camstack 1.2.63 → 1.2.65

package/dist/{launcher-RA6HGFNQ.js → launcher-3XCU3XJF.js}

@@ -23633,9 +23633,9 @@ var require_zod = __commonJS({
   }
 });
 
-// ../system/dist/dist-CDgIzo82.js
-var require_dist_CDgIzo82 = __commonJS({
-  "../system/dist/dist-CDgIzo82.js"(exports) {
+// ../system/dist/dist-Ck2jkBZk.js
+var require_dist_Ck2jkBZk = __commonJS({
+  "../system/dist/dist-Ck2jkBZk.js"(exports) {
     "use strict";
     var zod = require_zod();
     var EventCategory = /* @__PURE__ */ (function(EventCategory2) {
@@ -25997,6 +25997,40 @@ var require_dist_CDgIzo82 = __commonJS({
       /** Unix ms when the group was composed server-side. */
       fetchedAt: zod.z.number()
     });
+    var REDACTED_SECRET = "__camstack_redacted__";
+    function collectSecretConfigKeys(schema) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+      return keys;
+    }
+    function isRecord$2(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function sectionsOf(schema) {
+      if (!isRecord$2(schema)) return [];
+      const sections = schema["sections"];
+      return Array.isArray(sections) ? sections : [];
+    }
+    function fieldsOf(node) {
+      if (!isRecord$2(node)) return [];
+      const fields = node["fields"];
+      return Array.isArray(fields) ? fields : [];
+    }
+    function walkField(field, out) {
+      if (!isRecord$2(field)) return;
+      const type = field["type"];
+      const key = field["key"];
+      if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+      if (type === "group") {
+        for (const child of fieldsOf(field)) walkField(child, out);
+        return;
+      }
+      if (type === "sub-tabs") {
+        const tabs = field["tabs"];
+        if (!Array.isArray(tabs)) return;
+        for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+      }
+    }
     var STREAM_QUALITY_LABELS = {
       high: "High",
       mid: "Mid",
@@ -26313,13 +26347,29 @@ var require_dist_CDgIzo82 = __commonJS({
       "recorder",
       "analytics"
     ]);
+    var StorageMigrationMoveProgressSchema = zod.z.object({
+      filesMoved: zod.z.number().int().nonnegative(),
+      /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+      filesTotal: zod.z.number().int().nonnegative().nullable(),
+      bytesMoved: zod.z.number().int().nonnegative(),
+      /** The MOVER's start, not the migration's: a drain restarted after an addon
+      *  crash gets a new mover, and a rate computed from the migration's start
+      *  would silently average in the time nothing was running. */
+      startedAt: zod.z.number(),
+      /** When the coordinator last read these numbers. Paired with `startedAt` it
+      *  is the only honest rate: both clocks are the hub's, so a UI never has to
+      *  subtract its own. */
+      observedAt: zod.z.number()
+    });
     var StorageMigrationMoveSchema = zod.z.object({
       storageClass: StorageMigrationClassSchema,
       fromLocationId: zod.z.string(),
       toLocationId: zod.z.string(),
       moverJobId: zod.z.string().nullable(),
       state: RelocateJobStateSchema.nullable(),
-      error: zod.z.string().nullable()
+      error: zod.z.string().nullable(),
+      /** Last observed mover counters; `null` until the mover has been polled once. */
+      progress: StorageMigrationMoveProgressSchema.nullable()
     });
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
@@ -26365,6 +26415,52 @@ var require_dist_CDgIzo82 = __commonJS({
       })),
       findings: zod.z.array(StorageMigrationFindingSchema)
     });
+    var StorageMigrationLaneSchema = zod.z.enum(["footage", "media"]);
+    var StorageMigrationMoverSchema = zod.z.object({
+      lane: StorageMigrationLaneSchema,
+      job: RelocateJobSchema,
+      /** The coordinator job that armed this mover, or `null` for a mover armed
+      *  directly against the owning addon. */
+      migrationJobId: zod.z.string().nullable(),
+      /** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+      *  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+      *  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+      *  rate made of two different clocks. */
+      observedAt: zod.z.number()
+    });
+    var StorageMigrationResidueSchema = zod.z.object({
+      storageClass: StorageMigrationClassSchema,
+      /** The location still holding the data. `'*'` for the media lane, whose rows
+      *  move from wherever they are rather than from one named source. */
+      fromLocationId: zod.z.string(),
+      /** Where a drain would move it — the class's CURRENT default. */
+      toLocationId: zod.z.string(),
+      /** Segments (footage lane) or rows (media lane) still on the source. */
+      items: zod.z.number().int().nonnegative().nullable(),
+      /** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+      bytes: zod.z.number().int().nonnegative().nullable()
+    });
+    var StorageMigrationDrainInputSchema = zod.z.object({
+      /** The classes to drain. Each must appear in `storageMigration.residue`, so
+      *  a class whose source is already empty is refused rather than started. */
+      classes: zod.z.array(StorageMigrationClassSchema).min(1),
+      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+    });
+    var RelocateResidueInputSchema = zod.z.object({
+      fromLocationId: zod.z.string().min(1),
+      /** Narrow to one logical class; omit for every profile on the location. */
+      footageClass: RelocateFootageClassSchema.optional()
+    });
+    var RelocateResidueSchema = zod.z.object({
+      segments: zod.z.number().int().nonnegative(),
+      bytes: zod.z.number().int().nonnegative()
+    }).nullable();
+    var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
+    var RelocatableMediaCountInputSchema = zod.z.object({
+      toLocationId: zod.z.string().min(1),
+      /** Omitted = `move`. */
+      mode: MediaRelocateModeSchema.optional()
+    });
     var StorageLocationTypeSchema = zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*$/);
     var StorageLocationSchema = zod.z.object({
       id: zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/),
@@ -26408,6 +26504,8 @@ var require_dist_CDgIzo82 = __commonJS({
       updatedAt: zod.z.number()
     });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
+    var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
+    var STORAGE_ACCESS_FALLBACK = "local-path";
     var StorageLocationDeclarationSchema = zod.z.object({
       /**
       * Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -26427,6 +26525,19 @@ var require_dist_CDgIzo82 = __commonJS({
       */
       cardinality: zod.z.enum(["single", "multi"]),
       /**
+      * HOW the declaring service reaches the bytes — and therefore WHICH
+      * providers may back a location of this kind. See {@link StorageAccessSchema}
+      * and {@link STORAGE_ACCESS_FALLBACK}.
+      *
+      * Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+      * can only over-restrict (refuse a remote provider for a kind that might
+      * have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+      * permissive direction and is therefore never inferred — a repo guard
+      * (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+      * reached by omission.
+      */
+      access: StorageAccessSchema.optional(),
+      /**
       * When set, the default instance for this location inherits its resolved
       * root from the named location's default instance. Useful for derivative
       * slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -36385,8 +36496,10 @@ var require_dist_CDgIzo82 = __commonJS({
       lastSeen: zod.z.number(),
       /** Frame-rate position history (subject to maxPositionHistory cap). */
       positions: zod.z.array(TrackPositionSchema).readonly(),
-      /** Periodic snapshots at snapshotIntervalMs cadence (subject to
-      *  saveThumbnails policy). */
+      /** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+      *  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+      *  the retired `saveThumbnails` used to gate this and the rolling
+      *  `lastFrame` together). Empty is the healthy default, not a capture gap. */
       snapshots: zod.z.array(TrackSnapshotSchema).readonly(),
       /** Deduplicated zones the track has entered at least once. Zone IDS. */
       zonesVisited: zod.z.array(zod.z.string()).readonly(),
@@ -37369,6 +37482,21 @@ var require_dist_CDgIzo82 = __commonJS({
         * it to zero.
         */
         countUnstampedEventMedia: method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
+        /**
+        * How many rows a pass would STILL act on against `toLocationId`.
+        *
+        * One derivation, two consumers: it is the media lane's denominator (the
+        * **M** the footage lane gets from the ledger census — D295) and it is the
+        * residue behind "drain remaining". Deriving them separately is how "N of M"
+        * ends up comparing two different populations.
+        *
+        * `null` means the count could not be taken; it is never zero-filled,
+        * because a zero here reads as "nothing left to move".
+        */
+        countRelocatableMedia: method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -39909,6 +40037,35 @@ var require_dist_CDgIzo82 = __commonJS({
         cancel: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
+        }),
+        /**
+        * Every mover running RIGHT NOW, in both lanes, with its counters.
+        *
+        * `status` covers a migration's own moves — the coordinator folds their
+        * progress onto the durable job record it is already polling. This covers
+        * the other case, and it is not hypothetical: a drain armed straight against
+        * `recording.relocateFootage` (the only path that existed before
+        * {@link drain}) has no job to fold into and would otherwise be invisible.
+        */
+        movers: method(zod.z.object({}), zod.z.array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }),
+        /**
+        * What each class's SOURCE still holds, from the archive — never from the
+        * resident index (D295). Only classes with something left (or something
+        * unknown) are listed, so an empty list means there is nothing to drain and
+        * the UI has no honest button to offer.
+        */
+        residue: method(zod.z.object({}), zod.z.array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }),
+        /**
+        * Run the drain half alone, on a class whose default has ALREADY moved.
+        *
+        * It never repoints anything, which is what lets `start` keep refusing a
+        * destination that is already the default: the two verbs cannot be confused
+        * for one another, and no operator can re-repoint a migrated class through
+        * this door.
+        */
+        drain: method(StorageMigrationDrainInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+          kind: "mutation",
+          auth: "admin"
         })
       }
     };
@@ -40418,7 +40575,20 @@ var require_dist_CDgIzo82 = __commonJS({
       */
       scanned: zod.z.number(),
       /** True when the backend could not consider every row that passed the filter. */
-      truncated: zod.z.boolean()
+      truncated: zod.z.boolean(),
+      /**
+      * The `topK` the backend actually ran with.
+      *
+      * Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+      * past it used to learn nothing but a boolean, from a WARN in the provider's
+      * own log rather than in its answer. That is how an audit asking for 20,000
+      * consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+      * for weeks. `truncated` says THAT the answer was short; this says BY HOW
+      * MUCH, in the return value, where the caller cannot fail to see it.
+      *
+      * Equals the requested `topK` whenever nothing was lowered.
+      */
+      effectiveTopK: zod.z.number().int().positive()
     });
     var VectorDeleteInputSchema = zod.z.object({
       index: zod.z.string(),
@@ -40437,6 +40607,35 @@ var require_dist_CDgIzo82 = __commonJS({
       id: zod.z.string(),
       metadata: VectorMetadataSchema
     })) });
+    var VectorFetchInputSchema = zod.z.object({
+      index: zod.z.string(),
+      ids: zod.z.array(zod.z.string())
+    });
+    var VectorFetchResultSchema = zod.z.object({ items: zod.z.array(zod.z.object({
+      id: zod.z.string(),
+      /** base64 Float32LE — the same wire form `upsert` accepts. */
+      vector: zod.z.string(),
+      metadata: VectorMetadataSchema
+    })) });
+    var VectorScanInputSchema = zod.z.object({
+      index: zod.z.string(),
+      /** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+      cursor: zod.z.number().int().nonnegative().default(0),
+      limit: zod.z.number().int().positive()
+    });
+    var VectorScanResultSchema = zod.z.object({
+      items: zod.z.array(zod.z.object({
+        id: zod.z.string(),
+        metadata: VectorMetadataSchema
+      })),
+      /**
+      * Where the next page starts, or `null` when the walk reached the end.
+      *
+      * `null` is the ONLY end-of-index signal. A caller must not infer the end
+      * from a short page: a backend is free to return fewer rows than asked.
+      */
+      nextCursor: zod.z.number().int().nonnegative().nullable()
+    });
     var VectorStatsInputSchema = zod.z.object({ index: zod.z.string() });
     var VectorStatsResultSchema = zod.z.object({
       /** Provider id, so an operator can tell brute force from an ANN index. */
@@ -40467,6 +40666,10 @@ var require_dist_CDgIzo82 = __commonJS({
         query: method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
         /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
         getByIds: method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+        /** Metadata AND vectors, by named id — see {@link VectorFetchInputSchema}. */
+        fetchByIds: method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }),
+        /** One page of the whole index, unranked — see {@link VectorScanInputSchema}. */
+        scan: method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }),
         deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
           kind: "mutation",
           auth: "admin"
@@ -46928,6 +47131,20 @@ var require_dist_CDgIzo82 = __commonJS({
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * What a location STILL holds, asked of the durable hour ledger.
+        *
+        * The number behind "drain remaining": segments and bytes that would still
+        * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+        * — because the resident index is not the archive (D295), and a drain sized
+        * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+        * `null` means the archive could not be asked (no ledger on this node, or
+        * the aggregate failed) and is never conflated with an empty source.
+        */
+        getRelocateResidue: method(RelocateResidueInputSchema, RelocateResidueSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -52932,6 +53149,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countRelocatableMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.countUnstampedEventMedia": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -54096,6 +54319,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "recording.getRelocateResidue": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "recording.getStorageMigrationMoveStatus": {
         capName: "recording",
         capScope: "system",
@@ -54642,12 +54871,30 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "create"
       },
+      "storageMigration.drain": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "storageMigration.movers": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.plan": {
         capName: "storage-migration",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "storageMigration.residue": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.start": {
         capName: "storage-migration",
         capScope: "system",
@@ -55482,6 +55729,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "delete"
       },
+      "vectorStore.fetchByIds": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.getByIds": {
         capName: "vector-store",
         capScope: "system",
@@ -55494,6 +55747,12 @@ var require_dist_CDgIzo82 = __commonJS({
         addonId: null,
         access: "view"
       },
+      "vectorStore.scan": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.stats": {
         capName: "vector-store",
         capScope: "system",
@@ -58249,6 +58508,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return METHOD_ACCESS_MAP;
       }
     });
+    Object.defineProperty(exports, "REDACTED_SECRET", {
+      enumerable: true,
+      get: function() {
+        return REDACTED_SECRET;
+      }
+    });
     Object.defineProperty(exports, "RUNTIME_DEFAULTS", {
       enumerable: true,
       get: function() {
@@ -58279,6 +58544,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return SOURCE_DEVICE_TYPES;
       }
     });
+    Object.defineProperty(exports, "STORAGE_ACCESS_FALLBACK", {
+      enumerable: true,
+      get: function() {
+        return STORAGE_ACCESS_FALLBACK;
+      }
+    });
     Object.defineProperty(exports, "STREAM_PROFILE_META", {
       enumerable: true,
       get: function() {
@@ -58387,6 +58658,12 @@ var require_dist_CDgIzo82 = __commonJS({
         return buildStreamParamsConfigSchema;
       }
     });
+    Object.defineProperty(exports, "collectSecretConfigKeys", {
+      enumerable: true,
+      get: function() {
+        return collectSecretConfigKeys;
+      }
+    });
     Object.defineProperty(exports, "coreBlockAddonId", {
       enumerable: true,
       get: function() {
@@ -58789,7 +59066,7 @@ var require_alerts_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     function selectExpired(alerts, cutoffMs) {
       return alerts.filter((a) => a.createdAt < cutoffMs).sort((a, b) => a.createdAt - b.createdAt).map((a) => a.id);
     }
@@ -59608,7 +59885,7 @@ var require_console_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var require_formatter = require_formatter_DqAKDlvN();
     var LEVEL_RANK = {
       debug: 0,
@@ -59702,7 +59979,7 @@ var require_core_blocks_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -60599,11 +60876,11 @@ var require_core_blocks = __commonJS({
   }
 });
 
-// ../system/dist/retired-settings-keys-BfAzWvPC.js
-var require_retired_settings_keys_BfAzWvPC = __commonJS({
-  "../system/dist/retired-settings-keys-BfAzWvPC.js"(exports) {
+// ../system/dist/retired-settings-keys-Dp_CyuCW.js
+var require_retired_settings_keys_Dp_CyuCW = __commonJS({
+  "../system/dist/retired-settings-keys-Dp_CyuCW.js"(exports) {
     "use strict";
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     function settingsStoreIsAuthoritativeHere(env) {
       const raw = (env["CAMSTACK_ROLE"] ?? "").trim().toLowerCase();
       return raw === "" || raw === "hub";
@@ -62817,8 +63094,8 @@ var require_device_manager_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
-    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
+    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
     var node_crypto = __require("crypto");
     var _camstack_types_node = require_node();
     var JOB_HISTORY = 20;
@@ -67567,7 +67844,7 @@ var require_hub_forwarder = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var require_formatter = require_formatter_DqAKDlvN();
     var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;
     var HubForwarderDestination = class {
@@ -67704,7 +67981,7 @@ var require_liveness_monitor_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var NO_DEVICES = "liveness:no-devices";
     var ALL_OFFLINE = "liveness:all-devices-offline";
     var NO_FOOTAGE_PREFIX = "liveness:no-footage:";
@@ -67894,7 +68171,7 @@ var require_local_auth_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var crypto$1 = __require("crypto");
@@ -75707,7 +75984,7 @@ var require_loki_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     function sanitizeLabelName(raw) {
       const replaced = raw.replaceAll(/[^a-zA-Z0-9_]/g, "_");
       return /^[a-zA-Z_]/.test(replaced) ? replaced : `_${replaced}`;
@@ -76272,7 +76549,7 @@ var require_native_metrics_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var node_fs_promises = __require("fs/promises");
     var node_child_process = __require("child_process");
     var node_util = __require("util");
@@ -78894,7 +79171,7 @@ var require_filesystem_storage_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     var node_path = __require("path");
@@ -80010,8 +80287,8 @@ var require_sqlite_settings_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
-    var require_retired_settings_keys = require_retired_settings_keys_BfAzWvPC();
+    var require_dist10 = require_dist_Ck2jkBZk();
+    var require_retired_settings_keys = require_retired_settings_keys_Dp_CyuCW();
     var node_crypto = __require("crypto");
     var node_fs = __require("fs");
     var node_module = __require("module");
@@ -81773,7 +82050,88 @@ var require_sqlite_settings_addon = __commonJS({
         return {
           matches,
           scanned: rows.length,
-          truncated: k < params.topK && rows.length >= k
+          truncated: k < params.topK && rows.length >= k,
+          effectiveTopK: k
+        };
+      }
+      /**
+      * Ids read back WITH their vectors.
