@camstack/system 1.2.21 → 1.2.23

package/dist/builtins/backup-orchestrator/schedule-store.d.ts

@@ -0,0 +1,33 @@
+import { ISettingsBackend, TableSchema } from '@camstack/types';
+/**
+ * A backup schedule row.
+ *
+ * `locationIds` is the fan-out set (destination `backups` locations).
+ * `retentionCount` applies to every one of them for THIS schedule's
+ * runs. `dataSources` optionally narrows which top-level state
+ * locations get archived; empty = the orchestrator's full default set.
+ */
+export interface BackupSchedule {
+    readonly id: string;
+    readonly label: string;
+    readonly cron: string;
+    readonly enabled: boolean;
+    readonly locationIds: readonly string[];
+    readonly retentionCount: number;
+    readonly dataSources?: readonly string[];
+    /** ms-epoch of the last successful run. */
+    readonly lastRunAt?: number;
+}
+export declare const BACKUP_SCHEDULES_SCHEMA: TableSchema;
+export declare class BackupScheduleService {
+    private readonly backend;
+    private tableEnsured;
+    constructor(backend: ISettingsBackend);
+    initialize(): Promise<void>;
+    private ensureTable;
+    list(): Promise<readonly BackupSchedule[]>;
+    get(id: string): Promise<BackupSchedule | null>;
+    /** Replace-or-insert (delete + insert — mirrors the policy store). */
+    upsert(s: BackupSchedule): Promise<void>;
+    delete(id: string): Promise<void>;
+}

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, z as logDestinationCapability } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, z as logDestinationCapability } from "../../dist-CIek6F9X.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { At as sleep, C as deviceStatusCapability, Ct as isDeviceConfigCap, D as enumerateSchemaFields, E as enumerateItemArrayFields, G as parseStreamParamsFormPatch, O as evaluateLinkExpression, S as deviceStateCapability, U as normalizeUnit, Y as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as BaseAddon, b as buildStreamParamsConfigSchema, dt as DeviceType, it as errMsg, j as getByPath, jt as EventCategory, l as STREAM_PROFILE_META, lt as DeviceFeature, mt as WELL_KNOWN_TAB_MAP, o as DeviceStatusSchema, rt as validateExpressionSource, t as ALL_CAPABILITY_DEFINITIONS, tt as toExpressionValue, ut as DeviceRole, x as deviceManagerCapability } from "../../dist-DmQ6thmF.mjs";
+import { At as sleep, C as deviceStatusCapability, Ct as isDeviceConfigCap, D as enumerateSchemaFields, E as enumerateItemArrayFields, G as parseStreamParamsFormPatch, O as evaluateLinkExpression, S as deviceStateCapability, U as normalizeUnit, Y as setByPath, _ as applyTransform, a as CAP_NAMES_WITH_STATUS, at as BaseAddon, b as buildStreamParamsConfigSchema, dt as DeviceType, it as errMsg, j as getByPath, jt as EventCategory, l as STREAM_PROFILE_META, lt as DeviceFeature, mt as WELL_KNOWN_TAB_MAP, o as DeviceStatusSchema, rt as validateExpressionSource, t as ALL_CAPABILITY_DEFINITIONS, tt as toExpressionValue, ut as DeviceRole, x as deviceManagerCapability } from "../../dist-CIek6F9X.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, dt as DeviceType, it as errMsg, jt as EventCategory, vt as createEvent, w as doorbellCapability } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, dt as DeviceType, it as errMsg, jt as EventCategory, vt as createEvent, w as doorbellCapability } from "../../dist-CIek6F9X.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, z as logDestinationCapability } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, z as logDestinationCapability } from "../../dist-CIek6F9X.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { at as BaseAddon, f as UserRecordSchema, nt as userManagementCapability, r as ApiKeyRecordSchema, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, f as UserRecordSchema, nt as userManagementCapability, r as ApiKeyRecordSchema, u as ScopedTokenSchema, v as authProviderCapability } from "../../dist-CIek6F9X.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.d.ts

