@camstack/system 1.2.201 → 1.2.203

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -1,4 +1,5 @@
 import { IScopedLogger, IStorageProviderImpl, StorageAccess, StorageLocation, StorageLocationDeclaration, StorageLocationRef } from '@camstack/types';
+import { ResolveRoot } from './location-root-collision.js';
 import { ILocationStore } from './location-store.js';
 export interface ListLocationsFilter {
     readonly type?: string;
@@ -184,23 +185,37 @@ export declare class StorageOrchestratorService {
      */
     attachStore(store: ILocationStore): Promise<void>;
     /**
-     * Shout about a persisted row that is BOTH the type default and disabled.
+     * ONE explicit migration onto the four-state model (D385), run once per boot
+     * against the rows that came off disk. Idempotent: the second boot finds
+     * nothing to do.
      *
-     * `upsertLocation` can now produce this (enabled is the write set; `isDefault`
-     * is store residue). Hydrate also writes rows straight into the map, so a
-     * hand-edited store or a row written by another build can too. It matters
-     * because every bare-type ref still resolves through {@link getDefaultLocation}
-     * until Stage 5 of the enabled-write-set design: on such a row
-     * `storage.write({ location: 'eventMedia' })` and the migration coordinator's
-     * drain destination both point at a disk the operator turned off.
+     * Two steps, in order, and each one is a WRITE — the point is that "absent"
+     * stops existing rather than being re-interpreted on every read forever:
      *
-     * Reported, never repaired: flipping an operator's flag back on at boot would
-     * be the system overruling the switch instead of obeying it. The coordinator
-     * refuses the drain (`storage-migration-coordinator.drain`); the bare-ref read
-     * path is deliberately left working, because narrowing a READ is a worse bug
-     * than the one this line reports.
+     *   1. A row with no `mode` is stamped with the mode its legacy flags imply
+     *      (`legacyModeOf`): `config.readOnly === true` → `readonly` and the
+     *      config key is DELETED; `enabled === false` → `readonly` (the
+     *      CONSERVATIVE direction — a state change must never start deleting
+     *      footage on its own); everything else → `active`. `withLocationMode`
+     *      derives `enabled` from the mode, so the two can never disagree, and
+     *      this subsumes the D383 pass that stamped flagless rows `enabled: true`.
+     *   2. A type left with NO write target — only reachable from a hand-edited
+     *      store or a row an older build wrote — gets one made `active`, chosen as
+     *      the row the RETIRED default flag named, else the `:default`-slugged
+     *      row, else the lexicographically first. Loudly: a class with no write
+     *      target records nowhere, and refusing to repair it here would leave the
+     *      hub silently unable to write with no operator action pending.
+     *
+     * An operator's explicit `readonly`/`drain`/`disabled` is never reversed by
+     * step 1 — only step 2 touches it, and only when the alternative is a class
+     * that cannot write at all.
+     *
+     * On the live hub every location is enabled with no `readOnly`, so step 1 is
+     * a no-op that stamps `active` and nothing else changes.
      */
-    private reportDisabledDefaults;
+    private migrateOntoTheWriteSet;
+    /** Apply one migrated row in memory and mirror it to the store. */
+    private persistMigrated;
     /**
      * Inject the declaration-driven cardinality source. Called once by the
      * addon after the kernel aggregates every addon's `storageLocations`
@@ -259,22 +274,36 @@ export declare class StorageOrchestratorService {
      */
     backfillNodeIds(hubNodeId: string): Promise<void>;
     listLocations(filter?: ListLocationsFilter): readonly StorageLocation[];
-    getDefaultLocation(type: string): StorageLocation | null;
     /**
-     * Repoint several logical defaults as one in-memory commit. The migration
-     * coordinator persists its `repointing` phase before calling this method, so
-     * a process crash during the backing-store writes is recovered by replaying
-     * the same idempotent target set before anyone resumes writers.
+     * The WRITE SET of a type: every enabled location of it, in stable id order.
