@camstack/system 1.2.107 → 1.2.108

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -4,6 +4,7 @@ Object.defineProperties(exports, {
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
 const require_dist = require("../../dist-Ctfhlrtl.js");
+const require_retired_settings_keys = require("../../retired-settings-keys-pNmoHPTg.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");
@@ -84,181 +85,6 @@ var SQLITE_MMAP_SIZE_BYTES = 268435456;
 */
 var SQLITE_JOURNAL_SIZE_LIMIT_BYTES = 67108864;
 //#endregion
-//#region src/builtins/sqlite-storage/retired-settings-keys.ts
-/**
-* Is THIS node the one whose settings store is the cluster's authority?
-*
-* Mirrors `resolveNodeRole` (server/backend `node-role.ts`) — unset or `'hub'`
-* means hub, which is the launcher's own default. It is duplicated rather than
-* imported because `@camstack/system` is a dependency OF the backend, not the
-* other way round; the parse is four lines and the env var is the contract.
-*
-* Anything else answers `false`. Skipping where the purge should have run is a
-* missed cleanup the next hub boot fixes; running where it should not have is a
-* write to a store this node does not own. Only one of those is recoverable.
-*/
-function settingsStoreIsAuthoritativeHere(env) {
-	const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
-	return raw === "" || raw === "hub";
-}
-/**
-* The dead keys, per row.
-*
-* `detection-pipeline` / `addon-settings` / `root` — every key in this row is
-* dead; the row itself is kept because the addon writes live keys into it
-* (`pipelineTemplates`, `videoPipelineSteps`).
-*
-*  - `pipelineSteps` / `pipelineEngine`: the persisted GLOBAL step + engine
-*    seed. Removed with `getGlobalSteps` becoming pure — dispatch builds steps
-*    from the orchestrator's `agentSettings` plus per-camera overrides, and
-*    never consulted the seed. See `addon-pipeline/src/detection-pipeline/provider.ts`.
-*  - `engineRuntime` / `engineBackend` / `engineDevice` / `probedBestEngine`:
-*    the per-node engine CASCADE, removed with the operator-facing engine
-*    election. Each node now runs a device-array of inference pools balanced
-*    per session, and the node-default pool derives live from the node's own
-*    hardware (`resolveAutoEngine`). See
-*    `addon-pipeline/src/detection-pipeline/engine-store-keys.ts`.
-*/
-var RETIRED_SETTINGS_KEYS = [{
-	namespace: "detection-pipeline",
-	collection: "addon-settings",
-	row: "root",
-	keys: ["pipelineSteps", "pipelineEngine"],
-	perNodeKeys: [
-		"engineRuntime",
-		"engineBackend",
-		"engineDevice",
-		"probedBestEngine"
-	],
-	reason: "global step/engine seed and the per-node engine cascade — both removed; the live per-camera dispatch path never read either"
-}, {
-	namespace: "device-manager",
-	collection: "addon-settings",
-	row: "deviceMeta",
-	keys: [],
-	perNodeKeys: [],
-	mapValueKeys: ["deviceLinks"],
-	reason: "cross-device field wiring, deleted 2026-08-08 — 0 links across 302 devices a month after the UI shipped. There is no reader left: the resolver, the overlay, the cycle guard, the fifth binding kind and the tab are gone"
-}];
-/**
-* Adapt the settings backend to {@link RetiredKeyStore}.
-*
-* `get` answering a non-object (missing row) is a MISS, not a fault: it maps to
-* `null` and the purge skips the row. A backend throw propagates, which is what
-* routes it to the "read failed, row left untouched" branch.
-*/
-function retiredKeyStoreOf(backend) {
-	return {
-		async read(spec) {
-			return require_dist.asJsonObject(await backend.get({
-				namespace: spec.namespace,
-				collection: spec.collection,
-				key: spec.row
-			}));
-		},
-		async write(spec, value) {
-			await backend.set({
-				namespace: spec.namespace,
-				collection: spec.collection,
-				key: spec.row,
-				value
-			});
-		}
-	};
-}
-/**
-* Nested `<mapKey>.<retiredKey>` paths that `spec` retires inside a map-shaped
-* row. Pure. Values that are not plain objects are skipped, never rewritten.
