@camstack/addon-osd-manager 0.1.20 → 0.1.22

package/dist/index.js

@@ -5804,6 +5804,13 @@ var BaseAddon = class {
 	_readinessGeneration = typeof crypto !== "undefined" && crypto.randomUUID ? crypto.randomUUID() : Math.random().toString(36).slice(2, 14);
 	/** Capability names this addon registered at init — used to emit matching `down` events on shutdown. */
 	_registeredCapNames = [];
+	/**
+	* True only after `readAddonStore` actually answered. Constructor
+	* defaults look like stored config when the store is down — a forked
+	* addon that auto-starts from those defaults (cloudflare-tunnel quick
+	* mode, 2026-08-25) is not "the operator chose this".
+	*/
+	settingsStoreReady = false;
 	/** Default config values. Provided via constructor. */
 	defaults;
 	constructor(defaults) {
@@ -6204,7 +6211,9 @@ var BaseAddon = class {
 		];
 		let lastErr;
 		for (let attempt = 0; attempt <= delaysMs.length; attempt++) try {
-			return await settings.readAddonStore() ?? {};
+			const stored = await settings.readAddonStore() ?? {};
+			this.settingsStoreReady = true;
+			return stored;
 		} catch (err) {
 			lastErr = err;
 			const msg = err instanceof Error ? err.message : String(err);
@@ -6212,6 +6221,7 @@ var BaseAddon = class {
 			if (attempt === delaysMs.length) break;
 			await new Promise((r) => setTimeout(r, delaysMs[attempt]));
 		}
+		this.settingsStoreReady = false;
 		this._ctx?.logger?.warn?.("readAddonStore: settings-store unavailable after retries — using defaults", { meta: { error: lastErr instanceof Error ? lastErr.message : String(lastErr) } });
 		return {};
 	}
@@ -6623,7 +6633,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -6653,8 +6663,17 @@ var adminUiCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
-		getStaticDir: method(_void(), StaticDirOutputSchema$1),
-		getVersion: method(_void(), VersionOutputSchema$1)
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — both methods were reachable on the AppRouter
+		* by ANY authenticated session at the default `auth: 'protected'`, and
+		* `getStaticDir` leaks a hub filesystem path. The only caller is
+		* `main.ts`'s static-file bootstrap, via `capRegistry.getSingletonForNode`
+		* — never tRPC — so `auth: 'admin'` costs it nothing. The actual admin-ui
+		* SPA assets are served as plain static files, unaffected by this gate.
+		*/
+		getStaticDir: method(_void(), StaticDirOutputSchema$1, { auth: "admin" }),
+		getVersion: method(_void(), VersionOutputSchema$1, { auth: "admin" })
 	}
 };
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
@@ -6990,8 +7009,23 @@ var viewerUiCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
-		getStaticDir: method(_void(), StaticDirOutputSchema),
-		getVersion: method(_void(), VersionOutputSchema)
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — both methods were reachable on the AppRouter
+		* by ANY authenticated session at the default `auth: 'protected'`, and
+		* `getStaticDir` leaks a hub filesystem path.
+		*
+		* ⚠ Checked before gating: the VIEWER app IS used by a non-admin user
+		* (`roberta`), but it never calls `viewerUi.*` over tRPC. The static SPA
+		* it loads is served by the plain `GET /viewer/*` Fastify route in
+		* `main.ts`, which reads `staticDir`/`indexPath` from a module-level
+		* cache populated ONCE at boot via `capRegistry.getSingletonForNode`
+		* (in-process, not tRPC) — the cap's tRPC procedure is never on that
+		* request path. `auth: 'admin'` here does not block a single viewer
+		* user from loading the app.
