@camstack/system 1.2.70 → 1.2.72

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as isCollectionArrayMethod, Ct as asNumber, Et as emitDownForOwnedCaps, Ft as resolveCapMount, G as lifecycleJobSchema, It as scopeKey, J as logLevelAtMost, L as extractNestedAddonId, Mt as parseJsonObject, Nt as parseJsonUnknown$1, Ot as expandCapMethods, Pt as readinessKey, Q as objectInputDeclaresAddonId, Rt as EventCategory$1, St as asJsonObject$1, Tt as createEvent, U as isVoidInput, V as isObjectInput, W as kebabToCamel, Y as looseSchema, bt as ReadinessTimeoutError, d as METHOD_ACCESS_MAP, dt as errMsg$1, f as RUNTIME_DEFAULTS, ht as DEVICE_STATUS_METHOD, mt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pt as DATAPLANE_SECRET_HEADER$1, t as ALL_CAPABILITY_DEFINITIONS, tt as procedureAuthKey, v as addonSettingsCapability, wt as asString$1, yt as ReadinessRegistry, z as isArrayOutputSchema } from "./dist-CnQXXnK1.mjs";
+import { At as expandCapMethods, B as isCollectionArrayMethod, Bt as EventCategory$1, Dt as createEvent, Et as asString$1, Ft as parseJsonUnknown$1, G as lifecycleJobSchema, It as readinessKey, J as logLevelAtMost, L as extractNestedAddonId, Lt as resolveCapMount, Ot as emitDownForOwnedCaps, Pt as parseJsonObject, Q as objectInputDeclaresAddonId, Rt as scopeKey, St as ReadinessTimeoutError, Tt as asNumber, U as isVoidInput, V as isObjectInput, W as kebabToCamel, Y as looseSchema, _t as DEVICE_STATUS_METHOD, d as METHOD_ACCESS_MAP, f as RUNTIME_DEFAULTS, gt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, ht as DATAPLANE_SECRET_HEADER$1, nt as scopesAllowAddon, pt as errMsg$1, rt as scopesAllowDeviceCap, t as ALL_CAPABILITY_DEFINITIONS, tt as procedureAuthKey, v as addonSettingsCapability, wt as asJsonObject$1, xt as ReadinessRegistry, z as isArrayOutputSchema } from "./dist-Daxx9CB0.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -24,7 +24,7 @@ import { SystemConfigAddon } from "./builtins/system-config/system-config.addon.
 import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-CuE_hBli.mjs";
-import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-DKrHcUZj.mjs";
+import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as runNpm, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as resolveNpmInvocation, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveAddonClass, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-C1DMs1J9.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";
@@ -175,16 +175,6 @@ function matchPath(pattern, path) {
 	return params;
 }
 //#endregion
-//#region src/auth/scope-matcher.ts
-/**
-* True if the scope set grants `access` on device-scoped capabilities.
-* A `category:device` grant covers every device cap (the broad grant).
-* Mirrors the OR-semantics of the existing token scope matcher.
-*/
-function scopesAllowDeviceCap(scopes, access) {
-	return scopes.some((s) => s.type === "category" && s.target === "device" && s.access.includes(access));
-}
-//#endregion
 //#region src/events/event-bus.ts
 var EventBus = class {
 	listeners = /* @__PURE__ */ new Map();
@@ -94938,4 +94928,4 @@ var LifecycleJobEngine = class {
 	}
 };
 //#endregion
-export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };
+export { AGENT_CAP_FWD_ACTION, AGENT_CAP_FWD_SERVICE, AGENT_READINESS_SERVICE_NAME, ALL_CAPABILITY_DEFINITIONS, AddonApiFactory, AddonDepsManager, AddonEngineManager, AddonHealthMonitor, AddonInstaller, AddonLoader, AddonManifest, AddonRouteRegistry, AlertCenterAddon, ApiKeyManager, AuthManager, CLUSTER_SECRET_MISMATCH_TYPE, CLUSTER_SECRET_REJECTED_EXIT_CODE, CORE_CAP_SERVICE_NAME, CapRouteError, CapRouteResolver, CapUsageRegistry, CapabilityHandle, CapabilityRegistry, CapabilityUnavailableError, ConfigManager, ConfigStore, ConsoleDestination, ConsoleLoggingAddon, CoreBlocksAddon, CustomActionRegistry, DEFAULT_DATA_PATH, DEVICE_SETTINGS_CONTRIBUTION_METHODS, DEVICE_STATUS_METHOD, DataPlaneRegistry, DeviceManagerAddon, DeviceRegistry, DeviceStore, EVENT_TOPIC_PREFIX, EngineManagerResolver, EventBus, FeatureManager, FilesystemStorageAddon, FilesystemStorageProvider, FrameDecoder, FsStorageBackend