-*/
-function planNestedRetiredKeyPurge(blob, spec) {
-	const nestedKeys = spec.mapValueKeys ?? [];
-	if (nestedKeys.length === 0) return [];
-	const found = [];
-	for (const [mapKey, value] of Object.entries(blob)) {
-		const inner = require_dist.asJsonObject(value);
-		if (inner === null) continue;
-		for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
-	}
-	return found;
-}
-/** Keys of `blob` that `spec` retires. Pure. */
-function planRetiredKeyPurge(blob, spec) {
-	const exact = new Set(spec.keys);
-	const found = [];
-	for (const key of Object.keys(blob)) {
-		if (exact.has(key)) {
-			found.push(key);
-			continue;
-		}
-		for (const perNode of spec.perNodeKeys) if (key === perNode || key.startsWith(`${perNode}@`)) {
-			found.push(key);
-			break;
-		}
-	}
-	return found;
-}
-/**
-* Delete every retired key present in the declared rows — on the hub.
-*
-* Off the authoritative node this is a no-op that touches nothing and says
-* nothing (see the module header). Returns one entry per row that actually
-* changed — empty when the store is already clean, which is the steady state
-* after the first boot that ran it.
-*/
-async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_KEYS, env = process.env) {
-	if (!settingsStoreIsAuthoritativeHere(env)) return [];
-	const results = [];
-	for (const spec of specs) {
-		let blob;
-		try {
-			blob = await store.read(spec);
-		} catch (err) {
-			logger.warn("retired settings keys — read failed, row left untouched", { meta: {
-				addon: spec.namespace,
-				collection: spec.collection,
-				row: spec.row,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-			continue;
-		}
-		if (blob === null) continue;
-		const doomed = planRetiredKeyPurge(blob, spec);
-		const doomedNested = planNestedRetiredKeyPurge(blob, spec);
-		if (doomed.length === 0 && doomedNested.length === 0) continue;
-		const doomedSet = new Set(doomed);
-		const nestedByMapKey = /* @__PURE__ */ new Map();
-		for (const path of doomedNested) {
-			const cut = path.indexOf(".");
-			const mapKey = path.slice(0, cut);
-			const inner = path.slice(cut + 1);
-			const bucket = nestedByMapKey.get(mapKey) ?? /* @__PURE__ */ new Set();
-			bucket.add(inner);
-			nestedByMapKey.set(mapKey, bucket);
-		}
-		const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
-			const retired = nestedByMapKey.get(key);
-			if (retired === void 0) return [key, value];
-			const inner = require_dist.asJsonObject(value);
-			if (inner === null) return [key, value];
-			return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
-		}));
-		await store.write(spec, next);
-		const result = {
-			addon: spec.namespace,
-			collection: spec.collection,
-			row: spec.row,
-			keys: doomed,
-			nested: doomedNested
-		};
-		results.push(result);
-		logger.info(`purged ${doomed.length + doomedNested.length} retired settings keys`, { meta: {
-			...result,
-			reason: spec.reason
-		} });
-	}
-	return results;
-}
-//#endregion
 //#region src/builtins/sqlite-storage/filter-compiler.ts
 /** Thrown by `mutate` mode. Distinct type so a caller can map it to a 400. */
 var UnsafeFilterError = class extends Error {
@@ -1823,7 +1649,7 @@ var SqliteSettingsAddon = class extends require_dist.BaseAddon {
 		this.backend = new SqliteSettingsBackend(dbPath, { ...require_dist.RUNTIME_DEFAULTS }, this.ctx.logger.child("Query"));
 		await this.backend.initialize();
 		try {
-			await purgeRetiredSettingsKeys(retiredKeyStoreOf(this.backend), this.ctx.logger.child("RetiredKeys"));
+			await require_retired_settings_keys.purgeRetiredSettingsKeys(require_retired_settings_keys.retiredKeyStoreOf(this.backend), this.ctx.logger.child("RetiredKeys"));
 		} catch (err) {
 			this.ctx.logger.warn("Retired-key purge failed", { meta: { error: require_dist.errMsg(err) } });
 		}

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,5 @@
 import { A as dataStoreProviderCapability, Bt as parseJsonUnknown, _t as vectorStoreCapability, f as RUNTIME_DEFAULTS, gt as vectorDimFromBase64, j as decodeVectorBase64, kt as asJsonObject, vt as errMsg, w as bareAddonId, yt as BaseAddon } from "../../dist-_oC_QkQA.mjs";
+import { r as retiredKeyStoreOf, t as purgeRetiredSettingsKeys } from "../../retired-settings-keys-Bsjf7HQ-.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";
@@ -78,181 +79,6 @@ var SQLITE_MMAP_SIZE_BYTES = 268435456;
 */
 var SQLITE_JOURNAL_SIZE_LIMIT_BYTES = 67108864;
 //#endregion
-//#region src/builtins/sqlite-storage/retired-settings-keys.ts
-/**
-* Is THIS node the one whose settings store is the cluster's authority?