+		*/
+		getStaticDir: method(_void(), StaticDirOutputSchema, { auth: "admin" }),
+		getVersion: method(_void(), VersionOutputSchema, { auth: "admin" })
 	}
 };
 /**
@@ -7666,24 +7700,6 @@ var RecordingRetentionSchema = object({
 	maxSizeGb: number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = _enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -7691,7 +7707,11 @@ var ScrubThumbnailPresetSchema = _enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -7714,14 +7734,7 @@ var RecordingConfigSchema = object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -7797,10 +7810,11 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-var StorageMigrationMediaMoveInputSchema = object({
+var RelocateMediaInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
-}).extend({ leaseId: string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -8095,7 +8109,26 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
-var ClassMapDefinitionSchema = object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
 	mapping: record(string(), _enum([
 		"person",
 		"vehicle",
@@ -8187,6 +8220,12 @@ var ModelVariantGroupSchema = object({
 	*/
 	resolution: number().int().positive().optional()
 });
+var ModelProviderIdSchema = _enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 var ModelCatalogEntrySchema = object({
 	id: string(),
 	name: string(),
@@ -8284,11 +8323,17 @@ var ModelCatalogEntrySchema = object({
 	*/
 	group: ModelVariantGroupSchema.optional(),
 	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
 	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8318,7 +8363,7 @@ var ModelConvertMetadataSchema = object({
 		"segmentation"
 	]),
 	faceAlignment: boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -9191,7 +9236,18 @@ var addonPagesSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listPages: method(_void(), array(AddonPageDeclarationSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
 };
 var AddonHttpRouteSchema = object({
 	method: _enum([
@@ -9488,7 +9544,20 @@ var addonWidgetsSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listWidgets: method(_void(), array(WidgetMetadataSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-widgets-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+	* only, never tRPC. The public, enriched listing admin-ui actually
+	* consumes is the separate `addon-widgets` cap (`listWidgets` there is
+	* gated separately, and a `preAuth: true` widget is surfaced through the
+	* PUBLIC `auth.listLoginMethods` contribution channel instead) —
+	* neither is affected by this change.
+	*/
+listWidgets: method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
@@ -11652,7 +11721,17 @@ var customModelRegistryCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listModels: method(_void(), array(CustomModelDescriptorSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the detection-pipeline's model resolution
+	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+	* never tRPC — so `auth: 'admin'` costs it nothing.
+	*/
+listModels: method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * Query filter for settings-store collections.
@@ -11776,11 +11855,26 @@ var settingsStoreCapability = {
 			key: string(),
 			value: unknown()
 		}), _void(), { kind: "mutation" }),
-		/** Get all entries matching an optional filter. */
+		/**
+		* Rows matching a filter.
+		*
+		* `columns` is a SQL-level projection: the engine SELECTs only those
+		* columns (plus the primary key) instead of the whole row. It is the only
+		* way to stop paying disk for a column that is discarded — a heavy JSON
+		* column dominates the row, and dropping it in JS after the read pays every
+		* byte first. Measured on the live `pipeline-analytics:tracks` table: a
+		* 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+		* plan.
+		*
+		* The engine REFUSES a column it cannot serve rather than omitting it —
+		* see `SettingsQueryInput.columns` for why a projection may not be
+		* forgiving the way a predicate is.
+		*/
 		query: method(object({
 			namespace: string().optional(),
 			collection: string(),
-			filter: QueryFilterSchema.optional()
+			filter: QueryFilterSchema.optional(),
+			columns: array(string()).readonly().optional()
 		}), array(SettingsRecordSchema).readonly()),
 		/** Insert a new record. */
 		insert: method(object({
@@ -11906,6 +12000,23 @@ var EngineInfoSchema = object({
 * go through `settings-store`; they never see this cap, and an engine
 * never sees a caller.
 *
+* ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+* comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+* cap was live on the AppRouter with every method at the default
+* `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+* not. Verified against the live hub: `dataStoreProvider.query` returned raw
+* settings rows including a provider credential, bypassing the secret redaction
+* that `deviceManager.listAll` and friends go through.
+*
+* Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+* they had no options object at all, which is exactly how they kept the
+* permissive default while the mutations looked deliberate. The explicit
+* annotation is the fix that works today; making `internal` mean something at
+* mount time is the systemic one, and it is not free: 22 caps declare it, only
+* 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+* of surfaces the viewer and admin-ui call as non-admin users. That decision is
+* the operator's, not a side effect of this file.
+*
 * Design notes:
 *   - **Stateless dispatch.** Every method carries its own
 *     `namespace` + `collection`, so an engine keeps no per-caller state
@@ -11927,64 +12038,105 @@ var dataStoreProviderCapability = {
 	internal: true,
 	methods: {
 		/** Self-description — how the orchestrator picks a registrant. */
-		getEngineInfo: method(_void(), EngineInfoSchema),
+		getEngineInfo: method(_void(), EngineInfoSchema, { auth: "admin" }),
 		/** Get a single value by key from a collection. */
 		get: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			key: string()
-		}), unknown()),
+		}), unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			key: string(),
 			value: unknown()
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Get all entries matching an optional filter. */
 		query: method(object({
 			namespace: string().optional(),
 			collection: string(),
-			filter: QueryFilterSchema.optional()
-		}), array(SettingsRecordSchema).readonly()),
+			filter: QueryFilterSchema.optional(),
+			/**
+			* SQL-level column projection — MUST mirror `settings-store.query`.
+			*
+			* ⚠ An earlier version of this comment blamed Zod stripping, and that
+			* was wrong — corrected 2026-08-26 after the hop map
+			* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+			* There is **no Zod parse at all** between the door and the engine: the
+			* dispatcher forwards the payload verbatim and UDS carries it whole. A
+			* field declared here reaches `SqliteSettingsBackend` either way.
