@camstack/system 1.2.68 → 1.2.70

package/dist/index.js

@@ -1,53 +1,53 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-Dhpte164.js");
-const require_model_download_service = require("./model-download-service-Caj1kaSi.js");
-const require_manifest_python_deps = require("./manifest-python-deps-BE6l8Y4W.js");
-const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
-const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
-const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
+const require_dist = require("./dist-DCLoJf2T.js");
+const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
+require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
-const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_builtins_console_logging_index = require("./builtins/console-logging/index.js");
-const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
+const require_builtins_core_blocks_core_blocks_addon = require("./builtins/core-blocks/core-blocks.addon.js");
+require("./builtins/core-blocks/index.js");
+const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
+require("./builtins/device-manager/index.js");
 const require_builtins_hub_forwarder_index = require("./builtins/hub-forwarder/index.js");
-const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
-require("./builtins/storage-orchestrator/index.js");
-const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
-const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
-require("./builtins/alerts/index.js");
 const require_builtins_liveness_monitor_liveness_monitor_addon = require("./builtins/liveness-monitor/liveness-monitor.addon.js");
 require("./builtins/liveness-monitor/index.js");
-const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
-require("./builtins/system-config/index.js");
-const require_builtins_core_blocks_core_blocks_addon = require("./builtins/core-blocks/core-blocks.addon.js");
-require("./builtins/core-blocks/index.js");
 const require_builtins_local_auth_local_auth_addon = require("./builtins/local-auth/local-auth.addon.js");
 require("./builtins/local-auth/index.js");
-const require_builtins_device_manager_device_manager_addon = require("./builtins/device-manager/device-manager.addon.js");
-require("./builtins/device-manager/index.js");
+const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
+const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
+const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
+const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
+const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
+const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
+require("./builtins/storage-orchestrator/index.js");
+const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
+require("./builtins/system-config/index.js");
+const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
+const require_file_data_plane = require("./file-data-plane-DUHPHa-Y.js");
+const require_manifest_python_deps = require("./manifest-python-deps-DafB-1hp.js");
+const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
-let node_v8 = require("node:v8");
-node_v8 = require_chunk.__toESM(node_v8);
-let node_vm = require("node:vm");
-node_vm = require_chunk.__toESM(node_vm);
-let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
-let node_http = require("node:http");
-let node_fs = require("node:fs");
-let node_fs$1 = require_chunk.__toESM(node_fs, 1);
-node_fs = require_chunk.__toESM(node_fs);
+let _camstack_types_node = require("@camstack/types/node");
+let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path, 1);
+let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 node_util = require_chunk.__toESM(node_util);
-let _camstack_types_addon = require("@camstack/types/addon");
-let node_child_process = require("node:child_process");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
-let node_fs_promises = require("node:fs/promises");
+let node_fs = require("node:fs");
+let node_fs$1 = require_chunk.__toESM(node_fs, 1);
+node_fs = require_chunk.__toESM(node_fs);
+let node_http = require("node:http");
+let node_v8 = require("node:v8");
+node_v8 = require_chunk.__toESM(node_v8);
+let node_vm = require("node:vm");
+node_vm = require_chunk.__toESM(node_vm);
+let _camstack_types_addon = require("@camstack/types/addon");
 let node_url = require("node:url");
 let node_events = require("node:events");
 let node_stream = require("node:stream");
@@ -58,6 +58,381 @@ fs = require_chunk.__toESM(fs, 1);
 let path = require("path");
 path = require_chunk.__toESM(path, 1);
 let module$1 = require("module");
+//#region src/addon/addon-api-factory.ts
+/**
+* Wrap a raw tRPC caller (from `createCallerFactory`) in a proxy that
+* exposes each leaf procedure as `{ query, mutate, subscribe }`, matching
+* the shape of `CreateTRPCClient<AppRouter>`.
+*
+* The tricky part: tRPC v11 callers expose nested routers as callable
+* no-op functions (e.g. `caller.greet` is `typeof === 'function'`), so
+* we can't use `typeof` to tell namespace from leaf. Instead, we return
+* a unified proxy that handles BOTH behaviours:
+*
+*   - Accessing `.query` / `.mutate` treats the current node as a leaf
+*     procedure and invokes `caller(input)` when called.
+*   - Accessing `.subscribe` throws (not supported on direct caller).
+*   - Accessing any other property descends into `caller[prop]` and
+*     returns a nested proxy.
+*/
+function wrapCallerAsClient(caller) {
+	return new Proxy(Object.create(null), { get(_target, prop) {
+		if (typeof prop !== "string") return void 0;
+		if (prop === "query" || prop === "mutate") {
+			if (typeof caller !== "function") throw new Error(`Cannot call .${prop}() — this tRPC node is not a procedure`);
+			const fn = caller;
+			return (input) => fn(input);
+		}
+		if (prop === "subscribe") return () => {
+			throw new Error(`subscribe() is not supported on direct caller — use the WSS client for subscriptions`);
+		};
+		const child = caller?.[prop];
+		if (child === void 0 || child === null) return void 0;
+		return wrapCallerAsClient(child);
+	} });
+}
+var AddonApiFactory = class {
+	/**
+	* Create a direct caller -- calls tRPC procedures directly in-process.
+	* Zero network overhead. Used for in-process addons and dev mode.
+	*
+	* Returns `AddonApi` — the same tRPC client surface that broker-routed
+	* callers get. Callers treat it uniformly as `context.api` regardless
+	* of the underlying transport.
+	*/
+	async createDirectCaller(options) {
+		const { initTRPC } = await import("@trpc/server");
+		return wrapCallerAsClient(initTRPC.create().createCallerFactory(options.router)(options.context));
+	}
+};
+//#endregion
+//#region src/addon-routes/addon-route-registry.ts
+/**
+* Registry for dynamic HTTP routes registered by addons.
+* Framework-agnostic — the server HTTP layer queries this registry to dispatch requests.
+*/
+var AddonRouteRegistry = class {
+	routes = /* @__PURE__ */ new Map();
+	/**
+	* Register all routes from an addon's route provider.
+	*/
+	registerRoutes(addonId, provider) {
+		const registered = provider.getRoutes().map((route) => {
+			return {
+				addonId,
+				route,
+				fullPath: `/addon/${addonId}${route.path.startsWith("/") ? route.path : `/${route.path}`}`
+			};
+		});
+		this.routes.set(addonId, registered);
+	}
+	/**
+	* Unregister all routes for an addon.
+	*/
+	unregisterRoutes(addonId) {
+		this.routes.delete(addonId);
+	}
+	/**
+	* Match an incoming request method + path to a registered route.
+	* Supports simple path parameters (e.g., /items/:id).
+	*/
+	matchRoute(method, path) {
+		const normalizedMethod = method.toUpperCase();
+		for (const registeredRoutes of this.routes.values()) for (const entry of registeredRoutes) {
+			if (entry.route.method !== normalizedMethod) continue;
+			const params = matchPath(entry.fullPath, path);
+			if (params !== null) return {
+				route: entry.route,
+				addonId: entry.addonId,
+				params
+			};
+		}
+		return null;
+	}
+	/**
+	* List all registered routes across all addons.
+	*/
+	listRoutes() {
+		const result = [];
+		for (const registeredRoutes of this.routes.values()) for (const entry of registeredRoutes) result.push({
+			addonId: entry.addonId,
+			method: entry.route.method,
+			path: entry.fullPath,
+			access: entry.route.access,
+			description: entry.route.description
+		});
+		return result;
+	}
+};
+/**
+* Match a route pattern against an actual path.
+* Supports :param segments (e.g., /addon/:addonId/items/:id).
+* Returns extracted params or null if no match.
+*/
+function matchPath(pattern, path) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = path.split("/").filter(Boolean);
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const patternPart = patternParts[i];
+		const pathPart = pathParts[i];
+		if (patternPart.startsWith(":")) params[patternPart.slice(1)] = pathPart;
+		else if (patternPart !== pathPart) return null;
+	}
+	return params;
+}
+//#endregion
+//#region src/auth/scope-matcher.ts
+/**
+* True if the scope set grants `access` on device-scoped capabilities.
+* A `category:device` grant covers every device cap (the broad grant).
+* Mirrors the OR-semantics of the existing token scope matcher.
+*/
+function scopesAllowDeviceCap(scopes, access) {
+	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
+}
+//#endregion
+//#region src/events/event-bus.ts
+var EventBus = class {
+	listeners = /* @__PURE__ */ new Map();
+	on(event, callback) {
+		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
+		const set = this.listeners.get(event);
+		set.add(callback);
+		return () => set.delete(callback);
+	}
+	emit(event, data) {
+		const set = this.listeners.get(event);
+		if (!set) return;
+		for (const cb of set) try {
+			cb(data);
+		} catch {}
+	}
+	once(event, callback) {
+		const unsub = this.on(event, (data) => {
+			unsub();
+			callback(data);
+		});
+		return unsub;
+	}
+	removeAllListeners(event) {
+		if (event) this.listeners.delete(event);
+		else this.listeners.clear();
+	}
+	listenerCount(event) {
+		return this.listeners.get(event)?.size ?? 0;
+	}
+};
+//#endregion
+//#region src/events/system-event-bus.ts
+var EventRingBuffer = class {
+	capacity;
+	buffer;
+	head = 0;
+	count = 0;
+	constructor(capacity) {
+		this.capacity = capacity;
+		this.buffer = Array.from({ length: capacity });
+	}
+	push(event) {
+		this.buffer[this.head] = event;
+		this.head = (this.head + 1) % this.capacity;
+		if (this.count < this.capacity) this.count++;
+	}
+	getAll() {
+		const result = [];
+		for (let i = 0; i < this.count; i++) {
+			const index = (this.head - 1 - i + this.capacity) % this.capacity;
+			result.push(this.buffer[index]);
+		}
+		return result;
+	}
+	query(filter, limit) {
+		let result = [...this.getAll()];
+		if (filter) result = result.filter((event) => matchesFilter(event, filter));
+		if (limit !== void 0 && limit > 0) return result.slice(0, limit);
+		return result;
+	}
+};
+function matchesCategory(eventCategory, filterCategory) {
+	if (filterCategory.endsWith(".*")) {
+		const prefix = filterCategory.slice(0, -2);
+		return eventCategory.startsWith(prefix + ".") || eventCategory === prefix;
+	}
+	return eventCategory === filterCategory;
+}
+function matchesFilter(event, filter) {
+	if (filter.category) {
+		const raw = filter.category;
+		if (!(Array.isArray(raw) ? raw.map(String) : [String(raw)]).some((cat) => matchesCategory(event.category, cat))) return false;
+	}
+	if (filter.source) {
+		if (event.source.type !== filter.source.type || event.source.id !== filter.source.id) return false;
+	}
+	if (filter.agentId) {
+		const eventNodeId = event.source.nodeId;
+		if (!eventNodeId || !eventNodeId.startsWith(filter.agentId)) return false;
+	}
+	if (filter.addonId) {
+		if ((event.source.addonId ?? (event.source.type === "addon" ? String(event.source.id) : void 0)) !== filter.addonId) return false;
+	}
+	if (filter.deviceId !== void 0) {
+		if ((event.source.deviceId ?? (event.source.type === "device" ? Number(event.source.id) : void 0)) !== filter.deviceId) return false;
+	}
+	if (filter.since && event.timestamp < filter.since) return false;
+	return true;
+}
+var SystemEventBus = class {
+	ringBuffer;
+	subscribers = [];
+	constructor(bufferSize = 1e4) {
+		this.ringBuffer = new EventRingBuffer(bufferSize);
+	}
+	emit(event) {
+		this.ringBuffer.push(event);
+		for (const subscriber of this.subscribers) if (matchesFilter(event, subscriber.filter)) queueMicrotask(() => {
+			try {
+				subscriber.callback(event);
+			} catch (err) {
+				console.error(`[EventBus] Subscriber error for ${event.category}:`, err);
+			}
+		});
+	}
+	/**
+	* Subscribe to events matching a filter.
+	* When called with a typed category filter, the handler receives typed event data.
+	*/
+	subscribe(filter, handler) {
+		const subscriber = {
+			filter,
+			callback: handler
+		};
+		this.subscribers.push(subscriber);
+		return () => {
+			const index = this.subscribers.indexOf(subscriber);
+			if (index !== -1) this.subscribers.splice(index, 1);
+		};
+	}
+	getRecent(filter, limit) {
+		return this.ringBuffer.query(filter, limit);
+	}
+};
+//#endregion
+//#region src/feature/feature-manager.ts
+var FeatureManager = class {
+	configReader;
+	constructor(configReader) {
+		this.configReader = configReader;
+	}
+	isEnabled(flag) {
+		return this.configReader.features[flag];
+	}
+	getManifest() {
+		return { ...this.configReader.features };
+	}
+};
+//#endregion
+//#region src/http/data-plane-registry.ts
+function trimSlashes(s) {
+	return s.replace(/^\/+/, "").replace(/\/+$/, "");
+}
+var DataPlaneRegistry = class {
+	byAddon = /* @__PURE__ */ new Map();
+	/** Replace ALL endpoints for an addon (idempotent re-mount). */
+	registerAddon(addonId, endpoints) {
+		if (endpoints.length === 0) {
+			this.byAddon.delete(addonId);
+			return;
+		}
+		this.byAddon.set(addonId, [...endpoints]);
+	}
+	/** Drop an addon's endpoints (stop / disconnect). */
+	unregisterAddon(addonId) {
+		this.byAddon.delete(addonId);
+	}
+	/** True when the addon has at least one data-plane registered. */
+	has(addonId) {
+		return this.byAddon.has(addonId);
+	}
+	/**
+	* Match `subPath` (the part after `/addon/<addonId>/`, with or without a
+	* leading slash, NO query string) against the addon's prefixes. Longest prefix
+	* wins. Returns the matched endpoint + the remaining path the addon handler sees.