-*
-* Mirrors `resolveNodeRole` (server/backend `node-role.ts`) — unset or `'hub'`
-* means hub, which is the launcher's own default. It is duplicated rather than
-* imported because `@camstack/system` is a dependency OF the backend, not the
-* other way round; the parse is four lines and the env var is the contract.
-*
-* Anything else answers `false`. Skipping where the purge should have run is a
-* missed cleanup the next hub boot fixes; running where it should not have is a
-* write to a store this node does not own. Only one of those is recoverable.
-*/
-function settingsStoreIsAuthoritativeHere(env) {
-	const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
-	return raw === "" || raw === "hub";
-}
-/**
-* The dead keys, per row.
-*
-* `detection-pipeline` / `addon-settings` / `root` — every key in this row is
-* dead; the row itself is kept because the addon writes live keys into it
-* (`pipelineTemplates`, `videoPipelineSteps`).
-*
-*  - `pipelineSteps` / `pipelineEngine`: the persisted GLOBAL step + engine
-*    seed. Removed with `getGlobalSteps` becoming pure — dispatch builds steps
-*    from the orchestrator's `agentSettings` plus per-camera overrides, and
-*    never consulted the seed. See `addon-pipeline/src/detection-pipeline/provider.ts`.
-*  - `engineRuntime` / `engineBackend` / `engineDevice` / `probedBestEngine`:
-*    the per-node engine CASCADE, removed with the operator-facing engine
-*    election. Each node now runs a device-array of inference pools balanced
-*    per session, and the node-default pool derives live from the node's own
-*    hardware (`resolveAutoEngine`). See
-*    `addon-pipeline/src/detection-pipeline/engine-store-keys.ts`.
-*/
-var RETIRED_SETTINGS_KEYS = [{
-	namespace: "detection-pipeline",
-	collection: "addon-settings",
-	row: "root",
-	keys: ["pipelineSteps", "pipelineEngine"],
-	perNodeKeys: [
-		"engineRuntime",
-		"engineBackend",
-		"engineDevice",
-		"probedBestEngine"
-	],
-	reason: "global step/engine seed and the per-node engine cascade — both removed; the live per-camera dispatch path never read either"
-}, {
-	namespace: "device-manager",
-	collection: "addon-settings",
-	row: "deviceMeta",
-	keys: [],
-	perNodeKeys: [],
-	mapValueKeys: ["deviceLinks"],
-	reason: "cross-device field wiring, deleted 2026-08-08 — 0 links across 302 devices a month after the UI shipped. There is no reader left: the resolver, the overlay, the cycle guard, the fifth binding kind and the tab are gone"
-}];
-/**
-* Adapt the settings backend to {@link RetiredKeyStore}.
-*
-* `get` answering a non-object (missing row) is a MISS, not a fault: it maps to
-* `null` and the purge skips the row. A backend throw propagates, which is what
-* routes it to the "read failed, row left untouched" branch.
-*/
-function retiredKeyStoreOf(backend) {
-	return {
-		async read(spec) {
-			return asJsonObject(await backend.get({
-				namespace: spec.namespace,
-				collection: spec.collection,
-				key: spec.row
-			}));
-		},
-		async write(spec, value) {
-			await backend.set({
-				namespace: spec.namespace,
-				collection: spec.collection,
-				key: spec.row,
-				value
-			});
-		}
-	};
-}
-/**
-* Nested `<mapKey>.<retiredKey>` paths that `spec` retires inside a map-shaped
-* row. Pure. Values that are not plain objects are skipped, never rewritten.
-*/
-function planNestedRetiredKeyPurge(blob, spec) {
-	const nestedKeys = spec.mapValueKeys ?? [];
-	if (nestedKeys.length === 0) return [];
-	const found = [];
-	for (const [mapKey, value] of Object.entries(blob)) {
-		const inner = asJsonObject(value);
-		if (inner === null) continue;
-		for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
-	}
-	return found;
-}
-/** Keys of `blob` that `spec` retires. Pure. */
-function planRetiredKeyPurge(blob, spec) {
-	const exact = new Set(spec.keys);
-	const found = [];
-	for (const key of Object.keys(blob)) {
-		if (exact.has(key)) {
-			found.push(key);
-			continue;
-		}
-		for (const perNode of spec.perNodeKeys) if (key === perNode || key.startsWith(`${perNode}@`)) {
-			found.push(key);
-			break;
-		}
-	}
-	return found;
-}
-/**
-* Delete every retired key present in the declared rows — on the hub.
