@camstack/system 1.2.455 → 1.2.457

package/dist/file-host-worker.js

@@ -1,5 +1,5 @@
 require("./chunk-Cek0wNdY.js");
-const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("./wal-maintenance-DVN-DiVP.js");
 let node_worker_threads = require("node:worker_threads");
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/file-host-worker.mjs

@@ -1,4 +1,4 @@
-import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-TyuOEVy1.mjs";
+import { C as RecordsEngine, D as callVector, E as callRecords, O as controlTargetOf, T as callData, _ as collectTransferables, a as WalMaintenance, b as isFileHostWorkerData, h as serializeError, l as SqliteSettingsBackend, o as createVectorIndex, s as vectorProviderOf, w as callControl, x as trustInput, y as isFileHostRequest } from "./wal-maintenance-BMiX6UIa.mjs";
 import { parentPort, threadId, workerData } from "node:worker_threads";
 //#region src/builtins/sqlite-storage/file-host-worker.ts
 /**

package/dist/{hub-mdns-ciao-DlgkFJVY.mjs → hub-mdns-ciao-B8olZqqd.mjs}

@@ -1,7 +1,7 @@
 import { o as __toESM } from "./chunk-CNf5ZN-e.mjs";
-import { _a as userError } from "./dist-BpSENkRJ.mjs";
+import { Ea as userError } from "./dist-Dhux90yB.mjs";
 import { f as X509Certificate$1 } from "./x509.es-DK__ETIe.mjs";
-import { A as isConstrainedCa, E as reasonRequiresNewCa, M as permitsIdentity, P as readNameConstraints, T as evaluateExistingCert, _ as issueLeaf, g as generateCa, v as loadCa, y as collectCertIdentity } from "./agent-https-CLWrOO3o.mjs";
+import { D as reasonRequiresNewCa, E as evaluateExistingCert, F as readNameConstraints, N as permitsIdentity, _ as issueLeaf, b as collectCertIdentity, g as generateCa, j as isConstrainedCa, v as loadCa, y as localCaCommonName } from "./agent-https-CK9Z4sSR.mjs";
 import { X509Certificate, createPrivateKey } from "node:crypto";
 import { writeOwnerOnlyFileSync } from "@camstack/types/node";
 import { mkdir, writeFile } from "node:fs/promises";
@@ -204,7 +204,13 @@ async function ensureTlsCert(dataDir, options) {
 	mkdirSync(tlsDir, { recursive: true });
 	let dropped = [];
 	try {
-		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
+		dropped = await regenerate(paths, rawIdentity, {
+			commonName,
+			caCommonName: localCaCommonName(options?.hubName),
+			validDays,
+			newCa: caRotated,
+			reason
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
@@ -234,7 +240,13 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	mkdirSync(tlsDir, { recursive: true });
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, {
+		commonName,
+		caCommonName: localCaCommonName(options?.hubName),
+		validDays,
+		newCa: false,
+		reason: null
+	}));
 }
 /**
 * Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
@@ -260,7 +272,7 @@ async function replaceUnconstrainedLocalCa(dataDir, options) {
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const ca = await generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	const ca = await generateCa(/* @__PURE__ */ new Date(), identity.dnsNames, localCaCommonName(options?.hubName));
 	archivePreviousCa(paths, ca);
 	await writeFile(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 	writeOwnerOnlyFileSync(`${paths.caKeyPath}.new`, ca.keyPem);
@@ -297,15 +309,10 @@ function decideRegeneration(paths, identity) {
 		return "unreadable";
