@camstack/types 1.2.107 → 1.2.109

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_event_category = require("./event-category-EY0GNjV9.js");
-const require_sleep = require("./sleep-CUuoW-kk.js");
+const require_sleep = require("./sleep-BJTBu5cu.js");
 const require_canonical_hash = require("./canonical-hash-DNV8S5ET.js");
 const require_enums = require("./enums.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
@@ -4349,7 +4349,18 @@ var addonPagesSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageDeclarationSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
 };
 //#endregion
 //#region src/capabilities/addon-routes.cap.ts
@@ -4652,7 +4663,20 @@ var addonWidgetsSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listWidgets: require_sleep.method(zod.z.void(), zod.z.array(WidgetMetadataSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-widgets-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-widgets-source')` — LOCAL-PROCESS
+	* only, never tRPC. The public, enriched listing admin-ui actually
+	* consumes is the separate `addon-widgets` cap (`listWidgets` there is
+	* gated separately, and a `preAuth: true` widget is surfaced through the
+	* PUBLIC `auth.listLoginMethods` contribution channel instead) —
+	* neither is affected by this change.
+	*/
+listWidgets: require_sleep.method(zod.z.void(), zod.z.array(WidgetMetadataSchema).readonly(), { auth: "admin" }) }
 };
 //#endregion
 //#region src/capabilities/addon-widgets.cap.ts
@@ -6840,6 +6864,44 @@ function objectInputDeclaresAddonId(schema) {
 function resolveDefShape(defShape) {
 	return typeof defShape === "function" ? defShape() : defShape;
 }
+/**
+* Effective auth for a cap method — the `internal: true` floor (Task 7.5c).
+*
+* `internal: true` on a cap def is a DECLARATION that its methods are for
+* in-process (`ctx.api`) consumption only. Nothing enforced that:
+* `resolveCapMount` never reads `internal` (an internal cap still gets a
+* full tRPC router), and a method that omitted an explicit `auth` used to
+* default — permanently, at `method()`-call time — to `'protected'`,
+* reachable by any authenticated session regardless of `internal`. That
+* silent default is how 45 procedures across 13 internal caps ended up
+* exposed, including `ssoBridge.signBridgeToken`: it accepted
+* caller-supplied claims (including `isAdmin`), was reachable by any
+* authenticated session, and its token is redeemed at
+* `/api/auth/sso/finish` to mint a session — a full privilege escalation.
+* See `docs/decisions/adr-0240-an-internal-cap-floors-its-unannotated-methods-to-admin.md`
+* (D240) for the record.
+*
+* The floor, exactly: an `internal` cap's method with NO explicit `auth`
+* resolves to `'admin'` instead of `'protected'`. A method that DELIBERATELY
+* declares an explicit `auth` — public, protected, or admin — keeps it
+* unconditionally; the author already said what they meant, and an
+* annotation that happens to agree with the floor is documentation, not
+* redundancy. A non-`internal` cap's un-annotated method is unaffected
+* (still `'protected'`). This is a FLOOR, not a hard `mount: 'skip'` — that
+* would also override a deliberate `auth: 'public'`/`'protected'` choice,
+* which is not the defect being closed.
+*
+* `method()` (`capability-definition.ts`) deliberately leaves `auth`
+* UNSET when the caller omits it (rather than defaulting there) so the
+* "was this explicit" bit survives to this single resolution point. Single
+* source of truth shared by the runtime builder (`cap-router-builder.ts`)
+* and the codegen (`generate-cap-routers.ts`, `gen-api-reference.ts`) — the
+* two must never disagree, a documented failure mode in this repo.
+*/
+function resolveMethodAuth(def, method) {
+	if (method.auth !== void 0) return method.auth;
+	return def.internal === true ? "admin" : "protected";
+}
 /** Auth level → base-procedure key. `superAdmin` collapses to `admin`. */
 function procedureAuthKey(auth) {
 	if (auth === "public") return "public";
@@ -7101,7 +7163,17 @@ var customModelRegistryCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { listModels: require_sleep.method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly()) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the detection-pipeline's model resolution
+	* (`addon-pipeline/src/detection-pipeline/provider.ts`), calls
+	* `ctx.api.customModelRegistry.listModels.query()` — UDS/Moleculer,
+	* never tRPC — so `auth: 'admin'` costs it nothing.
