camstack 1.2.42 → 1.2.44

package/dist/{chunk-WSQAFZ7F.js → chunk-PBBUVCZE.js}

@@ -14522,7 +14522,7 @@ function date4(params) {
 // ../../node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../types/dist/sleep-BLxqGLY0.mjs
+// ../types/dist/sleep-swxwnJmL.mjs
 var WELL_KNOWN_TABS = [
   {
     id: "overview",
@@ -15002,7 +15002,7 @@ function method(input, output, options) {
     input,
     output,
     kind: options?.kind ?? "query",
-    auth: options?.auth ?? "protected",
+    ...options?.auth !== void 0 ? { auth: options.auth } : {},
     ...options?.access !== void 0 ? { access: options.access } : {},
     ...options?.caller !== void 0 ? { caller: options.caller } : {},
     timeoutMs: options?.timeoutMs
@@ -15025,8 +15025,17 @@ var adminUiCapability = {
   mode: "singleton",
   internal: true,
   methods: {
-    getStaticDir: method(external_exports.void(), StaticDirOutputSchema$1),
-    getVersion: method(external_exports.void(), VersionOutputSchema$1)
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — both methods were reachable on the AppRouter
+    * by ANY authenticated session at the default `auth: 'protected'`, and
+    * `getStaticDir` leaks a hub filesystem path. The only caller is
+    * `main.ts`'s static-file bootstrap, via `capRegistry.getSingletonForNode`
+    * — never tRPC — so `auth: 'admin'` costs it nothing. The actual admin-ui
+    * SPA assets are served as plain static files, unaffected by this gate.
+    */
+    getStaticDir: method(external_exports.void(), StaticDirOutputSchema$1, { auth: "admin" }),
+    getVersion: method(external_exports.void(), VersionOutputSchema$1, { auth: "admin" })
   }
 };
 var DeviceType = /* @__PURE__ */ (function(DeviceType2) {
@@ -15175,8 +15184,23 @@ var viewerUiCapability = {
   mode: "singleton",
   internal: true,
   methods: {
-    getStaticDir: method(external_exports.void(), StaticDirOutputSchema),
-    getVersion: method(external_exports.void(), VersionOutputSchema)
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — both methods were reachable on the AppRouter
+    * by ANY authenticated session at the default `auth: 'protected'`, and
+    * `getStaticDir` leaks a hub filesystem path.
+    *
+    * ⚠ Checked before gating: the VIEWER app IS used by a non-admin user
+    * (`roberta`), but it never calls `viewerUi.*` over tRPC. The static SPA
+    * it loads is served by the plain `GET /viewer/*` Fastify route in
+    * `main.ts`, which reads `staticDir`/`indexPath` from a module-level
+    * cache populated ONCE at boot via `capRegistry.getSingletonForNode`
+    * (in-process, not tRPC) — the cap's tRPC procedure is never on that
+    * request path. `auth: 'admin'` here does not block a single viewer
+    * user from loading the app.
+    */
+    getStaticDir: method(external_exports.void(), StaticDirOutputSchema, { auth: "admin" }),
+    getVersion: method(external_exports.void(), VersionOutputSchema, { auth: "admin" })
   }
 };
 var StreamSourceEntrySchema = external_exports.object({
@@ -15610,13 +15634,6 @@ var RecordingRetentionSchema = external_exports.object({
   maxAgeDays: external_exports.number().min(0).optional(),
   maxSizeGb: external_exports.number().min(0).optional()
 });
-var ScrubThumbnailPresetSchema = external_exports.enum([
-  "minimal",
-  "low",
-  "standard",
-  "high",
-  "max"
-]);
 var RecordingConfigSchema = external_exports.object({
   enabled: external_exports.boolean(),
   /** DERIVED summary of `bands`, stamped by the recorder on every save.
@@ -15636,14 +15653,7 @@ var RecordingConfigSchema = external_exports.object({
   * "off" is the absence of a covering band, never a band value.
   */
   bands: external_exports.array(RecordingBandSchema).default([]),
-  retention: RecordingRetentionSchema.optional(),
-  /**
-  * Per-camera scrub-thumbnail fidelity preset (resolution + JPEG quality for
-  * timeline-scrub sprite previews). Absent = `standard`. Applies to NEW
-  * windows only — existing sheets are immutable, and each window's index
-  * carries its own tile dims so mixed-preset history renders correctly.
