@camstack/addon-pipeline 1.2.129 → 1.2.130

package/dist/{addon-utils-CKB-2oM9.js → addon-utils-DH78p79i.js}

@@ -1,4 +1,4 @@
-const require_dist = require("./dist-D9x2_csL.js");
+const require_dist = require("./dist-DOw-izoI.js");
 require("node:crypto");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path, 1);

package/dist/audio-analyzer/index.js

@@ -2,9 +2,9 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-D9x2_csL.js");
-const require_process_memory = require("../process-memory-CSJ7-Wlp.js");
-const require_addon_utils = require("../addon-utils-CKB-2oM9.js");
+const require_dist = require("../dist-DOw-izoI.js");
+const require_process_memory = require("../process-memory-D9H5qjDl.js");
+const require_addon_utils = require("../addon-utils-DH78p79i.js");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_fs = require("node:fs");

package/dist/audio-analyzer/index.mjs

@@ -1,6 +1,6 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { A as audioAnalyzerCapability, Dt as hydrateSchema, J as mapAudioLabelToMacro, St as BaseAddon, _ as HF_BASE_URL, gt as errMsg, k as audioAnalysisCapability, lt as resolvePoolMemoryPolicy, n as AUDIO_BACKEND_CHOICES, s as DEFAULT_AUDIO_ANALYZER_CONFIG, x as PoolMemoryWatchdog } from "../dist-CMio-1qq.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-C6es8dMA.mjs";
+import { A as audioAnalyzerCapability, Dt as hydrateSchema, J as mapAudioLabelToMacro, St as BaseAddon, _ as HF_BASE_URL, gt as errMsg, k as audioAnalysisCapability, lt as resolvePoolMemoryPolicy, n as AUDIO_BACKEND_CHOICES, s as DEFAULT_AUDIO_ANALYZER_CONFIG, x as PoolMemoryWatchdog } from "../dist-Wt81pN5Y.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-1_D3EZT9.mjs";
 import { i as downloadFile } from "../addon-utils-CgBCF-mE.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs";

package/dist/detection-pipeline/index.js

@@ -2,11 +2,11 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-D9x2_csL.js");
-const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-UW8nsiMb.js");
-const require_lazy_sharp = require("../lazy-sharp-DrLwLKpg.js");
-const require_process_memory = require("../process-memory-CSJ7-Wlp.js");
-const require_addon_utils = require("../addon-utils-CKB-2oM9.js");
+const require_dist = require("../dist-DOw-izoI.js");
+const require_event_loop_stall_monitor = require("../event-loop-stall-monitor-Bld7jNCb.js");
+const require_lazy_sharp = require("../lazy-sharp-BbNI2ZD-.js");
+const require_process_memory = require("../process-memory-D9H5qjDl.js");
+const require_addon_utils = require("../addon-utils-DH78p79i.js");
 let sharp = require("sharp");
 sharp = require_dist.__toESM(sharp);
 let node_child_process = require("node:child_process");