+     * This replaced `getDefaultLocation` (D383) — a type does not have one write
+     * target any more, it has a pool, and every consumer that must pick one picks
+     * from here by its own rule (the recorder by headroom, a drain by an operator
+     * -named destination).
      */
-    setDefaultLocations(targetByType: ReadonlyMap<string, string>): Promise<void>;
+    writeTargets(type: string): readonly StorageLocation[];
     /**
-     * Insert or update a location. If `isDefault: true`, atomically
-     * demotes any other default for the same type — operators always see
-     * exactly one default per type.
+     * Change the WRITE SET as one compensated commit: each named location is
+     * enabled (it joins the pool) or disabled (it becomes read-only — still read,
+     * still played back, still age-swept, still drained).
+     *
+     * This is the cutover verb, and its only caller is the migration coordinator,
+     * which persists its `repointing` phase BEFORE calling so a crash mid-write
+     * is recovered by replaying the same idempotent set before writers resume.
      *
-     * When a persistence store is wired (Task 6), the new record AND any
-     * implicitly-demoted siblings are persisted before the in-memory map
-     * mutation returns. Persistence errors propagate to the caller.
+     * It moves ONLY the locations it is given: a cutover from A to C on a class
+     * that also writes to B leaves B in the pool, because the operator's pool is
+     * the authority and a migration is not a licence to shrink it. The commit is
+     * refused when it would leave a write-serving type with nothing enabled —
+     * the same refusal `upsertLocation` applies, judged on the RESULT so an
+     * enable and a disable in one commit are weighed together.
+     */
+    setWriteTargets(enabledByLocationId: ReadonlyMap<string, boolean>): Promise<void>;
+    /**
+     * Insert or update a location.
+     *
+     * When a persistence store is wired (Task 6), the record is mirrored to it;
+     * the mirror is fire-and-forget and its errors reach the logger.
      */
     /**
      * Refuse a `(location kind, provider)` pair the kind cannot use.
@@ -310,8 +339,7 @@ export declare class StorageOrchestratorService {
     /**
      * Remove a location. Refuses the last location of a type and the last
      * enabled location of a type. `isSystem` is informational — a frozen
-     * recordings `:default` is deletable once a sibling is live. Deleting
-     * the flagged default promotes an enabled sibling. Occupancy still
+     * recordings `:default` is deletable once a sibling is live. Occupancy still
      * refuses unless `force` is set; force never overrides uniqueness /
      * last-enabled.
      */
@@ -392,9 +420,11 @@ export declare class StorageOrchestratorService {
      * declarations on a populated map is a no-op (each declared `id`
      * already resolves to an existing `<id>:default`).
      *
-     * Convention: the bare-type ref `'recordings'` resolves via
-     * `getDefaultLocation('recordings')` (walks `isDefault === true`); the
-     * actual stored `id` is `'recordings:default'` so it satisfies the
+     * The seeded row is born ENABLED — a fresh install must be able to write the
+     * moment it boots, and `enabled` is the only write switch there is (D383).
+     * The `:default` suffix is a NAME kept for idempotency across existing
+     * installs, not a flag: the stored `id` is `'recordings:default'` so it
+     * satisfies the
      * `^[a-z][a-z0-9-]*:[a-z0-9-]+$` regex on `StorageLocationSchema.id`.
      *
      * `basePath` is the storage root (e.g. `<CAMSTACK_DATA>`). Each
@@ -420,6 +450,20 @@ export declare class StorageOrchestratorService {
         readonly backupBasePath?: string;
         readonly declarations: readonly StorageLocationDeclaration[];
     }): void;
+    /**
+     * The same-type physical-root refusal (D389).
+     *
+     * An unresolvable root — another node's disk, a remote provider, a path that
+     * does not exist yet — WARNS and lets the write through. Refusing on a read
+     * that could not be taken blocks the operator on a doubt, and the recorder's
+     * demotion still catches what slips past (D49's spirit).
