@camstack/addon-remote-storage 1.2.27 → 1.2.28

package/dist/{shared-3YApqgLa.mjs → shared-CWlFowyt.mjs}

@@ -6631,7 +6631,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -6651,7 +6651,7 @@ function systemMethod(input, output, options) {
 }
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
-method(_void(), StaticDirOutputSchema$1), method(_void(), VersionOutputSchema$1);
+method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -6972,7 +6972,7 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 }({});
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
-method(_void(), StaticDirOutputSchema), method(_void(), VersionOutputSchema);
+method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
 /**
 * device-ops — device-scoped cap that unifies the per-IDevice operations
 * previously routed through the `.device-ops` Moleculer bridge service.
@@ -7586,24 +7586,6 @@ var RecordingRetentionSchema = object({
 	maxSizeGb: number().min(0).optional()
 });
 /**
-* Scrub-thumbnail fidelity preset — the single per-camera selector bundling the
-* sprite tile RESOLUTION + JPEG QUALITY the recorder packs timeline-scrub
-* previews at. Five graduated steps; absent on a config = `standard` (the
-* shipped default, matching `sheet-geometry`/`sheet-composer`).
-*
-* Existing sheets are IMMUTABLE — a changed preset applies to NEW windows only.
-* Each window's index sidecar carries its own tile dims, so a camera whose
-* preset changed over time renders every historical window at the dims it was
-* written with.
-*/
-var ScrubThumbnailPresetSchema = _enum([
-	"minimal",
-	"low",
-	"standard",
-	"high",
-	"max"
-]);
-/**
 * The full per-camera recording intent — the wire shape of a RecordingTarget.
 *
 * `bands` is the ONLY authored recording intent: what to record, when, and on
@@ -7611,7 +7593,11 @@ var ScrubThumbnailPresetSchema = _enum([
 * other field is a storage knob (profiles, segment length, retention, scrub).
 *
 * STRICT on purpose: the legacy authoring surface (`schedule`/`schedules`/
-* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30.
+* `triggers`/`preBufferSec`/`postBufferSec`/`rules`) was retired 2026-07-30,
+* and `scrubThumbnails` — a five-step fidelity knob for a sprite tier that was
+* deleted on 2026-07-24 and had ZERO consumers in the recorder — on 2026-08-25
+* (D62: a switch that writes a store nobody reads is worse than no switch).
+* Stored rows keep loading: the READ schema is `.strip()` (config-store.ts).
 * A stale caller must fail loudly — silently stripping its legacy intent would
 * persist a band-less config, i.e. silently stop recording the camera.
 */
@@ -7634,14 +7620,7 @@ var RecordingConfigSchema = object({
 	* "off" is the absence of a covering band, never a band value.
 	*/
 	bands: array(RecordingBandSchema).default([]),
-	retention: RecordingRetentionSchema.optional(),
-	/**
-	* Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-	* timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-	* windows only — existing sheets are immutable, and each window's index
-	* carries its own tile dims so mixed-preset history renders correctly.
-	*/
-	scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+	retention: RecordingRetentionSchema.optional()
 }).strict();
 /**
 * Entity-relocation job state (storage entity-routing spec, Phase 4).
@@ -7717,10 +7696,11 @@ var RelocateFootageInputSchema = object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = object({ leaseId: string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: string().min(1) });
-var StorageMigrationMediaMoveInputSchema = object({
+var RelocateMediaInputSchema = object({
 	toLocationId: string(),
 	throttleMbps: number().min(1).max(1e3).optional()
-}).extend({ leaseId: string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -8015,7 +7995,26 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
-var ClassMapDefinitionSchema = object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = object({
 	mapping: record(string(), _enum([
 		"person",
 		"vehicle",
@@ -8220,7 +8219,7 @@ var ModelCatalogEntrySchema = object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8250,7 +8249,7 @@ var ModelConvertMetadataSchema = object({
 		"segmentation"
 	]),
 	faceAlignment: boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -9113,7 +9112,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly());
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -9348,7 +9347,7 @@ var WidgetMetadataSchema = object({
 	defaultColumns: number().int().min(1).max(12).default(6),
 	defaultRows: number().int().min(1).max(12).default(1)
 });
-method(_void(), array(WidgetMetadataSchema).readonly());
+method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
 * surface that admin-ui consumes through `useAddonWidgetsListWidgets()`.
@@ -10870,7 +10869,7 @@ var CustomModelDescriptorSchema = object({
 	stepId: string(),
 	entry: ModelCatalogEntrySchema
 });
-method(_void(), array(CustomModelDescriptorSchema).readonly());
+method(_void(), array(CustomModelDescriptorSchema).readonly(), { auth: "admin" });
 /**
 * Query filter for settings-store collections.