, HEALTH_MONITOR_GRACE_PERIOD_MS, HEALTH_MONITOR_RETRY_INTERVALS_MS, HEALTH_MONITOR_TICK_MS, HEAP_RECLAIM_MIN_INTERVAL_MS, HEAP_RECLAIM_TRIGGER_MB, HEAP_WATCH_INTERVAL_MS, HEAP_WATCH_WARN_RATIO, HUB_CAP_FWD_ACTION, HUB_CAP_FWD_SERVICE, HubForwarderAddon, HubForwarderDestination, HubLogForwarder, HubNodeRegistry, INFRA_CAPABILITIES, IntegrationRegistry, JobJournal, LifecycleJobEngine, LifecycleStateMachine, LivenessMonitorAddon, LocalAuthAddon, LocalChildClient, LocalChildRegistry, LogManager, LogRingBuffer, LokiDestination, LokiLoggingAddon, METHOD_ACCESS_MAP, ModelDownloadService, NATIVE_PROVIDER_SERVICE_INFIX, NATIVE_SCAN_DEPTH, NativeMetricsAddon, NativeMetricsProvider, NetworkQualityTracker, NotificationService, PYTHON_VERSION, PipelineRunner, PipelineValidator, PythonEnvManager, QUARANTINE_DIRNAME, RESTART_MARKER_FILE, RUNTIME_DEFAULTS, ReadinessRegistry, ReadinessTimeoutError, ReplEngine, RingBuffer, ScopedLogger, ScopedTokenManager, SocketChannel, SqliteSettingsAddon, SqliteSettingsBackend, StagingArea, StorageLocationManager, StorageManager, StorageOrchestratorAddon, StorageOrchestratorService, SystemConfigAddon, SystemEventBus, TRADITIONAL_NATIVE_PACKAGES, ToastService, UDS_NO_ROUTE_PREFIX, UdsLocalTransportClient, UdsLocalTransportServer, UserManager, WinstonDestination, WinstonLoggingAddon, __resetCapUsageRegistryForTests, adaptBrokerToCluster, addonSettingsCapability, bootstrapSchema, brokerCallForCap, brokerTransportLink, buildBinaryPath, buildCapRouters, buildHeapSample, buildLinkChain, buildNativeCapProxy, buildNodeManifest, buildStorageLocationRegistry, buildUdsNativeCapProxy, builderMountedCapNames, callRegisterNodeWithRetry, callWithServiceDiscovery, capActionName, capActionSuffix, capBareAction, capServiceName, classifyAddonDir, classifyCapRoute, clearPendingRestart, clusterEventTopic, clusterSecretMatches, collectModelFiles, contentTypeFor, copyDirRecursive, copyExtraFileDirs, createAddonContext, createAddonDataPlaneFacility, createAddonService, createAuthenticatedFileServer, createBroker, createBrokerDeviceManagerApi, createCoreCapService, createFileDataPlaneHandler, createHubCapForwardService, createHubService, createKernelHwAccel, createLocalTransport, createParentUnownedCallHandler, createProcessService, createReadinessService, createReadinessServiceForRegistry, createScopedProcessManager, createStreamProbeBrokerService, createUdsAddonContext, createUdsEventBridge, createUdsEventBus, createUdsLogger, createUdsLoggerWithControl, createV8Reclaimer, deleteModelFromDisk, deriveAgentListenPort, describeProviderKindDrift, detectWorkspacePackagesDir, downloadBinary, downloadFile, downloadModel, emitDownForOwnedCaps, encodeFrame, ensureAddonNativePrebuilds, ensureBinary, ensureDir, ensureFfmpeg, ensureLibraryBuilt, ensureModel, ensureNativePrebuilds, ensurePython, ensureTlsCert, expandCapMethods, fetchJson, findInPath, formatLogLine, getBrokerEventBus, getCapUsageRegistry, getFfmpegDownloadUrl, getModelFilePath, getMoleculerEventStats, getOrInitReadinessRegistry, getOrInitReadinessRegistryForClient, getPidStats, getPlatformInfo, getPythonDownloadUrl, getRestartMarkerPath, getSinglePidStats, getWorkerDeviceRegistry, hasDotNode, hashClusterSecret, installManifestNativeDeps, installManifestPythonDeps, installPackageFromNpm, installPythonPackages, installPythonRequirements, ipcChildLink, ipcParentLink, isAddonDeploySource, isArrayOutputSchema, isClusterSecretMismatchError, isCollectionArrayMethod, isInfraCapability, isModelDownloaded, isSourceNewer, loadTlsCert, localEndpointPath, localProviderLink, mountNativeCapService, parseCapAction, parseRangeHeader, parseTokenizedUrl, proxyToUpstream, quarantineAddonResidue, readPendingRestart, readinessKey, registerEventBusService, resolveFilePath, resolveHwAccel, resolveNpmInvocation, runNpm, scheduleSelfRestart, scopeKey, scopesAllowAddon, scopesAllowDeviceCap, selectAddonResidue, serializeTypedArrays, setHubConnected, setNodeEventInterest, shouldReclaim, startHeapWatch, strandedMb, stripCamstackDeps, subscribePassthrough, udsChildLogToWorkerEntry, validateProviderRegistrations, writePendingRestart };