 	}
 }
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
+async function regenerate(paths, rawIdentity, params) {
+	const { commonName, caCommonName, validDays, newCa, reason } = params;
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await generateCa(now, rawIdentity.dnsNames) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await generateCa(now, rawIdentity.dnsNames, caCommonName) : await loadCa(readFileSync(paths.caCertPath, "utf-8"), readFileSync(paths.caKeyPath, "utf-8"));
 	const constraints = readNameConstraints(ca.cert);
 	const { identity, dropped } = constraints === null ? {
 		identity: rawIdentity,

package/dist/{hub-mdns-ciao-Bkrvgnma.js → hub-mdns-ciao-DB1Y9agt.js}

@@ -1,7 +1,7 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-C89nqNnn.js");
 const require_x509_es = require("./x509.es-C4cOo48M.js");
-const require_agent_https = require("./agent-https-CCvlRQKV.js");
+const require_agent_https = require("./agent-https-CoyOZ3pC.js");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");
 let node_fs_promises = require("node:fs/promises");
@@ -204,7 +204,13 @@ async function ensureTlsCert(dataDir, options) {
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
 	let dropped = [];
 	try {
-		dropped = await regenerate(paths, rawIdentity, commonName, validDays, caRotated, reason);
+		dropped = await regenerate(paths, rawIdentity, {
+			commonName,
+			caCommonName: require_agent_https.localCaCommonName(options?.hubName),
+			validDays,
+			newCa: caRotated,
+			reason
+		});
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		if (!canKeepServing(paths)) throw err;
@@ -234,7 +240,13 @@ async function reissueTlsLeaf(dataDir, options) {
 	});
 	const previousFingerprint = readFingerprint(paths.certPath);
 	(0, node_fs.mkdirSync)(tlsDir, { recursive: true });
-	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, commonName, validDays, false, null));
+	return describe(paths, true, "san-coverage-gap", false, previousFingerprint, null, await regenerate(paths, identity, {
+		commonName,
+		caCommonName: require_agent_https.localCaCommonName(options?.hubName),
+		validDays,
+		newCa: false,
+		reason: null
+	}));
 }
 /**
 * Uploaded mode keeps a generated CA beside the upload (agents' leaves are still signed
@@ -260,7 +272,7 @@ async function replaceUnconstrainedLocalCa(dataDir, options) {
 		extraSans: options?.extraSans ?? [],
 		...options?.hostFacts === void 0 ? {} : { hostFacts: options.hostFacts }
 	});
-	const ca = await require_agent_https.generateCa(/* @__PURE__ */ new Date(), identity.dnsNames);
+	const ca = await require_agent_https.generateCa(/* @__PURE__ */ new Date(), identity.dnsNames, require_agent_https.localCaCommonName(options?.hubName));
 	archivePreviousCa(paths, ca);
 	await (0, node_fs_promises.writeFile)(`${paths.caCertPath}.new`, ca.certPem, "utf-8");
 	(0, _camstack_types_node.writeOwnerOnlyFileSync)(`${paths.caKeyPath}.new`, ca.keyPem);
@@ -297,15 +309,10 @@ function decideRegeneration(paths, identity) {
 		return "unreadable";
 	}
 }
-/**
-* Build every byte in memory, then move the files into place. A crash
-* mid-way leaves the previous material untouched; a crash between the
-* moves leaves a key/certificate mismatch, which the evaluator reports as
-* `key-mismatch` and heals on the next boot.