+      *
+      * `vec0` returns a vector column as the packed Float32 blob it stores, which
+      * is byte-for-byte what `upsert` was given — so the round trip is a base64
+      * encode and nothing else. No re-normalisation, no float re-ordering: a
+      * gallery loaded through here ranks identically to one loaded from the JSON
+      * column it replaced.
+      */
+      async fetchByIds(index, ids) {
+        this.specOf(index);
+        if (ids.length === 0) return [];
+        const placeholders = ids.map(() => "?").join(",");
+        const rows = this.measured({
+          op: "vectorFetch",
+          collection: tableFor(index)
+        }, () => this.db.prepare(`SELECT id, embedding, deviceId, timestamp, className, modelId, extra
+           FROM ${tableFor(index)} WHERE id IN (${placeholders})`).all(...ids));
+        const out = [];
+        for (const raw of rows) {
+          if (typeof raw !== "object" || raw === null) continue;
+          const row = raw;
+          const id = asText(row["id"]);
+          if (id === null) continue;
+          const blob = row["embedding"];
+          if (!Buffer.isBuffer(blob)) {
+            this.logger.warn("sqlite-vec: row has no readable vector \u2014 skipped", { meta: {
+              index,
+              id
+            } });
+            continue;
+          }
+          out.push({
+            id,
+            vector: blob.toString("base64"),
+            metadata: rebuild(row)
+          });
+        }
+        return out;
+      }
+      /**
+      * One page of the whole index, unranked.
+      *
+      * `LIMIT ? OFFSET ?` over the `vec0` table with NO `MATCH` clause: a plain
+      * scan, so the extension's KNN `k` ceiling ({@link VEC_KNN_MAX_K}) does not
+      * apply and no distance is computed at all. Ordered by `id` so a cursor means
+      * the same thing across calls — `rowid` order is not stable under the
+      * DELETE-then-INSERT upsert this class performs.
+      *
+      * The cursor is an OFFSET, so rows deleted behind the walk shift the window.
+      * That is acceptable and deliberate for the one caller: a reconcile that
+      * misses a row this pass sees it next pass, and the alternative — a keyset
+      * cursor on a virtual table whose ordering the extension owns — buys nothing
+      * for a walk that is idempotent by construction.
+      */
+      async scan(index, cursor, limit) {
+        this.specOf(index);
+        const offset = Math.max(0, Math.floor(cursor));
+        const take = Math.max(1, Math.floor(limit));
+        const rows = this.measured({
+          op: "vectorScan",
+          collection: tableFor(index)
+        }, () => this.db.prepare(`SELECT id, deviceId, timestamp, className, modelId, extra
+           FROM ${tableFor(index)} ORDER BY id LIMIT ? OFFSET ?`).all(BigInt(take), BigInt(offset)));
+        const items = [];
+        for (const raw of rows) {
+          if (typeof raw !== "object" || raw === null) continue;
+          const row = raw;
+          const id = asText(row["id"]);
+          if (id === null) continue;
+          items.push({
+            id,
+            metadata: rebuild(row)
+          });
+        }
+        return {
+          items,
+          nextCursor: rows.length < take ? null : offset + rows.length
         };
       }
       async getByIds(index, ids) {
@@ -82111,6 +82469,8 @@ var require_sqlite_settings_addon = __commonJS({
             ...input.filter !== void 0 ? { filter: input.filter } : {}
           }),
           getByIds: async (input) => ({ items: await vectorIndex.getByIds(input.index, input.ids) }),
+          fetchByIds: async (input) => ({ items: await vectorIndex.fetchByIds(input.index, input.ids) }),
+          scan: async (input) => vectorIndex.scan(input.index, input.cursor, input.limit),
           deleteByIds: async (input) => ({ deleted: await vectorIndex.deleteByIds(input.index, input.ids) }),
           deleteByFilter: async (input) => ({ deleted: await vectorIndex.deleteByFilter(input.index, input.filter) }),
           stats: async (input) => vectorIndex.stats(input.index)
@@ -82290,7 +82650,7 @@ var require_storage_orchestrator_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var node_crypto = __require("crypto");
     var node_fs_promises = __require("fs/promises");
     node_fs_promises = require_chunk.__toESM(node_fs_promises);
@@ -82526,7 +82886,8 @@ var require_storage_orchestrator_addon = __commonJS({
             toLocationId: target.id,
             moverJobId: null,
             state: null,
-            error: null
+            error: null,
+            progress: null
           });
           if (BLOCKING_ONLY_CLASSES.includes(storageClass)) findings.push({
             code: "blockingOnly",
@@ -82624,7 +82985,8 @@ var require_storage_orchestrator_addon = __commonJS({
               ...move,
               moverJobId: null,
               state: null,
-              error: null
+              error: null,
+              progress: null
             })),
             pauseLeaseId: null,
             pausedParticipants: [],
@@ -82658,6 +83020,177 @@ var require_storage_orchestrator_addon = __commonJS({
         await Promise.all(job.moves.filter((move) => move.moverJobId !== null).map((move) => this.cancelMove(move)));
         return true;
       }
+      /**
+      * Every mover running right now, in both lanes — including the ones no
+      * migration armed.
+      *
+      * `status` already carries a migration's own progress (the coordinator folds
+      * it onto each move from the poll it is already doing). This exists for the
+      * other half: `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+      * are operator-callable, and until {@link drain} existed that was the only way
+      * to run a drain at all. Such a mover has no job to fold into, so without this
+      * read a five-hour operation is invisible in the UI.
+      *
+      * `migrationJobId` is best-effort by construction: the coordinator keeps ONE
+      * durable job, so a mover armed by an older, since-overwritten migration
+      * reports `null`. That is the honest answer — nothing here can still claim it.
+      */
+      async movers() {
+        const job = await this.status();
+        const owned = /* @__PURE__ */ new Map();
+        for (const move of job?.moves ?? []) if (move.moverJobId !== null) owned.set(move.moverJobId, job?.jobId ?? "");
+        const [footage, media] = await Promise.all([this.deps.participants.recorder.listMovers(), this.deps.participants.analytics.listMovers()]);
+        const observedAt = this.deps.now();
+        const label = (lane, jobs) => jobs.map((mover) => ({
+          lane,
+          job: mover,
+          migrationJobId: owned.get(mover.jobId) ?? null,
+          observedAt
+        }));
+        return [...label("footage", footage), ...label("media", media)];
+      }
+      /**
+      * What every class's source STILL holds — the census behind a "drain
+      * remaining" action.
+      *
+      * A class appears here only when something is (or might be) left on a
+      * location that is not its default. An empty result therefore means exactly
+      * "there is nothing to drain", which is what lets the UI offer the action
+      * only when it is true, and what lets {@link drain} refuse rather than start
+      * a job that would move nothing and report `done` — the failure mode D295
+      * exists to end.
+      *
+      * `items: null` is "the archive could not be asked" and is still listed. A
+      * residue nobody could measure is the case an operator most needs to see;
+      * dropping it because the read failed would be the quiet success again.
+      */
+      async residue() {
+        const out = [];
+        for (const storageClass of STORAGE_CLASSES) {
+          if (!MOVER_CLASSES.includes(storageClass)) continue;
+          const target = this.deps.locations.getDefaultLocation(storageClass);
+          if (!target) continue;
+          if (laneOf(storageClass) === "media") {
+            const count = await unanswerable(this.deps.participants.analytics.residue({
+              toLocationId: target.id,
+              mode: storageClass === "galleryMedia" ? "gallery" : "move"
+            }));
+            if (count !== null && count.rows === 0) continue;
+            out.push({
+              storageClass,
+              fromLocationId: "*",
+              toLocationId: target.id,
+              items: count?.rows ?? null,
+              bytes: null
+            });
+            continue;
+          }
+          for (const source of this.deps.locations.listLocations({ type: storageClass })) {
+            if (source.id === target.id) continue;
+            const census = await unanswerable(this.deps.participants.recorder.residue({
+              fromLocationId: source.id,
+              footageClass: storageClass === "recordingsLow" ? "recordingsLow" : "recordings"
+            }));
+            if (census !== null && census.segments === 0) continue;
+            out.push({
+              storageClass,
+              fromLocationId: source.id,
+              toLocationId: target.id,
+              items: census?.segments ?? null,
+              bytes: census?.bytes ?? null
+            });
+          }
+        }
+        return out;
+      }
+      /**
+      * Run the DRAIN half alone, against classes whose default has already moved.
+      *
+      * ## Why this is a second verb rather than a looser `start`
+      *
+      * `start` refuses a destination that is already the class's default
+      * (`"recordingsLow:ssd" is already the "recordingsLow" default`). That refusal
+      * is correct and it is load-bearing: there is genuinely nothing left to
+      * repoint, and an operator must never be able to re-repoint a migrated class
+      * by accident. Making `start` idempotent — "an already-repointed class
+      * proceeds straight to draining" — would delete that protection AND make the
+      * verb mean two different things depending on state, so the confirmation an
+      * operator reads ("pauses the writers…") would be a lie half the time.
+      *
+      * `drain` instead cannot repoint AT ALL: it never touches
+      * `setDefaultLocations`, and its job starts in `draining` with `repointed`
+      * already true, so the `repointing` / `refreshing` / `resuming` blocks of
+      * {@link run} are behind it and unreachable. The two verbs are disjoint, and
+      * `start`'s refusal keeps meaning exactly what it meant.
+      *
+      * ## Why it re-derives the work instead of resuming the old job
+      *
+      * The finished job is the audit of what happened; re-opening it destroys
+      * that. And a drain is needed in cases where no migration job ever existed
+      * (a mover armed by hand, footage stranded on a location an operator added
+      * and then un-defaulted). One job = one operation, and the work list comes
+      * from {@link residue} — the archive — not from what a previous job believed.
