@camstack/system 1.2.390 → 1.2.392

package/dist/builtins/storage-orchestrator/location-secrets.d.ts

@@ -1,73 +1,114 @@
-import { StorageLocation } from '@camstack/types';
 /**
- * The config keys the ORCHESTRATOR itself owns, as opposed to the ones a
- * provider owns. Every one of them is read by framework code that has no idea
- * which provider is behind the row:
- *
- *  - `basePath`     — `localCapacityOf`, `locationOccupancy`, the seed pass,
- *                     `LocationCard`'s summary, `StorageSection`;
- *  - `readOnly`     — drain mode; the recorder and post-analysis both filter on
- *                     it off a `listLocations` row;
- *  - `maxUsedGb`    — `resolveLocationMaxUsedBytes`;
- *  - `minFreePercent` — `resolveLocationThresholds`.
- *
- * None can be a credential, because the framework interprets all four itself.
- * That is what makes the list safe to hardcode — it is NOT a list of "keys we
- * believe are not secret", which is the rotting kind. It is the closed set of
- * keys this module, not a provider, defines the meaning of.
- */
+* Credential redaction for `StorageLocation.config`.
+*
+* ── What was wrong ─────────────────────────────────────────────────────────
+* `storage.listLocations` carries no `auth` override, so it is `protected` —
+* every authenticated session reaches it, admin or not. The orchestrator
+* spread each stored row verbatim. `StorageLocation.config` is
+* `z.record(z.string(), z.unknown())`, and the SFTP / S3 / WebDAV providers
+* already declare `password`, `privateKey`, `privateKeyPassphrase`,
+* `secretAccessKey` and `token` inside it. Nothing was exposed only because
+* every location on the live hub is `filesystem-storage`, whose config is
+* `basePath` + `maxUsedGb`. The exposure arrives with the first remote
+* location, and three providers that collect one already ship.
+*
+* ── The mechanism ──────────────────────────────────────────────────────────
+* Schema-driven, never a hardcoded key list: each provider's
+* `getProviderInfo().configSchema` already says which of its fields hold a
+* credential, so it is the one thing that cannot drift from the provider.
+*
+* Two directions, and both are needed:
+*  - **out** — {@link redactLocationConfig} replaces every secret value with
+*    `REDACTED_SECRET` on the way to a caller.
+*  - **in** — {@link restoreRedactedSecrets} treats that same sentinel, sent
+*    back on an upsert, as "keep what is stored". Without it the wizard's
+*    edit-and-save round trip would write the sentinel into the config and
+*    lock the operator out of their own share on the first rename.
+*
+* ── The trap this deliberately avoids ──────────────────────────────────────
+* Keying redaction off `type: 'password'` alone MISSES a secret parked in a
+* `textarea`, and the SFTP provider parks an entire PEM private key there.
+* Discovery goes through `collectSecretConfigKeys`, whose discriminator is
+* `type === 'password' || secret === true`. A redaction that quietly misses a
+* credential is worse than none: it is a leak plus an assurance there is not
+* one.
+*
+* ── And the direction it can still fail in ─────────────────────────────────
+* A schema-driven mechanism has nothing to read while the provider is down,
+* and `listLocations` serves the row anyway. {@link secretKeysForConfig} is
+* where that is closed — an unknown provider withholds everything it did not
+* itself define, rather than nothing.
+*/
+import type { StorageLocation } from "@camstack/types";
+/**
+* The config keys the ORCHESTRATOR itself owns, as opposed to the ones a
+* provider owns. Every one of them is read by framework code that has no idea
+* which provider is behind the row:
+*
+*  - `basePath`     — `localCapacityOf`, `locationOccupancy`, the seed pass,
+*                     `LocationCard`'s summary, `StorageSection`;
+*  - `readOnly`     — drain mode; the recorder and post-analysis both filter on
+*                     it off a `listLocations` row;
+*  - `maxUsedGb`    — `resolveLocationMaxUsedBytes`;
+*  - `minFreePercent` — `resolveLocationThresholds`.
+*
+* None can be a credential, because the framework interprets all four itself.
+* That is what makes the list safe to hardcode — it is NOT a list of "keys we
+* believe are not secret", which is the rotting kind. It is the closed set of
+* keys this module, not a provider, defines the meaning of.
