@camstack/system 1.2.21 → 1.2.23

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-OQ1yU92D.js");
+const require_dist = require("./dist-CS0pdC8l.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
-const require_manifest_python_deps = require("./manifest-python-deps-CnRW2Utv.js");
+const require_manifest_python_deps = require("./manifest-python-deps-CqDPWqEE.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
@@ -991,6 +991,18 @@ var PartitionedLogBuffer = class {
 		this.maxTotalEntries = options.maxTotalEntries ?? null;
 		this.pruneLevel = options.pruneLevel ?? "debug";
 	}
+	/**
+	* Apply new limits at runtime. Shrinking takes effect as entries are pushed
+	* (each partition trims to the new capacity on its next write) — existing
+	* entries are NOT dropped eagerly: losing history the operator is currently
+	* reading, the instant they lower a number, is a worse surprise than a
+	* momentarily oversized buffer.
+	*/
+	reconfigure(options) {
+		if (options.perAddonCapacity !== void 0 && options.perAddonCapacity > 0) this.perAddonCapacity = options.perAddonCapacity;
+		if (options.maxTotalEntries !== void 0) this.maxTotalEntries = options.maxTotalEntries;
+		if (options.pruneLevel !== void 0) this.pruneLevel = options.pruneLevel;
+	}
 	bufferFor(key) {
 		let buf = this.buffers.get(key);
 		if (buf === void 0) {
@@ -1130,11 +1142,24 @@ var ScopedLogger = class ScopedLogger {
 		};
 	}
 };
-//#endregion
-//#region src/logging/log-manager.ts
 var LogManager = class {
 	ringBuffer;
+	/**
+	* Destinations, each tagged with the addon that provides it (when known) so
+	* the fan-out can honour the operator's per-destination toggle.
+	*/
 	destinations = [];
+	/**
+	* "Is this destination enabled?", injected by the wiring side (which owns
+	* the capability registry). Absent ⇒ everything is enabled.
+	*
+	* WHY: the orchestrator's Enable/Disable toggle only added the addon to
+	* `disabledProviders` and NOTHING consulted it for `log-destination` — so
+	* console and winston could not be turned off at all and the badge in the UI
+	* lied, while Loki appeared to work only because it carried a SECOND,
+	* private `enabled` setting of its own (audit 2026-07-30).
+	*/
+	isDestinationEnabled;
 	subscribers = /* @__PURE__ */ new Map();
 	deviceNameLookup = null;
 	/**
@@ -1169,8 +1194,11 @@ var LogManager = class {
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
 			const enriched = this.enrichDeviceName(entry);
-			this.ringBuffer.push(enriched);
-			for (const dest of this.destinations) dest.write(enriched);
+			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
+			for (const entry of this.destinations) {
+				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
+				entry.dest.write(enriched);
+			}
 			for (const [, sub] of this.subscribers) if (this.matchesFilter(enriched, sub.filter)) try {
 				sub.callback(enriched);
 			} catch {}
@@ -1228,15 +1256,26 @@ var LogManager = class {
 	*                     traffic starts. Lets a destination added mid-boot
 	*                     still receive boot-time log entries.
 	*/
+	/** Apply new in-memory buffer limits at runtime (see PartitionedLogBuffer). */
+	reconfigureBuffer(options) {
+		this.ringBuffer.reconfigure(options);
+	}
+	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
+	setDestinationEnabledCheck(check) {
+		this.isDestinationEnabled = check ?? void 0;
+	}
 	addDestination(dest, opts = {}) {
 		const replay = opts.replay ?? true;
-		this.destinations.push(dest);
+		this.destinations.push(opts.addonId === void 0 ? { dest } : {
+			dest,
+			addonId: opts.addonId
+		});
 		if (replay) for (const entry of this.ringBuffer.query({})) try {
 			dest.write(entry);
 		} catch {}
 	}
 	removeDestination(dest) {
-		const index = this.destinations.indexOf(dest);
+		const index = this.destinations.findIndex((d) => d.dest === dest);
 		if (index !== -1) this.destinations.splice(index, 1);
 	}
 	query(filter) {
@@ -5168,6 +5207,17 @@ var CapabilityRegistry = class CapabilityRegistry {
 		if (!state || state.definition.mode !== "collection") return [];
 		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId));
 	}
+	/**
+	* Is `addonId` currently DISABLED as a provider of `capability`?
+	*
+	* Exposed because the disabled set was write-only for `log-destination`:
+	* the orchestrator toggle added the addon here and nothing ever read it, so
+	* console and winston could not be turned off at all while the UI badge said
+	* they were (audit 2026-07-30).
+	*/
+	isProviderDisabled(capability, addonId) {
+		return this.capabilities.get(capability)?.disabledProviders.has(addonId) === true;
+	}
 	/** Get the full CapabilityDefinition for a declared capability. */
 	getDefinition(capability) {
 		return this.capabilities.get(capability)?.definition;