+			*
+			* What actually lost `columns` was the THIRD declaration of this shape:
+			* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+			* interface the engine destructures from. The field existed on both
+			* schemas and the engine still never read it, because nothing checks a
+			* registered provider against `InferProvider<cap>` —
+			* `ProviderRegistration.provider` is typed `object`.
+			*
+			* It is declared here anyway, and must stay in step with
+			* `settings-store.query`: a caller reading only the cap definitions has
+			* to be able to see that this call carries a projection.
+			* `data-door-schema-parity.spec.ts` keeps the two aligned.
+			*/
+			columns: array(string()).readonly().optional()
+		}), array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/** Insert a new record. */
 		insert: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			record: SettingsRecordSchema
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			id: string(),
 			data: record(string(), unknown())
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			key: string()
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete every record matching `filter`, in one statement. */
 		deleteWhere: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			filter: MutationFilterSchema
-		}), object({ deleted: number().int() }), { kind: "mutation" }),
+		}), object({ deleted: number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Apply `data` to every record matching `filter`, in one statement. */
 		updateWhere: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			filter: MutationFilterSchema,
 			data: record(string(), unknown())
-		}), object({ updated: number().int() }), { kind: "mutation" }),
+		}), object({ updated: number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			filter: QueryFilterSchema.optional()
-		}), number()),
+		}), number(), { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(object({
 			namespace: string().optional(),
@@ -11996,19 +12148,22 @@ var dataStoreProviderCapability = {
 		}), array(object({
 			bucket: number().int(),
 			count: number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: method(object({
 			namespace: string().optional(),
 			collection: string()
-		}), boolean()),
+		}), boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
 		declareCollection: method(object({
 			namespace: string().optional(),
 			collection: string(),
 			columns: array(CollectionColumnSchema).readonly(),
 			indexes: array(CollectionIndexSchema).readonly().optional()
-		}), _void(), { kind: "mutation" })
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -12884,6 +13039,27 @@ var LinkedDeviceSchema = object({
 	features: array(string()),
 	producesTrackedEvents: boolean().optional()
 });
+/** One camera's resolved linked set, tagged with the camera it belongs to.
+*  The batch answer needs the tag; the single-device answer already has it
+*  from the input, which is why `getLinkedDevices` keeps the untagged shape. */
+var LinkedDevicesForDeviceSchema = object({
+	deviceId: number(),
+	mode: LinkedDevicesModeSchema,
+	devices: array(LinkedDeviceSchema)
+});
+/** One device's binding map — the shape `getBindings`, `getBindingsBatch` and
+*  `getAllBindings` all answer in. Declared once: three copies of the same
+*  object literal is exactly how the three drift apart. */
+var DeviceBindingsForDeviceSchema = object({
+	deviceId: number(),
+	entries: array(object({
+		capName: string(),
+		kind: _enum(["native", "wrapped"]),
+		providerAddonId: string(),
+		providerNodeId: string(),
+		nativeAddonId: string()
+	}))
+});
 var SavedDeviceRowSchema = object({
 	/** Numeric id reserved at allocateDeviceId time. */
 	id: number(),
@@ -13246,7 +13422,21 @@ var deviceManagerCapability = {
 			projection: _enum(["full", "slim"]).optional(),
 			/** Return only camera devices. Filtering server-side instead of
 			*  shipping 293 rows to find 12. */
-			isCamera: boolean().optional()
+			isCamera: boolean().optional(),
+			/**
+			* Return only these device ids. For the caller that already KNOWS the
+			* handful it wants and needs a field the id-bearing answer does not
+			* carry — the viewer's linked-devices panel joins `type` and `online`
+			* onto ~8 linked ids and, unfiltered, dragged the fleet across to do
+			* it: 433 KB slim / 958 KB full for 967 devices, on a query that
+			* refetches on the reconcile interval, on a phone.
+			*
+			* Safe to send at a hub that predates it: Zod STRIPS unknown input
+			* keys rather than rejecting them (verified against the live hub
+			* 2026-08-25 — 967 rows came back), so an old hub answers exactly what
+			* it answers today and the caller filters as it already does.
+			*/
+			deviceIds: array(number()).optional()
 		}), array(DeviceInfoSchema)),
 		/** Get a single device by numeric deviceId. */
 		getDevice: method(object({ deviceId: number() }), DeviceInfoSchema.nullable()),
@@ -13265,6 +13455,23 @@ var deviceManagerCapability = {
 			mode: LinkedDevicesModeSchema,
 			devices: array(LinkedDeviceSchema)
 		})),
+		/**
+		* `getLinkedDevices` for MANY cameras, in one call.
