@camstack/system 1.2.135 → 1.2.137

package/dist/{dist-Bh25kEUH.mjs → dist-DMOTtKH8.mjs}

@@ -2568,8 +2568,17 @@ var adminUiCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
-		getStaticDir: method(z.void(), StaticDirOutputSchema$1),
-		getVersion: method(z.void(), VersionOutputSchema$1)
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — both methods were reachable on the AppRouter
+		* by ANY authenticated session at the default `auth: 'protected'`, and
+		* `getStaticDir` leaks a hub filesystem path. The only caller is
+		* `main.ts`'s static-file bootstrap, via `capRegistry.getSingletonForNode`
+		* — never tRPC — so `auth: 'admin'` costs it nothing. The actual admin-ui
+		* SPA assets are served as plain static files, unaffected by this gate.
+		*/
+		getStaticDir: method(z.void(), StaticDirOutputSchema$1, { auth: "admin" }),
+		getVersion: method(z.void(), VersionOutputSchema$1, { auth: "admin" })
 	}
 };
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
@@ -2905,8 +2914,23 @@ var viewerUiCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
-		getStaticDir: method(z.void(), StaticDirOutputSchema),
-		getVersion: method(z.void(), VersionOutputSchema)
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — both methods were reachable on the AppRouter
+		* by ANY authenticated session at the default `auth: 'protected'`, and
+		* `getStaticDir` leaks a hub filesystem path.
+		*
+		* ⚠ Checked before gating: the VIEWER app IS used by a non-admin user
+		* (`roberta`), but it never calls `viewerUi.*` over tRPC. The static SPA
+		* it loads is served by the plain `GET /viewer/*` Fastify route in
+		* `main.ts`, which reads `staticDir`/`indexPath` from a module-level
+		* cache populated ONCE at boot via `capRegistry.getSingletonForNode`
+		* (in-process, not tRPC) — the cap's tRPC procedure is never on that
+		* request path. `auth: 'admin'` here does not block a single viewer
+		* user from loading the app.
+		*/
+		getStaticDir: method(z.void(), StaticDirOutputSchema, { auth: "admin" }),
+		getVersion: method(z.void(), VersionOutputSchema, { auth: "admin" })
 	}
 };
 /**
@@ -5265,7 +5289,18 @@ var addonPagesSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: method(z.void(), z.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
 };
 var AddonHttpRouteSchema = z.object({
 	method: z.enum([
@@ -5562,7 +5597,20 @@ var addonWidgetsSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listWidgets: method(z.void(), z.array(WidgetMetadataSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-widgets-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+	* only, never tRPC. The public, enriched listing admin-ui actually
+	* consumes is the separate `addon-widgets` cap (`listWidgets` there is
+	* gated separately, and a `preAuth: true` widget is surfaced through the
+	* PUBLIC `auth.listLoginMethods` contribution channel instead) —
+	* neither is affected by this change.
+	*/
+listWidgets: method(z.void(), z.array(WidgetMetadataSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * `addon-widgets` — system-scoped singleton aggregator cap. Public-facing
@@ -7915,7 +7963,17 @@ var customModelRegistryCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the detection-pipeline's model resolution
+	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+	* never tRPC — so `auth: 'admin'` costs it nothing.
+	*/
+listModels: method(z.void(), z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
 };
 /**
 * Query filter for settings-store collections.
@@ -8184,6 +8242,23 @@ var EngineInfoSchema = z.object({
 * go through `settings-store`; they never see this cap, and an engine
 * never sees a caller.
 *
+* ⚠ **`internal: true` DOES NOT gate the mount, and until 2026-08-26 this
+* comment claimed otherwise.** `resolveCapMount` never reads the field, so this
+* cap was live on the AppRouter with every method at the default
+* `auth: 'protected'` — i.e. readable by ANY authenticated session, admin or
+* not. Verified against the live hub: `dataStoreProvider.query` returned raw
+* settings rows including a provider credential, bypassing the secret redaction
+* that `deviceManager.listAll` and friends go through.