+	*/
+	match(addonId, subPath) {
+		const endpoints = this.byAddon.get(addonId);
+		if (!endpoints) return null;
+		const normalized = `/${trimSlashes(subPath)}`;
+		let best = null;
+		for (const endpoint of endpoints) {
+			const prefix = `/${trimSlashes(endpoint.prefix)}`;
+			if (normalized === prefix || normalized.startsWith(`${prefix}/`)) {
+				const rest = normalized.slice(prefix.length) || "/";
+				if (best === null || prefix.length > best.len) best = {
+					endpoint,
+					rest,
+					len: prefix.length
+				};
+			}
+		}
+		if (best === null) return null;
+		return {
+			addonId,
+			endpoint: best.endpoint,
+			rest: best.rest
+		};
+	}
+};
+//#endregion
+//#region src/http/reverse-proxy.ts
+/**
+* Transport-agnostic reverse-proxy from the hub to an addon's `127.0.0.1`
+* data-plane listener. Operates on RAW Node http objects (`request.raw` /
+* `reply.raw`) so `@camstack/system` stays free of any HTTP-framework dependency.
+*
+* The hub authenticates first (its existing scoped-token / admin / cookie logic),
+* then hands the raw request+response here. We forward method + headers (incl.
+* `Range`) + body upstream — injecting the per-listener shared secret so the addon
+* accepts the call — and pipe the upstream response straight back (status +
+* headers + body), so `Content-Range`, backpressure and client-disconnect are all
+* native. No bytes are buffered; nothing crosses the cap channel.
+*/
+/** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
+*  the caller must `reply.hijack()` (or otherwise stop the framework from also
+*  responding) before calling this, since we drive `clientRes` directly. */
+function proxyToUpstream(opts) {
+	const { baseUrl, secret, upstreamPath, clientReq, clientRes } = opts;
+	const base = new URL(baseUrl);
+	const headers = { ...clientReq.headers };
+	delete headers.host;
+	delete headers.connection;
+	delete headers["content-length"];
+	headers[require_dist.DATAPLANE_SECRET_HEADER] = secret;
+	const upstream = (0, node_http.request)({
+		protocol: base.protocol,
+		hostname: base.hostname,
+		port: base.port,
+		method: clientReq.method ?? "GET",
+		path: upstreamPath,
+		headers
+	}, (upRes) => {
+		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
+		upRes.pipe(clientRes);
+	});
+	upstream.on("error", (err) => {
+		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
+		clientRes.end(JSON.stringify({
+			error: "data-plane upstream error",
+			detail: String(err)
+		}));
+	});
+	clientRes.on("close", () => {
+		if (!clientRes.writableFinished && !upstream.destroyed) upstream.destroy();
+	});
+	clientReq.pipe(upstream);
+}
+//#endregion
 //#region src/kernel/heap-watch.ts
 /**
 * heap-watch — hub-main's own memory, on the record, and returned to the OS.
@@ -323,524 +698,6 @@ function startHeapWatch(label = "hub-main", sink = consoleSink, intervalMs = HEA
 	};
 }
 //#endregion
-//#region src/events/event-bus.ts
-var EventBus = class {
-	listeners = /* @__PURE__ */ new Map();
-	on(event, callback) {
-		if (!this.listeners.has(event)) this.listeners.set(event, /* @__PURE__ */ new Set());
-		const set = this.listeners.get(event);
-		set.add(callback);
-		return () => set.delete(callback);
-	}
-	emit(event, data) {
-		const set = this.listeners.get(event);
-		if (!set) return;
-		for (const cb of set) try {
-			cb(data);
-		} catch {}
-	}
-	once(event, callback) {
-		const unsub = this.on(event, (data) => {
-			unsub();
-			callback(data);
-		});
-		return unsub;
-	}
-	removeAllListeners(event) {
-		if (event) this.listeners.delete(event);
-		else this.listeners.clear();
-	}
-	listenerCount(event) {
-		return this.listeners.get(event)?.size ?? 0;
-	}
-};
-//#endregion
-//#region src/http/data-plane-registry.ts
-function trimSlashes(s) {
-	return s.replace(/^\/+/, "").replace(/\/+$/, "");
-}
-var DataPlaneRegistry = class {
-	byAddon = /* @__PURE__ */ new Map();
-	/** Replace ALL endpoints for an addon (idempotent re-mount). */
-	registerAddon(addonId, endpoints) {
-		if (endpoints.length === 0) {
-			this.byAddon.delete(addonId);
-			return;
-		}
-		this.byAddon.set(addonId, [...endpoints]);
-	}
-	/** Drop an addon's endpoints (stop / disconnect). */
-	unregisterAddon(addonId) {
-		this.byAddon.delete(addonId);
-	}
-	/** True when the addon has at least one data-plane registered. */
-	has(addonId) {
-		return this.byAddon.has(addonId);
-	}
-	/**
-	* Match `subPath` (the part after `/addon/<addonId>/`, with or without a
-	* leading slash, NO query string) against the addon's prefixes. Longest prefix
-	* wins. Returns the matched endpoint + the remaining path the addon handler sees.
-	*/
-	match(addonId, subPath) {
-		const endpoints = this.byAddon.get(addonId);
-		if (!endpoints) return null;
-		const normalized = `/${trimSlashes(subPath)}`;
-		let best = null;
-		for (const endpoint of endpoints) {
-			const prefix = `/${trimSlashes(endpoint.prefix)}`;
-			if (normalized === prefix || normalized.startsWith(`${prefix}/`)) {
-				const rest = normalized.slice(prefix.length) || "/";
-				if (best === null || prefix.length > best.len) best = {
-					endpoint,
-					rest,
-					len: prefix.length
-				};
-			}
-		}
-		if (best === null) return null;
-		return {
-			addonId,
-			endpoint: best.endpoint,
-			rest: best.rest
-		};
-	}
-};
-//#endregion
-//#region src/http/reverse-proxy.ts
-/**
-* Transport-agnostic reverse-proxy from the hub to an addon's `127.0.0.1`
-* data-plane listener. Operates on RAW Node http objects (`request.raw` /
-* `reply.raw`) so `@camstack/system` stays free of any HTTP-framework dependency.
-*
-* The hub authenticates first (its existing scoped-token / admin / cookie logic),
-* then hands the raw request+response here. We forward method + headers (incl.
-* `Range`) + body upstream — injecting the per-listener shared secret so the addon
-* accepts the call — and pipe the upstream response straight back (status +
-* headers + body), so `Content-Range`, backpressure and client-disconnect are all
-* native. No bytes are buffered; nothing crosses the cap channel.
-*/
-/** Reverse-proxy one request to an addon data-plane listener. Fire-and-forget:
-*  the caller must `reply.hijack()` (or otherwise stop the framework from also
-*  responding) before calling this, since we drive `clientRes` directly. */
-function proxyToUpstream(opts) {
-	const { baseUrl, secret, upstreamPath, clientReq, clientRes } = opts;
-	const base = new URL(baseUrl);
-	const headers = { ...clientReq.headers };
-	delete headers.host;
-	delete headers.connection;
-	delete headers["content-length"];
-	headers[require_dist.DATAPLANE_SECRET_HEADER] = secret;
-	const upstream = (0, node_http.request)({
-		protocol: base.protocol,
-		hostname: base.hostname,
-		port: base.port,
-		method: clientReq.method ?? "GET",
-		path: upstreamPath,
-		headers
-	}, (upRes) => {
-		clientRes.writeHead(upRes.statusCode ?? 502, upRes.headers);
-		upRes.pipe(clientRes);
-	});
-	upstream.on("error", (err) => {
-		if (!clientRes.headersSent) clientRes.writeHead(502, { "content-type": "application/json" });
-		clientRes.end(JSON.stringify({
-			error: "data-plane upstream error",
-			detail: String(err)
-		}));
-	});
-	clientRes.on("close", () => {
-		if (!clientRes.writableFinished && !upstream.destroyed) upstream.destroy();
-	});
-	clientReq.pipe(upstream);
-}
-//#endregion
-//#region src/python/python-env-manager.ts
-var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
-var PythonEnvManager = class {
-	venvPath;
-	cachedProbe = null;
-	constructor(dataDir) {
-		this.venvPath = node_path.join(dataDir, ".venv");
-	}
-	async probe() {
-		if (this.cachedProbe) return this.cachedProbe;
-		for (const cmd of ["python3", "python"]) try {
-			const { stdout } = await execFileAsync$4(cmd, ["--version"]);
-			const version = stdout.trim().replace("Python ", "");
-			const major = parseInt(version.split(".")[0] ?? "0", 10);
-			const minor = parseInt(version.split(".")[1] ?? "0", 10);
-			if (major < 3 || major === 3 && minor < 10) continue;
-			const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
-			this.cachedProbe = {
-				available: true,
-				version,
-				path: pathOut.trim()
-			};
-			return this.cachedProbe;
-		} catch {
-			continue;
-		}
-		this.cachedProbe = { available: false };
-		return this.cachedProbe;
-	}
-	async ensure(options) {
-		const probe = await this.probe();
-		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
-		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
-			"-m",
-			"venv",
-			this.venvPath
-		]);
-		const venvPython = node_path.join(this.venvPath, "bin", "python");
-		if (options.packages.length > 0) await execFileAsync$4(venvPython, [
-			"-m",
-			"pip",
-			"install",
-			"-q",
-			...options.packages
-		]);
-		return {
-			pythonPath: venvPython,
-			venvPath: this.venvPath,
-			spawn: (script, args) => {
-				return (0, node_child_process.spawn)(venvPython, [script, ...args]);
-			}
-		};
-	}
-	spawn(script, args) {
-		const venvPython = node_path.join(this.venvPath, "bin", "python");
-		if (!node_fs.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
-		return (0, node_child_process.spawn)(venvPython, [script, ...args]);
-	}
-};
-//#endregion
-//#region src/pipeline/pipeline-validator.ts
-var PipelineValidator = class {
-	stepExists;
-	constructor(stepExists) {
-		this.stepExists = stepExists;
-	}
-	validate(config) {
-		const errors = [];
-		const warnings = [];
-		for (const node of config.video) this.validateNode(node, errors, warnings);
-		if (config.audio) this.validateNode(config.audio, errors, warnings);
-		return {
-			valid: errors.length === 0,
-			errors,
-			warnings
-		};
-	}
-	validateNode(node, errors, warnings) {
-		if (!this.stepExists(node.addon)) {
-			errors.push({
-				step: node.step,
-				addon: node.addon,
-				message: `Step "${node.addon}" has no provider — the addon that provided it may have been removed`,
-				severity: "error"
-			});
-			return;
-		}
-		if (node.children) for (const child of node.children) this.validateNode(child, errors, warnings);
-	}
-};
-//#endregion
-//#region src/pipeline/pipeline-runner.ts
-var PipelineRunner = class {
-	addonResolver;
-	constructor(addonResolver) {
-		this.addonResolver = addonResolver;
-	}
-	async run(frame, config) {
-		const startTime = performance.now();
-		const results = [];
-		const timings = {};
-		for (const rootNode of config.video) await this.executeNode(rootNode, frame, null, results, timings);
-		if (config.audio) await this.executeNode(config.audio, frame, null, results, timings);
-		return {
-			results,
-			totalMs: performance.now() - startTime,
-			timings,
-			frameTimestamp: frame.timestamp
-		};
-	}
-	async executeNode(node, frame, parentDetection, results, timings) {
-		const resultId = (0, node_crypto.randomUUID)();
-		const stepStart = performance.now();
-		try {
-			const effectiveConfig = { ...node.configOverride };
-			const caller = await this.addonResolver.resolve(node.addon, effectiveConfig);
-			let output;
-			if (parentDetection) {
-				const cropInput = {
-					frame,
-					roi: parentDetection.det.bbox,
-					parentDetection: parentDetection.det
-				};
-				output = await caller.process(cropInput);
-			} else output = await caller.process(frame);
-			const stepMs = performance.now() - stepStart;
-			const slot = "detections" in output ? "detector" : "crops" in output ? "cropper" : "classifier";
-			const stepResult = {
-				addon: node.addon,
-				slot,
-				output,
-				parentResultId: parentDetection?.resultId,
-				resultId,
-				inferenceMs: output.inferenceMs,
-				preprocessMs: 0,
-				totalMs: stepMs
-			};
-			results.push(stepResult);
-			timings[node.step] = stepMs;
-			if (node.children?.length) {
-				const detections = "detections" in output ? output.detections : "crops" in output ? output.crops : [];
-				await this.executeChildren(node.children, frame, detections, resultId, results, timings);
-			}
-		} catch (error) {
-			const stepMs = performance.now() - stepStart;
-			const message = require_dist.errMsg(error);
-			results.push({
-				addon: node.addon,
-				slot: "detector",
-				output: {
-					detections: [],
-					inferenceMs: 0,
-					modelId: ""
-				},
-				parentResultId: parentDetection?.resultId,
-				resultId,
-				inferenceMs: 0,
-				preprocessMs: 0,
-				totalMs: stepMs,
-				error: {
-					code: "ADDON_ERROR",
-					message,
-					childrenSkipped: true
-				}
-			});
-		}
-	}
-	async executeChildren(children, frame, parentDetections, parentResultId, results, timings) {
-		const promises = [];
-		for (const detection of parentDetections) {
-			if (detection.bbox.w < 1 || detection.bbox.h < 1) continue;
-			for (const child of children) promises.push(this.executeNode(child, frame, {
-				det: detection,
-				resultId: parentResultId
-			}, results, timings));
-		}
-		await Promise.allSettled(promises);
-	}
-};
-//#endregion
-//#region src/pipeline/engine-manager-resolver.ts
-/**
-* Adapter that wraps an IEngineManager + addonConfigs as an IAddonResolver.
-*
-* Used for backwards compatibility — the in-process AddonEngineManager
-* still uses the old getOrCreateEngine(addonId, globalConfig, override) API.