+		*
+		* Not a convenience wrapper — a cost fix. Resolving one camera's linked set
+		* needs the whole fleet as candidates (children ∪ same-location), so the
+		* single-device path runs a full `listAll` per call. Asked per camera that
+		* is N full-fleet sweeps of device-manager's event loop, and they do not
+		* overlap: measured on the live hub 2026-08-25, 30 concurrent
+		* `getLinkedDevices` took 4110 ms wall (median 4060 ms each) to return
+		* 7260 bytes in total. The batch takes ONE sweep and one settings read per
+		* camera.
+		*
+		* A device id that resolves to nothing still gets a row (`devices: []`) —
+		* a caller that asked for thirty and got twenty-eight cannot tell which two
+		* are missing, or that any are.
+		*/
+		getLinkedDevicesBatch: method(object({ deviceIds: array(number()) }), array(LinkedDevicesForDeviceSchema)),
 		/** Get stream sources for a camera device. */
 		getStreamSources: method(object({ deviceId: number() }), array(StreamSourceEntrySchema$1)),
 		/** Get config entries (key + value + description) for a device. */
@@ -13322,16 +13529,22 @@ var deviceManagerCapability = {
 		* currently-active provider (native or wrapper) + the underlying native
 		* addon id, so consumers can decide routing without re-running discovery.
 		*/
-		getBindings: method(object({ deviceId: number() }), object({
-			deviceId: number(),
-			entries: array(object({
-				capName: string(),
-				kind: _enum(["native", "wrapped"]),
-				providerAddonId: string(),
-				providerNodeId: string(),
-				nativeAddonId: string()
-			}))
-		})),
+		getBindings: method(object({ deviceId: number() }), DeviceBindingsForDeviceSchema),
+		/**
+		* `getBindings` for a NAMED set of devices, in one call.
+		*
+		* Between `getBindings` (one device) and `getAllBindings` (all 988) there
+		* was nothing, so a caller that needs seventy-five either pays
+		* seventy-five round-trips or drags the whole fleet across. Measured on
+		* the live hub 2026-08-25: 75 concurrent `getBindings` = 1211 ms / 118 KB,
+		* `getAllBindings({})` = 511 ms / 679 KB. Neither is the right answer to
+		* "these seventy-five".
+		*
+		* Same resolver, same routing rules, same per-device shape as
+		* `getBindings`; ids are deduped and a device with no bindings answers
+		* `entries: []` rather than dropping out.
+		*/
+		getBindingsBatch: method(object({ deviceIds: array(number()) }), array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Return the binding map for every device known to the hub. Used by
 		* `SystemManager` warm-boot: a single round-trip resolves the
@@ -13340,16 +13553,7 @@ var deviceManagerCapability = {
 		* device add/remove) — clients invalidate via the
 		* `capability.binding-changed` event.
 		*/
-		getAllBindings: method(object({}), array(object({
-			deviceId: number(),
-			entries: array(object({
-				capName: string(),
-				kind: _enum(["native", "wrapped"]),
-				providerAddonId: string(),
-				providerNodeId: string(),
-				nativeAddonId: string()
-			}))
-		}))),
+		getAllBindings: method(object({}), array(DeviceBindingsForDeviceSchema)),
 		/**
 		* Activate (or deactivate) a wrapper addon for a (device, cap) pair.
 		* Persists the binding via ctx.settings. active=false clears the wrapper
@@ -13759,13 +13963,20 @@ var embeddingEncoderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — every method below was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+		* `addon-post-analysis`, never tRPC.
+		*/
 		encode: method(object({
 			crop: _instanceof(Uint8Array),
 			width: number(),
 			height: number()
-		}), EmbeddingResultSchema),
-		encodeText: method(object({ text: string() }), EmbeddingResultSchema),
-		getInfo: method(_void(), EmbeddingInfoSchema)
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		encodeText: method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }),
+		getInfo: method(_void(), EmbeddingInfoSchema, { auth: "admin" })
 	}
 };
 /**
@@ -14074,12 +14285,28 @@ var llmRuntimeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
+		/**
+		* `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+		* `auth` override — `internal: true` did not gate the mount (see the
+		* 2026-08-26 note on `data-store-provider`), so they were reachable on
+		* the AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`, inconsistent with the rest of this cap (already
+		* `auth: 'admin'`) and with this file's own docblock: "the operator
+		* reaches this only through the `llm` cap's methods." The sole caller,
+		* `addon-ai`'s `runtime-client.ts`, reaches every method here via
+		* `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+		* nothing; the public `llm` cap (which end users and non-admin sessions
+		* legitimately call for chat/generation) is untouched.
