@camstack/types 1.2.123 → 1.2.126

package/dist/interfaces/addon.d.ts

@@ -1025,6 +1025,36 @@ export interface AddonDeclaration {
      * `ctx.deps.installPythonRequirements(absolutePath)`.
      */
     readonly python?: AddonPythonRequirements;
+    /**
+     * Host binaries this addon needs on PATH. Same declaration site, same
+     * lifecycle position and same idempotence contract as {@link python} —
+     * the runner satisfies them BEFORE `onInitialize()` runs, so a capability
+     * never advertises itself while the binary it wraps is missing.
+     *
+     * The declaration names WHAT is needed (a binary) plus the package name
+     * each host package manager knows it by — a translation table, not a
+     * procedure. HOW to install (`apt-get update && apt-get install -y …`,
+     * `brew install …`) belongs to the framework, so the next addon that needs
+     * a binary does not re-answer the question.
+     *
+     * Example:
+     *   ```jsonc
+     *   "camstack": {
+     *     "addons": [{
+     *       "id": "smb-storage",
+     *       "systemDependencies": [
+     *         { "binary": "smbclient", "packages": { "apt": "smbclient", "brew": "samba" } }
+     *       ]
+     *     }]
+     *   }
+     *   ```
+     *
+     * Failure is NOT fatal: the addon still loads and the capability that needs
+     * the binary must refuse loudly on its own surface. A provider that cannot
+     * run must never make its locations read as *empty* — `empty` is deletable
+     * (D293).
+     */
+    readonly systemDependencies?: readonly AddonSystemDependency[];
     /** Default configuration values */
     readonly defaultConfig?: Readonly<Record<string, unknown>>;
     /**
@@ -1046,6 +1076,43 @@ export interface AddonPythonRequirements {
      */
     readonly requirements: string;
 }
+/**
+ * One host binary an addon needs on PATH. See
+ * `AddonDeclaration.systemDependencies`.
+ *
+ * Deliberately NOT a shell command. A manifest that carried
+ * `"install": "apt-get install -y smbclient"` would be a per-addon script the
+ * framework runs blind — unportable, unverifiable, and a second answer to a
+ * question the Python mechanism already answered once.
+ */
+export interface AddonSystemDependency {
+    /**
+     * The executable that must resolve on PATH after the step completes. This
+     * is both the presence check (cheap, and what makes the common path a
+     * no-op) and the success check.
+     */
+    readonly binary: string;
+    /**
+     * Package name per host package manager. A manager absent from this map
+     * means "this addon has no way to install the binary on that host" — the
+     * runner logs it and continues rather than guessing that the package shares
+     * the binary's name.
+     */
+    readonly packages: AddonSystemDependencyPackages;
+    /** Operator-facing reason, surfaced in the log line when the install fails. */
+    readonly reason?: string;
+}
+/** Package name per supported host package manager. */
+export interface AddonSystemDependencyPackages {
+    /** Debian / Ubuntu (`apt-get`) — the container base. */
+    readonly apt?: string;
+    /** Alpine (`apk`). */
+    readonly apk?: string;
+    /** Fedora / RHEL (`dnf`). */
+    readonly dnf?: string;
+    /** macOS Homebrew (`brew`) — the desktop build. */
+    readonly brew?: string;
+}
 export interface AddonPackageManifest {
     /**
      * Human-readable package name for UI display (e.g., "Pipeline", "Core").

package/dist/interfaces/config-ui-secrets.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Secret-field discovery over a {@link ConfigUISchema}.
+ *
+ * A provider already declares its own form. That declaration is the ONLY place
+ * that knows which of its config keys hold a credential, so redaction reads it
+ * rather than keeping a second, hand-maintained key list somewhere in the
+ * orchestrator — a list that would be right on the day it was written and
+ * wrong on the day a provider gained a field.
+ *
+ * The discriminator is deliberately NOT `type === 'password'` alone. That was
+ * the first design and it is wrong: the SFTP provider's `privateKey` is a
+ * `textarea` holding a full PEM key. Keying off the input widget would have
+ * left it on the wire while reporting that secrets were redacted. See
+ * `ConfigFieldBase.secret`.
+ *
+ * The walk takes `unknown` because that is what the caller has: the
+ * `storage-provider` cap declares `configSchema: z.unknown()`, so a provider's
+ * schema arrives structurally unverified. It narrows defensively at every
+ * step and ignores anything it cannot read — an unreadable node contributes no
+ * keys, which is the direction that under-reports rather than over-reports.
