@camstack/system 1.2.155 → 1.2.156

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BPlfW-CG.js");
+const require_dist = require("../../dist-CDgIzo82.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Kt as hydrateSchema, Ot as errMsg, kt as BaseAddon } from "../../dist-D_NyUV6Y.mjs";
+import { Kt as hydrateSchema, Ot as errMsg, kt as BaseAddon } from "../../dist-LvKus-mT.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BPlfW-CG.js");
+const require_dist = require("../../dist-CDgIzo82.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-D_NyUV6Y.mjs";
+import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-LvKus-mT.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-BPlfW-CG.js → dist-CDgIzo82.js}

@@ -4166,18 +4166,61 @@ var RelocateFootageInputSchema = zod.z.object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = zod.z.enum([
+	"move",
+	"seal",
+	"gallery"
+]);
 var RelocateMediaInputSchema = zod.z.object({
 	toLocationId: zod.z.string(),
-	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/** How many rows still carry NO `locationId` — the population a repoint would
+*  silently re-aim at a disk that does not hold their bytes. Zero is the only
+*  value that permits a non-blocking `eventMedia` cutover. */
+var UnstampedEventMediaCountSchema = zod.z.object({
+	media: zod.z.number().int().nonnegative(),
+	retrainFrames: zod.z.number().int().nonnegative(),
+	total: zod.z.number().int().nonnegative()
 });
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
-/** The independently selectable logical storage classes. `recordings`
-* encompasses the high and mid segment profiles; `recordingsLow` is low
-* segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
+*
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 var StorageMigrationClassSchema = zod.z.enum([
 	"recordings",
 	"recordingsLow",
-	"eventMedia"
+	"eventMedia",
+	"backups",
+	"galleryMedia"
 ]);
 /** A destination is always an existing, fully-qualified location id. The
 * migration API intentionally never changes a source location's `basePath`:
@@ -4185,20 +4228,56 @@ var StorageMigrationClassSchema = zod.z.enum([
 var StorageMigrationDestinationsSchema = zod.z.object({
 	recordings: zod.z.string().min(1).optional(),
 	recordingsLow: zod.z.string().min(1).optional(),
-	eventMedia: zod.z.string().min(1).optional()
+	eventMedia: zod.z.string().min(1).optional(),
+	backups: zod.z.string().min(1).optional(),
+	galleryMedia: zod.z.string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* How a migration sequences the cutover against the byte move.
+*
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
+*/
+var StorageMigrationModeSchema = zod.z.enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = zod.z.object({
 	destinations: StorageMigrationDestinationsSchema,
-	throttleMbps: zod.z.number().min(1).max(1e3).optional()
+	throttleMbps: zod.z.number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
 });
-/** The durable coordinator state machine. The only phase that changes default
-* locations is `repointing`, after every selected mover has completed and been
-* verified. */
+/**
+* The durable coordinator state machine.
+*
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
+*/
 var StorageMigrationPhaseSchema = zod.z.enum([
 	"planning",
+	"sealing",
 	"pausing",
 	"moving",
+	"draining",
 	"verifying",
 	"repointing",
 	"refreshing",
@@ -4223,6 +4302,9 @@ var StorageMigrationMoveSchema = zod.z.object({
 var StorageMigrationJobSchema = zod.z.object({
 	jobId: zod.z.string(),
 	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
 	throttleMbps: zod.z.number(),
 	moves: zod.z.array(StorageMigrationMoveSchema),
@@ -4235,13 +4317,54 @@ var StorageMigrationJobSchema = zod.z.object({
 	finishedAt: zod.z.number().nullable(),
 	error: zod.z.string().nullable()
 });
+/**
+* What the planner NOTICED but did not refuse.
+*
+* A refusal throws — the operator cannot miss it. A finding is the other half:
+* something true about this plan that changes what the operator should expect,
+* surfaced where they read it rather than in a document they will not open.
+*
+*  - `sharesDeviceWithSource` — the destination realpath's to the same place as
+*    the source. The move will be a row re-stamp, not a byte move, and it buys
+*    no redundancy. NOTE: this is PATH identity, not `st_dev` — two distinct
+*    directories on one filesystem are NOT detected. See
+*    `deviceIdentityUnknown`.
+*  - `deviceIdentityUnknown` — a location carries a `nodeId` other than this
+*    one (or has no `basePath`), so its realpath cannot be taken here and the
+*    same-device question was not answered at all. Stated rather than assumed
+*    clear: a check that silently never fires is worse than no check.