+*/
 export declare const FRAMEWORK_CONFIG_KEYS: ReadonlySet<string>;
 /** Minimal shape needed off a provider's `getProviderInfo()` result. */
 export interface ProviderInfoLike {
-    readonly providerId: string;
-    readonly configSchema: unknown;
+	readonly providerId: string;
+	readonly configSchema: unknown;
 }
 /** Secret config keys a provider declares, derived from its own form schema. */
 export declare function secretKeysOfProviderInfo(info: ProviderInfoLike): ReadonlySet<string>;
 /**
- * Which keys of THIS config must be treated as secret.
- *
- * `declared` is what the provider's own schema said, or `undefined` when the
- * provider has not registered on this node and so has said nothing.
- *
- * The `undefined` branch is the one that matters. Redaction is schema-driven
- * and the schema arrives with the provider, so "no provider" used to mean "no
- * secret keys" — which redacted nothing while `listLocations` happily served
- * the row, because that method reads the store and never needs a provider.
- * That is a real window on every hub restart (the `remote-storage` group is a
- * separate runner that registers after the orchestrator boots) and it is
- * PERMANENT for a runner the CrashSupervisor marked terminally failed.
- *
- * So an unknown provider fails CLOSED: every key the framework does not itself
- * define is withheld. It over-redacts — a host name is hidden alongside the
- * password — and that is the correct direction, because the admin UI cannot
- * render a provider's form without that same provider's `configSchema` either,
- * so nothing that was working stops working.
- *
- * Withholding is done with the sentinel, never by dropping the key, so a save
- * performed in this degraded state still round-trips every value back intact.
- */
+* Which keys of THIS config must be treated as secret.
+*
+* `declared` is what the provider's own schema said, or `undefined` when the
+* provider has not registered on this node and so has said nothing.
+*
+* The `undefined` branch is the one that matters. Redaction is schema-driven
+* and the schema arrives with the provider, so "no provider" used to mean "no
+* secret keys" — which redacted nothing while `listLocations` happily served
+* the row, because that method reads the store and never needs a provider.
+* That is a real window on every hub restart (the `remote-storage` group is a
+* separate runner that registers after the orchestrator boots) and it is
+* PERMANENT for a runner the CrashSupervisor marked terminally failed.
+*
+* So an unknown provider fails CLOSED: every key the framework does not itself
+* define is withheld. It over-redacts — a host name is hidden alongside the
+* password — and that is the correct direction, because the admin UI cannot
+* render a provider's form without that same provider's `configSchema` either,
+* so nothing that was working stops working.
+*
+* Withholding is done with the sentinel, never by dropping the key, so a save
+* performed in this degraded state still round-trips every value back intact.
+*/
 export declare function secretKeysForConfig(config: Readonly<Record<string, unknown>>, declared: ReadonlySet<string> | undefined): ReadonlySet<string>;
 /**
- * A copy of `config` with every declared secret replaced by the sentinel.
- * Returns the SAME object when there is nothing to redact, so the common case
- * (a filesystem location) allocates nothing.
- *
- * A key the provider declares secret but that is absent from the stored config
- * is NOT invented — an absent password must keep reading as absent, or the
- * wizard would show a credential where none is set and the write-back would
- * then "keep" a value that never existed.
- */
+* A copy of `config` with every declared secret replaced by the sentinel.
+* Returns the SAME object when there is nothing to redact, so the common case
+* (a filesystem location) allocates nothing.
+*
+* A key the provider declares secret but that is absent from the stored config
+* is NOT invented — an absent password must keep reading as absent, or the
+* wizard would show a credential where none is set and the write-back would
+* then "keep" a value that never existed.
+*/
 export declare function redactLocationConfig(config: Readonly<Record<string, unknown>>, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;
 /** The same, applied to a whole location record. */
 export declare function redactLocation(location: StorageLocation, secretKeys: ReadonlySet<string>): StorageLocation;
 /**
- * Undo the redaction on the way IN: any secret key whose incoming value is the
- * sentinel is restored from what is already stored.
- *
- * A sentinel with NOTHING stored behind it is dropped rather than persisted —
- * writing the literal `__camstack_redacted__` as a password is a
- * lock-yourself-out bug that would only surface at the next connection
- * attempt, hours later, as an authentication failure with no explanation.
- */
+* Undo the redaction on the way IN: any secret key whose incoming value is the
+* sentinel is restored from what is already stored.