+ * A caller that needs "did I understand this schema at all" asks
+ * {@link schemaDeclaresAnyField}, which answers `false` for a shape this
+ * cannot read, so "no secrets" and "no schema" stay distinguishable.
+ */
+import type { ConfigField } from './config-ui.js';
+/**
+ * The value a redacted secret is replaced with on every read surface.
+ *
+ * It is also the WRITE-BACK token: an `upsertLocation` that sends this value
+ * back for a key means "keep what is stored", which is what lets an operator
+ * rename a location without retyping its password. A literal an operator could
+ * plausibly choose as a real password would turn that convenience into a way
+ * to lock yourself out, hence the sentinel shape.
+ */
+export declare const REDACTED_SECRET = "__camstack_redacted__";
+/** Is this field's stored value a credential? */
+export declare function isSecretConfigField(field: ConfigField): boolean;
+/**
+ * Every config key in `schema` whose value is a secret, including keys nested
+ * inside `group` / `sub-tabs` containers.
+ */
+export declare function collectSecretConfigKeys(schema: unknown): ReadonlySet<string>;
+/**
+ * True when the value is a readable schema declaring at least one field of any
+ * kind. Lets a caller tell "this provider has no secrets" from "this provider's
+ * schema could not be read", which are the same empty set otherwise.
+ */
+export declare function schemaDeclaresAnyField(schema: unknown): boolean;

package/dist/interfaces/config-ui.d.ts

@@ -124,6 +124,23 @@ export interface ConfigFieldBase {
     readonly default?: unknown;
     readonly span?: 1 | 2 | 3 | 4;
     readonly showWhen?: ConfigCondition;
+    /**
+     * The field's stored value is a CREDENTIAL and must never leave the process
+     * on a read surface. Redaction machinery keys off
+     * {@link isSecretConfigField}, which treats `type: 'password'` as implicitly
+     * secret — this flag exists for the fields that carry a secret WITHOUT being
+     * a password input.
+     *
+     * The concrete miss it was added for: the SFTP provider's `privateKey` is a
+     * `textarea` (a PEM block does not fit a one-line password box) holding a
+     * complete SSH private key. A redaction that trusted `type: 'password'`
+     * alone would have shipped with that key still on the wire and an assurance
+     * that credentials were redacted — worse than no redaction at all.
+     *
+     * Mark it on any field whose value would compromise something if read by a
+     * non-admin session. It costs nothing when the field is already a password.
+     */
+    readonly secret?: boolean;
     /** Per-model knob applicability — see {@link ConfigFieldModelApplicability}. */
     readonly modelApplicability?: ConfigFieldModelApplicability;
     /**

package/dist/interfaces/relocate.d.ts

@@ -91,24 +91,77 @@ export declare const StorageMigrationFootageMoveInputSchema: z.ZodObject<{
     leaseId: z.ZodString;
 }, z.core.$strip>;
 export type StorageMigrationFootageMoveInput = z.infer<typeof StorageMigrationFootageMoveInputSchema>;
+/**
+ * What a `relocateMedia` pass DOES. One engine, three passes — never a second
+ * mover (the engine already walks both collections with a timestamp cursor and
+ * already has a stamp-without-copy path).
+ *
+ *  - `move`    — the default and the historical behaviour: event-media and
+ *                retrain blobs move to `toLocationId` and their rows are
+ *                stamped. The enrolled gallery is skipped (D197).
+ *  - `seal`    — ROWS ONLY, no bytes. Every row whose `locationId` is NULL is
+ *                stamped with `toLocationId`. `toLocationId` here is the id the
+ *                bytes ALREADY sit on — today's `eventMedia` default — because
+ *                a NULL row means "wherever `eventMedia` points *now*", and the
+ *                instant a repoint moves that pointer the row reads from the
+ *                new disk while its bytes are on the old one.
+ *  - `gallery` — the inverse selection of `move`: ONLY the retention-exempt
+ *                (enrolled-gallery) rows, which `move` deliberately skips.
+ *                `galleryMedia` is `cardinality: 'single'`, so this pass can
+ *                never run beside a live second location: it is stop-the-world
+ *                by construction, which is acceptable only because the gallery
+ *                is a few KB per enrolled sample.