+		*/
 		complete: method(LlmGenerateBaseInputSchema.extend({
 			images: array(LlmImageSchema).optional(),
 			runtime: ManagedRuntimeConfigSchema,
 			/** The managed profile's timeout, threaded by the hub provider. */
 			timeoutMs: number().int().positive().optional()
-		}), LlmGenerateResultSchema, { kind: "mutation" }),
+		}), LlmGenerateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		ensureStarted: method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -14088,7 +14315,7 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		status: method(object({}), LlmRuntimeStatusSchema),
+		status: method(object({}), LlmRuntimeStatusSchema, { auth: "admin" }),
 		installModel: method(object({ model: ManagedModelRefSchema }), _void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -14097,8 +14324,8 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listLocalModels: method(object({}), array(LlmNodeModelSchema)),
-		getDiskUsage: method(object({}), LlmRuntimeDiskUsageSchema)
+		listLocalModels: method(object({}), array(LlmNodeModelSchema), { auth: "admin" }),
+		getDiskUsage: method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" })
 	}
 };
 /**
@@ -16237,12 +16464,15 @@ var NcOccupancyConditionSchema = object({
 * there is no second switch that can disagree with the first and every rule
 * authored before the decision migrates for free (`audioModeOf`):
 *
-*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
-*    classifier labels with one of them. No window, no percentage:
-*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
-*    `throttle` cooldown is the only brake. The per-label confidence floor is
-*    the analyzer's (`classificationMinScore`, per device) — a label only
-*    reaches this condition if the classifier was already confident enough.
+*  - **LABEL mode — `labels` present.** The rule fires when `confirmHits`
+*    labelled frames land inside `confirmWindowSec` (default 2 in 5 s).
+*    `hitPercent` and `samplingSeconds` are still ignored — a percentage of
+*    frames is the wrong question for a classifier that labels 1–3 frames
+*    per episode. The count window is the brake that drops a single-frame
+*    false positive; the rule's own `throttle` cooldown is the other. The
+*    per-label confidence floor is the analyzer's (`classificationMinScore`,
+*    per device) — a label only reaches this condition if the classifier was
+*    already confident enough. `confirmHits: 1` restores first-frame fire.
 *  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
 *    the condition: at least `hitPercent`% of the samples over
 *    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
@@ -16269,14 +16499,22 @@ var NcOccupancyConditionSchema = object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = object({
-	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+	/** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
 	labels: array(string().min(1)).min(1).optional(),
 	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: number().min(-96).max(0).optional(),
 	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: number().int().min(1).max(100).default(60),
 	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
-	samplingSeconds: number().int().min(1).max(300).default(10)
+	samplingSeconds: number().int().min(1).max(300).default(10),
+	/**
+	* LABEL MODE: how many labelled frames must land inside
+	* {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+	* Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+	*/
+	confirmHits: number().int().min(1).max(20).optional(),
+	/** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+	confirmWindowSec: number().int().min(1).max(60).optional()
 });
 /**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
@@ -18353,7 +18591,17 @@ var oauthIntegrationCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+	* by ANY authenticated session at the default `auth: 'protected'`. The
+	* real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+	* (`oauth2-routes.ts`), which resolve the provider directly off the
+	* capability registry — never through tRPC. `auth: 'admin'` closes the
+	* tRPC surface without touching that path.
+	*/
+getDescriptor: method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
@@ -19201,6 +19449,46 @@ var RecentTracksPageSchema = object({
 	/** Cursor for the next page, or null when this page is the last. */
 	nextCursor: string().nullable()
 });
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = object({
+	id: string(),
+	deviceId: number().int(),
+	openedAt: number().int(),
+	closedAt: number().int(),
+	timestamp: number().int(),
+	memberCount: number().int(),
+	memberTrackIds: array(string()).readonly(),
+	className: string(),
+	classes: array(string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: string().nullable(),
+	singleton: boolean()
+});
+var AnalyticsGroupMemberSchema = object({
+	trackId: string(),
+	deviceId: number().int(),
+	className: string(),
+	firstSeen: number().int(),
+	lastSeen: number().int(),
+	mediaUrl: string().nullable()
+});
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: array(number()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional()
+});
+var ListGroupsPageSchema = object({
+	groups: array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: string().nullable()
+});
 var KeyEventQueryInput = object({
 	deviceId: number(),
 	/** Window lower bound (track firstSeen ≥ since). */
@@ -19276,7 +19564,9 @@ var TrackCascadeCountsSchema = object({
 	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
 	plates: number().int(),
 	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: number().int()
+	embeddings: number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: number().int()
 });
 /** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
 var DiskReconcileCountsSchema = object({
@@ -19448,6 +19738,16 @@ var pipelineAnalyticsCapability = {
 		* are not included (same contract as `listTracks`).