+*
+* A sentinel with NOTHING stored behind it is dropped rather than persisted —
+* writing the literal `__camstack_redacted__` as a password is a
+* lock-yourself-out bug that would only surface at the next connection
+* attempt, hours later, as an authentication failure with no explanation.
+*/
 export declare function restoreRedactedSecrets(incoming: Readonly<Record<string, unknown>>, stored: Readonly<Record<string, unknown>> | undefined, secretKeys: ReadonlySet<string>): Readonly<Record<string, unknown>>;

package/dist/builtins/storage-orchestrator/location-store.d.ts

@@ -1,57 +1,66 @@
-import { ISettingsStoreProvider, LegacyStorageLocationDefault, StorageLocation } from '@camstack/types';
 /**
- * A location as it comes back OFF DISK: the live record plus the retired
- * `isDefault` column, which exists only so the orchestrator's boot migration
- * can turn an old default into the enabled write set and say which row it came
- * from. No other reader may take this type.
- */
+* Persistence layer for the storage-orchestrator's `StorageLocation`
+* map (Task 6 of the storage-unification refactor).
+*
+* The service depends only on the abstract `ILocationStore` —
+* production wires `SqliteLocationStore` (settings-backend-backed),
+* tests pass a fake (in-memory `Map`-backed) implementation. Same
+* pattern as `IntegrationRegistry` in `sqlite-storage/`.
+*/
+import type { ISettingsStoreProvider, LegacyStorageLocationDefault, StorageLocation } from "@camstack/types";
+/**
+* A location as it comes back OFF DISK: the live record plus the retired
+* `isDefault` column, which exists only so the orchestrator's boot migration
+* can turn an old default into the enabled write set and say which row it came
+* from. No other reader may take this type.
+*/
 export type PersistedStorageLocation = StorageLocation & LegacyStorageLocationDefault;
 /**
- * Abstract storage interface for `StorageLocation` records. Methods are
- * async because production-side implementations hit SQLite — but the
- * orchestrator's mutation paths fire-and-forget the writes so a slow
- * disk doesn't block the cap surface.
- */
+* Abstract storage interface for `StorageLocation` records. Methods are
+* async because production-side implementations hit SQLite — but the
+* orchestrator's mutation paths fire-and-forget the writes so a slow
+* disk doesn't block the cap surface.
+*/
 export interface ILocationStore {
-    /** Read every persisted location. Called once at boot. Rows carry the
-     *  RETIRED `isDefault` column when it was set, for the one reader allowed to
-     *  see it: the orchestrator's boot migration onto the `enabled` write set. */
-    loadAll(): Promise<readonly PersistedStorageLocation[]>;
-    /** Insert or replace a single location by id. */
-    upsert(loc: StorageLocation): Promise<void>;
-    /** Remove a location by id. */
-    delete(id: string): Promise<void>;
+	/** Read every persisted location. Called once at boot. Rows carry the
+	*  RETIRED `isDefault` column when it was set, for the one reader allowed to
+	*  see it: the orchestrator's boot migration onto the `enabled` write set. */
+	loadAll(): Promise<readonly PersistedStorageLocation[]>;
+	/** Insert or replace a single location by id. */
+	upsert(loc: StorageLocation): Promise<void>;
+	/** Remove a location by id. */
+	delete(id: string): Promise<void>;
 }
 /**
- * @durable class=config owner=storage-orchestrator
- *   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
- *   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
- */
+* @durable class=config owner=storage-orchestrator
+*   write="an operator creates or edits a location (basePath, minFreePercent, enabled, node pin); plus the boot reconcile — declared defaults seeded on a fresh install, and in-memory-only locations backfilled when the store is late-wired"
+*   retention="none — a row goes only when the operator deletes the location, or when the declaration pass prunes one whose declaring addon is gone. Bounded by the storage targets a human configures."
+*/
 export declare const STORAGE_LOCATIONS = "storage_locations";
 /**
- * `ILocationStore` on the `settings-store` collection surface — the same door
- * every other consumer uses. It holds the `data-store-provider` engine object
- * directly (not the `settings-store` singleton) because since D44 the
- * storage-orchestrator IS that singleton, and asking the registry for it would
- * route this table back through the orchestrator itself.
- */
+* `ILocationStore` on the `settings-store` collection surface — the same door
+* every other consumer uses. It holds the `data-store-provider` engine object
+* directly (not the `settings-store` singleton) because since D44 the
+* storage-orchestrator IS that singleton, and asking the registry for it would
+* route this table back through the orchestrator itself.
