@camstack/system 1.2.157 → 1.2.160

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { B as doorbellCapability, Ft as DeviceType, Ht as createEvent, O as bareAddonId, Ot as errMsg, Q as isSourceCap, W as evaluateSensorEdge, Z as isSameAddonId, g as SOURCE_DEVICE_TYPES, h as SOURCE_CAPS, kt as BaseAddon, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { A as bareAddonId, Gt as createEvent, Mt as BaseAddon, Rt as DeviceType, U as doorbellCapability, _ as SOURCE_DEVICE_TYPES, et as isSameAddonId, g as SOURCE_CAPS, in as EventCategory, jt as errMsg, q as evaluateSensorEdge, tt as isSourceCap } from "../../dist-DKs---Vx.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DKs---Vx.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, kt as BaseAddon, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Gt as createEvent, Mt as BaseAddon, in as EventCategory, jt as errMsg } from "../../dist-DKs---Vx.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as authProviderCapability, Tt as userManagementCapability, kt as BaseAddon, r as ApiKeyRecordSchema, v as ScopedTokenSchema, x as UserRecordSchema } from "../../dist-LvKus-mT.mjs";
+import { C as UserRecordSchema, Mt as BaseAddon, O as authProviderCapability, Ot as userManagementCapability, b as ScopedTokenSchema, r as ApiKeyRecordSchema } from "../../dist-DKs---Vx.mjs";
 import * as crypto$2 from "node:crypto";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 const require_tls = require("../../tls-BxQlomxd.js");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, nt as localNetworkCapability, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, at as localNetworkCapability, in as EventCategory } from "../../dist-DKs---Vx.mjs";
 import { S as readLanHttpState, _ as DEFAULT_LAN_HTTP_PORT, a as writeTlsMode, i as writeExtraSans, l as reissueTlsLeaf, n as readTlsAccessStatus, o as validateUploadedTls, r as readTlsMode, s as ensureTlsCert, t as readExtraSans, y as applyLanHttp } from "../../tls-DOTmtLCW.mjs";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, rt as logDestinationCapability } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DKs---Vx.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_fs_promises = require("node:fs/promises");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Ht as createEvent, Ot as errMsg, ft as reducePoints, kt as BaseAddon, ot as metricsProviderCapability, pt as resolveBucketMs, q as foldSnapshotByFunction, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Gt as createEvent, Mt as BaseAddon, X as foldSnapshotByFunction, gt as resolveBucketMs, ht as reducePoints, in as EventCategory, jt as errMsg, lt as metricsProviderCapability } from "../../dist-DKs---Vx.mjs";
 import { readFile, readdir } from "node:fs/promises";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_child_process = require("node:child_process");
 let node_util = require("node:util");
 let node_fs = require("node:fs");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ot as errMsg, V as enumerateInferenceDevices, Wt as emitReadiness, kt as BaseAddon, tn as EventCategory, ut as platformProbeCapability, vt as scoreRuntimes } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, W as enumerateInferenceDevices, in as EventCategory, jt as errMsg, pt as platformProbeCapability, qt as emitReadiness, xt as scoreRuntimes } from "../../dist-DKs---Vx.mjs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as fs from "node:fs";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { kt as BaseAddon, tn as EventCategory } from "../../dist-LvKus-mT.mjs";
+import { Mt as BaseAddon, in as EventCategory } from "../../dist-DKs---Vx.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
 let _camstack_types_node = require("@camstack/types/node");

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Ft as DeviceType, I as deriveBatteryPresence, Jt as nodePin, Nt as DeviceFeature, O as bareAddonId, Ot as errMsg, bt as snapshotCapability, i as BatteryStatusSchema, k as batteryCapability, kt as BaseAddon, tn as EventCategory, wt as streamQualityLabel } from "../../dist-LvKus-mT.mjs";
+import { A as bareAddonId, Ct as snapshotCapability, Dt as streamQualityLabel, It as DeviceFeature, Mt as BaseAddon, Rt as DeviceType, Zt as nodePin, i as BatteryStatusSchema, in as EventCategory, j as batteryCapability, jt as errMsg, z as deriveBatteryPresence } from "../../dist-DKs---Vx.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
 import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CDgIzo82.js");
+const require_dist = require("../../dist-CcvXUhHK.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as storageProviderCapability, K as filesystemBrowseCapability, kt as BaseAddon } from "../../dist-LvKus-mT.mjs";
+import { Et as storageProviderCapability, Mt as BaseAddon, Y as filesystemBrowseCapability } from "../../dist-DKs---Vx.mjs";
 import { randomUUID } from "node:crypto";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";