-*/
-async function regenerate(paths, rawIdentity, commonName, validDays, newCa, reason) {
+async function regenerate(paths, rawIdentity, params) {
+	const { commonName, caCommonName, validDays, newCa, reason } = params;
 	const now = /* @__PURE__ */ new Date();
-	const ca = newCa ? await require_agent_https.generateCa(now, rawIdentity.dnsNames) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
+	const ca = newCa ? await require_agent_https.generateCa(now, rawIdentity.dnsNames, caCommonName) : await require_agent_https.loadCa((0, node_fs.readFileSync)(paths.caCertPath, "utf-8"), (0, node_fs.readFileSync)(paths.caKeyPath, "utf-8"));
 	const constraints = require_agent_https.readNameConstraints(ca.cert);
 	const { identity, dropped } = constraints === null ? {
 		identity: rawIdentity,

package/dist/index.d.ts

@@ -9,15 +9,12 @@ export { ApiKeyManager } from "./auth/api-key-manager.js";
 export type { AuthConfigReader, ReauthClaims, TokenPayload } from "./auth/auth-manager.js";
 export { AuthManager } from "./auth/auth-manager.js";
 export { scopesAllowAddon, scopesAllowDeviceCap } from "./auth/scope-matcher.js";
-export { ScopedTokenManager } from "./auth/scoped-token-manager.js";
 export type { TokenExpiryResult } from "./auth/token-expiry.js";
 export { parseTokenExpiry } from "./auth/token-expiry.js";
 export type { CreateLoginSessionInput, LoginSessionCheck, LoginSessionMethod, LoginSessionRecord, LoginSessionRefresh, LoginSessionRevocation, LoginSessionSummary } from "./auth/login-session-manager.js";
 export { LoginSessionManager, REFRESH_TOKEN_PREFIX } from "./auth/login-session-manager.js";
 export { onSessionsRevoked } from "./auth/session-revocation-bus.js";
 export type { SessionsRevokedEvent, SessionsRevokedListener } from "./auth/session-revocation-bus.js";
-export type { AdminTokenRecord } from "./auth/admin-token-manager.js";
-export { ADMIN_TOKEN_MAX_LIFETIME_MS, ADMIN_TOKEN_PREFIX, AdminTokenManager } from "./auth/admin-token-manager.js";
 export { DeviceCaStore } from "./auth/device-ca-store.js";
 export { DEVICE_CA_KEY_REF, type DeviceCaSigner, generateDeviceCa, issueDeviceLeaf, loadDeviceCa, verifyDeviceLeaf, verifyDeviceSignature } from "./auth/device-ca.js";
 export { type AuthenticatedDevice, DeviceCredentialManager, type DeviceCredentialRecord, type DeviceCredentialState, PREVIOUS_LEAF_GRACE_MS, type DeviceCheckRefusal, type IssuedDeviceCertificate } from "./auth/device-credential-manager.js";
@@ -25,7 +22,8 @@ export { AuthAuditLog } from "./auth/auth-audit-log.js";
 export type { AuthAuditAction, AuthAuditEvent, AuthAuditRecord } from "./auth/auth-audit-log.js";
 export type { CidrMatcher, ParsedCidr, ParsedCidrList } from "./auth/cidr.js";
 export { createCidrMatcher, normalizeIp, parseCidrList, readCidrSetting } from "./auth/cidr.js";
-export type { AdminTokensInternal, AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal } from "./auth/user-management-internal.js";
+export type { AuthAuditInternal, DeviceCredentialsInternal, LinkExternalIdentityInput, LoginSessionsInternal, SetPasswordInput, UserManagementInternal, UserPreferencesInternal } from "./auth/user-management-internal.js";
+export { type PreferencesLimitReason, preferencesLimitReasonOf } from "./builtins/local-auth/user-preferences-store.js";
 export { attachUserManagementInternal, getUserManagementInternal, USER_MANAGEMENT_INTERNAL } from "./auth/user-management-internal.js";
 export type { UserRecord, UserStorageAccess } from "./auth/user-manager.js";
 export { FIRST_BOOT_ADMIN_PASSWORD, FIRST_BOOT_ADMIN_USERNAME, UserManager } from "./auth/user-manager.js";
@@ -104,6 +102,7 @@ export { isCredentialKeyName, redactLogEntry, redactLogMeta, redactLogText } fro
 export { clearPlatformKeychainKey, getPlatformKeychainKey, type PlatformKeychainKey, setPlatformKeychainKey } from "./builtins/keychain/platform-key-source.js";
 export type { LogEntry, LogFilter, LogLevel } from "./logging/log-ring-buffer.js";
 export { LogRingBuffer } from "./logging/log-ring-buffer.js";