-* This adapter bridges it to the new resolve(addonId, config) interface.
-*/
-var EngineManagerResolver = class {
-	engineManager;
-	addonConfigs;
-	constructor(engineManager, addonConfigs) {
-		this.engineManager = engineManager;
-		this.addonConfigs = addonConfigs;
-	}
-	async resolve(addonId, config) {
-		const globalConfig = this.addonConfigs.get(addonId) ?? {};
-		const engine = await this.engineManager.getOrCreateEngine(addonId, globalConfig, config);
-		return { process: async (input) => {
-			return engine.process(input);
-		} };
-	}
-	async shutdownAll() {
-		await this.engineManager.shutdownAll();
-	}
-};
-//#endregion
-//#region src/network/network-quality.ts
-var NetworkQualityTracker = class NetworkQualityTracker {
-	devices = /* @__PURE__ */ new Map();
-	static MAX_SAMPLES = 30;
-	reportStreamStats(deviceId, streamId, bitrateKbps, packetLoss) {
-		const device = this.getOrCreateDevice(deviceId);
-		let stream = device.streams.get(streamId);
-		if (!stream) {
-			stream = {
-				nominalBitrateKbps: bitrateKbps,
-				samples: [],
-				peakBitrateKbps: 0,
-				packetLossSamples: [],
-				lastUpdated: 0
-			};
-			device.streams.set(streamId, stream);
-		}
-		stream.samples.push(bitrateKbps);
-		if (stream.samples.length > NetworkQualityTracker.MAX_SAMPLES) stream.samples.shift();
-		stream.peakBitrateKbps = Math.max(stream.peakBitrateKbps, bitrateKbps);
-		if (packetLoss !== void 0) {
-			stream.packetLossSamples.push(packetLoss);
-			if (stream.packetLossSamples.length > NetworkQualityTracker.MAX_SAMPLES) stream.packetLossSamples.shift();
-		}
-		stream.lastUpdated = Date.now();
-	}
-	reportClientStats(deviceId, stats) {
-		const device = this.getOrCreateDevice(deviceId);
-		device.client = {
-			...stats,
-			lastUpdated: Date.now()
-		};
-	}
-	getDeviceStats(deviceId) {
-		const device = this.devices.get(deviceId);
-		if (!device) return null;
-		const streams = {};
-		for (const [streamId, s] of device.streams) {
-			const avg = (arr) => arr.length === 0 ? 0 : arr.reduce((a, b) => a + b, 0) / arr.length;
-			streams[streamId] = {
-				nominalBitrateKbps: s.nominalBitrateKbps,
-				observedBitrateKbps: Math.round(avg(s.samples)),
-				peakBitrateKbps: s.peakBitrateKbps,
-				packetLossPercent: Math.round(avg(s.packetLossSamples) * 10) / 10,
-				lastUpdated: s.lastUpdated
-			};
-		}
-		return {
-			deviceId,
-			streams,
-			client: device.client ?? void 0
-		};
-	}
-	getAllStats() {
-		const results = [];
-		for (const deviceId of this.devices.keys()) {
-			const stats = this.getDeviceStats(deviceId);
-			if (stats) results.push(stats);
-		}
-		return results;
-	}
-	getOrCreateDevice(deviceId) {
-		let device = this.devices.get(deviceId);
-		if (!device) {
-			device = {
-				streams: /* @__PURE__ */ new Map(),
-				client: null
-			};
-			this.devices.set(deviceId, device);
-		}
-		return device;
-	}
-};
-//#endregion
-//#region src/repl/repl-engine.ts
-var EXECUTION_TIMEOUT_MS = 5e3;
-var COMPLETION_TIMEOUT_MS = 1e3;
-var ReplEngine = class {
-	contextProvider;
-	constructor(contextProvider) {
-		this.contextProvider = contextProvider;
-	}
-	async execute(code, context) {
-		const start = Date.now();
-		const sandbox = await this.buildSandbox(context);
-		try {
-			const vmContext = node_vm.createContext(sandbox);
-			let result = new node_vm.Script(code).runInContext(vmContext, { timeout: EXECUTION_TIMEOUT_MS });
-			if (result && typeof result === "object" && "then" in result && typeof result.then === "function") result = await Promise.race([result, new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("Async timeout (5s)")), EXECUTION_TIMEOUT_MS))]);
-			const duration = Date.now() - start;
-			if (result === void 0) return {
-				output: "undefined",
-				type: "void",
-				duration
-			};
-			return {
-				output: node_util.inspect(result, {
-					depth: 4,
-					colors: false,
-					maxArrayLength: 50,
-					maxStringLength: 1e3
-				}),
-				type: "value",
-				duration
-			};
-		} catch (err) {
-			return {
-				output: err instanceof Error ? err.message : typeof err === "object" && err !== null && "message" in err ? String(err.message) : String(err),
-				type: "error",
-				duration: Date.now() - start
-			};
-		}
-	}
-	async getCompletions(partial, context) {
-		const sandbox = await this.buildSandbox(context);
-		const keys = Object.keys(sandbox);
-		if (!partial) return keys;
-		const lastDot = partial.lastIndexOf(".");
-		if (lastDot === -1) return keys.filter((k) => k.startsWith(partial));
-		const objPath = partial.substring(0, lastDot);
-		const propPrefix = partial.substring(lastDot + 1);
-		try {
-			const vmContext = node_vm.createContext(sandbox);
-			const obj = node_vm.runInContext(objPath, vmContext, { timeout: COMPLETION_TIMEOUT_MS });
-			if (obj && typeof obj === "object") {
-				const proto = Object.getPrototypeOf(obj);
-				const objKeys = Object.getOwnPropertyNames(obj).concat(Object.getOwnPropertyNames(proto ?? {})).filter((k) => k.startsWith(propPrefix));
-				return [...new Set(objKeys)].map((k) => `${objPath}.${k}`);
-			}
-		} catch {}
-		return [];
-	}
-	async buildSandbox(context) {
-		const base = {
-			console: {
-				log: (...args) => node_util.inspect(args),
-				warn: (...args) => node_util.inspect(args)
-			},
-			JSON,
-			Math,
-			Date,
-			Array,
-			Object,
-			String,
-			Number,
-			Boolean,
-			Map,
-			Set,
-			Promise,
-			Buffer,
-			setTimeout: void 0,
-			setInterval: void 0,
-			fetch: void 0,
-			require: void 0,
-			process: void 0,
-			...context.variables
-		};
-		switch (context.scope.type) {
-			case "system": return {
-				...base,
-				...await this.contextProvider.getSystemSandbox()
-			};
-			case "device": return {
-				...base,
-				...await this.contextProvider.getDeviceSandbox(context.scope.deviceId)
-			};
-			case "provider": return {
-				...base,
-				...await this.contextProvider.getProviderSandbox(context.scope.providerId)
-			};
-			case "addon": return {
-				...base,
-				...await this.contextProvider.getAddonSandbox(context.scope.addonId)
-			};
-			default: return base;
-		}
-	}
-};
-//#endregion
 //#region src/lifecycle/lifecycle-state-machine.ts
 var VALID_TRANSITIONS = {
 	stopped: ["starting", "disabled"],
@@ -852,195 +709,87 @@ var VALID_TRANSITIONS = {
 	running: ["stopping", "error"],
 	stopping: ["stopped", "error"],
 	error: [
-		"starting",
-		"stopped",
-		"disabled"
-	],
-	disabled: ["stopped"]
-};
-var LifecycleStateMachine = class {
-	elementId;
-	elementType;
-	eventBus;
-	logger;
-	_state = "stopped";
-	_error;
-	_startedAt;
-	_stoppedAt;
-	_restartCount = 0;
-	_hasStartedOnce = false;
-	constructor(elementId, elementType, eventBus, logger) {
-		this.elementId = elementId;
-		this.elementType = elementType;
-		this.eventBus = eventBus;
-		this.logger = logger;
-	}
-	get state() {
-		return this._state;
-	}
-	getStatus() {
-		return {
-			state: this._state,
-			error: this._error,
-			startedAt: this._startedAt,
-			stoppedAt: this._stoppedAt,
-			restartCount: this._restartCount,
-			uptime: this._state === "running" && this._startedAt ? Date.now() - this._startedAt : 0
-		};
-	}
-	transition(to, error) {
-		const from = this._state;
-		if (!this.isValidTransition(from, to)) {
-			this.logger.warn("Invalid state transition", { meta: {
-				from,
-				to
-			} });
-			return false;
-		}
-		this._state = to;
-		this._error = error;
-		if (to === "running") {
-			if (this._hasStartedOnce) this._restartCount++;
-			this._hasStartedOnce = true;
-			this._startedAt = Date.now();
-			this._stoppedAt = void 0;
-		}
-		if (to === "stopped" || to === "error" || to === "disabled") this._stoppedAt = Date.now();
-		this.logger.info("State transition", { meta: {
-			from,
-			to,
-			error
-		} });
-		this.eventBus.emit({
-			id: (0, node_crypto.randomUUID)(),
-			timestamp: /* @__PURE__ */ new Date(),
-			source: {
-				type: this.elementType,
-				id: this.elementId
-			},
-			category: `${this.elementType}.state.${to}`,
-			data: {
-				from,
-				to,
-				error,
-				elementId: this.elementId
-			}
-		});
-		return true;
-	}
-	incrementRestartCount() {
-		this._restartCount++;
-	}
-	isValidTransition(from, to) {
-		return VALID_TRANSITIONS[from]?.includes(to) ?? false;
-	}
-};
-//#endregion
-//#region src/feature/feature-manager.ts
-var FeatureManager = class {
-	configReader;
-	constructor(configReader) {
-		this.configReader = configReader;
-	}
-	isEnabled(flag) {
-		return this.configReader.features[flag];
-	}
-	getManifest() {
-		return { ...this.configReader.features };
-	}
-};
-//#endregion
-//#region src/events/system-event-bus.ts
-var EventRingBuffer = class {
-	capacity;
-	buffer;
-	head = 0;
-	count = 0;
-	constructor(capacity) {
-		this.capacity = capacity;
-		this.buffer = Array.from({ length: capacity });
-	}
-	push(event) {
-		this.buffer[this.head] = event;
-		this.head = (this.head + 1) % this.capacity;
-		if (this.count < this.capacity) this.count++;
-	}
-	getAll() {
-		const result = [];
-		for (let i = 0; i < this.count; i++) {
-			const index = (this.head - 1 - i + this.capacity) % this.capacity;
-			result.push(this.buffer[index]);
-		}
-		return result;
-	}
-	query(filter, limit) {
-		let result = [...this.getAll()];
-		if (filter) result = result.filter((event) => matchesFilter(event, filter));
-		if (limit !== void 0 && limit > 0) return result.slice(0, limit);
-		return result;
-	}
-};
-function matchesCategory(eventCategory, filterCategory) {
-	if (filterCategory.endsWith(".*")) {
-		const prefix = filterCategory.slice(0, -2);
-		return eventCategory.startsWith(prefix + ".") || eventCategory === prefix;
-	}
-	return eventCategory === filterCategory;
-}
-function matchesFilter(event, filter) {
-	if (filter.category) {
-		const raw = filter.category;
-		if (!(Array.isArray(raw) ? raw.map(String) : [String(raw)]).some((cat) => matchesCategory(event.category, cat))) return false;
-	}
-	if (filter.source) {
-		if (event.source.type !== filter.source.type || event.source.id !== filter.source.id) return false;
-	}
-	if (filter.agentId) {
-		const eventNodeId = event.source.nodeId;
-		if (!eventNodeId || !eventNodeId.startsWith(filter.agentId)) return false;
-	}
-	if (filter.addonId) {
-		if ((event.source.addonId ?? (event.source.type === "addon" ? String(event.source.id) : void 0)) !== filter.addonId) return false;
+		"starting",
+		"stopped",
+		"disabled"
+	],
+	disabled: ["stopped"]
+};
+var LifecycleStateMachine = class {
+	elementId;
+	elementType;
+	eventBus;
+	logger;
+	_state = "stopped";
+	_error;
+	_startedAt;
+	_stoppedAt;
+	_restartCount = 0;
+	_hasStartedOnce = false;
+	constructor(elementId, elementType, eventBus, logger) {
+		this.elementId = elementId;
+		this.elementType = elementType;
+		this.eventBus = eventBus;
+		this.logger = logger;
 	}
-	if (filter.deviceId !== void 0) {
-		if ((event.source.deviceId ?? (event.source.type === "device" ? Number(event.source.id) : void 0)) !== filter.deviceId) return false;
+	get state() {
+		return this._state;
 	}
-	if (filter.since && event.timestamp < filter.since) return false;
-	return true;
-}
-var SystemEventBus = class {
-	ringBuffer;
-	subscribers = [];
-	constructor(bufferSize = 1e4) {
-		this.ringBuffer = new EventRingBuffer(bufferSize);
+	getStatus() {
+		return {
+			state: this._state,
+			error: this._error,
+			startedAt: this._startedAt,
+			stoppedAt: this._stoppedAt,
+			restartCount: this._restartCount,
+			uptime: this._state === "running" && this._startedAt ? Date.now() - this._startedAt : 0
+		};
 	}
-	emit(event) {
-		this.ringBuffer.push(event);
-		for (const subscriber of this.subscribers) if (matchesFilter(event, subscriber.filter)) queueMicrotask(() => {
-			try {
-				subscriber.callback(event);
-			} catch (err) {
-				console.error(`[EventBus] Subscriber error for ${event.category}:`, err);
+	transition(to, error) {
+		const from = this._state;
+		if (!this.isValidTransition(from, to)) {
+			this.logger.warn("Invalid state transition", { meta: {
+				from,
+				to
+			} });
+			return false;
+		}
+		this._state = to;
+		this._error = error;
+		if (to === "running") {
+			if (this._hasStartedOnce) this._restartCount++;
+			this._hasStartedOnce = true;
+			this._startedAt = Date.now();
+			this._stoppedAt = void 0;
+		}
+		if (to === "stopped" || to === "error" || to === "disabled") this._stoppedAt = Date.now();
+		this.logger.info("State transition", { meta: {
+			from,
+			to,
+			error
+		} });
+		this.eventBus.emit({
+			id: (0, node_crypto.randomUUID)(),
+			timestamp: /* @__PURE__ */ new Date(),
+			source: {
+				type: this.elementType,
+				id: this.elementId
+			},
+			category: `${this.elementType}.state.${to}`,
+			data: {
+				from,
+				to,
+				error,
+				elementId: this.elementId
 			}
 		});
+		return true;
 	}
-	/**
-	* Subscribe to events matching a filter.