@@ -20,6 +20,14 @@ interface LocalNetworkConfig {
      *  with LAN/Wi-Fi addresses) from "operator explicitly cleared the
      *  allowlist" (true + empty → respect operator's choice). */
     readonly bootSeeded: boolean;
+    /**
+     * The endpoint outbound artifacts (notification attachment links, deep
+     * links) must be addressed by. Empty = AUTO: the first public candidate,
+     * never loopback. Stored VERBATIM rather than as an index into the candidate
+     * list — interfaces come and go, and an index would silently re-point at a
+     * different address after a reboot.
+     */
+    readonly notificationBaseUrl: string;
 }
 export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
     private pollTimer;
@@ -35,6 +43,14 @@ export declare class LocalNetworkAddon extends BaseAddon<LocalNetworkConfig> {
      */
     private meshEndpoint;
     constructor();
+    /**
+     * What AUTO currently resolves to for outbound artifact links: the first
+     * PUBLIC candidate, never loopback and never a LAN address — a link is
+     * opened on someone's phone, off this network, possibly hours later.
+     * `null` when nothing public is reachable (the caller then ships bytes only
+     * rather than a link that 404s).
+     */
+    private resolveNotificationEndpoint;
     protected onInitialize(): Promise<ProviderRegistration[]>;
     protected onShutdown(): Promise<void>;
     /**

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts
@@ -44,9 +44,25 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 	constructor() {
 		super({
 			allowedAddresses: [],
-			bootSeeded: false
+			bootSeeded: false,
+			notificationBaseUrl: ""
 		});
 	}
+	/**
+	* What AUTO currently resolves to for outbound artifact links: the first
+	* PUBLIC candidate, never loopback and never a LAN address — a link is
+	* opened on someone's phone, off this network, possibly hours later.
+	* `null` when nothing public is reachable (the caller then ships bytes only
+	* rather than a link that 404s).
+	*/
+	resolveNotificationEndpoint() {
+		const explicit = this.config.notificationBaseUrl;
+		if (explicit !== "") return explicit;
+		if (this.publicHostname !== "") return `https://${this.publicHostname}`;
+		const mesh = this.meshEndpoint;
+		if (mesh !== null && mesh.host !== "") return `https://${mesh.host}:${mesh.port}`;
+		return null;
+	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
 			const seed = autoSeedAllowlist(this.enumerate());
@@ -71,6 +87,18 @@ var LocalNetworkAddon = class extends require_dist.BaseAddon {
 				await this.reconcileMeshEndpoint();
 				return { endpoints: buildEndpoints(interfaces, input.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint) };
 			},
+			getNotificationEndpoint: async () => ({
+				baseUrl: this.config.notificationBaseUrl === "" ? null : this.config.notificationBaseUrl,
+				resolved: this.resolveNotificationEndpoint()
+			}),
+			setNotificationEndpoint: async ({ baseUrl }) => {
+				await this.updateGlobalSettings({ notificationBaseUrl: baseUrl ?? "" });
+				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
+				return {
+					baseUrl: baseUrl === "" ? null : baseUrl,
+					resolved: this.resolveNotificationEndpoint()
+				};
+			},
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { R as localNetworkCapability, at as BaseAddon, jt as EventCategory } from "../../dist-DmQ6thmF.mjs";
+import { R as localNetworkCapability, at as BaseAddon, jt as EventCategory } from "../../dist-CIek6F9X.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**
@@ -41,9 +41,25 @@ var LocalNetworkAddon = class extends BaseAddon {
 	constructor() {
 		super({
 			allowedAddresses: [],
-			bootSeeded: false
+			bootSeeded: false,
+			notificationBaseUrl: ""
 		});
 	}
+	/**
+	* What AUTO currently resolves to for outbound artifact links: the first
+	* PUBLIC candidate, never loopback and never a LAN address — a link is
+	* opened on someone's phone, off this network, possibly hours later.
+	* `null` when nothing public is reachable (the caller then ships bytes only
+	* rather than a link that 404s).
+	*/
+	resolveNotificationEndpoint() {
+		const explicit = this.config.notificationBaseUrl;
+		if (explicit !== "") return explicit;
+		if (this.publicHostname !== "") return `https://${this.publicHostname}`;
+		const mesh = this.meshEndpoint;
+		if (mesh !== null && mesh.host !== "") return `https://${mesh.host}:${mesh.port}`;
+		return null;
+	}
 	async onInitialize() {
 		if (!this.config.bootSeeded) {
 			const seed = autoSeedAllowlist(this.enumerate());
@@ -68,6 +84,18 @@ var LocalNetworkAddon = class extends BaseAddon {
 				await this.reconcileMeshEndpoint();
 				return { endpoints: buildEndpoints(interfaces, input.port, includeLoopback, ipv4Only, this.publicHostname, scheme, this.meshEndpoint) };
 			},
+			getNotificationEndpoint: async () => ({
+				baseUrl: this.config.notificationBaseUrl === "" ? null : this.config.notificationBaseUrl,
+				resolved: this.resolveNotificationEndpoint()
+			}),
+			setNotificationEndpoint: async ({ baseUrl }) => {
+				await this.updateGlobalSettings({ notificationBaseUrl: baseUrl ?? "" });
+				this.ctx.logger.info("local-network: notification endpoint set", { meta: { baseUrl: baseUrl ?? "(auto)" } });
+				return {
+					baseUrl: baseUrl === "" ? null : baseUrl,
+					resolved: this.resolveNotificationEndpoint()
+				};
+			},
 			getAllowedAddresses: async () => ({ addresses: this.config.allowedAddresses }),
 			resetAllowlistToBestMatch: async () => {
 				const seed = autoSeedAllowlist(this.enumerate());

