@camstack/system 1.2.138 → 1.2.140

package/dist/{dist-DMOTtKH8.mjs → dist-Clses4Bs.mjs}

@@ -2534,7 +2534,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -3838,10 +3838,11 @@ var RelocateFootageInputSchema = z.object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = z.object({ leaseId: z.string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: z.string().min(1) });
-var StorageMigrationMediaMoveInputSchema = z.object({
+var RelocateMediaInputSchema = z.object({
 	toLocationId: z.string(),
 	throttleMbps: z.number().min(1).max(1e3).optional()
-}).extend({ leaseId: z.string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: z.string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -4136,7 +4137,26 @@ var LabelDefinitionSchema = z.object({
 	description: z.string().optional(),
 	icon: z.string().optional()
 });
-var ClassMapDefinitionSchema = z.object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = z.object({
 	mapping: z.record(z.string(), z.enum([
 		"person",
 		"vehicle",
@@ -4341,7 +4361,7 @@ var ModelCatalogEntrySchema = z.object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = z.discriminatedUnion("format", [z.object({
 	format: z.literal("openvino"),
@@ -4371,7 +4391,7 @@ var ModelConvertMetadataSchema = z.object({
 		"segmentation"
 	]),
 	faceAlignment: z.boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertArtifactSchema = z.object({
 	format: z.enum(MODEL_FORMATS),
@@ -7742,6 +7762,44 @@ function objectInputDeclaresAddonId(schema) {
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
 }
+/**
+* Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+*
+* `internal: true` on a cap def is a DECLARATION that its methods are for
+* in-process (`ctx.api`) consumption only. Nothing enforced that:
+* `resolveCapMount` never reads `internal` (an internal cap still gets a
+* full tRPC router), and a method that omitted an explicit `auth` used to
+* default — permanently, at `method()`-call time — to `'protected'`,
+* reachable by any authenticated session regardless of `internal`. That
+* silent default is how 45 procedures across 13 internal caps ended up
+* exposed, including `ssoBridge.signBridgeToken`: it accepted
+* caller-supplied claims (including `isAdmin`), was reachable by any
+* authenticated session, and its token is redeemed at
+* `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+* See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+* (D240) for the record.
+*
+* The floor, exactly: an `internal` cap's method with NO explicit `auth`
+* resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+* declares an explicit `auth` — public, protected, or admin — keeps it
+* unconditionally; the author already said what they meant, and an
+* annotation that happens to agree with the floor is documentation, not
+* redundancy. A non-`internal` cap's un-annotated method is unaffected
+* (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+* would also override a deliberate `auth: 'public'`/`'protected'` choice,
+* which is not the defect being closed.
+*
+* `method()` (`capability-definition.ts`) deliberately leaves `auth`
+* UNSET when the caller omits it (rather than defaulting there) so the
+* "was this explicit" bit survives to this single resolution point. Single
+* source of truth shared by the runtime builder (`cap-router-builder.ts`)
+* and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+* two must never disagree, a documented failure mode in this repo.
+*/
+function resolveMethodAuth(def, method) {
+	if (method.auth !== void 0) return method.auth;
+	return def.internal === true ? "admin" : "protected";
+}
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 function procedureAuthKey(auth) {
 	if (auth === "public") return "public";
@@ -15880,6 +15938,29 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Moves event media between locations — the OPERATOR's mover, without the
+		* coordinator's lease. Twin of `recording.relocateFootage`: the same
+		* engine the lease-gated coordinated migration uses
+		* (`startStorageMigrationMove`), armable in the background and WITHOUT
+		* pausing anything. Exists because `eventMedia` was the only storage
+		* class whose only move path went through the recorder's global pause.
