@camstack/types 1.2.246 → 1.2.247

package/dist/capabilities/recording-archive.cap.d.ts

@@ -0,0 +1,1123 @@
+/**
+ * `recording-archive` — OUR archive, and the intent that fills it.
+ *
+ * The system-singleton half of the 2026-09-24 cut (D625). `recording` used to
+ * be one 33-method system singleton holding two unrelated subjects: three
+ * per-camera READS about coverage and playback, and everything else — storage
+ * locations, retention, relocation, rebalance, the ops log, the placement
+ * table and the byte-plane primitives our scrub and export are built on.
+ *
+ * The reads became a device-scoped COLLECTION, so a camera's own card can be a
+ * source beside ours (`recording.cap.ts`). Everything that is about OUR store,
+ * or unimplementable by a camera, stayed here.
+ *
+ * ## On the name
+ *
+ * `recording-storage` was the obvious choice and is wrong: this cap also holds
+ * `getDeviceConfig`/`setDeviceConfig`, which are recording INTENT — bands,
+ * retention, the D62 switch authority — and a name that says "storage" invites
+ * the next reader to move them out again. An archive is a thing we keep, and
+ * what we keep it under is a policy; the name covers both halves honestly and
+ * sits in the existing family (`recording-onboard`, `recording-export`,
+ * `recording-signal`).
+ *
+ * ## What must NOT happen to it
+ *
+ * It stays a SINGLETON. It is registered by `recorder`, which is
+ * `placement: 'any-node'` and runs on every recording node; the hub dispatches
+ * to one of them. Putting the ledger, the placement table or the relocation
+ * jobs behind a fan-out is the one genuinely dangerous move in this cut.
+ *
+ * `getDeviceConfig` / `setDeviceConfig` in particular are the D62 recording
+ * authority (`CameraSwitch.authority`). If a write reached a different provider
+ * than the read — which a collection fan-out permits — two authorities would
+ * decide when one camera records, and the symptom (recording silently off, or
+ * a `bands` array clobbered by a partial write) is durable and silent. Keeping
+ * them here means the worst case during a rollout is a 412: the switch refuses
+ * to flip and SAYS so. **Do not move them into the collection, at any point,
+ * for any reason.**
+ *
+ * ## The two batch reads
+ *
+ * `getAvailabilityBatch` / `getDaysWithRecordingsBatch` take `deviceIds:
+ * number[]` with no single `deviceId`, and a device-scoped mount routes
+ * through `getProviderForDevice(deviceId)` — there is nothing for it to route
+ * on. They stay here, and on this cap the batch is explicitly OURS: a grid has
+ * no per-camera picker, and a caller that wants another source's coverage asks
+ * `recording.getAvailability` per device with that source's `provider`.
+ */
+import { z } from 'zod';
+import { type InferProvider } from './capability-definition.js';
+export declare const RecordingStatusSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    enabled: z.ZodBoolean;
+    activeMode: z.ZodEnum<{
+        events: "events";
+        off: "off";
+        continuous: "continuous";
+        "on-device-decision": "on-device-decision";
+    }>;
+    nodeId: z.ZodString;
+    storageBytes: z.ZodNumber;
+}, z.core.$strip>;
+export type RecordingStatus = z.infer<typeof RecordingStatusSchema>;
+/**
+ * Most cameras one `getAvailabilityBatch` / `getDaysWithRecordingsBatch` may
+ * name.
+ *
+ * Matches the ceiling the per-camera batches elsewhere in the system carry
+ * (`pipelineAnalytics.getKeyEventsBatch`, `sceneMonitor.listScenesBatch`): a
+ * grid is tens of cameras, never hundreds, and each id costs the recorder one
+ * calendar walk whose answer crosses a process boundary.
+ *
+ * The ceiling is on the SCHEMA. An over-eager ask is REFUSED, never truncated
+ * to the first {@link RECORDING_TIMELINE_BATCH_MAX} ids — a truncated answer
+ * looks exactly like a complete one, and the caller would draw an empty
+ * timeline for the cameras it never learned were dropped.
+ */
+export declare const RECORDING_TIMELINE_BATCH_MAX = 200;
+/**
+ * One camera's row in a `getAvailabilityBatch` answer.
+ *
+ * `ranges` is EXACTLY what `recording.getAvailability` returns for that camera
+ * at OUR source — the batch collapses the transport, not the work — plus the
+ * `read` mark the singular answer now carries too (D625):
+ *
+ *  - `read: 'read'` — answered. `ranges: []` means "read, and this camera has
+ *    no footage in the window", which is a real claim.
+ *  - `read: 'unreadable'` — the recorder could not answer for this camera (its
+ *    calendar rung threw, its location is unmounted). `ranges` is empty and
+ *    that emptiness means NOTHING.
+ *
+ * A timeline that renders the second as the first tells an operator there is no
+ * footage when the truth is that nobody looked.
+ */
+export declare const RecordingAvailabilityForDeviceSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    read: z.ZodEnum<{
+        read: "read";
+        unreadable: "unreadable";
+    }>;
+    ranges: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        profile: z.ZodString;
+        startMs: z.ZodNumber;
+        endMs: z.ZodNumber;
+    }, z.core.$strip>>>;
+    profilesWithFootage: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type RecordingAvailabilityForDevice = z.infer<typeof RecordingAvailabilityForDeviceSchema>;
+/**
+ * One camera's row in a `getDaysWithRecordingsBatch` answer. Same rule as
+ * {@link RecordingAvailabilityForDeviceSchema}: `days: []` on a `'read'` row is
+ * "no footage in this month", `read: 'unreadable'` is "nobody could look", and
+ * the date-picker's day dots must not spell them the same.