+ */
+export declare const MediaRelocateModeSchema: z.ZodEnum<{
+    move: "move";
+    seal: "seal";
+    gallery: "gallery";
+}>;
+export type MediaRelocateMode = z.infer<typeof MediaRelocateModeSchema>;
 export declare const RelocateMediaInputSchema: z.ZodObject<{
     toLocationId: z.ZodString;
     throttleMbps: z.ZodOptional<z.ZodNumber>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        move: "move";
+        seal: "seal";
+        gallery: "gallery";
+    }>>;
 }, z.core.$strip>;
 export type RelocateMediaInput = z.infer<typeof RelocateMediaInputSchema>;
+/** How many rows still carry NO `locationId` — the population a repoint would
+ *  silently re-aim at a disk that does not hold their bytes. Zero is the only
+ *  value that permits a non-blocking `eventMedia` cutover. */
+export declare const UnstampedEventMediaCountSchema: z.ZodObject<{
+    media: z.ZodNumber;
+    retrainFrames: z.ZodNumber;
+    total: z.ZodNumber;
+}, z.core.$strip>;
+export type UnstampedEventMediaCount = z.infer<typeof UnstampedEventMediaCountSchema>;
 export declare const StorageMigrationMediaMoveInputSchema: z.ZodObject<{
     toLocationId: z.ZodString;
     throttleMbps: z.ZodOptional<z.ZodNumber>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        move: "move";
+        seal: "seal";
+        gallery: "gallery";
+    }>>;
     leaseId: z.ZodString;
 }, z.core.$strip>;
 export type StorageMigrationMediaMoveInput = z.infer<typeof StorageMigrationMediaMoveInputSchema>;
-/** The independently selectable logical storage classes. `recordings`
- * encompasses the high and mid segment profiles; `recordingsLow` is low
- * segments; `eventMedia` is post-analysis blobs. */
+/** The independently selectable logical storage classes — every class
+ * `storage.listLocationDeclarations` reports, so an operator never meets a
+ * Zod enum error where they should meet an explanation.
+ *
+ * `recordings` encompasses the high and mid segment profiles; `recordingsLow`
+ * is low segments; `eventMedia` is post-analysis blobs; `galleryMedia` is the
+ * enrolled gallery; `backups` is the system backup archive. The last two have
+ * their own rules — see {@link StorageMigrationFindingCodeSchema}. */
 export declare const StorageMigrationClassSchema: z.ZodEnum<{
     recordings: "recordings";
     recordingsLow: "recordingsLow";
     eventMedia: "eventMedia";
+    backups: "backups";
+    galleryMedia: "galleryMedia";
 }>;
 export type StorageMigrationClass = z.infer<typeof StorageMigrationClassSchema>;
 /** A destination is always an existing, fully-qualified location id. The
@@ -118,21 +171,63 @@ export declare const StorageMigrationDestinationsSchema: z.ZodObject<{
     recordings: z.ZodOptional<z.ZodString>;
     recordingsLow: z.ZodOptional<z.ZodString>;
     eventMedia: z.ZodOptional<z.ZodString>;
+    backups: z.ZodOptional<z.ZodString>;
+    galleryMedia: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type StorageMigrationDestinations = z.infer<typeof StorageMigrationDestinationsSchema>;
+/**
+ * How a migration sequences the cutover against the byte move.
+ *
+ *  - `blocking`     — the historical order: pause, move every byte, repoint,
+ *                     resume. Recording is stopped for the whole move. Right
+ *                     for a small or a cold class, and the only legal mode for
+ *                     a `cardinality: 'single'` class.
+ *  - `nonBlocking`  — repoint FIRST, drain behind: seal, pause, repoint,
+ *                     refresh, resume, then move the past with everything
+ *                     running. The pause is three bounded instants (a detach +
+ *                     attach round, a write-gate drain, a lease) instead of one
+ *                     bounded by bytes. 1.09 TB at 7–14 MB/s is thirty hours of
+ *                     stopped recording under `blocking`; the same move is
+ *                     seconds of stopped recording under `nonBlocking`.
+ *
+ * The mode is on the JOB, not only on the input, because `status` is where an
+ * operator finds out which one is running.