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -295,7 +295,8 @@ var LokiDestination = class {
 //#endregion
 //#region src/builtins/loki-logging/loki-logging.addon.ts
 var DEFAULTS = {
-	enabled: false,
+	enabled: true,
+	migratedEnabled: false,
 	url: "",
 	job: "camstack",
 	level: "info",
@@ -315,12 +316,39 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 	async onInitialize() {
 		this.destination = new LokiDestination();
 		await this.destination.initialize(this.destinationConfig());
-		this.ctx.logger.info(this.config.enabled && this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (set a URL and enable it)");
+		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (no URL set)");
+		await this.migrateRetiredEnabledFlag();
 		return [{
 			capability: require_dist.logDestinationCapability,
 			provider: this.destination
 		}];
 	}
+	/**
+	* ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
+	* per-destination toggle, then never look at the flag again.
+	*
+	* Without this, retiring the private setting would silently RE-ENABLE Loki
+	* for every operator who had turned it off — shipping their logs to a host
+	* they may no longer control. Best-effort: if the toggle call fails the
+	* migration is simply retried next boot (the flag is only cleared on
+	* success).
+	*/
+	async migrateRetiredEnabledFlag() {
+		if (this.config.migratedEnabled) return;
+		try {
+			if (!this.config.enabled) {
+				await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+					capName: "log-destination",
+					addonId: this.ctx.id,
+					enabled: false
+				});
+				this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
+			}
+			await this.updateGlobalSettings({ migratedEnabled: true });
+		} catch (err) {
+			this.ctx.logger.warn("Loki logging: enablement migration deferred to next boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
 		await this.destination?.shutdown();
 		this.destination = null;
@@ -334,7 +362,7 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 	*/
 	async onConfigChanged() {
 		await this.destination?.reconfigure(this.destinationConfig());
-		this.ctx.logger.info(this.config.enabled && this.config.url.length > 0 ? `Loki logging reconfigured → ${this.config.url}` : "Loki logging now inactive (disabled or no URL)");
+		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging reconfigured → ${this.config.url}` : "Loki logging now inactive (no URL)");
 	}
 	/**
 	* `node` is a Loki LABEL, so it must be the node's real identity and must not
@@ -350,6 +378,7 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 	destinationConfig() {
 		return {
 			...this.config,
+			enabled: true,
 			node: this.ctx.kernel.localNodeId ?? "hub"
 		};
 	}
@@ -361,16 +390,9 @@ var LokiLoggingAddon = class extends require_dist.BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
-			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations — enabling this does not disable those.",
+			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
 			columns: 2,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Off by default. Needs a URL below to do anything.",
-					default: false
-				}),
 				this.field({
 					type: "text",
 					key: "url",