+      */
+      async drain(input) {
+        if (this.startReserved) throw new Error("storage migration is already active");
+        this.startReserved = true;
+        try {
+          const existing = await this.status();
+          if (existing && isTerminal(existing) && existing.pausedParticipants.length > 0) {
+            await this.releaseAfterTerminal(existing);
+            await this.persist(existing);
+            if (existing.pausedParticipants.length > 0) throw new Error(`storage migration ${existing.jobId} still holds maintenance leases`);
+          }
+          if (existing && !isTerminal(existing)) throw new Error(`storage migration is already active (${existing.jobId})`);
+          for (const storageClass of input.classes) {
+            if (MOVER_CLASSES.includes(storageClass)) continue;
+            throw new Error(`No mover owns "${storageClass}" \u2014 there is nothing that can drain it. Move it by hand.`);
+          }
+          const residue = await this.residue();
+          const moves = [];
+          const destinations = {};
+          for (const storageClass of input.classes) {
+            const remaining = residue.filter((entry) => entry.storageClass === storageClass);
+            if (remaining.length === 0) throw new Error(`"${storageClass}" has nothing left outside its default location \u2014 there is nothing to drain. To CHANGE where it writes, use storageMigration.start with a new destination.`);
+            for (const entry of remaining) {
+              moves.push({
+                storageClass,
+                fromLocationId: entry.fromLocationId,
+                toLocationId: entry.toLocationId,
+                moverJobId: null,
+                state: null,
+                error: null,
+                progress: null
+              });
+              destinations[storageClass] = entry.toLocationId;
+            }
+          }
+          const now = this.deps.now();
+          const job = {
+            jobId: this.deps.newId(),
+            phase: "draining",
+            mode: "nonBlocking",
+            destinations,
+            throttleMbps: input.throttleMbps ?? 40,
+            moves,
+            pauseLeaseId: null,
+            pausedParticipants: [],
+            repointed: true,
+            cancelRequested: false,
+            startedAt: now,
+            updatedAt: now,
+            finishedAt: null,
+            error: null
+          };
+          await this.persist(job);
+          this.active = job;
+          this.runPromise = this.run(job);
+          this.runPromise;
+          return job.jobId;
+        } finally {
+          this.startReserved = false;
+        }
+      }
       /** Boot recovery resumes a durable unfinished state. A missing in-memory
       * child mover is recreated from the same copy-if-absent input. */
       async recover() {
@@ -82867,6 +83400,13 @@ var require_storage_orchestrator_addon = __commonJS({
             }
             move.state = status.state;
             move.error = status.error;
+            move.progress = {
+              filesMoved: status.filesMoved,
+              filesTotal: status.filesTotal,
+              bytesMoved: status.bytesMoved,
+              startedAt: status.startedAt,
+              observedAt: this.deps.now()
+            };
             if (status.state === "failed") throw new Error(move.error ?? `${move.storageClass} move failed`);
             if (status.state === "cancelled") {
               job.cancelRequested = true;
@@ -82986,6 +83526,13 @@ var require_storage_orchestrator_addon = __commonJS({
         await this.deps.state.set(job);
       }
     };
+    async function unanswerable(read) {
+      try {
+        return await read;
+      } catch {
+        return null;
+      }
+    }
     function requireLease(job) {
       if (job.pauseLeaseId === null) throw new Error("storage migration has no maintenance lease");
       return job.pauseLeaseId;
@@ -83006,6 +83553,9 @@ var require_storage_orchestrator_addon = __commonJS({
         const existing = map.get(declaration.id);
         if (existing !== void 0) {
           if (existing.cardinality !== declaration.cardinality) throw new Error(`Storage location cardinality conflict for id "${declaration.id}": "${existing.cardinality}" (first declarer) vs "${declaration.cardinality}" (later declarer). All addons declaring the same storage location id must agree on cardinality.`);
+          const existingAccess = existing.access ?? "local-path";
+          const declaredAccess = declaration.access ?? "local-path";
+          if (existingAccess !== declaredAccess) throw new Error(`Storage location access conflict for id "${declaration.id}": "${existingAccess}" (first declarer) vs "${declaredAccess}" (later declarer). All addons declaring the same storage location id must agree on access \u2014 a later declaration must never widen what an earlier one restricted.`);
           continue;
         }
         map.set(declaration.id, declaration);
@@ -83021,11 +83571,23 @@ var require_storage_orchestrator_addon = __commonJS({
         cardinalityOf(id) {
           return map.get(id)?.cardinality ?? null;
         },
+        accessOf(id) {
+          const declaration = map.get(id);
+          if (declaration === void 0) return null;
+          return declaration.access ?? "local-path";
+        },
         list() {
           return frozen;
         }
       };
     }
+    function resolveRefusalFor(location, locality) {
+      if (locality !== false) return null;
+      return `storage.resolve is a request for a path this node can open with node:fs, and location "${location.id}" is served by the remote provider "${location.providerId}" (nodeLocal: false) \u2014 the path it would return exists on the remote host, not here. Read and write this location through the storage cap (read/write, or beginUpload/writeChunk/finalizeUpload) instead.`;
+    }
+    function canProbeOccupancyLocally(locality) {
+      return locality === true;
+    }
     function resolveEngine(getEngines) {
       const engines = getEngines();
       if (engines.length === 0) throw new Error("settings-store: no data-store-provider engine is registered \u2014 the data door has nothing behind it");
@@ -83053,6 +83615,47 @@ var require_storage_orchestrator_addon = __commonJS({
         declareCollection: async (input) => (await engine()).declareCollection(input)
       };
     }
+    var EMPTY_SECRET_KEYS = /* @__PURE__ */ new Set();
+    function secretKeysOfProviderInfo(info) {
+      return require_dist10.collectSecretConfigKeys(info.configSchema);
+    }
+    function redactLocationConfig(config, secretKeys) {
+      if (secretKeys.size === 0) return config;
+      let touched = false;
+      const out = {};
+      for (const [key, value] of Object.entries(config)) {
+        if (secretKeys.has(key) && value !== void 0 && value !== null && value !== "") {
+          out[key] = require_dist10.REDACTED_SECRET;
+          touched = true;
+          continue;
+        }
+        out[key] = value;
+      }
+      return touched ? out : config;
+    }
+    function redactLocation(location, secretKeys) {
+      const config = redactLocationConfig(location.config, secretKeys);
+      if (config === location.config) return location;
+      return {
+        ...location,
+        config
+      };
+    }
+    function restoreRedactedSecrets(incoming, stored, secretKeys) {
+      if (secretKeys.size === 0) return incoming;
+      let touched = false;
+      const out = {};
+      for (const [key, value] of Object.entries(incoming)) {
+        if (value !== "__camstack_redacted__" || !secretKeys.has(key)) {
+          out[key] = value;
+          continue;
+        }
+        touched = true;
+        const previous = stored?.[key];
+        if (previous !== void 0) out[key] = previous;
+      }
+      return touched ? out : incoming;
+    }
     async function collectProviderInfos(providers, onError) {
       const out = [];
       for (const [index, p] of providers.entries()) try {
@@ -83374,6 +83977,66 @@ var require_storage_orchestrator_addon = __commonJS({
       * implicitly-demoted siblings are persisted before the in-memory map
       * mutation returns. Persistence errors propagate to the caller.
       */
+      /**
+      * Refuse a `(location kind, provider)` pair the kind cannot use.
+      *
+      * The rule, in one line: a `'local-path'` kind requires a provider whose
+      * `getProviderInfo().nodeLocal` is `true`.
+      *
+      * `nodeLocal` is the honest name for "this provider's `resolve` returns a
+      * path on the filesystem of the node that resolved it". The
+      * `storage-provider` cap's own discriminated union already forces every
+      * provider to declare it, and all four remote providers declare `false`, so
+      * no new cap surface is needed to ask the question.
+      *
+      * Three-valued on purpose. Only a POSITIVE `false` refuses:
+      *  - `true`      → node-local, always fine.
+      *  - `false`     → the provider is known and known to be remote. REFUSE.
+      *  - `undefined` → the provider has not registered yet (early boot, an addon
+      *    still loading). That is "unknown", not "remote", and a read that could
+      *    not be made must never destroy work (D49) — the system seed runs
+      *    through this path before any provider registers. Allowed, and logged,
+      *    so the allowance is never silent.
+      *
+      * The DECLARATION side is read the same way. A kind the registry does not
+      * know is `local-path` (fail-closed: an unknown kind is not a permissive
+      * one), but NO REGISTRY AT ALL is a different statement — nothing has been
+      * loaded, so nothing can be concluded about any kind. The addon injects the
+      * registry inside `onInitialize`, before the `storage` cap is mounted, so
+      * there is no window in which an operator upsert sees this branch; a service
+      * constructed without one is the in-memory/early-boot path.
+      */
+      refuseIncompatibleProvider(input) {
+        const registry = this.registry;
+        if (registry === null) {
+          this.logger.debug("storage-orchestrator: no location declarations loaded \u2014 access constraint not evaluated", { meta: {
+            id: input.id,
+            type: input.type,
+            providerId: input.providerId
+          } });
+          return;
+        }
+        const access = registry.accessOf(input.type) ?? "local-path";
+        if (access !== "local-path") return;
+        const nodeLocal = this.nodeLocalResolver?.(input.providerId);
+        if (nodeLocal === true) return;
+        if (nodeLocal === void 0) {
+          this.logger.debug("storage-orchestrator: provider not yet classified \u2014 allowing a local-path upsert", { meta: {
+            id: input.id,
+            type: input.type,
+            providerId: input.providerId,
+            access
+          } });
+          return;
+        }
+        this.logger.warn("storage-orchestrator: REFUSED a remote provider for a local-path kind", { meta: {
+          id: input.id,
+          type: input.type,
+          providerId: input.providerId,
+          access
+        } });
+        throw new Error(`Storage kind "${input.type}" is declared access "local-path": the service that owns it reads and writes its bytes with node:fs on the path "storage.resolve" returns, so it can only be backed by a node-local provider. Provider "${input.providerId}" is remote (nodeLocal: false) and its resolved paths do not exist on this node. Refusing location "${input.id}".`);
+      }
       upsertLocation(input) {
         const now = Date.now();
         const existing = this.locations.get(input.id);
@@ -83383,6 +84046,7 @@ var require_storage_orchestrator_addon = __commonJS({
             if (already) throw new Error(`Storage type "${input.type}" is single \u2014 only one location allowed (existing: "${already.id}"). Edit it instead of adding a new one.`);
           }
         }
+        this.refuseIncompatibleProvider(input);
         if (this.nodeLocalResolver?.(input.providerId) === true && !input.nodeId) input = {
           ...input,
           nodeId: "hub"
@@ -83853,6 +84517,19 @@ var require_storage_orchestrator_addon = __commonJS({
       */
       nodeLocalByProvider = /* @__PURE__ */ new Map();
       /**
+      * Cached `providerId → secret config keys`, derived from each provider's own
+      * `configSchema` in the SAME refresh as `nodeLocalByProvider` — one
+      * `getProviderInfo()` round trip answers both questions.
+      *
+      * An absent providerId yields an EMPTY set, which redacts nothing. That is
+      * the one direction this cache can be wrong in, so it is worth saying why it
+      * is acceptable: the entry is populated at the same moment the provider
+      * becomes resolvable at all, so a location whose provider is unknown here
+      * cannot be dispatched to either — there is no window in which a credential
+      * is readable through a provider the orchestrator can otherwise use.
+      */
+      secretKeysByProvider = /* @__PURE__ */ new Map();
+      /**
       * Disposers run on `onShutdown` — currently the eventBus subscription
       * for `capability:provider-registered` events used by the lazy seed
       * fallback. Stored separately from the `BaseAddon` disposer chain so
@@ -83887,13 +84564,24 @@ var require_storage_orchestrator_addon = __commonJS({
           listLocations: async ({ type }) => {
             const rows = type !== void 0 ? service.listLocations({ type }) : service.listLocations();
             return Promise.all(rows.map(async (loc) => ({
-              ...loc,
+              ...this.redacted(loc),
               capacity: await this.localCapacityOf(loc)
             })));
           },
-          getDefaultLocation: async ({ type }) => service.getDefaultLocation(type),
+          getDefaultLocation: async ({ type }) => {
+            const loc = service.getDefaultLocation(type);
+            return loc === null ? null : this.redacted(loc);
+          },
           listLocationDeclarations: async () => service.listDeclarations(),
-          upsertLocation: async (input) => service.upsertLocation(input),
+          upsertLocation: async (input) => {
+            const stored = service.getLocationById(input.id);
+            const config = restoreRedactedSecrets(input.config, stored?.config, this.secretKeysFor(input.providerId));
+            const saved = service.upsertLocation(config === input.config ? input : {
+              ...input,
+              config
+            });
+            return this.redacted(saved);
+          },
           deleteLocation: async ({ id, force }) => {
             await service.deleteLocation(id, { force: force === true });
           },
@@ -83938,6 +84626,7 @@ var require_storage_orchestrator_addon = __commonJS({
           },
           resolve: async ({ location, relativePath }) => {
             const loc = service.resolveRef(location);
+            this.refuseRemoteResolve(loc);
             return (await service.getProviderFor(loc)).resolve({
               location: loc,
               relativePath
@@ -84060,6 +84749,8 @@ var require_storage_orchestrator_addon = __commonJS({
               startMove: (input) => this.ctx.api.recording.startStorageMigrationMove.mutate(input),
               startDrain: (input) => this.ctx.api.recording.relocateFootage.mutate(input),
               getMove: (jobId) => this.ctx.api.recording.getStorageMigrationMoveStatus.query({ jobId }),
+              listMovers: () => this.ctx.api.recording.listRelocateJobs.query({}),
+              residue: (input) => this.ctx.api.recording.getRelocateResidue.query(input),
               cancelMove: async (jobId) => (await this.ctx.api.recording.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
                 await this.ctx.api.recording.refreshStorageLocationsForMigration.mutate({ leaseId });
@@ -84076,6 +84767,8 @@ var require_storage_orchestrator_addon = __commonJS({
               startDrain: (input) => this.ctx.api.pipelineAnalytics.relocateMedia.mutate(input),
               countUnstamped: () => this.ctx.api.pipelineAnalytics.countUnstampedEventMedia.query({}),
               getMove: (jobId) => this.ctx.api.pipelineAnalytics.getStorageMigrationMoveStatus.query({ jobId }),
+              listMovers: () => this.ctx.api.pipelineAnalytics.listRelocateMediaJobs.query({}),
+              residue: (input) => this.ctx.api.pipelineAnalytics.countRelocatableMedia.query(input),
               cancelMove: async (jobId) => (await this.ctx.api.pipelineAnalytics.cancelStorageMigrationMove.mutate({ jobId })).cancelled,
               refresh: async (leaseId) => {
                 await this.ctx.api.pipelineAnalytics.refreshStorageLocationsForMigration.mutate({ leaseId });
@@ -84091,7 +84784,10 @@ var require_storage_orchestrator_addon = __commonJS({
           plan: (input) => migration.plan(input),
           start: async (input) => ({ jobId: await migration.start(input) }),
           status: ({ jobId }) => migration.status(jobId),
-          cancel: async ({ jobId }) => ({ cancelled: await migration.cancel(jobId) })
+          cancel: async ({ jobId }) => ({ cancelled: await migration.cancel(jobId) }),
+          movers: () => migration.movers(),
+          residue: () => migration.residue(),
+          drain: async (input) => ({ jobId: await migration.drain(input) })
         };
         await this.seedFromDeclarations();
         const eventBus = this.ctx.eventBus;
@@ -84236,6 +84932,34 @@ var require_storage_orchestrator_addon = __commonJS({
         }
         return out;
       }
+      /** Declared secret config keys for a provider; empty when unknown. */
+      secretKeysFor(providerId) {
+        return this.secretKeysByProvider.get(providerId) ?? EMPTY_SECRET_KEYS;
+      }
+      /** A location with its provider's declared secrets replaced by the sentinel. */
+      redacted(location) {
+        return redactLocation(location, this.secretKeysFor(location.providerId));
+      }
+      /**
+      * Is this location backed by a provider that serves a genuine local
+      * filesystem? `true` / `false` / `undefined` — see
+      * `StorageOrchestratorService.refuseIncompatibleProvider` for why the
+      * unknown case is kept distinct rather than folded into either answer.
+      */
+      providerIsNodeLocal(location) {
+        return this.nodeLocalByProvider.get(location.providerId);
+      }
+      /** See the call site in the `resolve` dispatch, and `access-guards.ts`. */
+      refuseRemoteResolve(location) {
+        const refusal = resolveRefusalFor(location, this.providerIsNodeLocal(location));
+        if (refusal === null) return;
+        this.ctx.logger.warn("storage-orchestrator: REFUSED resolve() on a remote-backed location", { meta: {
+          id: location.id,
+          type: location.type,
+          providerId: location.providerId
+        } });
+        throw new Error(refusal);
+      }
       /** statfs capacity of a location's basePath, walking up to the nearest
       *  existing ancestor. Null for remote-node locations or unstattable paths. */
       async localCapacityOf(loc) {
@@ -84323,6 +85047,13 @@ var require_storage_orchestrator_addon = __commonJS({
       * errno — `EACCES`, `EIO`, a stale NFS handle — is `unknown` and refuses.