+ */
+export declare const StorageMigrationModeSchema: z.ZodEnum<{
+    blocking: "blocking";
+    nonBlocking: "nonBlocking";
+}>;
+export type StorageMigrationMode = z.infer<typeof StorageMigrationModeSchema>;
 /** Shared input for planning and starting an orchestrated storage migration. */
 export declare const StorageMigrationInputSchema: z.ZodObject<{
     destinations: z.ZodObject<{
         recordings: z.ZodOptional<z.ZodString>;
         recordingsLow: z.ZodOptional<z.ZodString>;
         eventMedia: z.ZodOptional<z.ZodString>;
+        backups: z.ZodOptional<z.ZodString>;
+        galleryMedia: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     throttleMbps: z.ZodOptional<z.ZodNumber>;
+    mode: z.ZodOptional<z.ZodEnum<{
+        blocking: "blocking";
+        nonBlocking: "nonBlocking";
+    }>>;
 }, z.core.$strip>;
 export type StorageMigrationInput = z.infer<typeof StorageMigrationInputSchema>;
-/** The durable coordinator state machine. The only phase that changes default
- * locations is `repointing`, after every selected mover has completed and been
- * verified. */
+/**
+ * The durable coordinator state machine.
+ *
+ * `blocking`:
+ *   planning → pausing → moving → verifying → repointing → refreshing → resuming → done
+ *
+ * `nonBlocking`:
+ *   planning → sealing → pausing → repointing → refreshing → resuming → draining → verifying → done
+ *
+ * Same phases, different order plus two new ones — not a second mover.
+ * `sealing` closes the `eventMedia` NULL-row hole BEFORE anything is paused;
+ * `draining` runs the same movers UNLEASED, after every writer is back up.
+ * `repointing` is still the only phase that changes a default location.
+ */
 export declare const StorageMigrationPhaseSchema: z.ZodEnum<{
     moving: "moving";
     verifying: "verifying";
@@ -140,7 +235,9 @@ export declare const StorageMigrationPhaseSchema: z.ZodEnum<{
     done: "done";
     cancelled: "cancelled";
     planning: "planning";
+    sealing: "sealing";
     pausing: "pausing";
+    draining: "draining";
     repointing: "repointing";
     refreshing: "refreshing";
     resuming: "resuming";
@@ -152,11 +249,41 @@ export declare const StorageMigrationParticipantSchema: z.ZodEnum<{
     analytics: "analytics";
 }>;
 export type StorageMigrationParticipant = z.infer<typeof StorageMigrationParticipantSchema>;
+/**
+ * The mover's own numbers, folded onto the coordinator's durable move record.
+ *
+ * The long half of a non-blocking migration is `draining`, and it is measured
+ * in hours: 136 885 files at ~4 MB/s is about five of them. Before this shape
+ * existed the only place those numbers appeared was a Loki line, so an operator
+ * watching the Admin UI saw `phase: draining` and nothing else for a whole
+ * afternoon.
+ *
+ * It is POLLED, never pushed. Events are telemetry and may be dropped
+ * (D8/D11), and a dropped progress event is indistinguishable from a stalled
+ * mover — which is the exact failure this is meant to end. The coordinator's
+ * `waitForMoves` already fetches the whole {@link RelocateJob} on every tick to
+ * read `state`; folding the counters costs no extra read and makes the durable
+ * record say afterwards how far a move actually got.
+ *
+ * `filesTotal` is `null` for "no honest denominator" and is never zero-filled:
+ * a windowed footage job (`sinceMs`) and a node with no ledger both genuinely
+ * cannot say M, and a 0 there would render as "100 % done".