package/dist/builtins/sqlite-storage/filter-compiler.d.ts

@@ -17,6 +17,22 @@
  * was written against it. `mutate` mode refuses both, before any SQL exists.
  * Emptying a collection is a legitimate thing to want, and it should be a
  * differently-named operation rather than a filter that happens to be empty.
+ * `measure` mode sits between them — see {@link FilterMode}.
+ *
+ * ── NULL is a value the language can name ────────────────────────────────
+ *
+ * A `null` on the right-hand side of `where` / `whereNot` compiles to `IS NULL`
+ * / `IS NOT NULL`, and binds no parameter. It used to compile to `= ?` / `!= ?`
+ * with a NULL parameter, and SQL three-valued logic makes both of those NULL
+ * for every row: the filter matched NOTHING and the caller got a `0` that
+ * looked like an answer. `pipelineAnalytics.countUnstampedEventMedia` — the
+ * gate that decides whether 152 GB of event media may be repointed onto
+ * another disk — asks exactly "how many rows have no `locationId`", and `0` is
+ * the one value that opens it. `whereNot: { field: null }` was the same defect
+ * mirrored: `(expr IS NULL OR expr != NULL)` is TRUE for a NULL row and NULL
+ * for every other, so it selected precisely the rows it was asked to exclude.
+ *
+ * Nothing could ever have MEANT `= NULL`; there is no caller to preserve.
  */
 /** The part of a declared collection this compiler needs. */
 export interface CollectionShape {
@@ -29,10 +45,28 @@ export interface CollectionShape {
      */
     readonly kvBlobColumn: string | null;
 }
-export type FilterMode = 'select' | 'mutate';
+/**
+ * How forgiving this compilation is allowed to be.
+ *
+ * - `select` — a predicate naming a field the collection cannot express is
+ *   SKIPPED. The caller receives the rows and can see for itself that the
+ *   filter did not bite; the cost is extra rows, not a wrong belief.
+ * - `measure` — the same predicate is REFUSED. A count, an aggregate or a
+ *   histogram hands back a NUMBER: the whole collection and the intended
+ *   subset are the same shape, and the caller has no way to tell which one it
+ *   was given. An empty filter is still fine — `COUNT(*)` over everything is a
+ *   legitimate question, unlike `DELETE` over everything. This closes the
+ *   asymmetry `aggregate` already applied to its FIELDS ("a dropped aggregate
+ *   returns a number that is wrong and looks exactly like a real one") but not
+ *   to its predicate.
+ * - `mutate` — refuses that AND an empty filter, which on a bulk write is the
+ *   entire collection.
+ */
+export type FilterMode = 'select' | 'measure' | 'mutate';
 /** Marshals a JS value to what the driver should bind. */
 export type SerializeValue = (value: unknown) => unknown;
 export interface QueryFilterInput {
+    /** Equality. A `null` value means `IS NULL` — see the file docblock. */
     readonly where?: Readonly<Record<string, unknown>>;
     readonly whereIn?: Readonly<Record<string, readonly unknown[]>>;
     readonly whereBetween?: Readonly<Record<string, readonly [unknown, unknown]>>;
@@ -40,6 +74,10 @@ export interface QueryFilterInput {
      * NULL-safe exclusion, compiled as `(expr IS NULL OR expr != ?)`. SQL `!=`
      * alone drops NULL rows, and on a nullable column those are precisely the
      * rows a "not this kind" filter must keep (they predate the column).
+     *
+     * A `null` VALUE means `IS NOT NULL` instead: "everything except the rows
+     * that carry no value" is the only reading of `whereNot: { f: null }` that
+     * is not a contradiction.
      */
     readonly whereNot?: Readonly<Record<string, unknown>>;
 }
@@ -53,7 +91,8 @@ export interface CompiledFilter {
     readonly whereSql: string;
     readonly params: readonly unknown[];
 }
-/** Thrown by `mutate` mode. Distinct type so a caller can map it to a 400. */
+/** Thrown by `measure` and `mutate` mode. Distinct type so a caller can map it
+ *  to a 400. */
 export declare class UnsafeFilterError extends Error {
     constructor(message: string);
 }

