@camstack/system 1.2.202 → 1.2.203

package/dist/builtins/storage-orchestrator/storage-orchestrator.service.d.ts

@@ -1,4 +1,5 @@
 import { IScopedLogger, IStorageProviderImpl, StorageAccess, StorageLocation, StorageLocationDeclaration, StorageLocationRef } from '@camstack/types';
+import { ResolveRoot } from './location-root-collision.js';
 import { ILocationStore } from './location-store.js';
 export interface ListLocationsFilter {
     readonly type?: string;
@@ -184,27 +185,33 @@ export declare class StorageOrchestratorService {
      */
     attachStore(store: ILocationStore): Promise<void>;
     /**
-     * ONE explicit migration onto the enabled write set (D383), run once per
-     * boot against the rows that came off disk. Idempotent: the second boot finds
+     * ONE explicit migration onto the four-state model (D385), run once per boot
+     * against the rows that came off disk. Idempotent: the second boot finds
      * nothing to do.
      *
      * Two steps, in order, and each one is a WRITE — the point is that "absent"
      * stops existing rather than being re-interpreted on every read forever:
      *
-     *   1. A flagless row (persisted before `enabled` existed) is stamped
-     *      `enabled: true`. Absence already meant active, so this preserves
-     *      behaviour exactly; it is the operator's "the initial locations are
-     *      enabled" spelled into the store.
-     *   2. A type left with NO enabled row — only reachable from a hand-edited
-     *      store or a row an older build wrote — gets one enabled back, chosen as
+     *   1. A row with no `mode` is stamped with the mode its legacy flags imply
+     *      (`legacyModeOf`): `config.readOnly === true` → `readonly` and the
+     *      config key is DELETED; `enabled === false` → `readonly` (the
+     *      CONSERVATIVE direction — a state change must never start deleting
+     *      footage on its own); everything else → `active`. `withLocationMode`
+     *      derives `enabled` from the mode, so the two can never disagree, and
+     *      this subsumes the D383 pass that stamped flagless rows `enabled: true`.
+     *   2. A type left with NO write target — only reachable from a hand-edited
+     *      store or a row an older build wrote — gets one made `active`, chosen as
      *      the row the RETIRED default flag named, else the `:default`-slugged
      *      row, else the lexicographically first. Loudly: a class with no write
      *      target records nowhere, and refusing to repair it here would leave the
      *      hub silently unable to write with no operator action pending.
      *
-     * An operator's explicit `enabled: false` is never reversed by step 1 — only
-     * step 2 touches it, and only when the alternative is a class that cannot
-     * write at all.
+     * An operator's explicit `readonly`/`drain`/`disabled` is never reversed by
+     * step 1 — only step 2 touches it, and only when the alternative is a class
+     * that cannot write at all.
+     *
+     * On the live hub every location is enabled with no `readOnly`, so step 1 is
+     * a no-op that stamps `active` and nothing else changes.
      */
     private migrateOntoTheWriteSet;
     /** Apply one migrated row in memory and mirror it to the store. */
@@ -443,6 +450,20 @@ export declare class StorageOrchestratorService {
         readonly backupBasePath?: string;
         readonly declarations: readonly StorageLocationDeclaration[];
     }): void;
+    /**
+     * The same-type physical-root refusal (D389).
+     *
+     * An unresolvable root — another node's disk, a remote provider, a path that
+     * does not exist yet — WARNS and lets the write through. Refusing on a read
+     * that could not be taken blocks the operator on a doubt, and the recorder's
+     * demotion still catches what slips past (D49's spirit).
+     */
+    private refuseSameTypeRootCollision;
+    /** Injectable so a test can drive symlinks and unresolvable paths without
+     *  touching a real filesystem. Production takes the shared derivation. */
+    private resolveRoot;
+    /** Test seam for {@link refuseSameTypeRootCollision}. */
+    setRootResolver(resolveRoot: ResolveRoot): void;
     /** Internal: check whether any location of the given type exists. */
     private hasAnyLocationOfType;
 }

package/dist/builtins/storage-orchestrator/storage-pressure-manager.d.ts

@@ -1,4 +1,26 @@
 import { IScopedLogger, IStorageEvictableProvider } from '@camstack/types';
+import { DrainProgress, DrainState } from './drain-ratchet.js';
+/**
+ * One draining location and the ACTIVE locations of its class the drain is
+ * paced against (D386). Supplied by the orchestrator, which is the only thing
+ * that knows a location's mode.
+ */
+export interface DrainPlanEntry {
+    readonly locationId: string;
+    /** Locations of the SAME class whose growth the drain is matched to. Empty
+     *  means the pace is unmeasurable and the cap stands still. */
+    readonly activePeerLocationIds: readonly string[];
+}
+/**
+ * Durable home for the ratchet state. It MUST survive a process restart: a cap
+ * recomputed from today's usage starts again at the top and silently undoes
+ * every byte of progress.
+ */
+export interface DrainStateStore {
+    load(): Promise<readonly DrainState[]>;
+    save(state: DrainState): Promise<void>;
+    clear(locationId: string): Promise<void>;
+}
 /**
  * StoragePressureManager — core-owned TRIGGER for disk-space relief.
  *
@@ -50,12 +72,35 @@ export interface PressureManagerDeps {
      * independently), preserving prior single-disk behaviour.
      */
     readonly getLocationDeviceKey?: (locationId: string) => Promise<string | null>;
+    /** Locations in `drain` mode, each with the active peers of its class.
+     *  Absent → no drain (the behaviour before D386). */
+    readonly getDrainPlan?: () => Promise<readonly DrainPlanEntry[]>;
+    /** Where the ratchet state lives across restarts. Absent → drain is inert:
+     *  without persistence the cap would reset on every boot, which is worse
+     *  than not draining. */
+    readonly drainState?: DrainStateStore;
 }
 export declare class StoragePressureManager {
     private readonly deps;
+    /** Last sweep's drain progress, by location. Read-only surface for the UI. */
+    private drainProgress;
     constructor(deps: PressureManagerDeps);
     /** Relieve every managed location currently under its threshold. */
     sweep(): Promise<void>;
+    /**
+     * The drain pass (D386). A `drain` location is excluded from nothing — it is
+     * given a monotonically descending effective usage cap and handed to the SAME
+     * `relieveToUsageCap` machinery every other cap uses. There is no second
+     * eviction path, and no operator-facing rate.
+     */
+    private sweepDrains;
+    /** Progress for every draining location, as of the last sweep. The read a UI
+     *  asks for — it never triggers work of its own. */
+    drainProgressSnapshot(): readonly DrainProgress[];
+    /** Evictable bytes on one location, summed across every provider. */
+    private evictableUsageOf;
+    /** Evictable bytes across a set of locations. */
+    private evictableUsageOfAll;
     /** Evict oldest-first until the location's evictable usage fits `maxBytes`. */
     private relieveToUsageCap;
     /**

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-jZb-HKI5.js");
+const require_dist = require("../../dist-BFvWv_bz.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { Lt as errMsg, Rt as BaseAddon, tn as hydrateSchema } from "../../dist-CiHYspij.mjs";
+import { Jt as BaseAddon, dn as hydrateSchema, qt as errMsg } from "../../dist-DcMUcdeq.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-jZb-HKI5.js");
+const require_dist = require("../../dist-BFvWv_bz.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Rt as BaseAddon, dt as logDestinationCapability } from "../../dist-CiHYspij.mjs";
+import { Jt as BaseAddon, ht as logDestinationCapability } from "../../dist-DcMUcdeq.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";