+ */
+export declare const StorageMigrationMoveProgressSchema: z.ZodObject<{
+    filesMoved: z.ZodNumber;
+    filesTotal: z.ZodNullable<z.ZodNumber>;
+    bytesMoved: z.ZodNumber;
+    startedAt: z.ZodNumber;
+    observedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type StorageMigrationMoveProgress = z.infer<typeof StorageMigrationMoveProgressSchema>;
 export declare const StorageMigrationMoveSchema: z.ZodObject<{
     storageClass: z.ZodEnum<{
         recordings: "recordings";
         recordingsLow: "recordingsLow";
         eventMedia: "eventMedia";
+        backups: "backups";
+        galleryMedia: "galleryMedia";
     }>;
     fromLocationId: z.ZodString;
     toLocationId: z.ZodString;
@@ -169,6 +296,13 @@ export declare const StorageMigrationMoveSchema: z.ZodObject<{
         cancelled: "cancelled";
     }>>;
     error: z.ZodNullable<z.ZodString>;
+    progress: z.ZodNullable<z.ZodObject<{
+        filesMoved: z.ZodNumber;
+        filesTotal: z.ZodNullable<z.ZodNumber>;
+        bytesMoved: z.ZodNumber;
+        startedAt: z.ZodNumber;
+        observedAt: z.ZodNumber;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type StorageMigrationMove = z.infer<typeof StorageMigrationMoveSchema>;
 export declare const StorageMigrationJobSchema: z.ZodObject<{
@@ -180,15 +314,23 @@ export declare const StorageMigrationJobSchema: z.ZodObject<{
         done: "done";
         cancelled: "cancelled";
         planning: "planning";
+        sealing: "sealing";
         pausing: "pausing";
+        draining: "draining";
         repointing: "repointing";
         refreshing: "refreshing";
         resuming: "resuming";
     }>;
+    mode: z.ZodEnum<{
+        blocking: "blocking";
+        nonBlocking: "nonBlocking";
+    }>;
     destinations: z.ZodObject<{
         recordings: z.ZodOptional<z.ZodString>;
         recordingsLow: z.ZodOptional<z.ZodString>;
         eventMedia: z.ZodOptional<z.ZodString>;
+        backups: z.ZodOptional<z.ZodString>;
+        galleryMedia: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     throttleMbps: z.ZodNumber;
     moves: z.ZodArray<z.ZodObject<{
@@ -196,6 +338,8 @@ export declare const StorageMigrationJobSchema: z.ZodObject<{
             recordings: "recordings";
             recordingsLow: "recordingsLow";
             eventMedia: "eventMedia";
+            backups: "backups";
+            galleryMedia: "galleryMedia";
         }>;
         fromLocationId: z.ZodString;
         toLocationId: z.ZodString;
@@ -208,6 +352,13 @@ export declare const StorageMigrationJobSchema: z.ZodObject<{
             cancelled: "cancelled";
         }>>;
         error: z.ZodNullable<z.ZodString>;
+        progress: z.ZodNullable<z.ZodObject<{
+            filesMoved: z.ZodNumber;
+            filesTotal: z.ZodNullable<z.ZodNumber>;
+            bytesMoved: z.ZodNumber;
+            startedAt: z.ZodNumber;
+            observedAt: z.ZodNumber;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     pauseLeaseId: z.ZodNullable<z.ZodString>;
     pausedParticipants: z.ZodArray<z.ZodEnum<{
@@ -223,20 +374,233 @@ export declare const StorageMigrationJobSchema: z.ZodObject<{
     error: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type StorageMigrationJob = z.infer<typeof StorageMigrationJobSchema>;
+/**
+ * What the planner NOTICED but did not refuse.
+ *
+ * A refusal throws — the operator cannot miss it. A finding is the other half:
+ * something true about this plan that changes what the operator should expect,
+ * surfaced where they read it rather than in a document they will not open.
+ *
+ *  - `sharesDeviceWithSource` — the destination realpath's to the same place as
+ *    the source. The move will be a row re-stamp, not a byte move, and it buys
+ *    no redundancy. NOTE: this is PATH identity, not `st_dev` — two distinct
+ *    directories on one filesystem are NOT detected. See
+ *    `deviceIdentityUnknown`.
+ *  - `deviceIdentityUnknown` — a location carries a `nodeId` other than this
+ *    one (or has no `basePath`), so its realpath cannot be taken here and the
+ *    same-device question was not answered at all. Stated rather than assumed
+ *    clear: a check that silently never fires is worse than no check.
+ *  - `unstampedEventMediaRows` — how many `eventMedia`/retrain rows still carry
+ *    no `locationId`. Non-zero refuses a `nonBlocking` cutover.
+ *  - `blockingOnly` — this class is `cardinality: 'single'`, so it can never
+ *    span two locations and can only ever be moved stop-the-world.
+ *  - `noMover` — the class is selectable and planned, but no addon owns a mover
+ *    for it. The migration cannot move its bytes.
