@camstack/addon-auth 1.2.31 → 1.2.32

package/dist/{dist-vL-NDuYW.js → dist-B6a8uEfA.js}

@@ -6629,7 +6629,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -6649,7 +6649,7 @@ function systemMethod(input, output, options) {
 }
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
-method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
+method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -6970,7 +6970,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 }({});
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
-method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
+method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
 /**
 * device-ops — device-scoped cap that unifies the per-IDevice operations
 * previously routed through the `.device-ops` Moleculer bridge service.
@@ -7715,24 +7715,6 @@ var RecordingRetentionSchema = object({
 	maxSizeGb: number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = _enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -7740,7 +7722,11 @@ var ScrubThumbnailPresetSchema = _enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -7763,14 +7749,7 @@ var RecordingConfigSchema = object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -7846,10 +7825,11 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-var StorageMigrationMediaMoveInputSchema = object({
+var RelocateMediaInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
-}).extend({ leaseId: string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -8144,7 +8124,26 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
-var ClassMapDefinitionSchema = object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
 	mapping: record(string(), _enum([
 		"person",
 		"vehicle",
@@ -8349,7 +8348,7 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8379,7 +8378,7 @@ var ModelConvertMetadataSchema = object({
 		"segmentation"
 	]),
 	faceAlignment: boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -9242,7 +9241,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly());
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -9501,7 +9500,20 @@ var addonWidgetsSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listWidgets: method(_void(), array(WidgetMetadataSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-widgets-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+	* only, never tRPC. The public, enriched listing admin-ui actually
+	* consumes is the separate `addon-widgets` cap (`listWidgets` there is
+	* gated separately, and a `preAuth: true` widget is surfaced through the
+	* PUBLIC `auth.listLoginMethods` contribution channel instead) —
+	* neither is affected by this change.
+	*/
+listWidgets: method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
@@ -11037,7 +11049,7 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
-method(_void(), array(CustomModelDescriptorSchema).readonly());
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" });
 /**
 * Query filter for settings-store collections.
 */
@@ -11124,7 +11136,8 @@ method(object({
 }), _void(), { kind: "mutation" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
 }), array(SettingsRecordSchema).readonly()), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -11187,46 +11200,87 @@ var EngineInfoSchema = object({
 	kind: _enum(["relational", "vector"]),
 	displayName: string()
 });
-method(_void(), EngineInfoSchema), method(object({
+method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+	filter: QueryFilterSchema.optional(),
+	/**
+	* SQL-level column projection — MUST mirror `settings-store.query`.
+	*
+	* ⚠ An earlier version of this comment blamed Zod stripping, and that
+	* was wrong — corrected 2026-08-26 after the hop map
+	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* There is **no Zod parse at all** between the door and the engine: the
+	* dispatcher forwards the payload verbatim and UDS carries it whole. A
+	* field declared here reaches `SqliteSettingsBackend` either way.
+	*
+	* What actually lost `columns` was the THIRD declaration of this shape:
+	* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+	* interface the engine destructures from. The field existed on both
+	* schemas and the engine still never read it, because nothing checks a
+	* registered provider against `InferProvider<cap>` —
+	* `ProviderRegistration.provider` is typed `object`.
+	*
+	* It is declared here anyway, and must stay in step with
+	* `settings-store.query`: a caller reading only the cap definitions has
+	* to be able to see that this call carries a projection.
+	* `data-door-schema-parity.spec.ts` keeps the two aligned.
+	*/
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11236,15 +11290,18 @@ method(_void(), EngineInfoSchema), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * shm ring usage stats for a `frameSink: 'shm'` decoder session —
 * exposed via `decoder.getShmStats` so downstream consumers can
@@ -12372,7 +12429,7 @@ method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
@@ -12665,19 +12722,22 @@ method(LlmGenerateBaseInputSchema.extend({
 	runtime: ManagedRuntimeConfigSchema,
 	/** The managed profile's timeout, threaded by the hub provider. */
 	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+}), LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+}), method(object({}), LlmRuntimeStatusSchema, { auth: "admin" }), method(object({ model: ManagedModelRefSchema }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
+}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" });
 /**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
@@ -16158,7 +16218,7 @@ var OauthIntegrationDescriptorSchema = object({
 	*/
 	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -17353,6 +17413,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -17507,6 +17576,11 @@ object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = object({
 	registryId: string().min(1),
 	id: string().min(1),
@@ -19672,7 +19746,7 @@ method(object({
 	* linking rather than produce an eternal token.