 */
@@ -10957,7 +10956,8 @@ method(object({
 }), _void(), { kind: "mutation" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
+	filter: QueryFilterSchema.optional(),
+	columns: array(string()).readonly().optional()
 }), array(SettingsRecordSchema).readonly()), method(object({
 	namespace: string().optional(),
 	collection: string(),
@@ -11020,46 +11020,87 @@ var EngineInfoSchema = object({
 	kind: _enum(["relational", "vector"]),
 	displayName: string()
 });
-method(_void(), EngineInfoSchema), method(object({
+method(_void(), EngineInfoSchema, { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), unknown()), method(object({
+}), unknown(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string(),
 	value: unknown()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
-	filter: QueryFilterSchema.optional()
-}), array(SettingsRecordSchema).readonly()), method(object({
+	filter: QueryFilterSchema.optional(),
+	/**
+	* SQL-level column projection — MUST mirror `settings-store.query`.
+	*
+	* ⚠ An earlier version of this comment blamed Zod stripping, and that
+	* was wrong — corrected 2026-08-26 after the hop map
+	* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+	* There is **no Zod parse at all** between the door and the engine: the
+	* dispatcher forwards the payload verbatim and UDS carries it whole. A
+	* field declared here reaches `SqliteSettingsBackend` either way.
+	*
+	* What actually lost `columns` was the THIRD declaration of this shape:
+	* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+	* interface the engine destructures from. The field existed on both
+	* schemas and the engine still never read it, because nothing checks a
+	* registered provider against `InferProvider<cap>` —
+	* `ProviderRegistration.provider` is typed `object`.
+	*
+	* It is declared here anyway, and must stay in step with
+	* `settings-store.query`: a caller reading only the cap definitions has
+	* to be able to see that this call carries a projection.
+	* `data-door-schema-parity.spec.ts` keeps the two aligned.
+	*/
+	columns: array(string()).readonly().optional()
+}), array(SettingsRecordSchema).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	record: SettingsRecordSchema
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	id: string(),
 	data: record(string(), unknown())
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	key: string()
-}), _void(), { kind: "mutation" }), method(object({
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema
-}), object({ deleted: number().int() }), { kind: "mutation" }), method(object({
+}), object({ deleted: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: MutationFilterSchema,
 	data: record(string(), unknown())
-}), object({ updated: number().int() }), { kind: "mutation" }), method(object({
+}), object({ updated: number().int() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	filter: QueryFilterSchema.optional()
-}), number()), method(object({
+}), number(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	field: string(),
@@ -11069,15 +11110,18 @@ method(_void(), EngineInfoSchema), method(object({
 }), array(object({
 	bucket: number().int(),
 	count: number().int()
-})).readonly()), method(object({
+})).readonly(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string()
-}), boolean()), method(object({
+}), boolean(), { auth: "admin" }), method(object({
 	namespace: string().optional(),
 	collection: string(),
 	columns: array(CollectionColumnSchema).readonly(),
 	indexes: array(CollectionIndexSchema).readonly().optional()
-}), _void(), { kind: "mutation" });
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * shm ring usage stats for a `frameSink: 'shm'` decoder session —
 * exposed via `decoder.getShmStats` so downstream consumers can
@@ -12205,7 +12249,7 @@ method(object({
 	crop: _instanceof(Uint8Array),
 	width: number(),
 	height: number()
-}), EmbeddingResultSchema), method(object({ text: string() }), EmbeddingResultSchema), method(_void(), EmbeddingInfoSchema);
+}), EmbeddingResultSchema, { auth: "admin" }), method(object({ text: string() }), EmbeddingResultSchema, { auth: "admin" }), method(_void(), EmbeddingInfoSchema, { auth: "admin" });
 /**
 * filesystem-browse — per-node capability for browsing the node's local
 * filesystem. Reads are unconfined (whole filesystem, from `/` down); WRITES
@@ -12498,19 +12542,22 @@ method(LlmGenerateBaseInputSchema.extend({
 	runtime: ManagedRuntimeConfigSchema,
 	/** The managed profile's timeout, threaded by the hub provider. */
 	timeoutMs: number().int().positive().optional()
-}), LlmGenerateResultSchema, { kind: "mutation" }), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
+}), LlmGenerateResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({}), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), LlmRuntimeStatusSchema), method(object({ model: ManagedModelRefSchema }), _void(), {
+}), method(object({}), LlmRuntimeStatusSchema, { auth: "admin" }), method(object({ model: ManagedModelRefSchema }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({ file: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(LlmNodeModelSchema)), method(object({}), LlmRuntimeDiskUsageSchema);
+}), method(object({}), array(LlmNodeModelSchema), { auth: "admin" }), method(object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" });
 /**
 * `llm` — consumer-facing LLM surface (spec §1-§3). Collection-mode: array
 * methods concat-fan across providers; single-row methods route to ONE
@@ -15983,7 +16030,7 @@ var OauthIntegrationDescriptorSchema = object({
 	*/
 	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -17178,6 +17225,15 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), method(object({ jobId: string() }), RelocateJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(RelocateMediaInputSchema, object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), array(RelocateJobSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(OpsLogQueryInputSchema, array(OpsLogEntrySchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -17332,6 +17388,11 @@ object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = object({
 	registryId: string().min(1),
 	id: string().min(1),
@@ -19497,7 +19558,7 @@ method(object({
 	* linking rather than produce an eternal token.