+ */
+export declare const StorageMigrationFindingCodeSchema: z.ZodEnum<{
+    sharesDeviceWithSource: "sharesDeviceWithSource";
+    deviceIdentityUnknown: "deviceIdentityUnknown";
+    unstampedEventMediaRows: "unstampedEventMediaRows";
+    blockingOnly: "blockingOnly";
+    noMover: "noMover";
+}>;
+export type StorageMigrationFindingCode = z.infer<typeof StorageMigrationFindingCodeSchema>;
+export declare const StorageMigrationFindingSchema: z.ZodObject<{
+    code: z.ZodEnum<{
+        sharesDeviceWithSource: "sharesDeviceWithSource";
+        deviceIdentityUnknown: "deviceIdentityUnknown";
+        unstampedEventMediaRows: "unstampedEventMediaRows";
+        blockingOnly: "blockingOnly";
+        noMover: "noMover";
+    }>;
+    storageClass: z.ZodEnum<{
+        recordings: "recordings";
+        recordingsLow: "recordingsLow";
+        eventMedia: "eventMedia";
+        backups: "backups";
+        galleryMedia: "galleryMedia";
+    }>;
+    message: z.ZodString;
+}, z.core.$strip>;
+export type StorageMigrationFinding = z.infer<typeof StorageMigrationFindingSchema>;
 export declare const StorageMigrationPlanSchema: z.ZodObject<{
     destinations: z.ZodObject<{
         recordings: z.ZodOptional<z.ZodString>;
         recordingsLow: z.ZodOptional<z.ZodString>;
         eventMedia: z.ZodOptional<z.ZodString>;
+        backups: z.ZodOptional<z.ZodString>;
+        galleryMedia: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
+    mode: z.ZodEnum<{
+        blocking: "blocking";
+        nonBlocking: "nonBlocking";
+    }>;
     moves: z.ZodArray<z.ZodObject<{
         storageClass: z.ZodEnum<{
             recordings: "recordings";
             recordingsLow: "recordingsLow";
             eventMedia: "eventMedia";
+            backups: "backups";
+            galleryMedia: "galleryMedia";
         }>;
         fromLocationId: z.ZodString;
         toLocationId: z.ZodString;
     }, z.core.$strip>>;
+    findings: z.ZodArray<z.ZodObject<{
+        code: z.ZodEnum<{
+            sharesDeviceWithSource: "sharesDeviceWithSource";
+            deviceIdentityUnknown: "deviceIdentityUnknown";
+            unstampedEventMediaRows: "unstampedEventMediaRows";
+            blockingOnly: "blockingOnly";
+            noMover: "noMover";
+        }>;
+        storageClass: z.ZodEnum<{
+            recordings: "recordings";
+            recordingsLow: "recordingsLow";
+            eventMedia: "eventMedia";
+            backups: "backups";
+            galleryMedia: "galleryMedia";
+        }>;
+        message: z.ZodString;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 export type StorageMigrationPlan = z.infer<typeof StorageMigrationPlanSchema>;
+/**
+ * Which single-flight engine owns a class of work.
+ *
+ * Shared rather than re-declared per consumer: the coordinator lanes its moves
+ * by it, and `storageMigration.movers` labels a mover with it so an operator
+ * can see *which* engine is busy when a drain refuses to start beside another.
+ */
+export declare const StorageMigrationLaneSchema: z.ZodEnum<{
+    media: "media";
+    footage: "footage";
+}>;
+export type StorageMigrationLane = z.infer<typeof StorageMigrationLaneSchema>;
+/**
+ * A mover as it exists RIGHT NOW, whether or not a migration job owns it.
+ *
+ * The coordinator's job record is the state of record for a migration, and its
+ * moves carry {@link StorageMigrationMoveProgress}. But the movers are usable
+ * standalone — `recording.relocateFootage` and `pipelineAnalytics.relocateMedia`
+ * are both operator-callable, and on 2026-08-29 a five-hour drain was armed that
+ * way because no supported UI path existed. A mover armed like that has no job
+ * to fold progress into, so it has to be readable on its own or it is invisible.
+ *
+ * `migrationJobId` is what tells the two apart: `null` means nothing here
+ * orchestrated it.
+ */
+export declare const StorageMigrationMoverSchema: z.ZodObject<{
+    lane: z.ZodEnum<{
+        media: "media";
+        footage: "footage";
+    }>;
+    job: z.ZodObject<{
+        jobId: z.ZodString;
+        state: z.ZodEnum<{
+            failed: "failed";
+            running: "running";
+            queued: "queued";
+            done: "done";
+            cancelled: "cancelled";
+        }>;
+        fromLocationId: z.ZodString;
+        toLocationId: z.ZodString;
+        deviceId: z.ZodNullable<z.ZodNumber>;
+        entities: z.ZodArray<z.ZodString>;
+        filesMoved: z.ZodNumber;
+        bytesMoved: z.ZodNumber;
+        filesTotal: z.ZodNullable<z.ZodNumber>;
+        startedAt: z.ZodNumber;
+        finishedAt: z.ZodNullable<z.ZodNumber>;
+        error: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    migrationJobId: z.ZodNullable<z.ZodString>;
+    observedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type StorageMigrationMover = z.infer<typeof StorageMigrationMoverSchema>;
+/**
+ * What a SOURCE still holds for one storage class — the number that makes a
+ * "drain remaining" action honest rather than hopeful.