+*  - `unstampedEventMediaRows` — how many `eventMedia`/retrain rows still carry
+*    no `locationId`. Non-zero refuses a `nonBlocking` cutover.
+*  - `blockingOnly` — this class is `cardinality: 'single'`, so it can never
+*    span two locations and can only ever be moved stop-the-world.
+*  - `noMover` — the class is selectable and planned, but no addon owns a mover
+*    for it. The migration cannot move its bytes.
+*/
+var StorageMigrationFindingCodeSchema = zod.z.enum([
+	"sharesDeviceWithSource",
+	"deviceIdentityUnknown",
+	"unstampedEventMediaRows",
+	"blockingOnly",
+	"noMover"
+]);
+var StorageMigrationFindingSchema = zod.z.object({
+	code: StorageMigrationFindingCodeSchema,
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: zod.z.string()
+});
 var StorageMigrationPlanSchema = zod.z.object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
 	moves: zod.z.array(zod.z.object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: zod.z.string(),
 		toLocationId: zod.z.string()
-	}))
+	})),
+	findings: zod.z.array(StorageMigrationFindingSchema)
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -17867,6 +17990,17 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* How many media / retrain rows still carry NO `locationId`.
+		*
+		* A NULL row means "wherever `eventMedia` points NOW", so the instant a
+		* repoint moves that pointer every such row reads from the new disk while
+		* its bytes are on the old one — the archive goes dark until a drain
+		* happens to stamp it. This count is what the migration planner's
+		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+		* it to zero.
+		*/
+		countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/** Every relocate job this addon knows about, newest first (in RAM: the
 		*  move is resumable, so a lost list costs nothing but the display). */
 		listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -20718,7 +20852,24 @@ var storageCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		deleteLocation: method(zod.z.object({ id: zod.z.string() }), zod.z.void(), {
+		/**
+		* Remove a location record. REFUSES a location that still holds data —
+		* deleting a drained location whose durable rows still name it is how this
+		* hub acquired 2 131 ghost `recordings:high` segments, and playback does
+		* not stat, so the operator sees a silent black window rather than an
+		* error.
+		*
+		* `force` exists because the occupancy check is BEST-EFFORT and refuses on
+		* "unknown" as well as on "occupied" (a read that fails must not authorise
+		* a destruction — D49). A location on a removed disk, on another node, or
+		* behind a remote provider answers "unknown" forever, and a refusal an
+		* operator cannot override is its own failure mode. `force: true` is
+		* logged, loudly, with what the check saw.
+		*/
+		deleteLocation: method(zod.z.object({
+			id: zod.z.string(),
+			force: zod.z.boolean().optional()
+		}), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -36071,6 +36222,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countUnstampedEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/{dist-D_NyUV6Y.mjs → dist-LvKus-mT.mjs}

@@ -4166,18 +4166,61 @@ var RelocateFootageInputSchema = z.object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = z.object({ leaseId: z.string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: z.string().min(1) });
+/**
+* What a `relocateMedia` pass DOES. One engine, three passes — never a second
+* mover (the engine already walks both collections with a timestamp cursor and
+* already has a stamp-without-copy path).
+*
+*  - `move`    — the default and the historical behaviour: event-media and
+*                retrain blobs move to `toLocationId` and their rows are
+*                stamped. The enrolled gallery is skipped (D197).
+*  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+*                stamped with `toLocationId`. `toLocationId` here is the id the
+*                bytes ALREADY sit on — today's `eventMedia` default — because
+*                a NULL row means "wherever `eventMedia` points *now*", and the
+*                instant a repoint moves that pointer the row reads from the
+*                new disk while its bytes are on the old one.
+*  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+*                (enrolled-gallery) rows, which `move` deliberately skips.
+*                `galleryMedia` is `cardinality: 'single'`, so this pass can
+*                never run beside a live second location: it is stop-the-world
+*                by construction, which is acceptable only because the gallery
+*                is a few KB per enrolled sample.
