@camstack/system 1.2.163 → 1.2.165

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B29Skpzo.js");
+const require_dist = require("../../dist-BhE8zNfY.js");
 let node_crypto = require("node:crypto");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -237,39 +237,15 @@ var STORAGE_CLASSES = [
 	"recordings",
 	"recordingsLow",
 	"eventMedia",
-	"backups",
-	"galleryMedia"
+	"backups"
 ];
 /** The classes footage/media movers actually own. Everything else is planned,
 *  reported and refused rather than silently accepted. */
 var MOVER_CLASSES = [
 	"recordings",
 	"recordingsLow",
-	"eventMedia",
-	"galleryMedia"
+	"eventMedia"
 ];
-/**
-* Classes that can never span two locations at once.
-*
-* `galleryMedia` is `cardinality: 'single'` and `upsertLocation` refuses a
-* second instance of a single type, so the "both locations are first-class for
-* reads while the past drains" transient the non-blocking mode rests on is not
-* merely undesirable there — it is not constructible. Its move is therefore
-* stop-the-world, always. That is acceptable only because the enrolled gallery
-* is a few KB per sample, and it is said here rather than discovered.
-*/
-var BLOCKING_ONLY_CLASSES = ["galleryMedia"];
-/**
-* Location types whose volume `galleryMedia` must NEVER land on.
-*
-* Verbatim from its own declaration: *"Deliberately NOT on the recordings
-* volume: these images survive every retention sweep, so they must also survive
-* a footage wipe, a quota eviction and a recordings disk swap."* A planner that
-* accepted `galleryMedia` → the recordings volume would let an operator destroy
-* the enrolment gallery on the next disk swap, months later, with no visible
-* link back to this decision.
-*/
-var GALLERY_FORBIDDEN_NEIGHBOUR_TYPES = ["recordings", "recordingsLow"];
 /** The two single-flight mover engines. Lanes run in parallel; within a lane,
 *  classes run FIFO because the engine refuses a second concurrent job. */
 var MOVE_LANES = ["media", "footage"];
@@ -309,6 +285,7 @@ var StorageMigrationCoordinator = class {
 		this.deps = deps;
 	}
 	async plan(input) {
+		refuseRetiredGalleryClass(input.destinations);
 		const mode = input.mode ?? "blocking";
 		const moves = [];
 		const findings = [];
@@ -322,8 +299,6 @@ var StorageMigrationCoordinator = class {
 			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
 			if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
 			if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" — the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
-			if (mode === "nonBlocking" && BLOCKING_ONLY_CLASSES.includes(storageClass)) throw new Error(`"${storageClass}" is a single-cardinality storage class: it can never exist at two locations at once, so it cannot be repointed first and drained behind. Use mode "blocking".`);
-			await this.refuseGalleryOntoRecordingsVolume(storageClass, targetId);
 			moves.push({
 				storageClass,
 				fromLocationId: source.id,
@@ -333,11 +308,6 @@ var StorageMigrationCoordinator = class {
 				error: null,
 				progress: null
 			});
-			if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
-				code: "blockingOnly",
-				storageClass,
-				message: `"${storageClass}" is single-cardinality: this move is stop-the-world for its whole duration, in every mode. It is a few KB per enrolled sample, which is why that is acceptable.`
-			});
 			findings.push(...await this.deviceFindings(storageClass, source.id, target.id));
 		}
 		if (moves.length === 0) throw new Error("select at least one storage class");
@@ -372,29 +342,6 @@ var StorageMigrationCoordinator = class {
 			findings
 		};
 	}
-	/**
-	* HARD refusal: `galleryMedia` onto a volume a recordings class lives on.
-	*
-	* This is the one same-device case that is a refusal rather than a finding,
-	* because its consequence is silent and arrives months later — the gallery is
-	* wiped by the next footage wipe, quota eviction or recordings disk swap, and
-	* nothing at that moment points back at this migration.