+*
+* Every method is now `auth: 'admin'` EXPLICITLY, including the five reads —
+* they had no options object at all, which is exactly how they kept the
+* permissive default while the mutations looked deliberate. The explicit
+* annotation is the fix that works today; making `internal` mean something at
+* mount time is the systemic one, and it is not free: 22 caps declare it, only
+* 4 are `mount: 'skip'`, and forcing admin on all of them would change the auth
+* of surfaces the viewer and admin-ui call as non-admin users. That decision is
+* the operator's, not a side effect of this file.
+*
 * Design notes:
 *   - **Stateless dispatch.** Every method carries its own
 *     `namespace` + `collection`, so an engine keeps no per-caller state
@@ -8205,20 +8280,23 @@ var dataStoreProviderCapability = {
 	internal: true,
 	methods: {
 		/** Self-description — how the orchestrator picks a registrant. */
-		getEngineInfo: method(z.void(), EngineInfoSchema),
+		getEngineInfo: method(z.void(), EngineInfoSchema, { auth: "admin" }),
 		/** Get a single value by key from a collection. */
 		get: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.unknown()),
+		}), z.unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string(),
 			value: z.unknown()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Get all entries matching an optional filter. */
 		query: method(z.object({
 			namespace: z.string().optional(),
@@ -8227,52 +8305,80 @@ var dataStoreProviderCapability = {
 			/**
 			* SQL-level column projection — MUST mirror `settings-store.query`.
 			*
-			* This is the second schema the same call passes through, and Zod
-			* objects STRIP what they do not declare: a field present on the door
-			* and absent here does not error, it silently disappears one hop before
-			* the engine, and the caller concludes the projection does nothing.
-			* `data-door-schema-parity.spec.ts` is what keeps the two in step.
+			* ⚠ An earlier version of this comment blamed Zod stripping, and that
+			* was wrong — corrected 2026-08-26 after the hop map
+			* (`docs/design/2026-08-26-mappa-hop-argomenti.md`) traced the path.
+			* There is **no Zod parse at all** between the door and the engine: the
+			* dispatcher forwards the payload verbatim and UDS carries it whole. A
+			* field declared here reaches `SqliteSettingsBackend` either way.
+			*
+			* What actually lost `columns` was the THIRD declaration of this shape:
+			* `SettingsQueryInput` in `interfaces/storage.ts`, a hand-written TS
+			* interface the engine destructures from. The field existed on both
+			* schemas and the engine still never read it, because nothing checks a
+			* registered provider against `InferProvider<cap>` —
+			* `ProviderRegistration.provider` is typed `object`.
+			*
+			* It is declared here anyway, and must stay in step with
+			* `settings-store.query`: a caller reading only the cap definitions has
+			* to be able to see that this call carries a projection.
+			* `data-door-schema-parity.spec.ts` keeps the two aligned.
 			*/
 			columns: z.array(z.string()).readonly().optional()
-		}), z.array(SettingsRecordSchema).readonly()),
+		}), z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/** Insert a new record. */
 		insert: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			record: SettingsRecordSchema
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			id: z.string(),
 			data: z.record(z.string(), z.unknown())
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete every record matching `filter`, in one statement. */
 		deleteWhere: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: MutationFilterSchema
-		}), z.object({ deleted: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ deleted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Apply `data` to every record matching `filter`, in one statement. */
 		updateWhere: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: MutationFilterSchema,
 			data: z.record(z.string(), z.unknown())
-		}), z.object({ updated: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ updated: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: QueryFilterSchema.optional()
-		}), z.number()),
+		}), z.number(), { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(z.object({
 			namespace: z.string().optional(),
@@ -8284,19 +8390,22 @@ var dataStoreProviderCapability = {
 		}), z.array(z.object({
 			bucket: z.number().int(),
 			count: z.number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string()
-		}), z.boolean()),
+		}), z.boolean(), { auth: "admin" }),
 		/** Declare a typed (SQL-backed) collection with columns + indexes. */
 		declareCollection: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			columns: z.array(CollectionColumnSchema).readonly(),
 			indexes: z.array(CollectionIndexSchema).readonly().optional()
-		}), z.void(), { kind: "mutation" })
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -10141,13 +10250,20 @@ var embeddingEncoderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — every method below was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+		* `addon-post-analysis`, never tRPC.