+*/
+var MediaRelocateModeSchema = z.enum([
+	"move",
+	"seal",
+	"gallery"
+]);
 var RelocateMediaInputSchema = z.object({
 	toLocationId: z.string(),
-	throttleMbps: z.number().min(1).max(1e3).optional()
+	throttleMbps: z.number().min(1).max(1e3).optional(),
+	/** Omitted = `move`, the pre-existing behaviour. */
+	mode: MediaRelocateModeSchema.optional()
+});
+/** How many rows still carry NO `locationId` — the population a repoint would
+*  silently re-aim at a disk that does not hold their bytes. Zero is the only
+*  value that permits a non-blocking `eventMedia` cutover. */
+var UnstampedEventMediaCountSchema = z.object({
+	media: z.number().int().nonnegative(),
+	retrainFrames: z.number().int().nonnegative(),
+	total: z.number().int().nonnegative()
 });
 var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: z.string().min(1) });
-/** The independently selectable logical storage classes. `recordings`
-* encompasses the high and mid segment profiles; `recordingsLow` is low
-* segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+* `storage.listLocationDeclarations` reports, so an operator never meets a
+* Zod enum error where they should meet an explanation.
+*
+* `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+* is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+* enrolled gallery; `backups` is the system backup archive. The last two have
+* their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 var StorageMigrationClassSchema = z.enum([
 	"recordings",
 	"recordingsLow",
-	"eventMedia"
+	"eventMedia",
+	"backups",
+	"galleryMedia"
 ]);
 /** A destination is always an existing, fully-qualified location id. The
 * migration API intentionally never changes a source location's `basePath`:
@@ -4185,20 +4228,56 @@ var StorageMigrationClassSchema = z.enum([
 var StorageMigrationDestinationsSchema = z.object({
 	recordings: z.string().min(1).optional(),
 	recordingsLow: z.string().min(1).optional(),
-	eventMedia: z.string().min(1).optional()
+	eventMedia: z.string().min(1).optional(),
+	backups: z.string().min(1).optional(),
+	galleryMedia: z.string().min(1).optional()
 }).refine((value) => Object.keys(value).length > 0, { message: "select at least one storage class" });
+/**
+* How a migration sequences the cutover against the byte move.
+*
+*  - `blocking`     — the historical order: pause, move every byte, repoint,
+*                     resume. Recording is stopped for the whole move. Right
+*                     for a small or a cold class, and the only legal mode for
+*                     a `cardinality: 'single'` class.
+*  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+*                     refresh, resume, then move the past with everything
+*                     running. The pause is three bounded instants (a detach +
+*                     attach round, a write-gate drain, a lease) instead of one
+*                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+*                     stopped recording under `blocking`; the same move is
+*                     seconds of stopped recording under `nonBlocking`.
+*
+* The mode is on the JOB, not only on the input, because `status` is where an
+* operator finds out which one is running.
+*/
+var StorageMigrationModeSchema = z.enum(["blocking", "nonBlocking"]);
 /** Shared input for planning and starting an orchestrated storage migration. */
 var StorageMigrationInputSchema = z.object({
 	destinations: StorageMigrationDestinationsSchema,
-	throttleMbps: z.number().min(1).max(1e3).optional()
+	throttleMbps: z.number().min(1).max(1e3).optional(),
+	/** Omitted = `blocking`, which stays the default. */
+	mode: StorageMigrationModeSchema.optional()
 });
-/** The durable coordinator state machine. The only phase that changes default
-* locations is `repointing`, after every selected mover has completed and been
-* verified. */
+/**
+* The durable coordinator state machine.
+*
+* `blocking`:
+*   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+*
+* `nonBlocking`:
+*   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+*
+* Same phases, different order plus two new ones — not a second mover.
+* `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+* `draining` runs the same movers UNLEASED, after every writer is back up.
+* `repointing` is still the only phase that changes a default location.
+*/
 var StorageMigrationPhaseSchema = z.enum([
 	"planning",
+	"sealing",
 	"pausing",
 	"moving",
+	"draining",
 	"verifying",
 	"repointing",
 	"refreshing",
@@ -4223,6 +4302,9 @@ var StorageMigrationMoveSchema = z.object({
 var StorageMigrationJobSchema = z.object({
 	jobId: z.string(),
 	phase: StorageMigrationPhaseSchema,
+	/** Which order this job is running. `status` is the only place an operator
+	*  can tell a seconds-long cutover from a thirty-hour one. */
+	mode: StorageMigrationModeSchema,
 	destinations: StorageMigrationDestinationsSchema,
 	throttleMbps: z.number(),
 	moves: z.array(StorageMigrationMoveSchema),
@@ -4235,13 +4317,54 @@ var StorageMigrationJobSchema = z.object({
 	finishedAt: z.number().nullable(),
 	error: z.string().nullable()
 });
+/**
+* What the planner NOTICED but did not refuse.