+	*/
+listModels: require_sleep.method(zod.z.void(), zod.z.array(CustomModelDescriptorSchema).readonly(), { auth: "admin" }) }
 };
 //#endregion
 //#region src/capabilities/settings-store.cap.ts
@@ -9522,13 +9594,20 @@ var embeddingEncoderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — every method below was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. Consumers reach the encoder via `ctx.api` from
+		* `addon-post-analysis`, never tRPC.
+		*/
 		encode: require_sleep.method(zod.z.object({
 			crop: zod.z.instanceof(Uint8Array),
 			width: zod.z.number(),
 			height: zod.z.number()
-		}), EmbeddingResultSchema),
-		encodeText: require_sleep.method(zod.z.object({ text: zod.z.string() }), EmbeddingResultSchema),
-		getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema)
+		}), EmbeddingResultSchema, { auth: "admin" }),
+		encodeText: require_sleep.method(zod.z.object({ text: zod.z.string() }), EmbeddingResultSchema, { auth: "admin" }),
+		getInfo: require_sleep.method(zod.z.void(), EmbeddingInfoSchema, { auth: "admin" })
 	}
 };
 //#endregion
@@ -9869,7 +9948,23 @@ var llmRuntimeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
-		complete: require_sleep.method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, { kind: "mutation" }),
+		/**
+		* `complete`, `status`, `listLocalModels` and `getDiskUsage` had NO
+		* `auth` override — `internal: true` did not gate the mount (see the
+		* 2026-08-26 note on `data-store-provider`), so they were reachable on
+		* the AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`, inconsistent with the rest of this cap (already
+		* `auth: 'admin'`) and with this file's own docblock: "the operator
+		* reaches this only through the `llm` cap's methods." The sole caller,
+		* `addon-ai`'s `runtime-client.ts`, reaches every method here via
+		* `ctx.api` + `nodePin` — never tRPC — so `auth: 'admin'` costs it
+		* nothing; the public `llm` cap (which end users and non-admin sessions
+		* legitimately call for chat/generation) is untouched.
+		*/
+		complete: require_sleep.method(LlmRuntimeCompleteInputSchema, LlmGenerateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		ensureStarted: require_sleep.method(zod.z.object({ runtime: ManagedRuntimeConfigSchema }), LlmRuntimeStatusSchema, {
 			kind: "mutation",
 			auth: "admin"
@@ -9878,7 +9973,7 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		status: require_sleep.method(zod.z.object({}), LlmRuntimeStatusSchema),
+		status: require_sleep.method(zod.z.object({}), LlmRuntimeStatusSchema, { auth: "admin" }),
 		installModel: require_sleep.method(zod.z.object({ model: ManagedModelRefSchema }), zod.z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -9887,8 +9982,8 @@ var llmRuntimeCapability = {
 			kind: "mutation",
 			auth: "admin"
 		}),
-		listLocalModels: require_sleep.method(zod.z.object({}), zod.z.array(LlmNodeModelSchema)),
-		getDiskUsage: require_sleep.method(zod.z.object({}), LlmRuntimeDiskUsageSchema)
+		listLocalModels: require_sleep.method(zod.z.object({}), zod.z.array(LlmNodeModelSchema), { auth: "admin" }),
+		getDiskUsage: require_sleep.method(zod.z.object({}), LlmRuntimeDiskUsageSchema, { auth: "admin" })
 	}
 };
 //#endregion
@@ -14666,7 +14761,17 @@ var oauthIntegrationCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
-	methods: { getDescriptor: require_sleep.method(zod.z.void(), OauthIntegrationDescriptorSchema) }
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — `getDescriptor` was reachable on the AppRouter
+	* by ANY authenticated session at the default `auth: 'protected'`. The
+	* real caller is `/api/oauth2/authorize` and `/api/oauth2/integrations`
+	* (`oauth2-routes.ts`), which resolve the provider directly off the
+	* capability registry — never through tRPC. `auth: 'admin'` closes the
+	* tRPC surface without touching that path.