-	*
-	* It can only refuse what it can SEE. `deviceKeyOf` is a realpath, so it
-	* catches a symlink, a bind mount and a literally-shared directory — and
-	* misses two distinct directories on one filesystem, and any location pinned
-	* to another node. Those come back `null`/distinct and produce a
-	* `deviceIdentityUnknown` finding instead.
-	*/
-	async refuseGalleryOntoRecordingsVolume(storageClass, targetId) {
-		if (storageClass !== "galleryMedia") return;
-		const targetKey = await this.deviceKey(targetId);
-		if (targetKey === null) return;
-		for (const type of GALLERY_FORBIDDEN_NEIGHBOUR_TYPES) for (const neighbour of this.deps.locations.listLocations({ type })) {
-			if (await this.deviceKey(neighbour.id) !== targetKey) continue;
-			throw new Error(`Storage location "${targetId}" shares a volume with "${neighbour.id}" (${type}). galleryMedia is deliberately NOT on the recordings volume: enrolment images survive every retention sweep, so they must also survive a footage wipe, a quota eviction and a recordings disk swap. Choose a destination on another volume.`);
-		}
-	}
 	/** Same-device observations that are reported, not refused. */
 	async deviceFindings(storageClass, sourceId, targetId) {
 		if (this.deps.deviceKeyOf === void 0) return [];
@@ -526,7 +473,7 @@ var StorageMigrationCoordinator = class {
 			if (laneOf(storageClass) === "media") {
 				const count = await unanswerable(this.deps.participants.analytics.residue({
 					toLocationId: target.id,
-					mode: storageClass === "galleryMedia" ? "gallery" : "move"
+					mode: "move"
 				}));
 				if (count !== null && count.rows === 0) continue;
 				out.push({
@@ -805,9 +752,7 @@ var StorageMigrationCoordinator = class {
 	*
 	* Two lanes — the recorder's footage engine and post-analysis's media engine
 	* — run in parallel with each other and strictly FIFO within themselves.
-	* `galleryMedia` shares the media lane with `eventMedia` because it shares
-	* the same `MediaRelocateEngine`, which refuses a second running job; starting
-	* both would fail the second one instantly.
+	* `eventMedia` is the only class on the media lane.
 	*/
 	async startOrResumeMoves(job) {
 		if (job.cancelRequested) return;
@@ -937,7 +882,7 @@ var StorageMigrationCoordinator = class {
 			const input = {
 				toLocationId: move.toLocationId,
 				throttleMbps: job.throttleMbps,
-				mode: move.storageClass === "galleryMedia" ? "gallery" : "move"
+				mode: "move"
 			};
 			return (unleased ? await this.deps.participants.analytics.startDrain(input) : await this.deps.participants.analytics.startMove({
 				...input,
@@ -1011,13 +956,18 @@ function isTerminal(job) {
 }
 /**
 * Which single-flight engine owns a class.
-*
-* `galleryMedia` is in the media lane not because it is event media — it
-* explicitly is not (D197) — but because it is moved by the same
-* `MediaRelocateEngine`, which refuses a second running job.
 */
 function laneOf(storageClass) {
-	return storageClass === "eventMedia" || storageClass === "galleryMedia" ? "media" : "footage";
+	return storageClass === "eventMedia" ? "media" : "footage";
+}
+/**
+* The enrolled gallery is the analytics addon's data dir, not a storage class
+* an operator migrates. A leftover destination from an older client is refused
+* rather than silently dropped.
+*/
+function refuseRetiredGalleryClass(destinations) {
+	if (destinations.galleryMedia === void 0) return;
+	throw new Error("galleryMedia is no longer a storage class. Enrolled gallery lives in the pipeline-analytics addon data directory, not a location the operator places.");
 }
 /**
 * True when this phase runs with every writer already back up, so no
@@ -1472,14 +1422,13 @@ var StorageOrchestratorService = class {
 	/**
 	* Shout about a persisted row that is BOTH the type default and disabled.