+     */
+    private refuseSameTypeRootCollision;
+    /** Injectable so a test can drive symlinks and unresolvable paths without
+     *  touching a real filesystem. Production takes the shared derivation. */
+    private resolveRoot;
+    /** Test seam for {@link refuseSameTypeRootCollision}. */
+    setRootResolver(resolveRoot: ResolveRoot): void;
     /** Internal: check whether any location of the given type exists. */
     private hasAnyLocationOfType;
 }

package/dist/builtins/storage-orchestrator/storage-pressure-manager.d.ts

@@ -1,4 +1,26 @@
 import { IScopedLogger, IStorageEvictableProvider } from '@camstack/types';
+import { DrainProgress, DrainState } from './drain-ratchet.js';
+/**
+ * One draining location and the ACTIVE locations of its class the drain is
+ * paced against (D386). Supplied by the orchestrator, which is the only thing
+ * that knows a location's mode.
+ */
+export interface DrainPlanEntry {
+    readonly locationId: string;
+    /** Locations of the SAME class whose growth the drain is matched to. Empty
+     *  means the pace is unmeasurable and the cap stands still. */
+    readonly activePeerLocationIds: readonly string[];
+}
+/**
+ * Durable home for the ratchet state. It MUST survive a process restart: a cap
+ * recomputed from today's usage starts again at the top and silently undoes
+ * every byte of progress.
+ */
+export interface DrainStateStore {
+    load(): Promise<readonly DrainState[]>;
+    save(state: DrainState): Promise<void>;
+    clear(locationId: string): Promise<void>;
+}
 /**
  * StoragePressureManager — core-owned TRIGGER for disk-space relief.
  *
@@ -50,12 +72,35 @@ export interface PressureManagerDeps {
      * independently), preserving prior single-disk behaviour.
      */
     readonly getLocationDeviceKey?: (locationId: string) => Promise<string | null>;
+    /** Locations in `drain` mode, each with the active peers of its class.
+     *  Absent → no drain (the behaviour before D386). */
+    readonly getDrainPlan?: () => Promise<readonly DrainPlanEntry[]>;
+    /** Where the ratchet state lives across restarts. Absent → drain is inert:
+     *  without persistence the cap would reset on every boot, which is worse
+     *  than not draining. */
+    readonly drainState?: DrainStateStore;
 }
 export declare class StoragePressureManager {
     private readonly deps;
+    /** Last sweep's drain progress, by location. Read-only surface for the UI. */
+    private drainProgress;
     constructor(deps: PressureManagerDeps);
     /** Relieve every managed location currently under its threshold. */
     sweep(): Promise<void>;
+    /**
+     * The drain pass (D386). A `drain` location is excluded from nothing — it is
+     * given a monotonically descending effective usage cap and handed to the SAME
+     * `relieveToUsageCap` machinery every other cap uses. There is no second
+     * eviction path, and no operator-facing rate.
+     */
+    private sweepDrains;
+    /** Progress for every draining location, as of the last sweep. The read a UI
+     *  asks for — it never triggers work of its own. */
+    drainProgressSnapshot(): readonly DrainProgress[];
+    /** Evictable bytes on one location, summed across every provider. */
+    private evictableUsageOf;
+    /** Evictable bytes across a set of locations. */
+    private evictableUsageOfAll;
     /** Evict oldest-first until the location's evictable usage fits `maxBytes`. */
     private relieveToUsageCap;
     /**

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CcV3k-hD.js");
+const require_dist = require("../../dist-BFvWv_bz.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { $t as hydrateSchema, Ft as errMsg, It as BaseAddon } from "../../dist-BmJNnb_s.mjs";
+import { Jt as BaseAddon, dn as hydrateSchema, qt as errMsg } from "../../dist-DcMUcdeq.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CcV3k-hD.js");
+const require_dist = require("../../dist-BFvWv_bz.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { It as BaseAddon, lt as logDestinationCapability } from "../../dist-BmJNnb_s.mjs";
+import { Jt as BaseAddon, ht as logDestinationCapability } from "../../dist-DcMUcdeq.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";