+	*/
+getDescriptor: require_sleep.method(zod.z.void(), OauthIntegrationDescriptorSchema, { auth: "admin" }) }
 };
 //#endregion
 //#region src/capabilities/pipeline-analytics.cap.ts
@@ -19679,6 +19784,20 @@ var ssoBridgeCapability = {
 	mode: "singleton",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — `signBridgeToken` was reachable on the
+		* AppRouter by ANY authenticated session at the default
+		* `auth: 'protected'`. The claims (including `isAdmin`) are CALLER-
+		* SUPPLIED: an unprivileged session could have minted its own
+		* `isAdmin: true` bridge token and redeemed it at
+		* `/api/auth/sso/finish` to become admin — a full privilege escalation
+		* through the exact surface this cap exists to close (see the module
+		* docblock). Every real caller (`oauth-grants.ts`, `main.ts`
+		* registration, the OIDC/magic-link addons) reaches this through
+		* `ctx.api` / the in-process registry — never through tRPC — so
+		* `auth: 'admin'` costs those callers nothing.
+		*/
 		signBridgeToken: require_sleep.method(zod.z.object({
 			claims: SsoBridgeClaimsSchema,
 			/**
@@ -19691,8 +19810,8 @@ var ssoBridgeCapability = {
 			* linking rather than produce an eternal token.
 			*/
 			ttlSec: zod.z.union([zod.z.number().int().positive(), zod.z.literal("never")]).optional()
-		}), zod.z.object({ token: zod.z.string() })),
-		verifyBridgeToken: require_sleep.method(zod.z.object({ token: zod.z.string() }), SsoBridgeClaimsSchema.nullable())
+		}), zod.z.object({ token: zod.z.string() }), { auth: "admin" }),
+		verifyBridgeToken: require_sleep.method(zod.z.object({ token: zod.z.string() }), SsoBridgeClaimsSchema.nullable(), { auth: "admin" })
 	}
 };
 //#endregion
@@ -19845,8 +19964,15 @@ var storageEvictableCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`) — this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`. The only
+		* consumer is the orchestrator's `StoragePressureManager`, which calls
+		* `ctx.api` — never tRPC — so `auth: 'admin'` costs it nothing.
+		*/
 		/** Bytes this provider holds on the given location — drives proportional fan-out. */
-		getEvictableUsage: require_sleep.method(zod.z.object({ locationId: zod.z.string() }), EvictableUsageSchema),
+		getEvictableUsage: require_sleep.method(zod.z.object({ locationId: zod.z.string() }), EvictableUsageSchema, { auth: "admin" }),
 		/**
 		* Free approximately `targetBytes` of this provider's OWN least-valuable
 		* data on the location (oldest footage, expired clips, …). Returns what it
@@ -19855,7 +19981,10 @@ var storageEvictableCapability = {
 		evict: require_sleep.method(zod.z.object({
 			locationId: zod.z.string(),
 			targetBytes: zod.z.number().int().positive()
-		}), EvictResultSchema, { kind: "mutation" })
+		}), EvictResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -19962,43 +20091,82 @@ var storageProviderCapability = {
 	mode: "collection",
 	internal: true,
 	methods: {
+		/**
+		* Every method below except `testLocation` had NO `auth` override —
+		* `internal: true` did not gate the mount (see the 2026-08-26 note on
+		* `data-store-provider`), so this was reachable on the AppRouter by ANY
+		* authenticated session at the default `auth: 'protected'`: arbitrary
+		* read/write/delete/list against any storage location the operator has
+		* configured, keyed only by a caller-supplied `location` + `relativePath`
+		* — the same "public consumers never see this cap" claim that was false
+		* for `data-store-provider`, here gating raw file I/O instead of raw
+		* settings rows. The only legitimate caller,
+		* `addon-registry.service.ts`'s `activeStorageProvider`, calls the
+		* provider object directly (in-process) — never tRPC — so `auth: 'admin'`
+		* on every method costs it nothing. Public consumers already go through
+		* the separate `storage` singleton cap.