+ */
+export declare const RecordingDaysForDeviceSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    read: z.ZodEnum<{
+        read: "read";
+        unreadable: "unreadable";
+    }>;
+    days: z.ZodReadonly<z.ZodArray<z.ZodNumber>>;
+}, z.core.$strip>;
+export type RecordingDaysForDevice = z.infer<typeof RecordingDaysForDeviceSchema>;
+/**
+ * Recording storage usage for one camera — what the ARCHIVE holds for it,
+ * across every profile and every resolvable location on this node.
+ *
+ * ## Archive vs residency, which is the whole point of this shape (D418)
+ *
+ * `usedBytes` / `oldestMs` / `segments` are the durable hour ledger's numbers:
+ * the same quantity `RecordingLocationUsage.usedBytes` reports for the volume
+ * this camera writes to, so the two can be added up and compared.
+ *
+ * They were not always. Until D418 this row came from the recorder's in-RAM
+ * `RecordingIndex`, which since D287 holds only the live tail plus the hours
+ * somebody hydrated — so a hub with 1.9 TB and 3.3 days of footage reported
+ * 60.5 GB and "oldest: three hours ago" on the same page as the volume row
+ * that said otherwise, and two people read it as retention eating recent
+ * footage. Residency is still reported, under `residentBytes` /
+ * `residentOldestMs`, which answer a different question and say so.
+ */
+export declare const RecordingDeviceUsageSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    usedBytes: z.ZodNumber;
+    oldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    segments: z.ZodOptional<z.ZodNumber>;
+    residentBytes: z.ZodOptional<z.ZodNumber>;
+    residentOldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>;
+export type RecordingDeviceUsage = z.infer<typeof RecordingDeviceUsageSchema>;
+/** Recording storage usage + capacity for one storage location. */
+export declare const RecordingLocationUsageSchema: z.ZodObject<{
+    locationId: z.ZodNullable<z.ZodString>;
+    locationIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    root: z.ZodOptional<z.ZodString>;
+    usedBytes: z.ZodNumber;
+    availableBytes: z.ZodNullable<z.ZodNumber>;
+    totalBytes: z.ZodNullable<z.ZodNumber>;
+}, z.core.$strip>;
+export type RecordingLocationUsage = z.infer<typeof RecordingLocationUsageSchema>;
+/** Aggregate recordings storage usage for a node: global total + per-camera +
+ *  per-location used/available. Stat-based (accurate even for detached cameras),
+ *  computed on demand — not from the name-only playback index. */
+export declare const RecordingStorageUsageSchema: z.ZodObject<{
+    nodeId: z.ZodString;
+    totalUsedBytes: z.ZodNumber;
+    devices: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        usedBytes: z.ZodNumber;
+        oldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        segments: z.ZodOptional<z.ZodNumber>;
+        residentBytes: z.ZodOptional<z.ZodNumber>;
+        residentOldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>>;
+    devicesRead: z.ZodOptional<z.ZodEnum<{
+        unavailable: "unavailable";
+        archive: "archive";
+    }>>;
+    locations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        locationId: z.ZodNullable<z.ZodString>;
+        locationIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        root: z.ZodOptional<z.ZodString>;
+        usedBytes: z.ZodNumber;
+        availableBytes: z.ZodNullable<z.ZodNumber>;
+        totalBytes: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type RecordingStorageUsage = z.infer<typeof RecordingStorageUsageSchema>;
+/**
+ * The OPERATOR-ARMED half of multi-location recordings (D116).
+ *
+ * The placement plan decides where NEW writes go and moves nothing. A rebalance
+ * is the operator asking for the EXISTING archive to be brought into line with
+ * that plan: one relocate job per (camera, profile) pile that sits on the wrong
+ * location, run FIFO behind the single-flight mover.
+ *
+ * `plan…` and `start…` return the SAME shape deliberately — what the operator
+ * confirms is exactly what gets enqueued, and `jobIds` is the only difference
+ * (empty on the plan).
+ */
+export declare const RecordingRebalanceMoveSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    profile: z.ZodString;
+    fromLocationId: z.ZodString;
+    toLocationId: z.ZodString;
+    bytes: z.ZodNumber;
+    files: z.ZodNumber;
+}, z.core.$strip>;
+export type RecordingRebalanceMove = z.infer<typeof RecordingRebalanceMoveSchema>;
+/** Why a pile that is out of place is staying there. Every refusal is
+ *  reported: a rebalance that silently drops a camera reads exactly like one
+ *  that had nothing to do. */
+export declare const RecordingRebalanceSkipReasonSchema: z.ZodEnum<{
+    unassigned: "unassigned";
+    "below-threshold": "below-threshold";
+    "target-not-writable": "target-not-writable";
+    "no-headroom": "no-headroom";
+}>;
+export type RecordingRebalanceSkipReason = z.infer<typeof RecordingRebalanceSkipReasonSchema>;
+export declare const RecordingRebalanceSkipSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    profile: z.ZodString;
+    fromLocationId: z.ZodString;
+    toLocationId: z.ZodNullable<z.ZodString>;
+    bytes: z.ZodNumber;
+    reason: z.ZodEnum<{
+        unassigned: "unassigned";
+        "below-threshold": "below-threshold";
+        "target-not-writable": "target-not-writable";
+        "no-headroom": "no-headroom";
+    }>;
+}, z.core.$strip>;
+export type RecordingRebalanceSkip = z.infer<typeof RecordingRebalanceSkipSchema>;
+export declare const RecordingRebalancePlanSchema: z.ZodObject<{
+    moves: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        profile: z.ZodString;
+        fromLocationId: z.ZodString;
+        toLocationId: z.ZodString;
+        bytes: z.ZodNumber;
+        files: z.ZodNumber;
+    }, z.core.$strip>>;
+    skipped: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        profile: z.ZodString;
+        fromLocationId: z.ZodString;
+        toLocationId: z.ZodNullable<z.ZodString>;
+        bytes: z.ZodNumber;
+        reason: z.ZodEnum<{
+            unassigned: "unassigned";
+            "below-threshold": "below-threshold";
+            "target-not-writable": "target-not-writable";
+            "no-headroom": "no-headroom";
+        }>;
+    }, z.core.$strip>>;
+    bytesToMove: z.ZodNumber;
+    jobIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type RecordingRebalancePlan = z.infer<typeof RecordingRebalancePlanSchema>;
+export declare const RecordingRebalanceInputSchema: z.ZodObject<{
+    throttleMbps: z.ZodOptional<z.ZodNumber>;
+    minMoveGb: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type RecordingRebalanceInput = z.infer<typeof RecordingRebalanceInputSchema>;
+/**
+ * Operator-facing placement of one camera onto a recordings location.