+*/
 export declare class SqliteLocationStore implements ILocationStore {
-    private readonly store;
-    private declared;
-    constructor(store: ISettingsStoreProvider);
-    /**
-     * Lazy `declareCollection` — keeps the constructor cheap and async-free.
-     * Called from every mutation/read path; `declareCollection` is idempotent
-     * (and additive on shape changes), so repeated calls collapse to a no-op.
-     */
-    private ensureDeclared;
-    loadAll(): Promise<readonly StorageLocation[]>;
-    /**
-     * Replace-or-insert. Implemented as delete + insert rather than a
-     * conditional update because the orchestrator serializes every mutation
-     * through the in-memory map before dispatching to the store — there's no
-     * contention to lose, and delete-then-insert is unconditionally simpler.
-     */
-    upsert(loc: StorageLocation): Promise<void>;
-    delete(id: string): Promise<void>;
+	private readonly store;
+	private declared;
+	constructor(store: ISettingsStoreProvider);
+	/**
+	* Lazy `declareCollection` — keeps the constructor cheap and async-free.
+	* Called from every mutation/read path; `declareCollection` is idempotent
+	* (and additive on shape changes), so repeated calls collapse to a no-op.
+	*/
+	private ensureDeclared;
+	loadAll(): Promise<readonly StorageLocation[]>;
+	/**
+	* Replace-or-insert. Implemented as delete + insert rather than a
+	* conditional update because the orchestrator serializes every mutation
+	* through the in-memory map before dispatching to the store — there's no
+	* contention to lose, and delete-then-insert is unconditionally simpler.
+	*/
+	upsert(loc: StorageLocation): Promise<void>;
+	delete(id: string): Promise<void>;
 }

package/dist/builtins/storage-orchestrator/location-volume-capacity.d.ts

@@ -1,58 +1,58 @@
-import { StorageLocation } from '@camstack/types';
-import { ProviderLocality } from './access-guards.js';
+import type { StorageLocation } from "@camstack/types";
+import type { ProviderLocality } from "./access-guards.js";
 /** The three `statfs` fields capacity is derived from (`node:fs` StatsFs). */
 export interface StatfsFacts {
-    readonly blocks: number;
-    readonly bsize: number;
-    readonly bavail: number;
+	readonly blocks: number;
+	readonly bsize: number;
+	readonly bavail: number;
 }
 /** The filesystem reads the probe takes, injected so the decision is testable. */
 export interface VolumeProbe {
-    readonly access: (target: string) => Promise<void>;
-    readonly statfs: (target: string) => Promise<StatfsFacts>;
+	readonly access: (target: string) => Promise<void>;
+	readonly statfs: (target: string) => Promise<StatfsFacts>;
 }
 export interface VolumeProbeDeps {
-    readonly probe: VolumeProbe;
-    /** Only ever used to REJECT a relative `basePath` by naming what it would
-     *  have resolved against — never to resolve one. */
-    readonly cwd: string;
+	readonly probe: VolumeProbe;
+	/** Only ever used to REJECT a relative `basePath` by naming what it would
+	*  have resolved against — never to resolve one. */
+	readonly cwd: string;
 }
 /**
- * A measurement, or the reason there is none. `unknown` is never folded into a
- * number: `0` free means "full" to every reader of this figure (D393).
- */
+* A measurement, or the reason there is none. `unknown` is never folded into a
+* number: `0` free means "full" to every reader of this figure (D393).
+*/
 export type LocalVolumeCapacity = {
-    readonly kind: 'measured';
-    /** The path actually stat'd — the location's root, or an ancestor of it. */
-    readonly path: string;
-    readonly totalBytes: number;
-    readonly availableBytes: number;
+	readonly kind: "measured";
+	/** The path actually stat'd — the location's root, or an ancestor of it. */
+	readonly path: string;
+	readonly totalBytes: number;
+	readonly availableBytes: number;
 } | {
-    readonly kind: 'unknown';
-    readonly reason: string;
+	readonly kind: "unknown";
+	readonly reason: string;
 };
 /** The two figures the cap carries, or `null` — never a zero standing in. */
 export interface MeasuredVolume {
-    readonly totalBytes: number;
-    readonly availableBytes: number;
+	readonly totalBytes: number;
+	readonly availableBytes: number;
 }
 /**
- * Free percent for the pressure guard. An unmeasurable volume answers `100`,
- * which is the value that keeps the guard INERT: a disk nobody measured must
- * never be the reason footage is deleted (D393).