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as logLevelAtMost, Dt as readinessKey, Et as parseJsonUnknown$1, F as isVoidInput, I as kebabToCamel, L as lifecycleJobSchema, M as isArrayOutputSchema, N as isCollectionArrayMethod, Ot as resolveCapMount, P as isObjectInput, Tt as parseJsonObject, V as looseSchema, W as objectInputDeclaresAddonId, _t as asString$1, c as RUNTIME_DEFAULTS, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, jt as EventCategory$1, k as extractNestedAddonId, kt as scopeKey, m as addonSettingsCapability, ot as DATAPLANE_SECRET_HEADER$1, pt as ReadinessTimeoutError, q as procedureAuthKey, s as METHOD_ACCESS_MAP, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, xt as expandCapMethods, yt as emitDownForOwnedCaps } from "./dist-DmQ6thmF.mjs";
+import { B as logLevelAtMost, Dt as readinessKey, Et as parseJsonUnknown$1, F as isVoidInput, I as kebabToCamel, L as lifecycleJobSchema, M as isArrayOutputSchema, N as isCollectionArrayMethod, Ot as resolveCapMount, P as isObjectInput, Tt as parseJsonObject, V as looseSchema, W as objectInputDeclaresAddonId, _t as asString$1, c as RUNTIME_DEFAULTS, ct as DEVICE_STATUS_METHOD, ft as ReadinessRegistry, gt as asNumber, ht as asJsonObject$1, it as errMsg$1, jt as EventCategory$1, k as extractNestedAddonId, kt as scopeKey, m as addonSettingsCapability, ot as DATAPLANE_SECRET_HEADER$1, pt as ReadinessTimeoutError, q as procedureAuthKey, s as METHOD_ACCESS_MAP, st as DEVICE_SETTINGS_CONTRIBUTION_METHODS, t as ALL_CAPABILITY_DEFINITIONS, vt as createEvent, xt as expandCapMethods, yt as emitDownForOwnedCaps } from "./dist-CIek6F9X.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-B30qVAuW.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-57PA4rHm.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./builtins/sqlite-storage/filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./builtins/sqlite-storage/sqlite-settings.addon.mjs";
@@ -984,6 +984,18 @@ var PartitionedLogBuffer = class {
 		this.maxTotalEntries = options.maxTotalEntries ?? null;
 		this.pruneLevel = options.pruneLevel ?? "debug";
 	}
+	/**
+	* Apply new limits at runtime. Shrinking takes effect as entries are pushed
+	* (each partition trims to the new capacity on its next write) — existing
+	* entries are NOT dropped eagerly: losing history the operator is currently
+	* reading, the instant they lower a number, is a worse surprise than a
+	* momentarily oversized buffer.
+	*/
+	reconfigure(options) {
+		if (options.perAddonCapacity !== void 0 && options.perAddonCapacity > 0) this.perAddonCapacity = options.perAddonCapacity;
+		if (options.maxTotalEntries !== void 0) this.maxTotalEntries = options.maxTotalEntries;
+		if (options.pruneLevel !== void 0) this.pruneLevel = options.pruneLevel;
+	}
 	bufferFor(key) {
 		let buf = this.buffers.get(key);
 		if (buf === void 0) {
@@ -1123,11 +1135,24 @@ var ScopedLogger = class ScopedLogger {
 		};
 	}
 };
-//#endregion
-//#region src/logging/log-manager.ts
 var LogManager = class {
 	ringBuffer;
+	/**
+	* Destinations, each tagged with the addon that provides it (when known) so
+	* the fan-out can honour the operator's per-destination toggle.