-  */
-  scrubThumbnails: ScrubThumbnailPresetSchema.optional()
+  retention: RecordingRetentionSchema.optional()
 }).strict();
 var RelocateJobStateSchema = external_exports.enum([
   "queued",
@@ -15932,7 +15942,7 @@ var CLASS_MAP_MACRO_TARGETS = [
   "animal",
   "package"
 ];
-var ClassMapDefinitionSchema = external_exports.object({
+var DetectionCatalogClassMapSchema = external_exports.object({
   mapping: external_exports.record(external_exports.string(), external_exports.enum(CLASS_MAP_MACRO_TARGETS)),
   preserveOriginal: external_exports.boolean()
 });
@@ -16103,7 +16113,7 @@ var ModelCatalogEntrySchema = external_exports.object({
   * applies (Frigate / COCO public catalog). Set on a custom model whose raw
   * labels already ARE the CamStack macros (Scrypted identity map).
   */
-  classMap: ClassMapDefinitionSchema.optional()
+  classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertTargetSchema = external_exports.discriminatedUnion("format", [external_exports.object({
   format: external_exports.literal("openvino"),
@@ -16133,7 +16143,7 @@ var ModelConvertMetadataSchema = external_exports.object({
     "segmentation"
   ]),
   faceAlignment: external_exports.boolean().optional(),
-  classMap: ClassMapDefinitionSchema.optional()
+  classMap: DetectionCatalogClassMapSchema.optional()
 });
 var ConvertArtifactSchema = external_exports.object({
   format: external_exports.enum(MODEL_FORMATS),
@@ -16857,7 +16867,19 @@ var addonPagesSourceCapability = {
   scope: "system",
   mode: "collection",
   internal: true,
-  methods: { listPages: method(external_exports.void(), external_exports.array(AddonPageDeclarationSchema).readonly()) }
+  methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — this was reachable on the AppRouter by ANY
+    * authenticated session at the default `auth: 'protected'`. The only
+    * consumer, the `addon-pages-aggregator` builtin, reads it via
+    * `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+    * only, never tRPC (per `ctx.capabilities` seeing only the local
+    * process). The public, enriched listing admin-ui actually consumes is
+    * the separate `addon-pages` cap, unaffected by this change.
+    */
+    listPages: method(external_exports.void(), external_exports.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" })
+  }
 };
 var AddonHttpRouteSchema = external_exports.object({
   method: external_exports.enum([
@@ -17061,7 +17083,21 @@ var addonWidgetsSourceCapability = {
   scope: "system",
   mode: "collection",
   internal: true,
-  methods: { listWidgets: method(external_exports.void(), external_exports.array(WidgetMetadataSchema).readonly()) }
+  methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — this was reachable on the AppRouter by ANY
+    * authenticated session at the default `auth: 'protected'`. The only
+    * consumer, the `addon-widgets-aggregator` builtin, reads it via
+    * `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+    * only, never tRPC. The public, enriched listing admin-ui actually
+    * consumes is the separate `addon-widgets` cap (`listWidgets` there is
+    * gated separately, and a `preAuth: true` widget is surfaced through the
+    * PUBLIC `auth.listLoginMethods` contribution channel instead) —
+    * neither is affected by this change.
+    */
+    listWidgets: method(external_exports.void(), external_exports.array(WidgetMetadataSchema).readonly(), { auth: "admin" })
+  }
 };
 var EnrichedWidgetMetadataSchema = WidgetMetadataSchema.extend({
   addonId: external_exports.string(),
@@ -18941,7 +18977,18 @@ var customModelRegistryCapability = {
   scope: "system",
   mode: "collection",
   internal: true,
-  methods: { listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly()) }
+  methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — this was reachable on the AppRouter by ANY
+    * authenticated session at the default `auth: 'protected'`. The only
+    * consumer, the detection-pipeline's model resolution
+    * (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+    * `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+    * never tRPC — so `auth: 'admin'` costs it nothing.
+    */
+    listModels: method(external_exports.void(), external_exports.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" })
+  }
 };
 var QueryFilterSchema = external_exports.object({
   where: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
@@ -19013,11 +19060,26 @@ var settingsStoreCapability = {
       key: external_exports.string(),
       value: external_exports.unknown()
     }), external_exports.void(), { kind: "mutation" }),
-    /** Get all entries matching an optional filter. */
+    /**
+    * Rows matching a filter.