+export { bareAddonOf, compileLogFilter, type CompiledLogFilter, filterIsEmpty, levelRank, lineContainsText, lineMatches, originNodeOf, type ReadableLine } from "./logging/log-read-filter.js";
 export type { LevelBearing } from "./logging/logging-gate.js";
 export { DEFAULT_LOG_LEVEL, LoggingGate } from "./logging/logging-gate.js";
 export { __resetLoggingGateForTests, getLoggingGate } from "./logging/logging-gate.singleton.js";

package/dist/index.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-DjQ8C-ku.js");
+const require_dist = require("./dist-C89nqNnn.js");
 const require_read_all_rows$1 = require("./read-all-rows-CVoO1ONM.js");
-const require_device_ca = require("./device-ca-QPBgfqVY.js");
+const require_device_ca = require("./device-ca-CVK3YcR_.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_builtins_calendars_calendars_addon = require("./builtins/calendars/calendars.addon.js");
@@ -23,25 +23,26 @@ const require_builtins_liveness_monitor_liveness_monitor_addon = require("./buil
 require("./builtins/liveness-monitor/index.js");
 const require_builtins_local_auth_local_auth_addon = require("./builtins/local-auth/local-auth.addon.js");
 require("./builtins/local-auth/index.js");
+const require_log_read_filter = require("./log-read-filter-Bi066jwU.js");
 const require_builtins_loki_logging_index = require("./builtins/loki-logging/index.js");
 const require_builtins_native_metrics_native_metrics_addon = require("./builtins/native-metrics/native-metrics.addon.js");
 const require_builtins_device_history_device_history_addon = require("./builtins/device-history/device-history.addon.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./builtins/sqlite-storage/filesystem-storage.addon.js");
-const require_wal_maintenance = require("./wal-maintenance-Bl0ZKjVR.js");
+const require_wal_maintenance = require("./wal-maintenance-DVN-DiVP.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./builtins/sqlite-storage/sqlite-settings.addon.js");
 const require_builtins_sqlite_storage_index = require("./builtins/sqlite-storage/index.js");
 const require_builtins_storage_orchestrator_storage_orchestrator_addon = require("./builtins/storage-orchestrator/storage-orchestrator.addon.js");
 require("./builtins/storage-orchestrator/index.js");
-const require_constants = require("./constants-DruwCkfp.js");
-const require_agent_https = require("./agent-https-CCvlRQKV.js");
+const require_constants = require("./constants-B_X9cWEK.js");
+const require_agent_https = require("./agent-https-CoyOZ3pC.js");
 const require_builtins_system_config_system_config_addon = require("./builtins/system-config/system-config.addon.js");
 require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_custom_action_registry = require("./custom-action-registry-COyb49zm.js");
-const require_hub_mdns_ciao = require("./hub-mdns-ciao-Bkrvgnma.js");
+const require_hub_mdns_ciao = require("./hub-mdns-ciao-DB1Y9agt.js");
 const require_platform_key_source = require("./platform-key-source-Di7HrlGR.js");
 const require_resource_monitor = require("./resource-monitor-mio9dSCT.js");
-const require_restore_archive = require("./restore-archive-4OP0EYg6.js");
+const require_restore_archive = require("./restore-archive-4DOUR5Gu.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
@@ -4439,6 +4440,16 @@ var ScopedLogger = class ScopedLogger {
 		};
 	}
 };
+//#endregion
+//#region src/logging/log-manager.ts
+/**
+* A short id for one process lifetime: the first half of every entry `id`.
+* Base-36 epoch ms plus a random suffix, so two boots of the same process in
+* the same millisecond still mint different ids.
+*/
+function newBootId() {
+	return `${Date.now().toString(36)}${Math.floor(Math.random() * 36 ** 4).toString(36).padStart(4, "0")}`;
+}
 var LogManager = class {
 	ringBuffer;
 	/**
@@ -4475,6 +4486,14 @@ var LogManager = class {
 	*/
 	gate = getLoggingGate();
 	/**
+	* Entry identity (D898): `<bootId>.<seq>`, stamped once, here, on every line
+	* this process accepts — so the in-memory tail, the live subscription and
+	* the rotated file carry the SAME id and a page read from disk dedupes
+	* exactly against the lines pushed live.