+	*/
 	destinations = [];
+	/**
+	* "Is this destination enabled?", injected by the wiring side (which owns
+	* the capability registry). Absent ⇒ everything is enabled.
+	*
+	* WHY: the orchestrator's Enable/Disable toggle only added the addon to
+	* `disabledProviders` and NOTHING consulted it for `log-destination` — so
+	* console and winston could not be turned off at all and the badge in the UI
+	* lied, while Loki appeared to work only because it carried a SECOND,
+	* private `enabled` setting of its own (audit 2026-07-30).
+	*/
+	isDestinationEnabled;
 	subscribers = /* @__PURE__ */ new Map();
 	deviceNameLookup = null;
 	/**
@@ -1162,8 +1187,11 @@ var LogManager = class {
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
 			const enriched = this.enrichDeviceName(entry);
-			this.ringBuffer.push(enriched);
-			for (const dest of this.destinations) dest.write(enriched);
+			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
+			for (const entry of this.destinations) {
+				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
+				entry.dest.write(enriched);
+			}
 			for (const [, sub] of this.subscribers) if (this.matchesFilter(enriched, sub.filter)) try {
 				sub.callback(enriched);
 			} catch {}
@@ -1221,15 +1249,26 @@ var LogManager = class {
 	*                     traffic starts. Lets a destination added mid-boot
 	*                     still receive boot-time log entries.
 	*/
+	/** Apply new in-memory buffer limits at runtime (see PartitionedLogBuffer). */
+	reconfigureBuffer(options) {
+		this.ringBuffer.reconfigure(options);
+	}
+	/** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
+	setDestinationEnabledCheck(check) {
+		this.isDestinationEnabled = check ?? void 0;
+	}
 	addDestination(dest, opts = {}) {
 		const replay = opts.replay ?? true;
-		this.destinations.push(dest);
+		this.destinations.push(opts.addonId === void 0 ? { dest } : {
+			dest,
+			addonId: opts.addonId
+		});
 		if (replay) for (const entry of this.ringBuffer.query({})) try {
 			dest.write(entry);
 		} catch {}
 	}
 	removeDestination(dest) {
-		const index = this.destinations.indexOf(dest);
+		const index = this.destinations.findIndex((d) => d.dest === dest);
 		if (index !== -1) this.destinations.splice(index, 1);
 	}
 	query(filter) {
@@ -5161,6 +5200,17 @@ var CapabilityRegistry = class CapabilityRegistry {
 		if (!state || state.definition.mode !== "collection") return [];
 		return [...state.providers.entries()].filter(([addonId]) => !state.disabledProviders.has(addonId));
 	}
+	/**
+	* Is `addonId` currently DISABLED as a provider of `capability`?
+	*
+	* Exposed because the disabled set was write-only for `log-destination`:
+	* the orchestrator toggle added the addon here and nothing ever read it, so
+	* console and winston could not be turned off at all while the UI badge said
+	* they were (audit 2026-07-30).
+	*/
+	isProviderDisabled(capability, addonId) {
+		return this.capabilities.get(capability)?.disabledProviders.has(addonId) === true;
+	}
 	/** Get the full CapabilityDefinition for a declared capability. */
 	getDefinition(capability) {
 		return this.capabilities.get(capability)?.definition;