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -210,8 +210,12 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * (visibility, kind, device, time window, expiry) — so `total` counted rows
      * the page could never show, including other users'.
      *
-     * `select` mode, deliberately: `count` must be forgiving in exactly the way
-     * `query` is, or the two disagree again for a new reason.
+     * `measure` mode. `count` compiles the same predicates `query` does — the
+     * two must never disagree about WHICH rows they are talking about — but it
+     * refuses a predicate it cannot express rather than skipping it. `query`
+     * hands back rows and a caller can see the filter did not bite; a count
+     * hands back a number, and the whole collection and the intended subset are
+     * the same shape.
      */
     count({ namespace, collection, filter }: SettingsCountInput): Promise<number>;
     /**
@@ -223,8 +227,10 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * projection — an unresolvable field THROWS rather than being dropped, because
      * a missing aggregate comes back as a number that looks real.
      *
-     * `select` mode on the filter, so this agrees with `query` and `count` about
-     * which rows it is talking about.
+     * `measure` mode on the filter, so this agrees with `query` and `count`
+     * about which rows it is talking about — and, since 2026-08-30, refuses an
+     * unresolvable PREDICATE for the same reason it already refused an
+     * unresolvable FIELD. Both come back as a number that looks real.
      */
     aggregate({ namespace, collection, fields, filter, }: SettingsAggregateInput): Promise<SettingsAggregateResult>;
     histogram({ namespace, collection, field, bucketSize, origin, filter, }: SettingsHistogramInput): Promise<readonly HistogramBucket[]>;
@@ -305,15 +311,17 @@ export declare class SqliteSettingsBackend implements ISettingsBackend {
      * connection whose `sqlite_stat1` visibility and temp schema match.
      *
      * `EXPLAIN QUERY PLAN` prepares and plans; it does not execute the statement,
-     * so it costs no page reads of its own. It is still called only from the
-     * slow-call path, once per shape per window.
+     * so it costs no page reads of its own. In production it is called only from
+     * the slow-call path, once per shape per window; it is public so a guard can
+     * assert that a declared index is the one the planner actually picks — "we
+     * added an index" and "the query uses it" are different claims.
      *
      * Never throws. A plan that cannot be taken (a statement the engine will no
      * longer prepare, a closed handle mid-shutdown) is a missing ANSWER, not a
      * failure worth turning a slow query into a crash — the profiler falls back
      * to the line it would have printed anyway.
      */
-    private explainQueryPlan;
+    explainQueryPlan(sql: string, params: readonly unknown[]): readonly string[];
     /**
      * Run one synchronous statement under the profiler.
      *

package/dist/builtins/sqlite-storage/vector-index-shared.d.ts

@@ -8,6 +8,33 @@ export interface VectorMatchRow {
     readonly score: number;
     readonly metadata: VectorMetadata;
 }
+/**
+ * What one ranked search returned, INCLUDING the `k` it really ran with.
+ *
+ * `effectiveTopK` is part of the answer rather than a log line for the reason
+ * `vector-store.cap.ts` records: a ceiling the caller learns about only from
+ * the provider's own log is a number truncated in silence.
+ */
+export interface VectorQueryOutcome {
+    readonly matches: VectorMatchRow[];
+    readonly scanned: number;
+    readonly truncated: boolean;
+    readonly effectiveTopK: number;
+}
+/** One row read back WITH its vector, base64 Float32LE. */
+export interface VectorFetchRow {
+    readonly id: string;
+    readonly vector: string;
+    readonly metadata: VectorMetadata;
+}
+/** One page of an unranked walk. `nextCursor: null` means end of index. */
+export interface VectorScanPage {
+    readonly items: Array<{
+        id: string;
+        metadata: VectorMetadata;
+    }>;
+    readonly nextCursor: number | null;
+}
 export interface VectorIndexStats {
     readonly backend: string;
     readonly count: number;
@@ -32,15 +59,13 @@ export interface VectorIndexBackend {
         topK: number;
         minScore?: number;
         filter?: VectorFilter;
-    }): Promise<{
-        matches: VectorMatchRow[];
-        scanned: number;
-        truncated: boolean;
-    }>;
+    }): Promise<VectorQueryOutcome>;
     getByIds(index: string, ids: readonly string[]): Promise<Array<{
         id: string;
         metadata: VectorMetadata;
     }>>;
+    fetchByIds(index: string, ids: readonly string[]): Promise<VectorFetchRow[]>;
+    scan(index: string, cursor: number, limit: number): Promise<VectorScanPage>;
     deleteByIds(index: string, ids: readonly string[]): Promise<number>;
     deleteByFilter(index: string, filter: VectorFilter): Promise<number>;
     stats(index: string): Promise<VectorIndexStats>;