+*
+* A refusal throws — the operator cannot miss it. A finding is the other half:
+* something true about this plan that changes what the operator should expect,
+* surfaced where they read it rather than in a document they will not open.
+*
+*  - `sharesDeviceWithSource` — the destination realpath's to the same place as
+*    the source. The move will be a row re-stamp, not a byte move, and it buys
+*    no redundancy. NOTE: this is PATH identity, not `st_dev` — two distinct
+*    directories on one filesystem are NOT detected. See
+*    `deviceIdentityUnknown`.
+*  - `deviceIdentityUnknown` — a location carries a `nodeId` other than this
+*    one (or has no `basePath`), so its realpath cannot be taken here and the
+*    same-device question was not answered at all. Stated rather than assumed
+*    clear: a check that silently never fires is worse than no check.
+*  - `unstampedEventMediaRows` — how many `eventMedia`/retrain rows still carry
+*    no `locationId`. Non-zero refuses a `nonBlocking` cutover.
+*  - `blockingOnly` — this class is `cardinality: 'single'`, so it can never
+*    span two locations and can only ever be moved stop-the-world.
+*  - `noMover` — the class is selectable and planned, but no addon owns a mover
+*    for it. The migration cannot move its bytes.
+*/
+var StorageMigrationFindingCodeSchema = z.enum([
+	"sharesDeviceWithSource",
+	"deviceIdentityUnknown",
+	"unstampedEventMediaRows",
+	"blockingOnly",
+	"noMover"
+]);
+var StorageMigrationFindingSchema = z.object({
+	code: StorageMigrationFindingCodeSchema,
+	storageClass: StorageMigrationClassSchema,
+	/** Human-readable, already carrying the ids and counts. */
+	message: z.string()
+});
 var StorageMigrationPlanSchema = z.object({
 	destinations: StorageMigrationDestinationsSchema,
+	/** The mode this plan was built for. A plan is only valid for its mode: the
+	*  `eventMedia` seal gate and the single-cardinality refusal both depend on
+	*  it. */
+	mode: StorageMigrationModeSchema,
 	moves: z.array(z.object({
 		storageClass: StorageMigrationClassSchema,
 		fromLocationId: z.string(),
 		toLocationId: z.string()
-	}))
+	})),
+	findings: z.array(StorageMigrationFindingSchema)
 });
 /**
 * `StorageLocationType` — an addon-declared id that identifies the *kind* of
@@ -17867,6 +17990,17 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* How many media / retrain rows still carry NO `locationId`.
+		*
+		* A NULL row means "wherever `eventMedia` points NOW", so the instant a
+		* repoint moves that pointer every such row reads from the new disk while
+		* its bytes are on the old one — the archive goes dark until a drain
+		* happens to stamp it. This count is what the migration planner's
+		* non-blocking gate reads; `relocateMedia({ mode: 'seal' })` is what drives
+		* it to zero.
+		*/
+		countUnstampedEventMedia: method(z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
 		/** Every relocate job this addon knows about, newest first (in RAM: the
 		*  move is resumable, so a lost list costs nothing but the display). */
 		listRelocateMediaJobs: method(z.object({}), z.array(RelocateJobSchema).readonly(), {
@@ -20718,7 +20852,24 @@ var storageCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		deleteLocation: method(z.object({ id: z.string() }), z.void(), {
+		/**
+		* Remove a location record. REFUSES a location that still holds data —
+		* deleting a drained location whose durable rows still name it is how this
+		* hub acquired 2 131 ghost `recordings:high` segments, and playback does
+		* not stat, so the operator sees a silent black window rather than an
+		* error.
+		*
+		* `force` exists because the occupancy check is BEST-EFFORT and refuses on
+		* "unknown" as well as on "occupied" (a read that fails must not authorise
+		* a destruction — D49). A location on a removed disk, on another node, or
+		* behind a remote provider answers "unknown" forever, and a refusal an
+		* operator cannot override is its own failure mode. `force: true` is
+		* logged, loudly, with what the check saw.