package/dist/kernel/capability-registry.d.ts

@@ -311,6 +311,15 @@ export declare class CapabilityRegistry {
      */
     getCollectionEntries<K extends keyof CollectionCapabilityMap>(capability: K): readonly (readonly [string, CollectionCapabilityMap[K]])[];
     getCollectionEntries<T = unknown>(capability: string): readonly (readonly [string, T])[];
+    /**
+     * Is `addonId` currently DISABLED as a provider of `capability`?
+     *
+     * Exposed because the disabled set was write-only for `log-destination`:
+     * the orchestrator toggle added the addon here and nothing ever read it, so
+     * console and winston could not be turned off at all while the UI badge said
+     * they were (audit 2026-07-30).
+     */
+    isProviderDisabled(capability: string, addonId: string): boolean;
     /** Get the full CapabilityDefinition for a declared capability. */
     getDefinition(capability: string): CapabilityDefinition | undefined;
     /** Get the mode declared for a capability. */

package/dist/kernel/transport/local-child-registry.d.ts

@@ -79,6 +79,22 @@ export interface LocalChildRegistryOptions {
      * distinguish a pin-to-self from a pin-to-another-node.
      */
     readonly ownNodeId?: string;
+    /**
+     * Does `(capName, method)` name a `mode:'collection'` array method whose
+     * contract is the UNION across every provider? Such a call must NOT be
+     * short-circuited to a local sibling: `resolveChildId` picks ONE provider
+     * (first-registered, or the singleton preference — meaningless here), so the
+     * caller would see a fraction of the catalog the hub's own tRPC router
+     * returns. It goes to `onUnownedCall`, which owns the aggregate over local
+     * siblings, in-process providers and remote nodes alike.
+     *
+     * `notification-output` has three provider siblings; the Notification Center
+     * landed on one holding no targets, read the empty list as "target deleted"
+     * and permanently dead-lettered every notification it ever produced
+     * (2026-07-30). Omitted ⇒ prior behaviour exactly (sibling short-circuit for
+     * everything). The kernel has no cap registry, so the wiring side injects it.
+     */
+    readonly isAggregatedCollectionMethod?: (capName: string, method: string) => boolean;
 }
 /**
  * Parent-side authority for local addon-runners reachable over a
@@ -100,6 +116,8 @@ export declare class LocalChildRegistry {
     private readonly resolveChildIdForAddon?;
     /** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
     private readonly ownNodeId?;
+    /** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+    private readonly isAggregatedCollectionMethod?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
     private readonly egressRoutedCaps;
     /** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */

package/dist/kernel/transport/parent-unowned-call.d.ts

@@ -110,6 +110,28 @@ export interface ParentUnownedCallDeps {
      * `CapabilityDefinition`s and the registry) injects this.
      */
     readonly resolveEmptyCollection?: (capName: string, method: string) => readonly unknown[] | null;
+    /**
+     * Optional collection FAN-OUT. Returns the union of `method` across every
+     * registered provider of a `mode:'collection'` cap, or `null` when the
+     * (cap, method) pair is not an aggregated collection array-method.
+     *
+     * Why: routing resolves ONE provider (`resolveChildId` picks the
+     * first-registered child, or the singleton preference — meaningless for a
+     * collection). The hub's tRPC cap-router instead fans array methods across
+     * every provider (`concatArrayMethod`). A forked addon calling the same cap
+     * through `ctx.api` therefore saw a DIFFERENT, smaller answer than the hub's
+     * own router — and for `notification-output`, whose three providers include
+     * two that hold no targets, it saw `[]`. The Notification Center read that
+     * empty catalog as "the target was deleted" and permanently dead-lettered
+     * every notification it ever produced (2026-07-30).
+     *
+     * Skipped when the call carries an explicit `nodeId` pin — a pin must route
+     * to its node, never be answered by a cluster-wide union. The kernel layer
+     * has no cap registry, so the wiring side injects this (same shape as
+     * {@link resolveEmptyCollection}, and it shares that path's aggregation code
+     * so the two answers cannot drift).
+     */
+    readonly callCollectionAggregate?: (capName: string, method: string, args: unknown) => Promise<readonly unknown[] | null>;
     /**
      * Optional predicate — returns `true` when `capName` is a HUB-CORE `$`-service
      * cap (`system`, `addons`, `nodes`, `capabilities`, `stream-probe`, …): served