package/dist/builtins/sqlite-storage/vector-index-vec.d.ts

@@ -1,6 +1,6 @@
 import { IScopedLogger, VectorFilter, VectorMetadata, VectorMetric, encodeVectorBase64 } from '@camstack/types';
 import { SqliteOpProfiler } from './query-profiler.js';
-import { VectorIndexStats, VectorMatchRow } from './vector-index-shared.js';
+import { VectorFetchRow, VectorIndexStats, VectorQueryOutcome, VectorScanPage } from './vector-index-shared.js';
 /** The raw statement surface this index needs from better-sqlite3. */
 export interface RawSqliteDatabase {
     exec(sql: string): unknown;
@@ -68,11 +68,33 @@ export declare class SqliteVecVectorIndex {
         topK: number;
         minScore?: number;
         filter?: VectorFilter;
-    }): Promise<{
-        matches: VectorMatchRow[];
-        scanned: number;
-        truncated: boolean;
-    }>;
+    }): Promise<VectorQueryOutcome>;
+    /**
+     * Ids read back WITH their vectors.
+     *
+     * `vec0` returns a vector column as the packed Float32 blob it stores, which
+     * is byte-for-byte what `upsert` was given — so the round trip is a base64
+     * encode and nothing else. No re-normalisation, no float re-ordering: a
+     * gallery loaded through here ranks identically to one loaded from the JSON
+     * column it replaced.
+     */
+    fetchByIds(index: string, ids: readonly string[]): Promise<VectorFetchRow[]>;
+    /**
+     * One page of the whole index, unranked.
+     *
+     * `LIMIT ? OFFSET ?` over the `vec0` table with NO `MATCH` clause: a plain
+     * scan, so the extension's KNN `k` ceiling ({@link VEC_KNN_MAX_K}) does not
+     * apply and no distance is computed at all. Ordered by `id` so a cursor means
+     * the same thing across calls — `rowid` order is not stable under the
+     * DELETE-then-INSERT upsert this class performs.
+     *
+     * The cursor is an OFFSET, so rows deleted behind the walk shift the window.
+     * That is acceptable and deliberate for the one caller: a reconcile that
+     * misses a row this pass sees it next pass, and the alternative — a keyset
+     * cursor on a virtual table whose ordering the extension owns — buys nothing
+     * for a walk that is idempotent by construction.
+     */
+    scan(index: string, cursor: number, limit: number): Promise<VectorScanPage>;
     getByIds(index: string, ids: readonly string[]): Promise<Array<{
         id: string;
         metadata: VectorMetadata;

package/dist/builtins/storage-orchestrator/access-guards.d.ts

@@ -0,0 +1,32 @@
+import { StorageLocation } from '@camstack/types';
+/** What a provider answered about itself; `undefined` = not yet classified. */
+export type ProviderLocality = boolean | undefined;
+/**
+ * May `storage.resolve` return a path for this location?
+ *
+ * `resolve` is the only method on the cap whose result LEAVES the storage
+ * abstraction — every caller of it opens the string with `node:fs`. A remote
+ * provider answers with a path on the remote host, which on this node is
+ * either missing or an unrelated local directory of the same name. For the
+ * recorder, writing to the wrong place is not an error the operator sees; it
+ * is a black window in the footage.
+ *
+ * Only a POSITIVE `false` refuses. `undefined` is "not yet classified", not
+ * "remote" — and a conclusion drawn from a read that was never made is how a
+ * doorbell rang 0/3 (D49).
+ */
+export declare function resolveRefusalFor(location: StorageLocation, locality: ProviderLocality): string | null;
+/**
+ * Can this node's filesystem answer "does this location still hold anything?"
+ *
+ * Only for a provider it KNOWS to be node-local. Everything else is `unknown`,
+ * which refuses a delete.
+ *
+ * The direction that matters is the one this closes. A remote location carries
+ * a plain-looking `basePath` (`/backups/camstack`); `fs.readdir` of it on the
+ * hub answers `ENOENT`, and `ENOENT` is deliberately read as `empty` — because
+ * for a LOCAL location an absent root means there is nothing the delete can
+ * strand. Applied to a remote row, that same reasoning turns a full share into
+ * a vacant one and walks D293's delete guard straight past it.
+ */
+export declare function canProbeOccupancyLocally(locality: ProviderLocality): boolean;