 		*/
 		listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
+		/**
+		* Batched co-moving group listing — the Groups feed. Same merge/cursor
+		* contract as {@link listRecentTracks}. A group is a sealed partition of
+		* one session; `getGroup` is the detail with members.
+		*/
+		listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
+		getGroup: method(object({
+			deviceId: number(),
+			groupId: string().min(1)
+		}), AnalyticsGroupDetailSchema.nullable()),
 		clearTracks: method(object({ deviceId: number() }), _void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -19700,6 +20000,29 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Moves event media between locations — the OPERATOR's mover, without the
+		* coordinator's lease. Twin of `recording.relocateFootage`: the same
+		* engine the lease-gated coordinated migration uses
+		* (`startStorageMigrationMove`), armable in the background and WITHOUT
+		* pausing anything. Exists because `eventMedia` was the only storage
+		* class whose only move path went through the recorder's global pause.
+		*/
+		relocateMedia: method(RelocateMediaInputSchema, object({ jobId: string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this addon knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateMediaJobs: method(object({}), array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. */
+		cancelRelocateMedia: method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listOpsLog: method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
@@ -20059,6 +20382,11 @@ object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = object({
 	registryId: string().min(1),
 	id: string().min(1),
@@ -20133,7 +20461,8 @@ var PipelineModelOptionSchema = object({
 		sizeMB: number()
 	})),
 	group: ModelVariantGroupSchema.optional(),
-	legacy: boolean().optional()
+	legacy: boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
 var ConfigFieldBridge = custom();
 var PipelineAddonSchemaSchema = object({
@@ -23011,6 +23340,20 @@ var ssoBridgeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — `signBridgeToken` was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+		* SUPPLIED: an unprivileged session could have minted its own
+		* `isAdmin: true` bridge token and redeemed it at
+		* `/api/auth/sso/finish` to become admin — a full privilege escalation
+		* through the exact surface this cap exists to close (see the module
+		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+		* registration, the OIDC/magic-link addons) reaches this through
+		* `ctx.api` / the in-process registry — never through tRPC — so
+		* `auth: 'admin'` costs those callers nothing.
+		*/
 		signBridgeToken: method(object({
 			claims: SsoBridgeClaimsSchema,
 			/**
@@ -23023,8 +23366,8 @@ var ssoBridgeCapability = {
 			* linking rather than produce an eternal token.
 			*/
 			ttlSec: union([number().int().positive(), literal("never")]).optional()
-		}), object({ token: string() })),
-		verifyBridgeToken: method(object({ token: string() }), SsoBridgeClaimsSchema.nullable())
+		}), object({ token: string() }), { auth: "admin" }),
+		verifyBridgeToken: method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" })
 	}
 };
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
@@ -23173,8 +23516,15 @@ var storageEvictableCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer is the orchestrator's `StoragePressureManager`, which calls
+		* `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
 		/** Bytes this provider holds on the given location — drives proportional fan-out. */
-		getEvictableUsage: method(object({ locationId: string() }), EvictableUsageSchema),
+		getEvictableUsage: method(object({ locationId: string() }), EvictableUsageSchema, { auth: "admin" }),
 		/**
 		* Free approximately `targetBytes` of this provider's OWN least-valuable
 		* data on the location (oldest footage, expired clips, …). Returns what it
@@ -23183,7 +23533,10 @@ var storageEvictableCapability = {
 		evict: method(object({
 			locationId: string(),
 			targetBytes: number().int().positive()
-		}), EvictResultSchema, { kind: "mutation" })
+		}), EvictResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -23286,43 +23639,82 @@ var storageProviderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* Every method below except `testLocation` had NO `auth` override —
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`), so this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`: arbitrary
+		* read/write/delete/list against any storage location the operator has
+		* configured, keyed only by a caller-supplied `location` + `relativePath`
+		* — the same "public consumers never see this cap" claim that was false
+		* for `data-store-provider`, here gating raw file I/O instead of raw
+		* settings rows. The only legitimate caller,
+		* `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+		* provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+		* on every method costs it nothing. Public consumers already go through
+		* the separate `storage` singleton cap.