+		*/
+		deleteLocation: method(z.object({
+			id: z.string(),
+			force: z.boolean().optional()
+		}), z.void(), {
 			kind: "mutation",
 			auth: "admin"
 		}),
@@ -36071,6 +36222,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.countUnstampedEventMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-BPlfW-CG.js");
+const require_dist = require("./dist-CDgIzo82.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-BxQlomxd.js");
-const require_manifest_python_deps = require("./manifest-python-deps-w48vOhGR.js");
+const require_manifest_python_deps = require("./manifest-python-deps-DVODn-qc.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-D_NyUV6Y.mjs";
+import { $ as isVoidInput, $t as scopeKey, At as DATAPLANE_SECRET_HEADER$1, Bt as asNumber, C as addonSettingsCapability, G as extractNestedAddonId, Gt as expandCapMethods, Ht as createEvent, It as ReadinessRegistry, J as isArrayOutputSchema, Lt as ReadinessTimeoutError, Mt as DEVICE_STATUS_METHOD, Ot as errMsg$1, Qt as resolveCapMount, Ut as emitDownForOwnedCaps, Vt as asString$1, X as isObjectInput, Xt as parseJsonUnknown$1, Y as isCollectionArrayMethod, Yt as parseJsonObject, Zt as readinessKey, _t as scopesAllowDeviceCap, at as looseSchema, ct as objectInputDeclaresAddonId, dt as procedureAuthKey, et as kebabToCamel, f as LOG_LEVEL_RANK, gt as scopesAllowAddon, it as logLevelAtMost, jt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, m as RUNTIME_DEFAULTS, mt as resolveMethodAuth, p as METHOD_ACCESS_MAP, t as ALL_CAPABILITY_DEFINITIONS, tn as EventCategory$1, tt as lifecycleJobSchema, zt as asJsonObject$1 } from "./dist-LvKus-mT.mjs";
 import { AlertCenterAddon } from "./builtins/alerts/alerts.addon.mjs";
 import "./builtins/alerts/index.mjs";
 import { t as formatLogLine } from "./formatter-B7qW8bPJ.mjs";
@@ -25,7 +25,7 @@ import "./builtins/system-config/index.mjs";
 import { WinstonDestination, WinstonLoggingAddon } from "./builtins/winston-logging/index.mjs";
 import { a as parseTokenizedUrl, c as collectModelFiles, d as downloadModel, f as ensureModel, h as isModelDownloaded, i as parseRangeHeader, l as deleteModelFromDisk, m as getModelFilePath, n as contentTypeFor, o as resolveFilePath, p as fetchJson, r as createAuthenticatedFileServer, s as ModelDownloadService, t as createFileDataPlaneHandler, u as downloadFile } from "./file-data-plane-BhKdxJgf.mjs";
 import { C as registerLanHttpHandler, S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, b as bindPendingLanHttp, c as loadTlsCert, d as collectCertIdentity, f as CA_VALIDITY_DAYS, g as evaluateExistingCert, h as SERVER_AUTH_OID, i as writeExtraSans, l as reissueTlsLeaf, m as MAX_LEAF_VALIDITY_DAYS, n as readTlsAccessStatus, o as validateUploadedTls, p as LEAF_RENEWAL_WINDOW_DAYS, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, u as CA_COMMON_NAME, v as allFamiliesListenHost, x as closeLanHttp, y as applyLanHttp } from "./tls-DOTmtLCW.mjs";
-import { $ as buildNativeCapProxy, $t as RUNNER_HEAP_SNAPSHOT_ENV, A as createParentUnownedCallHandler, At as HUB_MAIN_HEAP_WATCH_LABEL, B as AGENT_CAP_FWD_SERVICE, Bt as createLoopDelayMeter, C as brokerTransportLink, Ct as runNpm, D as HUB_CAP_FWD_ACTION, Dt as HEAP_RECLAIM_TRIGGER_MB, E as localProviderLink, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as readMoleculerFanoutMode, Gt as parseRssBudgetMb, H as CapRouteError, Ht as describeRss, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, J as UdsLocalTransportServer, Jt as startHeapWatch, K as createLocalTransport, Kt as reclaimIntervalMs, L as LocalChildRegistry, Lt as ZERO_LOOP_DELAY, M as createUdsEventBus, Mt as HUB_RSS_BUDGET_ENV, N as udsChildLogToWorkerEntry, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as HUB_CAP_FWD_SERVICE, Ot as HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as