 	*
-	* `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
-	* default) and neither can `setDefaultLocations` — but hydrate writes rows
-	* straight into the map without either, so a hand-edited store, a partial
-	* migration or a row written by another build can. It matters because every
-	* bare-type ref resolves through {@link getDefaultLocation}: on such a row
+	* `upsertLocation` can now produce this (enabled is the write set; `isDefault`
+	* is store residue). Hydrate also writes rows straight into the map, so a
+	* hand-edited store or a row written by another build can too. It matters
+	* because every bare-type ref still resolves through {@link getDefaultLocation}
+	* until Stage 5 of the enabled-write-set design: on such a row
 	* `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-	* drain destination both point at a disk the operator turned off. That is the
-	* one thing this model must never do silently.
+	* drain destination both point at a disk the operator turned off.
 	*
 	* Reported, never repaired: flipping an operator's flag back on at boot would
 	* be the system overruling the switch instead of obeying it. The coordinator
@@ -1763,6 +1712,7 @@ var StorageOrchestratorService = class {
 			createdAt: existing?.createdAt ?? now,
 			updatedAt: now
 		};
+		refuseLastWriteTargetDisabled(existing, next, this.locations.values());
 		const demoted = [];
 		if (next.isDefault) {
 			for (const [otherId, otherLoc] of this.locations) if (otherLoc.type === next.type && otherLoc.id !== next.id && otherLoc.isDefault) {
@@ -2061,9 +2011,27 @@ function resolveEnabled(input, existing, typeAlreadyHasLocation) {
 		if (existing) return {};
 		return { enabled: input.isDefault || !typeAlreadyHasLocation };
 	}
-	if (input.isDefault && requested === false) return { enabled: true };
 	return { enabled: requested };
 }
+/** Types that may have zero enabled locations. Backups with none is sad, not illegal. */
+var OPTIONAL_WRITE_TYPES = new Set(["backups"]);
+/**
+* Refuse an UPDATE that would leave a write-serving type with no enabled
+* location. Creates are exempt (an explicit `enabled: false` on the first
+* location is already a named test). `isDefault` is not consulted — enabled
+* is the write set.
+*/
+function refuseLastWriteTargetDisabled(existing, next, locations) {
+	if (OPTIONAL_WRITE_TYPES.has(next.type)) return;
+	if (next.enabled !== false) return;
+	if (existing === void 0) return;
+	if (existing.enabled === false) return;
+	for (const loc of locations) {
+		if (loc.id === next.id || loc.type !== next.type) continue;
+		if (loc.enabled !== false) return;
+	}
+	throw new Error(`Cannot disable "${next.id}": it is the last enabled location of type "${next.type}". Enable another location of this type first.`);
+}
 //#endregion
 //#region src/builtins/storage-orchestrator/storage-pressure-manager.ts
 var DEFAULT_MAX_ROUNDS = 8;

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-DxFjna2a.mjs";
+import { Mt as BaseAddon, N as collectSecretConfigKeys, Qt as parseJsonObject, S as StorageMigrationJobSchema, St as settingsStoreCapability, Tt as storageMigrationCapability, m as REDACTED_SECRET, wt as storageCapability, x as StorageLocationTypeSchema } from "../../dist-BpsHt11f.mjs";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";
 import * as path$1 from "node:path";
@@ -230,39 +230,15 @@ var STORAGE_CLASSES = [
 	"recordings",
 	"recordingsLow",
 	"eventMedia",
-	"backups",
-	"galleryMedia"
+	"backups"
 ];
 /** The classes footage/media movers actually own. Everything else is planned,
 *  reported and refused rather than silently accepted. */
 var MOVER_CLASSES = [
 	"recordings",
 	"recordingsLow",
-	"eventMedia",
-	"galleryMedia"
+	"eventMedia"
 ];
-/**
-* Classes that can never span two locations at once.