+ *
+ * `pinLocationId` is the operator instruction: a location id, or `null` for
+ * Auto (the planner may move this camera). `locationId` is where high/mid
+ * currently write — the plan, which may disagree with the pin when Auto.
+ */
+export declare const RecordingDevicePlacementSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    profile: z.ZodString;
+    locationId: z.ZodString;
+}, z.core.$strip>;
+export type RecordingDevicePlacement = z.infer<typeof RecordingDevicePlacementSchema>;
+export declare const RecordingDevicePinSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    locationId: z.ZodString;
+}, z.core.$strip>;
+export type RecordingDevicePin = z.infer<typeof RecordingDevicePinSchema>;
+export declare const RecordingPlacementViewSchema: z.ZodObject<{
+    assignments: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        profile: z.ZodString;
+        locationId: z.ZodString;
+    }, z.core.$strip>>;
+    pins: z.ZodArray<z.ZodObject<{
+        deviceId: z.ZodNumber;
+        locationId: z.ZodString;
+    }, z.core.$strip>>;
+    defaultLocations: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+export type RecordingPlacementView = z.infer<typeof RecordingPlacementViewSchema>;
+export declare const RecordingSetDevicePlacementInputSchema: z.ZodObject<{
+    deviceId: z.ZodNumber;
+    locationId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type RecordingSetDevicePlacementInput = z.infer<typeof RecordingSetDevicePlacementInputSchema>;
+/**
+ * Result of locating footage at a wall-clock instant for one device/profile.
+ * `segment` carries the covering segment's window; `gap` reports the forward
+ * nearest covered edge (`null` past the end of footage / when none exists)
+ * and the backward covered edge `prevEndMs` (exclusive end of the nearest
+ * footage behind the epoch; `null` when none — optional so older providers
+ * that omit it stay valid). `prevEndMs` lets a backward frame-step hop the
+ * small inter-segment cracks (durMs under-covers the span to the next
+ * startMs by ~11-17 ms) instead of no-opping at a segment head.
+ */
+export declare const LocateSegmentResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"segment">;
+    startMs: z.ZodNumber;
+    durMs: z.ZodNumber;
+    bytes: z.ZodNumber;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"gap">;
+    nearestEdgeMs: z.ZodNullable<z.ZodNumber>;
+    prevEndMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+}, z.core.$strip>], "kind">;
+export type LocateSegmentResult = z.infer<typeof LocateSegmentResultSchema>;
+/** Raw bytes of one finalized footage segment (read off disk on the recording node). */
+export declare const ReadSegmentBytesResultSchema: z.ZodObject<{
+    data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+}, z.core.$strip>;
+export type ReadSegmentBytesResult = z.infer<typeof ReadSegmentBytesResultSchema>;
+/**
+ * One GOP of a finalized segment, cut by byte range through the segment's own
+ * `mfra` (D31 on the D42 feeder path). `data` is the `ftyp`+`moov` head plus
+ * the single `moof`+`mdat` covering the requested instant — standalone-
+ * demuxable, never the whole file. When the segment's index cannot be parsed
+ * the provider degrades INSIDE the mechanism to the whole segment (still one
+ * `data`, `gopStartMs` = the segment start) — a worse read, not another path.
+ */
+export declare const ReadGopBytesResultSchema: z.ZodObject<{
+    data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+    gopStartMs: z.ZodNumber;
+    gopDurMs: z.ZodNumber;
+}, z.core.$strip>;
+export type ReadGopBytesResult = z.infer<typeof ReadGopBytesResultSchema>;
+/**
+ * A time WINDOW of one finalized segment, cut by byte range — the multi-GOP
+ * twin of {@link ReadGopBytesResultSchema}'s single instant. Built for the
+ * replay clip's `recording` source (`docs/design/plans/2026-08-26-replay-clip-su-pipeline.md`):
+ * a replay needs several seconds of native pixels, not one frame.
+ *
+ * `ok.data` is standalone-demuxable, same as a GOP read. `ok.reachesRequestedEnd`
+ * is `false` when the returned bytes were cut short by the read's own safety
+ * byte cap before covering `[fromMs, toMs)` — a truncation, reported, not a
+ * silently shorter answer. `spans-multiple-segments` is a REFUSAL, not a
+ * degradation: a window whose end falls past the covering segment would need
+ * bytes stitched from a second segment file (its own `ftyp`+`moov`), which is
+ * not one standalone-demuxable stream — the caller's answer is to request a
+ * shorter window or one aligned to a single segment, not to receive spliced
+ * bytes nothing has proven decodable.
