an
+	* Intel-only accelerator, so a stray `/dev/accel` node on a non-Intel host
+	* (e.g. some other DRM accel driver) must NOT be misread as an Intel NPU.
+	*/
+	readonly intelPresent: boolean;
 }
 /**
- * Detect the Intel NPU ("AI Boost", the `intel_vpu` kernel driver).
- *
- * On Linux the NPU surfaces as a DRM accel char device `/dev/accel/accel*`.
- * Detection is gated on linux + x64 + an Intel CPU/iGPU being present — the NPU
- * only ships on x86_64 Intel Core Ultra (Meteor/Arrow Lake+) parts, so those
- * three conditions together make a matching accel node an Intel NPU.
- *
- * Returns `null` when any gate fails or no accel node is found. The caller must
- * NOT clobber an already-resolved NPU (e.g. `apple-ane` on macOS).
- */
+* Detect the Intel NPU ("AI Boost", the `intel_vpu` kernel driver).
+*
+* On Linux the NPU surfaces as a DRM accel char device `/dev/accel/accel*`.
+* Detection is gated on linux + x64 + an Intel CPU/iGPU being present — the NPU
+* only ships on x86_64 Intel Core Ultra (Meteor/Arrow Lake+) parts, so those
+* three conditions together make a matching accel node an Intel NPU.
+*
+* Returns `null` when any gate fails or no accel node is found. The caller must
+* NOT clobber an already-resolved NPU (e.g. `apple-ane` on macOS).
+*/
 export declare function classifyIntelNpu(ctx: IntelNpuContext, fsx: NpuFs): NpuInfo | null;

package/dist/builtins/platform-probe/platform-scorer.d.ts

@@ -1,37 +1,37 @@
-import { HardwareInfo, PlatformCapabilities, IScopedLogger } from '@camstack/types';
+import type { HardwareInfo, PlatformCapabilities, IScopedLogger } from "@camstack/types";
 export declare class PlatformScorer {
-    private cached;
-    private readonly logger;
-    /**
-     * Path to the embedded portable Python (from `ctx.deps.ensurePython()`).
-     * The Docker hub ships NO system `python3` — inference runs on the
-     * downloaded portable build — so probing system `python3`/`python` would
-     * wrongly report "Python not found". When set, the interpreter lookup
-     * tries THIS binary first; `null` falls back to a system `python3`/`python`
-     * lookup (dev / agent environments where Python is on PATH).
-     */
-    private readonly embeddedPythonPath;
-    constructor(logger?: IScopedLogger, embeddedPythonPath?: string | null);
-    /**
-     * Probe hardware + derive scores from pure rules and score all backend combos.
-     *
-     * An optional `onPhase` callback is invoked at each step so consumers
-     * (e.g. the platform-probe addon) can emit live progress events on
-     * the event bus. The callback takes a phase id + a typed payload; all
-     * phases fire in strict order: `started` → `hardware` → `scored` → `done`.
-     * On failure, `error` fires once with the exception. Cached after first call.
-     *
-     * Scores are hardware-driven only (no Python module import subprocess):
-     * `scoreRuntimes` from `@camstack/types` is the single source of truth.
-     */
-    probe(onPhase?: (phase: string, payload?: Record<string, unknown>) => void): Promise<PlatformCapabilities>;
-    probeHardware(): Promise<HardwareInfo>;
-    /**
-     * Locates a Python interpreter without importing any module.
-     *
-     * Tries: embedded path (if configured) → `python3` → `python`.
-     * Returns the first executable found, or `null` if none respond.
-     * MUST NOT run `-c "import ..."` — interpreter location only.
-     */
-    private resolvePythonPath;
+	private cached;
+	private readonly logger;
+	/**
+	* Path to the embedded portable Python (from `ctx.deps.ensurePython()`).
+	* The Docker hub ships NO system `python3` — inference runs on the
+	* downloaded portable build — so probing system `python3`/`python` would
+	* wrongly report "Python not found". When set, the interpreter lookup
+	* tries THIS binary first; `null` falls back to a system `python3`/`python`
+	* lookup (dev / agent environments where Python is on PATH).
+	*/
+	private readonly embeddedPythonPath;
+	constructor(logger?: IScopedLogger, embeddedPythonPath?: string | null);
+	/**
+	* Probe hardware + derive scores from pure rules and score all backend combos.
+	*
+	* An optional `onPhase` callback is invoked at each step so consumers
+	* (e.g. the platform-probe addon) can emit live progress events on
+	* the event bus. The callback takes a phase id + a typed payload; all
+	* phases fire in strict order: `started` → `hardware` → `scored` → `done`.
+	* On failure, `error` fires once with the exception. Cached after first call.
+	*
+	* Scores are hardware-driven only (no Python module import subprocess):
+	* `scoreRuntimes` from `@camstack/types` is the single source of truth.
+	*/
+	probe(onPhase?: (phase: string, payload?: Record<string, unknown>) => void): Promise<PlatformCapabilities>;
+	probeHardware(): Promise<HardwareInfo>;
+	/**
+	* Locates a Python interpreter without importing any module.
+	*
+	* Tries: embedded path (if configured) → `python3` → `python`.
+	* Returns the first executable found, or `null` if none respond.
+	* MUST NOT run `-c "import ..."` — interpreter location only.
+	*/
+	private resolvePythonPath;
 }

