@camstack/addon-remote-storage 1.2.76 → 1.2.78

package/dist/s3.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-DlUg7bET.js");
+const require_shared = require("./shared-D7aelvq0.js");
 let node_stream = require("node:stream");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_lib_storage = require("@aws-sdk/lib-storage");

package/dist/s3.addon.mjs

@@ -1,4 +1,4 @@
-import { c as BaseAddon, i as rearmIdleAbort, n as getOptionalBasePath, o as scheduleIdleAbort, s as storageProviderCapability, t as createSessionId } from "./shared-Ch1dJcLf.mjs";
+import { c as BaseAddon, i as rearmIdleAbort, n as getOptionalBasePath, o as scheduleIdleAbort, s as storageProviderCapability, t as createSessionId } from "./shared-C5_1Zy4l.mjs";
 import { PassThrough } from "node:stream";
 import { DeleteObjectCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client } from "@aws-sdk/client-s3";
 import { Upload } from "@aws-sdk/lib-storage";

package/dist/sftp.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-DlUg7bET.js");
+const require_shared = require("./shared-D7aelvq0.js");
 let ssh2 = require("ssh2");
 let node_path = require("node:path");
 node_path = require_shared.__toESM(node_path);

package/dist/sftp.addon.mjs

@@ -1,4 +1,4 @@
-import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-Ch1dJcLf.mjs";
+import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-C5_1Zy4l.mjs";
 import { Client } from "ssh2";
 import * as path from "node:path";
 //#region src/providers/sftp/sftp-config-schema.ts

package/dist/{shared-Ch1dJcLf.mjs → shared-C5_1Zy4l.mjs}

@@ -7600,111 +7600,6 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -8650,8 +8545,11 @@ var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -8672,21 +8570,20 @@ var StorageLocationSchema = object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: string().optional(),
-	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -8699,10 +8596,12 @@ var StorageLocationSchema = object({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({ isDefault: boolean().optional() });
 /**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -8878,6 +8777,111 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10534,12 +10538,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10702,8 +10724,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10752,14 +10782,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -21523,7 +21546,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -34432,12 +34455,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",