       */
       async locationOccupancy(location) {
+        if (!canProbeOccupancyLocally(this.providerIsNodeLocal(location))) {
+          this.ctx.logger.debug("storage-orchestrator: occupancy unknown \u2014 location is not backed by a local filesystem", { meta: {
+            id: location.id,
+            providerId: location.providerId
+          } });
+          return "unknown";
+        }
         if ((location.nodeId === void 0 || location.nodeId === "" ? HUB_NODE_ID : location.nodeId) !== (this.service?.getLocalNodeId() ?? HUB_NODE_ID)) return "unknown";
         const basePath = this.locationBasePath(location.id);
         if (basePath === null) return "unknown";
@@ -84405,7 +85136,10 @@ var require_storage_orchestrator_addon = __commonJS({
             error: err instanceof Error ? err.message : String(err)
           } });
         });
-        for (const info of infos) this.nodeLocalByProvider.set(info.providerId, info.nodeLocal);
+        for (const info of infos) {
+          this.nodeLocalByProvider.set(info.providerId, info.nodeLocal);
+          this.secretKeysByProvider.set(info.providerId, secretKeysOfProviderInfo(info));
+        }
       }
     };
     exports.SqliteLocationStore = SqliteLocationStore;
@@ -84444,7 +85178,7 @@ var require_system_config_addon = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var SECTION_TITLES = {
       server: "Server",
       auth: "Authentication"
@@ -102505,7 +103239,7 @@ var require_winston_logging = __commonJS({
       [Symbol.toStringTag]: { value: "Module" }
     });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var require_formatter = require_formatter_DqAKDlvN();
     var node_path = __require("path");
     node_path = require_chunk.__toESM(node_path);
@@ -104448,9 +105182,9 @@ var require_event_category_BaEgqJNv = __commonJS({
   }
 });
 
-// ../types/dist/sleep-CJrvRDlD.js
-var require_sleep_CJrvRDlD = __commonJS({
-  "../types/dist/sleep-CJrvRDlD.js"(exports) {
+// ../types/dist/sleep-CWWLTM6W.js
+var require_sleep_CWWLTM6W = __commonJS({
+  "../types/dist/sleep-CWWLTM6W.js"(exports) {
     "use strict";
     var require_event_category = require_event_category_BaEgqJNv();
     var zod = require_zod();
@@ -107151,6 +107885,7 @@ var require_sleep_CJrvRDlD = __commonJS({
           cancelStorageMigrationMove: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelStorageMigrationMove", "mutation", input),
           relocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "relocateMedia", "mutation", input),
           countUnstampedEventMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countUnstampedEventMedia", "query", input),
+          countRelocatableMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "countRelocatableMedia", "query", input),
           listRelocateMediaJobs: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listRelocateMediaJobs", "query", input),
           cancelRelocateMedia: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "cancelRelocateMedia", "mutation", input),
           listOpsLog: (input) => dispatch("pipeline-analytics", "pipelineAnalytics", "listOpsLog", "query", input),
@@ -108115,7 +108850,7 @@ var require_addon = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CJrvRDlD();
+    var require_sleep = require_sleep_CWWLTM6W();
     var require_err_msg = require_err_msg_COpsHMw2();
     var CAP_INPUT_DEFAULTS = Object.freeze({
       "addons": { "getLogs": { "limit": 100 } },
@@ -108335,7 +109070,10 @@ var require_addon = __commonJS({
         "createApiKey": { "isAdmin": false },
         "createUser": { "isAdmin": false }
       },
-      "vector-store": { "declareIndex": { "metric": "cosine" } },
+      "vector-store": {
+        "declareIndex": { "metric": "cosine" },
+        "scan": { "cursor": 0 }
+      },
       "zones": {
         "addZone": { "zone": { "__nested__": {
           "kind": "polygon",
@@ -114994,12 +115732,12 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../system/dist/manifest-python-deps-DVODn-qc.js
-var require_manifest_python_deps_DVODn_qc = __commonJS({
-  "../system/dist/manifest-python-deps-DVODn-qc.js"(exports) {
+// ../system/dist/manifest-system-deps-8boi90D9.js
+var require_manifest_system_deps_8boi90D9 = __commonJS({
+  "../system/dist/manifest-system-deps-8boi90D9.js"(exports) {
     "use strict";
     var require_chunk = require_chunk_Cek0wNdY();
-    require_dist_CDgIzo82();
+    require_dist_Ck2jkBZk();
     var node_crypto = __require("crypto");
     node_crypto = require_chunk.__toESM(node_crypto);
     var _camstack_types_node = require_node();
@@ -115702,14 +116440,14 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         dispose
       };
     }
-    var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$2 = (0, node_util.promisify)(node_child_process.execFile);
     var DEFAULT_REGISTRY = "https://registry.npmjs.org";
     function bootstrappedCliPath(cacheDir) {
       return node_path.join(cacheDir, "package", "bin", "npm-cli.js");
     }
     async function defaultProbeSystemNpm() {
       try {
-        await execFileAsync$1("npm", ["--version"], { timeout: 15e3 });
+        await execFileAsync$2("npm", ["--version"], { timeout: 15e3 });
         return true;
       } catch {
         return false;
@@ -115727,7 +116465,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       await node_fs.promises.writeFile(destTgz, bytes);
     }
     async function defaultExtractTarball(tgzPath, destDir) {
-      await execFileAsync$1("tar", [
+      await execFileAsync$2("tar", [
         "-xzf",
         tgzPath,
         "-C",
@@ -115755,7 +116493,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         registry: options.registry,
         logger: options.logger
       });
-      return execFileAsync$1(invocation.command, [...invocation.argsPrefix, ...args], {
+      return execFileAsync$2(invocation.command, [...invocation.argsPrefix, ...args], {
         ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
         timeout: options.timeout ?? 3e5
       });
@@ -115813,7 +116551,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       const namedAddon = Object.values(mod).find(isAddonConstructor);
       if (namedAddon) return namedAddon;
     }
-    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var execFileAsync$1 = (0, node_util.promisify)(node_child_process.execFile);
     function defaultNpmCacheDir() {
       return node_path.join(node_os.tmpdir(), "camstack-npm-bootstrap");
     }
@@ -116041,7 +116779,7 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
             return;
           }
           logger.warn("@electron/rebuild not available \u2014 falling back to npx", { meta: { addonDir } });
-          await execFileAsync("npx", [
+          await execFileAsync$1("npx", [
             "--yes",
             "electron-rebuild",
             "-m",
@@ -117244,11 +117982,11 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
               });
             }
           };
-          const PROBE_TIMEOUT_MS = 3e4;
+          const PROBE_TIMEOUT_MS2 = 3e4;
           const runProbe = async () => {
             if (typeof lifecycleHost.onProbe !== "function") return;
             try {
-              await Promise.race([lifecycleHost.onProbe(), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`onProbe timeout after ${PROBE_TIMEOUT_MS}ms`)), PROBE_TIMEOUT_MS))]);
+              await Promise.race([lifecycleHost.onProbe(), new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error(`onProbe timeout after ${PROBE_TIMEOUT_MS2}ms`)), PROBE_TIMEOUT_MS2))]);
             } catch (err) {
               opts.logger.warn("device.onProbe() threw or timed out \u2014 continuing with stale flags (slice subscription will reconcile if probe lands later)", {
                 tags: {
@@ -122158,6 +122896,156 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
       }
       await deps.installPythonRequirements(reqAbs);
     }
+    var execFileAsync = (0, node_util.promisify)(node_child_process.execFile);
+    var INSTALL_TIMEOUT_MS = 300 * 1e3;
+    var PROBE_TIMEOUT_MS = 1e4;
+    async function installManifestSystemDeps(declaration, logger, options = {}) {
+      const deps = declaration.systemDependencies;
+      if (!deps || deps.length === 0) return;
+      const hasBinary = options.hasBinary ?? defaultHasBinary;
+      const detectManager = options.detectManager ?? defaultDetectManager;
+      const run = options.run ?? defaultRun;
+      const platform = options.platform ?? process.platform;
+      for (const dep of deps) try {
+        await satisfyOne(dep, declaration.id, {
+          hasBinary,
+          detectManager,
+          run,
+          platform
+        }, logger);
+      } catch (err) {
+        logger.warn("system dependency step failed", { meta: {
+          addonId: declaration.id,
+          binary: dep.binary,
+          error: err instanceof Error ? err.message : String(err)
+        } });
+      }
+    }
+    async function satisfyOne(dep, addonId, rt, logger) {
+      if (await rt.hasBinary(dep.binary)) {
+        logger.debug("system dependency already present", { meta: {
+          addonId,
+          binary: dep.binary
+        } });
+        return;
+      }
+      const manager = await rt.detectManager();
+      if (manager === null) {
+        logger.warn("system dependency missing and no supported package manager on this host", { meta: {
+          addonId,
+          binary: dep.binary,
+          platform: rt.platform,
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      const packageName = dep.packages[manager];
+      if (packageName === void 0 || packageName.length === 0) {
+        logger.warn("system dependency missing and the addon declares no package for this manager", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      const plan = planFor(manager, packageName);
+      logger.info("installing system dependency", { meta: {
+        addonId,
+        binary: dep.binary,
+        manager,
+        package: packageName
+      } });
+      try {
+        for (const [command, args] of plan.steps) await rt.run(command, args);
+      } catch (err) {
+        logger.warn("system dependency install failed \u2014 the addon loads, its capability must refuse", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          package: packageName,
+          error: err instanceof Error ? err.message : String(err),
+          ...dep.reason !== void 0 ? { reason: dep.reason } : {}
+        } });
+        return;
+      }
+      if (!await rt.hasBinary(dep.binary)) {
+        logger.warn("system dependency installed but the binary still does not resolve", { meta: {
+          addonId,
+          binary: dep.binary,
+          manager,
+          package: packageName
+        } });
+        return;
+      }
+      logger.info("system dependency installed", { meta: {
+        addonId,
+        binary: dep.binary,
+        manager,
+        package: packageName
+      } });
+    }
+    function planFor(manager, packageName) {
+      switch (manager) {
+        case "apt":
+          return {
+            manager,
+            steps: [["apt-get", ["update"]], ["apt-get", [
+              "install",
+              "-y",
+              "--no-install-recommends",
+              packageName
+            ]]]
+          };
+        case "apk":
+          return {
+            manager,
+            steps: [["apk", [
+              "add",
+              "--no-cache",
+              packageName
+            ]]]
+          };
+        case "dnf":
+          return {
+            manager,
+            steps: [["dnf", [
+              "install",
+              "-y",
+              packageName
+            ]]]
+          };
+        case "brew":
+          return {
+            manager,
+            steps: [["brew", ["install", packageName]]]
+          };
+      }
+    }
+    async function defaultHasBinary(binary) {
+      try {
+        await execFileAsync("command", ["-v", binary], {
+          timeout: PROBE_TIMEOUT_MS,
+          shell: process.platform === "win32" ? false : "/bin/sh"
+        });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    async function defaultDetectManager() {
+      const candidates = node_os.platform() === "darwin" ? ["brew"] : [
+        "apt",
+        "apk",
+        "dnf",
+        "brew"
+      ];
+      for (const candidate of candidates) if (await defaultHasBinary(candidate === "apt" ? "apt-get" : candidate)) return candidate;
+      return null;
+    }
+    async function defaultRun(command, args) {
+      await execFileAsync(command, [...args], { timeout: INSTALL_TIMEOUT_MS });
+    }
     Object.defineProperty(exports, "AGENT_CAP_FWD_ACTION", {
       enumerable: true,
       get: function() {
@@ -122752,6 +123640,12 @@ var require_manifest_python_deps_DVODn_qc = __commonJS({
         return installManifestPythonDeps;
       }
     });
+    Object.defineProperty(exports, "installManifestSystemDeps", {
+      enumerable: true,
+      get: function() {
+        return installManifestSystemDeps;
+      }
+    });
     Object.defineProperty(exports, "ipcParentLink", {
       enumerable: true,
       get: function() {
@@ -126740,7 +127634,7 @@ var require_dist3 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_chunk = require_chunk_Cek0wNdY();
-    var require_dist10 = require_dist_CDgIzo82();
+    var require_dist10 = require_dist_Ck2jkBZk();
     var require_builtins_alerts_alerts_addon = require_alerts_addon();
     require_alerts();
     var require_formatter = require_formatter_DqAKDlvN();
@@ -126766,7 +127660,7 @@ var require_dist3 = __commonJS({
     var require_builtins_winston_logging_index = require_winston_logging();
     var require_file_data_plane = require_file_data_plane_DO8KbxCe();
     var require_tls$1 = require_tls_BxQlomxd();
-    var require_manifest_python_deps = require_manifest_python_deps_DVODn_qc();
+    var require_manifest_system_deps = require_manifest_system_deps_8boi90D9();
     var require_resource_monitor = require_resource_monitor_CdnzxBLP();
     var require_custom_action_registry = require_custom_action_registry_jY0NOZK8();
     var zod = require_zod();
@@ -129235,7 +130129,7 @@ var require_dist3 = __commonJS({
         if (!node_fs.existsSync(entryPath)) throw new Error(`Entry not found: ${entryPath}`);
         const modUnknown = await importAddonModuleFresh(entryPath);
         const mod = isRecord$2(modUnknown) ? modUnknown : {};
-        const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
+        const AddonClass = require_manifest_system_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`No addon class in ${entryPath}`);
         this.addons.set(declaration.id, {
           declaration,
@@ -129251,7 +130145,7 @@ var require_dist3 = __commonJS({
       async loadFromPath(addonId, modulePath, packageName, declaration, packageVersion = "0.0.0") {
         const modUnknown = await importAddonModuleFresh(modulePath);
         const mod = isRecord$2(modUnknown) ? modUnknown : {};
-        const AddonClass = require_manifest_python_deps.resolveAddonClass(mod);
+        const AddonClass = require_manifest_system_deps.resolveAddonClass(mod);
         if (!AddonClass) throw new Error(`Module ${modulePath} has no default export`);
         this.addons.set(addonId, {
           module: mod,
@@ -130154,7 +131048,7 @@ var require_dist3 = __commonJS({
         await node_fs.promises.writeFile(node_path.join(targetDir, "package.json"), JSON.stringify(stripBundledDeps(pkgData), null, 2));
         await copyDirRecursive(distDir, node_path.join(targetDir, "dist"));
         await copyExtraFileDirs(pkgData, sourceDir, targetDir);
-        require_manifest_python_deps.copyBundledNativeModules(sourceDir, targetDir, this.logger);
+        require_manifest_system_deps.copyBundledNativeModules(sourceDir, targetDir, this.logger);