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
-}), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
+}), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -19767,10 +19841,13 @@ var EvictResultSchema = object({
 	/** True when the provider has nothing left it is willing to drop on this location. */
 	exhausted: boolean()
 });
-method(object({ locationId: string() }), EvictableUsageSchema), method(object({
+method(object({ locationId: string() }), EvictableUsageSchema, { auth: "admin" }), method(object({
 	locationId: string(),
 	targetBytes: number().int().positive()
-}), EvictResultSchema, { kind: "mutation" });
+}), EvictResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }), method(StorageMigrationInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -19830,26 +19907,50 @@ var ReadChunkInputSchema = object({
 	length: number()
 });
 var EndDownloadInputSchema = object({ downloadId: string() });
-method(_void(), ProviderInfoSchema), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
+method(_void(), ProviderInfoSchema, { auth: "admin" }), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationSchema }), number().nullable(), { auth: "admin" }), method(BeginUploadInputSchema, BeginUploadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(WriteChunkInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(FinalizeUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(AbortUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ReadChunkInputSchema, _instanceof(Uint8Array), { auth: "admin" }), method(EndDownloadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = unknown().nullable();
 var ProfileSettingsBagSchema = record(string(), unknown());
@@ -20113,9 +20214,28 @@ var userPasskeysCapability = {
 			auth: "admin",
 			access: "create"
 		}),
+		/**
+		* The four methods below had NO `auth` override — `internal: true` did
+		* not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+		* so they were reachable on the AppRouter at the default
+		* `auth: 'protected'` (any authenticated session), inconsistent with
+		* every other method on this cap (all already `auth: 'admin'`).
+		*
+		* ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+		* methods, so admin-gating them here must not break login for an
+		* unauthenticated principal. It doesn't — the real login path is the
+		* PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+		* `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+		* procedures in `server/backend/src/api/core/auth.router.ts`, which call
+		* `provider.beginAuthentication(...)` etc. directly against the
+		* capability-registry-resolved provider — never through this cap's own
+		* tRPC route. `auth: 'admin'` here only closes a redundant, unused
+		* second entry point onto the same ceremony.
+		*/
 		beginAuthentication: method(object({ userId: string().optional() }), object({ optionsJSON: record(string(), unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishAuthentication: method(object({
 			/** Required — the user the assertion belongs to (verified). */
@@ -20124,11 +20244,13 @@ var userPasskeysCapability = {
 			response: record(string(), unknown())
 		}), object({ verified: boolean() }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishDiscoverableAuthentication: method(object({ 
 		/** AuthenticationResponseJSON from the browser. */
@@ -20137,7 +20259,8 @@ response: record(string(), unknown()) }), object({
 			userId: string().nullable()
 		}), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
@@ -20315,7 +20438,19 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -22038,7 +22173,27 @@ var MediaFileLiteSchema$1 = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
-method(_void(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
+method(object({ 
+/**
+* Inline {@link IdentitySchema.coverBase64} on every row.
+*
+* Default `false`, the same inversion `listRecentFaces` and
+* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+* why the burden belongs on the caller that WANTS the bytes). Measured
+* on the live hub the same day: four identities cost 40,979 B with the
+* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+* four times and the viewer holds at `staleTime: 30_000`.
+*
+* Nothing loses its avatar: `coverMediaKey` is already on every row and
+* the `event-media` plane serves that key `immutable` with an ETag.
+*
+* **This is an INPUT field, so it does not reach the addon until the
+* next train** — the hub router validates cap inputs against its own
+* compiled Zod and strips a key it does not know. Until then the
+* provider sees `undefined`, which resolves to `false`: the cheap shape
+* is what ships, and the opt-in becomes reachable when the train lands.
+*/
+includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -24185,8 +24340,10 @@ var PlateInfoSchema = object({
 	keyFrameMediaKey: string().optional(),
 	base64: string().optional(),
 	/**
-	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
-	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	* Same crop as a data-plane URL, always present when the plate has a stored
+	* crop. `getPlateByTrack` returns this and never inlines JPEG; `listPlates`
+	* and `searchPlates` inline the crop only when their `includeCrops` input is
+	* left at its `true` default.
 	*/
 	cropUrl: string().optional()
 });
@@ -24206,14 +24363,34 @@ var PlateClusterSchema = object({
 });
 method(object({
 	deviceId: number().int().optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link PlateInfo.cropUrl}.
+	* Measured on the live hub at the 500 rows the Plates view asks for:
+	* 879,403 B and 27.7 s with the crops inline, against a few KiB of
+	* metadata without them — and the browser then caches the images.
+	*
+	* This is the plate twin of `faceGallery.listRecentFaces`'s option;
+	* plates were the one gallery list left without it.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod and strips a key it does not know. Until the train
+	* ships, sending `false` is harmless and keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(PlateInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()
 }), PlateInfoSchema.nullable()), method(object({ plateId: string() }), array(MediaFileLiteSchema).readonly()), method(object({
 	text: string().min(1),
 	maxDistance: number().int().min(0).optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/** See `listPlates.includeCrops`. Default `true`. */
+	includeCrops: boolean().optional()
 }), array(PlateInfoSchema).readonly()), method(object({
 	maxDistance: number().int().min(0).optional(),
 	minClusterSize: number().int().min(2).optional(),
@@ -24227,7 +24404,13 @@ method(object({
 }), method(object({ plateId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
+}), method(object({ 
+/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+*  INPUT field: stripped by the hub router until the train ships, which
+*  resolves to `false` and is exactly the intended default. */
+includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -29604,6 +29787,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29778,6 +29967,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29856,6 +30051,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",