package/dist/{shared-DlUg7bET.js → shared-D7aelvq0.js}

@@ -7623,111 +7623,6 @@ var CameraSwitchGroupSchema = object({
 	fetchedAt: number()
 });
 /**
-* Per-component log CHANNELS — the gate a hot path consults, and the registry
-* an addon declares its channels in.
-*
-* ## Two axes, deliberately separated
-*
-* - **DECLARATION** — which channels exist. Only the addon knows:
-*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
-*   baichuan/handshake. A hand-wired central list rots at the first addition,
-*   and rots silently. So a channel is declared where it is consulted, and the
-*   `log-channels` capability enumerates the declarations.
-* - **VALUE** — at which level, for which scope, until when. That stays ONE
-*   thing: the logging settings document on the `system` cap. Two authorities
-*   over the values is the exact defect
-*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
-*   remove; re-introducing it from the cure side would be grotesque.
-*
-* Nothing in this file reads a clock, an env var or a store. The registry is
-* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
-* the hot path with a value somebody actually read, and by
-* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
-* never reaches here, so it can neither disarm an armed channel nor arm a
-* disarmed one (D49).
-*
-* ## The canonical call shape
-*
-* ```ts
-* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
-*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
-* }
-* ```
-*
-* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
-* read. Disarmed, a call site costs one load and one branch, and the `extras`
-* object literal is never constructed because it lives inside the branch. It
-* is the same shape already proven in production at `stream-broker.ts:1650`,
-* and the same discipline `LoggingGate.allowsDestination` uses for the
-* destination floor (measured at 1.93 ns/call when off).
-*
-* ## Why a channel emits at `info`
-*
-* `loki-logging.addon.ts` pins the destination default at `info` and
-* `loki-destination.ts` drops everything below it, so a line emitted at
-* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
-* minutes. A diagnostic that cannot be read an hour later is worse than no
-* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
-* emits at the channel's declared level, whose schema floor is `info`.
-*/
-/**
-* The level a channel writes at once armed.
-*
-* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
-* not leave the process for Loki, and the whole point of arming a channel is
-* to read it later.
-*/
-var LogChannelLevelSchema = _enum([
-	"info",
-	"warn",
-	"error"
-]);
-/**
-* What an addon declares about one channel. No value, no state — a
-* declaration is inert.
-*/
-var LogChannelDescriptorSchema = object({
-	/**
-	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
-	* the addon's short name so an operator reading a channel list can tell who
-	* owns it without a second lookup.
-	*/
-	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
-	/** One sentence: what the operator will SEE after arming it. */
-	description: string().min(1),
-	/** The level its lines are emitted at. Never below `info`. */
-	defaultLevel: LogChannelLevelSchema,
-	/**
-	* Whether this channel can be narrowed to a camera.
-	*
-	* `true` is a PROMISE with two halves, and both must hold: the gate is
-	* consulted with the numeric device id, AND every line the channel admits
-	* carries `tags: { deviceId }` with that same numeric id. The second half is
-	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
-	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
-	* the body is the only way to filter.
-	*
-	* A channel whose lines carry the device only in `meta` (or not at all) is
-	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
-	* the operator narrows to one camera, sees nothing, and concludes the code
-	* path was never taken.
-	*/
-	perDevice: boolean()
-});
-/**
-* An armed window over one channel, as the document hands it to a mirror.
-*
-* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
-* expires by itself, which is the one failure a boolean cannot avoid.
-*/
-var LogChannelWindowSchema = object({
-	channel: string().min(1),
-	/** Epoch ms the window closes at. */
-	armedUntilMs: number(),
-	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
-	deviceIds: array(number().int()).readonly().nullable()
-});
-/**
 * Ops-log — the durable, append-only operations audit shared by the
 * recordings and events management surfaces.
 *
@@ -8673,8 +8568,11 @@ var StorageLocationTypeSchema = string().regex(/^[a-z][a-zA-Z0-9-]*$/);
 * `STORAGE_LOCATION_CARDINALITY` map has been removed.
 *
 * `id` is a stable namespaced string of the form `<type>:<slug>`.
-* The default location for a type uses `id === <type>:default` by
-* convention (the bare type ref like `'backups'` resolves to it).
+* The seed names its first instance `<type>:default` — a NAME, not a flag.
+* There is no default location any more (D383): `enabled` is the whole write
+* model, and a bare type ref resolves to the sole location of the type, or —
+* transitionally, only while legacy NULL-stamped rows exist — to the row whose
+* slug is `default`.
 *
 * `isSystem` is a legacy persisted flag. Seed still creates the initial
 * `<type>:default` locations; the flag is no longer a lock, a badge, or a
@@ -8695,21 +8593,20 @@ var StorageLocationSchema = object({
 	* flag at upsert time, not here (the schema is provider-agnostic).
 	*/
 	nodeId: string().optional(),
-	isDefault: boolean().default(false),