         await node_fs.promises.writeFile(node_path.join(targetDir, ".install-source"), "local");
         const localPkgVersion = require_dist10.asString(pkgData.version, "0.0.0");
         this.manifest.upsert(packageName, {
@@ -130163,7 +131057,7 @@ var require_dist3 = __commonJS({
         });
         const strippedDeps = stripBundledDeps(pkgData);
         if (strippedDeps["dependencies"] && typeof strippedDeps["dependencies"] === "object" && Object.keys(strippedDeps["dependencies"]).length > 0) try {
-          await require_manifest_python_deps.runNpm([
+          await require_manifest_system_deps.runNpm([
             "install",
             "--omit=dev",
             "--ignore-scripts=false"
@@ -130172,7 +131066,7 @@ var require_dist3 = __commonJS({
           this.logger.warn(`${packageName} \u2014 npm install failed (continuing)`, { meta: { error: require_dist10.errMsg(err) } });
         }
         try {
-          await require_manifest_python_deps.installManifestNativeDeps(targetDir, pkgData, this.logger, this.registry, this.npmCacheDir);
+          await require_manifest_system_deps.installManifestNativeDeps(targetDir, pkgData, this.logger, this.registry, this.npmCacheDir);
         } catch (err) {
           this.logger.warn(`${packageName} \u2014 native deps install failed (continuing)`, { meta: { error: require_dist10.errMsg(err) } });
         }
@@ -130208,7 +131102,7 @@ var require_dist3 = __commonJS({
               tmpDir
             ];
             if (this.registry) args.push("--registry", this.registry);
-            const { stdout } = await require_manifest_python_deps.runNpm(args, this.npmRunOptions(tmpDir, 12e4));
+            const { stdout } = await require_manifest_system_deps.runNpm(args, this.npmRunOptions(tmpDir, 12e4));
             const tgzFiles = node_fs.readdirSync(tmpDir).filter((f) => f.endsWith(".tgz"));
             if (tgzFiles.length === 0) throw new Error(`npm pack produced no tgz. stdout: ${stdout.trim()}`);
             return node_path.join(tmpDir, tgzFiles[0]);
@@ -130412,7 +131306,7 @@ var require_dist3 = __commonJS({
           dependencies: depNames
         } });
         try {
-          await require_manifest_python_deps.runNpm([
+          await require_manifest_system_deps.runNpm([
             "install",
             "--omit=dev",
             "--omit=peer",
@@ -130472,7 +131366,7 @@ var require_dist3 = __commonJS({
           return;
         }
         try {
-          await require_manifest_python_deps.installManifestNativeDeps(pkgDir, pkgView.raw, this.logger, this.registry, this.npmCacheDir);
+          await require_manifest_system_deps.installManifestNativeDeps(pkgDir, pkgView.raw, this.logger, this.registry, this.npmCacheDir);
         } catch (nativeErr) {
           this.logger.error(`${packageName} \u2014 native dependency install FAILED; install ABORTED (a swapped-in copy would fail every load at the binding)`, { meta: {
             pkgDir,
@@ -131016,7 +131910,7 @@ var require_dist3 = __commonJS({
         if (!(!node_fs.existsSync(distDir) || this.isDistIncomplete(pkgData, sourceDir))) return;
         this.logger.info(`${packageName} \u2014 building (dist/ missing or incomplete)`);
         try {
-          await require_manifest_python_deps.runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
+          await require_manifest_system_deps.runNpm(["run", "build"], this.npmRunOptions(sourceDir, 18e4));
         } catch (err) {
           const msg = require_dist10.errMsg(err);
           this.logger.warn(`${packageName} auto-build failed`, { meta: { error: msg } });
@@ -205618,7 +206512,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     function createCoreCapService(options) {
       const actions = {};
       for (const { actionName, invoke } of options.actions) actions[actionName] = { handler: async (ctx) => {
-        const raw = require_manifest_python_deps.deserializeTypedArrays(ctx.params);
+        const raw = require_manifest_system_deps.deserializeTypedArrays(ctx.params);
         return invoke(raw !== null && typeof raw === "object" && Object.keys(raw).length === 0 ? void 0 : raw, readOrigin(ctx));
       } };
       return {
@@ -206399,7 +207293,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
       function emitRunnerEvent(category, sourceId, data) {
         if (!capturedBroker) return;
-        require_manifest_python_deps.getBrokerEventBus(capturedBroker).emit(require_dist10.createEvent(category, {
+        require_manifest_system_deps.getBrokerEventBus(capturedBroker).emit(require_dist10.createEvent(category, {
           type: "core",
           id: sourceId,
           nodeId: parentNodeId
@@ -206423,8 +207317,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
           ...applyRunnerNativeAllocator(process.env),
           ...env
         };
-        if (rssBudgetMb === void 0) delete childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV];
-        else childEnv[require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
+        if (rssBudgetMb === void 0) delete childEnv[require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV];
+        else childEnv[require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV] = String(rssBudgetMb);
         const heapFlags = runnerHeapFlags(addons);
         capturedBroker?.logger.info(`[${runnerId}] heap profile: ${heavy ? "heavy" : "light"} flags=[${heapFlags.join(" ")}] arenas=${childEnv["MALLOC_ARENA_MAX"] ?? "glibc-default"} vips=${childEnv["VIPS_CONCURRENCY"] ?? "sharp-default"}`);
         const child = spawnFn(process.execPath, [...heapFlags, runnerPath], {
@@ -207157,12 +208051,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return finalJob;
       }
     };
-    exports.AGENT_CAP_FWD_ACTION = require_manifest_python_deps.AGENT_CAP_FWD_ACTION;
-    exports.AGENT_CAP_FWD_SERVICE = require_manifest_python_deps.AGENT_CAP_FWD_SERVICE;
+    exports.AGENT_CAP_FWD_ACTION = require_manifest_system_deps.AGENT_CAP_FWD_ACTION;
+    exports.AGENT_CAP_FWD_SERVICE = require_manifest_system_deps.AGENT_CAP_FWD_SERVICE;
     exports.AGENT_READINESS_SERVICE_NAME = AGENT_READINESS_SERVICE_NAME;
     exports.ALL_CAPABILITY_DEFINITIONS = require_dist10.ALL_CAPABILITY_DEFINITIONS;
     exports.AddonApiFactory = AddonApiFactory;
-    exports.AddonDepsManager = require_manifest_python_deps.AddonDepsManager;
+    exports.AddonDepsManager = require_manifest_system_deps.AddonDepsManager;
     exports.AddonEngineManager = AddonEngineManager;
     exports.AddonHealthMonitor = AddonHealthMonitor;
     exports.AddonInstaller = AddonInstaller;
@@ -207177,19 +208071,19 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.CLUSTER_SECRET_MISMATCH_TYPE = CLUSTER_SECRET_MISMATCH_TYPE;
     exports.CLUSTER_SECRET_REJECTED_EXIT_CODE = CLUSTER_SECRET_REJECTED_EXIT_CODE;
     exports.CORE_CAP_SERVICE_NAME = CORE_CAP_SERVICE_NAME;
-    exports.CapRouteError = require_manifest_python_deps.CapRouteError;
-    exports.CapRouteResolver = require_manifest_python_deps.CapRouteResolver;
-    exports.CapUsageRegistry = require_manifest_python_deps.CapUsageRegistry;
-    exports.CapabilityHandle = require_manifest_python_deps.CapabilityHandle;
+    exports.CapRouteError = require_manifest_system_deps.CapRouteError;
+    exports.CapRouteResolver = require_manifest_system_deps.CapRouteResolver;
+    exports.CapUsageRegistry = require_manifest_system_deps.CapUsageRegistry;
+    exports.CapabilityHandle = require_manifest_system_deps.CapabilityHandle;
     exports.CapabilityRegistry = CapabilityRegistry;
-    exports.CapabilityUnavailableError = require_manifest_python_deps.CapabilityUnavailableError;
+    exports.CapabilityUnavailableError = require_manifest_system_deps.CapabilityUnavailableError;
     exports.ConfigManager = ConfigManager;
     exports.ConfigStore = require_builtins_sqlite_storage_index.ConfigStore$1;
     exports.ConsoleDestination = require_builtins_console_logging_index.ConsoleDestination$1;
     exports.ConsoleLoggingAddon = require_builtins_console_logging_index.ConsoleLoggingAddon$1;
     exports.CoreBlocksAddon = require_builtins_core_blocks_core_blocks_addon.CoreBlocksAddon;
     exports.CustomActionRegistry = require_custom_action_registry.CustomActionRegistry;
-    exports.DECISIVE_HEAP_SPACES = require_manifest_python_deps.DECISIVE_HEAP_SPACES;
+    exports.DECISIVE_HEAP_SPACES = require_manifest_system_deps.DECISIVE_HEAP_SPACES;
     exports.DEFAULT_DATA_PATH = DEFAULT_DATA_PATH;
     exports.DEFAULT_LAN_HTTP_PORT = require_tls$1.DEFAULT_LAN_HTTP_PORT;
     exports.DEFAULT_LOG_LEVEL = DEFAULT_LOG_LEVEL;
@@ -207197,33 +208091,33 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.DEVICE_STATUS_METHOD = require_dist10.DEVICE_STATUS_METHOD;
     exports.DataPlaneRegistry = DataPlaneRegistry;
     exports.DeviceManagerAddon = require_builtins_device_manager_device_manager_addon.DeviceManagerAddon;
-    exports.DeviceRegistry = require_manifest_python_deps.DeviceRegistry;
+    exports.DeviceRegistry = require_manifest_system_deps.DeviceRegistry;
     exports.DeviceStore = require_builtins_sqlite_storage_index.DeviceStore$1;
-    exports.EMPTY_SOCKET_DIRECTION = require_manifest_python_deps.EMPTY_SOCKET_DIRECTION;
-    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_python_deps.EMPTY_SOCKET_PLANE_BASELINE;
-    exports.EVENT_PLANE_TOP_N = require_manifest_python_deps.EVENT_PLANE_TOP_N;
-    exports.EVENT_TOPIC_PREFIX = require_manifest_python_deps.EVENT_TOPIC_PREFIX;
+    exports.EMPTY_SOCKET_DIRECTION = require_manifest_system_deps.EMPTY_SOCKET_DIRECTION;
+    exports.EMPTY_SOCKET_PLANE_BASELINE = require_manifest_system_deps.EMPTY_SOCKET_PLANE_BASELINE;
+    exports.EVENT_PLANE_TOP_N = require_manifest_system_deps.EVENT_PLANE_TOP_N;
+    exports.EVENT_TOPIC_PREFIX = require_manifest_system_deps.EVENT_TOPIC_PREFIX;
     exports.EngineManagerResolver = EngineManagerResolver;
     exports.EventBus = EventBus;
     exports.FeatureManager = FeatureManager;
     exports.FilesystemStorageAddon = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageAddon;
     exports.FilesystemStorageProvider = require_builtins_sqlite_storage_filesystem_storage_addon.FilesystemStorageProvider;
-    exports.FrameDecoder = require_manifest_python_deps.FrameDecoder;
+    exports.FrameDecoder = require_manifest_system_deps.FrameDecoder;
     exports.FsStorageBackend = FsStorageBackend;
     exports.HEALTH_MONITOR_GRACE_PERIOD_MS = HEALTH_MONITOR_GRACE_PERIOD_MS;
     exports.HEALTH_MONITOR_RETRY_INTERVALS_MS = HEALTH_MONITOR_RETRY_INTERVALS_MS;
     exports.HEALTH_MONITOR_TICK_MS = HEALTH_MONITOR_TICK_MS;
-    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
-    exports.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS = require_manifest_python_deps.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS;
-    exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_python_deps.HEAP_RECLAIM_TRIGGER_MB;
-    exports.HEAP_SPACE_REPORT_MIN_MB = require_manifest_python_deps.HEAP_SPACE_REPORT_MIN_MB;
-    exports.HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.HEAP_WATCH_INTERVAL_MS;
-    exports.HEAP_WATCH_WARN_RATIO = require_manifest_python_deps.HEAP_WATCH_WARN_RATIO;
-    exports.HUB_CAP_FWD_ACTION = require_manifest_python_deps.HUB_CAP_FWD_ACTION;
-    exports.HUB_CAP_FWD_SERVICE = require_manifest_python_deps.HUB_CAP_FWD_SERVICE;
-    exports.HUB_MAIN_HEAP_WATCH_LABEL = require_manifest_python_deps.HUB_MAIN_HEAP_WATCH_LABEL;
-    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_python_deps.HUB_MAIN_RSS_BUDGET_MB;
-    exports.HUB_RSS_BUDGET_ENV = require_manifest_python_deps.HUB_RSS_BUDGET_ENV;
+    exports.HEAP_RECLAIM_MIN_INTERVAL_MS = require_manifest_system_deps.HEAP_RECLAIM_MIN_INTERVAL_MS;
+    exports.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS = require_manifest_system_deps.HEAP_RECLAIM_STEADY_STATE_INTERVAL_MS;
+    exports.HEAP_RECLAIM_TRIGGER_MB = require_manifest_system_deps.HEAP_RECLAIM_TRIGGER_MB;
+    exports.HEAP_SPACE_REPORT_MIN_MB = require_manifest_system_deps.HEAP_SPACE_REPORT_MIN_MB;
+    exports.HEAP_WATCH_INTERVAL_MS = require_manifest_system_deps.HEAP_WATCH_INTERVAL_MS;
+    exports.HEAP_WATCH_WARN_RATIO = require_manifest_system_deps.HEAP_WATCH_WARN_RATIO;
+    exports.HUB_CAP_FWD_ACTION = require_manifest_system_deps.HUB_CAP_FWD_ACTION;
+    exports.HUB_CAP_FWD_SERVICE = require_manifest_system_deps.HUB_CAP_FWD_SERVICE;
+    exports.HUB_MAIN_HEAP_WATCH_LABEL = require_manifest_system_deps.HUB_MAIN_HEAP_WATCH_LABEL;
+    exports.HUB_MAIN_RSS_BUDGET_MB = require_manifest_system_deps.HUB_MAIN_RSS_BUDGET_MB;
+    exports.HUB_RSS_BUDGET_ENV = require_manifest_system_deps.HUB_RSS_BUDGET_ENV;
     exports.HubForwarderAddon = require_builtins_hub_forwarder_index.HubForwarderAddon$1;
     exports.HubForwarderDestination = require_builtins_hub_forwarder_index.HubForwarderDestination$1;
     exports.HubLogForwarder = HubLogForwarder;
@@ -207236,8 +208130,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.LifecycleStateMachine = LifecycleStateMachine;
     exports.LivenessMonitorAddon = require_builtins_liveness_monitor_liveness_monitor_addon.LivenessMonitorAddon;
     exports.LocalAuthAddon = require_builtins_local_auth_local_auth_addon.LocalAuthAddon;
-    exports.LocalChildClient = require_manifest_python_deps.LocalChildClient;
-    exports.LocalChildRegistry = require_manifest_python_deps.LocalChildRegistry;
+    exports.LocalChildClient = require_manifest_system_deps.LocalChildClient;
+    exports.LocalChildRegistry = require_manifest_system_deps.LocalChildRegistry;
     exports.LogManager = LogManager;
     exports.LogRingBuffer = LogRingBuffer;
     exports.LoggingGate = LoggingGate;
@@ -207246,7 +208140,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.MAX_LEAF_VALIDITY_DAYS = require_tls$1.MAX_LEAF_VALIDITY_DAYS;
     exports.METHOD_ACCESS_MAP = require_dist10.METHOD_ACCESS_MAP;
     exports.ModelDownloadService = require_file_data_plane.ModelDownloadService;
-    exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_python_deps.NATIVE_PROVIDER_SERVICE_INFIX;
+    exports.NATIVE_PROVIDER_SERVICE_INFIX = require_manifest_system_deps.NATIVE_PROVIDER_SERVICE_INFIX;
     exports.NATIVE_SCAN_DEPTH = NATIVE_SCAN_DEPTH;
     exports.NativeMetricsAddon = require_builtins_native_metrics_native_metrics_addon.default;
     exports.NativeMetricsProvider = require_builtins_native_metrics_native_metrics_addon.NativeMetricsProvider;
@@ -207263,21 +208157,21 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.PythonEnvManager = PythonEnvManager;
     exports.QUARANTINE_DIRNAME = QUARANTINE_DIRNAME;
     exports.RESTART_MARKER_FILE = RESTART_MARKER_FILE;
-    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_python_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
-    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_python_deps.RSS_BUDGET_RELEASE_RATIO;
-    exports.RUNNER_HEAP_SNAPSHOT_ENV = require_manifest_python_deps.RUNNER_HEAP_SNAPSHOT_ENV;
-    exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_python_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
-    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_python_deps.RUNNER_RSS_BUDGET_ENV;
+    exports.RSS_BUDGET_REANNOUNCE_MIN_MS = require_manifest_system_deps.RSS_BUDGET_REANNOUNCE_MIN_MS;
+    exports.RSS_BUDGET_RELEASE_RATIO = require_manifest_system_deps.RSS_BUDGET_RELEASE_RATIO;
+    exports.RUNNER_HEAP_SNAPSHOT_ENV = require_manifest_system_deps.RUNNER_HEAP_SNAPSHOT_ENV;
+    exports.RUNNER_HEAP_WATCH_INTERVAL_MS = require_manifest_system_deps.RUNNER_HEAP_WATCH_INTERVAL_MS;
+    exports.RUNNER_RSS_BUDGET_ENV = require_manifest_system_deps.RUNNER_RSS_BUDGET_ENV;
     exports.RUNTIME_DEFAULTS = require_dist10.RUNTIME_DEFAULTS;
     exports.ReadinessRegistry = require_dist10.ReadinessRegistry;
     exports.ReadinessTimeoutError = require_dist10.ReadinessTimeoutError;
     exports.ReplEngine = ReplEngine;