+    *
+    * `columns` is a SQL-level projection: the engine SELECTs only those
+    * columns (plus the primary key) instead of the whole row. It is the only
+    * way to stop paying disk for a column that is discarded — a heavy JSON
+    * column dominates the row, and dropping it in JS after the read pays every
+    * byte first. Measured on the live `pipeline-analytics:tracks` table: a
+    * 501-row page is 4.6 MB whole and 0.11 MB projected, same index, same
+    * plan.
+    *
+    * The engine REFUSES a column it cannot serve rather than omitting it —
+    * see `SettingsQueryInput.columns` for why a projection may not be
+    * forgiving the way a predicate is.
+    */
     query: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
-      filter: QueryFilterSchema.optional()
+      filter: QueryFilterSchema.optional(),
+      columns: external_exports.array(external_exports.string()).readonly().optional()
     }), external_exports.array(SettingsRecordSchema).readonly()),
     /** Insert a new record. */
     insert: method(external_exports.object({
@@ -19133,64 +19195,105 @@ var dataStoreProviderCapability = {
   internal: true,
   methods: {
     /** Self-description — how the orchestrator picks a registrant. */
-    getEngineInfo: method(external_exports.void(), EngineInfoSchema),
+    getEngineInfo: method(external_exports.void(), EngineInfoSchema, { auth: "admin" }),
     /** Get a single value by key from a collection. */
     get: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       key: external_exports.string()
-    }), external_exports.unknown()),
+    }), external_exports.unknown(), { auth: "admin" }),
     /** Set a value by key in a collection (upsert). */
     set: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       key: external_exports.string(),
       value: external_exports.unknown()
-    }), external_exports.void(), { kind: "mutation" }),
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Get all entries matching an optional filter. */
     query: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
-      filter: QueryFilterSchema.optional()
-    }), external_exports.array(SettingsRecordSchema).readonly()),
+      filter: QueryFilterSchema.optional(),
+      /**
+      * SQL-level column projection — MUST mirror `settings-store.query`.
+      *
+      * ⚠ An earlier version of this comment blamed Zod stripping, and that
+      * was wrong — corrected 2026-08-26 after the hop map
+      * (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+      * There is **no Zod parse at all** between the door and the engine: the
+      * dispatcher forwards the payload verbatim and UDS carries it whole. A
+      * field declared here reaches `SqliteSettingsBackend` either way.
+      *
+      * What actually lost `columns` was the THIRD declaration of this shape:
+      * `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+      * interface the engine destructures from. The field existed on both
+      * schemas and the engine still never read it, because nothing checks a
+      * registered provider against `InferProvider<cap>` —
+      * `ProviderRegistration.provider` is typed `object`.
+      *
+      * It is declared here anyway, and must stay in step with
+      * `settings-store.query`: a caller reading only the cap definitions has
+      * to be able to see that this call carries a projection.
+      * `data-door-schema-parity.spec.ts` keeps the two aligned.
+      */
+      columns: external_exports.array(external_exports.string()).readonly().optional()
+    }), external_exports.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
     /** Insert a new record. */
     insert: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       record: SettingsRecordSchema
-    }), external_exports.void(), { kind: "mutation" }),
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Update an existing record by ID. */
     update: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       id: external_exports.string(),
       data: external_exports.record(external_exports.string(), external_exports.unknown())
-    }), external_exports.void(), { kind: "mutation" }),
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Delete a record by key/ID. */
     delete: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       key: external_exports.string()
-    }), external_exports.void(), { kind: "mutation" }),
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Delete every record matching `filter`, in one statement. */
     deleteWhere: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       filter: MutationFilterSchema
-    }), external_exports.object({ deleted: external_exports.number().int() }), { kind: "mutation" }),
+    }), external_exports.object({ deleted: external_exports.number().int() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Apply `data` to every record matching `filter`, in one statement. */
     updateWhere: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       filter: MutationFilterSchema,
       data: external_exports.record(external_exports.string(), external_exports.unknown())
-    }), external_exports.object({ updated: external_exports.number().int() }), { kind: "mutation" }),
+    }), external_exports.object({ updated: external_exports.number().int() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     /** Count entries in a collection, optionally filtered. */
     count: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       filter: QueryFilterSchema.optional()
-    }), external_exports.number()),
+    }), external_exports.number(), { auth: "admin" }),
     /** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
     histogram: method(external_exports.object({
       namespace: external_exports.string().optional(),
@@ -19202,19 +19305,22 @@ var dataStoreProviderCapability = {
     }), external_exports.array(external_exports.object({
       bucket: external_exports.number().int(),
       count: external_exports.number().int()
-    })).readonly()),
+    })).readonly(), { auth: "admin" }),
     /** Check if a collection is empty. */
     isEmpty: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string()
-    }), external_exports.boolean()),
+    }), external_exports.boolean(), { auth: "admin" }),
     /** Declare a typed (SQL-backed) collection with columns + indexes. */
     declareCollection: method(external_exports.object({
       namespace: external_exports.string().optional(),
       collection: external_exports.string(),
       columns: external_exports.array(CollectionColumnSchema).readonly(),
       indexes: external_exports.array(CollectionIndexSchema).readonly().optional()
-    }), external_exports.void(), { kind: "mutation" })
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    })
   }
 };
 var ShmRingStatsSchema = external_exports.object({
@@ -20756,13 +20862,20 @@ var embeddingEncoderCapability = {
   mode: "collection",
   internal: true,
   methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — every method below was reachable on the
+    * AppRouter by ANY authenticated session at the default
+    * `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+    * `addon-post-analysis`, never tRPC.