-	* When called with a typed category filter, the handler receives typed event data.
-	*/
-	subscribe(filter, handler) {
-		const subscriber = {
-			filter,
-			callback: handler
-		};
-		this.subscribers.push(subscriber);
-		return () => {
-			const index = this.subscribers.indexOf(subscriber);
-			if (index !== -1) this.subscribers.splice(index, 1);
-		};
+	incrementRestartCount() {
+		this._restartCount++;
 	}
-	getRecent(filter, limit) {
-		return this.ringBuffer.query(filter, limit);
+	isValidTransition(from, to) {
+		return VALID_TRANSITIONS[from]?.includes(to) ?? false;
 	}
 };
 //#endregion
@@ -1475,92 +1224,601 @@ var LogManager = class {
 			} catch {}
 		});
 	}
-	enrichDeviceName(entry) {
-		if (!this.deviceNameLookup) return entry;
-		const tags = entry.tags;
-		if (!tags) return entry;
-		const deviceId = tags.deviceId;
-		if (typeof deviceId !== "number" || !Number.isFinite(deviceId)) return entry;
-		if (typeof tags.deviceName === "string") return entry;
-		const name = this.deviceNameLookup(deviceId);
-		if (!name) return entry;
+	enrichDeviceName(entry) {
+		if (!this.deviceNameLookup) return entry;
+		const tags = entry.tags;
+		if (!tags) return entry;
+		const deviceId = tags.deviceId;
+		if (typeof deviceId !== "number" || !Number.isFinite(deviceId)) return entry;
+		if (typeof tags.deviceName === "string") return entry;
+		const name = this.deviceNameLookup(deviceId);
+		if (!name) return entry;
+		return {
+			...entry,
+			tags: {
+				...tags,
+				deviceName: name
+			}
+		};
+	}
+	/** Subscribe to live logs matching a filter. Returns an unsubscribe function. */
+	subscribe(filter, callback) {
+		const id = Math.random().toString(36).slice(2);
+		this.subscribers.set(id, {
+			filter,
+			callback
+		});
+		return () => {
+			this.subscribers.delete(id);
+		};
+	}
+	matchesFilter(entry, filter) {
+		if (filter.level) {
+			const levels = [
+				"debug",
+				"info",
+				"warn",
+				"error"
+			];
+			const minIdx = levels.indexOf(filter.level);
+			if (levels.indexOf(entry.level) < minIdx) return false;
+		}
+		if (filter.tags) {
+			if (!matchesLogTags(entry.tags, filter.tags)) return false;
+		}
+		return true;
+	}
+	/**
+	* Register a log destination.
+	*
+	* @param opts.replay  If true (default), replay every entry currently in
+	*                     the ring buffer to the new destination before live
+	*                     traffic starts. Lets a destination added mid-boot
+	*                     still receive boot-time log entries.
+	*/
+	/** Apply new in-memory buffer limits at runtime (see PartitionedLogBuffer). */
+	reconfigureBuffer(options) {
+		this.ringBuffer.reconfigure(options);
+	}
+	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
+	setDestinationEnabledCheck(check) {
+		this.isDestinationEnabled = check ?? void 0;
+	}
+	addDestination(dest, opts = {}) {
+		const replay = opts.replay ?? true;
+		this.destinations.push(opts.addonId === void 0 ? { dest } : {
+			dest,
+			addonId: opts.addonId
+		});
+		if (replay) for (const entry of this.ringBuffer.query({})) try {
+			dest.write(entry);
+		} catch {}
+	}
+	removeDestination(dest) {
+		const index = this.destinations.findIndex((d) => d.dest === dest);
+		if (index !== -1) this.destinations.splice(index, 1);
+	}
+	query(filter) {
+		return this.ringBuffer.query(filter);
+	}
+	/**
+	* Drop ring-buffer entries matching `filter`. Returns the count
+	* removed. Backs the UI's "Clear logs" admin action so an operator
+	* can wipe the historical window for a scope (per-device, per-addon,
+	* agent-level) without restarting the server. External destinations
+	* (file, forwarder) are NOT touched — only the in-memory ring.
+	*/
+	clear(filter = {}) {
+		return this.ringBuffer.clear(filter);
+	}
+};
+//#endregion
+//#region src/network/network-quality.ts
+var NetworkQualityTracker = class NetworkQualityTracker {
+	devices = /* @__PURE__ */ new Map();
+	static MAX_SAMPLES = 30;
+	reportStreamStats(deviceId, streamId, bitrateKbps, packetLoss) {
+		const device = this.getOrCreateDevice(deviceId);
+		let stream = device.streams.get(streamId);
+		if (!stream) {
+			stream = {
+				nominalBitrateKbps: bitrateKbps,
+				samples: [],
+				peakBitrateKbps: 0,
+				packetLossSamples: [],
+				lastUpdated: 0
+			};
+			device.streams.set(streamId, stream);
+		}
+		stream.samples.push(bitrateKbps);
+		if (stream.samples.length > NetworkQualityTracker.MAX_SAMPLES) stream.samples.shift();
+		stream.peakBitrateKbps = Math.max(stream.peakBitrateKbps, bitrateKbps);
+		if (packetLoss !== void 0) {
+			stream.packetLossSamples.push(packetLoss);
+			if (stream.packetLossSamples.length > NetworkQualityTracker.MAX_SAMPLES) stream.packetLossSamples.shift();
+		}
+		stream.lastUpdated = Date.now();
+	}
+	reportClientStats(deviceId, stats) {
+		const device = this.getOrCreateDevice(deviceId);
+		device.client = {
+			...stats,
+			lastUpdated: Date.now()
+		};
+	}
+	getDeviceStats(deviceId) {
+		const device = this.devices.get(deviceId);
+		if (!device) return null;
+		const streams = {};
+		for (const [streamId, s] of device.streams) {
+			const avg = (arr) => arr.length === 0 ? 0 : arr.reduce((a, b) => a + b, 0) / arr.length;
+			streams[streamId] = {
+				nominalBitrateKbps: s.nominalBitrateKbps,
+				observedBitrateKbps: Math.round(avg(s.samples)),
+				peakBitrateKbps: s.peakBitrateKbps,
+				packetLossPercent: Math.round(avg(s.packetLossSamples) * 10) / 10,
+				lastUpdated: s.lastUpdated
+			};
+		}
+		return {
+			deviceId,
+			streams,
+			client: device.client ?? void 0
+		};
+	}
+	getAllStats() {
+		const results = [];
+		for (const deviceId of this.devices.keys()) {
+			const stats = this.getDeviceStats(deviceId);
+			if (stats) results.push(stats);
+		}
+		return results;
+	}
+	getOrCreateDevice(deviceId) {
+		let device = this.devices.get(deviceId);
+		if (!device) {
+			device = {
+				streams: /* @__PURE__ */ new Map(),
+				client: null
+			};
+			this.devices.set(deviceId, device);
+		}
+		return device;
+	}
+};
+//#endregion
+//#region src/notification/notification-service.ts
+/**
+* Central notification service that routes canonical notifications to
+* configured `(addonId, targetId)` targets. Framework-agnostic —
+* dependencies injected via constructor.
+*
+* Providers are resolved from the ICapabilityRegistry by `addonId` on each
+* call (proxy pattern). Falls back to a local map when no registry is
+* provided (tests / backward compat).
+*/
+var NotificationService = class {
+	logger;
+	localProviders = /* @__PURE__ */ new Map();
+	routing = /* @__PURE__ */ new Map();
+	rateLimits = /* @__PURE__ */ new Map();
+	lastSent = /* @__PURE__ */ new Map();
+	registry = null;
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/** Set the registry for live provider lookup. Called once during boot. */
+	setRegistry(registry) {
+		this.registry = registry;
+	}
+	/** Resolve the collection provider for an addon — registry first, then local map. */
+	resolveProvider(addonId) {
+		if (this.registry) return this.registry.getProviderByAddon("notification-output", addonId) ?? void 0;
+		return this.localProviders.get(addonId);
+	}
+	/** Register a provider in the local fallback map (used when no registry is set). */
+	registerLocalProvider(addonId, provider) {
+		this.localProviders.set(addonId, provider);
+		this.logger.info("Notification provider added", { meta: { addonId } });
+	}
+	/** Remove a provider from the local fallback map. */
+	unregisterLocalProvider(addonId) {
+		this.localProviders.delete(addonId);
+		this.logger.info("Notification provider removed", { meta: { addonId } });
+	}
+	/** Route a category to a set of `(addonId, targetId)` targets. */
+	setRouting(category, targets) {
+		this.routing.set(category, [...targets]);
+	}
+	setRateLimit(category, minIntervalMs) {
+		this.rateLimits.set(category, minIntervalMs);
+	}
+	async notify(notification) {
+		const { category, deviceId } = notification;
+		const rateLimitKey = deviceId ? `${category}:${deviceId}` : category;
+		const minInterval = this.rateLimits.get(category) ?? 0;
+		if (minInterval > 0) {
+			const last = this.lastSent.get(rateLimitKey) ?? 0;
+			if (notification.timestamp - last < minInterval) {
+				this.logger.debug("Rate limited", { meta: { rateLimitKey } });
+				return;
+			}
+		}
+		const targets = this.routing.get(category) ?? this.routing.get("*") ?? [];
+		if (targets.length === 0) {
+			this.logger.debug("No routing configured for category", { meta: { category } });
+			return;
+		}
+		this.lastSent.set(rateLimitKey, notification.timestamp);
+		const { category: _category, timestamp: _timestamp, ...canonical } = notification;
+		await Promise.allSettled(targets.map(async (ref) => {
+			const provider = this.resolveProvider(ref.addonId);
+			if (!provider) {
+				this.logger.debug("No provider for target", { meta: { addonId: ref.addonId } });
+				return;
+			}
+			try {
+				await provider.send({
+					targetId: ref.targetId,
+					notification: canonical
+				});
+			} catch (err) {
+				this.logger.error("Notification target failed", { meta: {
+					addonId: ref.addonId,
+					targetId: ref.targetId,
+					error: require_dist.errMsg(err)
+				} });
+			}
+		}));
+	}
+	getRouting() {
+		return this.routing;
+	}
+};
+//#endregion
+//#region src/notification/toast-service.ts
+/**
+* Service for broadcasting toast notifications to connected UI clients.
+* Framework-agnostic — integrates with tRPC subscriptions via subscribe().
+*/
+var ToastService = class {
+	listeners = /* @__PURE__ */ new Map();
+	/**
+	* Subscribe to toast events for a specific user.
+	* Returns an unsubscribe function.
+	*/
+	subscribe(connectionId, userId, callback) {
+		this.listeners.set(connectionId, {
+			userId,
+			callback
+		});
+		return () => {
+			this.listeners.delete(connectionId);
+		};
+	}
+	/**
+	* Broadcast a toast to all connected clients.
+	*/
+	broadcast(toast) {
+		for (const entry of this.listeners.values()) entry.callback(toast);
+	}
+	/**
+	* Send a toast to a specific user's connections only.
+	*/
+	sendToUser(userId, toast) {
+		for (const entry of this.listeners.values()) if (entry.userId === userId) entry.callback(toast);
+	}
+};
+//#endregion
+//#region src/pipeline/engine-manager-resolver.ts
+/**
+* Adapter that wraps an IEngineManager + addonConfigs as an IAddonResolver.
+*
+* Used for backwards compatibility — the in-process AddonEngineManager
+* still uses the old getOrCreateEngine(addonId, globalConfig, override) API.
+* This adapter bridges it to the new resolve(addonId, config) interface.