     exports.RingBuffer = RingBuffer;
     exports.SERVER_AUTH_OID = require_tls$1.SERVER_AUTH_OID;
-    exports.SOCKET_PLANE_TOP_N = require_manifest_python_deps.SOCKET_PLANE_TOP_N;
+    exports.SOCKET_PLANE_TOP_N = require_manifest_system_deps.SOCKET_PLANE_TOP_N;
     exports.ScopedLogger = ScopedLogger;
     exports.ScopedTokenManager = require_builtins_local_auth_local_auth_addon.ScopedTokenManager;
-    exports.SocketChannel = require_manifest_python_deps.SocketChannel;
+    exports.SocketChannel = require_manifest_system_deps.SocketChannel;
     exports.SqliteSettingsAddon = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsAddon;
     exports.SqliteSettingsBackend = require_builtins_sqlite_storage_sqlite_settings_addon.SqliteSettingsBackend;
     exports.StagingArea = StagingArea;
@@ -207289,23 +208183,23 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.SystemEventBus = SystemEventBus;
     exports.TRADITIONAL_NATIVE_PACKAGES = TRADITIONAL_NATIVE_PACKAGES;
     exports.ToastService = ToastService;
-    exports.UDS_NO_ROUTE_PREFIX = require_manifest_python_deps.UDS_NO_ROUTE_PREFIX;
-    exports.UdsLocalTransportClient = require_manifest_python_deps.UdsLocalTransportClient;
-    exports.UdsLocalTransportServer = require_manifest_python_deps.UdsLocalTransportServer;
+    exports.UDS_NO_ROUTE_PREFIX = require_manifest_system_deps.UDS_NO_ROUTE_PREFIX;
+    exports.UdsLocalTransportClient = require_manifest_system_deps.UdsLocalTransportClient;
+    exports.UdsLocalTransportServer = require_manifest_system_deps.UdsLocalTransportServer;
     exports.UserManager = require_builtins_local_auth_local_auth_addon.UserManager;
     exports.WinstonDestination = require_builtins_winston_logging_index.WinstonDestination$1;
     exports.WinstonLoggingAddon = require_builtins_winston_logging_index.WinstonLoggingAddon$1;
-    exports.ZERO_LOOP_DELAY = require_manifest_python_deps.ZERO_LOOP_DELAY;
-    exports.__resetCapUsageRegistryForTests = require_manifest_python_deps.__resetCapUsageRegistryForTests;
+    exports.ZERO_LOOP_DELAY = require_manifest_system_deps.ZERO_LOOP_DELAY;
+    exports.__resetCapUsageRegistryForTests = require_manifest_system_deps.__resetCapUsageRegistryForTests;
     exports.__resetLoggingGateForTests = __resetLoggingGateForTests;
-    exports.adaptBrokerToCluster = require_manifest_python_deps.adaptBrokerToCluster;
+    exports.adaptBrokerToCluster = require_manifest_system_deps.adaptBrokerToCluster;
     exports.addonSettingsCapability = require_dist10.addonSettingsCapability;
     exports.allFamiliesListenHost = require_tls$1.allFamiliesListenHost;
     exports.applyLanHttp = require_tls$1.applyLanHttp;
     exports.bindPendingLanHttp = require_tls$1.bindPendingLanHttp;
     exports.bootstrapSchema = bootstrapSchema;
-    exports.brokerCallForCap = require_manifest_python_deps.brokerCallForCap;
-    exports.brokerTransportLink = require_manifest_python_deps.brokerTransportLink;
+    exports.brokerCallForCap = require_manifest_system_deps.brokerCallForCap;
+    exports.brokerTransportLink = require_manifest_system_deps.brokerTransportLink;
     Object.defineProperty(exports, "buildBinaryPath", {
       enumerable: true,
       get: function() {
@@ -207313,70 +208207,70 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
       }
     });
     exports.buildCapRouters = buildCapRouters;
-    exports.buildHeapSample = require_manifest_python_deps.buildHeapSample;
-    exports.buildLinkChain = require_manifest_python_deps.buildLinkChain;
-    exports.buildNativeCapProxy = require_manifest_python_deps.buildNativeCapProxy;
+    exports.buildHeapSample = require_manifest_system_deps.buildHeapSample;
+    exports.buildLinkChain = require_manifest_system_deps.buildLinkChain;
+    exports.buildNativeCapProxy = require_manifest_system_deps.buildNativeCapProxy;
     exports.buildNodeManifest = buildNodeManifest;
     exports.buildStorageLocationRegistry = require_builtins_storage_orchestrator_storage_orchestrator_addon.buildStorageLocationRegistry;
-    exports.buildUdsNativeCapProxy = require_manifest_python_deps.buildUdsNativeCapProxy;
+    exports.buildUdsNativeCapProxy = require_manifest_system_deps.buildUdsNativeCapProxy;
     exports.builderMountedCapNames = builderMountedCapNames;
     exports.callRegisterNodeWithRetry = callRegisterNodeWithRetry;
-    exports.callWithServiceDiscovery = require_manifest_python_deps.callWithServiceDiscovery;
+    exports.callWithServiceDiscovery = require_manifest_system_deps.callWithServiceDiscovery;
     exports.canServeDataPlane = canServeDataPlane;
-    exports.capActionName = require_manifest_python_deps.capActionName;
-    exports.capActionSuffix = require_manifest_python_deps.capActionSuffix;
-    exports.capBareAction = require_manifest_python_deps.capBareAction;
-    exports.capServiceName = require_manifest_python_deps.capServiceName;
+    exports.capActionName = require_manifest_system_deps.capActionName;
+    exports.capActionSuffix = require_manifest_system_deps.capActionSuffix;
+    exports.capBareAction = require_manifest_system_deps.capBareAction;
+    exports.capServiceName = require_manifest_system_deps.capServiceName;
     exports.classifyAddonDir = classifyAddonDir;
-    exports.classifyCapRoute = require_manifest_python_deps.classifyCapRoute;
+    exports.classifyCapRoute = require_manifest_system_deps.classifyCapRoute;
     exports.clearPendingRestart = clearPendingRestart;
     exports.closeLanHttp = require_tls$1.closeLanHttp;
-    exports.clusterEventTopic = require_manifest_python_deps.clusterEventTopic;
+    exports.clusterEventTopic = require_manifest_system_deps.clusterEventTopic;
     exports.clusterSecretMatches = clusterSecretMatches;
     exports.collectCertIdentity = require_tls$1.collectCertIdentity;
     exports.collectModelFiles = require_file_data_plane.collectModelFiles;
     exports.contentTypeFor = require_file_data_plane.contentTypeFor;
     exports.copyDirRecursive = copyDirRecursive;
     exports.copyExtraFileDirs = copyExtraFileDirs;
-    exports.createAddonContext = require_manifest_python_deps.createAddonContext;
-    exports.createAddonDataPlaneFacility = require_manifest_python_deps.createAddonDataPlaneFacility;
-    exports.createAddonService = require_manifest_python_deps.createAddonService;
+    exports.createAddonContext = require_manifest_system_deps.createAddonContext;
+    exports.createAddonDataPlaneFacility = require_manifest_system_deps.createAddonDataPlaneFacility;
+    exports.createAddonService = require_manifest_system_deps.createAddonService;
     exports.createAuthenticatedFileServer = require_file_data_plane.createAuthenticatedFileServer;
     exports.createBroker = createBroker2;
-    exports.createBrokerDeviceManagerApi = require_manifest_python_deps.createBrokerDeviceManagerApi;
+    exports.createBrokerDeviceManagerApi = require_manifest_system_deps.createBrokerDeviceManagerApi;
     exports.createCoreCapService = createCoreCapService;
-    exports.createDeferredHeapWatchSink = require_manifest_python_deps.createDeferredHeapWatchSink;
+    exports.createDeferredHeapWatchSink = require_manifest_system_deps.createDeferredHeapWatchSink;
     exports.createDoorSettingsView = createDoorSettingsView;
-    exports.createEventPlaneMeter = require_manifest_python_deps.createEventPlaneMeter;
-    exports.createEventPlaneReader = require_manifest_python_deps.createEventPlaneReader;
+    exports.createEventPlaneMeter = require_manifest_system_deps.createEventPlaneMeter;
+    exports.createEventPlaneReader = require_manifest_system_deps.createEventPlaneReader;
     exports.createFileDataPlaneHandler = require_file_data_plane.createFileDataPlaneHandler;
-    exports.createHubCapForwardService = require_manifest_python_deps.createHubCapForwardService;
+    exports.createHubCapForwardService = require_manifest_system_deps.createHubCapForwardService;
     exports.createHubService = createHubService;
-    exports.createKernelHwAccel = require_manifest_python_deps.createKernelHwAccel;
-    exports.createLocalTransport = require_manifest_python_deps.createLocalTransport;
-    exports.createLoopDelayMeter = require_manifest_python_deps.createLoopDelayMeter;
-    exports.createParentUnownedCallHandler = require_manifest_python_deps.createParentUnownedCallHandler;
+    exports.createKernelHwAccel = require_manifest_system_deps.createKernelHwAccel;
+    exports.createLocalTransport = require_manifest_system_deps.createLocalTransport;
+    exports.createLoopDelayMeter = require_manifest_system_deps.createLoopDelayMeter;
+    exports.createParentUnownedCallHandler = require_manifest_system_deps.createParentUnownedCallHandler;
     exports.createProcessService = createProcessService;
     exports.createReadinessService = createReadinessService;
     exports.createReadinessServiceForRegistry = createReadinessServiceForRegistry;
     exports.createScopedProcessManager = createScopedProcessManager;
-    exports.createSocketDirectionCounters = require_manifest_python_deps.createSocketDirectionCounters;
-    exports.createSocketPlaneMeter = require_manifest_python_deps.createSocketPlaneMeter;
-    exports.createSocketPlaneReader = require_manifest_python_deps.createSocketPlaneReader;
+    exports.createSocketDirectionCounters = require_manifest_system_deps.createSocketDirectionCounters;
+    exports.createSocketPlaneMeter = require_manifest_system_deps.createSocketPlaneMeter;
+    exports.createSocketPlaneReader = require_manifest_system_deps.createSocketPlaneReader;
     exports.createStreamProbeBrokerService = createStreamProbeBrokerService;
-    exports.createUdsAddonContext = require_manifest_python_deps.createUdsAddonContext;
-    exports.createUdsEventBridge = require_manifest_python_deps.createUdsEventBridge;
-    exports.createUdsEventBus = require_manifest_python_deps.createUdsEventBus;
-    exports.createUdsLogger = require_manifest_python_deps.createUdsLogger;
-    exports.createUdsLoggerWithControl = require_manifest_python_deps.createUdsLoggerWithControl;
-    exports.createV8Reclaimer = require_manifest_python_deps.createV8Reclaimer;
+    exports.createUdsAddonContext = require_manifest_system_deps.createUdsAddonContext;
+    exports.createUdsEventBridge = require_manifest_system_deps.createUdsEventBridge;
+    exports.createUdsEventBus = require_manifest_system_deps.createUdsEventBus;
+    exports.createUdsLogger = require_manifest_system_deps.createUdsLogger;
+    exports.createUdsLoggerWithControl = require_manifest_system_deps.createUdsLoggerWithControl;
+    exports.createV8Reclaimer = require_manifest_system_deps.createV8Reclaimer;
     exports.deleteModelFromDisk = require_file_data_plane.deleteModelFromDisk;
     exports.deriveAgentListenPort = deriveAgentListenPort;
     exports.describeProviderKindDrift = describeProviderKindDrift;
-    exports.describeRss = require_manifest_python_deps.describeRss;
+    exports.describeRss = require_manifest_system_deps.describeRss;
     exports.detectWorkspacePackagesDir = detectWorkspacePackagesDir;
-    exports.diffEventPlane = require_manifest_python_deps.diffEventPlane;
-    exports.diffSocketPlane = require_manifest_python_deps.diffSocketPlane;
+    exports.diffEventPlane = require_manifest_system_deps.diffEventPlane;
+    exports.diffSocketPlane = require_manifest_system_deps.diffSocketPlane;
     Object.defineProperty(exports, "downloadBinary", {
       enumerable: true,
       get: function() {
@@ -207386,8 +208280,8 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.downloadFile = require_file_data_plane.downloadFile;
     exports.downloadModel = require_file_data_plane.downloadModel;
     exports.emitDownForOwnedCaps = require_dist10.emitDownForOwnedCaps;
-    exports.emitHeapDiagnosticReport = require_manifest_python_deps.emitHeapDiagnosticReport;
-    exports.encodeFrame = require_manifest_python_deps.encodeFrame;
+    exports.emitHeapDiagnosticReport = require_manifest_system_deps.emitHeapDiagnosticReport;
+    exports.encodeFrame = require_manifest_system_deps.encodeFrame;
     exports.ensureAddonNativePrebuilds = ensureAddonNativePrebuilds;
     Object.defineProperty(exports, "ensureBinary", {
       enumerable: true,
@@ -207421,12 +208315,12 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.findInPath;
       }
     });
-    exports.formatEventPlane = require_manifest_python_deps.formatEventPlane;
-    exports.formatHeapSpaces = require_manifest_python_deps.formatHeapSpaces;
+    exports.formatEventPlane = require_manifest_system_deps.formatEventPlane;
+    exports.formatHeapSpaces = require_manifest_system_deps.formatHeapSpaces;
     exports.formatLogLine = require_formatter.formatLogLine;
-    exports.formatSocketPlane = require_manifest_python_deps.formatSocketPlane;
-    exports.getBrokerEventBus = require_manifest_python_deps.getBrokerEventBus;
-    exports.getCapUsageRegistry = require_manifest_python_deps.getCapUsageRegistry;
+    exports.formatSocketPlane = require_manifest_system_deps.formatSocketPlane;
+    exports.getBrokerEventBus = require_manifest_system_deps.getBrokerEventBus;
+    exports.getCapUsageRegistry = require_manifest_system_deps.getCapUsageRegistry;
     Object.defineProperty(exports, "getFfmpegDownloadUrl", {
       enumerable: true,
       get: function() {
@@ -207435,9 +208329,9 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     });
     exports.getLoggingGate = getLoggingGate;
     exports.getModelFilePath = require_file_data_plane.getModelFilePath;
-    exports.getMoleculerEventStats = require_manifest_python_deps.getMoleculerEventStats;
-    exports.getOrInitReadinessRegistry = require_manifest_python_deps.getOrInitReadinessRegistry;
-    exports.getOrInitReadinessRegistryForClient = require_manifest_python_deps.getOrInitReadinessRegistryForClient;
+    exports.getMoleculerEventStats = require_manifest_system_deps.getMoleculerEventStats;
+    exports.getOrInitReadinessRegistry = require_manifest_system_deps.getOrInitReadinessRegistry;
+    exports.getOrInitReadinessRegistryForClient = require_manifest_system_deps.getOrInitReadinessRegistryForClient;
     exports.getPidStats = require_resource_monitor.getPidStats;
     Object.defineProperty(exports, "getPlatformInfo", {
       enumerable: true,
@@ -207453,14 +208347,15 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     });
     exports.getRestartMarkerPath = getRestartMarkerPath;
     exports.getSinglePidStats = require_resource_monitor.getSinglePidStats;
-    exports.getWorkerDeviceRegistry = require_manifest_python_deps.getWorkerDeviceRegistry;
+    exports.getWorkerDeviceRegistry = require_manifest_system_deps.getWorkerDeviceRegistry;
     exports.hasDotNode = hasDotNode;
     exports.hashClusterSecret = hashClusterSecret;
-    exports.heapSnapshotAuthorised = require_manifest_python_deps.heapSnapshotAuthorised;
-    exports.heapSpaceField = require_manifest_python_deps.heapSpaceField;
-    exports.hubMainRssBudget = require_manifest_python_deps.hubMainRssBudget;
-    exports.installManifestNativeDeps = require_manifest_python_deps.installManifestNativeDeps;
-    exports.installManifestPythonDeps = require_manifest_python_deps.installManifestPythonDeps;
+    exports.heapSnapshotAuthorised = require_manifest_system_deps.heapSnapshotAuthorised;
+    exports.heapSpaceField = require_manifest_system_deps.heapSpaceField;
+    exports.hubMainRssBudget = require_manifest_system_deps.hubMainRssBudget;
+    exports.installManifestNativeDeps = require_manifest_system_deps.installManifestNativeDeps;
+    exports.installManifestPythonDeps = require_manifest_system_deps.installManifestPythonDeps;
+    exports.installManifestSystemDeps = require_manifest_system_deps.installManifestSystemDeps;
     exports.installPackageFromNpm = installPackageFromNpm;
     Object.defineProperty(exports, "installPythonPackages", {
       enumerable: true,
@@ -207474,7 +208369,7 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