-*
-* `galleryMedia` is `cardinality: 'single'` and `upsertLocation` refuses a
-* second instance of a single type, so the "both locations are first-class for
-* reads while the past drains" transient the non-blocking mode rests on is not
-* merely undesirable there — it is not constructible. Its move is therefore
-* stop-the-world, always. That is acceptable only because the enrolled gallery
-* is a few KB per sample, and it is said here rather than discovered.
-*/
-var BLOCKING_ONLY_CLASSES = ["galleryMedia"];
-/**
-* Location types whose volume `galleryMedia` must NEVER land on.
-*
-* Verbatim from its own declaration: *"Deliberately NOT on the recordings
-* volume: these images survive every retention sweep, so they must also survive
-* a footage wipe, a quota eviction and a recordings disk swap."* A planner that
-* accepted `galleryMedia` → the recordings volume would let an operator destroy
-* the enrolment gallery on the next disk swap, months later, with no visible
-* link back to this decision.
-*/
-var GALLERY_FORBIDDEN_NEIGHBOUR_TYPES = ["recordings", "recordingsLow"];
 /** The two single-flight mover engines. Lanes run in parallel; within a lane,
 *  classes run FIFO because the engine refuses a second concurrent job. */
 var MOVE_LANES = ["media", "footage"];
@@ -302,6 +278,7 @@ var StorageMigrationCoordinator = class {
 		this.deps = deps;
 	}
 	async plan(input) {
+		refuseRetiredGalleryClass(input.destinations);
 		const mode = input.mode ?? "blocking";
 		const moves = [];
 		const findings = [];
@@ -315,8 +292,6 @@ var StorageMigrationCoordinator = class {
 			if (target.type !== storageClass) throw new Error(`Storage location "${targetId}" is type "${target.type}", expected "${storageClass}"`);
 			if (source.id === target.id) throw new Error(`Storage location "${targetId}" is already the "${storageClass}" default`);
 			if (!MOVER_CLASSES.includes(storageClass)) throw new Error(`No mover owns "${storageClass}" — the migration can repoint its default but cannot move its bytes. Move it by hand, then repoint the default with upsertLocation.`);
-			if (mode === "nonBlocking" && BLOCKING_ONLY_CLASSES.includes(storageClass)) throw new Error(`"${storageClass}" is a single-cardinality storage class: it can never exist at two locations at once, so it cannot be repointed first and drained behind. Use mode "blocking".`);
-			await this.refuseGalleryOntoRecordingsVolume(storageClass, targetId);
 			moves.push({
 				storageClass,
 				fromLocationId: source.id,
@@ -326,11 +301,6 @@ var StorageMigrationCoordinator = class {
 				error: null,
 				progress: null
 			});
-			if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
-				code: "blockingOnly",
-				storageClass,
-				message: `"${storageClass}" is single-cardinality: this move is stop-the-world for its whole duration, in every mode. It is a few KB per enrolled sample, which is why that is acceptable.`
-			});
 			findings.push(...await this.deviceFindings(storageClass, source.id, target.id));
 		}
 		if (moves.length === 0) throw new Error("select at least one storage class");
@@ -365,29 +335,6 @@ var StorageMigrationCoordinator = class {
 			findings
 		};
 	}
-	/**
-	* HARD refusal: `galleryMedia` onto a volume a recordings class lives on.
-	*
-	* This is the one same-device case that is a refusal rather than a finding,
-	* because its consequence is silent and arrives months later — the gallery is
-	* wiped by the next footage wipe, quota eviction or recordings disk swap, and
-	* nothing at that moment points back at this migration.
-	*
-	* It can only refuse what it can SEE. `deviceKeyOf` is a realpath, so it
-	* catches a symlink, a bind mount and a literally-shared directory — and
-	* misses two distinct directories on one filesystem, and any location pinned
-	* to another node. Those come back `null`/distinct and produce a
-	* `deviceIdentityUnknown` finding instead.