+*/
+var EngineManagerResolver = class {
+	engineManager;
+	addonConfigs;
+	constructor(engineManager, addonConfigs) {
+		this.engineManager = engineManager;
+		this.addonConfigs = addonConfigs;
+	}
+	async resolve(addonId, config) {
+		const globalConfig = this.addonConfigs.get(addonId) ?? {};
+		const engine = await this.engineManager.getOrCreateEngine(addonId, globalConfig, config);
+		return { process: async (input) => {
+			return engine.process(input);
+		} };
+	}
+	async shutdownAll() {
+		await this.engineManager.shutdownAll();
+	}
+};
+//#endregion
+//#region src/pipeline/pipeline-runner.ts
+var PipelineRunner = class {
+	addonResolver;
+	constructor(addonResolver) {
+		this.addonResolver = addonResolver;
+	}
+	async run(frame, config) {
+		const startTime = performance.now();
+		const results = [];
+		const timings = {};
+		for (const rootNode of config.video) await this.executeNode(rootNode, frame, null, results, timings);
+		if (config.audio) await this.executeNode(config.audio, frame, null, results, timings);
+		return {
+			results,
+			totalMs: performance.now() - startTime,
+			timings,
+			frameTimestamp: frame.timestamp
+		};
+	}
+	async executeNode(node, frame, parentDetection, results, timings) {
+		const resultId = (0, node_crypto.randomUUID)();
+		const stepStart = performance.now();
+		try {
+			const effectiveConfig = { ...node.configOverride };
+			const caller = await this.addonResolver.resolve(node.addon, effectiveConfig);
+			let output;
+			if (parentDetection) {
+				const cropInput = {
+					frame,
+					roi: parentDetection.det.bbox,
+					parentDetection: parentDetection.det
+				};
+				output = await caller.process(cropInput);
+			} else output = await caller.process(frame);
+			const stepMs = performance.now() - stepStart;
+			const slot = "detections" in output ? "detector" : "crops" in output ? "cropper" : "classifier";
+			const stepResult = {
+				addon: node.addon,
+				slot,
+				output,
+				parentResultId: parentDetection?.resultId,
+				resultId,
+				inferenceMs: output.inferenceMs,
+				preprocessMs: 0,
+				totalMs: stepMs
+			};
+			results.push(stepResult);
+			timings[node.step] = stepMs;
+			if (node.children?.length) {
+				const detections = "detections" in output ? output.detections : "crops" in output ? output.crops : [];
+				await this.executeChildren(node.children, frame, detections, resultId, results, timings);
+			}
+		} catch (error) {
+			const stepMs = performance.now() - stepStart;
+			const message = require_dist.errMsg(error);
+			results.push({
+				addon: node.addon,
+				slot: "detector",
+				output: {
+					detections: [],
+					inferenceMs: 0,
+					modelId: ""
+				},
+				parentResultId: parentDetection?.resultId,
+				resultId,
+				inferenceMs: 0,
+				preprocessMs: 0,
+				totalMs: stepMs,
+				error: {
+					code: "ADDON_ERROR",
+					message,
+					childrenSkipped: true
+				}
+			});
+		}
+	}
+	async executeChildren(children, frame, parentDetections, parentResultId, results, timings) {
+		const promises = [];
+		for (const detection of parentDetections) {
+			if (detection.bbox.w < 1 || detection.bbox.h < 1) continue;
+			for (const child of children) promises.push(this.executeNode(child, frame, {
+				det: detection,
+				resultId: parentResultId
+			}, results, timings));
+		}
+		await Promise.allSettled(promises);
+	}
+};
+//#endregion
+//#region src/pipeline/pipeline-validator.ts
+var PipelineValidator = class {
+	stepExists;
+	constructor(stepExists) {
+		this.stepExists = stepExists;
+	}
+	validate(config) {
+		const errors = [];
+		const warnings = [];
+		for (const node of config.video) this.validateNode(node, errors, warnings);
+		if (config.audio) this.validateNode(config.audio, errors, warnings);
 		return {
-			...entry,
-			tags: {
-				...tags,
-				deviceName: name
-			}
-		};
-	}
-	/** Subscribe to live logs matching a filter. Returns an unsubscribe function. */
-	subscribe(filter, callback) {
-		const id = Math.random().toString(36).slice(2);
-		this.subscribers.set(id, {
-			filter,
-			callback
-		});
-		return () => {
-			this.subscribers.delete(id);
+			valid: errors.length === 0,
+			errors,
+			warnings
 		};
 	}
-	matchesFilter(entry, filter) {
-		if (filter.level) {
-			const levels = [
-				"debug",
-				"info",
-				"warn",
-				"error"
-			];
-			const minIdx = levels.indexOf(filter.level);
-			if (levels.indexOf(entry.level) < minIdx) return false;
+	validateNode(node, errors, warnings) {
+		if (!this.stepExists(node.addon)) {
+			errors.push({
+				step: node.step,
+				addon: node.addon,
+				message: `Step "${node.addon}" has no provider — the addon that provided it may have been removed`,
+				severity: "error"
+			});
+			return;
 		}
-		if (filter.tags) {
-			if (!matchesLogTags(entry.tags, filter.tags)) return false;
+		if (node.children) for (const child of node.children) this.validateNode(child, errors, warnings);
+	}
+};
+//#endregion
+//#region src/python/python-env-manager.ts
+var execFileAsync$4 = (0, node_util.promisify)(node_child_process.execFile);
+var PythonEnvManager = class {
+	venvPath;
+	cachedProbe = null;
+	constructor(dataDir) {
+		this.venvPath = node_path.join(dataDir, ".venv");
+	}
+	async probe() {
+		if (this.cachedProbe) return this.cachedProbe;
+		for (const cmd of ["python3", "python"]) try {
+			const { stdout } = await execFileAsync$4(cmd, ["--version"]);
+			const version = stdout.trim().replace("Python ", "");
+			const major = parseInt(version.split(".")[0] ?? "0", 10);
+			const minor = parseInt(version.split(".")[1] ?? "0", 10);
+			if (major < 3 || major === 3 && minor < 10) continue;
+			const { stdout: pathOut } = await execFileAsync$4(cmd, ["-c", "import sys; print(sys.executable)"]);
+			this.cachedProbe = {
+				available: true,
+				version,
+				path: pathOut.trim()
+			};
+			return this.cachedProbe;
+		} catch {
+			continue;
 		}
-		return true;
+		this.cachedProbe = { available: false };
+		return this.cachedProbe;
 	}
-	/**
-	* Register a log destination.
-	*
-	* @param opts.replay  If true (default), replay every entry currently in
-	*                     the ring buffer to the new destination before live
-	*                     traffic starts. Lets a destination added mid-boot
-	*                     still receive boot-time log entries.
-	*/
-	/** Apply new in-memory buffer limits at runtime (see PartitionedLogBuffer). */
-	reconfigureBuffer(options) {
-		this.ringBuffer.reconfigure(options);
+	async ensure(options) {
+		const probe = await this.probe();
+		if (!probe.available || !probe.path) throw new Error("Python 3.10+ is required but not found on this system");
+		if (!node_fs.existsSync(node_path.join(this.venvPath, "bin", "python"))) await execFileAsync$4(probe.path, [
+			"-m",
+			"venv",
+			this.venvPath
+		]);
+		const venvPython = node_path.join(this.venvPath, "bin", "python");
+		if (options.packages.length > 0) await execFileAsync$4(venvPython, [
+			"-m",
+			"pip",
+			"install",
+			"-q",
+			...options.packages
+		]);
+		return {
+			pythonPath: venvPython,
+			venvPath: this.venvPath,
+			spawn: (script, args) => {
+				return (0, node_child_process.spawn)(venvPython, [script, ...args]);
+			}
+		};
 	}
-	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
-	setDestinationEnabledCheck(check) {
-		this.isDestinationEnabled = check ?? void 0;
+	spawn(script, args) {
+		const venvPython = node_path.join(this.venvPath, "bin", "python");
+		if (!node_fs.existsSync(venvPython)) throw new Error("Python venv not initialized. Call ensure() first.");
+		return (0, node_child_process.spawn)(venvPython, [script, ...args]);
 	}
-	addDestination(dest, opts = {}) {
-		const replay = opts.replay ?? true;
-		this.destinations.push(opts.addonId === void 0 ? { dest } : {
-			dest,
-			addonId: opts.addonId
-		});
-		if (replay) for (const entry of this.ringBuffer.query({})) try {
-			dest.write(entry);
-		} catch {}
+};
+//#endregion
+//#region src/repl/repl-engine.ts
+var EXECUTION_TIMEOUT_MS = 5e3;
+var COMPLETION_TIMEOUT_MS = 1e3;
+var ReplEngine = class {
+	contextProvider;
+	constructor(contextProvider) {
+		this.contextProvider = contextProvider;
 	}
-	removeDestination(dest) {
-		const index = this.destinations.findIndex((d) => d.dest === dest);
-		if (index !== -1) this.destinations.splice(index, 1);
+	async execute(code, context) {
+		const start = Date.now();
+		const sandbox = await this.buildSandbox(context);
+		try {
+			const vmContext = node_vm.createContext(sandbox);
+			let result = new node_vm.Script(code).runInContext(vmContext, { timeout: EXECUTION_TIMEOUT_MS });
+			if (result && typeof result === "object" && "then" in result && typeof result.then === "function") result = await Promise.race([result, new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("Async timeout (5s)")), EXECUTION_TIMEOUT_MS))]);
+			const duration = Date.now() - start;
+			if (result === void 0) return {
+				output: "undefined",
+				type: "void",
+				duration
+			};
+			return {
+				output: node_util.inspect(result, {
+					depth: 4,
+					colors: false,
+					maxArrayLength: 50,
+					maxStringLength: 1e3
+				}),
+				type: "value",
+				duration
+			};
+		} catch (err) {
+			return {
+				output: err instanceof Error ? err.message : typeof err === "object" && err !== null && "message" in err ? String(err.message) : String(err),
+				type: "error",
+				duration: Date.now() - start
+			};
+		}
 	}
-	query(filter) {
-		return this.ringBuffer.query(filter);
+	async getCompletions(partial, context) {
+		const sandbox = await this.buildSandbox(context);
+		const keys = Object.keys(sandbox);
+		if (!partial) return keys;
+		const lastDot = partial.lastIndexOf(".");
+		if (lastDot === -1) return keys.filter((k) => k.startsWith(partial));
+		const objPath = partial.substring(0, lastDot);
+		const propPrefix = partial.substring(lastDot + 1);
+		try {
+			const vmContext = node_vm.createContext(sandbox);
+			const obj = node_vm.runInContext(objPath, vmContext, { timeout: COMPLETION_TIMEOUT_MS });
+			if (obj && typeof obj === "object") {
+				const proto = Object.getPrototypeOf(obj);
+				const objKeys = Object.getOwnPropertyNames(obj).concat(Object.getOwnPropertyNames(proto ?? {})).filter((k) => k.startsWith(propPrefix));
+				return [...new Set(objKeys)].map((k) => `${objPath}.${k}`);
+			}
+		} catch {}
+		return [];
 	}
-	/**
-	* Drop ring-buffer entries matching `filter`. Returns the count
-	* removed. Backs the UI's "Clear logs" admin action so an operator
-	* can wipe the historical window for a scope (per-device, per-addon,
-	* agent-level) without restarting the server. External destinations
-	* (file, forwarder) are NOT touched — only the in-memory ring.
-	*/
-	clear(filter = {}) {
-		return this.ringBuffer.clear(filter);
+	async buildSandbox(context) {
+		const base = {
+			console: {
+				log: (...args) => node_util.inspect(args),
+				warn: (...args) => node_util.inspect(args)
+			},
+			JSON,
+			Math,
+			Date,
+			Array,
+			Object,
+			String,
+			Number,
+			Boolean,
+			Map,
+			Set,
+			Promise,
+			Buffer,
+			setTimeout: void 0,
+			setInterval: void 0,
+			fetch: void 0,
+			require: void 0,
+			process: void 0,
+			...context.variables
+		};
+		switch (context.scope.type) {
+			case "system": return {
+				...base,
+				...await this.contextProvider.getSystemSandbox()
+			};
+			case "device": return {
+				...base,
+				...await this.contextProvider.getDeviceSandbox(context.scope.deviceId)
+			};
+			case "provider": return {
+				...base,
+				...await this.contextProvider.getProviderSandbox(context.scope.providerId)
+			};
+			case "addon": return {
+				...base,
+				...await this.contextProvider.getAddonSandbox(context.scope.addonId)
+			};
+			default: return base;
+		}
 	}
 };
 //#endregion
@@ -1902,216 +2160,6 @@ var StorageManager = class {
 	}
 };
 //#endregion
-//#region src/auth/scope-matcher.ts
-/**
-* True if the scope set grants `access` on device-scoped capabilities.
-* A `category:device` grant covers every device cap (the broad grant).
-* Mirrors the OR-semantics of the existing token scope matcher.
-*/
-function scopesAllowDeviceCap(scopes, access) {
-	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
-}
-//#endregion
-//#region src/notification/notification-service.ts
-/**
-* Central notification service that routes canonical notifications to
-* configured `(addonId, targetId)` targets. Framework-agnostic —
-* dependencies injected via constructor.
-*
-* Providers are resolved from the ICapabilityRegistry by `addonId` on each
-* call (proxy pattern). Falls back to a local map when no registry is
-* provided (tests / backward compat).
-*/
-var NotificationService = class {
-	logger;
-	localProviders = /* @__PURE__ */ new Map();
-	routing = /* @__PURE__ */ new Map();
-	rateLimits = /* @__PURE__ */ new Map();
-	lastSent = /* @__PURE__ */ new Map();
-	registry = null;
-	constructor(logger) {
-		this.logger = logger;
-	}
-	/** Set the registry for live provider lookup. Called once during boot. */
-	setRegistry(registry) {
-		this.registry = registry;
-	}
-	/** Resolve the collection provider for an addon — registry first, then local map. */
-	resolveProvider(addonId) {
-		if (this.registry) return this.registry.getProviderByAddon("notification-output", addonId) ?? void 0;
-		return this.localProviders.get(addonId);
-	}
-	/** Register a provider in the local fallback map (used when no registry is set). */
-	registerLocalProvider(addonId, provider) {
-		this.localProviders.set(addonId, provider);
-		this.logger.info("Notification provider added", { meta: { addonId } });
-	}
-	/** Remove a provider from the local fallback map. */
-	unregisterLocalProvider(addonId) {
-		this.localProviders.delete(addonId);
-		this.logger.info("Notification provider removed", { meta: { addonId } });
-	}
-	/** Route a category to a set of `(addonId, targetId)` targets. */
-	setRouting(category, targets) {
-		this.routing.set(category, [...targets]);
-	}
-	setRateLimit(category, minIntervalMs) {
-		this.rateLimits.set(category, minIntervalMs);
-	}
-	async notify(notification) {
-		const { category, deviceId } = notification;
-		const rateLimitKey = deviceId ? `${category}:${deviceId}` : category;
-		const minInterval = this.rateLimits.get(category) ?? 0;
-		if (minInterval > 0) {
-			const last = this.lastSent.get(rateLimitKey) ?? 0;
-			if (notification.timestamp - last < minInterval) {
-				this.logger.debug("Rate limited", { meta: { rateLimitKey } });
-				return;
-			}
-		}
-		const targets = this.routing.get(category) ?? this.routing.get("*") ?? [];
-		if (targets.length === 0) {
-			this.logger.debug("No routing configured for category", { meta: { category } });
-			return;
-		}
-		this.lastSent.set(rateLimitKey, notification.timestamp);
-		const { category: _category, timestamp: _timestamp, ...canonical } = notification;
-		await Promise.allSettled(targets.map(async (ref) => {
-			const provider = this.resolveProvider(ref.addonId);
-			if (!provider) {
-				this.logger.debug("No provider for target", { meta: { addonId: ref.addonId } });
-				return;
-			}
-			try {
-				await provider.send({
-					targetId: ref.targetId,
-					notification: canonical
-				});
-			} catch (err) {
-				this.logger.error("Notification target failed", { meta: {
-					addonId: ref.addonId,
-					targetId: ref.targetId,
-					error: require_dist.errMsg(err)
-				} });
-			}
-		}));
-	}
-	getRouting() {
-		return this.routing;
-	}
-};
-//#endregion
-//#region src/notification/toast-service.ts
-/**
-* Service for broadcasting toast notifications to connected UI clients.