         return _camstack_types_node.installPythonRequirements;
       }
     });
-    exports.ipcParentLink = require_manifest_python_deps.ipcParentLink;
+    exports.ipcParentLink = require_manifest_system_deps.ipcParentLink;
     exports.isAddonDeploySource = isAddonDeploySource;
     exports.isArrayOutputSchema = require_dist10.isArrayOutputSchema;
     exports.isClusterSecretMismatchError = isClusterSecretMismatchError;
@@ -207484,55 +208379,55 @@ globstar while`, t, d, e, f, m), this.matchOne(t.slice(d), e.slice(f), s)) retur
     exports.isSourceNewer = isSourceNewer;
     exports.isolatedBuiltinPhase = isolatedBuiltinPhase;
     exports.loadTlsCert = require_tls$1.loadTlsCert;
-    exports.localEndpointPath = require_manifest_python_deps.localEndpointPath;
-    exports.localProviderLink = require_manifest_python_deps.localProviderLink;
-    exports.mountNativeCapService = require_manifest_python_deps.mountNativeCapService;
-    exports.nextRssBudgetState = require_manifest_python_deps.nextRssBudgetState;
-    exports.parseCapAction = require_manifest_python_deps.parseCapAction;
+    exports.localEndpointPath = require_manifest_system_deps.localEndpointPath;
+    exports.localProviderLink = require_manifest_system_deps.localProviderLink;
+    exports.mountNativeCapService = require_manifest_system_deps.mountNativeCapService;
+    exports.nextRssBudgetState = require_manifest_system_deps.nextRssBudgetState;
+    exports.parseCapAction = require_manifest_system_deps.parseCapAction;
     exports.parseRangeHeader = require_file_data_plane.parseRangeHeader;
-    exports.parseRssBudgetMb = require_manifest_python_deps.parseRssBudgetMb;
+    exports.parseRssBudgetMb = require_manifest_system_deps.parseRssBudgetMb;
     exports.parseTokenizedUrl = require_file_data_plane.parseTokenizedUrl;
     exports.partitionIsolatedBuiltinIds = partitionIsolatedBuiltinIds;
     exports.proxyToUpstream = proxyToUpstream;
     exports.quarantineAddonResidue = quarantineAddonResidue;
     exports.readExtraSans = require_tls$1.readExtraSans;
-    exports.readHeapSpaces = require_manifest_python_deps.readHeapSpaces;
+    exports.readHeapSpaces = require_manifest_system_deps.readHeapSpaces;
     exports.readLanHttpState = require_tls$1.readLanHttpState;
-    exports.readMoleculerFanoutMode = require_manifest_python_deps.readMoleculerFanoutMode;
+    exports.readMoleculerFanoutMode = require_manifest_system_deps.readMoleculerFanoutMode;
     exports.readPendingRestart = readPendingRestart;
     exports.readTlsAccessStatus = require_tls$1.readTlsAccessStatus;
     exports.readTlsMode = require_tls$1.readTlsMode;
     exports.readinessKey = require_dist10.readinessKey;
-    exports.reclaimIntervalMs = require_manifest_python_deps.reclaimIntervalMs;
-    exports.recordSocketFrame = require_manifest_python_deps.recordSocketFrame;
-    exports.registerEventBusService = require_manifest_python_deps.registerEventBusService;
+    exports.reclaimIntervalMs = require_manifest_system_deps.reclaimIntervalMs;
+    exports.recordSocketFrame = require_manifest_system_deps.recordSocketFrame;
+    exports.registerEventBusService = require_manifest_system_deps.registerEventBusService;
     exports.registerLanHttpHandler = require_tls$1.registerLanHttpHandler;
     exports.reissueTlsLeaf = require_tls$1.reissueTlsLeaf;
     exports.resolveFilePath = require_file_data_plane.resolveFilePath;
-    exports.resolveHwAccel = require_manifest_python_deps.resolveHwAccel;
-    exports.resolveNpmInvocation = require_manifest_python_deps.resolveNpmInvocation;
+    exports.resolveHwAccel = require_manifest_system_deps.resolveHwAccel;
+    exports.resolveNpmInvocation = require_manifest_system_deps.resolveNpmInvocation;
     exports.runHubAddonBoot = runHubAddonBoot;
-    exports.runNpm = require_manifest_python_deps.runNpm;
-    exports.sampleSocketDirection = require_manifest_python_deps.sampleSocketDirection;
+    exports.runNpm = require_manifest_system_deps.runNpm;
+    exports.sampleSocketDirection = require_manifest_system_deps.sampleSocketDirection;
     exports.scheduleSelfRestart = scheduleSelfRestart;
     exports.scopeKey = require_dist10.scopeKey;
     exports.scopesAllowAddon = require_dist10.scopesAllowAddon;
     exports.scopesAllowDeviceCap = require_dist10.scopesAllowDeviceCap;
     exports.selectAddonResidue = selectAddonResidue;
-    exports.selectReportedSpaces = require_manifest_python_deps.selectReportedSpaces;
-    exports.serializeTypedArrays = require_manifest_python_deps.serializeTypedArrays;
-    exports.setHubConnected = require_manifest_python_deps.setHubConnected;
-    exports.setNodeEventInterest = require_manifest_python_deps.setNodeEventInterest;
-    exports.shouldReclaim = require_manifest_python_deps.shouldReclaim;
-    exports.socketDirectionBytes = require_manifest_python_deps.socketDirectionBytes;
-    exports.socketDirectionMessages = require_manifest_python_deps.socketDirectionMessages;
-    exports.startHeapWatch = require_manifest_python_deps.startHeapWatch;
-    exports.startRunnerHeapWatch = require_manifest_python_deps.startRunnerHeapWatch;
-    exports.strandedMb = require_manifest_python_deps.strandedMb;
+    exports.selectReportedSpaces = require_manifest_system_deps.selectReportedSpaces;
+    exports.serializeTypedArrays = require_manifest_system_deps.serializeTypedArrays;
+    exports.setHubConnected = require_manifest_system_deps.setHubConnected;
+    exports.setNodeEventInterest = require_manifest_system_deps.setNodeEventInterest;
+    exports.shouldReclaim = require_manifest_system_deps.shouldReclaim;
+    exports.socketDirectionBytes = require_manifest_system_deps.socketDirectionBytes;
+    exports.socketDirectionMessages = require_manifest_system_deps.socketDirectionMessages;
+    exports.startHeapWatch = require_manifest_system_deps.startHeapWatch;
+    exports.startRunnerHeapWatch = require_manifest_system_deps.startRunnerHeapWatch;
+    exports.strandedMb = require_manifest_system_deps.strandedMb;
     exports.stripCamstackDeps = stripCamstackDeps;
-    exports.subscribePassthrough = require_manifest_python_deps.subscribePassthrough;
-    exports.udsChildLogToWorkerEntry = require_manifest_python_deps.udsChildLogToWorkerEntry;
-    exports.validateProviderRegistrations = require_manifest_python_deps.validateProviderRegistrations;
+    exports.subscribePassthrough = require_manifest_system_deps.subscribePassthrough;
+    exports.udsChildLogToWorkerEntry = require_manifest_system_deps.udsChildLogToWorkerEntry;
+    exports.validateProviderRegistrations = require_manifest_system_deps.validateProviderRegistrations;
     exports.validateUploadedTls = require_tls$1.validateUploadedTls;
     exports.waitUntilReady = waitUntilReady;
     exports.writeExtraSans = require_tls$1.writeExtraSans;
@@ -207567,7 +208462,7 @@ var require_dist4 = __commonJS({
     "use strict";
     Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
     var require_event_category = require_event_category_BaEgqJNv();
-    var require_sleep = require_sleep_CJrvRDlD();
+    var require_sleep = require_sleep_CWWLTM6W();
     var require_canonical_hash = require_canonical_hash_DNV8S5ET();
     var require_enums2 = require_enums();
     var require_err_msg = require_err_msg_COpsHMw2();
@@ -208277,6 +209172,48 @@ var require_dist4 = __commonJS({
         unreadable
       };
     }
+    var REDACTED_SECRET = "__camstack_redacted__";
+    function isSecretConfigField(field) {
+      if (field.type === "password") return true;
+      return "secret" in field && field.secret === true;
+    }
+    function collectSecretConfigKeys(schema) {
+      const keys = /* @__PURE__ */ new Set();
+      for (const section of sectionsOf(schema)) for (const field of fieldsOf(section)) walkField(field, keys);
+      return keys;
+    }
+    function schemaDeclaresAnyField(schema) {
+      for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
+      return false;
+    }
+    function isRecord$2(value) {
+      return typeof value === "object" && value !== null && !Array.isArray(value);
+    }
+    function sectionsOf(schema) {
+      if (!isRecord$2(schema)) return [];
+      const sections = schema["sections"];
+      return Array.isArray(sections) ? sections : [];
+    }
+    function fieldsOf(node) {
+      if (!isRecord$2(node)) return [];
+      const fields = node["fields"];
+      return Array.isArray(fields) ? fields : [];
+    }
+    function walkField(field, out) {
+      if (!isRecord$2(field)) return;
+      const type = field["type"];
+      const key = field["key"];
+      if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
+      if (type === "group") {
+        for (const child of fieldsOf(field)) walkField(child, out);
+        return;
+      }
+      if (type === "sub-tabs") {
+        const tabs = field["tabs"];
+        if (!Array.isArray(tabs)) return;
+        for (const tab of tabs) for (const child of fieldsOf(tab)) walkField(child, out);
+      }
+    }
     var STREAM_QUALITY_LABELS = {
       high: "High",
       mid: "Mid",
@@ -208945,13 +209882,29 @@ var require_dist4 = __commonJS({
       "recorder",
       "analytics"
     ]);
+    var StorageMigrationMoveProgressSchema = zod.z.object({
+      filesMoved: zod.z.number().int().nonnegative(),
+      /** The archive census — the **M** of "N of M" (D295). `null` = unknowable. */
+      filesTotal: zod.z.number().int().nonnegative().nullable(),
+      bytesMoved: zod.z.number().int().nonnegative(),
+      /** The MOVER's start, not the migration's: a drain restarted after an addon
+      *  crash gets a new mover, and a rate computed from the migration's start
+      *  would silently average in the time nothing was running. */
+      startedAt: zod.z.number(),
+      /** When the coordinator last read these numbers. Paired with `startedAt` it
+      *  is the only honest rate: both clocks are the hub's, so a UI never has to
+      *  subtract its own. */
+      observedAt: zod.z.number()
+    });
     var StorageMigrationMoveSchema = zod.z.object({
       storageClass: StorageMigrationClassSchema,
       fromLocationId: zod.z.string(),
       toLocationId: zod.z.string(),
       moverJobId: zod.z.string().nullable(),
       state: RelocateJobStateSchema.nullable(),
-      error: zod.z.string().nullable()
+      error: zod.z.string().nullable(),
+      /** Last observed mover counters; `null` until the mover has been polled once. */
+      progress: StorageMigrationMoveProgressSchema.nullable()
     });
     var StorageMigrationJobSchema = zod.z.object({
       jobId: zod.z.string(),
@@ -208997,6 +209950,52 @@ var require_dist4 = __commonJS({
       })),
       findings: zod.z.array(StorageMigrationFindingSchema)
     });
+    var StorageMigrationLaneSchema = zod.z.enum(["footage", "media"]);
+    var StorageMigrationMoverSchema = zod.z.object({
+      lane: StorageMigrationLaneSchema,
+      job: RelocateJobSchema,
+      /** The coordinator job that armed this mover, or `null` for a mover armed
+      *  directly against the owning addon. */
+      migrationJobId: zod.z.string().nullable(),
+      /** When the hub read these counters. Stamped here so a rate is `bytesMoved`
+      *  over (`observedAt` − `job.startedAt`) with BOTH ends on the hub's clock —
+      *  a browser subtracting its own `Date.now()` from a server `startedAt` is a
+      *  rate made of two different clocks. */
+      observedAt: zod.z.number()
+    });
+    var StorageMigrationResidueSchema = zod.z.object({
+      storageClass: StorageMigrationClassSchema,
+      /** The location still holding the data. `'*'` for the media lane, whose rows
+      *  move from wherever they are rather than from one named source. */
+      fromLocationId: zod.z.string(),
+      /** Where a drain would move it — the class's CURRENT default. */
+      toLocationId: zod.z.string(),
+      /** Segments (footage lane) or rows (media lane) still on the source. */
+      items: zod.z.number().int().nonnegative().nullable(),
+      /** Bytes on the source; `null` when the lane counts rows rather than bytes. */
+      bytes: zod.z.number().int().nonnegative().nullable()
+    });
+    var StorageMigrationDrainInputSchema = zod.z.object({
+      /** The classes to drain. Each must appear in `storageMigration.residue`, so
+      *  a class whose source is already empty is refused rather than started. */
+      classes: zod.z.array(StorageMigrationClassSchema).min(1),
+      throttleMbps: zod.z.number().min(1).max(1e3).optional()
+    });
+    var RelocateResidueInputSchema = zod.z.object({
+      fromLocationId: zod.z.string().min(1),
+      /** Narrow to one logical class; omit for every profile on the location. */
+      footageClass: RelocateFootageClassSchema.optional()
+    });
+    var RelocateResidueSchema = zod.z.object({
+      segments: zod.z.number().int().nonnegative(),
+      bytes: zod.z.number().int().nonnegative()
+    }).nullable();
+    var RelocatableMediaCountSchema = zod.z.object({ rows: zod.z.number().int().nonnegative() }).nullable();
+    var RelocatableMediaCountInputSchema = zod.z.object({
+      toLocationId: zod.z.string().min(1),
+      /** Omitted = `move`. */
+      mode: MediaRelocateModeSchema.optional()
+    });
     var SUB_DETECTION_TYPES = ["face", "plate"];
     var RECOGNITION_TYPES = [
       "face",
@@ -209047,6 +210046,8 @@ var require_dist4 = __commonJS({
       updatedAt: zod.z.number()
     });
     var StorageLocationRefSchema = zod.z.union([StorageLocationTypeSchema, zod.z.string().regex(/^[a-z][a-zA-Z0-9-]*:[a-zA-Z0-9-]+$/)]);
+    var StorageAccessSchema = zod.z.enum(["local-path", "cap-mediated"]);
+    var STORAGE_ACCESS_FALLBACK = "local-path";
     var StorageLocationDeclarationSchema = zod.z.object({
       /**
       * Global location identifier, e.g. `recordings` or `recordingsLow`.
@@ -209066,6 +210067,19 @@ var require_dist4 = __commonJS({
       */
       cardinality: zod.z.enum(["single", "multi"]),
       /**
+      * HOW the declaring service reaches the bytes — and therefore WHICH
+      * providers may back a location of this kind. See {@link StorageAccessSchema}
+      * and {@link STORAGE_ACCESS_FALLBACK}.
+      *
+      * Absent means `'local-path'`. That default is FAIL-CLOSED on purpose: it
+      * can only over-restrict (refuse a remote provider for a kind that might
+      * have coped) and never under-restrict. Declaring `'cap-mediated'` is the
+      * permissive direction and is therefore never inferred — a repo guard
+      * (`scripts/check-storage-access-declarations.ts`) refuses to let it be
+      * reached by omission.
+      */
+      access: StorageAccessSchema.optional(),
+      /**
       * When set, the default instance for this location inherits its resolved
       * root from the named location's default instance. Useful for derivative
       * slots (e.g. `recordingsLow` → `recordings`) so operators only need to
@@ -220998,8 +222012,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       lastSeen: zod.z.number(),
       /** Frame-rate position history (subject to maxPositionHistory cap). */
       positions: zod.z.array(TrackPositionSchema).readonly(),
-      /** Periodic snapshots at snapshotIntervalMs cadence (subject to
-      *  saveThumbnails policy). */
+      /** Periodic snapshots at snapshotIntervalMs cadence — DEBUG media, produced
+      *  only while `MediaSettings.debugMediaEnabled` is on for the camera (D299;
+      *  the retired `saveThumbnails` used to gate this and the rolling
+      *  `lastFrame` together). Empty is the healthy default, not a capture gap. */
       snapshots: zod.z.array(TrackSnapshotSchema).readonly(),
       /** Deduplicated zones the track has entered at least once. Zone IDS. */
       zonesVisited: zod.z.array(zod.z.string()).readonly(),
@@ -221982,6 +222998,21 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         * it to zero.