+ */
+export declare const ReadWindowBytesResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"ok">;
+    data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+    gopStartMs: z.ZodNumber;
+    gopDurMs: z.ZodNumber;
+    reachesRequestedEnd: z.ZodBoolean;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"spans-multiple-segments">;
+    segmentEndMs: z.ZodNumber;
+}, z.core.$strip>], "kind">;
+export type ReadWindowBytesResult = z.infer<typeof ReadWindowBytesResultSchema>;
+export declare const recordingArchiveCapability: {
+    readonly name: "recording-archive";
+    readonly scope: "system";
+    readonly mode: "singleton";
+    /** Moves here with the config pair — the derived Recording settings
+     *  section is a view over `getDeviceConfig`/`setDeviceConfig` (D14), and
+     *  those did not move (D625). */
+    readonly exposesDeviceSettings: true;
+    readonly status: {
+        readonly schema: z.ZodObject<{
+            deviceId: z.ZodNumber;
+            enabled: z.ZodBoolean;
+            activeMode: z.ZodEnum<{
+                events: "events";
+                off: "off";
+                continuous: "continuous";
+                "on-device-decision": "on-device-decision";
+            }>;
+            nodeId: z.ZodString;
+            storageBytes: z.ZodNumber;
+        }, z.core.$strip>;
+        readonly kind: "command-driven";
+    };
+    readonly methods: {
+        /**
+         * `recording.getAvailability` for a SET of cameras, in one round trip, at
+         * OUR source.
+         *
+         * A multi-camera timeline re-asks availability for every camera in the grid
+         * on every day change; fanned out that is one request per camera for N
+         * independent calendar walks. The per-camera work is IDENTICAL (the same
+         * `availabilityProfileFor` + `rangesIn`, run concurrently inside the
+         * recorder) — only the transport collapses.
+         *
+         * It lives on the ARCHIVE, not on the `recording` collection, because it
+         * takes `deviceIds` with no single `deviceId` and a device-scoped mount has
+         * nothing to route on (D625 §10.2). The consequence is stated rather than
+         * hidden: the batch answers for OURS. A caller that needs another source's
+         * coverage asks `recording.getAvailability` per device, naming that
+         * source's provider.
+         *
+         * `protected` for the same reason the singular method is: every id in
+         * `deviceIds` is a device reference, so the F1 #3 gate refuses any camera
+         * outside the caller's scope — one id out of scope refuses the CALL, it
+         * does not quietly drop a row.
+         *
+         * Every requested id gets a row, marked — see
+         * {@link RecordingAvailabilityForDeviceSchema}. `deviceIds` is capped at
+         * {@link RECORDING_TIMELINE_BATCH_MAX} and an over-cap ask is refused.
+         */
+        readonly getAvailabilityBatch: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceIds: z.ZodArray<z.ZodNumber>;
+            fromMs: z.ZodNumber;
+            toMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            read: z.ZodEnum<{
+                read: "read";
+                unreadable: "unreadable";
+            }>;
+            ranges: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                profile: z.ZodString;
+                startMs: z.ZodNumber;
+                endMs: z.ZodNumber;
+            }, z.core.$strip>>>;
+            profilesWithFootage: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * `recording.getDaysWithRecordings` for a SET of cameras, in one round
+         * trip, at OUR source. Same placement argument as
+         * {@link getAvailabilityBatch}.
+         *
+         * The cheapest question in the product, asked once per camera per month
+         * change. One directory read per day per camera at the owner, unchanged;
+         * what collapses is the N requests it took to ask.
+         *
+         * Every requested id gets a row, marked — see
+         * {@link RecordingDaysForDeviceSchema}. `deviceIds` is capped at
+         * {@link RECORDING_TIMELINE_BATCH_MAX} and an over-cap ask is refused.
+         */
+        readonly getDaysWithRecordingsBatch: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceIds: z.ZodArray<z.ZodNumber>;
+            fromMs: z.ZodNumber;
+            toMs: z.ZodNumber;
+            tzOffsetMinutes: z.ZodNumber;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            read: z.ZodEnum<{
+                read: "read";
+                unreadable: "unreadable";
+            }>;
+            days: z.ZodReadonly<z.ZodArray<z.ZodNumber>>;
+        }, z.core.$strip>>>, "query">;
+        readonly getStorageUsage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            nodeId: z.ZodString;
+            totalUsedBytes: z.ZodNumber;
+            devices: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                usedBytes: z.ZodNumber;
+                oldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                segments: z.ZodOptional<z.ZodNumber>;
+                residentBytes: z.ZodOptional<z.ZodNumber>;
+                residentOldestMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            }, z.core.$strip>>;
+            devicesRead: z.ZodOptional<z.ZodEnum<{
+                unavailable: "unavailable";
+                archive: "archive";
+            }>>;
+            locations: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                locationId: z.ZodNullable<z.ZodString>;
+                locationIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                root: z.ZodOptional<z.ZodString>;
+                usedBytes: z.ZodNumber;
+                availableBytes: z.ZodNullable<z.ZodNumber>;
+                totalBytes: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>, "query">;
+        /**
+         * READ the camera's recording intent.
+         *
+         * `protected`, not `admin`, since 2026-09-21. It is the only per-camera
+         * source of the recording mode the viewer has, and the camera status dot
+         * asks for it on a screen every read-only user sees. As `admin` it answered
+         * FORBIDDEN, the viewer collapsed that to `null` and `null` to `'off'`, and
+         * a recording camera was drawn GREEN — a failed measurement rendered as a
+         * value (D315, D393, D590). It carries schedules and retention, no secret,
+         * and the per-device gate in `scope-access.ts` still applies; `setDeviceConfig`
+         * stays `admin`.
+         *
+         * It is a SINGLETON method and stays one (D625 §16.2): it is the D62
+         * recording authority, and an authority that several providers could answer
+         * is the "two knobs over one decision" D62 forbids.