+ *
+ * It comes from the archive (`SegmentHourLedger.census` for footage, the media
+ * engine's own selection count for media), never from the resident index: a
+ * drain sized off `RecordingIndex` is what reported `done` over 80.3 GB it had
+ * never been told about (D295).
+ *
+ * `items`/`bytes` are `null` for "the archive could not be asked", which is
+ * deliberately NOT zero: a drain is still offered for an unknown residue,
+ * because refusing on an unanswerable read would hide exactly the case an
+ * operator needs to act on.
+ */
+export declare const StorageMigrationResidueSchema: z.ZodObject<{
+    storageClass: z.ZodEnum<{
+        recordings: "recordings";
+        recordingsLow: "recordingsLow";
+        eventMedia: "eventMedia";
+        backups: "backups";
+        galleryMedia: "galleryMedia";
+    }>;
+    fromLocationId: z.ZodString;
+    toLocationId: z.ZodString;
+    items: z.ZodNullable<z.ZodNumber>;
+    bytes: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type StorageMigrationResidue = z.infer<typeof StorageMigrationResidueSchema>;
+/**
+ * Run the DRAIN half and nothing else.
+ *
+ * A migration that reached `done` has already repointed, so `start` correctly
+ * refuses its destination ("already the default") — there is nothing left to
+ * repoint. But the drain can fail, be cancelled, be interrupted by a restart,
+ * or finish against a work list that was a tenth of the archive (D295), and
+ * before this there was no supported way to run only that half: the only way
+ * through was calling `recording.relocateFootage` by hand over admin tRPC.
+ *
+ * `drain` NEVER calls `setDefaultLocations`. That is what keeps `start`'s
+ * refusal meaningful: the two verbs are disjoint, so nothing here can silently
+ * re-repoint a class that is already migrated.
+ */
+export declare const StorageMigrationDrainInputSchema: z.ZodObject<{
+    classes: z.ZodArray<z.ZodEnum<{
+        recordings: "recordings";
+        recordingsLow: "recordingsLow";
+        eventMedia: "eventMedia";
+        backups: "backups";
+        galleryMedia: "galleryMedia";
+    }>>;
+    throttleMbps: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type StorageMigrationDrainInput = z.infer<typeof StorageMigrationDrainInputSchema>;
+/** What a footage source still holds, asked of the durable hour ledger. */
+export declare const RelocateResidueInputSchema: z.ZodObject<{
+    fromLocationId: z.ZodString;
+    footageClass: z.ZodOptional<z.ZodEnum<{
+        recordings: "recordings";
+        recordingsLow: "recordingsLow";
+    }>>;
+}, z.core.$strip>;
+export type RelocateResidueInput = z.infer<typeof RelocateResidueInputSchema>;
+/** `null` = the archive could not answer (no ledger on this node, or the
+ *  aggregate failed). Never conflated with an empty source. */
+export declare const RelocateResidueSchema: z.ZodNullable<z.ZodObject<{
+    segments: z.ZodNumber;
+    bytes: z.ZodNumber;
+}, z.core.$strip>>;
+export type RelocateResidue = z.infer<typeof RelocateResidueSchema>;
+/** How many rows a media pass would still act on against a given target — the
+ *  media lane's denominator AND its residue, from ONE derivation so the two can
+ *  never disagree. `null` = the count could not be taken. */
+export declare const RelocatableMediaCountSchema: z.ZodNullable<z.ZodObject<{
+    rows: z.ZodNumber;
+}, z.core.$strip>>;
+export type RelocatableMediaCount = z.infer<typeof RelocatableMediaCountSchema>;
+export declare const RelocatableMediaCountInputSchema: z.ZodObject<{
+    toLocationId: z.ZodString;
+    mode: z.ZodOptional<z.ZodEnum<{
+        move: "move";
+        seal: "seal";
+        gallery: "gallery";
+    }>>;
+}, z.core.$strip>;
+export type RelocatableMediaCountInput = z.infer<typeof RelocatableMediaCountInputSchema>;