         */
         countUnstampedEventMedia: require_sleep.method(zod.z.object({}), UnstampedEventMediaCountSchema, { auth: "admin" }),
+        /**
+        * How many rows a pass would STILL act on against `toLocationId`.
+        *
+        * One derivation, two consumers: it is the media lane's denominator (the
+        * **M** the footage lane gets from the ledger census — D295) and it is the
+        * residue behind "drain remaining". Deriving them separately is how "N of M"
+        * ends up comparing two different populations.
+        *
+        * `null` means the count could not be taken; it is never zero-filled,
+        * because a zero here reads as "nothing left to move".
+        */
+        countRelocatableMedia: require_sleep.method(RelocatableMediaCountInputSchema, RelocatableMediaCountSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Every relocate job this addon knows about, newest first (in RAM: the
         *  move is resumable, so a lost list costs nothing but the display). */
         listRelocateMediaJobs: require_sleep.method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
@@ -224686,6 +225717,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         cancel: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
           auth: "admin"
+        }),
+        /**
+        * Every mover running RIGHT NOW, in both lanes, with its counters.
+        *
+        * `status` covers a migration's own moves — the coordinator folds their
+        * progress onto the durable job record it is already polling. This covers
+        * the other case, and it is not hypothetical: a drain armed straight against
+        * `recording.relocateFootage` (the only path that existed before
+        * {@link drain}) has no job to fold into and would otherwise be invisible.
+        */
+        movers: require_sleep.method(zod.z.object({}), zod.z.array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }),
+        /**
+        * What each class's SOURCE still holds, from the archive — never from the
+        * resident index (D295). Only classes with something left (or something
+        * unknown) are listed, so an empty list means there is nothing to drain and
+        * the UI has no honest button to offer.
+        */
+        residue: require_sleep.method(zod.z.object({}), zod.z.array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }),
+        /**
+        * Run the drain half alone, on a class whose default has ALREADY moved.
+        *
+        * It never repoints anything, which is what lets `start` keep refusing a
+        * destination that is already the default: the two verbs cannot be confused
+        * for one another, and no operator can re-repoint a migrated class through
+        * this door.
+        */
+        drain: require_sleep.method(StorageMigrationDrainInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+          kind: "mutation",
+          auth: "admin"
         })
       }
     };
@@ -225195,7 +226255,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       */
       scanned: zod.z.number(),
       /** True when the backend could not consider every row that passed the filter. */
-      truncated: zod.z.boolean()
+      truncated: zod.z.boolean(),
+      /**
+      * The `topK` the backend actually ran with.
+      *
+      * Every backend has a ceiling — sqlite-vec's is 4,096 — and a caller asking
+      * past it used to learn nothing but a boolean, from a WARN in the provider's
+      * own log rather than in its answer. That is how an audit asking for 20,000
+      * consumed 4,096 and reported `examined: 4096` as if it had walked the index,
+      * for weeks. `truncated` says THAT the answer was short; this says BY HOW
+      * MUCH, in the return value, where the caller cannot fail to see it.
+      *
+      * Equals the requested `topK` whenever nothing was lowered.
+      */
+      effectiveTopK: zod.z.number().int().positive()
     });
     var VectorDeleteInputSchema = zod.z.object({
       index: zod.z.string(),
@@ -225214,6 +226287,35 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
       id: zod.z.string(),
       metadata: VectorMetadataSchema
     })) });
+    var VectorFetchInputSchema = zod.z.object({
+      index: zod.z.string(),
+      ids: zod.z.array(zod.z.string())
+    });
+    var VectorFetchResultSchema = zod.z.object({ items: zod.z.array(zod.z.object({
+      id: zod.z.string(),
+      /** base64 Float32LE — the same wire form `upsert` accepts. */
+      vector: zod.z.string(),
+      metadata: VectorMetadataSchema
+    })) });
+    var VectorScanInputSchema = zod.z.object({
+      index: zod.z.string(),
+      /** Opaque resume point. `0` starts at the top; pass back `nextCursor`. */
+      cursor: zod.z.number().int().nonnegative().default(0),
+      limit: zod.z.number().int().positive()
+    });
+    var VectorScanResultSchema = zod.z.object({
+      items: zod.z.array(zod.z.object({
+        id: zod.z.string(),
+        metadata: VectorMetadataSchema
+      })),
+      /**
+      * Where the next page starts, or `null` when the walk reached the end.
+      *
+      * `null` is the ONLY end-of-index signal. A caller must not infer the end
+      * from a short page: a backend is free to return fewer rows than asked.
+      */
+      nextCursor: zod.z.number().int().nonnegative().nullable()
+    });
     var VectorStatsInputSchema = zod.z.object({ index: zod.z.string() });
     var VectorStatsResultSchema = zod.z.object({
       /** Provider id, so an operator can tell brute force from an ANN index. */
@@ -225244,6 +226346,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         query: require_sleep.method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
         /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
         getByIds: require_sleep.method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+        /** Metadata AND vectors, by named id — see {@link VectorFetchInputSchema}. */
+        fetchByIds: require_sleep.method(VectorFetchInputSchema, VectorFetchResultSchema, { auth: "admin" }),
+        /** One page of the whole index, unranked — see {@link VectorScanInputSchema}. */
+        scan: require_sleep.method(VectorScanInputSchema, VectorScanResultSchema, { auth: "admin" }),
         deleteByIds: require_sleep.method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
           kind: "mutation",
           auth: "admin"
@@ -231714,6 +232820,20 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           kind: "query",
           auth: "admin"
         }),
+        /**
+        * What a location STILL holds, asked of the durable hour ledger.
+        *
+        * The number behind "drain remaining": segments and bytes that would still
+        * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+        * — because the resident index is not the archive (D295), and a drain sized
+        * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+        * `null` means the archive could not be asked (no ledger on this node, or
+        * the aggregate failed) and is never conflated with an empty source.
+        */
+        getRelocateResidue: require_sleep.method(RelocateResidueInputSchema, RelocateResidueSchema, {
+          kind: "query",
+          auth: "admin"
+        }),
         /** Cancel a running or queued relocate job. A queued job never runs. */
         cancelRelocateJob: require_sleep.method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
           kind: "mutation",
@@ -240654,6 +241774,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "pipelineAnalytics.countRelocatableMedia": {
+        capName: "pipeline-analytics",
+        capScope: "device",
+        addonId: null,
+        access: "view"
+      },
       "pipelineAnalytics.countUnstampedEventMedia": {
         capName: "pipeline-analytics",
         capScope: "device",
@@ -241818,6 +242944,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "recording.getRelocateResidue": {
+        capName: "recording",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "recording.getStorageMigrationMoveStatus": {
         capName: "recording",
         capScope: "system",
@@ -242364,12 +243496,30 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "create"
       },
+      "storageMigration.drain": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "create"
+      },
+      "storageMigration.movers": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.plan": {
         capName: "storage-migration",
         capScope: "system",
         addonId: null,
         access: "view"
       },
+      "storageMigration.residue": {
+        capName: "storage-migration",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "storageMigration.start": {
         capName: "storage-migration",
         capScope: "system",
@@ -243204,6 +244354,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "delete"
       },
+      "vectorStore.fetchByIds": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.getByIds": {
         capName: "vector-store",
         capScope: "system",
@@ -243216,6 +244372,12 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
         addonId: null,
         access: "view"
       },
+      "vectorStore.scan": {
+        capName: "vector-store",
+        capScope: "system",
+        addonId: null,
+        access: "view"
+      },
       "vectorStore.stats": {
         capName: "vector-store",
         capScope: "system",
@@ -246390,6 +247552,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           cancelStorageMigrationMove: (input) => dispatch("recording", "cancelStorageMigrationMove", "mutation", input),
           relocateFootage: (input) => dispatch("recording", "relocateFootage", "mutation", input),
           listRelocateJobs: (input) => dispatch("recording", "listRelocateJobs", "query", input),
+          getRelocateResidue: (input) => dispatch("recording", "getRelocateResidue", "query", input),
           cancelRelocateJob: (input) => dispatch("recording", "cancelRelocateJob", "mutation", input),
           planStorageRebalance: (input) => dispatch("recording", "planStorageRebalance", "query", input),
           startStorageRebalance: (input) => dispatch("recording", "startStorageRebalance", "mutation", input)
@@ -246453,7 +247616,10 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
           plan: (input) => dispatch("storageMigration", "plan", "query", input),
           start: (input) => dispatch("storageMigration", "start", "mutation", input),
           status: (input) => dispatch("storageMigration", "status", "query", input),
-          cancel: (input) => dispatch("storageMigration", "cancel", "mutation", input)
+          cancel: (input) => dispatch("storageMigration", "cancel", "mutation", input),
+          movers: (input) => dispatch("storageMigration", "movers", "query", input),
+          residue: (input) => dispatch("storageMigration", "residue", "query", input),
+          drain: (input) => dispatch("storageMigration", "drain", "mutation", input)
         },
         streamBroker: {
           fetchEventMedia: (input) => dispatch("streamBroker", "fetchEventMedia", "mutation", input),
@@ -249907,6 +251073,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.REACHABILITY_PROBE_TIMEOUT_MS = REACHABILITY_PROBE_TIMEOUT_MS;
     exports.RECOGNITION_TYPES = RECOGNITION_TYPES;
     exports.RECORDING_EXPORT_MAX_READ_BYTES = RECORDING_EXPORT_MAX_READ_BYTES;
+    exports.REDACTED_SECRET = REDACTED_SECRET;
     exports.RESERVED_BINDING_NAMES = RESERVED_BINDING_NAMES;
     exports.RESTORED_CAP_NAMES = RESTORED_CAP_NAMES;
     exports.ROOT_BUCKET_KEY = ROOT_BUCKET_KEY;
@@ -249945,11 +251112,15 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.RecordingTriggersSchema = RecordingTriggersSchema;
     exports.RecordingWeekdaySchema = RecordingWeekdaySchema;
     exports.RedirectLoginMethodSchema = RedirectLoginMethodSchema;
+    exports.RelocatableMediaCountInputSchema = RelocatableMediaCountInputSchema;
+    exports.RelocatableMediaCountSchema = RelocatableMediaCountSchema;
     exports.RelocateFootageClassSchema = RelocateFootageClassSchema;
     exports.RelocateFootageInputSchema = RelocateFootageInputSchema;
     exports.RelocateJobSchema = RelocateJobSchema;
     exports.RelocateJobStateSchema = RelocateJobStateSchema;
     exports.RelocateMediaInputSchema = RelocateMediaInputSchema;
+    exports.RelocateResidueInputSchema = RelocateResidueInputSchema;
+    exports.RelocateResidueSchema = RelocateResidueSchema;
     exports.RenderedAsSchema = RenderedAsSchema;
     exports.ReportMotionInputSchema = ReportMotionInputSchema;
     exports.ReportedFailureContributionSchema = ReportedFailureContributionSchema;
@@ -250000,6 +251171,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.SOURCE_CAP_CHANGED_AT_FIELD = SOURCE_CAP_CHANGED_AT_FIELD;
     exports.SOURCE_DEVICE_TYPES = SOURCE_DEVICE_TYPES;
     exports.SOURCE_INFO_METADATA_KEY = SOURCE_INFO_METADATA_KEY;
+    exports.STORAGE_ACCESS_FALLBACK = STORAGE_ACCESS_FALLBACK;
     exports.STREAM_PROFILE_META = STREAM_PROFILE_META;
     exports.STREAM_QUALITY_LABELS = STREAM_QUALITY_LABELS;
     exports.SUB_DETECTION_TYPES = SUB_DETECTION_TYPES;
@@ -250049,6 +251221,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StartEmbeddedInputSchema = StartEmbeddedInputSchema;
     exports.StationaryObjectSchema = StationaryObjectSchema;
     exports.StorageAbortUploadInputSchema = AbortUploadInputSchema;
+    exports.StorageAccessSchema = StorageAccessSchema;
     exports.StorageBeginDownloadInputSchema = BeginDownloadInputSchema;
     exports.StorageBeginDownloadResultSchema = BeginDownloadResultSchema;
     exports.StorageBeginUploadInputSchema = BeginUploadInputSchema;
@@ -250061,18 +251234,23 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.StorageLocationTypeSchema = StorageLocationTypeSchema;
     exports.StorageMigrationClassSchema = StorageMigrationClassSchema;
     exports.StorageMigrationDestinationsSchema = StorageMigrationDestinationsSchema;
+    exports.StorageMigrationDrainInputSchema = StorageMigrationDrainInputSchema;
     exports.StorageMigrationFindingCodeSchema = StorageMigrationFindingCodeSchema;
     exports.StorageMigrationFindingSchema = StorageMigrationFindingSchema;
     exports.StorageMigrationFootageMoveInputSchema = StorageMigrationFootageMoveInputSchema;
     exports.StorageMigrationInputSchema = StorageMigrationInputSchema;
     exports.StorageMigrationJobSchema = StorageMigrationJobSchema;
+    exports.StorageMigrationLaneSchema = StorageMigrationLaneSchema;
     exports.StorageMigrationLeaseInputSchema = StorageMigrationLeaseInputSchema;
     exports.StorageMigrationMediaMoveInputSchema = StorageMigrationMediaMoveInputSchema;
     exports.StorageMigrationModeSchema = StorageMigrationModeSchema;
+    exports.StorageMigrationMoveProgressSchema = StorageMigrationMoveProgressSchema;
     exports.StorageMigrationMoveSchema = StorageMigrationMoveSchema;
+    exports.StorageMigrationMoverSchema = StorageMigrationMoverSchema;
     exports.StorageMigrationParticipantSchema = StorageMigrationParticipantSchema;
     exports.StorageMigrationPhaseSchema = StorageMigrationPhaseSchema;
     exports.StorageMigrationPlanSchema = StorageMigrationPlanSchema;
+    exports.StorageMigrationResidueSchema = StorageMigrationResidueSchema;
     exports.StorageProviderInfoSchema = ProviderInfoSchema;
     exports.StorageReadChunkInputSchema = ReadChunkInputSchema;
     exports.StorageTestLocationResultSchema = TestLocationResultSchema;
@@ -250266,6 +251444,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.clusterStepSettingKey = clusterStepSettingKey;
     exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
     exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
+    exports.collectSecretConfigKeys = collectSecretConfigKeys;
     exports.colorCapability = colorCapability;
     exports.colorForKind = colorForKind;
     exports.commitWatchdogRestart = commitWatchdogRestart;
@@ -250406,6 +251585,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.isRestoredCap = isRestoredCap;
     exports.isSameAddonId = isSameAddonId;
     exports.isScheduleActive = isScheduleActive;
+    exports.isSecretConfigField = isSecretConfigField;
     exports.isSoftwareDecode = require_canonical_hash.isSoftwareDecode;
     exports.isSourceCap = isSourceCap;
     exports.isSystemDelivery = isSystemDelivery;
@@ -250553,6 +251733,7 @@ ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
     exports.runtimeDevices = runtimeDevices;
     exports.runtimeStatePolicyFor = runtimeStatePolicyFor;
     exports.sceneMonitorCapability = sceneMonitorCapability;
+    exports.schemaDeclaresAnyField = schemaDeclaresAnyField;
     exports.scopeInherits = scopeInherits;
     exports.scopeKey = require_sleep.scopeKey;
     exports.scopesAllowAddon = scopesAllowAddon;