+	*/
+	bootId = newBootId();
+	seq = 0;
+	/**
 	* `perAddonCapacity` bounds EACH addon's bucket, not the total — a chatty addon
 	* evicts only its own lines, so quiet addons keep their sparse history.
 	*
@@ -4507,7 +4526,10 @@ var LogManager = class {
 	}
 	createLogger(scope) {
 		return new ScopedLogger(scope, (entry) => {
-			const enriched = redactLogEntry(this.enrichDeviceName(entry));
+			const enriched = {
+				...redactLogEntry(this.enrichDeviceName(entry)),
+				id: `${this.bootId}.${String(++this.seq)}`
+			};
 			if (this.isDestinationEnabled?.("log-buffer") !== false) this.ringBuffer.push(enriched);
 			if (this.gate.allowsDestination(enriched)) for (const entry of this.destinations) {
 				if (entry.addonId !== void 0 && this.isDestinationEnabled?.(entry.addonId) === false) continue;
@@ -16049,6 +16071,67 @@ function createChildrenBatchLoader(opts) {
 	} };
 }
 //#endregion
+//#region src/kernel/moleculer/accessory-prune-gate.ts
+function isSpecList(answer) {
+	return Array.isArray(answer);
+}
+function classifyAccessoryRead(answer, ctx) {
+	if (isSpecList(answer)) {
+		if (!ctx.online) return {
+			kind: "unknown",
+			reason: "parent offline",
+			children: answer
+		};
+		if (ctx.probedAt === 0) return {
+			kind: "unknown",
+			reason: "probe not yet completed",
+			children: answer
+		};
+		return {
+			kind: "successful",
+			children: answer
+		};
+	}
+	if (answer.kind === "unknown") return {
+		kind: "unknown",
+		reason: answer.reason,
+		children: answer.known ?? []
+	};
+	return {
+		kind: "successful",
+		children: answer.children
+	};
+}
+/** One per parent registration; in-memory on purpose (a restart starts over — the safe direction). */
+var AccessoryShrinkGate = class {
+	/** childId → the probe (`lastProbedAt`) of the first successful read that lacked it. */
+	#firstMissing = /* @__PURE__ */ new Map();
+	/**
+	* `missing` = the managed children a SUCCESSFUL read no longer lists. Never
+	* call this for an unknown read.
+	*/
+	decide(missing, probedAt) {
+		const missingSet = new Set(missing);
+		for (const id of [...this.#firstMissing.keys()]) if (!missingSet.has(id)) this.#firstMissing.delete(id);
+		const prune = [];
+		const deferred = [];
+		for (const id of missing) {
+			const first = this.#firstMissing.get(id);
+			if (first !== void 0 && probedAt > first) {
+				prune.push(id);
+				this.#firstMissing.delete(id);
+				continue;
+			}
+			if (first === void 0) this.#firstMissing.set(id, probedAt);
+			deferred.push(id);
+		}
+		return {
+			prune,
+			deferred
+		};
+	}
+};
+//#endregion
 //#region src/kernel/moleculer/runtime-state-load.ts
 /** A device build refused because its runtime state could not be loaded. */
 var RuntimeStateLoadError = class extends Error {
@@ -16771,6 +16854,7 @@ function createBrokerDeviceManagerApi(opts) {
 				throw err;
 			}
 			const lifecycleHost = device;
+			const shrinkGate = new AccessoryShrinkGate();
 			const runReconcile = async () => {
 				try {
 					await callDeviceManager(api, "registerDevice", {
@@ -16794,7 +16878,12 @@ function createBrokerDeviceManagerApi(opts) {
 					});
 				}
 				if (typeof lifecycleHost.getAccessoryChildren !== "function") return;
-				const specs = lifecycleHost.getAccessoryChildren();
+				const probedAt = device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0;
+				const read = classifyAccessoryRead(lifecycleHost.getAccessoryChildren(), {
+					online: device.online,