 	isSystem: boolean().default(false),
 	/**
-	* Operator opt-in: whether consumers that BALANCE across several locations
-	* of a type may write here. Recordings reads it today; event media and
-	* backups are the next consumers, which is why the flag lives on the
-	* location rather than in any one addon's store — nothing has to be
-	* extended to add the next consumer.
+	* THE write switch, and the only one (D383). `enabled: true` means every
+	* consumer that chooses a write target for this type may write here, and all
+	* enabled locations of a type are used TOGETHER; `false` means read-only —
+	* still read, still played back, still age-swept, still drained, never
+	* written.
 	*
-	* OPTIONAL, and ABSENT MEANS ACTIVE. Every location persisted before the
-	* flag existed reads back with no flag and keeps working exactly as before;
-	* that is the whole compat story, and it is why no migration ships with it.
-	* A newly CREATED sibling is stamped `false` by the orchestrator (creating a
-	* disk must not silently start writing to it); the default of a type is
-	* always stamped `true`.
+	* OPTIONAL only for the wire: an upsert that omits it means "leave what is
+	* stored" on an update and "born inert unless it is the first location of its
+	* type" on a create. On a PERSISTED row absence is legacy and it means
+	* enabled — {@link isLocationEnabled} is the one place that says so, and the
+	* orchestrator stamps every flagless row `true` once at hydrate so absence
+	* stops existing rather than being re-derived on every read.
 	*/
 	enabled: boolean().optional(),
 	/** COMPUTED at read time by the orchestrator (statfs of the backing volume
@@ -8722,10 +8619,12 @@ var StorageLocationSchema = object({
 	createdAt: number(),
 	updatedAt: number()
 });
+object({ isDefault: boolean().optional() });
 /**
 * Reference accepted by consumer-facing `api.storage.*` calls.
 * Either:
-*  - a `StorageLocationType` (e.g. `'backups'`) → orchestrator resolves to the default of that type
+*  - a `StorageLocationType` (e.g. `'backups'`) → the sole location of that type
+*    (transitionally, the `<type>:default`-slugged row when several exist)
 *  - a fully-qualified id (e.g. `'backups:nas-01'`) → addresses a specific instance
 *
 * The orchestrator's `resolveRef(ref)` handles both cases.
@@ -8901,6 +8800,111 @@ var DecoderSessionConfigSchema = object({
 	*/
 	debug: boolean().optional()
 });
+/**
+* Per-component log CHANNELS — the gate a hot path consults, and the registry
+* an addon declares its channels in.
+*
+* ## Two axes, deliberately separated
+*
+* - **DECLARATION** — which channels exist. Only the addon knows:
+*   `stream-broker` knows webrtc/ICE/RTP, `provider-reolink` knows
+*   baichuan/handshake. A hand-wired central list rots at the first addition,
+*   and rots silently. So a channel is declared where it is consulted, and the
+*   `log-channels` capability enumerates the declarations.
+* - **VALUE** — at which level, for which scope, until when. That stays ONE
+*   thing: the logging settings document on the `system` cap. Two authorities
+*   over the values is the exact defect
+*   `docs/design/plans/2026-08-26-logging-per-componente.md` was written to
+*   remove; re-introducing it from the cure side would be grotesque.
+*
+* Nothing in this file reads a clock, an env var or a store. The registry is
+* a MIRROR: it is moved only by {@link LogChannelRegistry.apply}, called off
+* the hot path with a value somebody actually read, and by
+* {@link LogChannelRegistry.tick}, called on a timer. A store read that fails
+* never reaches here, so it can neither disarm an armed channel nor arm a
+* disarmed one (D49).
+*
+* ## The canonical call shape
+*
+* ```ts
+* if (CH_RTP.on && CH_RTP.wants(deviceId)) {
+*   CH_RTP.log(logger, 'rtp subscriber added', { tags: { deviceId }, meta: { ssrc } })
+* }
+* ```
+*
+* `on` is a plain boolean FIELD — never a getter — and it is the FIRST thing
+* read. Disarmed, a call site costs one load and one branch, and the `extras`
+* object literal is never constructed because it lives inside the branch. It
+* is the same shape already proven in production at `stream-broker.ts:1650`,
+* and the same discipline `LoggingGate.allowsDestination` uses for the
+* destination floor (measured at 1.93 ns/call when off).
+*
+* ## Why a channel emits at `info`
+*
+* `loki-logging.addon.ts` pins the destination default at `info` and
+* `loki-destination.ts` drops everything below it, so a line emitted at
+* `debug` never reaches Loki and the hub's in-memory ring only holds ~35
+* minutes. A diagnostic that cannot be read an hour later is worse than no
+* diagnostic, because it looks done. {@link LogChannelGate.log} therefore
+* emits at the channel's declared level, whose schema floor is `info`.
+*/
+/**
+* The level a channel writes at once armed.
+*
+* `debug` is absent ON PURPOSE and not by omission: below `info` the line does
+* not leave the process for Loki, and the whole point of arming a channel is
+* to read it later.
+*/
+var LogChannelLevelSchema = _enum([
+	"info",
+	"warn",
+	"error"
+]);
+/**
+* What an addon declares about one channel. No value, no state — a
+* declaration is inert.
+*/
+var LogChannelDescriptorSchema = object({
+	/**
+	* Dotted `area.thing`, unique across the workspace. `area` is conventionally
+	* the addon's short name so an operator reading a channel list can tell who
+	* owns it without a second lookup.
+	*/
+	name: string().min(3).regex(/^[a-z0-9-]+(\.[a-z0-9-]+)+$/, "a channel name is dotted lower-kebab, e.g. area.thing"),