+    */
     encode: method(external_exports.object({
       crop: external_exports.instanceof(Uint8Array),
       width: external_exports.number(),
       height: external_exports.number()
-    }), EmbeddingResultSchema),
-    encodeText: method(external_exports.object({ text: external_exports.string() }), EmbeddingResultSchema),
-    getInfo: method(external_exports.void(), EmbeddingInfoSchema)
+    }), EmbeddingResultSchema, { auth: "admin" }),
+    encodeText: method(external_exports.object({ text: external_exports.string() }), EmbeddingResultSchema, { auth: "admin" }),
+    getInfo: method(external_exports.void(), EmbeddingInfoSchema, { auth: "admin" })
   }
 };
 var DirEntrySchema = external_exports.object({
@@ -21028,7 +21141,23 @@ var llmRuntimeCapability = {
   mode: "singleton",
   internal: true,
   methods: {
-    complete: method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+    /**
+    * `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+    * `auth` override — `internal: true` did not gate the mount (see the
+    * 2026-08-26 note on `data-store-provider`), so they were reachable on
+    * the AppRouter by ANY authenticated session at the default
+    * `auth: 'protected'`, inconsistent with the rest of this cap (already
+    * `auth: 'admin'`) and with this file's own docblock: "the operator
+    * reaches this only through the `llm` cap's methods." The sole caller,
+    * `addon-ai`'s `runtime-client.ts`, reaches every method here via
+    * `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+    * nothing; the public `llm` cap (which end users and non-admin sessions
+    * legitimately call for chat/generation) is untouched.
+    */
+    complete: method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
     ensureStarted: method(external_exports.object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
       kind: "mutation",
       auth: "admin"
@@ -21037,7 +21166,7 @@ var llmRuntimeCapability = {
       kind: "mutation",
       auth: "admin"
     }),
-    status: method(external_exports.object({}), LlmRuntimeStatusSchema),
+    status: method(external_exports.object({}), LlmRuntimeStatusSchema, { auth: "admin" }),
     installModel: method(external_exports.object({ model: ManagedModelRefSchema }), external_exports.void(), {
       kind: "mutation",
       auth: "admin"
@@ -21046,8 +21175,8 @@ var llmRuntimeCapability = {
       kind: "mutation",
       auth: "admin"
     }),
-    listLocalModels: method(external_exports.object({}), external_exports.array(LlmNodeModelSchema)),
-    getDiskUsage: method(external_exports.object({}), LlmRuntimeDiskUsageSchema)
+    listLocalModels: method(external_exports.object({}), external_exports.array(LlmNodeModelSchema), { auth: "admin" }),
+    getDiskUsage: method(external_exports.object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" })
   }
 };
 var LlmProfileKindSchema = external_exports.enum([
@@ -24037,7 +24166,18 @@ var oauthIntegrationCapability = {
   scope: "system",
   mode: "collection",
   internal: true,
-  methods: { getDescriptor: method(external_exports.void(), OauthIntegrationDescriptorSchema) }
+  methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+    * by ANY authenticated session at the default `auth: 'protected'`. The
+    * real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+    * (`oauth2-routes.ts`), which resolve the provider directly off the
+    * capability registry — never through tRPC. `auth: 'admin'` closes the
+    * tRPC surface without touching that path.