package/dist/builtins/platform-probe/runtime-packages.d.ts

@@ -1,6 +1,6 @@
-import { HardwareInfo } from '@camstack/types';
+import type { HardwareInfo } from "@camstack/types";
 export interface RuntimePackageSet {
-    requirementsFiles: string[];
-    backendIds: string[];
+	requirementsFiles: string[];
+	backendIds: string[];
 }
 export declare function resolveRuntimePackages(hardware: HardwareInfo): RuntimePackageSet;

package/dist/builtins/remote-access-orchestrator/enabled-providers-reconcile.d.ts

@@ -1,96 +1,96 @@
 /**
- * Pure reconciliation core for the remote-access orchestrator's durable
- * `enabledProviders` set (D8 delivery-rule fix).
- *
- * Why this module exists
- * ----------------------
- * `enabledProviders: string[]` is the operator's "auto-start on boot"
- * intent — a DURABLE setting. Historically it was written ONLY from two
- * fire-and-forget bus events (`NetworkTunnelStarted` / `Stopped`). A
- * dropped event (hub restart, addon crash-respawn, hub↔orchestrator
- * partition) silently diverges the persisted set from reality:
- *   - dropped `Started` → tunnel running, not recorded → no auto-start
- *   - dropped `Stopped` → tunnel stopped, still recorded → boot restarts
- *     an operator-stopped tunnel.
- *
- * A durable setting must not be written by a lossy event. The fix is an
- * idempotent reconcile pass that pulls authoritative state via an
- * ACKNOWLEDGED RPC (`network-access` cap `getStatus`) on every provider
- * (re)connect — mirroring the kernel readiness-registry hydration via
- * `$readiness.getSnapshot`. The lifecycle events stay (still fine for
- * live UI dashboards); only the PERSISTENCE WRITE moves to the RPC pull.
- *
- * Reconcile semantics — ADD-ONLY (deliberately conservative)
- * ----------------------------------------------------------
- * `connected: true` from an acked RPC is UNAMBIGUOUS: the tunnel is up,
- * so the operator must have started it → safe to ADD to `enabledProviders`
- * (recovers a dropped `NetworkTunnelStarted` event).
- *
- * `connected: false` is AMBIGUOUS:
- *   - Provider registered but not yet started (normal cold-boot state,
- *     BEFORE `autoStartEnabledProviders` has called `start()`).
- *   - Provider transiently down (network blip, restart in progress).
- *   - Provider intentionally stopped by the operator.
- * `getStatus()` reports connectivity, NOT operator intent. Acting on
- * `connected: false` would wipe `enabledProviders` on every hub restart
- * (providers re-register ~15-20 s before `start()` is called), defeating
- * the purpose of the durable enabled-set. Therefore the reconcile pass
- * NEVER removes on `connected: false`.
- *
- * Removal of operator intent stays event-driven (`NetworkTunnelStopped`
- * → `markEnabled(id, false)`). That event is emitted synchronously by
- * the provider's own `stop()` call — it is the reliable signal that the
- * operator actually stopped the tunnel. A failed/absent RPC probe also
- * leaves the provider untouched.
- *
- * // Follow-up: covering the dropped-`Stopped` direction (a `Stopped`
- * // event lost → tunnel stopped but still in enabledProviders → boot
- * // wrongly restarts it) would require a provider-side persisted
- * // operator-intent flag that `getStatus()` surfaces. That is a larger
- * // multi-addon change (the audit's "approach 2") and is OUT OF SCOPE
- * // for this backstop. The current fix covers the higher-impact direction
- * // (dropped `Started` → operator's running tunnel not auto-restarted).
- *
- * The function is pure: the addon owns the RPC fan-out + the persist
- * call, so this core is unit-testable without a CapabilityRegistry.
- */
+* Pure reconciliation core for the remote-access orchestrator's durable
+* `enabledProviders` set (D8 delivery-rule fix).
+*
+* Why this module exists
+* ----------------------
+* `enabledProviders: string[]` is the operator's "auto-start on boot"
+* intent — a DURABLE setting. Historically it was written ONLY from two
+* fire-and-forget bus events (`NetworkTunnelStarted` / `Stopped`). A
+* dropped event (hub restart, addon crash-respawn, hub↔orchestrator
+* partition) silently diverges the persisted set from reality:
+*   - dropped `Started` → tunnel running, not recorded → no auto-start
+*   - dropped `Stopped` → tunnel stopped, still recorded → boot restarts
+*     an operator-stopped tunnel.
+*
+* A durable setting must not be written by a lossy event. The fix is an
+* idempotent reconcile pass that pulls authoritative state via an
+* ACKNOWLEDGED RPC (`network-access` cap `getStatus`) on every provider
+* (re)connect — mirroring the kernel readiness-registry hydration via
+* `$readiness.getSnapshot`. The lifecycle events stay (still fine for
+* live UI dashboards); only the PERSISTENCE WRITE moves to the RPC pull.
+*
+* Reconcile semantics — ADD-ONLY (deliberately conservative)
+* ----------------------------------------------------------
+* `connected: true` from an acked RPC is UNAMBIGUOUS: the tunnel is up,