+	/** One sentence: what the operator will SEE after arming it. */
+	description: string().min(1),
+	/** The level its lines are emitted at. Never below `info`. */
+	defaultLevel: LogChannelLevelSchema,
+	/**
+	* Whether this channel can be narrowed to a camera.
+	*
+	* `true` is a PROMISE with two halves, and both must hold: the gate is
+	* consulted with the numeric device id, AND every line the channel admits
+	* carries `tags: { deviceId }` with that same numeric id. The second half is
+	* what makes `| json | deviceId="617"` work in Loki — `loki-payload.ts`
+	* keeps `deviceId` out of the stream labels for cardinality, so the tag in
+	* the body is the only way to filter.
+	*
+	* A channel whose lines carry the device only in `meta` (or not at all) is
+	* declared `false`. Declaring it `true` anyway would be a lie the UI repeats:
+	* the operator narrows to one camera, sees nothing, and concludes the code
+	* path was never taken.
+	*/
+	perDevice: boolean()
+});
+/**
+* An armed window over one channel, as the document hands it to a mirror.
+*
+* A window is a DEADLINE, never a flag (ADR-0244): a channel somebody forgot
+* expires by itself, which is the one failure a boolean cannot avoid.
+*/
+var LogChannelWindowSchema = object({
+	channel: string().min(1),
+	/** Epoch ms the window closes at. */
+	armedUntilMs: number(),
+	/** `null` = every camera. A non-empty list narrows to those numeric ids. */
+	deviceIds: array(number().int()).readonly().nullable()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -10557,12 +10561,30 @@ var BackupDestinationInfoSchema = object({
 	lastSuccessAt: number().optional(),
 	/** Newest-archive size from `manifests.json`, or undefined. */
 	lastSuccessSizeBytes: number().optional(),
-	/** Per-destination cron expression. Empty = manual-only (no schedule). */
+	/**
+	* Cron cadence(s) of the ENABLED schedules that fan out to this
+	* destination, comma-joined. Absent when no enabled schedule targets it
+	* — a destination nothing is scheduled to write to must not advertise a
+	* cadence (D384). This is never the `backup_destination_policies.cron`
+	* column: that per-location cron has scheduled nothing since 2026-07-28
+	* and reading it made a destination with a DISABLED schedule claim a
+	* nightly run.
+	*/
 	cron: string().optional(),
-	/** ms-epoch of next computed firing for this destination's cron, if any. */
+	/** ms-epoch of the next firing across those schedules (earliest), if any. */
 	nextRunAt: number().optional(),
-	/** ms-epoch of last successful scheduled run (mirrors policy.lastRunAt). */
-	lastRunAt: number().optional()
+	/**
+	* ms-epoch of the last time a run ATTEMPTED to write here — success or
+	* failure. Never a success stamp: pair it with `lastSuccessAt` (the
+	* newest archive that actually landed) and `lastError`.
+	*/
+	lastAttemptAt: number().optional(),
+	/**
+	* Why the last attempt failed, verbatim. Absent when the last attempt
+	* landed the archive. A destination that has never been written to has
+	* neither this nor `lastAttemptAt`.
+	*/
+	lastError: string().optional()
 });
 /**
 * Per-archive entry returned by `backup.listArchives({ destinationId })`.
@@ -10725,8 +10747,16 @@ var BackupScheduleSchema = object({
 	retentionCount: number().int().min(1).max(1e3),
 	/** Optional subset of source locations to include; omitted = all. */
 	dataSources: array(string()).readonly().optional(),
-	/** ms-epoch of last successful run. */
-	lastRunAt: number().optional(),
+	/**
+	* ms-epoch of the last tick that FIRED this schedule. Stamped before the
+	* archive runs (it is the dedupe anchor), so it says "attempted", never
+	* "succeeded" — a run refused by every destination stamps it too.
+	*/
+	lastAttemptAt: number().optional(),
+	/** ms-epoch of the last run of this schedule that landed at ≥1 destination. */
+	lastSuccessAt: number().optional(),
+	/** Why the last fired run failed, verbatim. Absent when it succeeded. */
+	lastError: string().optional(),
 	/** ms-epoch of next computed firing (read-only, filled on list). */
 	nextRunAt: number().optional()
 });
@@ -10775,14 +10805,7 @@ method(_void(), array(BackupDestinationInfoSchema).readonly(), { auth: "admin" }
 	locationId: string(),
 	enabled: boolean(),
 	retentionCount: number().int().min(1).max(1e3),
-	label: string().optional(),
-	/**
-	* Per-destination cron expression. Empty string clears the
-	* schedule (manual-only). Validated server-side via croner;
-	* malformed expressions reject the upsert with an actionable
-	* message.
-	*/
-	cron: string().optional()
+	label: string().optional()
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
@@ -21546,7 +21569,7 @@ method(object({
 	downloadId: string(),
 	offset: number(),
 	length: number()
-}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(object({ type: StorageLocationTypeSchema }), StorageLocationSchema.nullable()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
+}), _instanceof(Uint8Array)), method(object({ downloadId: string() }), _void(), { kind: "mutation" }), method(object({ type: StorageLocationTypeSchema.optional() }), array(StorageLocationSchema).readonly()), method(_void(), array(StorageLocationDeclarationSchema).readonly()), method(StorageLocationSchema.omit({
 	createdAt: true,
 	updatedAt: true
 }), StorageLocationSchema, {
@@ -34455,12 +34478,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"storage.getDefaultLocation": {
-		capName: "storage",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
 	"storage.list": {
 		capName: "storage",
 		capScope: "system",