+		*/
 		encode: method(z.object({
 			crop: z.instanceof(Uint8Array),
 			width: z.number(),
 			height: z.number()
-		}), EmbeddingResultSchema),
-		encodeText: method(z.object({ text: z.string() }), EmbeddingResultSchema),
-		getInfo: method(z.void(), EmbeddingInfoSchema)
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		encodeText: method(z.object({ text: z.string() }), EmbeddingResultSchema, { auth: "admin" }),
+		getInfo: method(z.void(), EmbeddingInfoSchema, { auth: "admin" })
 	}
 };
 /**
@@ -10458,12 +10574,28 @@ var llmRuntimeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
+		/**
+		* `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+		* `auth` override — `internal: true` did not gate the mount (see the
+		* 2026-08-26 note on `data-store-provider`), so they were reachable on
+		* the AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`, inconsistent with the rest of this cap (already
+		* `auth: 'admin'`) and with this file's own docblock: "the operator
+		* reaches this only through the `llm` cap's methods." The sole caller,
+		* `addon-ai`'s `runtime-client.ts`, reaches every method here via
+		* `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+		* nothing; the public `llm` cap (which end users and non-admin sessions
+		* legitimately call for chat/generation) is untouched.
+		*/
 		complete: method(LlmGenerateBaseInputSchema.extend({
 			images: z.array(LlmImageSchema).optional(),
 			runtime: ManagedRuntimeConfigSchema,
 			/** The managed profile's timeout, threaded by the hub provider. */
 			timeoutMs: z.number().int().positive().optional()
-		}), LlmGenerateResultSchema, { kind: "mutation" }),
+		}), LlmGenerateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		ensureStarted: method(z.object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -10472,7 +10604,7 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		status: method(z.object({}), LlmRuntimeStatusSchema),
+		status: method(z.object({}), LlmRuntimeStatusSchema, { auth: "admin" }),
 		installModel: method(z.object({ model: ManagedModelRefSchema }), z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -10481,8 +10613,8 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listLocalModels: method(z.object({}), z.array(LlmNodeModelSchema)),
-		getDiskUsage: method(z.object({}), LlmRuntimeDiskUsageSchema)
+		listLocalModels: method(z.object({}), z.array(LlmNodeModelSchema), { auth: "admin" }),
+		getDiskUsage: method(z.object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" })
 	}
 };
 /**
@@ -14331,7 +14463,17 @@ var oauthIntegrationCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { getDescriptor: method(z.void(), OauthIntegrationDescriptorSchema) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+	* by ANY authenticated session at the default `auth: 'protected'`. The
+	* real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+	* (`oauth2-routes.ts`), which resolve the provider directly off the
+	* capability registry — never through tRPC. `auth: 'admin'` closes the
+	* tRPC surface without touching that path.
+	*/
+getDescriptor: method(z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
@@ -19103,6 +19245,20 @@ var ssoBridgeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — `signBridgeToken` was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+		* SUPPLIED: an unprivileged session could have minted its own
+		* `isAdmin: true` bridge token and redeemed it at
+		* `/api/auth/sso/finish` to become admin — a full privilege escalation
+		* through the exact surface this cap exists to close (see the module
+		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+		* registration, the OIDC/magic-link addons) reaches this through
+		* `ctx.api` / the in-process registry — never through tRPC — so
+		* `auth: 'admin'` costs those callers nothing.
+		*/
 		signBridgeToken: method(z.object({
 			claims: SsoBridgeClaimsSchema,
 			/**
@@ -19115,8 +19271,8 @@ var ssoBridgeCapability = {
 			* linking rather than produce an eternal token.