RSS_BUDGET_RELEASE_RATIO, Q as encodeFrame, Qt as HEAP_SPACE_REPORT_MIN_MB, R as UDS_NO_ROUTE_PREFIX, Rt as buildHeapSample, S as brokerCallForCap, Sn as formatEventPlane, St as resolveNpmInvocation, T as ipcParentLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as classifyCapRoute, Ut as hubMainRssBudget, V as CapRouteResolver, Vt as createV8Reclaimer, W as callWithServiceDiscovery, Wt as nextRssBudgetState, X as localEndpointPath, Xt as strandedMb, Y as SocketChannel, Yt as startRunnerHeapWatch, Z as FrameDecoder, Zt as DECISIVE_HEAP_SPACES, _ as createKernelHwAccel, _n as socketDirectionMessages, _t as CapabilityHandle, a as getWorkerDeviceRegistry, an as selectReportedSpaces, b as __resetCapUsageRegistryForTests, bn as createEventPlaneReader, bt as installManifestNativeDeps, c as setHubConnected, cn as createSocketPlaneMeter, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dn as formatSocketPlane, dt as capBareAction, en as emitHeapDiagnosticReport, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, fn as EMPTY_SOCKET_DIRECTION, ft as capServiceName, g as AddonDepsManager, gn as socketDirectionBytes, gt as DeviceRegistry, h as subscribePassthrough, hn as sampleSocketDirection, ht as serializeTypedArrays, i as createUdsAddonContext, in as readHeapSpaces, it as mountNativeCapService, j as createUdsEventBridge, jt as HUB_MAIN_RSS_BUDGET_MB, k as createHubCapForwardService, kt as HEAP_WATCH_WARN_RATIO, l as EVENT_TOPIC_PREFIX, ln as createSocketPlaneReader, lt as capActionName, m as setNodeEventInterest, mn as recordSocketFrame, mt as deserializeTypedArrays, n as adaptBrokerToCluster, nn as heapSnapshotAuthorised, o as getOrInitReadinessRegistry, on as EMPTY_SOCKET_PLANE_BASELINE, ot as createAddonService, p as registerEventBusService, pn as createSocketDirectionCounters, pt as parseCapAction, q as UdsLocalTransportClient, qt as shouldReclaim, r as createAddonContext, rn as heapSpaceField, s as getOrInitReadinessRegistryForClient, sn as SOCKET_PLANE_TOP_N, st as validateProviderRegistrations, t as installManifestPythonDeps, tn as formatHeapSpaces, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, un as diffSocketPlane, ut as capActionSuffix, v as resolveHwAccel, vn as EVENT_PLANE_TOP_N, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xn as diffEventPlane, xt as resolveAddonClass, y as CapUsageRegistry, yn as createEventPlaneMeter, yt as copyBundledNativeModules, z as AGENT_CAP_FWD_ACTION, zt as createDeferredHeapWatchSink } from "./manifest-python-deps-BiWtkFGY.mjs";
+import { $ as buildNativeCapProxy, $t as RUNNER_HEAP_SNAPSHOT_ENV, A as createParentUnownedCallHandler, At as HUB_MAIN_HEAP_WATCH_LABEL, B as AGENT_CAP_FWD_SERVICE, Bt as createLoopDelayMeter, C as brokerTransportLink, Ct as runNpm, D as HUB_CAP_FWD_ACTION, Dt as HEAP_RECLAIM_TRIGGER_MB, E as localProviderLink, Et as HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS, F as createUdsLoggerWithControl, Ft as RUNNER_HEAP_WATCH_INTERVAL_MS, G as readMoleculerFanoutMode, Gt as parseRssBudgetMb, H as CapRouteError, Ht as describeRss, I as LocalChildClient, It as RUNNER_RSS_BUDGET_ENV, J as UdsLocalTransportServer, Jt as startHeapWatch, K as createLocalTransport, Kt as reclaimIntervalMs, L as LocalChildRegistry, Lt as ZERO_LOOP_DELAY, M as createUdsEventBus, Mt as HUB_RSS_BUDGET_ENV, N as udsChildLogToWorkerEntry, Nt as RSS_BUDGET_REANNOUNCE_MIN_MS, O as HUB_CAP_FWD_SERVICE, Ot as HEAP_WATCH_INTERVAL_MS, P as createUdsLogger, Pt as RSS_BUDGET_RELEASE_RATIO, Q as encodeFrame, Qt as HEAP_SPACE_REPORT_MIN_MB, R as UDS_NO_ROUTE_PREFIX, Rt as buildHeapSample, S as brokerCallForCap, Sn as formatEventPlane, St as resolveNpmInvocation, T as ipcParentLink, Tt as HEAP_RECLAIM_MIN_INTERVAL_MS, U as classifyCapRoute, Ut as hubMainRssBudget, V as CapRouteResolver, Vt as