@camstack/system 1.2.156 → 1.2.159

package/dist/builtins/storage-orchestrator/location-secrets.d.ts

@@ -0,0 +1,33 @@
+import { StorageLocation } from '@camstack/types';
+/** Shared empty set for providers that declare no secrets (or are unknown). */
+export declare const EMPTY_SECRET_KEYS: ReadonlySet<string>;
+/** Minimal shape needed off a provider's `getProviderInfo()` result. */
+export interface ProviderInfoLike {
+    readonly providerId: string;
+    readonly configSchema: unknown;
+}
+/** Secret config keys a provider declares, derived from its own form schema. */
+export declare function secretKeysOfProviderInfo(info: ProviderInfoLike): ReadonlySet<string>;
+/**
+ * A copy of `config` with every declared secret replaced by the sentinel.
+ * Returns the SAME object when there is nothing to redact, so the common case
+ * (a filesystem location) allocates nothing.
+ *
+ * A key the provider declares secret but that is absent from the stored config
+ * is NOT invented — an absent password must keep reading as absent, or the
+ * wizard would show a credential where none is set and the write-back would
+ * then "keep" a value that never existed.
+ */
+export declare function redactLocationConfig(config: Readonly<Record<string, unknown>>, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;
+/** The same, applied to a whole location record. */
+export declare function redactLocation(location: StorageLocation, secretKeys: ReadonlySet<string>): StorageLocation;
+/**
+ * Undo the redaction on the way IN: any secret key whose incoming value is the
+ * sentinel is restored from what is already stored.
+ *
+ * A sentinel with NOTHING stored behind it is dropped rather than persisted —
+ * writing the literal `__camstack_redacted__` as a password is a
+ * lock-yourself-out bug that would only surface at the next connection
+ * attempt, hours later, as an authentication failure with no explanation.
+ */
+export declare function restoreRedactedSecrets(incoming: Readonly<Record<string, unknown>>, stored: Readonly<Record<string, unknown>> | undefined, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;