package/dist/detection-pipeline/index.mjs

@@ -1,8 +1,8 @@
 import { n as __require } from "../chunk-DnnnRqeS.mjs";
-import { $ as pickClusterStepModels, D as YAMNET_TO_MACRO, Dt as hydrateSchema, Et as createEvent, Ft as sleep, G as evaluateZoneRules, Gt as string, I as defaultDeviceFor$1, Kt as union, Lt as array, Mt as parseJsonUnknown, St as BaseAddon, Ut as object, V as detectionPipelineCapability, W as enumerateInferenceDevices, Z as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, dt as runtimeDevices$1, et as pickClusterStepSettings, gt as errMsg, jt as nodePin, l as DEFAULT_CLUSTER_STEP_SETTINGS, lt as resolvePoolMemoryPolicy, mt as supportedRuntimes$1, p as DEVICE_BACKEND_TO_FORMAT, q as inferModelProvider, qt as EventCategory, rt as pipelineExecutorCapability, st as resolveClusterStepModelId, t as APPLE_SA_TO_MACRO, x as PoolMemoryWatchdog } from "../dist-CMio-1qq.mjs";
-import { a as ALL_PIPELINE_STEPS, c as getDefaultModelForFormatFromDef, d as resolveModelForFormat, f as landmarkPrecisionVerdict, l as getStep, n as startEventLoopStallMonitor, o as ALL_STEPS, r as localFrameRegistry, s as getDefaultModelForFormat, u as getStepDefinition } from "../event-loop-stall-monitor-B9dxYxyf.mjs";
+import { $ as pickClusterStepModels, D as YAMNET_TO_MACRO, Dt as hydrateSchema, Et as createEvent, Ft as sleep, G as evaluateZoneRules, Gt as string, I as defaultDeviceFor$1, Kt as union, Lt as array, Mt as parseJsonUnknown, St as BaseAddon, Ut as object, V as detectionPipelineCapability, W as enumerateInferenceDevices, Z as overlayClusterStepSettings, c as DEFAULT_CLUSTER_STEP_MODELS, dt as runtimeDevices$1, et as pickClusterStepSettings, gt as errMsg, jt as nodePin, l as DEFAULT_CLUSTER_STEP_SETTINGS, lt as resolvePoolMemoryPolicy, mt as supportedRuntimes$1, p as DEVICE_BACKEND_TO_FORMAT, q as inferModelProvider, qt as EventCategory, rt as pipelineExecutorCapability, st as resolveClusterStepModelId, t as APPLE_SA_TO_MACRO, x as PoolMemoryWatchdog } from "../dist-Wt81pN5Y.mjs";
+import { a as ALL_PIPELINE_STEPS, c as getDefaultModelForFormatFromDef, d as resolveModelForFormat, f as landmarkPrecisionVerdict, l as getStep, n as startEventLoopStallMonitor, o as ALL_STEPS, r as localFrameRegistry, s as getDefaultModelForFormat, u as getStepDefinition } from "../event-loop-stall-monitor-CtQCOZqm.mjs";
 import { t as getSharp } from "../lazy-sharp-BtT5x-qP.mjs";
-import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-C6es8dMA.mjs";
+import { n as pickNodePlatformArch, t as readProcessMemory } from "../process-memory-1_D3EZT9.mjs";
 import { a as ensureModel, o as isModelDownloaded, r as deleteModelFromDisk } from "../addon-utils-CgBCF-mE.mjs";
 import sharp from "sharp";
 import { spawn } from "node:child_process";