package/dist/logging/log-manager.d.ts

@@ -1,4 +1,4 @@
-import { LogEntry, LogFilter } from './log-ring-buffer.js';
+import { LogEntry, LogFilter, LogLevel } from './log-ring-buffer.js';
 import { PartitionedLogBufferOptions } from './partitioned-log-buffer.js';
 import { IScopedLogger } from './scoped-logger.js';
 export interface ILogDestination {
@@ -7,9 +7,31 @@ export interface ILogDestination {
     write(entry: LogEntry): void;
     query?(filter: LogFilter): Promise<readonly LogEntry[]>;
 }
+/**
+ * The reserved destination id of the in-memory buffer. Not an addon: the
+ * buffer must exist before any addon loads (boot lines) and it backs
+ * `logs.query`/`subscribe`, so it lives in the kernel — but it answers to the
+ * SAME orchestrator toggle as every other destination.
+ */
+export declare const LOG_BUFFER_DESTINATION_ID = "log-buffer";
 export declare class LogManager {
     private readonly ringBuffer;
+    /**
+     * Destinations, each tagged with the addon that provides it (when known) so
+     * the fan-out can honour the operator's per-destination toggle.
+     */
     private readonly destinations;
+    /**
+     * "Is this destination enabled?", injected by the wiring side (which owns
+     * the capability registry). Absent ⇒ everything is enabled.
+     *
+     * WHY: the orchestrator's Enable/Disable toggle only added the addon to
+     * `disabledProviders` and NOTHING consulted it for `log-destination` — so
+     * console and winston could not be turned off at all and the badge in the UI
+     * lied, while Loki appeared to work only because it carried a SECOND,
+     * private `enabled` setting of its own (audit 2026-07-30).
+     */
+    private isDestinationEnabled?;
     private readonly subscribers;
     private deviceNameLookup;
     /**
@@ -48,8 +70,17 @@ export declare class LogManager {
      *                     traffic starts. Lets a destination added mid-boot
      *                     still receive boot-time log entries.
      */
+    /** Apply new in-memory buffer limits at runtime (see PartitionedLogBuffer). */
+    reconfigureBuffer(options: {
+        readonly perAddonCapacity?: number;
+        readonly maxTotalEntries?: number | null;
+        readonly pruneLevel?: LogLevel;
+    }): void;
+    /** Set the per-destination enablement check (see {@link isDestinationEnabled}). */
+    setDestinationEnabledCheck(check: ((addonId: string) => boolean) | null): void;
     addDestination(dest: ILogDestination, opts?: {
         replay?: boolean;
+        addonId?: string;
     }): void;
     removeDestination(dest: ILogDestination): void;
     query(filter: LogFilter): LogEntry[];

package/dist/logging/partitioned-log-buffer.d.ts

@@ -42,12 +42,24 @@ export interface PartitionedLogBufferOptions {
  */
 export declare class PartitionedLogBuffer {
     private readonly buffers;
-    private readonly perAddonCapacity;
-    private readonly maxTotalEntries;
-    private readonly pruneLevel;
+    private perAddonCapacity;
+    private maxTotalEntries;
+    private pruneLevel;
     /** Running total, so `push` does not walk every bucket to decide. */
     private totalEntries;
     constructor(perAddonCapacity?: number, options?: PartitionedLogBufferOptions);
+    /**
+     * Apply new limits at runtime. Shrinking takes effect as entries are pushed
+     * (each partition trims to the new capacity on its next write) — existing
+     * entries are NOT dropped eagerly: losing history the operator is currently
+     * reading, the instant they lower a number, is a worse surprise than a
+     * momentarily oversized buffer.
+     */
+    reconfigure(options: {
+        readonly perAddonCapacity?: number;
+        readonly maxTotalEntries?: number | null;
+        readonly pruneLevel?: LogLevel;
+    }): void;
     private bufferFor;
     push(entry: LogEntry): void;
     /**

package/dist/{manifest-python-deps-B30qVAuW.mjs → manifest-python-deps-57PA4rHm.mjs}

@@ -5,7 +5,7 @@ import * as path$1 from "node:path";
 import { isAbsolute, join } from "node:path";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
-import { DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep } from "@camstack/types/addon";
+import { DATAPLANE_SECRET_HEADER, DeviceType, DisposerChain, EventCategory, ReadinessRegistry, asJsonObject, asString, createDeviceProxy, deviceOpsCapability, emitReadiness, errMsg, expandCapMethods, readNodePin, scopeKey, sleep, withCapInputDefaults } from "@camstack/types/addon";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as os from "node:os";
@@ -4301,6 +4301,8 @@ var LocalChildRegistry = class {
 	resolveChildIdForAddon;
 	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
 	ownNodeId;
+	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+	isAggregatedCollectionMethod;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -4329,6 +4331,7 @@ var LocalChildRegistry = class {
 			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
+			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -4692,7 +4695,7 @@ var LocalChildRegistry = class {
 				};
 				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
-				if ((pinnedNodeId === void 0 || pinTargetsThisNode ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				if ((!(pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true) && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -5248,6 +5251,8 @@ function createParentUnownedCallHandler(deps) {
 		if (nodeId === void 0) {
 			const empty = deps.resolveEmptyCollection?.(input.capName, input.method);
 			if (empty != null) return empty;
+			const aggregate = await deps.callCollectionAggregate?.(input.capName, input.method, input.args);
+			if (aggregate != null) return aggregate;
 		}
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {
@@ -5415,14 +5420,18 @@ function localProviderLink(resolver, observerOpts) {
 		return ({ op, next }) => {
 			const parsed = parsePath(op.path);
 			if (!parsed) return next(op);
+			const opWithDefaults = op.input === void 0 ? op : {
+				...op,
+				input: withCapInputDefaults(parsed.capName, parsed.method, op.input)
+			};
 			if (localBase !== void 0) {
 				const pinnedNodeId = readNodePin(op.context);
-				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(op);
+				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(opWithDefaults);
 			}
 			const provider = resolver.getByName(parsed.capName);
-			if (!provider || typeof provider !== "object") return next(op);
+			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
-			if (typeof fn !== "function") return next(op);
+			if (typeof fn !== "function") return next(opWithDefaults);
 			if (observerOpts) try {
 				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
 				if (providerAddonId) observerOpts.observer({
@@ -5434,7 +5443,7 @@ function localProviderLink(resolver, observerOpts) {
 				});
 			} catch {}
 			return observable((observer) => {
-				Promise.resolve(fn.call(provider, op.input)).then((data) => {
+				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
 						type: "data",
 						data