+		*/
+		relocateMedia: method(RelocateMediaInputSchema, z.object({ jobId: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this addon knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateMediaJobs: method(z.object({}), z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. */
+		cancelRelocateMedia: method(z.object({ jobId: z.string() }), z.object({ cancelled: z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listOpsLog: method(OpsLogQueryInputSchema, z.array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
@@ -16239,6 +16320,11 @@ z.object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = z.object({
 	registryId: z.string().min(1),
 	id: z.string().min(1),
@@ -33934,6 +34020,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -34108,6 +34200,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -34186,6 +34284,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39238,4 +39342,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { metricsProviderCapability as $, dataStoreProviderCapability as A, asNumber as At, extractNestedAddonId as B, parseJsonUnknown as Bt, backupCapability as C, DeviceFeature as Ct, coreBlockAddonId as D, ReadinessTimeoutError as Dt, buildStreamParamsConfigSchema as E, ReadinessRegistry as Et, deviceStatusCapability as F, expandCapMethods as Ft, isSameAddonId as G, EventCategory as Gt, isArrayOutputSchema as H, resolveCapMount as Ht, doorbellCapability as I, hydrateSchema as It, lifecycleJobSchema as J, isVoidInput as K, enumerateInferenceDevices as L, isDeviceConfigCap as Lt, deriveBatteryPresence as M, createEvent as Mt, deviceManagerCapability as N, emitDownForOwnedCaps as Nt, coreBlockIdFromAddonId as O, WELL_KNOWN_TAB_MAP as Ot, deviceStateCapability as P, emitReadiness as Pt, looseSchema as Q, enumerateItemArrayFields as R, nodePin as Rt, authProviderCapability as S, DEVICE_STATUS_METHOD as St, batteryCapability as T, DeviceType as Tt, isCollectionArrayMethod as U, scopeKey as Ut, filesystemBrowseCapability as V, readinessKey as Vt, isObjectInput as W, sleep as Wt, logDestinationCapability as X, localNetworkCapability as Y, logLevelAtMost as Z, UserRecordSchema as _, vectorStoreCapability as _t, CAP_NAMES_WITH_STATUS as a, runtimeStatePolicyFor as at, addonWidgetsCapability as b, DATAPLANE_SECRET_HEADER as bt, CoreBlockSchema as c, scoreRuntimes as ct, METHOD_ACCESS_MAP as d, storageCapability as dt, normalizeUnit as et, RUNTIME_DEFAULTS as f, storageMigrationCapability as ft, StorageMigrationJobSchema as g, vectorDimFromBase64 as gt, StorageLocationTypeSchema as h, userManagementCapability as ht, BatteryStatusSchema as i, procedureAuthKey as it, decodeVectorBase64 as j, asString as jt, coreBlocksCapability as k, asJsonObject as kt, DeclaredDevices as l, settingsStoreCapability as lt, ScopedTokenSchema as m, streamQualityLabel as mt, AlertSchema as n, parseStreamParamsFormPatch as nt, CORE_BLOCKS_ADDON_ID as o, scopesAllowAddon as ot, STREAM_PROFILE_META as p, storageProviderCapability as pt, kebabToCamel as q, ApiKeyRecordSchema as r, platformProbeCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, scopesAllowDeviceCap as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tt, DeviceStatusSchema as u, snapshotCapability as ut, addonPagesCapability as v, errMsg as vt, bareAddonId as w, DeviceRole as wt, alertsCapability as x, DEVICE_SETTINGS_CONTRIBUTION_METHODS as xt, addonSettingsCapability as y, BaseAddon as yt, enumerateSchemaFields as z, parseJsonObject as zt };