package/dist/smb.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-DlUg7bET.js");
+const require_shared = require("./shared-D7aelvq0.js");
 let node_crypto = require("node:crypto");
 let node_path = require("node:path");
 node_path = require_shared.__toESM(node_path);
@@ -225,6 +225,28 @@ function shareIdentity(input) {
 function pathSegments(remotePath) {
 	return remotePath.split("/").filter((s) => s.length > 0);
 }
+/**
+* Turn a directory path into the MASK `smbclient dir` needs to enumerate it.
+*
+* `samba-client`'s `list(x)` runs `smbclient -c 'dir x'`, and smbclient's
+* `dir` argument is a wildcard mask evaluated against the current directory —
+* it does NOT descend into a directory named by it. A bare directory path
+* therefore returns that directory's own entry, and an empty string returns
+* nothing at all, because an empty mask matches nothing.
+*
+* Measured on the hub, 2026-09-07: `backups:smb` held a 387 MB archive and a
+* `manifests.json`; `storage.list` answered `[]` and `storage.exists`
+* answered `false`, so every SMB upload was refused by its own post-transfer
+* "did it land?" check even though the bytes were intact on the share. The
+* unit suite was green because its fake client treated the argument as a
+* directory — the fake supplied the semantics production assumed and
+* smbclient does not have.
+*
+* @param dir `''` for the connection's basePath, else a relative directory.
+*/
+function listMaskFor(dir) {
+	return dir === "" ? "*" : `${dir}/*`;
+}
 //#endregion
 //#region src/providers/smb/smb-provider.ts
 /**
@@ -484,7 +506,7 @@ var SmbStorageProvider = class {
 		const client = await this.clientForLocation(location);
 		const dir = safeSmbRelativePath(prefix ?? "");
 		try {
-			return (await client.list(dir)).filter((e) => e.name !== "." && e.name !== "..").map((e) => dir === "" ? e.name : `${dir}/${e.name}`);
+			return (await client.list(listMaskFor(dir))).filter((e) => e.name !== "." && e.name !== "..").map((e) => dir === "" ? e.name : `${dir}/${e.name}`);
 		} catch (err) {
 			if (isNotFound(err)) return [];
 			this.logger.warn("smb-storage: list failed", { meta: {
@@ -682,14 +704,19 @@ var SmbStorageProvider = class {
 			...cfg.basePath !== "" ? { directory: cfg.basePath } : {}
 		});
 	}
-	/** One entry of a remote listing, or `null` when the path does not exist. */
+	/**
+	* One entry of a remote listing, or `null` when the path does not exist.
+	*
+	* Goes through {@link listMaskFor} — a bare directory path is NOT a
+	* listable argument for smbclient.
+	*/
 	async statRemote(location, relativePath) {
 		const client = await this.clientForLocation(location);
 		const target = safeSmbRelativePath(relativePath);
 		const dir = target.includes("/") ? target.slice(0, target.lastIndexOf("/")) : "";
 		const name = target.includes("/") ? target.slice(target.lastIndexOf("/") + 1) : target;
 		try {
-			return (await client.list(dir)).find((e) => e.name.toLowerCase() === name.toLowerCase()) ?? null;
+			return (await client.list(listMaskFor(dir))).find((e) => e.name.toLowerCase() === name.toLowerCase()) ?? null;
 		} catch (err) {
 			if (isNotFound(err)) return null;
 			throw err;