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, z as logDestinationCapability } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, z as logDestinationCapability } from "../../dist-CIek6F9X.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label
@@ -290,7 +290,8 @@ var LokiDestination = class {
 //#endregion
 //#region src/builtins/loki-logging/loki-logging.addon.ts
 var DEFAULTS = {
-	enabled: false,
+	enabled: true,
+	migratedEnabled: false,
 	url: "",
 	job: "camstack",
 	level: "info",
@@ -310,12 +311,39 @@ var LokiLoggingAddon = class extends BaseAddon {
 	async onInitialize() {
 		this.destination = new LokiDestination();
 		await this.destination.initialize(this.destinationConfig());
-		this.ctx.logger.info(this.config.enabled && this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (set a URL and enable it)");
+		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging initialized → ${this.config.url}` : "Loki logging registered but inactive (no URL set)");
+		await this.migrateRetiredEnabledFlag();
 		return [{
 			capability: logDestinationCapability,
 			provider: this.destination
 		}];
 	}
+	/**
+	* ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
+	* per-destination toggle, then never look at the flag again.
+	*
+	* Without this, retiring the private setting would silently RE-ENABLE Loki
+	* for every operator who had turned it off — shipping their logs to a host
+	* they may no longer control. Best-effort: if the toggle call fails the
+	* migration is simply retried next boot (the flag is only cleared on
+	* success).
+	*/
+	async migrateRetiredEnabledFlag() {
+		if (this.config.migratedEnabled) return;
+		try {
+			if (!this.config.enabled) {
+				await this.ctx.api.addons.setCapabilityProviderEnabled.mutate({
+					capName: "log-destination",
+					addonId: this.ctx.id,
+					enabled: false
+				});
+				this.ctx.logger.info("Loki logging: the retired `enabled: false` setting was carried over to the per-destination toggle — re-enable it there if you want Loki shipping again.");
+			}
+			await this.updateGlobalSettings({ migratedEnabled: true });
+		} catch (err) {
+			this.ctx.logger.warn("Loki logging: enablement migration deferred to next boot", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
 	async onShutdown() {
 		await this.destination?.shutdown();
 		this.destination = null;
@@ -329,7 +357,7 @@ var LokiLoggingAddon = class extends BaseAddon {
 	*/
 	async onConfigChanged() {
 		await this.destination?.reconfigure(this.destinationConfig());
-		this.ctx.logger.info(this.config.enabled && this.config.url.length > 0 ? `Loki logging reconfigured → ${this.config.url}` : "Loki logging now inactive (disabled or no URL)");
+		this.ctx.logger.info(this.config.url.length > 0 ? `Loki logging reconfigured → ${this.config.url}` : "Loki logging now inactive (no URL)");
 	}
 	/**
 	* `node` is a Loki LABEL, so it must be the node's real identity and must not
@@ -345,6 +373,7 @@ var LokiLoggingAddon = class extends BaseAddon {
 	destinationConfig() {
 		return {
 			...this.config,
+			enabled: true,
 			node: this.ctx.kernel.localNodeId ?? "hub"
 		};
 	}
@@ -356,16 +385,9 @@ var LokiLoggingAddon = class extends BaseAddon {
 		return this.schema({ sections: [{
 			id: "loki-logging",
 			title: "Loki",
-			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations — enabling this does not disable those.",
+			description: "Ship this node’s logs to a Grafana Loki instance. Independent of the rotated-file and console destinations. Turn it on or off with the Enable/Disable control on this destination — the same one every other destination uses.",
 			columns: 2,
 			fields: [
-				this.field({
-					type: "boolean",
-					key: "enabled",
-					label: "Enabled",
-					description: "Off by default. Needs a URL below to do anything.",
-					default: false
-				}),
 				this.field({
 					type: "text",
 					key: "url",