+         */
+        readonly getDeviceConfig: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodOptional<z.ZodEnum<{
+                events: "events";
+                off: "off";
+                continuous: "continuous";
+                "on-device-decision": "on-device-decision";
+            }>>;
+            profiles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>>;
+            segmentSeconds: z.ZodOptional<z.ZodNumber>;
+            bands: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                days: z.ZodArray<z.ZodNumber>;
+                start: z.ZodString;
+                end: z.ZodString;
+                mode: z.ZodEnum<{
+                    events: "events";
+                    continuous: "continuous";
+                }>;
+                audio: z.ZodOptional<z.ZodEnum<{
+                    muted: "muted";
+                    on: "on";
+                }>>;
+                triggers: z.ZodOptional<z.ZodObject<{
+                    motion: z.ZodOptional<z.ZodBoolean>;
+                    audioThresholdDbfs: z.ZodOptional<z.ZodNumber>;
+                    objectClasses: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        person: "person";
+                        vehicle: "vehicle";
+                        animal: "animal";
+                    }>>>;
+                    sensorDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+                }, z.core.$strip>>;
+                preBufferSec: z.ZodOptional<z.ZodNumber>;
+                postBufferSec: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>>;
+            deviceDecision: z.ZodOptional<z.ZodBoolean>;
+            retention: z.ZodOptional<z.ZodObject<{
+                maxAgeDays: z.ZodOptional<z.ZodNumber>;
+                maxSizeGb: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>, "query">;
+        /** Locate footage at a wall-clock instant: the covering segment's window,
+         *  or a gap with the forward nearest covered edge. Used by a feeder running
+         *  in another addon process to seek recorded footage over tRPC.
+         *
+         *  BYTE PLANE: defined by `mfra` byte ranges over OUR own MP4 segment tree.
+         *  There is no vendor-neutral statement of it, its only callers are feeders
+         *  in other addon processes (the stream broker, the replay-clip source),
+         *  and an onboard source that ever needs bytes delegates to the
+         *  `videoclips` transport its vendor already has (D625 §9.3, §10.5). */
+        readonly locateSegment: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            profile: z.ZodString;
+            epochMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"segment">;
+            startMs: z.ZodNumber;
+            durMs: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"gap">;
+            nearestEdgeMs: z.ZodNullable<z.ZodNumber>;
+            prevEndMs: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        }, z.core.$strip>], "kind">, "query">;
+        /** Read one finalized segment's raw bytes by its exact `startMs`. Used by a
+         *  feeder running in another addon process to pull recorded footage over tRPC. */
+        readonly readSegmentBytes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            profile: z.ZodString;
+            startMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+        }, z.core.$strip>, "query">;
+        /** Read the single GOP of segment `startMs` covering `epochMs`, by mfra
+         *  byte range — the scrub-granular read (D31 letter on the feeder path).
+         *  See {@link ReadGopBytesResultSchema} for the degradation contract. */
+        readonly readGopBytes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            profile: z.ZodString;
+            startMs: z.ZodNumber;
+            epochMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+            gopStartMs: z.ZodNumber;
+            gopDurMs: z.ZodNumber;
+        }, z.core.$strip>, "query">;
+        /** Read a WINDOW `[fromMs, toMs)` of segment `startMs`, by mfra byte
+         *  range — the multi-GOP twin of `readGopBytes`. Refuses (does not
+         *  degrade) when the window runs past the covering segment. Used by the
+         *  replay clip's `recording` source to fetch several seconds of native
+         *  footage for its single ffmpeg decode pass. */
+        readonly readWindowBytes: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            profile: z.ZodString;
+            startMs: z.ZodNumber;
+            fromMs: z.ZodNumber;
+            toMs: z.ZodNumber;
+        }, z.core.$strip>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"ok">;
+            data: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
+            gopStartMs: z.ZodNumber;
+            gopDurMs: z.ZodNumber;
+            reachesRequestedEnd: z.ZodBoolean;
+        }, z.core.$strip>, z.ZodObject<{
+            kind: z.ZodLiteral<"spans-multiple-segments">;
+            segmentEndMs: z.ZodNumber;
+        }, z.core.$strip>], "kind">, "query">;
+        readonly setDeviceConfig: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            config: z.ZodObject<{
+                enabled: z.ZodBoolean;
+                mode: z.ZodOptional<z.ZodEnum<{
+                    events: "events";
+                    off: "off";
+                    continuous: "continuous";
+                    "on-device-decision": "on-device-decision";
+                }>>;
+                profiles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    high: "high";
+                    mid: "mid";
+                    low: "low";
+                }>>>;
+                segmentSeconds: z.ZodOptional<z.ZodNumber>;
+                bands: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                    days: z.ZodArray<z.ZodNumber>;
+                    start: z.ZodString;
+                    end: z.ZodString;
+                    mode: z.ZodEnum<{
+                        events: "events";
+                        continuous: "continuous";
+                    }>;
+                    audio: z.ZodOptional<z.ZodEnum<{
+                        muted: "muted";
+                        on: "on";
+                    }>>;
+                    triggers: z.ZodOptional<z.ZodObject<{
+                        motion: z.ZodOptional<z.ZodBoolean>;
+                        audioThresholdDbfs: z.ZodOptional<z.ZodNumber>;
+                        objectClasses: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            person: "person";
+                            vehicle: "vehicle";
+                            animal: "animal";
+                        }>>>;
+                        sensorDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+                    }, z.core.$strip>>;
+                    preBufferSec: z.ZodOptional<z.ZodNumber>;
+                    postBufferSec: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>>;
+                deviceDecision: z.ZodOptional<z.ZodBoolean>;
+                retention: z.ZodOptional<z.ZodObject<{