+* so the operator must have started it → safe to ADD to `enabledProviders`
+* (recovers a dropped `NetworkTunnelStarted` event).
+*
+* `connected: false` is AMBIGUOUS:
+*   - Provider registered but not yet started (normal cold-boot state,
+*     BEFORE `autoStartEnabledProviders` has called `start()`).
+*   - Provider transiently down (network blip, restart in progress).
+*   - Provider intentionally stopped by the operator.
+* `getStatus()` reports connectivity, NOT operator intent. Acting on
+* `connected: false` would wipe `enabledProviders` on every hub restart
+* (providers re-register ~15-20 s before `start()` is called), defeating
+* the purpose of the durable enabled-set. Therefore the reconcile pass
+* NEVER removes on `connected: false`.
+*
+* Removal of operator intent stays event-driven (`NetworkTunnelStopped`
+* → `markEnabled(id, false)`). That event is emitted synchronously by
+* the provider's own `stop()` call — it is the reliable signal that the
+* operator actually stopped the tunnel. A failed/absent RPC probe also
+* leaves the provider untouched.
+*
+* // Follow-up: covering the dropped-`Stopped` direction (a `Stopped`
+* // event lost → tunnel stopped but still in enabledProviders → boot
+* // wrongly restarts it) would require a provider-side persisted
+* // operator-intent flag that `getStatus()` surfaces. That is a larger
+* // multi-addon change (the audit's "approach 2") and is OUT OF SCOPE
+* // for this backstop. The current fix covers the higher-impact direction
+* // (dropped `Started` → operator's running tunnel not auto-restarted).
+*
+* The function is pure: the addon owns the RPC fan-out + the persist
+* call, so this core is unit-testable without a CapabilityRegistry.
+*/
 /**
- * Outcome of one provider's `getStatus()` RPC probe.
- *
- * `ok: true`  → the RPC was acknowledged; `connected` is authoritative.
- * `ok: false` → the RPC threw / timed out; state is unknown and the
- *               provider's membership must be left as-is.
- */
+* Outcome of one provider's `getStatus()` RPC probe.
+*
+* `ok: true`  → the RPC was acknowledged; `connected` is authoritative.
+* `ok: false` → the RPC threw / timed out; state is unknown and the
+*               provider's membership must be left as-is.
+*/
 export type ProviderProbeResult = {
-    readonly addonId: string;
-    readonly ok: true;
-    readonly connected: boolean;
+	readonly addonId: string;
+	readonly ok: true;
+	readonly connected: boolean;
 } | {
-    readonly addonId: string;
-    readonly ok: false;
+	readonly addonId: string;
+	readonly ok: false;
 };
 export interface ReconcileResult {
-    /** The corrected enabled-set, sorted for stable persistence. */
-    readonly nextEnabled: readonly string[];
-    /** `true` when `nextEnabled` differs from the input — caller persists only then. */
-    readonly changed: boolean;
-    /** addonIds added because an acked RPC reported them connected. */
-    readonly added: readonly string[];
-    /**
-     * Always empty — reconcile is add-only. Removal of operator intent is
-     * event-driven (`NetworkTunnelStopped`). Kept in the type so callers
-     * that log `result.removed` continue to compile without changes.
-     */
-    readonly removed: readonly string[];
+	/** The corrected enabled-set, sorted for stable persistence. */
+	readonly nextEnabled: readonly string[];
+	/** `true` when `nextEnabled` differs from the input — caller persists only then. */
+	readonly changed: boolean;
+	/** addonIds added because an acked RPC reported them connected. */
+	readonly added: readonly string[];
+	/**
+	* Always empty — reconcile is add-only. Removal of operator intent is
+	* event-driven (`NetworkTunnelStopped`). Kept in the type so callers
+	* that log `result.removed` continue to compile without changes.
+	*/
+	readonly removed: readonly string[];
 }
 /**
- * Reconcile the durable `enabledProviders` set against authoritative
- * RPC probe results. Pure — no I/O. ADD-ONLY: only adds providers whose
- * acked `getStatus()` reports `connected: true`. Never removes on
- * `connected: false` — see module doc for the full rationale.
- *
- * @param currentEnabled - the persisted enabled-set before reconcile.
- * @param probes - one entry per provider whose `getStatus()` RPC was
- *   attempted this pass. Providers absent from this list are untouched.
- */
+* Reconcile the durable `enabledProviders` set against authoritative
+* RPC probe results. Pure — no I/O. ADD-ONLY: only adds providers whose
+* acked `getStatus()` reports `connected: true`. Never removes on
+* `connected: false` — see module doc for the full rationale.
+*
+* @param currentEnabled - the persisted enabled-set before reconcile.
+* @param probes - one entry per provider whose `getStatus()` RPC was
+*   attempted this pass. Providers absent from this list are untouched.
+*/
 export declare function reconcileEnabledProviders(currentEnabled: readonly string[], probes: readonly ProviderProbeResult[]): ReconcileResult;