+    */
+    getDescriptor: method(external_exports.void(), OauthIntegrationDescriptorSchema, { auth: "admin" })
+  }
 };
 var TrackStateSchema = external_exports.enum([
   "new",
@@ -25167,6 +25307,29 @@ var pipelineAnalyticsCapability = {
       kind: "mutation",
       auth: "admin"
     }),
+    /**
+    * Moves event media between locations — the OPERATOR's mover, without the
+    * coordinator's lease. Twin of `recording.relocateFootage`: the same
+    * engine the lease-gated coordinated migration uses
+    * (`startStorageMigrationMove`), armable in the background and WITHOUT
+    * pausing anything. Exists because `eventMedia` was the only storage
+    * class whose only move path went through the recorder's global pause.
+    */
+    relocateMedia: method(RelocateMediaInputSchema, external_exports.object({ jobId: external_exports.string() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    /** Every relocate job this addon knows about, newest first (in RAM: the
+    *  move is resumable, so a lost list costs nothing but the display). */
+    listRelocateMediaJobs: method(external_exports.object({}), external_exports.array(RelocateJobSchema).readonly(), {
+      kind: "query",
+      auth: "admin"
+    }),
+    /** Cancel a running or queued relocate job. */
+    cancelRelocateMedia: method(external_exports.object({ jobId: external_exports.string() }), external_exports.object({ cancelled: external_exports.boolean() }), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     listOpsLog: method(OpsLogQueryInputSchema, external_exports.array(OpsLogEntrySchema).readonly(), {
       kind: "query",
       auth: "admin"
@@ -28229,6 +28392,20 @@ var ssoBridgeCapability = {
   mode: "singleton",
   internal: true,
   methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — `signBridgeToken` was reachable on the
+    * AppRouter by ANY authenticated session at the default
+    * `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+    * SUPPLIED: an unprivileged session could have minted its own
+    * `isAdmin: true` bridge token and redeemed it at
+    * `/api/auth/sso/finish` to become admin — a full privilege escalation
+    * through the exact surface this cap exists to close (see the module
+    * docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+    * registration, the OIDC/magic-link addons) reaches this through
+    * `ctx.api` / the in-process registry — never through tRPC — so
+    * `auth: 'admin'` costs those callers nothing.
+    */
     signBridgeToken: method(external_exports.object({
       claims: SsoBridgeClaimsSchema,
       /**
@@ -28241,8 +28418,8 @@ var ssoBridgeCapability = {
       * linking rather than produce an eternal token.
       */
       ttlSec: external_exports.union([external_exports.number().int().positive(), external_exports.literal("never")]).optional()
-    }), external_exports.object({ token: external_exports.string() })),
-    verifyBridgeToken: method(external_exports.object({ token: external_exports.string() }), SsoBridgeClaimsSchema.nullable())
+    }), external_exports.object({ token: external_exports.string() }), { auth: "admin" }),
+    verifyBridgeToken: method(external_exports.object({ token: external_exports.string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" })
   }
 };
 var ProviderListEntrySchema = external_exports.discriminatedUnion("shouldSaveDiskSpace", [external_exports.object({
@@ -28360,8 +28537,15 @@ var storageEvictableCapability = {
   mode: "collection",
   internal: true,
   methods: {
+    /**
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`) — this was reachable on the AppRouter by ANY
+    * authenticated session at the default `auth: 'protected'`. The only
+    * consumer is the orchestrator's `StoragePressureManager`, which calls
+    * `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+    */
     /** Bytes this provider holds on the given location — drives proportional fan-out. */
-    getEvictableUsage: method(external_exports.object({ locationId: external_exports.string() }), EvictableUsageSchema),
+    getEvictableUsage: method(external_exports.object({ locationId: external_exports.string() }), EvictableUsageSchema, { auth: "admin" }),
     /**
     * Free approximately `targetBytes` of this provider's OWN least-valuable
     * data on the location (oldest footage, expired clips, …). Returns what it
@@ -28370,7 +28554,10 @@ var storageEvictableCapability = {
     evict: method(external_exports.object({
       locationId: external_exports.string(),
       targetBytes: external_exports.number().int().positive()
-    }), EvictResultSchema, { kind: "mutation" })
+    }), EvictResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    })
   }
 };
 var storageMigrationCapability = {
@@ -28448,43 +28635,82 @@ var storageProviderCapability = {
   mode: "collection",
   internal: true,
   methods: {
+    /**
+    * Every method below except `testLocation` had NO `auth` override —
+    * `internal: true` did not gate the mount (see the 2026-08-26 note on
+    * `data-store-provider`), so this was reachable on the AppRouter by ANY
+    * authenticated session at the default `auth: 'protected'`: arbitrary
+    * read/write/delete/list against any storage location the operator has
+    * configured, keyed only by a caller-supplied `location` + `relativePath`
+    * — the same "public consumers never see this cap" claim that was false
+    * for `data-store-provider`, here gating raw file I/O instead of raw
+    * settings rows. The only legitimate caller,
+    * `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+    * provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+    * on every method costs it nothing. Public consumers already go through
+    * the separate `storage` singleton cap.