- */
+* Free percent for the pressure guard. An unmeasurable volume answers `100`,
+* which is the value that keeps the guard INERT: a disk nobody measured must
+* never be the reason footage is deleted (D393).
+*/
 export declare function freePercentOf(capacity: MeasuredVolume | null): number;
 /**
- * Volume total for turning a deficit percentage into a byte target. `0` on an
- * unmeasurable volume — the guard's own stop condition reads that as "no
- * target", so nothing is evicted on a reading nobody took.
- */
+* Volume total for turning a deficit percentage into a byte target. `0` on an
+* unmeasurable volume — the guard's own stop condition reads that as "no
+* target", so nothing is evicted on a reading nobody took.
+*/
 export declare function volumeTotalBytesOf(capacity: MeasuredVolume | null): number;
 /**
- * Free + total bytes on the volume backing `location`, or why there are none.
- *
- * Never throws: an unreachable volume is one degraded ROW, not a failed
- * `listLocations` — a NAS that stops answering must not blank the capacity of
- * every other disk on the node.
- */
+* Free + total bytes on the volume backing `location`, or why there are none.
+*
+* Never throws: an unreachable volume is one degraded ROW, not a failed
+* `listLocations` — a NAS that stops answering must not blank the capacity of
+* every other disk on the node.
+*/
 export declare function readLocalVolumeCapacity(location: StorageLocation, locality: ProviderLocality, localNodeId: string, deps: VolumeProbeDeps): Promise<LocalVolumeCapacity>;

package/dist/builtins/storage-orchestrator/provider-discovery.d.ts

@@ -1,10 +1,24 @@
-import { IStorageCapProvider, IStorageProviderImpl } from '@camstack/types';
+/**
+* Provider discovery — the pure mapping behind the orchestrator's
+* `storage.listProviders` cap handler.
+*
+* Walks every registered `storage-provider`, collects each one's
+* `getProviderInfo()` blob, and projects it into the `storage` cap's
+* `listProviders` output shape (including the intrinsic disk-space
+* policy fields `shouldSaveDiskSpace` + `minFreePercent`). Errors from
+* individual providers are isolated via `onError` — a single misbehaving
+* driver never denies the whole list.
+*
+* Extracted from the addon handler so the projection is unit-testable
+* without booting a `BaseAddon`.
+*/
+import type { IStorageCapProvider, IStorageProviderImpl } from "@camstack/types";
 /** One entry of the `storage.listProviders` output array. */
-export type StorageProviderListEntry = Awaited<ReturnType<IStorageCapProvider['listProviders']>>[number];
+export type StorageProviderListEntry = Awaited<ReturnType<IStorageCapProvider["listProviders"]>>[number];
 /**
- * Callback invoked when a provider's `getProviderInfo()` throws. The array
- * `index` is passed so the orchestrator can identify which provider failed —
- * `getProviderInfo()` itself threw, so there is no static id to log otherwise.
- */
+* Callback invoked when a provider's `getProviderInfo()` throws. The array
+* `index` is passed so the orchestrator can identify which provider failed —
+* `getProviderInfo()` itself threw, so there is no static id to log otherwise.
