@camstack/addon-post-analysis 1.2.108 → 1.2.110

package/dist/{dist-BV5xFo8f.js → dist-RzJseCJP.js}

@@ -8291,6 +8291,15 @@ var LabelDefinitionSchema = object({
 	description: string().optional(),
 	icon: string().optional()
 });
+var ClassMapDefinitionSchema = object({
+	mapping: record(string(), _enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -8469,7 +8478,13 @@ var ModelCatalogEntrySchema = object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = discriminatedUnion("format", [object({
 	format: literal("openvino"),
@@ -8498,7 +8513,8 @@ var ModelConvertMetadataSchema = object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: boolean().optional()
+	faceAlignment: boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertResultSchema = object({
 	entry: ModelCatalogEntrySchema,
@@ -18793,6 +18809,33 @@ var NativeCropRefSchema = object({
 		h: number()
 	})
 });
+object({
+	crop: object({
+		left: number(),
+		top: number(),
+		width: number().positive(),
+		height: number().positive()
+	}).optional(),
+	content: object({
+		width: number().int().positive(),
+		height: number().int().positive()
+	}),
+	fit: _enum(["stretch", "contain"]),
+	format: _enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = object({
+	registryId: string().min(1),
+	id: string().min(1),
+	width: number().int().positive(),
+	height: number().int().positive(),
+	format: _enum(["rgb", "gray"]),
+	timestamp: number(),
+	capturedAt: number().optional()
+});
 var ModelFormatSchema$1 = _enum([
 	"onnx",
 	"coreml",
@@ -19037,6 +19080,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
 	/**
+	* Process-local lazy frame. Valid only when caller and provider resolve
+	* in the same execution-group process; split/cross-node callers use
+	* `frame`/`image` inline compatibility instead.
+	*/
+	frameRef: FrameRefSchema.optional(),
+	/**
 	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 	* the decoded pixels live in. One more member of the one-of
 	* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -19332,7 +19381,10 @@ var NativeCropResultSchema = object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -19823,12 +19875,41 @@ var RunnerLocalLoadSchema = object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = object({
+	framesDecoded: number(),
+	framesAdmitted: number(),
+	framesDroppedPixelFree: number(),
+	viewsMaterialized: number(),
+	viewsSkipped: number(),
+	workerToRunnerBytes: number(),
+	runnerToPoolRawBytes: number(),
+	runnerToPoolJpegBytes: number(),
+	onDemandFullFrameRequests: number(),
+	onDemandCropRequests: number(),
+	nativeHits: number(),
+	nativeMisses: number(),
+	tileHits: number(),
+	tileMisses: number(),
+	fallbackHits: number(),
+	fallbackMisses: number(),
+	retainedWritesAvoided: number(),
+	residentRefs: number(),
+	residentBytes: number(),
+	releases: number(),
+	evictions: number(),
+	staleMisses: number()
+});
+var FrameLazyMetricsSchema = object({
+	node: FrameLazyCountersSchema,
+	cameras: array(FrameLazyCountersSchema.extend({ deviceId: number() }))
+});
 var RunnerLocalMetricsSchema = object({
 	nodeId: string(),
 	activeCameras: number(),
 	throttledCameras: number(),
 	avgInferenceTimeMs: number(),
-	queueDepth: number()
+	queueDepth: number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 method(RunnerCameraConfigSchema, object({ success: literal(true) }), { kind: "mutation" }), method(object({ deviceId: number() }), object({ success: literal(true) }), { kind: "mutation" }), method(ReportMotionInputSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), RunnerLocalLoadSchema), method(_void(), RunnerLocalMetricsSchema), method(object({ deviceId: number() }), CameraMetricsSchema.nullable()), method(_void(), array(CameraMetricsWithDeviceIdSchema).readonly()), method(_void(), array(number()).readonly()), method(object({
 	handle: FrameHandleSchema,
@@ -21158,6 +21239,9 @@ method(_void(), ProviderInfoSchema), method(object({ config: record(string(), un
 	location: StorageLocationSchema,
 	relativePath: string()
 }), _void(), { kind: "mutation" }), method(object({ location: StorageLocationSchema }), number().nullable()), method(BeginUploadInputSchema, BeginUploadResultSchema, { kind: "mutation" }), method(WriteChunkInputSchema, _void(), { kind: "mutation" }), method(FinalizeUploadInputSchema, _void(), { kind: "mutation" }), method(AbortUploadInputSchema, _void(), { kind: "mutation" }), method(BeginDownloadInputSchema, BeginDownloadResultSchema, { kind: "mutation" }), method(ReadChunkInputSchema, _instanceof(Uint8Array)), method(EndDownloadInputSchema, _void(), { kind: "mutation" });