package/dist/builtins/storage-orchestrator/storage-migration-coordinator.d.ts

@@ -1,4 +1,4 @@
-import { RelocateFootageInput, RelocateJob, RelocateMediaInput, StorageMigrationFootageMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationMediaMoveInput, StorageMigrationPlan, UnstampedEventMediaCount } from '@camstack/types';
+import { RelocatableMediaCount, RelocatableMediaCountInput, RelocateFootageInput, RelocateJob, RelocateMediaInput, RelocateResidue, RelocateResidueInput, StorageMigrationDrainInput, StorageMigrationFootageMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationMediaMoveInput, StorageMigrationMover, StorageMigrationPlan, StorageMigrationResidue, UnstampedEventMediaCount } from '@camstack/types';
 import { StorageOrchestratorService } from './storage-orchestrator.service.js';
 export interface MigrationState {
     get(): Promise<StorageMigrationJob | null>;
@@ -24,6 +24,10 @@ export interface FootageMigrationParticipant extends LeaseParticipant {
     getMove(jobId: string): Promise<RelocateJob | null>;
     cancelMove(jobId: string): Promise<boolean>;
     refresh(leaseId: string): Promise<void>;
+    /** Every mover this engine knows about — including ones no migration armed. */
+    listMovers(): Promise<readonly RelocateJob[]>;
+    /** What a source STILL holds, from the durable hour ledger (D295). */
+    residue(input: RelocateResidueInput): Promise<RelocateResidue>;
 }
 export interface MediaMigrationParticipant extends LeaseParticipant {
     startMove(input: StorageMigrationMediaMoveInput): Promise<{
@@ -41,6 +45,11 @@ export interface MediaMigrationParticipant extends LeaseParticipant {
     getMove(jobId: string): Promise<RelocateJob | null>;
     cancelMove(jobId: string): Promise<boolean>;
     refresh(leaseId: string): Promise<void>;
+    /** Every mover this engine knows about — including ones no migration armed. */
+    listMovers(): Promise<readonly RelocateJob[]>;
+    /** How many rows a pass would still act on — the media lane's residue, from
+     *  the same derivation that produces its `filesTotal`. */
+    residue(input: RelocatableMediaCountInput): Promise<RelocatableMediaCount>;
 }
 export interface StorageMigrationParticipants {
     readonly pipeline: LeaseParticipant;
@@ -103,6 +112,67 @@ export declare class StorageMigrationCoordinator {
     start(input: StorageMigrationInput): Promise<string>;
     status(jobId?: string): Promise<StorageMigrationJob | null>;
     cancel(jobId: string): Promise<boolean>;
+    /**
+     * Every mover running right now, in both lanes — including the ones no
+     * migration armed.
+     *
+     * `status` already carries a migration's own progress (the coordinator folds
+     * it onto each move from the poll it is already doing). This exists for the
+     * other half: `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+     * are operator-callable, and until {@link drain} existed that was the only way
+     * to run a drain at all. Such a mover has no job to fold into, so without this
+     * read a five-hour operation is invisible in the UI.
+     *
+     * `migrationJobId` is best-effort by construction: the coordinator keeps ONE
+     * durable job, so a mover armed by an older, since-overwritten migration
+     * reports `null`. That is the honest answer — nothing here can still claim it.
+     */
+    movers(): Promise<readonly StorageMigrationMover[]>;
+    /**
+     * What every class's source STILL holds — the census behind a "drain
+     * remaining" action.
+     *
+     * A class appears here only when something is (or might be) left on a
+     * location that is not its default. An empty result therefore means exactly
+     * "there is nothing to drain", which is what lets the UI offer the action
+     * only when it is true, and what lets {@link drain} refuse rather than start
+     * a job that would move nothing and report `done` — the failure mode D295
+     * exists to end.
+     *
+     * `items: null` is "the archive could not be asked" and is still listed. A
+     * residue nobody could measure is the case an operator most needs to see;
+     * dropping it because the read failed would be the quiet success again.
+     */
+    residue(): Promise<readonly StorageMigrationResidue[]>;
+    /**
+     * Run the DRAIN half alone, against classes whose default has already moved.
+     *
+     * ## Why this is a second verb rather than a looser `start`
+     *
+     * `start` refuses a destination that is already the class's default
+     * (`"recordingsLow:ssd" is already the "recordingsLow" default`). That refusal
+     * is correct and it is load-bearing: there is genuinely nothing left to
+     * repoint, and an operator must never be able to re-repoint a migrated class
+     * by accident. Making `start` idempotent — "an already-repointed class
+     * proceeds straight to draining" — would delete that protection AND make the
+     * verb mean two different things depending on state, so the confirmation an
+     * operator reads ("pauses the writers…") would be a lie half the time.
+     *
+     * `drain` instead cannot repoint AT ALL: it never touches
+     * `setDefaultLocations`, and its job starts in `draining` with `repointed`
+     * already true, so the `repointing` / `refreshing` / `resuming` blocks of
+     * {@link run} are behind it and unreachable. The two verbs are disjoint, and
+     * `start`'s refusal keeps meaning exactly what it meant.
+     *
+     * ## Why it re-derives the work instead of resuming the old job
+     *
+     * The finished job is the audit of what happened; re-opening it destroys
+     * that. And a drain is needed in cases where no migration job ever existed
+     * (a mover armed by hand, footage stranded on a location an operator added
+     * and then un-defaulted). One job = one operation, and the work list comes
+     * from {@link residue} — the archive — not from what a previous job believed.
+     */
+    drain(input: StorageMigrationDrainInput): Promise<string>;
     /** Boot recovery resumes a durable unfinished state. A missing in-memory
      * child mover is recreated from the same copy-if-absent input. */
     recover(): Promise<void>;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -15,6 +15,19 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      * `undefined` (treated as node-agnostic).
      */
     private readonly nodeLocalByProvider;
+    /**
+     * Cached `providerId → secret config keys`, derived from each provider's own
+     * `configSchema` in the SAME refresh as `nodeLocalByProvider` — one
+     * `getProviderInfo()` round trip answers both questions.
+     *
+     * An absent providerId yields an EMPTY set, which redacts nothing. That is
+     * the one direction this cache can be wrong in, so it is worth saying why it
+     * is acceptable: the entry is populated at the same moment the provider
+     * becomes resolvable at all, so a location whose provider is unknown here
+     * cannot be dispatched to either — there is no window in which a credential
+     * is readable through a provider the orchestrator can otherwise use.
+     */
+    private readonly secretKeysByProvider;
     /**
      * Disposers run on `onShutdown` — currently the eventBus subscription
      * for `capability:provider-registered` events used by the lazy seed
@@ -61,6 +74,19 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      * the recorder so disk-pressure is a single core concern.
      */
     private resolveLocationThresholds;
+    /** Declared secret config keys for a provider; empty when unknown. */
+    private secretKeysFor;
+    /** A location with its provider's declared secrets replaced by the sentinel. */
+    private redacted;
+    /**
+     * Is this location backed by a provider that serves a genuine local
+     * filesystem? `true` / `false` / `undefined` — see
+     * `StorageOrchestratorService.refuseIncompatibleProvider` for why the
+     * unknown case is kept distinct rather than folded into either answer.
+     */
+    private providerIsNodeLocal;
+    /** See the call site in the `resolve` dispatch, and `access-guards.ts`. */
+    private refuseRemoteResolve;
     /** statfs capacity of a location's basePath, walking up to the nearest
      *  existing ancestor. Null for remote-node locations or unstattable paths. */
     private localCapacityOf;