+                    maxAgeDays: z.ZodOptional<z.ZodNumber>;
+                    maxSizeGb: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>>;
+            }, z.core.$strict>;
+        }, z.core.$strip>, z.ZodObject<{
+            enabled: z.ZodBoolean;
+            mode: z.ZodOptional<z.ZodEnum<{
+                events: "events";
+                off: "off";
+                continuous: "continuous";
+                "on-device-decision": "on-device-decision";
+            }>>;
+            profiles: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                high: "high";
+                mid: "mid";
+                low: "low";
+            }>>>;
+            segmentSeconds: z.ZodOptional<z.ZodNumber>;
+            bands: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                days: z.ZodArray<z.ZodNumber>;
+                start: z.ZodString;
+                end: z.ZodString;
+                mode: z.ZodEnum<{
+                    events: "events";
+                    continuous: "continuous";
+                }>;
+                audio: z.ZodOptional<z.ZodEnum<{
+                    muted: "muted";
+                    on: "on";
+                }>>;
+                triggers: z.ZodOptional<z.ZodObject<{
+                    motion: z.ZodOptional<z.ZodBoolean>;
+                    audioThresholdDbfs: z.ZodOptional<z.ZodNumber>;
+                    objectClasses: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                        person: "person";
+                        vehicle: "vehicle";
+                        animal: "animal";
+                    }>>>;
+                    sensorDeviceIds: z.ZodOptional<z.ZodArray<z.ZodNumber>>;
+                }, z.core.$strip>>;
+                preBufferSec: z.ZodOptional<z.ZodNumber>;
+                postBufferSec: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>>;
+            deviceDecision: z.ZodOptional<z.ZodBoolean>;
+            retention: z.ZodOptional<z.ZodObject<{
+                maxAgeDays: z.ZodOptional<z.ZodNumber>;
+                maxSizeGb: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strict>, "mutation">;
+        /** Re-scan this device's footage from disk (stat sizes) and reseed the
+         *  index, then return the fresh status. */
+        readonly rescanStorage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+        }, z.core.$strip>, z.ZodObject<{
+            deviceId: z.ZodNumber;
+            enabled: z.ZodBoolean;
+            activeMode: z.ZodEnum<{
+                events: "events";
+                off: "off";
+                continuous: "continuous";
+                "on-device-decision": "on-device-decision";
+            }>;
+            nodeId: z.ZodString;
+            storageBytes: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        /** Apply this device's retention policy to footage now; returns the oldest
+         *  surviving footage start (the retention floor) or null if no footage. The
+         *  prune is logged to the recordings ops-log with `reason` (default
+         *  `'retention'` — the policy-driven prune; `'quota'` when disk-pressure
+         *  triggered). */
+        readonly pruneFootage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            reason: z.ZodOptional<z.ZodEnum<{
+                retention: "retention";
+                quota: "quota";
+                manual: "manual";
+                operator: "operator";
+                maintenance: "maintenance";
+                "orphaned-device": "orphaned-device";
+            }>>;
+        }, z.core.$strip>, z.ZodObject<{
+            floorMs: z.ZodNullable<z.ZodNumber>;
+            deletedBuckets: z.ZodNumber;
+            reclaimedBytes: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * Manually delete a camera's footage — the whole footprint, or a
+         * `[fromMs, toMs)` window when either bound is given. Logged to the
+         * recordings ops-log as `op:'manual-delete', reason:'manual'`. Destructive:
+         * the admin UI guards it behind a confirm.
+         */
+        readonly deleteFootprint: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            fromMs: z.ZodOptional<z.ZodNumber>;
+            toMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            deletedBuckets: z.ZodNumber;
+            reclaimedBytes: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        /** The recordings ops-log rows (newest-first), optionally scoped to one
+         *  camera. Backed by the recorder's bounded DurableState ring. */
+        readonly listOpsLog: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            limit: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            at: z.ZodNumber;
+            domain: z.ZodEnum<{
+                recording: "recording";
+                events: "events";
+            }>;
+            op: z.ZodEnum<{
+                prune: "prune";
+                "manual-delete": "manual-delete";
+                rescan: "rescan";
+                "retention-run": "retention-run";
+                relocate: "relocate";
+                "orphan-audit": "orphan-audit";
+            }>;
+            reason: z.ZodEnum<{
+                retention: "retention";
+                quota: "quota";
+                manual: "manual";
+                operator: "operator";
+                maintenance: "maintenance";
+                "orphaned-device": "orphaned-device";
+            }>;
+            deviceId: z.ZodNullable<z.ZodNumber>;
+            nodeId: z.ZodString;
+            itemsAffected: z.ZodNumber;
+            bytesReclaimed: z.ZodNumber;
+            detail: z.ZodNullable<z.ZodString>;
+            actor: z.ZodString;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * Render a short GIF from recorded footage around `aroundMs` (low profile,
+         * palette-free ffmpeg gif). Synchronous — the window is a few seconds of
+         * `low`, rendering in ~1-2s. Built for notification attachments: the
+         * caller gets bytes, nothing persists. Fails when no footage covers the
+         * window (camera not recording → caller skips the attachment).
+         */
+        readonly renderGif: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            aroundMs: z.ZodNumber;
+            preRollSec: z.ZodDefault<z.ZodNumber>;
+            postRollSec: z.ZodDefault<z.ZodNumber>;
+            maxWidth: z.ZodDefault<z.ZodNumber>;
+            fps: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            gifBase64: z.ZodString;
+            fromMs: z.ZodNumber;
+            toMs: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * Render a short MP4 clip from recorded footage around `aroundMs` — the
+         * "send a clip, not a gif" notification attachment. Same window, source
+         * and fail-closed contract as {@link renderGif}: no footage covering the
+         * window ⇒ it throws and the caller ships no attachment. Re-encoded (never
+         * stream-copied) so a concat across segments with different encoder
+         * parameters still plays. Silent by contract.