package/dist/builtins/storage-orchestrator/location-secrets.d.ts

@@ -0,0 +1,33 @@
+import { StorageLocation } from '@camstack/types';
+/** Shared empty set for providers that declare no secrets (or are unknown). */
+export declare const EMPTY_SECRET_KEYS: ReadonlySet<string>;
+/** Minimal shape needed off a provider's `getProviderInfo()` result. */
+export interface ProviderInfoLike {
+    readonly providerId: string;
+    readonly configSchema: unknown;
+}
+/** Secret config keys a provider declares, derived from its own form schema. */
+export declare function secretKeysOfProviderInfo(info: ProviderInfoLike): ReadonlySet<string>;
+/**
+ * A copy of `config` with every declared secret replaced by the sentinel.
+ * Returns the SAME object when there is nothing to redact, so the common case
+ * (a filesystem location) allocates nothing.
+ *
+ * A key the provider declares secret but that is absent from the stored config
+ * is NOT invented — an absent password must keep reading as absent, or the
+ * wizard would show a credential where none is set and the write-back would
+ * then "keep" a value that never existed.
+ */
+export declare function redactLocationConfig(config: Readonly<Record<string, unknown>>, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;
+/** The same, applied to a whole location record. */
+export declare function redactLocation(location: StorageLocation, secretKeys: ReadonlySet<string>): StorageLocation;
+/**
+ * Undo the redaction on the way IN: any secret key whose incoming value is the
+ * sentinel is restored from what is already stored.
+ *
+ * A sentinel with NOTHING stored behind it is dropped rather than persisted —
+ * writing the literal `__camstack_redacted__` as a password is a
+ * lock-yourself-out bug that would only surface at the next connection
+ * attempt, hours later, as an authentication failure with no explanation.
+ */
+export declare function restoreRedactedSecrets(incoming: Readonly<Record<string, unknown>>, stored: Readonly<Record<string, unknown>> | undefined, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;