package/dist/smb.addon.mjs

@@ -1,4 +1,4 @@
-import { c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, s as storageProviderCapability } from "./shared-Ch1dJcLf.mjs";
+import { c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, s as storageProviderCapability } from "./shared-C5_1Zy4l.mjs";
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
 import * as fsp from "node:fs/promises";
@@ -218,6 +218,28 @@ function shareIdentity(input) {
 function pathSegments(remotePath) {
 	return remotePath.split("/").filter((s) => s.length > 0);
 }
+/**
+* Turn a directory path into the MASK `smbclient dir` needs to enumerate it.
+*
+* `samba-client`'s `list(x)` runs `smbclient -c 'dir x'`, and smbclient's
+* `dir` argument is a wildcard mask evaluated against the current directory —
+* it does NOT descend into a directory named by it. A bare directory path
+* therefore returns that directory's own entry, and an empty string returns
+* nothing at all, because an empty mask matches nothing.
+*
+* Measured on the hub, 2026-09-07: `backups:smb` held a 387 MB archive and a
+* `manifests.json`; `storage.list` answered `[]` and `storage.exists`
+* answered `false`, so every SMB upload was refused by its own post-transfer
+* "did it land?" check even though the bytes were intact on the share. The
+* unit suite was green because its fake client treated the argument as a
+* directory — the fake supplied the semantics production assumed and
+* smbclient does not have.
+*
+* @param dir `''` for the connection's basePath, else a relative directory.
+*/
+function listMaskFor(dir) {
+	return dir === "" ? "*" : `${dir}/*`;
+}
 //#endregion
 //#region src/providers/smb/smb-provider.ts
 /**
@@ -477,7 +499,7 @@ var SmbStorageProvider = class {
 		const client = await this.clientForLocation(location);
 		const dir = safeSmbRelativePath(prefix ?? "");
 		try {
-			return (await client.list(dir)).filter((e) => e.name !== "." && e.name !== "..").map((e) => dir === "" ? e.name : `${dir}/${e.name}`);
+			return (await client.list(listMaskFor(dir))).filter((e) => e.name !== "." && e.name !== "..").map((e) => dir === "" ? e.name : `${dir}/${e.name}`);
 		} catch (err) {
 			if (isNotFound(err)) return [];
 			this.logger.warn("smb-storage: list failed", { meta: {
@@ -675,14 +697,19 @@ var SmbStorageProvider = class {
 			...cfg.basePath !== "" ? { directory: cfg.basePath } : {}
 		});
 	}
-	/** One entry of a remote listing, or `null` when the path does not exist. */
+	/**
+	* One entry of a remote listing, or `null` when the path does not exist.
+	*
+	* Goes through {@link listMaskFor} — a bare directory path is NOT a
+	* listable argument for smbclient.
+	*/
 	async statRemote(location, relativePath) {
 		const client = await this.clientForLocation(location);
 		const target = safeSmbRelativePath(relativePath);
 		const dir = target.includes("/") ? target.slice(0, target.lastIndexOf("/")) : "";
 		const name = target.includes("/") ? target.slice(target.lastIndexOf("/") + 1) : target;
 		try {
-			return (await client.list(dir)).find((e) => e.name.toLowerCase() === name.toLowerCase()) ?? null;
+			return (await client.list(listMaskFor(dir))).find((e) => e.name.toLowerCase() === name.toLowerCase()) ?? null;
 		} catch (err) {
 			if (isNotFound(err)) return null;
 			throw err;

package/dist/webdav.addon.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_shared = require("./shared-DlUg7bET.js");
+const require_shared = require("./shared-D7aelvq0.js");
 let node_stream = require("node:stream");
 let webdav = require("webdav");
 //#region src/providers/webdav/webdav-config-schema.ts

package/dist/webdav.addon.mjs

@@ -1,4 +1,4 @@
-import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-Ch1dJcLf.mjs";
+import { a as safeJoinRemotePath, c as BaseAddon, i as rearmIdleAbort, o as scheduleIdleAbort, r as getRequiredBasePath, s as storageProviderCapability, t as createSessionId } from "./shared-C5_1Zy4l.mjs";
 import { PassThrough } from "node:stream";
 import { AuthType, createClient } from "webdav";
 //#region src/providers/webdav/webdav-config-schema.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-remote-storage",
-  "version": "1.2.76",
+  "version": "1.2.78",
   "description": "Remote storage providers (SFTP, S3, WebDAV, SMB) — unifies remote backends behind the storage-provider cap",
   "keywords": [
     "camstack",