 	*/
 	ttlSec: union([number().int().positive(), literal("never")]).optional()
-}), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
+}), object({ token: string() }), { auth: "admin" }), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" });
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
 	displayName: string().min(1),
@@ -19592,10 +19653,13 @@ var EvictResultSchema = object({
 	/** True when the provider has nothing left it is willing to drop on this location. */
 	exhausted: boolean()
 });
-method(object({ locationId: string() }), EvictableUsageSchema), method(object({
+method(object({ locationId: string() }), EvictableUsageSchema, { auth: "admin" }), method(object({
 	locationId: string(),
 	targetBytes: number().int().positive()
-}), EvictResultSchema, { kind: "mutation" });
+}), EvictResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin" }), method(StorageMigrationInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
@@ -19681,43 +19745,82 @@ var storageProviderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* Every method below except `testLocation` had NO `auth` override —
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`), so this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`: arbitrary
+		* read/write/delete/list against any storage location the operator has
+		* configured, keyed only by a caller-supplied `location` + `relativePath`
+		* — the same "public consumers never see this cap" claim that was false
+		* for `data-store-provider`, here gating raw file I/O instead of raw
+		* settings rows. The only legitimate caller,
+		* `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+		* provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+		* on every method costs it nothing. Public consumers already go through
+		* the separate `storage` singleton cap.
+		*/
 		/** Self-description for the "Add location" wizard. */
-		getProviderInfo: method(_void(), ProviderInfoSchema),
+		getProviderInfo: method(_void(), ProviderInfoSchema, { auth: "admin" }),
 		/** Validate config + probe connectivity. Called on add and on edit. */
 		testLocation: method(object({ config: record(string(), unknown()) }), TestLocationResultSchema, { auth: "admin" }),
 		resolve: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), string()),
+		}), string(), { auth: "admin" }),
 		write: method(object({
 			location: StorageLocationSchema,
 			relativePath: string(),
 			data: _instanceof(Uint8Array)
-		}), _void(), { kind: "mutation" }),
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), _instanceof(Uint8Array)),
+		}), _instanceof(Uint8Array), { auth: "admin" }),
 		exists: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), boolean()),
+		}), boolean(), { auth: "admin" }),
 		list: method(object({
 			location: StorageLocationSchema,
 			prefix: string().optional()
-		}), array(string()).readonly()),
+		}), array(string()).readonly(), { auth: "admin" }),
 		delete: method(object({
 			location: StorageLocationSchema,
 			relativePath: string()
-		}), _void(), { kind: "mutation" }),
-		getAvailableSpace: method(object({ location: StorageLocationSchema }), number().nullable()),
-		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }),
-		writeChunk: method(WriteChunkInputSchema, _void(), { kind: "mutation" }),
-		finalizeUpload: method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }),
-		abortUpload: method(AbortUploadInputSchema, _void(), { kind: "mutation" }),
-		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }),
-		readChunk: method(ReadChunkInputSchema, _instanceof(Uint8Array)),
-		endDownload: method(EndDownloadInputSchema, _void(), { kind: "mutation" })
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getAvailableSpace: method(object({ location: StorageLocationSchema }), number().nullable(), { auth: "admin" }),
+		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		writeChunk: method(WriteChunkInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: method(FinalizeUploadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: method(AbortUploadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		readChunk: method(ReadChunkInputSchema, _instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: method(EndDownloadInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
@@ -19977,7 +20080,8 @@ method(object({
 	access: "create"
 }), method(object({ userId: string().optional() }), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({
 	/** Required — the user the assertion belongs to (verified). */
 	userId: string(),
@@ -19985,10 +20089,12 @@ method(object({
 	response: record(string(), unknown())
 }), object({ verified: boolean() }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({}), object({ optionsJSON: record(string(), unknown()) }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ 
 /** AuthenticationResponseJSON from the browser. */
 response: record(string(), unknown()) }), object({
@@ -19996,7 +20102,8 @@ response: record(string(), unknown()) }), object({
 	userId: string().nullable()
 }), {
 	kind: "mutation",
-	access: "view"
+	access: "view",
+	auth: "admin"
 }), method(object({ userId: string() }), array(PasskeySummarySchema), { auth: "admin" }), method(object({
 	userId: string(),
 	credentialId: string()
@@ -20168,7 +20275,19 @@ var VectorStatsResultSchema = object({
 	/** False when the backend ranks approximately. */
 	exact: boolean()
 });
-method(VectorDeclareIndexInputSchema, _void(), { kind: "mutation" }), method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }), method(VectorQueryInputSchema, VectorQueryResultSchema), method(VectorGetInputSchema, VectorGetResultSchema), method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }), method(VectorStatsInputSchema, VectorStatsResultSchema);
+method(VectorDeclareIndexInputSchema, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }), method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }), method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" });
 var ClipSchema = object({
 	/** Opaque, provider-namespaced id. The default provider encodes the time
 	*  window so `getClipPlayback` is self-contained (no event re-query). */
@@ -21891,7 +22010,27 @@ var MediaFileLiteSchema$1 = object({
 	sizeBytes: number(),
 	timestamp: number()
 });
-method(_void(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
+method(object({ 
+/**
+* Inline {@link IdentitySchema.coverBase64} on every row.