+         *
+         * The returned window is SEGMENT-GRANULAR: the source playlist is built
+         * from whole segments, so the clip starts at or before `fromMs` and ends
+         * at or after `toMs` — overshoot bounded by one segment per side (an 8 s
+         * ask over 4 s segments measured 12 s). `fromMs`/`toMs` report the window
+         * ASKED for, not the encoded duration.
+         */
+        readonly renderClip: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            aroundMs: z.ZodNumber;
+            preRollSec: z.ZodDefault<z.ZodNumber>;
+            postRollSec: z.ZodDefault<z.ZodNumber>;
+            maxWidth: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            clipBase64: z.ZodString;
+            mime: z.ZodString;
+            fromMs: z.ZodNumber;
+            toMs: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strip>, "mutation">;
+        /** Internal migration-participant lease. Blocks new recorder attaches and
+         * waits for writers to exit while their watchers index final segments. */
+        readonly pauseForStorageMigration: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            leaseId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            paused: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        readonly resumeForStorageMigration: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            leaseId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            resumed: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        /** Re-resolve location roots after the coordinator changes defaults. */
+        readonly refreshStorageLocationsForMigration: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            leaseId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            refreshed: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+        /** Internal mover, callable only by the storage-migration coordinator. */
+        readonly startStorageMigrationMove: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            fromLocationId: z.ZodString;
+            toLocationId: z.ZodString;
+            entities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                segments: "segments";
+            }>>>;
+            footageClass: z.ZodOptional<z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+            }>>;
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            throttleMbps: z.ZodOptional<z.ZodNumber>;
+            sinceMs: z.ZodOptional<z.ZodNumber>;
+            leaseId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, "mutation">;
+        readonly getStorageMigrationMoveStatus: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            jobId: z.ZodString;
+            state: z.ZodEnum<{
+                queued: "queued";
+                running: "running";
+                done: "done";
+                failed: "failed";
+                cancelled: "cancelled";
+            }>;
+            fromLocationId: z.ZodString;
+            toLocationId: z.ZodString;
+            deviceId: z.ZodNullable<z.ZodNumber>;
+            entities: z.ZodArray<z.ZodString>;
+            filesMoved: z.ZodNumber;
+            bytesMoved: z.ZodNumber;
+            filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
+            rowsForgotten: z.ZodOptional<z.ZodNumber>;
+            startedAt: z.ZodNumber;
+            finishedAt: z.ZodNullable<z.ZodNumber>;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>, import("./capability-definition.js").CapabilityMethodKind>;
+        readonly cancelStorageMigrationMove: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            cancelled: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * Move footage between locations — the OPERATOR's mover, scoped to one
+         * camera (and optionally to specific profiles) rather than a whole disk.
+         * Queued FIFO behind the single-flight engine, so arming several is safe.
+         */
+        readonly relocateFootage: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            fromLocationId: z.ZodString;
+            toLocationId: z.ZodString;
+            entities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                segments: "segments";
+            }>>>;
+            footageClass: z.ZodOptional<z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+            }>>;
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            throttleMbps: z.ZodOptional<z.ZodNumber>;
+            sinceMs: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, "mutation">;
+        /** Every relocate job this recorder knows about, newest first (in RAM: the
+         *  move is resumable, so a lost list costs nothing but the display). */
+        readonly listRelocateJobs: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodReadonly<z.ZodArray<z.ZodObject<{
+            jobId: z.ZodString;
+            state: z.ZodEnum<{
+                queued: "queued";
+                running: "running";
+                done: "done";
+                failed: "failed";
+                cancelled: "cancelled";
+            }>;
+            fromLocationId: z.ZodString;
+            toLocationId: z.ZodString;
+            deviceId: z.ZodNullable<z.ZodNumber>;
+            entities: z.ZodArray<z.ZodString>;
+            filesMoved: z.ZodNumber;
+            bytesMoved: z.ZodNumber;
+            filesTotal: z.ZodNullable<z.ZodNumber>;
+            rowsReconciled: z.ZodOptional<z.ZodNumber>;
+            rowsForgotten: z.ZodOptional<z.ZodNumber>;
+            startedAt: z.ZodNumber;
+            finishedAt: z.ZodNullable<z.ZodNumber>;
+            error: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>>, "query">;
+        /**
+         * What a location STILL holds, asked of the durable hour ledger.
+         *
+         * The number behind "drain remaining": segments and bytes that would still
+         * have to move off `fromLocationId`. It is a ledger aggregate — the archive
+         * — because the resident index is not the archive (D295), and a drain sized
+         * off the index is exactly what reported `done` over 80.3 GB on 2026-08-29.
+         * `null` means the archive could not be asked (no ledger on this node, or
+         * the aggregate failed) and is never conflated with an empty source.
+         */
+        readonly getRelocateResidue: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            fromLocationId: z.ZodString;
+            footageClass: z.ZodOptional<z.ZodEnum<{
+                recordings: "recordings";
+                recordingsLow: "recordingsLow";
+            }>>;
+        }, z.core.$strip>, z.ZodNullable<z.ZodObject<{
+            segments: z.ZodNumber;
+            bytes: z.ZodNumber;
+        }, z.core.$strip>>, "query">;
+        /**
+         * Does this location's LEDGER tell the truth about its disk? (D319)
+         *
+         * One `readdir` per claimed hour, diffed both ways: durable rows whose file
+         * is not there, and files no durable row names. `apply` defaults to FALSE —
+         * the report is the product, and the dry run is how an operator
+         * sanity-checks the destructive run before authorising it.