-*
-* Off the authoritative node this is a no-op that touches nothing and says
-* nothing (see the module header). Returns one entry per row that actually
-* changed — empty when the store is already clean, which is the steady state
-* after the first boot that ran it.
-*/
-async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_KEYS, env = process.env) {
-	if (!settingsStoreIsAuthoritativeHere(env)) return [];
-	const results = [];
-	for (const spec of specs) {
-		let blob;
-		try {
-			blob = await store.read(spec);
-		} catch (err) {
-			logger.warn("retired settings keys — read failed, row left untouched", { meta: {
-				addon: spec.namespace,
-				collection: spec.collection,
-				row: spec.row,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-			continue;
-		}
-		if (blob === null) continue;
-		const doomed = planRetiredKeyPurge(blob, spec);
-		const doomedNested = planNestedRetiredKeyPurge(blob, spec);
-		if (doomed.length === 0 && doomedNested.length === 0) continue;
-		const doomedSet = new Set(doomed);
-		const nestedByMapKey = /* @__PURE__ */ new Map();
-		for (const path of doomedNested) {
-			const cut = path.indexOf(".");
-			const mapKey = path.slice(0, cut);
-			const inner = path.slice(cut + 1);
-			const bucket = nestedByMapKey.get(mapKey) ?? /* @__PURE__ */ new Set();
-			bucket.add(inner);
-			nestedByMapKey.set(mapKey, bucket);
-		}
-		const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
-			const retired = nestedByMapKey.get(key);
-			if (retired === void 0) return [key, value];
-			const inner = asJsonObject(value);
-			if (inner === null) return [key, value];
-			return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
-		}));
-		await store.write(spec, next);
-		const result = {
-			addon: spec.namespace,
-			collection: spec.collection,
-			row: spec.row,
-			keys: doomed,
-			nested: doomedNested
-		};
-		results.push(result);
-		logger.info(`purged ${doomed.length + doomedNested.length} retired settings keys`, { meta: {
-			...result,
-			reason: spec.reason
-		} });
-	}
-	return results;
-}
-//#endregion
 //#region src/builtins/sqlite-storage/filter-compiler.ts
 /** Thrown by `mutate` mode. Distinct type so a caller can map it to a 400. */
 var UnsafeFilterError = class extends Error {

package/dist/retired-settings-keys-Bsjf7HQ-.mjs

@@ -0,0 +1,278 @@
+import { kt as asJsonObject } from "./dist-_oC_QkQA.mjs";
+//#region src/builtins/sqlite-storage/retired-settings-keys.ts
+/**
+* Is THIS node the one whose settings store is the cluster's authority?
+*
+* Mirrors `resolveNodeRole` (server/backend `node-role.ts`) — unset or `'hub'`
+* means hub, which is the launcher's own default. It is duplicated rather than
+* imported because `@camstack/system` is a dependency OF the backend, not the
+* other way round; the parse is four lines and the env var is the contract.
+*
+* Anything else answers `false`. Skipping where the purge should have run is a
+* missed cleanup the next hub boot fixes; running where it should not have is a
+* write to a store this node does not own. Only one of those is recoverable.
+*/
+function settingsStoreIsAuthoritativeHere(env) {
+	const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
+	return raw === "" || raw === "hub";
+}
+/**
+* The dead keys, per row.
+*
+* `detection-pipeline` / `addon-settings` / `root` — every key in this row is
+* dead; the row itself is kept because the addon writes live keys into it
+* (`pipelineTemplates`, `videoPipelineSteps`).
+*
+*  - `pipelineSteps` / `pipelineEngine`: the persisted GLOBAL step + engine
+*    seed. Removed with `getGlobalSteps` becoming pure — dispatch builds steps
+*    from the orchestrator's `agentSettings` plus per-camera overrides, and
+*    never consulted the seed. See `addon-pipeline/src/detection-pipeline/provider.ts`.
+*  - `engineRuntime` / `engineBackend` / `engineDevice` / `probedBestEngine`:
+*    the per-node engine CASCADE, removed with the operator-facing engine
+*    election. Each node now runs a device-array of inference pools balanced
+*    per session, and the node-default pool derives live from the node's own
+*    hardware (`resolveAutoEngine`). See
+*    `addon-pipeline/src/detection-pipeline/engine-store-keys.ts`.