+export { metricsProviderCapability as $, dataStoreProviderCapability as A, asJsonObject as At, extractNestedAddonId as B, parseJsonObject as Bt, backupCapability as C, DEVICE_STATUS_METHOD as Ct, coreBlockAddonId as D, ReadinessRegistry as Dt, buildStreamParamsConfigSchema as E, DeviceType as Et, deviceStatusCapability as F, emitReadiness as Ft, isSameAddonId as G, sleep as Gt, isArrayOutputSchema as H, readinessKey as Ht, doorbellCapability as I, expandCapMethods as It, lifecycleJobSchema as J, isVoidInput as K, EventCategory as Kt, enumerateInferenceDevices as L, hydrateSchema as Lt, deriveBatteryPresence as M, asString as Mt, deviceManagerCapability as N, createEvent as Nt, coreBlockIdFromAddonId as O, ReadinessTimeoutError as Ot, deviceStateCapability as P, emitDownForOwnedCaps as Pt, looseSchema as Q, enumerateItemArrayFields as R, isDeviceConfigCap as Rt, authProviderCapability as S, DEVICE_SETTINGS_CONTRIBUTION_METHODS as St, batteryCapability as T, DeviceRole as Tt, isCollectionArrayMethod as U, resolveCapMount as Ut, filesystemBrowseCapability as V, parseJsonUnknown as Vt, isObjectInput as W, scopeKey as Wt, logDestinationCapability as X, localNetworkCapability as Y, logLevelAtMost as Z, UserRecordSchema as _, vectorDimFromBase64 as _t, CAP_NAMES_WITH_STATUS as a, resolveMethodAuth as at, addonWidgetsCapability as b, BaseAddon as bt, CoreBlockSchema as c, scopesAllowDeviceCap as ct, METHOD_ACCESS_MAP as d, snapshotCapability as dt, normalizeUnit as et, RUNTIME_DEFAULTS as f, storageCapability as ft, StorageMigrationJobSchema as g, userManagementCapability as gt, StorageLocationTypeSchema as h, streamQualityLabel as ht, BatteryStatusSchema as i, procedureAuthKey as it, decodeVectorBase64 as j, asNumber as jt, coreBlocksCapability as k, WELL_KNOWN_TAB_MAP as kt, DeclaredDevices as l, scoreRuntimes as lt, ScopedTokenSchema as m, storageProviderCapability as mt, AlertSchema as n, parseStreamParamsFormPatch as nt, CORE_BLOCKS_ADDON_ID as o, runtimeStatePolicyFor as ot, STREAM_PROFILE_META as p, storageMigrationCapability as pt, kebabToCamel as q, ApiKeyRecordSchema as r, platformProbeCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, scopesAllowAddon as st, ALL_CAPABILITY_DEFINITIONS as t, objectInputDeclaresAddonId as tt, DeviceStatusSchema as u, settingsStoreCapability as ut, addonPagesCapability as v, vectorStoreCapability as vt, bareAddonId as w, DeviceFeature as wt, alertsCapability as x, DATAPLANE_SECRET_HEADER as xt, addonSettingsCapability as y, errMsg as yt, enumerateSchemaFields as z, nodePin as zt };

package/dist/{dist-mQ3BkrJd.js → dist-D5Jhh8Vk.js}

@@ -2534,7 +2534,7 @@ function method(input, output, options) {
 		input,
 		output,
 		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
+		...options?.auth !== void 0 ? { auth: options.auth } : {},
 		...options?.access !== void 0 ? { access: options.access } : {},
 		...options?.caller !== void 0 ? { caller: options.caller } : {},
 		timeoutMs: options?.timeoutMs
@@ -3838,10 +3838,11 @@ var RelocateFootageInputSchema = zod.z.object({
 * `RecordingConfig.enabled` or camera wrapper bindings. */
 var StorageMigrationLeaseInputSchema = zod.z.object({ leaseId: zod.z.string().min(1) });
 var StorageMigrationFootageMoveInputSchema = RelocateFootageInputSchema.extend({ leaseId: zod.z.string().min(1) });
-var StorageMigrationMediaMoveInputSchema = zod.z.object({
+var RelocateMediaInputSchema = zod.z.object({
 	toLocationId: zod.z.string(),
 	throttleMbps: zod.z.number().min(1).max(1e3).optional()
-}).extend({ leaseId: zod.z.string().min(1) });
+});
+var StorageMigrationMediaMoveInputSchema = RelocateMediaInputSchema.extend({ leaseId: zod.z.string().min(1) });
 /** The independently selectable logical storage classes. `recordings`
 * encompasses the high and mid segment profiles; `recordingsLow` is low
 * segments; `eventMedia` is post-analysis blobs. */
@@ -4136,7 +4137,26 @@ var LabelDefinitionSchema = zod.z.object({
 	description: zod.z.string().optional(),
 	icon: zod.z.string().optional()
 });
-var ClassMapDefinitionSchema = zod.z.object({
+/**
+* Wire schema for a per-model CATALOG classMap override
+* (`ModelCatalogEntry.classMap` / `ModelConvertMetadata.classMap`) —
+* restricted to {@link CLASS_MAP_MACRO_TARGETS}, the only macros the
+* detection pipeline executor actually routes.