 			*/
 			ttlSec: z.union([z.number().int().positive(), z.literal("never")]).optional()
-		}), z.object({ token: z.string() })),
-		verifyBridgeToken: method(z.object({ token: z.string() }), SsoBridgeClaimsSchema.nullable())
+		}), z.object({ token: z.string() }), { auth: "admin" }),
+		verifyBridgeToken: method(z.object({ token: z.string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" })
 	}
 };
 var ProviderListEntrySchema = z.discriminatedUnion("shouldSaveDiskSpace", [z.object({
@@ -19265,8 +19421,15 @@ var storageEvictableCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer is the orchestrator's `StoragePressureManager`, which calls
+		* `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
 		/** Bytes this provider holds on the given location — drives proportional fan-out. */
-		getEvictableUsage: method(z.object({ locationId: z.string() }), EvictableUsageSchema),
+		getEvictableUsage: method(z.object({ locationId: z.string() }), EvictableUsageSchema, { auth: "admin" }),
 		/**
 		* Free approximately `targetBytes` of this provider's OWN least-valuable
 		* data on the location (oldest footage, expired clips, …). Returns what it
@@ -19275,7 +19438,10 @@ var storageEvictableCapability = {
 		evict: method(z.object({
 			locationId: z.string(),
 			targetBytes: z.number().int().positive()
-		}), EvictResultSchema, { kind: "mutation" })
+		}), EvictResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /**
@@ -19378,43 +19544,82 @@ var storageProviderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* Every method below except `testLocation` had NO `auth` override —
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`), so this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`: arbitrary
+		* read/write/delete/list against any storage location the operator has
+		* configured, keyed only by a caller-supplied `location` + `relativePath`
+		* — the same "public consumers never see this cap" claim that was false
+		* for `data-store-provider`, here gating raw file I/O instead of raw
+		* settings rows. The only legitimate caller,
+		* `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+		* provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+		* on every method costs it nothing. Public consumers already go through
+		* the separate `storage` singleton cap.
+		*/
 		/** Self-description for the "Add location" wizard. */
-		getProviderInfo: method(z.void(), ProviderInfoSchema),
+		getProviderInfo: method(z.void(), ProviderInfoSchema, { auth: "admin" }),
 		/** Validate config + probe connectivity. Called on add and on edit. */
 		testLocation: method(z.object({ config: z.record(z.string(), z.unknown()) }), TestLocationResultSchema, { auth: "admin" }),
 		resolve: method(z.object({
 			location: StorageLocationSchema,
 			relativePath: z.string()
-		}), z.string()),
+		}), z.string(), { auth: "admin" }),
 		write: method(z.object({
 			location: StorageLocationSchema,
 			relativePath: z.string(),
 			data: z.instanceof(Uint8Array)
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: method(z.object({
 			location: StorageLocationSchema,
 			relativePath: z.string()
-		}), z.instanceof(Uint8Array)),
+		}), z.instanceof(Uint8Array), { auth: "admin" }),
 		exists: method(z.object({
 			location: StorageLocationSchema,
 			relativePath: z.string()
-		}), z.boolean()),
+		}), z.boolean(), { auth: "admin" }),
 		list: method(z.object({
 			location: StorageLocationSchema,
 			prefix: z.string().optional()
-		}), z.array(z.string()).readonly()),
+		}), z.array(z.string()).readonly(), { auth: "admin" }),
 		delete: method(z.object({
 			location: StorageLocationSchema,
 			relativePath: z.string()
-		}), z.void(), { kind: "mutation" }),
-		getAvailableSpace: method(z.object({ location: StorageLocationSchema }), z.number().nullable()),
-		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }),
-		writeChunk: method(WriteChunkInputSchema, z.void(), { kind: "mutation" }),
-		finalizeUpload: method(FinalizeUploadInputSchema, z.void(), { kind: "mutation" }),
-		abortUpload: method(AbortUploadInputSchema, z.void(), { kind: "mutation" }),
-		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }),
-		readChunk: method(ReadChunkInputSchema, z.instanceof(Uint8Array)),
-		endDownload: method(EndDownloadInputSchema, z.void(), { kind: "mutation" })
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getAvailableSpace: method(z.object({ location: StorageLocationSchema }), z.number().nullable(), { auth: "admin" }),
+		beginUpload: method(BeginUploadInputSchema, BeginUploadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		writeChunk: method(WriteChunkInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: method(FinalizeUploadInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: method(AbortUploadInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		beginDownload: method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		readChunk: method(ReadChunkInputSchema, z.instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: method(EndDownloadInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 /** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
@@ -19747,9 +19952,28 @@ var userPasskeysCapability = {
 			auth: "admin",
 			access: "create"
 		}),
+		/**
+		* The four methods below had NO `auth` override — `internal: true` did
+		* not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+		* so they were reachable on the AppRouter at the default
+		* `auth: 'protected'` (any authenticated session), inconsistent with
+		* every other method on this cap (all already `auth: 'admin'`).