-* Framework-agnostic — integrates with tRPC subscriptions via subscribe().
-*/
-var ToastService = class {
-	listeners = /* @__PURE__ */ new Map();
-	/**
-	* Subscribe to toast events for a specific user.
-	* Returns an unsubscribe function.
-	*/
-	subscribe(connectionId, userId, callback) {
-		this.listeners.set(connectionId, {
-			userId,
-			callback
-		});
-		return () => {
-			this.listeners.delete(connectionId);
-		};
-	}
-	/**
-	* Broadcast a toast to all connected clients.
-	*/
-	broadcast(toast) {
-		for (const entry of this.listeners.values()) entry.callback(toast);
-	}
-	/**
-	* Send a toast to a specific user's connections only.
-	*/
-	sendToUser(userId, toast) {
-		for (const entry of this.listeners.values()) if (entry.userId === userId) entry.callback(toast);
-	}
-};
-//#endregion
-//#region src/addon-routes/addon-route-registry.ts
-/**
-* Registry for dynamic HTTP routes registered by addons.
-* Framework-agnostic — the server HTTP layer queries this registry to dispatch requests.
-*/
-var AddonRouteRegistry = class {
-	routes = /* @__PURE__ */ new Map();
-	/**
-	* Register all routes from an addon's route provider.
-	*/
-	registerRoutes(addonId, provider) {
-		const registered = provider.getRoutes().map((route) => {
-			return {
-				addonId,
-				route,
-				fullPath: `/addon/${addonId}${route.path.startsWith("/") ? route.path : `/${route.path}`}`
-			};
-		});
-		this.routes.set(addonId, registered);
-	}
-	/**
-	* Unregister all routes for an addon.
-	*/
-	unregisterRoutes(addonId) {
-		this.routes.delete(addonId);
-	}
-	/**
-	* Match an incoming request method + path to a registered route.
-	* Supports simple path parameters (e.g., /items/:id).
-	*/
-	matchRoute(method, path) {
-		const normalizedMethod = method.toUpperCase();
-		for (const registeredRoutes of this.routes.values()) for (const entry of registeredRoutes) {
-			if (entry.route.method !== normalizedMethod) continue;
-			const params = matchPath(entry.fullPath, path);
-			if (params !== null) return {
-				route: entry.route,
-				addonId: entry.addonId,
-				params
-			};
-		}
-		return null;
-	}
-	/**
-	* List all registered routes across all addons.
-	*/
-	listRoutes() {
-		const result = [];
-		for (const registeredRoutes of this.routes.values()) for (const entry of registeredRoutes) result.push({
-			addonId: entry.addonId,
-			method: entry.route.method,
-			path: entry.fullPath,
-			access: entry.route.access,
-			description: entry.route.description
-		});
-		return result;
-	}
-};
-/**
-* Match a route pattern against an actual path.
-* Supports :param segments (e.g., /addon/:addonId/items/:id).
-* Returns extracted params or null if no match.
-*/
-function matchPath(pattern, path) {
-	const patternParts = pattern.split("/").filter(Boolean);
-	const pathParts = path.split("/").filter(Boolean);
-	if (patternParts.length !== pathParts.length) return null;
-	const params = {};
-	for (let i = 0; i < patternParts.length; i++) {
-		const patternPart = patternParts[i];
-		const pathPart = pathParts[i];
-		if (patternPart.startsWith(":")) params[patternPart.slice(1)] = pathPart;
-		else if (patternPart !== pathPart) return null;
-	}
-	return params;
-}
-//#endregion
 //#region src/tls/cert-manager.ts
 var execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 /**
@@ -2185,54 +2233,6 @@ function loadTlsCert(certPath, keyPath) {
 	};
 }
 //#endregion
-//#region src/addon/addon-api-factory.ts
-/**
-* Wrap a raw tRPC caller (from `createCallerFactory`) in a proxy that
-* exposes each leaf procedure as `{ query, mutate, subscribe }`, matching
-* the shape of `CreateTRPCClient<AppRouter>`.
-*
-* The tricky part: tRPC v11 callers expose nested routers as callable
-* no-op functions (e.g. `caller.greet` is `typeof === 'function'`), so
-* we can't use `typeof` to tell namespace from leaf. Instead, we return
-* a unified proxy that handles BOTH behaviours:
-*
-*   - Accessing `.query` / `.mutate` treats the current node as a leaf
-*     procedure and invokes `caller(input)` when called.
-*   - Accessing `.subscribe` throws (not supported on direct caller).
-*   - Accessing any other property descends into `caller[prop]` and
-*     returns a nested proxy.
-*/
-function wrapCallerAsClient(caller) {
-	return new Proxy(Object.create(null), { get(_target, prop) {
-		if (typeof prop !== "string") return void 0;
-		if (prop === "query" || prop === "mutate") {
-			if (typeof caller !== "function") throw new Error(`Cannot call .${prop}() — this tRPC node is not a procedure`);
-			const fn = caller;
-			return (input) => fn(input);
-		}
-		if (prop === "subscribe") return () => {
-			throw new Error(`subscribe() is not supported on direct caller — use the WSS client for subscriptions`);
-		};
-		const child = caller?.[prop];
-		if (child === void 0 || child === null) return void 0;
-		return wrapCallerAsClient(child);
-	} });
-}
-var AddonApiFactory = class {
-	/**
-	* Create a direct caller -- calls tRPC procedures directly in-process.
-	* Zero network overhead. Used for in-process addons and dev mode.
-	*
-	* Returns `AddonApi` — the same tRPC client surface that broker-routed
-	* callers get. Callers treat it uniformly as `context.api` regardless
-	* of the underlying transport.
-	*/
-	async createDirectCaller(options) {
-		const { initTRPC } = await import("@trpc/server");
-		return wrapCallerAsClient(initTRPC.create().createCallerFactory(options.router)(options.context));
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/integration-registry.ts
 function serializeSetting(value) {
 	if (typeof value === "number") return {
@@ -2807,6 +2807,268 @@ var IntegrationRegistry = class IntegrationRegistry {
 	}
 };
 //#endregion
+//#region src/kernel/deps/ensure-native-prebuilds.ts
+/**
+* `ensureNativePrebuilds` — the post-install native-prebuild ENSURE step the
+* shared `RootUpdateService` runs while staging a `@camstack/server` closure,
+* BEFORE its `findMissingNativePrebuilds` validator (in `@camstack/node-root`)
+* decides whether to arm the swap.
+*
+* Why this exists (Mac desktop incident, 2026-07-21): a runtime
+* `applyServerUpdate` on a packaged desktop stages the closure with
+* `npm install @camstack/server@X` under the app's BUNDLED bare Node. The one
+* TRADITIONAL (non-N-API) native, `better-sqlite3`, resolves its `.node` via
+* its `install` script `prebuild-install || node-gyp rebuild`. On a user's Mac
+* with no build toolchain (and where the auto `prebuild-install` does not
+* target the bundled Node's ABI/arch the way the DMG build's EXPLICIT
+* `prebuild-install --runtime node --target <bundled> --arch <arch>` call does)
+* that leaves the module SOURCE-ONLY → the closure has no `better-sqlite3`
+* `.node` → the validator refuses the swap ("staged closure missing native
+* prebuilds: better-sqlite3"). The docker image never hits this: its Node ABI
+* has a published prebuild the auto path fetches cleanly, and it carries a
+* build toolchain fallback.
+*
+* This mirrors the DMG build's explicit re-fetch (`scripts/stage-deps.mjs`)
+* into the runtime staging path: for each traditional native that is present
+* in the closure but missing its compiled `.node`, fetch the prebuild for the
+* RUNNING Node ABI/arch (the same Node that will load the swapped closure).
+*
+* N-API natives (`sharp`, `node-av`) are ABI-stable and ship their binaries as
+* platform SIBLING packages that npm fetches reliably with no compile step, so
+* they are not in scope here — a genuine miss there is a broken install the
+* validator should still reject, not something a prebuild re-fetch can heal.
+*
+* Injected into the update service from the construction site so the zero-dep
+* `@camstack/node-root` layer never depends on npm/@camstack/system, and the
+* fetch is unit-testable with a fake fetcher.
+*/
+var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
+/** Bounded recursive `.node` scan depth inside a module dir. */
+var NATIVE_SCAN_DEPTH = 4;
+/** Timeout for a single `prebuild-install` fetch. */
+var PREBUILD_FETCH_TIMEOUT_MS = 12e4;
+/**
+* Traditional (compile-or-prebuild) natives an installed closure must carry a
+* `.node` for. Only these are ENSURE-able by a prebuild re-fetch; N-API natives
+* are excluded (see file header).
+*/
+var TRADITIONAL_NATIVE_PACKAGES = ["better-sqlite3"];
+/** Bounded recursive scan for ANY `*.node` file under `dir`. */
+function hasDotNode(dir, maxDepth) {
+	let entries;
+	try {
+		entries = node_fs.readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return false;
+	}
+	for (const entry of entries) if (entry.isFile() && entry.name.endsWith(".node")) return true;
+	if (maxDepth <= 0) return false;
+	for (const entry of entries) if (entry.isDirectory() && hasDotNode(node_path.join(dir, entry.name), maxDepth - 1)) return true;
+	return false;
+}
+/** Locate the bundled `prebuild-install` bin.js inside the staged closure. */
+function resolvePrebuildInstallBin(closureDir, moduleDir) {
+	return [node_path.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), node_path.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => node_fs.existsSync(c)) ?? null;
+}
+/**
+* Default fetcher: run the closure's own `prebuild-install` under the CURRENT
+* Node (`process.execPath`) — no reliance on `npx`/`npm` on PATH (a packaged
+* app ships a bare Node). Explicitly targets the running ABI/arch, mirroring
+* `scripts/stage-deps.mjs`.
+*/
+function makeDefaultFetch(closureDir, logger) {
+	return async (moduleDir, target) => {
+		const bin = resolvePrebuildInstallBin(closureDir, moduleDir);
+		if (bin === null) throw new Error(`prebuild-install not found in the staged closure for ${moduleDir}`);
+		logger.info("fetching native prebuild via prebuild-install", { meta: {
+			moduleDir,
+			bin,
+			nodeVersion: target.nodeVersion,
+			arch: target.arch
+		} });
+		await execFileAsync$2(process.execPath, [
+			bin,
+			"--runtime",
+			"node",
+			"--target",
+			target.nodeVersion,
+			"--arch",
+			target.arch
+		], {
+			cwd: moduleDir,
+			timeout: PREBUILD_FETCH_TIMEOUT_MS
+		});
+	};
+}
+/**
+* Ensure every traditional native in `<closureDir>/node_modules` carries its
+* compiled `.node`, fetching the prebuild for the running ABI when missing.
+*
+* A NO-OP when nothing is missing (docker / tests) and when a native package is
+* absent from the closure. Never throws for a single package's fetch failure —
+* it logs and continues so the downstream `findMissingNativePrebuilds`
+* validator makes the final swap/abort decision. Returns the packages whose
+* prebuild was successfully fetched (for logging/tests).
+*/
+async function ensureNativePrebuilds(closureDir, options) {
+	const nm = node_path.join(closureDir, "node_modules");
+	const target = options.target ?? {
+		nodeVersion: process.versions.node,
+		arch: process.arch
+	};
+	const packages = options.packages ?? TRADITIONAL_NATIVE_PACKAGES;
+	const fetchPrebuild = options.fetchPrebuild ?? makeDefaultFetch(closureDir, options.logger);
+	const fetched = [];
+	for (const pkg of packages) {
+		const moduleDir = node_path.join(nm, pkg);
+		if (!node_fs.existsSync(moduleDir)) continue;
+		if (hasDotNode(moduleDir, 4)) continue;
+		options.logger.warn("staged closure native prebuild missing — fetching for running ABI", { meta: {
+			pkg,
+			moduleDir,
+			nodeVersion: target.nodeVersion,
+			arch: target.arch
+		} });
+		try {
+			await fetchPrebuild(moduleDir, target);
+		} catch (err) {
+			options.logger.error("native prebuild fetch failed (validator will decide)", { meta: {
+				pkg,
+				error: (0, _camstack_types_addon.errMsg)(err)
+			} });
+			continue;
+		}
+		if (hasDotNode(moduleDir, 4)) {
+			fetched.push(pkg);
+			options.logger.info("native prebuild fetched", { meta: { pkg } });
+		} else options.logger.error("native prebuild still missing after fetch", { meta: { pkg } });
+	}
+	return fetched;
+}
+//#endregion
+//#region src/kernel/deps/ensure-addon-natives.ts
+/**
+* `ensureAddonNativePrebuilds` — the POST-install native-prebuild ENSURE pass an
+* addon install runs on the INSTALLED addon dir AFTER `npm install`.