package/dist/builtins/storage-orchestrator/storage-migration-coordinator.d.ts

@@ -1,4 +1,4 @@
-import { RelocateFootageInput, RelocateJob, RelocateMediaInput, StorageMigrationFootageMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationMediaMoveInput, StorageMigrationPlan, UnstampedEventMediaCount } from '@camstack/types';
+import { RelocatableMediaCount, RelocatableMediaCountInput, RelocateFootageInput, RelocateJob, RelocateMediaInput, RelocateResidue, RelocateResidueInput, StorageMigrationDrainInput, StorageMigrationFootageMoveInput, StorageMigrationInput, StorageMigrationJob, StorageMigrationMediaMoveInput, StorageMigrationMover, StorageMigrationPlan, StorageMigrationResidue, UnstampedEventMediaCount } from '@camstack/types';
 import { StorageOrchestratorService } from './storage-orchestrator.service.js';
 export interface MigrationState {
     get(): Promise<StorageMigrationJob | null>;
@@ -24,6 +24,10 @@ export interface FootageMigrationParticipant extends LeaseParticipant {
     getMove(jobId: string): Promise<RelocateJob | null>;
     cancelMove(jobId: string): Promise<boolean>;
     refresh(leaseId: string): Promise<void>;
+    /** Every mover this engine knows about — including ones no migration armed. */
+    listMovers(): Promise<readonly RelocateJob[]>;
+    /** What a source STILL holds, from the durable hour ledger (D295). */
+    residue(input: RelocateResidueInput): Promise<RelocateResidue>;
 }
 export interface MediaMigrationParticipant extends LeaseParticipant {
     startMove(input: StorageMigrationMediaMoveInput): Promise<{
@@ -41,6 +45,11 @@ export interface MediaMigrationParticipant extends LeaseParticipant {
     getMove(jobId: string): Promise<RelocateJob | null>;
     cancelMove(jobId: string): Promise<boolean>;
     refresh(leaseId: string): Promise<void>;
+    /** Every mover this engine knows about — including ones no migration armed. */
+    listMovers(): Promise<readonly RelocateJob[]>;
+    /** How many rows a pass would still act on — the media lane's residue, from
+     *  the same derivation that produces its `filesTotal`. */
+    residue(input: RelocatableMediaCountInput): Promise<RelocatableMediaCount>;
 }
 export interface StorageMigrationParticipants {
     readonly pipeline: LeaseParticipant;
@@ -103,6 +112,67 @@ export declare class StorageMigrationCoordinator {
     start(input: StorageMigrationInput): Promise<string>;
     status(jobId?: string): Promise<StorageMigrationJob | null>;
     cancel(jobId: string): Promise<boolean>;
+    /**
+     * Every mover running right now, in both lanes — including the ones no
+     * migration armed.
+     *
+     * `status` already carries a migration's own progress (the coordinator folds
+     * it onto each move from the poll it is already doing). This exists for the
+     * other half: `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+     * are operator-callable, and until {@link drain} existed that was the only way
+     * to run a drain at all. Such a mover has no job to fold into, so without this
+     * read a five-hour operation is invisible in the UI.
+     *
+     * `migrationJobId` is best-effort by construction: the coordinator keeps ONE
+     * durable job, so a mover armed by an older, since-overwritten migration
+     * reports `null`. That is the honest answer — nothing here can still claim it.
+     */
+    movers(): Promise<readonly StorageMigrationMover[]>;
+    /**
+     * What every class's source STILL holds — the census behind a "drain
+     * remaining" action.
+     *
+     * A class appears here only when something is (or might be) left on a
+     * location that is not its default. An empty result therefore means exactly
+     * "there is nothing to drain", which is what lets the UI offer the action
+     * only when it is true, and what lets {@link drain} refuse rather than start
+     * a job that would move nothing and report `done` — the failure mode D295
+     * exists to end.
+     *
+     * `items: null` is "the archive could not be asked" and is still listed. A
+     * residue nobody could measure is the case an operator most needs to see;
+     * dropping it because the read failed would be the quiet success again.
+     */
+    residue(): Promise<readonly StorageMigrationResidue[]>;
+    /**
+     * Run the DRAIN half alone, against classes whose default has already moved.
+     *
+     * ## Why this is a second verb rather than a looser `start`
+     *
+     * `start` refuses a destination that is already the class's default
+     * (`"recordingsLow:ssd" is already the "recordingsLow" default`). That refusal
+     * is correct and it is load-bearing: there is genuinely nothing left to
+     * repoint, and an operator must never be able to re-repoint a migrated class
+     * by accident. Making `start` idempotent — "an already-repointed class
+     * proceeds straight to draining" — would delete that protection AND make the
+     * verb mean two different things depending on state, so the confirmation an
+     * operator reads ("pauses the writers…") would be a lie half the time.
+     *
+     * `drain` instead cannot repoint AT ALL: it never touches
+     * `setDefaultLocations`, and its job starts in `draining` with `repointed`
+     * already true, so the `repointing` / `refreshing` / `resuming` blocks of
+     * {@link run} are behind it and unreachable. The two verbs are disjoint, and
+     * `start`'s refusal keeps meaning exactly what it meant.
+     *
+     * ## Why it re-derives the work instead of resuming the old job
+     *
+     * The finished job is the audit of what happened; re-opening it destroys
+     * that. And a drain is needed in cases where no migration job ever existed
+     * (a mover armed by hand, footage stranded on a location an operator added
+     * and then un-defaulted). One job = one operation, and the work list comes
+     * from {@link residue} — the archive — not from what a previous job believed.
+     */
+    drain(input: StorageMigrationDrainInput): Promise<string>;
     /** Boot recovery resumes a durable unfinished state. A missing in-memory
      * child mover is recreated from the same copy-if-absent input. */
     recover(): Promise<void>;
@@ -143,9 +213,10 @@ export declare class StorageMigrationCoordinator {
      *
      * The gate is the RE-COUNT, not the seal job's terminal state: a seal that
      * failed some rows still finishes, and "finished" is not "there are none
-     * left". A non-zero count here fails the job while nothing has been paused
+     * left". A remaining row here fails the job while nothing has been paused
      * and nothing has been repointed, which is the cheapest possible place to
-     * discover it.
+     * discover it. So does a re-count that could not be TAKEN: the gate opens on
+     * a measured absence, and only on that.
      *
      * The seal's own mover job id is deliberately NOT durable. It is idempotent
      * and cheap, so a coordinator restart mid-seal simply re-runs the whole