+*/
+var RETIRED_SETTINGS_KEYS = [{
+	namespace: "detection-pipeline",
+	collection: "addon-settings",
+	row: "root",
+	keys: ["pipelineSteps", "pipelineEngine"],
+	perNodeKeys: [
+		"engineRuntime",
+		"engineBackend",
+		"engineDevice",
+		"probedBestEngine"
+	],
+	reason: "global step/engine seed and the per-node engine cascade — both removed; the live per-camera dispatch path never read either"
+}];
+/**
+* The device-manager's three fleet blobs, replaced by one row per device in
+* `device-manager:devices` (`device-row-store.ts`).
+*
+* 625 KB of the `addon-settings` table's 627 KB, re-read and re-parsed on every
+* projection and rewritten in full on every rename. `deviceIndex` is listed
+* here like the other two even though it was never migrated: `addonId` and
+* `stableId` are columns of every row, so an addon's device list is a query,
+* and the one bit that was not derivable — "has `registerDevice` run?" — is the
+* `registered` column.
+*/
+var RETIRED_SETTINGS_ROWS = [
+	{
+		collection: "addon-settings",
+		row: "device-manager.deviceMeta",
+		owner: "device-manager",
+		evidence: { collection: "device-manager:devices" },
+		reason: "the fleet is one row per device in `device-manager:devices` since the flatten; this blob was 467 KB read and JSON.parsed on hub-main per projection"
+	},
+	{
+		collection: "addon-settings",
+		row: "device-manager.deviceMetadata",
+		owner: "device-manager",
+		evidence: { collection: "device-manager:devices" },
+		reason: "hardware-identity metadata is the `metadata` column of the device row; the separate blob existed only because a blob write is whole-value"
+	},
+	{
+		collection: "addon-settings",
+		row: "device-manager.deviceIndex",
+		owner: "device-manager",
+		evidence: { collection: "device-manager:devices" },
+		reason: "derivable: `addonId`/`stableId` are indexed columns, and index membership is the `registered` column"
+	}
+];
+/**
+* Adapt the settings backend to {@link RetiredKeyStore}.
+*
+* `get` answering a non-object (missing row) is a MISS, not a fault: it maps to
+* `null` and the purge skips the row. A backend throw propagates, which is what
+* routes it to the "read failed, row left untouched" branch.
+*/
+function retiredKeyStoreOf(backend) {
+	return {
+		async read(spec) {
+			return asJsonObject(await backend.get({
+				namespace: spec.namespace,
+				collection: spec.collection,
+				key: spec.row
+			}));
+		},
+		async write(spec, value) {
+			await backend.set({
+				namespace: spec.namespace,
+				collection: spec.collection,
+				key: spec.row,
+				value
+			});
+		}
+	};
+}
+/**
+* Nested `<mapKey>.<retiredKey>` paths that `spec` retires inside a map-shaped
+* row. Pure. Values that are not plain objects are skipped, never rewritten.
+*/
+function planNestedRetiredKeyPurge(blob, spec) {
+	const nestedKeys = spec.mapValueKeys ?? [];
+	if (nestedKeys.length === 0) return [];
+	const found = [];
+	for (const [mapKey, value] of Object.entries(blob)) {
+		const inner = asJsonObject(value);
+		if (inner === null) continue;
+		for (const retired of nestedKeys) if (retired in inner) found.push(`${mapKey}.${retired}`);
+	}
+	return found;
+}
+/** Keys of `blob` that `spec` retires. Pure. */
+function planRetiredKeyPurge(blob, spec) {
+	const exact = new Set(spec.keys);
+	const found = [];
+	for (const key of Object.keys(blob)) {
+		if (exact.has(key)) {
+			found.push(key);
+			continue;
+		}
+		for (const perNode of spec.perNodeKeys) if (key === perNode || key.startsWith(`${perNode}@`)) {
+			found.push(key);
+			break;
+		}
+	}
+	return found;
+}
+/**
+* Delete every retired key present in the declared rows — on the hub.
+*
+* Off the authoritative node this is a no-op that touches nothing and says
+* nothing (see the module header). Returns one entry per row that actually
+* changed — empty when the store is already clean, which is the steady state
+* after the first boot that ran it.