-	*/
-	async refuseGalleryOntoRecordingsVolume(storageClass, targetId) {
-		if (storageClass !== "galleryMedia") return;
-		const targetKey = await this.deviceKey(targetId);
-		if (targetKey === null) return;
-		for (const type of GALLERY_FORBIDDEN_NEIGHBOUR_TYPES) for (const neighbour of this.deps.locations.listLocations({ type })) {
-			if (await this.deviceKey(neighbour.id) !== targetKey) continue;
-			throw new Error(`Storage location "${targetId}" shares a volume with "${neighbour.id}" (${type}). galleryMedia is deliberately NOT on the recordings volume: enrolment images survive every retention sweep, so they must also survive a footage wipe, a quota eviction and a recordings disk swap. Choose a destination on another volume.`);
-		}
-	}
 	/** Same-device observations that are reported, not refused. */
 	async deviceFindings(storageClass, sourceId, targetId) {
 		if (this.deps.deviceKeyOf === void 0) return [];
@@ -519,7 +466,7 @@ var StorageMigrationCoordinator = class {
 			if (laneOf(storageClass) === "media") {
 				const count = await unanswerable(this.deps.participants.analytics.residue({
 					toLocationId: target.id,
-					mode: storageClass === "galleryMedia" ? "gallery" : "move"
+					mode: "move"
 				}));
 				if (count !== null && count.rows === 0) continue;
 				out.push({
@@ -798,9 +745,7 @@ var StorageMigrationCoordinator = class {
 	*
 	* Two lanes — the recorder's footage engine and post-analysis's media engine
 	* — run in parallel with each other and strictly FIFO within themselves.
-	* `galleryMedia` shares the media lane with `eventMedia` because it shares
-	* the same `MediaRelocateEngine`, which refuses a second running job; starting
-	* both would fail the second one instantly.
+	* `eventMedia` is the only class on the media lane.
 	*/
 	async startOrResumeMoves(job) {
 		if (job.cancelRequested) return;
@@ -930,7 +875,7 @@ var StorageMigrationCoordinator = class {
 			const input = {
 				toLocationId: move.toLocationId,
 				throttleMbps: job.throttleMbps,
-				mode: move.storageClass === "galleryMedia" ? "gallery" : "move"
+				mode: "move"
 			};
 			return (unleased ? await this.deps.participants.analytics.startDrain(input) : await this.deps.participants.analytics.startMove({
 				...input,
@@ -1004,13 +949,18 @@ function isTerminal(job) {
 }
 /**
 * Which single-flight engine owns a class.
-*
-* `galleryMedia` is in the media lane not because it is event media — it
-* explicitly is not (D197) — but because it is moved by the same
-* `MediaRelocateEngine`, which refuses a second running job.
 */
 function laneOf(storageClass) {
-	return storageClass === "eventMedia" || storageClass === "galleryMedia" ? "media" : "footage";
+	return storageClass === "eventMedia" ? "media" : "footage";
+}
+/**
+* The enrolled gallery is the analytics addon's data dir, not a storage class
+* an operator migrates. A leftover destination from an older client is refused
+* rather than silently dropped.
+*/
+function refuseRetiredGalleryClass(destinations) {
+	if (destinations.galleryMedia === void 0) return;
+	throw new Error("galleryMedia is no longer a storage class. Enrolled gallery lives in the pipeline-analytics addon data directory, not a location the operator places.");
 }
 /**
 * True when this phase runs with every writer already back up, so no
@@ -1465,14 +1415,13 @@ var StorageOrchestratorService = class {
 	/**
 	* Shout about a persisted row that is BOTH the type default and disabled.
 	*
-	* `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
-	* default) and neither can `setDefaultLocations` — but hydrate writes rows
-	* straight into the map without either, so a hand-edited store, a partial
-	* migration or a row written by another build can. It matters because every
-	* bare-type ref resolves through {@link getDefaultLocation}: on such a row
+	* `upsertLocation` can now produce this (enabled is the write set; `isDefault`
+	* is store residue). Hydrate also writes rows straight into the map, so a
+	* hand-edited store or a row written by another build can too. It matters
+	* because every bare-type ref still resolves through {@link getDefaultLocation}
+	* until Stage 5 of the enabled-write-set design: on such a row
 	* `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-	* drain destination both point at a disk the operator turned off. That is the
-	* one thing this model must never do silently.