+		*/
 		/** Self-description for the "Add location" wizard. */
-		getProviderInfo: require_sleep.method(zod.z.void(), ProviderInfoSchema),
+		getProviderInfo: require_sleep.method(zod.z.void(), ProviderInfoSchema, { auth: "admin" }),
 		/** Validate config + probe connectivity. Called on add and on edit. */
 		testLocation: require_sleep.method(zod.z.object({ config: zod.z.record(zod.z.string(), zod.z.unknown()) }), TestLocationResultSchema, { auth: "admin" }),
 		resolve: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			relativePath: zod.z.string()
-		}), zod.z.string()),
+		}), zod.z.string(), { auth: "admin" }),
 		write: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			relativePath: zod.z.string(),
 			data: zod.z.instanceof(Uint8Array)
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			relativePath: zod.z.string()
-		}), zod.z.instanceof(Uint8Array)),
+		}), zod.z.instanceof(Uint8Array), { auth: "admin" }),
 		exists: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			relativePath: zod.z.string()
-		}), zod.z.boolean()),
+		}), zod.z.boolean(), { auth: "admin" }),
 		list: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			prefix: zod.z.string().optional()
-		}), zod.z.array(zod.z.string()).readonly()),
+		}), zod.z.array(zod.z.string()).readonly(), { auth: "admin" }),
 		delete: require_sleep.method(zod.z.object({
 			location: StorageLocationSchema,
 			relativePath: zod.z.string()
-		}), zod.z.void(), { kind: "mutation" }),
-		getAvailableSpace: require_sleep.method(zod.z.object({ location: StorageLocationSchema }), zod.z.number().nullable()),
-		beginUpload: require_sleep.method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }),
-		writeChunk: require_sleep.method(WriteChunkInputSchema, zod.z.void(), { kind: "mutation" }),
-		finalizeUpload: require_sleep.method(FinalizeUploadInputSchema, zod.z.void(), { kind: "mutation" }),
-		abortUpload: require_sleep.method(AbortUploadInputSchema, zod.z.void(), { kind: "mutation" }),
-		beginDownload: require_sleep.method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }),
-		readChunk: require_sleep.method(ReadChunkInputSchema, zod.z.instanceof(Uint8Array)),
-		endDownload: require_sleep.method(EndDownloadInputSchema, zod.z.void(), { kind: "mutation" })
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getAvailableSpace: require_sleep.method(zod.z.object({ location: StorageLocationSchema }), zod.z.number().nullable(), { auth: "admin" }),
+		beginUpload: require_sleep.method(BeginUploadInputSchema, BeginUploadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		writeChunk: require_sleep.method(WriteChunkInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: require_sleep.method(FinalizeUploadInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: require_sleep.method(AbortUploadInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		beginDownload: require_sleep.method(BeginDownloadInputSchema, BeginDownloadResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		readChunk: require_sleep.method(ReadChunkInputSchema, zod.z.instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: require_sleep.method(EndDownloadInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -20337,9 +20505,28 @@ var userPasskeysCapability = {
 			auth: "admin",
 			access: "create"
 		}),
+		/**
+		* The four methods below had NO `auth` override — `internal: true` did
+		* not gate the mount (see the 2026-08-26 note on `data-store-provider`),
+		* so they were reachable on the AppRouter at the default
+		* `auth: 'protected'` (any authenticated session), inconsistent with
+		* every other method on this cap (all already `auth: 'admin'`).
+		*
+		* ⚠ Checked before gating: these are also the PRE-AUTH login-ceremony
+		* methods, so admin-gating them here must not break login for an
+		* unauthenticated principal. It doesn't — the real login path is the
+		* PUBLIC `auth.beginAuthentication` / `auth.finishAuthentication` /
+		* `auth.beginDiscoverableAuthentication` / `auth.finishDiscoverableAuthentication`
+		* procedures in `server/backend/src/api/core/auth.router.ts`, which call
+		* `provider.beginAuthentication(...)` etc. directly against the
+		* capability-registry-resolved provider — never through this cap's own
+		* tRPC route. `auth: 'admin'` here only closes a redundant, unused
+		* second entry point onto the same ceremony.