+*/
+async function purgeRetiredSettingsKeys(store, logger, specs = RETIRED_SETTINGS_KEYS, env = process.env) {
+	if (!settingsStoreIsAuthoritativeHere(env)) return [];
+	const results = [];
+	for (const spec of specs) {
+		let blob;
+		try {
+			blob = await store.read(spec);
+		} catch (err) {
+			logger.warn("retired settings keys — read failed, row left untouched", { meta: {
+				addon: spec.namespace,
+				collection: spec.collection,
+				row: spec.row,
+				error: err instanceof Error ? err.message : String(err)
+			} });
+			continue;
+		}
+		if (blob === null) continue;
+		const doomed = planRetiredKeyPurge(blob, spec);
+		const doomedNested = planNestedRetiredKeyPurge(blob, spec);
+		if (doomed.length === 0 && doomedNested.length === 0) continue;
+		const doomedSet = new Set(doomed);
+		const nestedByMapKey = /* @__PURE__ */ new Map();
+		for (const path of doomedNested) {
+			const cut = path.indexOf(".");
+			const mapKey = path.slice(0, cut);
+			const inner = path.slice(cut + 1);
+			const bucket = nestedByMapKey.get(mapKey) ?? /* @__PURE__ */ new Set();
+			bucket.add(inner);
+			nestedByMapKey.set(mapKey, bucket);
+		}
+		const next = Object.fromEntries(Object.entries(blob).filter(([key]) => !doomedSet.has(key)).map(([key, value]) => {
+			const retired = nestedByMapKey.get(key);
+			if (retired === void 0) return [key, value];
+			const inner = asJsonObject(value);
+			if (inner === null) return [key, value];
+			return [key, Object.fromEntries(Object.entries(inner).filter(([k]) => !retired.has(k)))];
+		}));
+		await store.write(spec, next);
+		const result = {
+			addon: spec.namespace,
+			collection: spec.collection,
+			row: spec.row,
+			keys: doomed,
+			nested: doomedNested
+		};
+		results.push(result);
+		logger.info(`purged ${doomed.length + doomedNested.length} retired settings keys`, { meta: {
+			...result,
+			reason: spec.reason
+		} });
+	}
+	return results;
+}
+/**
+* Delete every retired ROW whose successor is populated — on the hub.
+*
+* Off the authoritative node this is a no-op that touches nothing and says
+* nothing, same gate as {@link purgeRetiredSettingsKeys}.
+*
+* **The evidence check is the whole safety of this function.** A retired row is
+* the only copy of its data until the migration has written the successor
+* collection, and the migration is an OFFLINE step an operator runs — it is not
+* part of boot. So a hub that boots the new code before being migrated must
+* find its blobs intact, not deleted: the purge SKIPS, loudly, and the next
+* boot after the migration cleans up. An evidence read that FAILS is treated
+* exactly like an empty one — a fault is never permission to delete.
+*/
+async function purgeRetiredSettingsRows(store, logger, specs = RETIRED_SETTINGS_ROWS, env = process.env) {
+	if (!settingsStoreIsAuthoritativeHere(env)) return [];
+	const results = [];
+	/** Evidence counts, memoised per collection — the specs share successors. */
+	const evidence = /* @__PURE__ */ new Map();
+	for (const spec of specs) {
+		let present;
+		try {
+			present = await store.hasRow(spec);
+		} catch (err) {
+			logger.warn("retired settings row — read failed, row left untouched", { meta: {
+				addon: spec.owner,
+				collection: spec.collection,
+				row: spec.row,
+				error: errText(err)
+			} });
+			continue;
+		}
+		if (!present) continue;
+		const successor = spec.evidence.collection;
+		let count = evidence.get(successor);
+		if (count === void 0) {
+			try {
+				count = await store.countRows(successor);
+			} catch (err) {
+				logger.warn("retired settings row — successor unreadable, row left untouched", { meta: {
+					addon: spec.owner,
+					row: spec.row,
+					successor,
+					error: errText(err)
+				} });
+				count = 0;
+			}
+			evidence.set(successor, count);
+		}
+		if (count === 0) {
+			logger.warn("retired settings row kept — its successor is empty, migration has not run", { meta: {
+				addon: spec.owner,
+				collection: spec.collection,
+				row: spec.row,
+				successor
+			} });
+			continue;
+		}
+		await store.deleteRow(spec);
+		const result = {
+			owner: spec.owner,
+			collection: spec.collection,
+			row: spec.row
+		};
+		results.push(result);
+		logger.info("purged a retired settings row", { meta: {
+			...result,
+			reason: spec.reason
+		} });
+	}
+	return results;
+}
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+export { purgeRetiredSettingsRows as n, retiredKeyStoreOf as r, purgeRetiredSettingsKeys as t };