+    */
     /** Self-description for the "Add location" wizard. */
-    getProviderInfo: method(external_exports.void(), ProviderInfoSchema),
+    getProviderInfo: method(external_exports.void(), ProviderInfoSchema, { auth: "admin" }),
     /** Validate config + probe connectivity. Called on add and on edit. */
     testLocation: method(external_exports.object({ config: external_exports.record(external_exports.string(), external_exports.unknown()) }), TestLocationResultSchema, { auth: "admin" }),
     resolve: method(external_exports.object({
       location: StorageLocationSchema,
       relativePath: external_exports.string()
-    }), external_exports.string()),
+    }), external_exports.string(), { auth: "admin" }),
     write: method(external_exports.object({
       location: StorageLocationSchema,
       relativePath: external_exports.string(),
       data: external_exports.instanceof(Uint8Array)
-    }), external_exports.void(), { kind: "mutation" }),
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
     read: method(external_exports.object({
       location: StorageLocationSchema,
       relativePath: external_exports.string()
-    }), external_exports.instanceof(Uint8Array)),
+    }), external_exports.instanceof(Uint8Array), { auth: "admin" }),
     exists: method(external_exports.object({
       location: StorageLocationSchema,
       relativePath: external_exports.string()
-    }), external_exports.boolean()),
+    }), external_exports.boolean(), { auth: "admin" }),
     list: method(external_exports.object({
       location: StorageLocationSchema,
       prefix: external_exports.string().optional()
-    }), external_exports.array(external_exports.string()).readonly()),
+    }), external_exports.array(external_exports.string()).readonly(), { auth: "admin" }),
     delete: method(external_exports.object({
       location: StorageLocationSchema,
       relativePath: external_exports.string()
-    }), external_exports.void(), { kind: "mutation" }),
-    getAvailableSpace: method(external_exports.object({ location: StorageLocationSchema }), external_exports.number().nullable()),
-    beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }),
-    writeChunk: method(WriteChunkInputSchema, external_exports.void(), { kind: "mutation" }),
-    finalizeUpload: method(FinalizeUploadInputSchema, external_exports.void(), { kind: "mutation" }),
-    abortUpload: method(AbortUploadInputSchema, external_exports.void(), { kind: "mutation" }),
-    beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }),
-    readChunk: method(ReadChunkInputSchema, external_exports.instanceof(Uint8Array)),
-    endDownload: method(EndDownloadInputSchema, external_exports.void(), { kind: "mutation" })
+    }), external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    getAvailableSpace: method(external_exports.object({ location: StorageLocationSchema }), external_exports.number().nullable(), { auth: "admin" }),
+    beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    writeChunk: method(WriteChunkInputSchema, external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    finalizeUpload: method(FinalizeUploadInputSchema, external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    abortUpload: method(AbortUploadInputSchema, external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    readChunk: method(ReadChunkInputSchema, external_exports.instanceof(Uint8Array), { auth: "admin" }),
+    endDownload: method(EndDownloadInputSchema, external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    })
   }
 };
 var ProfileSettingsSchemaBridge = external_exports.unknown().nullable();
@@ -28723,9 +28949,28 @@ var userPasskeysCapability = {
       auth: "admin",
       access: "create"
     }),
+    /**
+    * The four methods below had NO `auth` override — `internal: true` did
+    * not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+    * so they were reachable on the AppRouter at the default
+    * `auth: 'protected'` (any authenticated session), inconsistent with
+    * every other method on this cap (all already `auth: 'admin'`).