createV8Reclaimer, W as callWithServiceDiscovery, Wt as nextRssBudgetState, X as localEndpointPath, Xt as strandedMb, Y as SocketChannel, Yt as startRunnerHeapWatch, Z as FrameDecoder, Zt as DECISIVE_HEAP_SPACES, _ as createKernelHwAccel, _n as socketDirectionMessages, _t as CapabilityHandle, a as getWorkerDeviceRegistry, an as selectReportedSpaces, b as __resetCapUsageRegistryForTests, bn as createEventPlaneReader, bt as installManifestNativeDeps, c as setHubConnected, cn as createSocketPlaneMeter, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dn as formatSocketPlane, dt as capBareAction, en as emitHeapDiagnosticReport, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, fn as EMPTY_SOCKET_DIRECTION, ft as capServiceName, g as AddonDepsManager, gn as socketDirectionBytes, gt as DeviceRegistry, h as subscribePassthrough, hn as sampleSocketDirection, ht as serializeTypedArrays, i as createUdsAddonContext, in as readHeapSpaces, it as mountNativeCapService, j as createUdsEventBridge, jt as HUB_MAIN_RSS_BUDGET_MB, k as createHubCapForwardService, kt as HEAP_WATCH_WARN_RATIO, l as EVENT_TOPIC_PREFIX, ln as createSocketPlaneReader, lt as capActionName, m as setNodeEventInterest, mn as recordSocketFrame, mt as deserializeTypedArrays, n as adaptBrokerToCluster, nn as heapSnapshotAuthorised, o as getOrInitReadinessRegistry, on as EMPTY_SOCKET_PLANE_BASELINE, ot as createAddonService, p as registerEventBusService, pn as createSocketDirectionCounters, pt as parseCapAction, q as UdsLocalTransportClient, qt as shouldReclaim, r as createAddonContext, rn as heapSpaceField, s as getOrInitReadinessRegistryForClient, sn as SOCKET_PLANE_TOP_N, st as validateProviderRegistrations, t as installManifestPythonDeps, tn as formatHeapSpaces, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, un as diffSocketPlane, ut as capActionSuffix, v as resolveHwAccel, vn as EVENT_PLANE_TOP_N, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xn as diffEventPlane, xt as resolveAddonClass, y as CapUsageRegistry, yn as createEventPlaneMeter, yt as copyBundledNativeModules, z as AGENT_CAP_FWD_ACTION, zt as createDeferredHeapWatchSink } from "./manifest-python-deps-CD14Pv0-.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BWmQ5i-o.mjs";
 import { t as CustomActionRegistry } from "./custom-action-registry-F__gp_VX.mjs";
 import { z } from "zod";

package/dist/{manifest-python-deps-BiWtkFGY.mjs → manifest-python-deps-CD14Pv0-.mjs}

@@ -1,4 +1,4 @@
-import "./dist-D_NyUV6Y.mjs";
+import "./dist-LvKus-mT.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomBytes, randomUUID } from "node:crypto";
 import { ensureBinary, ensureFfmpeg, ensurePython, installPythonPackages, installPythonRequirements } from "@camstack/types/node";

package/dist/{manifest-python-deps-w48vOhGR.js → manifest-python-deps-DVODn-qc.js}

@@ -1,5 +1,5 @@
 const require_chunk = require("./chunk-Cek0wNdY.js");
-require("./dist-BPlfW-CG.js");
+require("./dist-CDgIzo82.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let _camstack_types_node = require("@camstack/types/node");

package/dist/{retired-settings-keys-DBY6ebwV.js → retired-settings-keys-BfAzWvPC.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-BPlfW-CG.js");
+const require_dist = require("./dist-CDgIzo82.js");
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/dist/{retired-settings-keys-Bq1Tb84I.mjs → retired-settings-keys-CV4QVdXj.mjs}

@@ -1,4 +1,4 @@
-import { zt as asJsonObject } from "./dist-D_NyUV6Y.mjs";
+import { zt as asJsonObject } from "./dist-LvKus-mT.mjs";
 //#region src/builtins/sqlite-storage/retired-settings-keys.ts
 /**
 * Is THIS node the one whose settings store is the cluster's authority?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.155",
+  "version": "1.2.156",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",