+					probedAt
+				});
+				const specs = read.children;
 				const expected = new Set(specs.map((s) => `${device.stableId}-${s.stableIdSuffix}`));
 				await runBounded(specs, ACCESSORY_SPAWN_CONCURRENCY, async (spec) => {
 					try {
@@ -16812,24 +16901,42 @@ function createBrokerDeviceManagerApi(opts) {
 						});
 					}
 				});
-				if ((device.runtimeState?.getCapState("feature-probe")?.lastProbedAt ?? 0) === 0 && specs.length === 0) {
-					opts.logger.debug("Accessory orphan reconciliation skipped — probe not yet completed", { tags: {
-						parentDeviceId: device.id,
-						parentStableId: device.stableId
-					} });
+				if (read.kind === "unknown") {
+					opts.logger.info("Accessory orphan reconciliation skipped — child list unknown", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							reason: read.reason,
+							probedAt
+						}
+					});
 					return;
 				}
 				try {
-					const currentChildren = await childrenLoader.load(device.id);
-					for (const child of currentChildren) {
-						if (child.linkDeviceId !== device.id) continue;
-						if (expected.has(child.stableId)) continue;
+					const missing = (await childrenLoader.load(device.id)).filter((child) => child.linkDeviceId === device.id && !expected.has(child.stableId));
+					const decision = shrinkGate.decide(missing.map((child) => child.id), probedAt);
+					if (decision.deferred.length > 0) opts.logger.info("Accessory children missing from a complete read — kept until a later probe agrees", {
+						tags: {
+							deviceId: device.id,
+							parentStableId: device.stableId
+						},
+						meta: {
+							childDeviceIds: [...decision.deferred],
+							probedAt
+						}
+					});
+					const confirmed = new Set(decision.prune);
+					for (const child of missing) {
+						if (!confirmed.has(child.id)) continue;
 						const live = registry.getById(child.id);
 						try {
 							if (live) await deviceApi.remove(child.id);
 							else await callDeviceManager(api, "removeDevice", { deviceId: child.id });
 							opts.logger.info("Removed orphan accessory child no longer in parent specs", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId
 								},
@@ -16842,6 +16949,7 @@ function createBrokerDeviceManagerApi(opts) {
 						} catch (err) {
 							opts.logger.warn("Failed to remove orphan accessory child", {
 								tags: {
+									deviceId: child.id,
 									parentDeviceId: device.id,
 									parentStableId: device.stableId,
 									childDeviceId: child.id
@@ -21301,7 +21409,7 @@ var LEVEL_ORDER = {
 	warn: 2,
 	error: 3
 };
-function levelRank(level) {
+function levelRank$1(level) {
 	return LEVEL_ORDER[level] ?? 0;
 }
 function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, tags = {}) {
@@ -21313,7 +21421,7 @@ function createUdsLoggerWithState(client, addonId, nodeId, levelState, scope, ta
 		...tags
 	};
 	function log(level, message, extras) {
-		if (levelRank(level) < levelRank(levelState.current)) return;
+		if (levelRank$1(level) < levelRank$1(levelState.current)) return;
 		const mergedTags = extras?.tags ? {
 			...baseTags,
 			...extras.tags
@@ -27009,6 +27117,10 @@ var en_default = {
 	"device.credentials-unavailable": "Device credentials not available",
 	"device.credential-not-found": "Device credential not found: {id}",
 	"storage.no-provider": "No storage provider configured",
+	"preferences.forbidden": "This credential cannot reach account preferences",