+    *
+    * ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+    * methods, so admin-gating them here must not break login for an
+    * unauthenticated principal. It doesn't — the real login path is the
+    * PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+    * `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+    * procedures in `server/backend/src/api/core/auth.router.ts`, which call
+    * `provider.beginAuthentication(...)` etc. directly against the
+    * capability-registry-resolved provider — never through this cap's own
+    * tRPC route. `auth: 'admin'` here only closes a redundant, unused
+    * second entry point onto the same ceremony.
+    */
     beginAuthentication: method(external_exports.object({ userId: external_exports.string().optional() }), external_exports.object({ optionsJSON: external_exports.record(external_exports.string(), external_exports.unknown()) }), {
       kind: "mutation",
-      access: "view"
+      access: "view",
+      auth: "admin"
     }),
     finishAuthentication: method(external_exports.object({
       /** Required — the user the assertion belongs to (verified). */
@@ -28734,11 +28979,13 @@ var userPasskeysCapability = {
       response: external_exports.record(external_exports.string(), external_exports.unknown())
     }), external_exports.object({ verified: external_exports.boolean() }), {
       kind: "mutation",
-      access: "view"
+      access: "view",
+      auth: "admin"
     }),
     beginDiscoverableAuthentication: method(external_exports.object({}), external_exports.object({ optionsJSON: external_exports.record(external_exports.string(), external_exports.unknown()) }), {
       kind: "mutation",
-      access: "view"
+      access: "view",
+      auth: "admin"
     }),
     finishDiscoverableAuthentication: method(external_exports.object({
       /** AuthenticationResponseJSON from the browser. */
@@ -28748,7 +28995,8 @@ var userPasskeysCapability = {
       userId: external_exports.string().nullable()
     }), {
       kind: "mutation",
-      access: "view"
+      access: "view",
+      auth: "admin"
     }),
     listPasskeys: method(external_exports.object({ userId: external_exports.string() }), external_exports.array(PasskeySummarySchema), { auth: "admin" }),
     removePasskey: method(external_exports.object({
@@ -28873,14 +29121,26 @@ var vectorStoreCapability = {
   internal: true,
   methods: {
     /** Idempotent. Re-declaring with a different `dim` is an error, not a wipe. */
-    declareIndex: method(VectorDeclareIndexInputSchema, external_exports.void(), { kind: "mutation" }),
-    upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }),
-    query: method(VectorQueryInputSchema, VectorQueryResultSchema),
+    declareIndex: method(VectorDeclareIndexInputSchema, external_exports.void(), {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    query: method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
     /** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
-    getByIds: method(VectorGetInputSchema, VectorGetResultSchema),
-    deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-    deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-    stats: method(VectorStatsInputSchema, VectorStatsResultSchema)
+    getByIds: method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+    deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+      kind: "mutation",
+      auth: "admin"
+    }),
+    stats: method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
   }
 };
 var ClipSchema = external_exports.object({
@@ -31301,7 +31561,28 @@ var faceGalleryCapability = {
   scope: "system",
   mode: "singleton",
   methods: {
-    listIdentities: method(external_exports.void(), external_exports.array(IdentitySchema).readonly()),
+    listIdentities: method(external_exports.object({
+      /**
+      * Inline {@link IdentitySchema.coverBase64} on every row.
+      *
+      * Default `false`, the same inversion `listRecentFaces` and
+      * `listPlates` took on 2026-08-25 (see `include-crops-default.ts` for
+      * why the burden belongs on the caller that WANTS the bytes). Measured
+      * on the live hub the same day: four identities cost 40,979 B with the
+      * covers inline, ~10 KB of base64 per row, on a query this UI mounts
+      * four times and the viewer holds at `staleTime: 30_000`.
+      *
+      * Nothing loses its avatar: `coverMediaKey` is already on every row and
+      * the `event-media` plane serves that key `immutable` with an ETag.
+      *
+      * **This is an INPUT field, so it does not reach the addon until the
+      * next train** — the hub router validates cap inputs against its own
+      * compiled Zod and strips a key it does not know. Until then the
+      * provider sees `undefined`, which resolves to `false`: the cheap shape
+      * is what ships, and the opt-in becomes reachable when the train lands.