+*
+* This is deliberately a DIFFERENT, narrower shape than the general-purpose
+* `ClassMapDefinition` interface above (e.g. `IDetectionAddon.getClassMap()`
+* and the audio `YAMNET_TO_MACRO` catalog both use macro targets outside this
+* enum) — the two used to share the name `ClassMapDefinition`/
+* `ClassMapDefinitionSchema`, which made the schema-type-twin guard
+* (`scripts/check-schema-type-twins.ts`) flag them as a duplicated shape. They
+* are not: it is two different concepts colliding on a name. Keep this type
+* under its own name rather than reusing `ClassMapDefinition` — reusing it
+* would either narrow every `ClassMapDefinition` consumer to the four
+* detection macros (breaking `YAMNET_TO_MACRO`) or drop the validation this
+* schema exists for (see the "rejects a classMap whose target is not a
+* detection macro" test in `model-catalog-schema.test.ts`).
+*/
+var DetectionCatalogClassMapSchema = zod.z.object({
 	mapping: zod.z.record(zod.z.string(), zod.z.enum([
 		"person",
 		"vehicle",
@@ -4341,7 +4361,7 @@ var ModelCatalogEntrySchema = zod.z.object({
 	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
 	* labels already ARE the CamStack macros (Scrypted identity map).
 	*/
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = zod.z.discriminatedUnion("format", [zod.z.object({
 	format: zod.z.literal("openvino"),
@@ -4371,7 +4391,7 @@ var ModelConvertMetadataSchema = zod.z.object({
 		"segmentation"
 	]),
 	faceAlignment: zod.z.boolean().optional(),
-	classMap: ClassMapDefinitionSchema.optional()
+	classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertArtifactSchema = zod.z.object({
 	format: zod.z.enum(MODEL_FORMATS),
@@ -7742,6 +7762,44 @@ function objectInputDeclaresAddonId(schema) {
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
 }
+/**
+* Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+*
+* `internal: true` on a cap def is a DECLARATION that its methods are for
+* in-process (`ctx.api`) consumption only. Nothing enforced that:
+* `resolveCapMount` never reads `internal` (an internal cap still gets a
+* full tRPC router), and a method that omitted an explicit `auth` used to
+* default — permanently, at `method()`-call time — to `'protected'`,
+* reachable by any authenticated session regardless of `internal`. That
+* silent default is how 45 procedures across 13 internal caps ended up
+* exposed, including `ssoBridge.signBridgeToken`: it accepted
+* caller-supplied claims (including `isAdmin`), was reachable by any
+* authenticated session, and its token is redeemed at
+* `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+* See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+* (D240) for the record.
+*
+* The floor, exactly: an `internal` cap's method with NO explicit `auth`
+* resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+* declares an explicit `auth` — public, protected, or admin — keeps it
+* unconditionally; the author already said what they meant, and an
+* annotation that happens to agree with the floor is documentation, not
+* redundancy. A non-`internal` cap's un-annotated method is unaffected
+* (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+* would also override a deliberate `auth: 'public'`/`'protected'` choice,
+* which is not the defect being closed.
+*
+* `method()` (`capability-definition.ts`) deliberately leaves `auth`
+* UNSET when the caller omits it (rather than defaulting there) so the
+* "was this explicit" bit survives to this single resolution point. Single
+* source of truth shared by the runtime builder (`cap-router-builder.ts`)
+* and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+* two must never disagree, a documented failure mode in this repo.
+*/
+function resolveMethodAuth(def, method) {
+	if (method.auth !== void 0) return method.auth;
+	return def.internal === true ? "admin" : "protected";
+}
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 function procedureAuthKey(auth) {
 	if (auth === "public") return "public";
@@ -15880,6 +15938,29 @@ var pipelineAnalyticsCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
+		/**
+		* Moves event media between locations — the OPERATOR's mover, without the
+		* coordinator's lease. Twin of `recording.relocateFootage`: the same
+		* engine the lease-gated coordinated migration uses
+		* (`startStorageMigrationMove`), armable in the background and WITHOUT
+		* pausing anything. Exists because `eventMedia` was the only storage
+		* class whose only move path went through the recorder's global pause.