+/** Profile-exported FormBuilder schema. Shape is ConfigUISchema at the UI. */
+var ProfileSettingsSchemaBridge = unknown().nullable();
+var ProfileSettingsBagSchema = record(string(), unknown());
 /**
 * A live terminal session hosted by the provider addon. Output and input do
 * NOT flow through the capability — they use the addon data plane
@@ -21187,7 +21271,14 @@ var TerminalSessionInfoSchema = object({
 var TerminalProfileInfoSchema = object({
 	profileId: string(),
 	label: string(),
-	description: string().optional()
+	description: string().optional(),
+	/** Spawn defaults the instance form copies on create. */
+	executable: string().optional(),
+	args: array(string()).readonly().optional(),
+	cwd: string().optional(),
+	environment: array(string()).readonly().optional(),
+	/** ConfigUISchema for instance knobs, or null when the profile has none. */
+	settingsSchema: ProfileSettingsSchemaBridge.optional()
 });
 /**
 * A durable operator-created Terminal instance. Profiles are templates; only
@@ -21200,7 +21291,12 @@ var TerminalInstanceInfoSchema = object({
 	profileId: string(),
 	profileLabel: string(),
 	name: string(),
-	enabled: boolean()
+	enabled: boolean(),
+	executable: string(),
+	args: array(string()).readonly(),
+	cwd: string(),
+	environment: array(string()).readonly(),
+	profileSettings: ProfileSettingsBagSchema
 });
 var TerminalLegacyCameraSchema = object({
 	stableId: string(),
@@ -21230,7 +21326,23 @@ var TerminalOutputBatchSchema = object({
 method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }), method(_void(), array(TerminalInstanceInfoSchema).readonly(), { auth: "admin" }), method(object({
 	targetNodeId: string().min(1),
 	profileId: string().min(1),
-	name: string().trim().min(1).max(160).optional()
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
+}), TerminalInstanceInfoSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	instanceId: string().min(1),
+	name: string().trim().min(1).max(160).optional(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional(),
+	profileSettings: ProfileSettingsBagSchema.optional()
 }), TerminalInstanceInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -21252,7 +21364,11 @@ method(_void(), array(TerminalProfileInfoSchema).readonly(), { auth: "admin" }),
 }), method(_void(), array(TerminalSessionInfoSchema).readonly(), { auth: "admin" }), method(object({
 	profileId: string(),
 	cols: number().int().positive(),
-	rows: number().int().positive()
+	rows: number().int().positive(),
+	executable: string().max(1024).optional(),
+	args: array(string().max(2048)).max(64).optional(),
+	cwd: string().max(1024).optional(),
+	environment: array(string().max(4096)).max(64).optional()
 }), TerminalSessionInfoSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -25167,10 +25283,10 @@ var lawnMowerControlCapability = {
 *
 *  • The SDK (mobile / web client) consumes `getConnectionEndpoints()`
 *    to receive an ordered list of candidate base URLs it should race
-*    on connect — LAN IPv4 first (lowest latency when on same network),
-*    then public hostname (if a tunnel is up), then IPv6. The SDK can
-*    race them with short timeouts and stick with the winner for the
-*    session.
+*    on connect — LAN IPv4 and stable LAN IPv6 first (lowest latency
+*    when on the same network), then public hostname (if a tunnel is
+*    up). The SDK can race them with short timeouts and stick with the
+*    winner for the session.
 *
 * Why hub-only: agents are not directly addressable by the operator's
 * clients — they reverse-connect to the hub. Exposing their interfaces
@@ -25325,6 +25441,17 @@ var NotificationEndpointSchema = object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: array(string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: array(string()).readonly()
+});
 var AllowedAddressesSchema = object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -25333,6 +25460,20 @@ var AllowedAddressesSchema = object({
 * Network Addresses admin page and persisted by the addon.
 */
 addresses: array(string()).readonly() });
+var TlsStatusSchema = object({
+	mode: _enum([
+		"generated",
+		"uploaded",
+		"disabled"
+	]),
+	leafFingerprintSha256: string().nullable(),
+	caFingerprintSha256: string().nullable(),
+	validTo: string().nullable(),
+	sans: array(string()),
+	caCertPem: string().nullable(),
+	reissueError: string().nullable(),
+	restartRequired: boolean()
+});
 method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(object({
 	/**
 	* LEGACY HINT — do not send from new code. Kept optional so clients