package/dist/kernel/transport/local-child-registry.d.ts

@@ -95,6 +95,27 @@ export interface LocalChildRegistryOptions {
      * everything). The kernel has no cap registry, so the wiring side injects it.
      */
     readonly isAggregatedCollectionMethod?: (capName: string, method: string) => boolean;
+    /**
+     * Does this call carry an explicit `{ addonId }` selector naming the provider
+     * it wants? Such a call must NOT be short-circuited to a local sibling
+     * either: `resolveChildId` picks the FIRST-registered child for the cap name,
+     * which is the one thing the caller took the trouble to say it did not want.
+     * It goes to `onUnownedCall`, which resolves the named provider.
+     *
+     * The array-method bypass above and this one are the same defect seen twice.
+     * `broker.getBrokerConfig({id:'ha_001', addonId:'provider-homeassistant'})`
+     * from the Home Assistant export was answered by `provider-homematic` — which
+     * returns `null` for a broker it does not own, indistinguishable from "no
+     * such broker" — so the export could never open a link. Fixing only
+     * `onUnownedCall` did nothing, because this decision is made first: measured
+     * on the live hub with a deliberately bogus addonId, which came back `null`
+     * instead of refused (2026-08-09, [D105]).
+     *
+     * Omitted ⇒ prior behaviour exactly. The kernel has no cap registry, so the
+     * wiring side injects it, sharing the predicate with the handler that then
+     * performs the routing — a rule implemented twice is a rule that drifts.
+     */
+    readonly isAddonPinnedCall?: (capName: string, method: string, args: unknown) => boolean;
     /**
      * Per-cap-method bound for UDS cap calls, in ms — read from the cap
      * definition's declared `timeoutMs`. The SAME resolver the remote plane uses
@@ -130,6 +151,7 @@ export declare class LocalChildRegistry {
     private readonly ownNodeId?;
     /** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
     private readonly isAggregatedCollectionMethod?;
+    private readonly isAddonPinnedCall?;
     /** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
     private readonly capTimeoutMs?;
     /** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */

package/dist/kernel/transport/parent-unowned-call.d.ts

@@ -132,6 +132,33 @@ export interface ParentUnownedCallDeps {
      * so the two answers cannot drift).
      */
     readonly callCollectionAggregate?: (capName: string, method: string, args: unknown) => Promise<readonly unknown[] | null>;
+    /**
+     * Optional `{ addonId }` PIN for a collection cap's SCALAR method — the twin
+     * of {@link callCollectionAggregate}, for the same reason.
+     *
+     * On a system-scoped collection cap `addonId` is not provider data: the
+     * codegen injects it as the `{nodeId?, addonId?}` selector on every method,
+     * and the hub's tRPC cap-router routes by it. This handler lifted only
+     * `nodeId` and `deviceId` out of a child's args, so a forked addon's pin was
+     * DISCARDED IN SILENCE and the call was answered by whichever provider
+     * registered first. `broker.getBrokerConfig({id:'ha_001', addonId:'provider-
+     * homeassistant'})` therefore returned Homematic's `null` — indistinguishable
+     * from "no such broker" — and the Home Assistant export could never open a
+     * link. Every write-up that "proved the pin works" had measured the hub's
+     * tRPC surface, never this path (2026-08-09).
+     *
+     * Returns a `{ value }` box so a legitimate `null` result is distinguishable
+     * from "not a pinned collection call, route normally", and THROWS when the
+     * pin names a non-provider — a pin that silently degrades to another
+     * provider's answer is worse than no pin. Array methods are never pinned
+     * here: their contract is the union above.
+     *
+     * The kernel layer has no cap registry, so the wiring side injects this and
+     * it shares the tRPC path's provider resolution — the two must not drift.
+     */
+    readonly callPinnedCollection?: (capName: string, method: string, args: unknown) => Promise<{
+        readonly value: unknown;
+    } | null>;
     /**
      * Optional predicate — returns `true` when `capName` is a HUB-CORE `$`-service
      * cap (`system`, `addons`, `nodes`, `capabilities`, `stream-probe`, …): served