+         *
+         * REFUSES a source that is still a write target: a listing of a live
+         * location is a lower bound, which is not the strong evidence that lets
+         * this pass forget without a budget. A live location is reconciled by the
+         * mover, under D318's bound.
+         */
+        readonly reconcileLedgerAgainstDisk: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            locationId: z.ZodString;
+            apply: z.ZodOptional<z.ZodBoolean>;
+            deviceId: z.ZodOptional<z.ZodNumber>;
+            profiles: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>, z.ZodObject<{
+            locationId: z.ZodString;
+            applied: z.ZodBoolean;
+            refused: z.ZodNullable<z.ZodEnum<{
+                "location-unknown": "location-unknown";
+                "source-writable": "source-writable";
+                "no-ledger": "no-ledger";
+                "archive-unreadable": "archive-unreadable";
+                "anchor-absent": "anchor-absent";
+                "anchor-unreadable": "anchor-unreadable";
+                "anchor-moved": "anchor-moved";
+            }>>;
+            archiveSegments: z.ZodNullable<z.ZodNumber>;
+            archiveBytes: z.ZodNullable<z.ZodNumber>;
+            hoursClaimed: z.ZodNumber;
+            hoursWalked: z.ZodNumber;
+            hoursMissing: z.ZodNumber;
+            listings: z.ZodNumber;
+            segmentsClaimed: z.ZodNumber;
+            ghostSegments: z.ZodNumber;
+            ghostBytes: z.ZodNumber;
+            ghostHoursWhole: z.ZodNumber;
+            forgottenSegments: z.ZodNumber;
+            forgottenBytes: z.ZodNumber;
+            orphanFiles: z.ZodNumber;
+            orphanSample: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+            hoursSkipped: z.ZodNumber;
+            skippedByReason: z.ZodObject<{
+                'live-tail': z.ZodNumber;
+                'listing-error': z.ZodNumber;
+                'path-mismatch': z.ZodNumber;
+                'durable-refused': z.ZodNumber;
+            }, z.core.$strip>;
+            bounded: z.ZodBoolean;
+            byDevice: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                hoursWalked: z.ZodNumber;
+                hoursMissing: z.ZodNumber;
+                ghostSegments: z.ZodNumber;
+                ghostBytes: z.ZodNumber;
+                forgottenSegments: z.ZodNumber;
+                orphanFiles: z.ZodNumber;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>, "mutation">;
+        /** Cancel a running or queued relocate job. A queued job never runs. */
+        readonly cancelRelocateJob: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            jobId: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            cancelled: z.ZodBoolean;
+        }, z.core.$strip>, "mutation">;
+        /** What a rebalance WOULD move, and what it would refuse. Moves nothing. */
+        readonly planStorageRebalance: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            throttleMbps: z.ZodOptional<z.ZodNumber>;
+            minMoveGb: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            moves: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                profile: z.ZodString;
+                fromLocationId: z.ZodString;
+                toLocationId: z.ZodString;
+                bytes: z.ZodNumber;
+                files: z.ZodNumber;
+            }, z.core.$strip>>;
+            skipped: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                profile: z.ZodString;
+                fromLocationId: z.ZodString;
+                toLocationId: z.ZodNullable<z.ZodString>;
+                bytes: z.ZodNumber;
+                reason: z.ZodEnum<{
+                    unassigned: "unassigned";
+                    "below-threshold": "below-threshold";
+                    "target-not-writable": "target-not-writable";
+                    "no-headroom": "no-headroom";
+                }>;
+            }, z.core.$strip>>;
+            bytesToMove: z.ZodNumber;
+            jobIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>, "query">;
+        /** Arm the rebalance: enqueue one relocate job per planned move. */
+        readonly startStorageRebalance: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            throttleMbps: z.ZodOptional<z.ZodNumber>;
+            minMoveGb: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>, z.ZodObject<{
+            moves: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                profile: z.ZodString;
+                fromLocationId: z.ZodString;
+                toLocationId: z.ZodString;
+                bytes: z.ZodNumber;
+                files: z.ZodNumber;
+            }, z.core.$strip>>;
+            skipped: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                profile: z.ZodString;
+                fromLocationId: z.ZodString;
+                toLocationId: z.ZodNullable<z.ZodString>;
+                bytes: z.ZodNumber;
+                reason: z.ZodEnum<{
+                    unassigned: "unassigned";
+                    "below-threshold": "below-threshold";
+                    "target-not-writable": "target-not-writable";
+                    "no-headroom": "no-headroom";
+                }>;
+            }, z.core.$strip>>;
+            bytesToMove: z.ZodNumber;
+            jobIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>, "mutation">;
+        /**
+         * The placement plan in force plus operator pins. Drives the Locations
+         * admin page: Auto vs a named recordings location, per camera.
+         */
+        readonly getPlacement: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{}, z.core.$strip>, z.ZodObject<{
+            assignments: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                profile: z.ZodString;
+                locationId: z.ZodString;
+            }, z.core.$strip>>;
+            pins: z.ZodArray<z.ZodObject<{
+                deviceId: z.ZodNumber;
+                locationId: z.ZodString;
+            }, z.core.$strip>>;
+            defaultLocations: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>, "query">;
+        /**
+         * Pin a camera to a recordings location, or clear the pin (Auto). High and
+         * mid follow the pin; low stays with the recordingsLow planner.
+         */
+        readonly setDevicePlacement: import("./capability-definition.js").CapabilityMethodSchema<z.ZodObject<{
+            deviceId: z.ZodNumber;
+            locationId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>, z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>, "mutation">;
+    };
+};
+export type IRecordingArchiveProvider = InferProvider<typeof recordingArchiveCapability>;