package/dist/builtins/loki-logging/loki-logging.addon.d.ts

@@ -1,7 +1,15 @@
 import { LogLevel, ProviderRegistration, BaseAddon } from '@camstack/types';
 import { LokiDestination } from './loki-destination.js';
 interface LokiAddonConfig {
+    /**
+     * RETIRED (2026-07-30). Enablement is the orchestrator's per-destination
+     * toggle now — the ONE truth for every log destination. Kept only so a
+     * stored `false` can be migrated ONCE into a registry disable: without that,
+     * an operator who had Loki off would silently start shipping logs after this
+     * update. `migratedEnabled` marks the migration done; the field is then dead.
+     */
     readonly enabled: boolean;
+    readonly migratedEnabled: boolean;
     readonly url: string;
     readonly job: string;
     readonly level: LogLevel;
@@ -17,6 +25,17 @@ export declare class LokiLoggingAddon extends BaseAddon<LokiAddonConfig> {
     private destination;
     constructor();
     protected onInitialize(): Promise<ProviderRegistration[]>;
+    /**
+     * ONE-SHOT: carry a stored `enabled: false` over to the orchestrator's
+     * per-destination toggle, then never look at the flag again.
+     *
+     * Without this, retiring the private setting would silently RE-ENABLE Loki
+     * for every operator who had turned it off — shipping their logs to a host
+     * they may no longer control. Best-effort: if the toggle call fails the
+     * migration is simply retried next boot (the flag is only cleared on
+     * success).
+     */
+    private migrateRetiredEnabledFlag;
     protected onShutdown(): Promise<void>;
     /**
      * React to a settings change (enable/disable, URL, level, batching) without a

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { H as metricsProviderCapability, at as BaseAddon, jt as EventCategory, vt as createEvent } from "../../dist-DmQ6thmF.mjs";
+import { H as metricsProviderCapability, at as BaseAddon, jt as EventCategory, vt as createEvent } from "../../dist-CIek6F9X.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { J as scoreRuntimes, K as platformProbeCapability, T as enumerateInferenceDevices, at as BaseAddon, bt as emitReadiness, it as errMsg, jt as EventCategory } from "../../dist-DmQ6thmF.mjs";
+import { J as scoreRuntimes, K as platformProbeCapability, T as enumerateInferenceDevices, at as BaseAddon, bt as emitReadiness, it as errMsg, jt as EventCategory } from "../../dist-CIek6F9X.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { at as BaseAddon, jt as EventCategory } from "../../dist-DmQ6thmF.mjs";
+import { at as BaseAddon, jt as EventCategory } from "../../dist-CIek6F9X.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { Z as snapshotCapability, at as BaseAddon, dt as DeviceType, et as streamQualityLabel, i as BatteryStatusSchema, it as errMsg, lt as DeviceFeature, wt as nodePin } from "../../dist-DmQ6thmF.mjs";
+import { Z as snapshotCapability, at as BaseAddon, dt as DeviceType, et as streamQualityLabel, i as BatteryStatusSchema, it as errMsg, lt as DeviceFeature, wt as nodePin } from "../../dist-CIek6F9X.mjs";
 import { execFile } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,4 +1,4 @@
-import { $ as storageProviderCapability, A as filesystemBrowseCapability, at as BaseAddon } from "../../dist-DmQ6thmF.mjs";
+import { $ as storageProviderCapability, A as filesystemBrowseCapability, at as BaseAddon } from "../../dist-CIek6F9X.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-OQ1yU92D.js");
+const require_dist = require("../../dist-CS0pdC8l.js");
 let node_crypto = require("node:crypto");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { Et as parseJsonUnknown, X as settingsStoreCapability, at as BaseAddon, c as RUNTIME_DEFAULTS, ht as asJsonObject, it as errMsg } from "../../dist-DmQ6thmF.mjs";
+import { Et as parseJsonUnknown, X as settingsStoreCapability, at as BaseAddon, c as RUNTIME_DEFAULTS, ht as asJsonObject, it as errMsg } from "../../dist-CIek6F9X.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/sqlite-settings-backend.ts

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.d.ts

@@ -64,6 +64,13 @@ export declare class StorageOrchestratorAddon extends BaseAddon<StorageOrchestra
      * the recorder so disk-pressure is a single core concern.
      */
     private resolveLocationThresholds;
+    /** statfs capacity of a location's basePath, walking up to the nearest
+     *  existing ancestor. Null for remote-node locations or unstattable paths. */
+    private localCapacityOf;
+    /** Per-location cap on EVICTABLE bytes (`config.maxUsedGb`): the operator's
+     *  "recordings may use at most N GB in total" — enforced by the pressure
+     *  manager alongside the free-percent guard. */
+    private resolveLocationMaxUsedBytes;
     private locationBasePath;
     /**
      * A stable key for the PHYSICAL storage device behind a location — the