package/dist/builtins/remote-access-orchestrator/index.d.ts

@@ -1 +1 @@
-export { RemoteAccessOrchestratorAddon, default } from './remote-access-orchestrator.addon.js';
+export { RemoteAccessOrchestratorAddon, default } from "./remote-access-orchestrator.addon.js";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.d.ts

@@ -1,40 +1,71 @@
-import { BaseAddon, ProviderRegistration } from '@camstack/types';
+/**
+* Remote-access orchestrator — backend-only boot-autostart service for
+* the `network-access` collection (Cloudflare Tunnel, ngrok, Tailscale, …).
+*
+* Retired its `remote-access` facade cap (2026-05-15): the admin UI now
+* talks to the `network-access` collection cap directly via generic
+* per-`addonId` routing, so this addon registers NO capability.
+*
+* What it still owns — the load-bearing logic:
+*   The orchestrator owns the "operator wants this provider running"
+*   intent — an `enabledProviders: string[]` slice in its addon-store
+*   blob (BaseAddon.config). On boot we iterate the list and call
+*   `provider.start()` for each enabled entry, so a tunnel set up once
+*   stays up across hub restarts.
+*
+*   Since start/stop no longer flow through this addon, the enabled-set
+*   is kept in sync from two sources:
+*     1. `NetworkTunnelStarted` / `NetworkTunnelStopped` bus events —
+*        fast, but lossy (fire-and-forget broadcasts). They drive both
+*        the live UI and removal from the durable set (`Stopped` is the
+*        only reliable "operator stopped it" signal).
+*     2. An RPC-driven ADD-ONLY RECONCILE pass (`reconcileEnabledProviders`)
+*        that pulls authoritative `connected` state via the `network-access`
+*        cap's `getStatus()` on every provider (re)connect. THIS covers
+*        dropped `NetworkTunnelStarted` events — if `connected: true` is
+*        acked, the provider is added to `enabledProviders`. It NEVER
+*        removes on `connected: false` because that signal is ambiguous
+*        (registered-not-yet-started vs transiently-down vs intentionally
+*        stopped). Running before `autoStartEnabledProviders` is safe:
+*        it can only add already-connected providers, never evict.
+*/
+import { BaseAddon, type ProviderRegistration } from "@camstack/types";
 interface RemoteAccessOrchestratorConfig {
-    /**
-     * addonIds the operator has explicitly Started. Auto-respawned on
-     * boot so a tunnel set up once stays up across hub restarts.
-     */
-    readonly enabledProviders: readonly string[];
+	/**
+	* addonIds the operator has explicitly Started. Auto-respawned on
+	* boot so a tunnel set up once stays up across hub restarts.
+	*/
+	readonly enabledProviders: readonly string[];
 }
 export declare class RemoteAccessOrchestratorAddon extends BaseAddon<RemoteAccessOrchestratorConfig> {
-    constructor();
-    protected onInitialize(): Promise<ProviderRegistration[]>;
-    /**