+		*/
 		beginAuthentication: require_sleep.method(zod.z.object({ userId: zod.z.string().optional() }), zod.z.object({ optionsJSON: zod.z.record(zod.z.string(), zod.z.unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishAuthentication: require_sleep.method(zod.z.object({
 			/** Required — the user the assertion belongs to (verified). */
@@ -20348,11 +20535,13 @@ var userPasskeysCapability = {
 			response: zod.z.record(zod.z.string(), zod.z.unknown())
 		}), zod.z.object({ verified: zod.z.boolean() }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		beginDiscoverableAuthentication: require_sleep.method(zod.z.object({}), zod.z.object({ optionsJSON: zod.z.record(zod.z.string(), zod.z.unknown()) }), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		finishDiscoverableAuthentication: require_sleep.method(zod.z.object({ 
 		/** AuthenticationResponseJSON from the browser. */
@@ -20361,7 +20550,8 @@ response: zod.z.record(zod.z.string(), zod.z.unknown()) }), zod.z.object({
 			userId: zod.z.string().nullable()
 		}), {
 			kind: "mutation",
-			access: "view"
+			access: "view",
+			auth: "admin"
 		}),
 		listPasskeys: require_sleep.method(zod.z.object({ userId: zod.z.string() }), zod.z.array(PasskeySummarySchema), { auth: "admin" }),
 		removePasskey: require_sleep.method(zod.z.object({
@@ -20541,6 +20731,14 @@ var VectorStatsResultSchema = zod.z.object({
 	/** False when the backend ranks approximately. */
 	exact: zod.z.boolean()
 });
+/**
+* `internal: true` did not gate the mount (see the 2026-08-26 note on
+* `data-store-provider`) — every method below was reachable on the AppRouter
+* by ANY authenticated session at the default `auth: 'protected'`. The only
+* consumers (`addon-post-analysis`'s embedding stores) reach this cap via
+* `ctx.api` — UDS/Moleculer, never tRPC — so `auth: 'admin'` on every method
+* costs them nothing. No client (viewer or admin-ui) calls `vectorStore.*`.
+*/
 var vectorStoreCapability = {
 	name: "vector-store",
 	scope: "system",
@@ -20548,14 +20746,26 @@ var vectorStoreCapability = {
 	internal: true,
 	methods: {
 		/** Idempotent. Re-declaring with a different `dim` is an error, not a wipe. */
-		declareIndex: require_sleep.method(VectorDeclareIndexInputSchema, zod.z.void(), { kind: "mutation" }),
-		upsert: require_sleep.method(VectorUpsertInputSchema, VectorUpsertResultSchema, { kind: "mutation" }),
-		query: require_sleep.method(VectorQueryInputSchema, VectorQueryResultSchema),
+		declareIndex: require_sleep.method(VectorDeclareIndexInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsert: require_sleep.method(VectorUpsertInputSchema, VectorUpsertResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		query: require_sleep.method(VectorQueryInputSchema, VectorQueryResultSchema, { auth: "admin" }),
 		/** Metadata by id, no vectors — see {@link VectorGetResultSchema}. */
-		getByIds: require_sleep.method(VectorGetInputSchema, VectorGetResultSchema),
-		deleteByIds: require_sleep.method(VectorDeleteInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		deleteByFilter: require_sleep.method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, { kind: "mutation" }),
-		stats: require_sleep.method(VectorStatsInputSchema, VectorStatsResultSchema)
+		getByIds: require_sleep.method(VectorGetInputSchema, VectorGetResultSchema, { auth: "admin" }),
+		deleteByIds: require_sleep.method(VectorDeleteInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteByFilter: require_sleep.method(VectorDeleteByFilterInputSchema, VectorDeleteResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stats: require_sleep.method(VectorStatsInputSchema, VectorStatsResultSchema, { auth: "admin" })
 	}
 };
 //#endregion
@@ -48919,6 +49129,7 @@ exports.resolveDeviceProfile = resolveDeviceProfile;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveFormat = resolveFormat;
 exports.resolveHydratedFieldValue = require_sleep.resolveHydratedFieldValue;
+exports.resolveMethodAuth = resolveMethodAuth;
 exports.resolveModelFormat = resolveModelFormat;
 exports.resolveMutate = resolveMutate;
 exports.resolvePoolMemoryPolicy = resolvePoolMemoryPolicy;