+	"preferences.unavailable": "Account preferences are not available",
+	"preferences.value-too-large": "This preference value is too large",
+	"preferences.too-many-namespaces": "Too many preference namespaces for this account",
 	"recording.export-unknown": "Unknown export \"{id}\"",
 	"recording.export-invalid-range": "Invalid time range {fromMs}..{toMs}",
 	"recording.export-no-profiles": "The export needs at least one stream profile",
@@ -27256,6 +27368,10 @@ var it_default = {
 	"device.credentials-unavailable": "Le credenziali del dispositivo non sono disponibili",
 	"device.credential-not-found": "Credenziale del dispositivo non trovata: {id}",
 	"storage.no-provider": "Nessun provider di archiviazione configurato",
+	"preferences.forbidden": "Questa credenziale non può accedere alle preferenze dell’account",
+	"preferences.unavailable": "Le preferenze dell’account non sono disponibili",
+	"preferences.value-too-large": "Il valore di questa preferenza è troppo grande",
+	"preferences.too-many-namespaces": "Troppi gruppi di preferenze per questo account",
 	"recording.export-unknown": "Esportazione \"{id}\" sconosciuta",
 	"recording.export-invalid-range": "Intervallo di tempo non valido {fromMs}..{toMs}",
 	"recording.export-no-profiles": "L'esportazione richiede almeno un profilo di flusso",
@@ -27572,8 +27688,6 @@ function resetCatalogRegistryForTests() {
 	shared = null;
 }
 //#endregion
-exports.ADMIN_TOKEN_MAX_LIFETIME_MS = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_MAX_LIFETIME_MS;
-exports.ADMIN_TOKEN_PREFIX = require_builtins_local_auth_local_auth_addon.ADMIN_TOKEN_PREFIX;
 exports.AGENT_CAP_FWD_ACTION = AGENT_CAP_FWD_ACTION;
 exports.AGENT_CAP_FWD_SERVICE = AGENT_CAP_FWD_SERVICE;
 exports.AGENT_DASHBOARD_ORIGINS_FIELD = require_builtins_system_config_system_config_addon.AGENT_DASHBOARD_ORIGINS_FIELD;
@@ -27598,7 +27712,6 @@ exports.AddonLoader = AddonLoader;
 exports.AddonManifest = AddonManifest;
 exports.AddonRefusedError = AddonRefusedError;
 exports.AddonRouteRegistry = AddonRouteRegistry;
-exports.AdminTokenManager = require_builtins_local_auth_local_auth_addon.AdminTokenManager;
 exports.AgentHttpsInstallError = require_agent_https.AgentHttpsInstallError;
 exports.AgentHttpsNames = require_agent_https.AgentHttpsNames;
 exports.AgentMdnsAdvertiser = AgentMdnsAdvertiser;
@@ -27775,7 +27888,6 @@ exports.STORAGE_DRAIN_STATE_LEGACY = require_builtins_storage_orchestrator_stora
 exports.STORE_READABLE_BOOTSTRAP_KEYS = STORE_READABLE_BOOTSTRAP_KEYS;
 exports.SYSTEM_SECRET_OWNER = require_device_ca.SYSTEM_SECRET_OWNER;
 exports.ScopedLogger = ScopedLogger;
-exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
 exports.SettingsReadUnavailableError = require_builtins_local_auth_local_auth_addon.SettingsReadUnavailableError;
 exports.SocketChannel = SocketChannel;
 exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
@@ -27823,6 +27935,7 @@ exports.attachUserManagementInternal = require_builtins_local_auth_local_auth_ad
 exports.attributeStall = require_custom_action_registry.attributeStall;
 exports.backupOrchestratorRecordKinds = require_restore_archive.backupOrchestratorRecordKinds;
 exports.backupRecordStoresOf = require_restore_archive.backupRecordStoresOf;
+exports.bareAddonOf = require_log_read_filter.bareAddonOf;
 exports.bindPendingLanHttp = require_hub_mdns_ciao.bindPendingLanHttp;
 exports.bootstrapSchema = bootstrapSchema;