-     * Maintain the persisted `enabledProviders` set from a tunnel
-     * lifecycle event. `source.id` is `string | number`; `network-access`
-     * providers emit with `type: 'addon'` so it is always the addonId
-     * string. Non-string / non-addon sources are ignored defensively.
-     */
-    private onTunnelLifecycle;
-    /**
-     * Probe every locally-visible `network-access` provider's
-     * `getStatus()` over RPC and reconcile the durable `enabledProviders`
-     * set against the result. This is the D8 backstop for dropped
-     * `NetworkTunnelStarted` events: if `connected: true` is acked, the
-     * provider is added to `enabledProviders`. ADD-ONLY — never removes on
-     * `connected: false` (see enabled-providers-reconcile.ts for rationale).
-     *
-     * `getStatus()` is an acknowledged cap RPC — a transport blip surfaces
-     * as a rejected promise (recorded as `ok: false`, membership left
-     * untouched), never as a silent lossy write. Runs on every provider
-     * (re)connect via the `watchCapability` hooks, mirroring the kernel
-     * readiness-registry hydration on `$node.connected`. Safe to call
-     * before `autoStartEnabledProviders`: add-only semantics mean it cannot
-     * wipe the enabled-set even when providers are registered-not-yet-started.
-     */
-    private reconcileAndPersist;
-    private autoStartEnabledProviders;
-    private markEnabled;
-    private resolveImpl;
+	constructor();
+	protected onInitialize(): Promise<ProviderRegistration[]>;
+	/**
+	* Maintain the persisted `enabledProviders` set from a tunnel
+	* lifecycle event. `source.id` is `string | number`; `network-access`
+	* providers emit with `type: 'addon'` so it is always the addonId
+	* string. Non-string / non-addon sources are ignored defensively.
+	*/
+	private onTunnelLifecycle;
+	/**
+	* Probe every locally-visible `network-access` provider's
+	* `getStatus()` over RPC and reconcile the durable `enabledProviders`
+	* set against the result. This is the D8 backstop for dropped
+	* `NetworkTunnelStarted` events: if `connected: true` is acked, the
+	* provider is added to `enabledProviders`. ADD-ONLY — never removes on
+	* `connected: false` (see enabled-providers-reconcile.ts for rationale).
+	*
+	* `getStatus()` is an acknowledged cap RPC — a transport blip surfaces
+	* as a rejected promise (recorded as `ok: false`, membership left
+	* untouched), never as a silent lossy write. Runs on every provider
+	* (re)connect via the `watchCapability` hooks, mirroring the kernel
+	* readiness-registry hydration on `$node.connected`. Safe to call
+	* before `autoStartEnabledProviders`: add-only semantics mean it cannot
+	* wipe the enabled-set even when providers are registered-not-yet-started.
+	*/
+	private reconcileAndPersist;
+	private autoStartEnabledProviders;
+	private markEnabled;
+	private resolveImpl;
 }
 export default RemoteAccessOrchestratorAddon;