+		*/
 		/** Self-description for the "Add location" wizard. */
-		getProviderInfo: method(_void(), ProviderInfoSchema),
+		getProviderInfo: method(_void(), ProviderInfoSchema, { auth: "admin" }),
 		/** Validate config + probe connectivity. Called on add and on edit. */
 		testLocation: method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }),
 		resolve: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), string()),
+		}), string(), { auth: "admin" }),
 		write: method(object({
 			location: StorageLocationSchema,
 			relativePath: string(),
 			data: _instanceof(Uint8Array)
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), _instanceof(Uint8Array)),
+		}), _instanceof(Uint8Array), { auth: "admin" }),
 		exists: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), boolean()),
+		}), boolean(), { auth: "admin" }),
 		list: method(object({
 			location: StorageLocationSchema,
 			prefix: string().optional()
-		}), array(string()).readonly()),
+		}), array(string()).readonly(), { auth: "admin" }),
 		delete: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), _void(), { kind: "mutation" }),
-		getAvailableSpace: method(object({ location: StorageLocationSchema }), number().nullable()),
-		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }),
-		writeChunk: method(WriteChunkInputSchema, _void(), { kind: "mutation" }),
-		finalizeUpload: method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }),
-		abortUpload: method(AbortUploadInputSchema, _void(), { kind: "mutation" }),
-		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }),
-		readChunk: method(ReadChunkInputSchema, _instanceof(Uint8Array)),
-		endDownload: method(EndDownloadInputSchema, _void(), { kind: "mutation" })
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getAvailableSpace: method(object({ location: StorageLocationSchema }), number().nullable(), { auth: "admin" }),
+		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		writeChunk: method(WriteChunkInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: method(FinalizeUploadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: method(AbortUploadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		readChunk: method(ReadChunkInputSchema, _instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: method(EndDownloadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
@@ -23655,9 +24047,28 @@ var userPasskeysCapability = {
 			auth: "admin",
 			access: "create"
 		}),
+		/**
+		* The four methods below had NO `auth` override — `internal: true` did
+		* not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+		* so they were reachable on the AppRouter at the default
+		* `auth: 'protected'` (any authenticated session), inconsistent with
+		* every other method on this cap (all already `auth: 'admin'`).
+		*
+		* ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+		* methods, so admin-gating them here must not break login for an
+		* unauthenticated principal. It doesn't — the real login path is the
+		* PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+		* `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+		* procedures in `server/backend/src/api/core/auth.router.ts`, which call
+		* `provider.beginAuthentication(...)` etc. directly against the
+		* capability-registry-resolved provider — never through this cap's own
+		* tRPC route. `auth: 'admin'` here only closes a redundant, unused
+		* second entry point onto the same ceremony.
+		*/
 		beginAuthentication: method(object({ userId: string().optional() }), object({ optionsJSON: record(string(), unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishAuthentication: method(object({
 			/** Required — the user the assertion belongs to (verified). */
@@ -23666,11 +24077,13 @@ var userPasskeysCapability = {
 			response: record(string(), unknown())
 		}), object({ verified: boolean() }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		beginDiscoverableAuthentication: method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishDiscoverableAuthentication: method(object({ 
 		/** AuthenticationResponseJSON from the browser. */
@@ -23679,7 +24092,8 @@ response: record(string(), unknown()) }), object({
 			userId: string().nullable()
 		}), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		listPasskeys: method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(object({
@@ -23857,6 +24271,14 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
+/**
+* `internal: true` did not gate the mount (see the 2026-08-26 note on
+* `data-store-provider`) — every method below was reachable on the AppRouter
+* by ANY authenticated session at the default `auth: 'protected'`. The only
+* consumers (`addon-post-analysis`'s embedding stores) reach this cap via
+* `ctx.api` — UDS/Moleculer, never tRPC — so `auth: 'admin'` on every method
+* costs them nothing. No client (viewer or admin-ui) calls `vectorStore.*`.
+*/
 var vectorStoreCapability = {
 	name: "vector-store",
 	scope: "system",
@@ -23864,14 +24286,26 @@ var vectorStoreCapability = {
 	internal: true,
 	methods: {
 		/** Idempotent. Re-declaring with a different `dim` is an error, not a wipe. */
-		declareIndex: method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }),
-		upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }),
-		query: method(VectorQueryInputSchema, VectorQueryResultSchema),
+		declareIndex: method(VectorDeclareIndexInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
 		/** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
-		getByIds: method(VectorGetInputSchema, VectorGetResultSchema),
-		deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		stats: method(VectorStatsInputSchema, VectorStatsResultSchema)
+		getByIds: method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+		deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stats: method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
 	}
 };
 var ClipSchema = object({
@@ -26720,7 +27154,27 @@ var faceGalleryCapability = {
 	scope: "system",
 	mode: "singleton",
 	methods: {
-		listIdentities: method(_void(), array(IdentitySchema).readonly()),
+		listIdentities: method(object({ 
+		/**
+		* Inline {@link IdentitySchema.coverBase64} on every row.
+		*
+		* Default `false`, the same inversion `listRecentFaces` and
+		* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+		* why the burden belongs on the caller that WANTS the bytes). Measured
+		* on the live hub the same day: four identities cost 40,979 B with the
+		* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+		* four times and the viewer holds at `staleTime: 30_000`.