@@ -25342,17 +25483,31 @@ method(_void(), ListResultSchema), method(_void(), PreferredSchema), method(obje
 	*/
 	port: number().int().min(1).max(65535).optional(),
 	/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-	*  candidate. Default `true`. */
+	*  candidate. Default `false` — loopback is not a client route. */
 	includeLoopback: boolean().optional(),
-	/** Skip IPv6 entries. Some legacy clients can't parse them.
-	*  Default `false`. */
+	/** Skip IPv6 entries. Default `false` — the palette includes stable
+	*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+	*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 	ipv4Only: boolean().optional(),
 	/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 	*  Pass `'https'` when the caller is itself loaded over HTTPS
 	*  to avoid mixed-content blocks in the browser. The public
 	*  tunnel always emits `https://` regardless. */
 	scheme: _enum(["http", "https"]).optional()
-}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" });
+}), GetConnectionEndpointsResultSchema), method(_void(), NotificationEndpointSchema), method(object({ baseUrl: string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }), method(_void(), ViewerEndpointsSchema), method(object({ baseUrls: array(string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }), method(_void(), AllowedAddressesSchema), method(AllowedAddressesSchema, object({ success: literal(true) }), { kind: "mutation" }), method(_void(), AllowedAddressesSchema, { kind: "mutation" }), method(_void(), TlsStatusSchema), method(object({ reason: string().optional() }), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	certPem: string().min(1),
+	keyPem: string().min(1),
+	caPem: string().optional()
+}), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), object({ pem: string() })), method(_void(), TlsStatusSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 var LockControlStatusSchema = object({
 	/** Lifecycle state of the lock. `jammed` means the motor reported
 	*  failure to reach the target — operator intervention required. */
@@ -33490,6 +33645,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.downloadCa": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.getAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -33514,18 +33675,42 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getTlsStatus": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.regenerateCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.resetAllowlistToBestMatch": {
 		capName: "local-network",
 		capScope: "system",
 		addonId: null,
 		access: "delete"
 	},
+	"localNetwork.revertToGeneratedCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.setAllowedAddresses": {
 		capName: "local-network",
 		capScope: "system",
@@ -33538,6 +33723,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"localNetwork.uploadCertificate": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"lockControl.lock": {
 		capName: "lock-control",
 		capScope: "device",
@@ -36418,6 +36615,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"terminalSession.updateInstance": {
+		capName: "terminal-session",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"terminalSession.writeInput": {
 		capName: "terminal-session",
 		capScope: "system",
@@ -39169,6 +39372,35 @@ function pickClusterStepModels(view) {
 	}
 	return readClusterStepModels(flat);
 }
+var CLUSTER_STEP_SETTING_FIELDS = [{
+	stepId: "face-embedding",
+	key: "minLandmarkFaceSize",
+	label: "Min face size for recognition (detection px)",
+	description: "Refuse to embed a face smaller than this IN THE DETECTION FRAME. Applies to every node — the enrolled gallery is one index, and two admission floors would fill it from two policies. 0 disables the gate.",
+	type: "slider",
+	min: 0,
+	max: 64,
+	step: 2,
+	default: 24
+}];
+function clusterStepSettingKey(stepId, fieldKey) {
+	return `clusterStepSetting:${stepId}:${fieldKey}`;
+}
+var ClusterSettingNumberSchema = number().finite();
+function readClusterStepSettings(config) {
+	const out = {};
+	for (const field of CLUSTER_STEP_SETTING_FIELDS) {
+		const parsed = ClusterSettingNumberSchema.safeParse(config[clusterStepSettingKey(field.stepId, field.key)]);
+		const value = parsed.success ? parsed.data : field.default;
+		const existing = out[field.stepId] ?? {};
+		out[field.stepId] = {
+			...existing,
+			[field.key]: value
+		};
+	}
+	return out;
+}
+readClusterStepSettings({});
 object({
 	/**
 	* Fraction of the box's own size added on EACH side before cutting.