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-8LQ4lDEB.js");
+const require_dist = require("../../dist-XTkzsnz-.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { ni as EventCategory, ur as BaseAddon } from "../../dist-Biqn3TEn.mjs";
+import { ni as EventCategory, ur as BaseAddon } from "../../dist-byg8IP4Q.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/shared/device-state-changed.d.ts

@@ -1,15 +1,15 @@
 /**
- * The ONE cast-free narrowing of the `device.state-changed` payload. The
- * category is not part of the typed `EventCatalog` — every subscriber validates
- * at the boundary, and the builtins share this one narrowing instead of a
- * verbatim copy each (D659), like `./settle-sources.ts`; addons never import
- * each other, and its consumers live in this package.
- */
+* The ONE cast-free narrowing of the `device.state-changed` payload. The
+* category is not part of the typed `EventCatalog` — every subscriber validates
+* at the boundary, and the builtins share this one narrowing instead of a
+* verbatim copy each (D659), like `./settle-sources.ts`; addons never import
+* each other, and its consumers live in this package.
+*/
 /** Narrowed payload of a `DeviceStateChanged` bus event. */
 export interface DeviceStateChangedData {
-    readonly deviceId: number;
-    readonly capName: string;
-    readonly slice: Readonly<Record<string, unknown>>;
+	readonly deviceId: number;
+	readonly capName: string;
+	readonly slice: Readonly<Record<string, unknown>>;
 }
 /** Structural narrowing helper for untrusted bus payloads. */
 export declare function isRecord(value: unknown): value is Readonly<Record<string, unknown>>;

package/dist/builtins/shared/settle-sources.d.ts

@@ -1,22 +1,22 @@
 /**
- * settleSourcesWithTimeout — parallel, per-source-timeout fan-out shared by
- * the addon-pages / addon-widgets aggregators.
- *
- * Each source is called concurrently and raced against `timeoutMs`. A source
- * that rejects OR exceeds the timeout yields a `{ ok: false, error }` result
- * instead of blocking or failing the whole batch. This is the defense that
- * keeps ONE slow/unreachable source — e.g. an agent-hosted source whose cap
- * call sits in a 30s Moleculer `waitForServices` — from stalling the
- * aggregator's `listPages()/listWidgets()` (which otherwise hangs long enough
- * to trip the admin-ui WS keepalive → "server unreachable") or blanking the
- * sidebar. Entry order is preserved in the returned array.
- */
+* settleSourcesWithTimeout — parallel, per-source-timeout fan-out shared by
+* the addon-pages / addon-widgets aggregators.
+*
+* Each source is called concurrently and raced against `timeoutMs`. A source
+* that rejects OR exceeds the timeout yields a `{ ok: false, error }` result
+* instead of blocking or failing the whole batch. This is the defense that
+* keeps ONE slow/unreachable source — e.g. an agent-hosted source whose cap
+* call sits in a 30s Moleculer `waitForServices` — from stalling the
+* aggregator's `listPages()/listWidgets()` (which otherwise hangs long enough
+* to trip the admin-ui WS keepalive → "server unreachable") or blanking the
+* sidebar. Entry order is preserved in the returned array.
+*/
 /** Per-source outcome: the source's items, or the error that prevented them. */
 export type SourceResult<T> = {
-    readonly ok: true;
-    readonly value: readonly T[];
+	readonly ok: true;
+	readonly value: readonly T[];
 } | {
-    readonly ok: false;
-    readonly error: Error;
+	readonly ok: false;
+	readonly error: Error;
 };
 export declare function settleSourcesWithTimeout<T>(entries: ReadonlyArray<readonly [string, () => Promise<readonly T[]>]>, timeoutMs: number): Promise<ReadonlyArray<readonly [string, SourceResult<T>]>>;

package/dist/builtins/snapshot/index.d.ts

@@ -1,2 +1,2 @@
-export { SnapshotAddon } from './snapshot.addon.js';
-export { SnapshotAddon as default } from './snapshot.addon.js';
+export { SnapshotAddon } from "./snapshot.addon.js";
+export { SnapshotAddon as default } from "./snapshot.addon.js";