+		*
+		* ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+		* methods, so admin-gating them here must not break login for an
+		* unauthenticated principal. It doesn't — the real login path is the
+		* PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+		* `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+		* procedures in `server/backend/src/api/core/auth.router.ts`, which call
+		* `provider.beginAuthentication(...)` etc. directly against the
+		* capability-registry-resolved provider — never through this cap's own
+		* tRPC route. `auth: 'admin'` here only closes a redundant, unused
+		* second entry point onto the same ceremony.
+		*/
 		beginAuthentication: method(z.object({ userId: z.string().optional() }), z.object({ optionsJSON: z.record(z.string(), z.unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishAuthentication: method(z.object({
 			/** Required — the user the assertion belongs to (verified). */
@@ -19758,11 +19982,13 @@ var userPasskeysCapability = {
 			response: z.record(z.string(), z.unknown())
 		}), z.object({ verified: z.boolean() }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		beginDiscoverableAuthentication: method(z.object({}), z.object({ optionsJSON: z.record(z.string(), z.unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishDiscoverableAuthentication: method(z.object({ 
 		/** AuthenticationResponseJSON from the browser. */
@@ -19771,7 +19997,8 @@ response: z.record(z.string(), z.unknown()) }), z.object({
 			userId: z.string().nullable()
 		}), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		listPasskeys: method(z.object({ userId: z.string() }), z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: method(z.object({
@@ -19949,6 +20176,14 @@ var VectorStatsResultSchema = z.object({
 	/** False when the backend ranks approximately. */
 	exact: z.boolean()
 });
+/**
+* `internal: true` did not gate the mount (see the 2026-08-26 note on
+* `data-store-provider`) — every method below was reachable on the AppRouter
+* by ANY authenticated session at the default `auth: 'protected'`. The only
+* consumers (`addon-post-analysis`'s embedding stores) reach this cap via
+* `ctx.api` — UDS/Moleculer, never tRPC — so `auth: 'admin'` on every method
+* costs them nothing. No client (viewer or admin-ui) calls `vectorStore.*`.
+*/
 var vectorStoreCapability = {
 	name: "vector-store",
 	scope: "system",
@@ -19956,14 +20191,26 @@ var vectorStoreCapability = {
 	internal: true,
 	methods: {
 		/** Idempotent. Re-declaring with a different `dim` is an error, not a wipe. */
-		declareIndex: method(VectorDeclareIndexInputSchema, z.void(), { kind: "mutation" }),
-		upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }),
-		query: method(VectorQueryInputSchema, VectorQueryResultSchema),
+		declareIndex: method(VectorDeclareIndexInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsert: method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
 		/** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
-		getByIds: method(VectorGetInputSchema, VectorGetResultSchema),
-		deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		stats: method(VectorStatsInputSchema, VectorStatsResultSchema)
+		getByIds: method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+		deleteByIds: method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteByFilter: method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stats: method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
 	}
 };
 var ClipSchema = z.object({