+		*
+		* Nothing loses its avatar: `coverMediaKey` is already on every row and
+		* the `event-media` plane serves that key `immutable` with an ETag.
+		*
+		* **This is an INPUT field, so it does not reach the addon until the
+		* next train** — the hub router validates cap inputs against its own
+		* compiled Zod and strips a key it does not know. Until then the
+		* provider sees `undefined`, which resolves to `false`: the cheap shape
+		* is what ships, and the opt-in becomes reachable when the train lands.
+		*/
+includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly()),
 		createIdentity: method(object({ name: string().min(1) }), IdentitySchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -29971,7 +30425,14 @@ var PlateInfoSchema = object({
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
 	keyFrameMediaKey: string().optional(),
-	base64: string().optional()
+	base64: string().optional(),
+	/**
+	* Same crop as a data-plane URL, always present when the plate has a stored
+	* crop. `getPlateByTrack` returns this and never inlines JPEG; `listPlates`
+	* and `searchPlates` inline the crop only when their `includeCrops` input is
+	* left at its `true` default.
+	*/
+	cropUrl: string().optional()
 });
 var MediaFileLiteSchema = object({
 	key: string(),
@@ -30002,7 +30463,25 @@ var plateGalleryCapability = {
 	methods: {
 		listPlates: method(object({
 			deviceId: number().int().optional(),
-			limit: number().int().positive().optional()
+			limit: number().int().positive().optional(),
+			/**
+			* Inline the base64 crop on every row. Default `true` — the existing
+			* behaviour, kept so no caller breaks.
+			*
+			* Set `false` once the caller renders {@link PlateInfo.cropUrl}.
+			* Measured on the live hub at the 500 rows the Plates view asks for:
+			* 879,403 B and 27.7 s with the crops inline, against a few KiB of
+			* metadata without them — and the browser then caches the images.
+			*
+			* This is the plate twin of `faceGallery.listRecentFaces`'s option;
+			* plates were the one gallery list left without it.
+			*
+			* **This is an INPUT field, so it does not reach the addon until the
+			* next train.** The hub router validates cap inputs against its own
+			* compiled Zod and strips a key it does not know. Until the train
+			* ships, sending `false` is harmless and keeps the crops inline.
+			*/
+			includeCrops: boolean().optional()
 		}).optional(), array(PlateInfoSchema).readonly()),
 		getPlateByTrack: method(object({
 			deviceId: number().int(),
@@ -30013,7 +30492,9 @@ var plateGalleryCapability = {
 		searchPlates: method(object({
 			text: string().min(1),
 			maxDistance: number().int().min(0).optional(),
-			limit: number().int().positive().optional()
+			limit: number().int().positive().optional(),
+			/** See `listPlates.includeCrops`. Default `true`. */
+			includeCrops: boolean().optional()
 		}), array(PlateInfoSchema).readonly()),
 		/** Suggest groups of near-identical reads (same physical plate) for review/merge. */
 		suggestPlateClusters: method(object({
@@ -30033,7 +30514,13 @@ var plateGalleryCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listVehicles: method(_void(), array(VehicleSchema).readonly()),
+		listVehicles: method(object({ 
+		/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+		*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+		*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+		*  INPUT field: stripped by the hub router until the train ships, which
+		*  resolves to `false` and is exactly the intended default. */
+includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()),
 		createVehicle: method(object({ name: string().min(1) }), VehicleSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -35001,6 +35488,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getBindingsBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getChildren": {
 		capName: "device-manager",
 		capScope: "system",
@@ -35061,6 +35554,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getLinkedDevicesBatch": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getRoleDisplayDefaults": {
 		capName: "device-manager",
 		capScope: "system",
@@ -36765,6 +37264,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36831,6 +37336,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getGroup": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36915,6 +37426,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listGroups": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36927,6 +37444,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -37005,6 +37528,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39696,6 +40225,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getBindingsBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getChildren": [{
 		name: "parentDeviceId",
 		form: "single",
@@ -39741,6 +40275,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.getLinkedDevicesBatch": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"deviceManager.getSettingsSchema": [{
 		name: "deviceId",
 		form: "single",
@@ -39761,6 +40300,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"deviceManager.listAll": [{
+		name: "deviceIds",
+		form: "array",
+		optional: true
+	}],
 	"deviceManager.loadConfig": [{
 		name: "deviceId",
 		form: "single",
@@ -40334,6 +40878,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getGroup": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getKeyEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -40389,6 +40938,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listGroups": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listOpsLog": [{
 		name: "deviceId",
 		form: "single",