+		*/
+		relocateMedia: method(RelocateMediaInputSchema, zod.z.object({ jobId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Every relocate job this addon knows about, newest first (in RAM: the
+		*  move is resumable, so a lost list costs nothing but the display). */
+		listRelocateMediaJobs: method(zod.z.object({}), zod.z.array(RelocateJobSchema).readonly(), {
+			kind: "query",
+			auth: "admin"
+		}),
+		/** Cancel a running or queued relocate job. */
+		cancelRelocateMedia: method(zod.z.object({ jobId: zod.z.string() }), zod.z.object({ cancelled: zod.z.boolean() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listOpsLog: method(OpsLogQueryInputSchema, zod.z.array(OpsLogEntrySchema).readonly(), {
 			kind: "query",
 			auth: "admin"
@@ -16239,6 +16320,11 @@ zod.z.object({
 		"jpeg"
 	])
 });
+/**
+* Process-local frame identity. It is serializable so it can ride an in-process
+* capability call, but `registryId` deliberately prevents resolution in any
+* other process or execution group.
+*/
 var FrameRefSchema = zod.z.object({
 	registryId: zod.z.string().min(1),
 	id: zod.z.string().min(1),
@@ -33934,6 +34020,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.cancelRelocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.cancelStorageMigrationMove": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -34108,6 +34200,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRelocateMediaJobs": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -34186,6 +34284,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.relocateMedia": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.restageRetrainTrack": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -39742,6 +39846,12 @@ Object.defineProperty(exports, "resolveCapMount", {
 		return resolveCapMount;
 	}
 });
+Object.defineProperty(exports, "resolveMethodAuth", {
+	enumerable: true,
+	get: function() {
+		return resolveMethodAuth;
+	}
+});
 Object.defineProperty(exports, "runtimeStatePolicyFor", {
 	enumerable: true,
 	get: function() {

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-mQ3BkrJd.js");
+const require_dist = require("./dist-D5Jhh8Vk.js");
 const require_builtins_alerts_alerts_addon = require("./builtins/alerts/alerts.addon.js");
 require("./builtins/alerts/index.js");
 const require_formatter = require("./formatter-DqAKDlvN.js");
@@ -26,7 +26,7 @@ require("./builtins/system-config/index.js");
 const require_builtins_winston_logging_index = require("./builtins/winston-logging/index.js");
 const require_file_data_plane = require("./file-data-plane-DO8KbxCe.js");
 const require_tls$1 = require("./tls-u8QCJCFE.js");
-const require_manifest_python_deps = require("./manifest-python-deps-C9x9vrqt.js");
+const require_manifest_python_deps = require("./manifest-python-deps-Bu8H1_rg.js");
 const require_resource_monitor = require("./resource-monitor-CdnzxBLP.js");
 const require_custom_action_registry = require("./custom-action-registry-jY0NOZK8.js");
 let zod = require("zod");
@@ -6406,15 +6406,35 @@ function methodsFor(def) {
 		return {
 			name,
 			kind: m.kind ?? "query",
-			auth: m.auth ?? "protected",
+			auth: require_dist.resolveMethodAuth(def, m),
 			schema: m,
 			isVoid: require_dist.isVoidInput(m.input),
 			isObject: require_dist.isObjectInput(m.input),
-			callerRequired: m.caller === "required"
+			callerRequired: m.caller === "required",
+			isArrayOutput: m.kind !== "subscription" && require_dist.isArrayOutputSchema(m.output)
 		};
 	});
 }
 /**
+* Invoke `method.name` on a resolved provider, raising the canonical
+* "method not found" error (Task 7.5d) when the provider does not implement
+* it — the naive `provider[method.name]?.(payload)` optional call let a
+* missing method answer `undefined` (200 to the caller). EXCEPTION, mirrored
+* from `child-cap-dispatch.ts`'s `isCollectionListMethod` graceful skip: a
+* COLLECTION cap's array-output method degrades to `[]` — the hub fans that
+* method across every registered provider
+* (`resolveCollectionProvider`/`concatArrayMethod`), so ONE provider not
+* implementing it is a graceful skip, not an error. Every other missing
+* method (singleton, device-native, or a collection's SCALAR method) is a
+* real implementation gap and fails loud.