 exports.brokerCallForCap = brokerCallForCap;
@@ -27871,6 +27984,7 @@ exports.clusterNodeHistoryRecordKind = clusterNodeHistoryRecordKind;
 exports.collectAgentNames = require_agent_https.collectAgentNames;
 exports.collectCertIdentity = require_agent_https.collectCertIdentity;
 exports.collectModelFiles = require_custom_action_registry.collectModelFiles;
+exports.compileLogFilter = require_log_read_filter.compileLogFilter;
 exports.computePairingCommitment = require_builtins_system_config_system_config_addon.computePairingCommitment;
 exports.computePairingSas = require_builtins_system_config_system_config_addon.computePairingSas;
 exports.connectBrokerTransport = connectBrokerTransport;
@@ -27980,6 +28094,7 @@ exports.evaluateExistingCert = require_agent_https.evaluateExistingCert;
 exports.expandCapMethods = require_dist.expandCapMethods;
 exports.exportMeshPrivateKeyPem = require_agent_https.exportMeshPrivateKeyPem;
 exports.fetchJson = require_custom_action_registry.fetchJson;
+exports.filterIsEmpty = require_log_read_filter.filterIsEmpty;
 exports.findAddonRefusal = findAddonRefusal;
 Object.defineProperty(exports, "findInPath", {
 	enumerable: true,
@@ -28090,10 +28205,14 @@ exports.issueMeshLeafForNode = require_agent_https.issueMeshLeafForNode;
 exports.issueMeshLeafFromCsr = require_agent_https.issueMeshLeafFromCsr;
 exports.keyFingerprintShort = require_builtins_system_config_system_config_addon.keyFingerprintShort;
 exports.leafFingerprintOf = require_hub_mdns_ciao.leafFingerprintOf;
+exports.levelRank = require_log_read_filter.levelRank;
+exports.lineContainsText = require_log_read_filter.lineContainsText;
+exports.lineMatches = require_log_read_filter.lineMatches;
 exports.loadAgentHttps = require_agent_https.loadAgentHttps;
 exports.loadDeviceCa = require_device_ca.loadDeviceCa;
 exports.loadMeshCa = require_agent_https.loadMeshCa;
 exports.loadTlsCert = require_hub_mdns_ciao.loadTlsCert;
+exports.localCaCommonName = require_agent_https.localCaCommonName;
 exports.localEndpointPath = localEndpointPath;
 exports.localProviderLink = localProviderLink;
 exports.localSupportedPythonRuntimes = localSupportedPythonRuntimes;
@@ -28106,6 +28225,7 @@ exports.normalizeIp = require_builtins_system_config_system_config_addon.normali
 exports.onProcessNodeRegistered = require_builtins_system_config_system_config_addon.onProcessNodeRegistered;
 exports.onSessionsRevoked = require_builtins_local_auth_local_auth_addon.onSessionsRevoked;
 exports.openMeshTlsWhenRevocationsLoaded = require_builtins_system_config_system_config_addon.openMeshTlsWhenRevocationsLoaded;
+exports.originNodeOf = require_log_read_filter.originNodeOf;
 exports.overlayGetStatus = overlayGetStatus;
 exports.parseAgentDashboardOrigins = require_builtins_system_config_system_config_addon.parseAgentDashboardOrigins;
 exports.parseCapAction = parseCapAction;
@@ -28119,6 +28239,7 @@ exports.pemDigest = require_agent_https.pemDigest;
 exports.permitsIdentity = require_agent_https.permitsIdentity;
 exports.permitsName = require_agent_https.permitsName;
 exports.pinnedHttpsCaFingerprint = require_agent_https.pinnedHttpsCaFingerprint;
+exports.preferencesLimitReasonOf = require_builtins_local_auth_local_auth_addon.preferencesLimitReasonOf;
 exports.prepareBootTls = require_hub_mdns_ciao.prepareBootTls;
 exports.prepareRestoreArchive = require_restore_archive.prepareRestoreArchive;
 exports.probePlatform = probePlatform;