+*
+* Default `false`, the same inversion `listRecentFaces` and
+* `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+* why the burden belongs on the caller that WANTS the bytes). Measured
+* on the live hub the same day: four identities cost 40,979 B with the
+* covers inline, ~10 KB of base64 per row, on a query this UI mounts
+* four times and the viewer holds at `staleTime: 30_000`.
+*
+* Nothing loses its avatar: `coverMediaKey` is already on every row and
+* the `event-media` plane serves that key `immutable` with an ETag.
+*
+* **This is an INPUT field, so it does not reach the addon until the
+* next train** — the hub router validates cap inputs against its own
+* compiled Zod and strips a key it does not know. Until then the
+* provider sees `undefined`, which resolves to `false`: the cheap shape
+* is what ships, and the opt-in becomes reachable when the train lands.
+*/
+includeCrops: boolean().optional() }).optional(), array(IdentitySchema).readonly()), method(object({ name: string().min(1) }), IdentitySchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -24038,8 +24177,10 @@ var PlateInfoSchema = object({
 	keyFrameMediaKey: string().optional(),
 	base64: string().optional(),
 	/**
-	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
-	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	* Same crop as a data-plane URL, always present when the plate has a stored
+	* crop. `getPlateByTrack` returns this and never inlines JPEG; `listPlates`
+	* and `searchPlates` inline the crop only when their `includeCrops` input is
+	* left at its `true` default.
 	*/
 	cropUrl: string().optional()
 });
@@ -24059,14 +24200,34 @@ var PlateClusterSchema = object({
 });
 method(object({
 	deviceId: number().int().optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/**
+	* Inline the base64 crop on every row. Default `true` — the existing
+	* behaviour, kept so no caller breaks.
+	*
+	* Set `false` once the caller renders {@link PlateInfo.cropUrl}.
+	* Measured on the live hub at the 500 rows the Plates view asks for:
+	* 879,403 B and 27.7 s with the crops inline, against a few KiB of
+	* metadata without them — and the browser then caches the images.
+	*
+	* This is the plate twin of `faceGallery.listRecentFaces`'s option;
+	* plates were the one gallery list left without it.
+	*
+	* **This is an INPUT field, so it does not reach the addon until the
+	* next train.** The hub router validates cap inputs against its own
+	* compiled Zod and strips a key it does not know. Until the train
+	* ships, sending `false` is harmless and keeps the crops inline.
+	*/
+	includeCrops: boolean().optional()
 }).optional(), array(PlateInfoSchema).readonly()), method(object({
 	deviceId: number().int(),
 	trackId: string()
 }), PlateInfoSchema.nullable()), method(object({ plateId: string() }), array(MediaFileLiteSchema).readonly()), method(object({
 	text: string().min(1),
 	maxDistance: number().int().min(0).optional(),
-	limit: number().int().positive().optional()
+	limit: number().int().positive().optional(),
+	/** See `listPlates.includeCrops`. Default `true`. */
+	includeCrops: boolean().optional()
 }), array(PlateInfoSchema).readonly()), method(object({
 	maxDistance: number().int().min(0).optional(),
 	minClusterSize: number().int().min(2).optional(),
@@ -24080,7 +24241,13 @@ method(object({
 }), method(object({ plateId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(_void(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
+}), method(object({ 
+/** Inline {@link VehicleSchema.coverBase64} on every row. Default
+*  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+*  option; `coverMediaKey` + the `event-media` plane carry the picture.
+*  INPUT field: stripped by the hub router until the train ships, which
+*  resolves to `false` and is exactly the intended default. */
+includeCrops: boolean().optional() }).optional(), array(VehicleSchema).readonly()), method(object({ name: string().min(1) }), VehicleSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(object({
@@ -29457,6 +29624,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29631,6 +29804,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -29709,6 +29888,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",