+*/
+function invokeCapMethod(provider, method, payload, capName, isCollection, services) {
+	const fn = provider[method.name];
+	if (typeof fn === "function") return fn(payload);
+	if (isCollection && method.isArrayOutput) return [];
+	return (services.methodNotFound ?? ((cap, m) => services.badRequest(`Capability "${cap}" has no method "${m}"`)))(capName, method.name);
+}
+/**
 * Extract the authenticated caller identity from the (structurally
 * unknown) tRPC context. The builder cannot import the server's
 * `TrpcContext`, so the read is narrowing-based: `ctx.user.id` (string)
@@ -6534,37 +6554,29 @@ function buildOneCapRouter(def, primitives, services) {
 			}).optional() : zod.z.object({ nodeId: zod.z.string().optional() }).optional();
 			procedures[method.name] = base.input(voidSelector)[procKind](({ input, ctx }) => {
 				const sel = input ?? {};
-				return (nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services, isCollection ? sel.addonId : void 0))[method.name]?.();
+				return invokeCapMethod(nodeIdData ? requireLocal(capName, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services) : resolveProviderForCall(capName, sel.nodeId, () => getLocal(ctx, isCollection ? sel.addonId : void 0), services, isCollection ? sel.addonId : void 0), method, void 0, capName, isCollection, services);
 			});
 			continue;
 		}
 		if (method.isObject) {
 			const schema = nodeIdData ? inputSchema : require_dist.looseSchema(inputSchema);
 			procedures[method.name] = base.input(schema)[procKind](({ input, ctx }) => {
-				if (nodeIdData) {
-					const provider = requireLocal(capName, () => getLocal(ctx), services);
-					const payload = method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input;
-					return provider[method.name]?.(payload);
-				}
+				if (nodeIdData) return invokeCapMethod(requireLocal(capName, () => getLocal(ctx), services), method, method.callerRequired ? injectCaller(stripKeys(input, []).rest, ctx, capName, method.name, services) : input, capName, isCollection, services);
 				if (isCollection) {
 					const { rest, picked } = stripKeys(input, ["nodeId", "addonId"]);
 					const nodeId = typeof picked.nodeId === "string" ? picked.nodeId : void 0;
 					const topLevelAddonId = typeof picked.addonId === "string" ? picked.addonId : void 0;
 					const canRecoverNestedAddonId = !require_dist.isArrayOutputSchema(method.schema.output) && !require_dist.objectInputDeclaresAddonId(method.schema.input);
 					const addonId = topLevelAddonId ?? (canRecoverNestedAddonId ? require_dist.extractNestedAddonId(rest) : void 0);
-					const provider = resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, topLevelAddonId);
-					const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
-					return provider[method.name]?.(payload);
+					return invokeCapMethod(resolveProviderForCall(capName, nodeId, () => getLocal(ctx, addonId), services, topLevelAddonId), method, method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest, capName, isCollection, services);
 				}
 				const { rest, picked } = stripKeys(input, ["nodeId"]);
-				const provider = resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services);
-				const payload = method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest;
-				return provider[method.name]?.(payload);
+				return invokeCapMethod(resolveProviderForCall(capName, typeof picked.nodeId === "string" ? picked.nodeId : void 0, () => getLocal(ctx), services), method, method.callerRequired ? injectCaller(rest, ctx, capName, method.name, services) : rest, capName, isCollection, services);
 			});
 			continue;
 		}
 		procedures[method.name] = base.input(inputSchema)[procKind](({ input, ctx }) => {
-			return requireLocal(capName, () => getLocal(ctx), services)[method.name]?.(input);
+			return invokeCapMethod(requireLocal(capName, () => getLocal(ctx), services), method, input, capName, isCollection, services);
 		});
 	}
 	return primitives.router(procedures);
@@ -95389,7 +95401,6 @@ Object.defineProperty(exports, "installPythonRequirements", {
 		return _camstack_types_node.installPythonRequirements;
 	}
 });
-exports.ipcChildLink = require_manifest_python_deps.ipcChildLink;
 exports.ipcParentLink = require_manifest_python_deps.ipcParentLink;
 exports.isAddonDeploySource = isAddonDeploySource;
 exports.isArrayOutputSchema = require_dist.isArrayOutputSchema;