+	* drain destination both point at a disk the operator turned off.
 	*
 	* Reported, never repaired: flipping an operator's flag back on at boot would
 	* be the system overruling the switch instead of obeying it. The coordinator
@@ -1756,6 +1705,7 @@ var StorageOrchestratorService = class {
 			createdAt: existing?.createdAt ?? now,
 			updatedAt: now
 		};
+		refuseLastWriteTargetDisabled(existing, next, this.locations.values());
 		const demoted = [];
 		if (next.isDefault) {
 			for (const [otherId, otherLoc] of this.locations) if (otherLoc.type === next.type && otherLoc.id !== next.id && otherLoc.isDefault) {
@@ -2054,9 +2004,27 @@ function resolveEnabled(input, existing, typeAlreadyHasLocation) {
 		if (existing) return {};
 		return { enabled: input.isDefault || !typeAlreadyHasLocation };
 	}
-	if (input.isDefault && requested === false) return { enabled: true };
 	return { enabled: requested };
 }
+/** Types that may have zero enabled locations. Backups with none is sad, not illegal. */
+var OPTIONAL_WRITE_TYPES = new Set(["backups"]);
+/**
+* Refuse an UPDATE that would leave a write-serving type with no enabled
+* location. Creates are exempt (an explicit `enabled: false` on the first
+* location is already a named test). `isDefault` is not consulted — enabled
+* is the write set.
+*/
+function refuseLastWriteTargetDisabled(existing, next, locations) {
+	if (OPTIONAL_WRITE_TYPES.has(next.type)) return;
+	if (next.enabled !== false) return;
+	if (existing === void 0) return;
+	if (existing.enabled === false) return;
+	for (const loc of locations) {
+		if (loc.id === next.id || loc.type !== next.type) continue;
+		if (loc.enabled !== false) return;
+	}
+	throw new Error(`Cannot disable "${next.id}": it is the last enabled location of type "${next.type}". Enable another location of this type first.`);
+}
 //#endregion
 //#region src/builtins/storage-orchestrator/storage-pressure-manager.ts
 var DEFAULT_MAX_ROUNDS = 8;

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -186,14 +186,13 @@ export declare class StorageOrchestratorService {
     /**
      * Shout about a persisted row that is BOTH the type default and disabled.
      *
-     * `upsertLocation` cannot produce this (`resolveEnabled` force-enables a
-     * default) and neither can `setDefaultLocations` — but hydrate writes rows
-     * straight into the map without either, so a hand-edited store, a partial
-     * migration or a row written by another build can. It matters because every
-     * bare-type ref resolves through {@link getDefaultLocation}: on such a row
+     * `upsertLocation` can now produce this (enabled is the write set; `isDefault`
+     * is store residue). Hydrate also writes rows straight into the map, so a
+     * hand-edited store or a row written by another build can too. It matters
+     * because every bare-type ref still resolves through {@link getDefaultLocation}
+     * until Stage 5 of the enabled-write-set design: on such a row
      * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-     * drain destination both point at a disk the operator turned off. That is the
-     * one thing this model must never do silently.
+     * drain destination both point at a disk the operator turned off.
      *
      * Reported, never repaired: flipping an operator's flag back on at boot would
      * be the system overruling the switch instead of obeying it. The coordinator

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B29Skpzo.js");
+const require_dist = require("../../dist-BhE8zNfY.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, Yt as hydrateSchema, jt as errMsg } from "../../dist-DxFjna2a.mjs";
+import { Mt as BaseAddon, Yt as hydrateSchema, jt as errMsg } from "../../dist-BpsHt11f.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-B29Skpzo.js");
+const require_dist = require("../../dist-BhE8zNfY.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-DxFjna2a.mjs";
+import { Mt as BaseAddon, ot as logDestinationCapability } from "../../dist-BpsHt11f.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-B29Skpzo.js → dist-BhE8zNfY.js}

@@ -18151,6 +18151,47 @@ var RebuildStatusSchema = zod.z.object({
 	/** Present when the pass ended by throwing. */
 	error: zod.z.string().nullable()
 });
+/**
+* Acknowledgement that a debug-media reclaim STARTED.