package/dist/embedding-encoder/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-BV5xFo8f.js");
+const require_dist = require("../dist-RzJseCJP.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_dist.__toESM(node_fs, 1);
 node_fs = require_dist.__toESM(node_fs);
@@ -60,7 +60,7 @@ function readViaPs(pid) {
 	});
 }
 //#endregion
-//#region ../system/dist/file-data-plane-CuE_hBli.mjs
+//#region ../system/dist/file-data-plane-BhKdxJgf.mjs
 function isNonEmptyFile(filePath) {
 	return node_fs$1.existsSync(filePath) && node_fs$1.statSync(filePath).size > 0;
 }
@@ -86,21 +86,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (node_fs$1.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	node_fs$1.mkdirSync(node_path$1.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -111,9 +146,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();

package/dist/embedding-encoder/index.mjs

@@ -1,4 +1,4 @@
-import { A as PoolMemoryWatchdog, St as BaseAddon, ct as parseProcStatus, et as embeddingEncoderCapability, mt as resolvePoolMemoryPolicy, rt as hfModelUrl } from "../dist-DFNQ5VB_.mjs";
+import { A as PoolMemoryWatchdog, St as BaseAddon, ct as parseProcStatus, et as embeddingEncoderCapability, mt as resolvePoolMemoryPolicy, rt as hfModelUrl } from "../dist-BtpxOtGv.mjs";
 import { createRequire } from "node:module";
 import * as fs from "node:fs";
 import "node:fs";
@@ -68,7 +68,7 @@ function readViaPs(pid) {
 	});
 }
 //#endregion
-//#region ../system/dist/file-data-plane-CuE_hBli.mjs
+//#region ../system/dist/file-data-plane-BhKdxJgf.mjs
 function isNonEmptyFile(filePath) {
 	return fs.existsSync(filePath) && fs.statSync(filePath).size > 0;
 }
@@ -94,21 +94,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (fs.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	fs.mkdirSync(path$1.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -119,9 +154,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();

package/dist/pipeline-analytics/_stub.js

@@ -1,6 +1,6 @@
 import { a as e, i as t, n, o as r, r as i, t as a } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare__react__loadShare__.js-C0AuF9av.mjs";
 import { t as o } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_tanstack_mf_1_react_mf_2_query__loadShare__.js-B3Wx5J80.mjs";
-import { a as s, i as c, n as l, o as u, r as d, s as f, t as p } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-bze3q2fV.mjs";
+import { a as s, i as c, n as l, o as u, r as d, s as f, t as p } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare___mf_0_camstack_mf_1_ui_mf_2_library__loadShare__.js-m0Jqwk3C.mjs";
 import { n as m, r as h, t as g } from "./_virtual_mf___mfe_internal__addon_pipeline_analytics_widgets__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-Bm-iyjmq.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils.js
 var _ = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), v = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), y = (e) => {

package/dist/pipeline-analytics/{_virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-v1VQLSa-.mjs → _virtual_mf-localSharedImportMap___mfe_internal__addon_pipeline_analytics_widgets-DbTCGBNZ.mjs}

@@ -3,7 +3,7 @@ import "./dist-CYZr2fwk.mjs";
 var e = {
 	"@camstack/sdk": {
 		name: "@camstack/sdk",
-		version: "1.2.28",
+		version: "1.2.30",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -18,7 +18,7 @@ var e = {
 	},
 	"@camstack/types": {
 		name: "@camstack/types",
-		version: "1.2.96",
+		version: "1.2.99",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",
@@ -33,7 +33,7 @@ var e = {
 	},
 	"@camstack/ui-library": {
 		name: "@camstack/ui-library",
-		version: "1.2.66",
+		version: "1.2.68",
 		scope: ["default"],
 		loaded: !1,
 		from: "addon_pipeline_analytics_widgets",