+*/
 export type ProviderInfoErrorHandler = (provider: IStorageProviderImpl, error: unknown, index: number) => void;
 export declare function collectProviderInfos(providers: readonly IStorageProviderImpl[], onError: ProviderInfoErrorHandler): Promise<StorageProviderListEntry[]>;

package/dist/builtins/storage-orchestrator/storage-cleanup-coordinator.d.ts

@@ -1,68 +1,68 @@
-import { LedgerWalkInput, LedgerWalkReport, StorageCleanupInput, StorageCleanupJob } from '@camstack/types';
-import { StorageOrchestratorService } from './storage-orchestrator.service.js';
+import type { LedgerWalkInput, LedgerWalkReport, StorageCleanupInput, StorageCleanupJob } from "@camstack/types";
+import type { StorageOrchestratorService } from "./storage-orchestrator.service.js";
 export interface CleanupJobState {
-    get(): Promise<StorageCleanupJob | null>;
-    set(value: StorageCleanupJob | null): Promise<void>;
+	get(): Promise<StorageCleanupJob | null>;
+	set(value: StorageCleanupJob | null): Promise<void>;
 }
 export interface OrphanAuditStart {
-    readonly started: boolean;
-    readonly alreadyRunning: boolean;
+	readonly started: boolean;
+	readonly alreadyRunning: boolean;
 }
 export interface OrphanAuditStatus {
-    readonly running: boolean;
-    readonly complete: boolean | null;
-    readonly totalReclaimed: number;
-    readonly totalBytesReclaimed: number;
-    readonly error: string | null;
+	readonly running: boolean;
+	readonly complete: boolean | null;
+	readonly totalReclaimed: number;
+	readonly totalBytesReclaimed: number;
+	readonly error: string | null;
 }
 export interface DebugMediaStart {
-    readonly started: boolean;
-    readonly alreadyRunning: boolean;
+	readonly started: boolean;
+	readonly alreadyRunning: boolean;
 }
 export interface DebugMediaStatus {
-    readonly running: boolean;
-    readonly totalReclaimed: number;
-    readonly totalBytesReclaimed: number;
-    readonly error: string | null;
+	readonly running: boolean;
+	readonly totalReclaimed: number;
+	readonly totalBytesReclaimed: number;
+	readonly error: string | null;
 }
 export interface StorageCleanupParticipants {
-    startOrphan(restart: boolean): Promise<OrphanAuditStart>;
-    orphanStatus(): Promise<OrphanAuditStatus>;
-    startDebugMedia(): Promise<DebugMediaStart>;
-    debugMediaStatus(): Promise<DebugMediaStatus>;
-    walkLedger(input: LedgerWalkInput): Promise<LedgerWalkReport>;
+	startOrphan(restart: boolean): Promise<OrphanAuditStart>;
+	orphanStatus(): Promise<OrphanAuditStatus>;
+	startDebugMedia(): Promise<DebugMediaStart>;
+	debugMediaStatus(): Promise<DebugMediaStatus>;
+	walkLedger(input: LedgerWalkInput): Promise<LedgerWalkReport>;
 }
 export interface StorageCleanupCoordinatorDeps {
-    readonly locations: StorageOrchestratorService;
-    readonly state: CleanupJobState;
-    readonly participants: StorageCleanupParticipants;
-    readonly now: () => number;
-    readonly newId: () => string;
-    readonly sleep?: (ms: number) => Promise<void>;
-    readonly pollMs?: number;
+	readonly locations: StorageOrchestratorService;
+	readonly state: CleanupJobState;
+	readonly participants: StorageCleanupParticipants;
+	readonly now: () => number;
+	readonly newId: () => string;
+	readonly sleep?: (ms: number) => Promise<void>;
+	readonly pollMs?: number;
 }
 /**
- * One operator-facing cleanup of leftover analytics rows/blobs, optional
- * debug media, and ghost ledger rows on frozen footage locations.
- *
- * Each addon call either returns immediately (start+poll) or is a bounded
- * ledger walk. The HTTP caller never waits on the full pass.
- */
+* One operator-facing cleanup of leftover analytics rows/blobs, optional
+* debug media, and ghost ledger rows on frozen footage locations.
+*
+* Each addon call either returns immediately (start+poll) or is a bounded
+* ledger walk. The HTTP caller never waits on the full pass.
+*/
 export declare class StorageCleanupCoordinator {
-    private readonly deps;
-    private active;
-    private startReserved;
-    constructor(deps: StorageCleanupCoordinatorDeps);
-    start(input: StorageCleanupInput): Promise<string>;
-    status(jobId?: string): Promise<StorageCleanupJob | null>;
-    cancel(jobId: string): Promise<boolean>;
-    private run;
-    private reclaimOrphans;
-    private reclaimDebugMedia;
-    private forgetGhosts;
-    private waitUntilIdle;
-    private stopped;
-    private setPhase;
-    private finish;
-    private persist;
+	private readonly deps;
+	private active;
+	private startReserved;
+	constructor(deps: StorageCleanupCoordinatorDeps);
+	start(input: StorageCleanupInput): Promise<string>;
+	status(jobId?: string): Promise<StorageCleanupJob | null>;
+	cancel(jobId: string): Promise<boolean>;
+	private run;
+	private reclaimOrphans;
+	private reclaimDebugMedia;
+	private forgetGhosts;
+	private waitUntilIdle;
+	private stopped;
+	private setPhase;
+	private finish;
+	private persist;
 }