+*
+* Why this exists (Mac desktop first-boot FATAL, 2026-07-21): `installCopy`
+* copies `dist/`, plants prebuilt natives from the bundled addon copy
+* (`copyBundledNativeModules`), then `npm install`s the addon's runtime deps.
+* On a TOOLCHAIN-LESS host that `npm install` RE-CREATES the traditional native
+* `better-sqlite3` SOURCE-ONLY — clobbering the good `.node` the pre-install
+* copy just planted — and the runner later dies at addon init with a cryptic
+* "Could not locate the bindings file". The copy-BEFORE-install fix was
+* empirically insufficient: npm's own install in the copied dir replaces the
+* satisfied dep without its binary.
+*
+* This pass runs LAST, so it always sees the final on-disk state npm left, and
+* per referenced traditional native still lacking its compiled `.node`:
+*   1. bundled-copy first — if the bundled addon copy carries the matching
+*      `.node` (same machine → same platform/arch/ABI), re-plant it DIRECTLY.
+*      Cheapest + offline-safe; runs BEFORE any network fetch.
+*   2. fetch fallback — otherwise fetch the prebuild for the running ABI via the
+*      shared `ensureNativePrebuilds` pointed at the addon dir.
+*   3. FAIL LOUD — if the native is STILL source-only after both, log a clear
+*      error naming module + addon and THROW so the install fails at install
+*      time rather than at addon init.
+*
+* N-API natives (`sharp`, `node-av`) ship their binaries as ABI-stable platform
+* SIBLING packages npm fetches without a compile step, so they are excluded from
+* the default set — a miss there is a broken install, not something a prebuild
+* re-fetch heals (same rationale as `ensureNativePrebuilds`).
+*/
+/**
+* Re-plant `<srcModuleDir>` → `<dstModuleDir>` when the source carries a `.node`.
+* Returns whether the destination ends up with a compiled binary.
+*/
+function replantFromBundled(srcModuleDir, dstModuleDir, hasNative) {
+	if (!hasNative(srcModuleDir)) return false;
+	try {
+		node_fs.rmSync(dstModuleDir, {
+			recursive: true,
+			force: true
+		});
+		node_fs.mkdirSync(node_path.dirname(dstModuleDir), { recursive: true });
+		node_fs.cpSync(srcModuleDir, dstModuleDir, {
+			recursive: true,
+			dereference: true
+		});
+	} catch {
+		return false;
+	}
+	return hasNative(dstModuleDir);
+}
+/**
+* Ensure every referenced traditional native in `<addonDir>/node_modules`
+* carries its compiled `.node` after the addon's `npm install`. Bundled-copy
+* first (offline), prebuild-fetch fallback, LOUD throw on a residual miss.
+*
+* SKIPS a native absent from the addon's own `node_modules` (it resolves via a
+* hoisted host copy — not this addon's concern). A NO-OP in docker / dev where
+* npm produced a working `.node` (already-present). Returns the per-native
+* outcomes for logging/tests.
+*
+* @throws if any required native is still source-only after copy + fetch.
+*/
+async function ensureAddonNativePrebuilds(addonDir, options) {
+	const packages = options.packages ?? TRADITIONAL_NATIVE_PACKAGES;
+	const hasNative = options.hasNative ?? ((dir) => hasDotNode(dir, 4));
+	const nm = node_path.join(addonDir, "node_modules");
+	const results = [];
+	const missing = [];
+	for (const pkg of packages) {
+		const moduleDir = node_path.join(nm, pkg);
+		if (!node_fs.existsSync(moduleDir)) continue;
+		if (hasNative(moduleDir)) {
+			results.push({
+				pkg,
+				outcome: "already-present"
+			});
+			continue;
+		}
+		if (options.bundledSourceDir) {
+			const src = node_path.join(options.bundledSourceDir, "node_modules", pkg);
+			if (replantFromBundled(src, moduleDir, hasNative)) {
+				options.logger.info("addon native prebuild re-planted from bundled copy (offline)", { meta: {
+					addon: options.addonName,
+					pkg,
+					src,
+					moduleDir
+				} });
+				results.push({
+					pkg,
+					outcome: "copied"
+				});
+				continue;
+			}
+		}
+		if ((await ensureNativePrebuilds(addonDir, {
+			logger: options.logger,
+			packages: [pkg],
+			...options.target ? { target: options.target } : {},
+			...options.fetchPrebuild ? { fetchPrebuild: options.fetchPrebuild } : {}
+		})).includes(pkg)) {
+			results.push({
+				pkg,
+				outcome: "fetched"
+			});
+			continue;
+		}
+		options.logger.error("addon native prebuild MISSING after ensure — module has no compiled .node", { meta: {
+			addon: options.addonName,
+			pkg,
+			moduleDir
+		} });
+		results.push({
+			pkg,
+			outcome: "missing"
+		});
+		missing.push(pkg);
+	}
+	if (missing.length > 0) throw new Error(`${options.addonName} — required native module(s) missing a compiled .node after install (bundled-copy + prebuild-fetch both failed): ${missing.join(", ")}`);
+	return results;
+}
+//#endregion
 //#region src/kernel/addon-loader.ts
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3168,7 +3430,7 @@ var AddonEngineManager = class {
 };
 //#endregion
 //#region src/kernel/fs-utils.ts
-var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
+var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
 /**
 * Ensure a directory exists (recursive).
 * Single source of truth — replaces scattered mkdirSync calls.
@@ -3357,7 +3619,7 @@ function ensureLibraryBuilt(packageName, packagesDir) {
 async function installPackageFromNpm(packageName, targetDir) {
 	const tmpDir = await node_fs.promises.mkdtemp(node_path.join(node_os.tmpdir(), "camstack-install-"));
 	try {
-		const { stdout } = await execFileAsync$2("npm", [
+		const { stdout } = await execFileAsync$1("npm", [
 			"pack",
 			packageName,
 			"--pack-destination",
@@ -3371,7 +3633,7 @@ async function installPackageFromNpm(packageName, targetDir) {
 		const tgzPath = node_path.join(tmpDir, tgzFilename);
 		const extractDir = node_path.join(tmpDir, "extracted");
 		ensureDir(extractDir);
-		await execFileAsync$2("tar", [
+		await execFileAsync$1("tar", [
 			"-xzf",
 			tgzPath,
 			"-C",
@@ -3675,268 +3937,6 @@ var AddonManifest = class {
 	}
 };
 //#endregion
-//#region src/kernel/deps/ensure-native-prebuilds.ts
-/**
-* `ensureNativePrebuilds` — the post-install native-prebuild ENSURE step the
-* shared `RootUpdateService` runs while staging a `@camstack/server` closure,
-* BEFORE its `findMissingNativePrebuilds` validator (in `@camstack/node-root`)
-* decides whether to arm the swap.
-*
-* Why this exists (Mac desktop incident, 2026-07-21): a runtime
-* `applyServerUpdate` on a packaged desktop stages the closure with
-* `npm install @camstack/server@X` under the app's BUNDLED bare Node. The one
-* TRADITIONAL (non-N-API) native, `better-sqlite3`, resolves its `.node` via
-* its `install` script `prebuild-install || node-gyp rebuild`. On a user's Mac
-* with no build toolchain (and where the auto `prebuild-install` does not
-* target the bundled Node's ABI/arch the way the DMG build's EXPLICIT
-* `prebuild-install --runtime node --target <bundled> --arch <arch>` call does)
-* that leaves the module SOURCE-ONLY → the closure has no `better-sqlite3`
-* `.node` → the validator refuses the swap ("staged closure missing native
-* prebuilds: better-sqlite3"). The docker image never hits this: its Node ABI
-* has a published prebuild the auto path fetches cleanly, and it carries a
-* build toolchain fallback.
-*
-* This mirrors the DMG build's explicit re-fetch (`scripts/stage-deps.mjs`)
-* into the runtime staging path: for each traditional native that is present
-* in the closure but missing its compiled `.node`, fetch the prebuild for the
-* RUNNING Node ABI/arch (the same Node that will load the swapped closure).
-*
-* N-API natives (`sharp`, `node-av`) are ABI-stable and ship their binaries as
-* platform SIBLING packages that npm fetches reliably with no compile step, so
-* they are not in scope here — a genuine miss there is a broken install the
-* validator should still reject, not something a prebuild re-fetch can heal.
-*
-* Injected into the update service from the construction site so the zero-dep
-* `@camstack/node-root` layer never depends on npm/@camstack/system, and the
-* fetch is unit-testable with a fake fetcher.
-*/
-var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
-/** Bounded recursive `.node` scan depth inside a module dir. */
-var NATIVE_SCAN_DEPTH = 4;
-/** Timeout for a single `prebuild-install` fetch. */
-var PREBUILD_FETCH_TIMEOUT_MS = 12e4;
-/**
-* Traditional (compile-or-prebuild) natives an installed closure must carry a
-* `.node` for. Only these are ENSURE-able by a prebuild re-fetch; N-API natives
-* are excluded (see file header).
-*/
-var TRADITIONAL_NATIVE_PACKAGES = ["better-sqlite3"];
-/** Bounded recursive scan for ANY `*.node` file under `dir`. */
-function hasDotNode(dir, maxDepth) {
-	let entries;
-	try {
-		entries = node_fs.readdirSync(dir, { withFileTypes: true });
-	} catch {
-		return false;
-	}
-	for (const entry of entries) if (entry.isFile() && entry.name.endsWith(".node")) return true;
-	if (maxDepth <= 0) return false;
-	for (const entry of entries) if (entry.isDirectory() && hasDotNode(node_path.join(dir, entry.name), maxDepth - 1)) return true;
-	return false;
-}
-/** Locate the bundled `prebuild-install` bin.js inside the staged closure. */
-function resolvePrebuildInstallBin(closureDir, moduleDir) {
-	return [node_path.join(moduleDir, "node_modules", "prebuild-install", "bin.js"), node_path.join(closureDir, "node_modules", "prebuild-install", "bin.js")].find((c) => node_fs.existsSync(c)) ?? null;
-}
-/**
-* Default fetcher: run the closure's own `prebuild-install` under the CURRENT
-* Node (`process.execPath`) — no reliance on `npx`/`npm` on PATH (a packaged
-* app ships a bare Node). Explicitly targets the running ABI/arch, mirroring
-* `scripts/stage-deps.mjs`.
-*/
-function makeDefaultFetch(closureDir, logger) {
-	return async (moduleDir, target) => {
-		const bin = resolvePrebuildInstallBin(closureDir, moduleDir);
-		if (bin === null) throw new Error(`prebuild-install not found in the staged closure for ${moduleDir}`);
-		logger.info("fetching native prebuild via prebuild-install", { meta: {
-			moduleDir,
-			bin,
-			nodeVersion: target.nodeVersion,
-			arch: target.arch
-		} });
-		await execFileAsync$1(process.execPath, [
-			bin,
-			"--runtime",
-			"node",
-			"--target",
-			target.nodeVersion,
-			"--arch",
-			target.arch
-		], {
-			cwd: moduleDir,
-			timeout: PREBUILD_FETCH_TIMEOUT_MS
-		});
-	};
-}
-/**
-* Ensure every traditional native in `<closureDir>/node_modules` carries its
-* compiled `.node`, fetching the prebuild for the running ABI when missing.
-*
-* A NO-OP when nothing is missing (docker / tests) and when a native package is
-* absent from the closure. Never throws for a single package's fetch failure —
-* it logs and continues so the downstream `findMissingNativePrebuilds`
-* validator makes the final swap/abort decision. Returns the packages whose
-* prebuild was successfully fetched (for logging/tests).
-*/
-async function ensureNativePrebuilds(closureDir, options) {
-	const nm = node_path.join(closureDir, "node_modules");
-	const target = options.target ?? {
-		nodeVersion: process.versions.node,
-		arch: process.arch
-	};
-	const packages = options.packages ?? TRADITIONAL_NATIVE_PACKAGES;
-	const fetchPrebuild = options.fetchPrebuild ?? makeDefaultFetch(closureDir, options.logger);
-	const fetched = [];
-	for (const pkg of packages) {
-		const moduleDir = node_path.join(nm, pkg);
-		if (!node_fs.existsSync(moduleDir)) continue;
-		if (hasDotNode(moduleDir, 4)) continue;
-		options.logger.warn("staged closure native prebuild missing — fetching for running ABI", { meta: {
-			pkg,
-			moduleDir,
-			nodeVersion: target.nodeVersion,
-			arch: target.arch
-		} });
-		try {
-			await fetchPrebuild(moduleDir, target);
-		} catch (err) {
-			options.logger.error("native prebuild fetch failed (validator will decide)", { meta: {
-				pkg,
-				error: (0, _camstack_types_addon.errMsg)(err)
-			} });
-			continue;
-		}
-		if (hasDotNode(moduleDir, 4)) {
-			fetched.push(pkg);
-			options.logger.info("native prebuild fetched", { meta: { pkg } });
-		} else options.logger.error("native prebuild still missing after fetch", { meta: { pkg } });
-	}
-	return fetched;
-}
-//#endregion
-//#region src/kernel/deps/ensure-addon-natives.ts
-/**
-* `ensureAddonNativePrebuilds` — the POST-install native-prebuild ENSURE pass an
-* addon install runs on the INSTALLED addon dir AFTER `npm install`.
-*
-* Why this exists (Mac desktop first-boot FATAL, 2026-07-21): `installCopy`
-* copies `dist/`, plants prebuilt natives from the bundled addon copy
-* (`copyBundledNativeModules`), then `npm install`s the addon's runtime deps.
-* On a TOOLCHAIN-LESS host that `npm install` RE-CREATES the traditional native
-* `better-sqlite3` SOURCE-ONLY — clobbering the good `.node` the pre-install
-* copy just planted — and the runner later dies at addon init with a cryptic
-* "Could not locate the bindings file". The copy-BEFORE-install fix was
-* empirically insufficient: npm's own install in the copied dir replaces the
-* satisfied dep without its binary.