package/dist/{manifest-python-deps-CnRW2Utv.js → manifest-python-deps-CqDPWqEE.js}

@@ -4303,6 +4303,8 @@ var LocalChildRegistry = class {
 	resolveChildIdForAddon;
 	/** This node's own Moleculer nodeId (see {@link LocalChildRegistryOptions.ownNodeId}). */
 	ownNodeId;
+	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
+	isAggregatedCollectionMethod;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
 	egressRoutedCaps = /* @__PURE__ */ new Set();
 	/** Active event fan-out mode, read once from `CAMSTACK_UDS_EVENT_FANOUT`. */
@@ -4331,6 +4333,7 @@ var LocalChildRegistry = class {
 			this.getActiveSingletonAddonId = opts.getActiveSingletonAddonId;
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
+			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
 		} else {
 			this.server = serverOrOptions;
 			this.onUnownedCall = onUnownedCallArg;
@@ -4694,7 +4697,7 @@ var LocalChildRegistry = class {
 				};
 				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
-				if ((pinnedNodeId === void 0 || pinTargetsThisNode ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				if ((!(pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true) && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -5250,6 +5253,8 @@ function createParentUnownedCallHandler(deps) {
 		if (nodeId === void 0) {
 			const empty = deps.resolveEmptyCollection?.(input.capName, input.method);
 			if (empty != null) return empty;
+			const aggregate = await deps.callCollectionAggregate?.(input.capName, input.method, input.args);
+			if (aggregate != null) return aggregate;
 		}
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {
@@ -5417,14 +5422,18 @@ function localProviderLink(resolver, observerOpts) {
 		return ({ op, next }) => {
 			const parsed = parsePath(op.path);
 			if (!parsed) return next(op);
+			const opWithDefaults = op.input === void 0 ? op : {
+				...op,
+				input: (0, _camstack_types_addon.withCapInputDefaults)(parsed.capName, parsed.method, op.input)
+			};
 			if (localBase !== void 0) {
 				const pinnedNodeId = (0, _camstack_types_addon.readNodePin)(op.context);
-				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(op);
+				if (pinnedNodeId !== void 0 && pinnedNodeId !== localBase) return next(opWithDefaults);
 			}
 			const provider = resolver.getByName(parsed.capName);
-			if (!provider || typeof provider !== "object") return next(op);
+			if (!provider || typeof provider !== "object") return next(opWithDefaults);
 			const fn = Reflect.get(provider, parsed.method);
-			if (typeof fn !== "function") return next(op);
+			if (typeof fn !== "function") return next(opWithDefaults);
 			if (observerOpts) try {
 				const providerAddonId = observerOpts.providerAddonIdForCap(parsed.capName);
 				if (providerAddonId) observerOpts.observer({
@@ -5436,7 +5445,7 @@ function localProviderLink(resolver, observerOpts) {
 				});
 			} catch {}
 			return observable((observer) => {
-				Promise.resolve(fn.call(provider, op.input)).then((data) => {
+				Promise.resolve(fn.call(provider, opWithDefaults.input)).then((data) => {
 					observer.next({ result: {
 						type: "data",
 						data

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.21",
+  "version": "1.2.23",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",
@@ -125,7 +125,8 @@
             "id": "backups",
             "displayName": "Backups",
             "description": "Backup archives.",
-            "cardinality": "multi"
+            "cardinality": "multi",
+            "defaultRoot": "backup"
           }
         ]
       },