+      */
+      includeCrops: external_exports.boolean().optional()
+    }).optional(), external_exports.array(IdentitySchema).readonly()),
     createIdentity: method(external_exports.object({ name: external_exports.string().min(1) }), IdentitySchema, {
       kind: "mutation",
       auth: "admin"
@@ -34053,8 +34334,10 @@ var PlateInfoSchema = external_exports.object({
   keyFrameMediaKey: external_exports.string().optional(),
   base64: external_exports.string().optional(),
   /**
-  * Same crop as a data-plane URL. `getPlateByTrack` returns this and
-  * never inlines JPEG; `listPlates` still inlines for the admin-ui.
+  * Same crop as a data-plane URL, always present when the plate has a stored
+  * crop. `getPlateByTrack` returns this and never inlines JPEG; `listPlates`
+  * and `searchPlates` inline the crop only when their `includeCrops` input is
+  * left at its `true` default.
   */
   cropUrl: external_exports.string().optional()
 });
@@ -34079,7 +34362,25 @@ var plateGalleryCapability = {
   methods: {
     listPlates: method(external_exports.object({
       deviceId: external_exports.number().int().optional(),
-      limit: external_exports.number().int().positive().optional()
+      limit: external_exports.number().int().positive().optional(),
+      /**
+      * Inline the base64 crop on every row. Default `true` — the existing
+      * behaviour, kept so no caller breaks.
+      *
+      * Set `false` once the caller renders {@link PlateInfo.cropUrl}.
+      * Measured on the live hub at the 500 rows the Plates view asks for:
+      * 879,403 B and 27.7 s with the crops inline, against a few KiB of
+      * metadata without them — and the browser then caches the images.
+      *
+      * This is the plate twin of `faceGallery.listRecentFaces`'s option;
+      * plates were the one gallery list left without it.
+      *
+      * **This is an INPUT field, so it does not reach the addon until the
+      * next train.** The hub router validates cap inputs against its own
+      * compiled Zod and strips a key it does not know. Until the train
+      * ships, sending `false` is harmless and keeps the crops inline.
+      */
+      includeCrops: external_exports.boolean().optional()
     }).optional(), external_exports.array(PlateInfoSchema).readonly()),
     getPlateByTrack: method(external_exports.object({
       deviceId: external_exports.number().int(),
@@ -34090,7 +34391,9 @@ var plateGalleryCapability = {
     searchPlates: method(external_exports.object({
       text: external_exports.string().min(1),
       maxDistance: external_exports.number().int().min(0).optional(),
-      limit: external_exports.number().int().positive().optional()
+      limit: external_exports.number().int().positive().optional(),
+      /** See `listPlates.includeCrops`. Default `true`. */
+      includeCrops: external_exports.boolean().optional()
     }), external_exports.array(PlateInfoSchema).readonly()),
     /** Suggest groups of near-identical reads (same physical plate) for review/merge. */
     suggestPlateClusters: method(external_exports.object({
@@ -34110,7 +34413,14 @@ var plateGalleryCapability = {
       kind: "mutation",
       auth: "admin"
     }),
-    listVehicles: method(external_exports.void(), external_exports.array(VehicleSchema).readonly()),
+    listVehicles: method(external_exports.object({
+      /** Inline {@link VehicleSchema.coverBase64} on every row. Default
+      *  `false` — the vehicle twin of `faceGallery.listIdentities`'s
+      *  option; `coverMediaKey` + the `event-media` plane carry the picture.
+      *  INPUT field: stripped by the hub router until the train ships, which
+      *  resolves to `false` and is exactly the intended default. */
+      includeCrops: external_exports.boolean().optional()
+    }).optional(), external_exports.array(VehicleSchema).readonly()),
     createVehicle: method(external_exports.object({ name: external_exports.string().min(1) }), VehicleSchema, {
       kind: "mutation",
       auth: "admin"
@@ -40031,6 +40341,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.cancelRelocateMedia": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.cancelStorageMigrationMove": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -40205,6 +40521,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "view"
   },
+  "pipelineAnalytics.listRelocateMediaJobs": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "view"
+  },
   "pipelineAnalytics.listRetrainAnnotations": {
     capName: "pipeline-analytics",
     capScope: "device",
@@ -40283,6 +40605,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
     addonId: null,
     access: "create"
   },
+  "pipelineAnalytics.relocateMedia": {
+    capName: "pipeline-analytics",
+    capScope: "device",
+    addonId: null,
+    access: "create"
+  },
   "pipelineAnalytics.restageRetrainTrack": {
     capName: "pipeline-analytics",
     capScope: "device",