-*
-* This pass runs LAST, so it always sees the final on-disk state npm left, and
-* per referenced traditional native still lacking its compiled `.node`:
-*   1. bundled-copy first — if the bundled addon copy carries the matching
-*      `.node` (same machine → same platform/arch/ABI), re-plant it DIRECTLY.
-*      Cheapest + offline-safe; runs BEFORE any network fetch.
-*   2. fetch fallback — otherwise fetch the prebuild for the running ABI via the
-*      shared `ensureNativePrebuilds` pointed at the addon dir.
-*   3. FAIL LOUD — if the native is STILL source-only after both, log a clear
-*      error naming module + addon and THROW so the install fails at install
-*      time rather than at addon init.
-*
-* N-API natives (`sharp`, `node-av`) ship their binaries as ABI-stable platform
-* SIBLING packages npm fetches without a compile step, so they are excluded from
-* the default set — a miss there is a broken install, not something a prebuild
-* re-fetch heals (same rationale as `ensureNativePrebuilds`).
-*/
-/**
-* Re-plant `<srcModuleDir>` → `<dstModuleDir>` when the source carries a `.node`.
-* Returns whether the destination ends up with a compiled binary.
-*/
-function replantFromBundled(srcModuleDir, dstModuleDir, hasNative) {
-	if (!hasNative(srcModuleDir)) return false;
-	try {
-		node_fs.rmSync(dstModuleDir, {
-			recursive: true,
-			force: true
-		});
-		node_fs.mkdirSync(node_path.dirname(dstModuleDir), { recursive: true });
-		node_fs.cpSync(srcModuleDir, dstModuleDir, {
-			recursive: true,
-			dereference: true
-		});
-	} catch {
-		return false;
-	}
-	return hasNative(dstModuleDir);
-}
-/**
-* Ensure every referenced traditional native in `<addonDir>/node_modules`
-* carries its compiled `.node` after the addon's `npm install`. Bundled-copy
-* first (offline), prebuild-fetch fallback, LOUD throw on a residual miss.
-*
-* SKIPS a native absent from the addon's own `node_modules` (it resolves via a
-* hoisted host copy — not this addon's concern). A NO-OP in docker / dev where
-* npm produced a working `.node` (already-present). Returns the per-native
-* outcomes for logging/tests.
-*
-* @throws if any required native is still source-only after copy + fetch.
-*/
-async function ensureAddonNativePrebuilds(addonDir, options) {
-	const packages = options.packages ?? TRADITIONAL_NATIVE_PACKAGES;
-	const hasNative = options.hasNative ?? ((dir) => hasDotNode(dir, 4));
-	const nm = node_path.join(addonDir, "node_modules");
-	const results = [];
-	const missing = [];
-	for (const pkg of packages) {
-		const moduleDir = node_path.join(nm, pkg);
-		if (!node_fs.existsSync(moduleDir)) continue;
-		if (hasNative(moduleDir)) {
-			results.push({
-				pkg,
-				outcome: "already-present"
-			});
-			continue;
-		}
-		if (options.bundledSourceDir) {
-			const src = node_path.join(options.bundledSourceDir, "node_modules", pkg);
-			if (replantFromBundled(src, moduleDir, hasNative)) {
-				options.logger.info("addon native prebuild re-planted from bundled copy (offline)", { meta: {
-					addon: options.addonName,
-					pkg,
-					src,
-					moduleDir
-				} });
-				results.push({
-					pkg,
-					outcome: "copied"
-				});
-				continue;
-			}
-		}
-		if ((await ensureNativePrebuilds(addonDir, {
-			logger: options.logger,
-			packages: [pkg],
-			...options.target ? { target: options.target } : {},
-			...options.fetchPrebuild ? { fetchPrebuild: options.fetchPrebuild } : {}
-		})).includes(pkg)) {
-			results.push({
-				pkg,
-				outcome: "fetched"
-			});
-			continue;
-		}
-		options.logger.error("addon native prebuild MISSING after ensure — module has no compiled .node", { meta: {
-			addon: options.addonName,
-			pkg,
-			moduleDir
-		} });
-		results.push({
-			pkg,
-			outcome: "missing"
-		});
-		missing.push(pkg);
-	}
-	if (missing.length > 0) throw new Error(`${options.addonName} — required native module(s) missing a compiled .node after install (bundled-copy + prebuild-fetch both failed): ${missing.join(", ")}`);
-	return results;
-}
-//#endregion
 //#region src/kernel/addon-installer.ts
 var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
 function parseInstallSource(value) {
@@ -5453,6 +5453,19 @@ var CapabilityRegistry = class CapabilityRegistry {
 	_ready = false;
 	/** Boot-time dependency graph: capability → dependsOn names (from CapabilityDeclaration) */
 	capabilityDeps = /* @__PURE__ */ new Map();
+	/**
+	* capability → addon ids whose MANIFEST declares it.
+	*
+	* Populated by {@link declareFromManifest}, which runs at addon-LOAD time —
+	* before a forked addon's runner has spawned, let alone registered anything.
+	* So this map answers a question `providers` cannot: **which addons still owe
+	* this capability a provider**, i.e. is an absence final or merely early.
+	*
+	* It is not a second registry and nothing waits on it: it stores an argument
+	* `declareFromManifest` was already being handed and dropping, and it is read
+	* synchronously at the moment a caller needs the answer ([D3](../../../../docs/decisions/adr-0003.md)).
+	*/
+	manifestDeclarers = /* @__PURE__ */ new Map();
 	/** Per-device singleton overrides: deviceId → (capability → addonId) */
 	deviceOverrides = /* @__PURE__ */ new Map();
 	/** capName → (nodeId → bare addonId) per-node singleton overrides. */
@@ -5578,6 +5591,11 @@ var CapabilityRegistry = class CapabilityRegistry {
 	*/
 	declareFromManifest(declaration, addonId) {
 		if (declaration.dependsOn?.length) this.capabilityDeps.set(declaration.name, declaration.dependsOn);
+		if (addonId !== void 0) {
+			const declarers = this.manifestDeclarers.get(declaration.name);
+			if (declarers) declarers.add(addonId);
+			else this.manifestDeclarers.set(declaration.name, new Set([addonId]));
+		}
 		if (addonId !== void 0 && declaration.autoActivate !== void 0) this.autoActivateFlags.set(`${declaration.name}/${addonId}`, declaration.autoActivate);
 		const state = this.capabilities.get(declaration.name);
 		if (!state) {
@@ -5700,6 +5718,22 @@ var CapabilityRegistry = class CapabilityRegistry {
 	hasProvider(capabilityName, addonId) {
 		return this.capabilities.get(capabilityName)?.providers.has(addonId) ?? false;
 	}
+	/**
+	* Addon ids whose manifest declares `capabilityName`, whether or not they
+	* have registered a provider yet.
+	*
+	* Pair it with {@link hasProvider} to separate "this capability's collection
+	* is still filling up" from "this is everything there will ever be" — the
+	* difference between a 503 a client should retry and a 400 it should not.
+	* Every entry is an addon INSTALLED on this node; an addon that is installed
+	* but disabled therefore stays listed, which is the honest answer (the
+	* capability is owed by something that is not going to supply it, and naming
+	* it is the diagnosis).
+	*/
+	getManifestDeclarers(capabilityName) {
+		const declarers = this.manifestDeclarers.get(capabilityName);
+		return declarers ? [...declarers] : [];
+	}
 	/** Unregister a provider. For singleton: clears active. For collection: removes from list. */
 	unregisterProvider(capabilityName, addonId) {
 		const state = this.capabilities.get(capabilityName);
@@ -94964,7 +94998,6 @@ exports.HEAP_RECLAIM_MIN_INTERVAL_MS = HEAP_RECLAIM_MIN_INTERVAL_MS;
 exports.HEAP_RECLAIM_TRIGGER_MB = HEAP_RECLAIM_TRIGGER_MB;
 exports.HEAP_WATCH_INTERVAL_MS = HEAP_WATCH_INTERVAL_MS;
 exports.HEAP_WATCH_WARN_RATIO = HEAP_WATCH_WARN_RATIO;
-exports.HOME_ASSISTANT_OAUTH_INTEGRATION = require_builtins_local_auth_local_auth_addon.HOME_ASSISTANT_OAUTH_INTEGRATION;
 exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
 exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
 exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
@@ -94985,7 +95018,7 @@ exports.LogRingBuffer = LogRingBuffer;
 exports.LokiDestination = require_builtins_loki_logging_index.LokiDestination$1;
 exports.LokiLoggingAddon = require_builtins_loki_logging_index.LokiLoggingAddon$1;
 exports.METHOD_ACCESS_MAP = require_dist.METHOD_ACCESS_MAP;
-exports.ModelDownloadService = require_model_download_service.ModelDownloadService;
+exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
 exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
 exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
 exports.NativeMetricsAddon = require_builtins_native_metrics_native_metrics_addon.default;
@@ -95059,18 +95092,18 @@ exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
 exports.clearPendingRestart = clearPendingRestart;
 exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
 exports.clusterSecretMatches = clusterSecretMatches;
-exports.collectModelFiles = require_model_download_service.collectModelFiles;
-exports.contentTypeFor = require_model_download_service.contentTypeFor;
+exports.collectModelFiles = require_file_data_plane.collectModelFiles;
+exports.contentTypeFor = require_file_data_plane.contentTypeFor;
 exports.copyDirRecursive = copyDirRecursive;
 exports.copyExtraFileDirs = copyExtraFileDirs;
 exports.createAddonContext = require_manifest_python_deps.createAddonContext;
 exports.createAddonDataPlaneFacility = require_manifest_python_deps.createAddonDataPlaneFacility;
 exports.createAddonService = require_manifest_python_deps.createAddonService;
-exports.createAuthenticatedFileServer = require_model_download_service.createAuthenticatedFileServer;
+exports.createAuthenticatedFileServer = require_file_data_plane.createAuthenticatedFileServer;
 exports.createBroker = createBroker;
 exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
 exports.createCoreCapService = createCoreCapService;
-exports.createFileDataPlaneHandler = require_model_download_service.createFileDataPlaneHandler;
+exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
 exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
 exports.createHubService = createHubService;
 exports.createKernelHwAccel = require_manifest_python_deps.createKernelHwAccel;
@@ -95087,7 +95120,7 @@ exports.createUdsEventBus = require_manifest_python_deps.createUdsEventBus;
 exports.createUdsLogger = require_manifest_python_deps.createUdsLogger;
 exports.createUdsLoggerWithControl = require_manifest_python_deps.createUdsLoggerWithControl;
 exports.createV8Reclaimer = createV8Reclaimer;
-exports.deleteModelFromDisk = require_model_download_service.deleteModelFromDisk;
+exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
 exports.deriveAgentListenPort = deriveAgentListenPort;
 exports.describeProviderKindDrift = describeProviderKindDrift;
 exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
@@ -95097,8 +95130,8 @@ Object.defineProperty(exports, "downloadBinary", {
 		return _camstack_types_node.downloadBinary;
 	}
 });
-exports.downloadFile = require_model_download_service.downloadFile;
-exports.downloadModel = require_model_download_service.downloadModel;
+exports.downloadFile = require_file_data_plane.downloadFile;
+exports.downloadModel = require_file_data_plane.downloadModel;
 exports.emitDownForOwnedCaps = require_dist.emitDownForOwnedCaps;
 exports.encodeFrame = require_manifest_python_deps.encodeFrame;
 exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
@@ -95116,7 +95149,7 @@ Object.defineProperty(exports, "ensureFfmpeg", {
 	}
 });
 exports.ensureLibraryBuilt = ensureLibraryBuilt;
-exports.ensureModel = require_model_download_service.ensureModel;
+exports.ensureModel = require_file_data_plane.ensureModel;
 exports.ensureNativePrebuilds = ensureNativePrebuilds;
 Object.defineProperty(exports, "ensurePython", {
 	enumerable: true,
@@ -95126,7 +95159,7 @@ Object.defineProperty(exports, "ensurePython", {
 });
 exports.ensureTlsCert = ensureTlsCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
-exports.fetchJson = require_model_download_service.fetchJson;
+exports.fetchJson = require_file_data_plane.fetchJson;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
 	get: function() {
@@ -95142,7 +95175,7 @@ Object.defineProperty(exports, "getFfmpegDownloadUrl", {
 		return _camstack_types_node.getFfmpegDownloadUrl;
 	}
 });
-exports.getModelFilePath = require_model_download_service.getModelFilePath;
+exports.getModelFilePath = require_file_data_plane.getModelFilePath;
 exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
 exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
 exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
@@ -95186,21 +95219,21 @@ exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;
 exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
 exports.isCollectionArrayMethod = require_dist.isCollectionArrayMethod;
 exports.isInfraCapability = isInfraCapability;
-exports.isModelDownloaded = require_model_download_service.isModelDownloaded;
+exports.isModelDownloaded = require_file_data_plane.isModelDownloaded;
 exports.isSourceNewer = isSourceNewer;
 exports.loadTlsCert = loadTlsCert;
 exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
 exports.localProviderLink = require_manifest_python_deps.localProviderLink;
 exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
 exports.parseCapAction = require_manifest_python_deps.parseCapAction;
-exports.parseRangeHeader = require_model_download_service.parseRangeHeader;
-exports.parseTokenizedUrl = require_model_download_service.parseTokenizedUrl;
+exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
+exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
 exports.proxyToUpstream = proxyToUpstream;
 exports.quarantineAddonResidue = quarantineAddonResidue;
 exports.readPendingRestart = readPendingRestart;
 exports.readinessKey = require_dist.readinessKey;
 exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
-exports.resolveFilePath = require_model_download_service.resolveFilePath;
+exports.resolveFilePath = require_file_data_plane.resolveFilePath;
 exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
 exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
 exports.runNpm = require_manifest_python_deps.runNpm;