package/dist/{dist-D9x2_csL.js → dist-DOw-izoI.js}

@@ -6792,7 +6792,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -6816,7 +6816,7 @@ function event(data) {
 }
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
-method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
+method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -7137,7 +7137,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 }({});
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
-method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
+method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
 /**
 * device-ops — device-scoped cap that unifies the per-IDevice operations
 * previously routed through the `.device-ops` Moleculer bridge service.
@@ -8772,10 +8772,11 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-var StorageMigrationMediaMoveInputSchema = object({
+var RelocateMediaInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
-}).extend({ leaseId: string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -9070,7 +9071,26 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
-var ClassMapDefinitionSchema = object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
 	mapping: record(string(), _enum([
 		"person",
 		"vehicle",
@@ -9288,7 +9308,7 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -9318,7 +9338,7 @@ var ModelConvertMetadataSchema = object({
 		"segmentation"
 	]),
 	faceAlignment: boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -10181,7 +10201,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly());
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -10421,7 +10441,20 @@ var addonWidgetsSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listWidgets: method(_void(), array(WidgetMetadataSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-widgets-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+	* only, never tRPC. The public, enriched listing admin-ui actually
+	* consumes is the separate `addon-widgets` cap (`listWidgets` there is
+	* gated separately, and a `preAuth: true` widget is surfaced through the
+	* PUBLIC `auth.listLoginMethods` contribution channel instead) —
+	* neither is affected by this change.
+	*/
+listWidgets: method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
@@ -12357,7 +12390,7 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
-method(_void(), array(CustomModelDescriptorSchema).readonly());
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" });
 /**
 * Query filter for settings-store collections.
 */
@@ -12508,56 +12541,87 @@ var EngineInfoSchema = object({
 	kind: _enum(["relational", "vector"]),
 	displayName: string()
 });
-method(_void(), EngineInfoSchema), method(object({
+method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional(),
 	/**
 	* SQL-level column projection — MUST mirror `settings-store.query`.
 	*
-	* This is the second schema the same call passes through, and Zod
-	* objects STRIP what they do not declare: a field present on the door
-	* and absent here does not error, it silently disappears one hop before
-	* the engine, and the caller concludes the projection does nothing.
-	* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+	* ⚠ An earlier version of this comment blamed Zod stripping, and that
+	* was wrong — corrected 2026-08-26 after the hop map
+	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* There is **no Zod parse at all** between the door and the engine: the
+	* dispatcher forwards the payload verbatim and UDS carries it whole. A
+	* field declared here reaches `SqliteSettingsBackend` either way.
+	*
+	* What actually lost `columns` was the THIRD declaration of this shape:
+	* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+	* interface the engine destructures from. The field existed on both
+	* schemas and the engine still never read it, because nothing checks a
+	* registered provider against `InferProvider<cap>` —
+	* `ProviderRegistration.provider` is typed `object`.
+	*
+	* It is declared here anyway, and must stay in step with
+	* `settings-store.query`: a caller reading only the cap definitions has
+	* to be able to see that this call carries a projection.
+	* `data-door-schema-parity.spec.ts` keeps the two aligned.
 	*/
 	columns: array(string()).readonly().optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -12567,15 +12631,18 @@ method(_void(), EngineInfoSchema), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * shm ring usage stats for a `frameSink: 'shm'` decoder session —
 * exposed via `decoder.getShmStats` so downstream consumers can
@@ -13734,7 +13801,7 @@ method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
@@ -14027,19 +14094,22 @@ method(LlmGenerateBaseInputSchema.extend({
 	runtime: ManagedRuntimeConfigSchema,
 	/** The managed profile's timeout, threaded by the hub provider. */
 	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+}), LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+}), method(object({}), LlmRuntimeStatusSchema, { auth: "admin" }), method(object({ model: ManagedModelRefSchema }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
+}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" });
 /**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
@@ -17855,7 +17925,7 @@ var OauthIntegrationDescriptorSchema = object({
 	*/
 	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -19050,6 +19120,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -19204,6 +19283,11 @@ object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = object({
 	registryId: string().min(1),
 	id: string().min(1),
@@ -21663,7 +21747,7 @@ method(object({
 	* linking rather than produce an eternal token.
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
-}), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
+}), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -21764,8 +21848,15 @@ var storageEvictableCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer is the orchestrator's `StoragePressureManager`, which calls
+		* `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
 		/** Bytes this provider holds on the given location — drives proportional fan-out. */
-		getEvictableUsage: method(object({ locationId: string() }), EvictableUsageSchema),
+		getEvictableUsage: method(object({ locationId: string() }), EvictableUsageSchema, { auth: "admin" }),
 		/**
 		* Free approximately `targetBytes` of this provider's OWN least-valuable
 		* data on the location (oldest footage, expired clips, …). Returns what it
@@ -21774,7 +21865,10 @@ var storageEvictableCapability = {
 		evict: method(object({
 			locationId: string(),
 			targetBytes: number().int().positive()
-		}), EvictResultSchema, { kind: "mutation" })
+		}), EvictResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }), method(StorageMigrationInputSchema, object({ jobId: string() }), {
@@ -21836,26 +21930,50 @@ var ReadChunkInputSchema = object({
 	length: number()
 });
 var EndDownloadInputSchema = object({ downloadId: string() });
-method(_void(), ProviderInfoSchema), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
+method(_void(), ProviderInfoSchema, { auth: "admin" }), method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), string()), method(object({
+}), string(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string(),
 	data: _instanceof(Uint8Array)
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _instanceof(Uint8Array)), method(object({
+}), _instanceof(Uint8Array), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	prefix: string().optional()
-}), array(string()).readonly()), method(object({
+}), array(string()).readonly(), { auth: "admin" }), method(object({
 	location: StorageLocationSchema,
 	relativePath: string()
-}), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ location: StorageLocationSchema }), number().nullable(), { auth: "admin" }), method(BeginUploadInputSchema, BeginUploadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(WriteChunkInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(FinalizeUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(AbortUploadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(ReadChunkInputSchema, _instanceof(Uint8Array), { auth: "admin" }), method(EndDownloadInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
 var ProfileSettingsSchemaBridge = unknown().nullable();
 var ProfileSettingsBagSchema = record(string(), unknown());
@@ -22113,7 +22231,8 @@ method(object({
 	access: "create"
 }), method(object({ userId: string().optional() }), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({
 	/** Required — the user the assertion belongs to (verified). */
 	userId: string(),
@@ -22121,10 +22240,12 @@ method(object({
 	response: record(string(), unknown())
 }), object({ verified: boolean() }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ 
 /** AuthenticationResponseJSON from the browser. */
 response: record(string(), unknown()) }), object({
@@ -22132,7 +22253,8 @@ response: record(string(), unknown()) }), object({
 	userId: string().nullable()
 }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -22304,7 +22426,19 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -31960,6 +32094,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32134,6 +32274,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -32212,6 +32358,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",