package/dist/{manifest-python-deps-DKrHcUZj.mjs → manifest-python-deps-C1DMs1J9.mjs}

@@ -4438,6 +4438,7 @@ var LocalChildRegistry = class {
 	ownNodeId;
 	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
 	isAggregatedCollectionMethod;
+	isAddonPinnedCall;
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
@@ -4469,6 +4470,7 @@ var LocalChildRegistry = class {
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.isAddonPinnedCall = opts.isAddonPinnedCall;
 			this.capTimeoutMs = opts.capTimeoutMs;
 		} else {
 			this.server = serverOrOptions;
@@ -4842,7 +4844,9 @@ var LocalChildRegistry = class {
 				};
 				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
-				if ((!(pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true) && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				if ((!aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -5421,6 +5425,8 @@ function createParentUnownedCallHandler(deps) {
 			if (empty != null) return empty;
 			const aggregate = await deps.callCollectionAggregate?.(input.capName, input.method, input.args);
 			if (aggregate != null) return aggregate;
+			const pinned = await deps.callPinnedCollection?.(input.capName, input.method, input.args);
+			if (pinned !== null && pinned !== void 0) return pinned.value;
 		}
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {

package/dist/{manifest-python-deps-DafB-1hp.js → manifest-python-deps-DG_LLcZF.js}

@@ -4440,6 +4440,7 @@ var LocalChildRegistry = class {
 	ownNodeId;
 	/** See {@link LocalChildRegistryOptions.isAggregatedCollectionMethod}. */
 	isAggregatedCollectionMethod;
+	isAddonPinnedCall;
 	/** See {@link LocalChildRegistryOptions.capTimeoutMs}. */
 	capTimeoutMs;
 	/** Tracks capNames already logged as UDS-routed; one INFO line per capName per process. */
@@ -4471,6 +4472,7 @@ var LocalChildRegistry = class {
 			this.resolveChildIdForAddon = opts.resolveChildIdForAddon;
 			this.ownNodeId = opts.ownNodeId;
 			this.isAggregatedCollectionMethod = opts.isAggregatedCollectionMethod;
+			this.isAddonPinnedCall = opts.isAddonPinnedCall;
 			this.capTimeoutMs = opts.capTimeoutMs;
 		} else {
 			this.server = serverOrOptions;
@@ -4844,7 +4846,9 @@ var LocalChildRegistry = class {
 				};
 				const pinnedNodeId = out.nodeId ?? extractNodeId(out.args);
 				const pinTargetsThisNode = pinnedNodeId !== void 0 && this.ownNodeId !== void 0 && pinnedNodeId === this.ownNodeId;
-				if ((!(pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true) && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
+				const aggregated = pinnedNodeId === void 0 && this.isAggregatedCollectionMethod?.(out.capName, out.method) === true;
+				const addonPinned = pinnedNodeId === void 0 && this.isAddonPinnedCall?.(out.capName, out.method, out.args) === true;
+				if ((!aggregated && !addonPinned && (pinnedNodeId === void 0 || pinTargetsThisNode) ? this.resolveChildId(out.capName, out.deviceId) : null) !== null) {
 					if (!this.egressRoutedCaps.has(out.capName)) {
 						this.egressRoutedCaps.add(out.capName);
 						this.logger?.info("routed child egress over UDS", { capName: out.capName });
@@ -5423,6 +5427,8 @@ function createParentUnownedCallHandler(deps) {
 			if (empty != null) return empty;
 			const aggregate = await deps.callCollectionAggregate?.(input.capName, input.method, input.args);
 			if (aggregate != null) return aggregate;
+			const pinned = await deps.callPinnedCollection?.(input.capName, input.method, input.args);
+			if (pinned !== null && pinned !== void 0) return pinned.value;
 		}
 		const resolver = deps.getResolver();
 		if (resolver !== null) try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.70",
+  "version": "1.2.72",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",