+*
+* The pass is paced at ~2 MB/s over a standing 100 GB — tens of minutes — so
+* it runs detached and this returns immediately. Awaiting it is how the
+* `addons.custom` door hit the 60 s UDS deadline while the walk carried on
+* with no status. Poll {@link pipelineAnalyticsCapability.methods.getMediaReclaimStatus}.
+*/
+var MediaReclaimStartResultSchema = zod.z.object({
+	started: zod.z.boolean(),
+	/** True when a pass was already running; the new request is ignored. */
+	alreadyRunning: zod.z.boolean()
+});
+var MediaReclaimInputSchema = zod.z.object({
+	mode: zod.z.enum(["report", "reclaim"]).default("report"),
+	scopes: zod.z.array(zod.z.enum(["motion-still", "track-filmstrip"])).min(1).optional(),
+	deviceIds: zod.z.array(zod.z.number().int()).min(1).optional(),
+	restart: zod.z.boolean().optional(),
+	pageSize: zod.z.number().int().min(50).max(5e3).optional(),
+	maxRowsPerDevice: zod.z.number().int().min(1).max(5e5).optional(),
+	maxReclaimPerDevice: zod.z.number().int().min(1).max(5e5).optional(),
+	maxBytesPerRun: zod.z.number().int().min(1).optional(),
+	budgetMinutes: zod.z.number().int().min(1).max(720).optional(),
+	throttleBytesPerSec: zod.z.number().int().min(64 * 1024).optional(),
+	graceMinutes: zod.z.number().int().min(1).max(10080).optional()
+});
+var MediaReclaimStatusSchema = zod.z.object({
+	running: zod.z.boolean(),
+	mode: zod.z.enum(["report", "reclaim"]).nullable(),
+	totalExamined: zod.z.number(),
+	totalEligible: zod.z.number(),
+	totalReclaimed: zod.z.number(),
+	totalBytesReclaimed: zod.z.number(),
+	totalRefused: zod.z.number(),
+	/** Device+scope windows finished in this pass. */
+	devicesDone: zod.z.number(),
+	complete: zod.z.boolean().nullable(),
+	startedAtMs: zod.z.number().nullable(),
+	finishedAtMs: zod.z.number().nullable(),
+	error: zod.z.string().nullable()
+});
 var ReplayFrameInputSchema = zod.z.object({
 	timestamp: zod.z.number(),
 	frame: PipelineRunResultBridge
@@ -18574,6 +18615,20 @@ var pipelineAnalyticsCapability = {
 			auth: "admin"
 		}),
 		/**
+		* Reclaim the standing debug-media backlog (motion-visit stills + track
+		* filmstrips). DETACHED: returns `{ started }` immediately. The pass is
+		* tens of minutes; awaiting it is a timeout, not a verdict. Dry-run unless
+		* `mode: 'reclaim'`. Poll `getMediaReclaimStatus`.
+		*/
+		reclaimDebugMedia: method(MediaReclaimInputSchema, MediaReclaimStartResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getMediaReclaimStatus: method(zod.z.object({}), MediaReclaimStatusSchema, {
+			kind: "query",
+			auth: "admin"
+		}),
+		/**
 		* The CHEAP QUESTION, asked before any media moves: how big is the dataset
 		* the marked (`markForTrain`) tracks would produce?
 		*
@@ -37160,6 +37215,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getMediaReclaimStatus": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getMotionEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -37334,6 +37395,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.reclaimDebugMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.reconcileFromDisk": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -40950,6 +41017,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.reclaimDebugMedia": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"pipelineAnalytics.reconcileFromDisk": [{
 		name: "deviceId",
 		form: "single",