@camstack/addon-post-analysis 1.2.94 → 1.2.95

package/dist/pipeline-analytics/index.js

@@ -6405,6 +6405,16 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/default-tap-url.ts
+/** The viewer's hosted base path under the hub. */
+var VIEWER_BASE_PATH = "/viewer/camstack";
+function defaultTapUrl(input) {
+	if (input.systemEvent === true) return null;
+	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
+	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
+}
+//#endregion
 //#region src/shared/frame/box-drawer.ts
 var DEFAULT_COLOR = require_dist.DEFAULT_EVENT_COLOR;
 var DEFAULT_QUALITY = 80;
@@ -9262,12 +9272,19 @@ var NcDispatcher = class {
 		}) : rendered;
 		const attachments = [...await this.withArtifactUrls(entry, await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
+		const tapUrl = params.clickUrl === void 0 && this.deps.viewerUrlBase !== void 0 ? defaultTapUrl({
+			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
+			timestampMs: subject.timestamp,
+			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
+			systemEvent: systemEvent !== void 0
+		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
 			body,
 			title,
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
+			...tapUrl !== null ? { clickUrl: tapUrl } : {},
 			tag: entry.payload.group?.key ?? entry.ruleId,
 			...systemEvent !== void 0 ? systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {} : { deviceId: subject.deviceId },
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
@@ -19148,7 +19165,8 @@ var NotificationCenter = class NotificationCenter {
 				confirmGate: (input) => confirmGate.judge(input),
 				confirmStats: () => confirmGate.stats()
 			} : {},
-			releaseCooldown: (input) => this.releaseCooldown(input)
+			releaseCooldown: (input) => this.releaseCooldown(input),
+			...deps.dispatcher.viewerUrlBase !== void 0 ? { viewerUrlBase: deps.dispatcher.viewerUrlBase } : {}
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -24856,6 +24874,188 @@ function clusterByEmbedding(items, threshold = .5) {
 	})).toSorted((a, b) => b.size - a.size || b.cohesion - a.cohesion);
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/face-matcher.ts
+/**
+* Count enrolled samples per identity for probes of a matching model+dimension.
+* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
+*/
+function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probeModelId) continue;
+		if (s.embedding.length !== probeDim) continue;
+		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
+	}
+	const eligible = /* @__PURE__ */ new Set();
+	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
+	return eligible;
+}
+/**
+* Match a probe embedding against the gallery. Only samples with the same
+* `modelId` AND the same dimension are compared (model-version safety). Returns
+* the best identity when its score ≥ threshold and it beats the best OTHER
+* identity by ≥ margin; otherwise null.
+*/
+function matchEmbedding(probe, gallery, opts) {
+	const probeVec = new Float32Array(probe.embedding);
+	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
+	const bestByIdentity = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probe.modelId) continue;
+		if (s.embedding.length !== probe.embedding.length) continue;
+		if (!eligible.has(s.identityId)) continue;
+		const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		const prev = bestByIdentity.get(s.identityId);
+		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+	}
+	if (bestByIdentity.size === 0) return null;
+	let bestId = null;
+	let bestScore = -Infinity;
+	let secondScore = -Infinity;
+	for (const [id, score] of bestByIdentity) if (score > bestScore) {
+		secondScore = bestScore;
+		bestScore = score;
+		bestId = id;
+	} else if (score > secondScore) secondScore = score;
+	if (bestId === null || bestScore < opts.threshold) return null;
+	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
+	return {
+		identityId: bestId,
+		score: bestScore
+	};
+}
+/**
+* Assign at most one identity per track AND at most one track per identity for
+* a single frame. Greedy by score: compute every candidate's full ranked match
+* list, then repeatedly take the globally-highest (track, identity) pair whose
+* track and identity are both still free, until none qualify. A losing track
+* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
+*/
+/**
+* Enrollment bound: the maximum cosine an embedding may score against a sample
+* of a DIFFERENT identity and still be enrolled. Genuine ArcFace cross-person
+* cosines sit under ~0.4; the low-information attractor (IR, blur, backs of
+* heads) sits at 0.95+. Measured 2026-08-18: 22 of 50 live samples were
+* enrolled from that attractor, with inter-identity cosines up to 0.988 — each
+* one a magnet that "recognises" every degraded probe as its owner.
+*/
+var ENROLLMENT_MAX_FOREIGN_COSINE = .9;
+/**
+* Gate an embedding BEFORE it becomes a gallery sample: condemned when its
+* best cosine against any sample of ANOTHER identity (same model + dimension)
+* reaches {@link ENROLLMENT_MAX_FOREIGN_COSINE}. Null = safe to enroll.
+* Closeness to the TARGET identity's own samples is expected and never
+* condemns.
+*/
+function enrollmentPromiscuity(embedding, modelId, targetIdentityId, gallery, bound = ENROLLMENT_MAX_FOREIGN_COSINE) {
+	const probeVec = new Float32Array(embedding);
+	let worst = null;
+	for (const s of gallery) {
+		if (s.identityId === targetIdentityId) continue;
+		if (s.modelId !== modelId) continue;
+		if (s.embedding.length !== embedding.length) continue;
+		const cosine = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+		if (cosine >= bound && (worst === null || cosine > worst.cosine)) worst = {
+			identityId: s.identityId,
+			cosine
+		};
+	}
+	return worst;
+}
+function assignUniquePerFrame(candidates, gallery, opts) {
+	const pairs = [];
+	candidates.forEach((c, trackIdx) => {
+		const probeVec = new Float32Array(c.embedding);
+		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
+		const bestByIdentity = /* @__PURE__ */ new Map();
+		for (const s of gallery) {
+			if (s.modelId !== c.modelId) continue;
+			if (s.embedding.length !== c.embedding.length) continue;
+			if (!eligible.has(s.identityId)) continue;
+			const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
+			const prev = bestByIdentity.get(s.identityId);
+			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+		}
+		let bestId = null;
+		let bestScore = -1;
+		let secondScore = -1;
+		for (const [identityId, score] of bestByIdentity) if (score > bestScore) {
+			if (bestId !== null) secondScore = bestScore;
+			bestId = identityId;
+			bestScore = score;
+		} else if (score > secondScore) secondScore = score;
+		const ambiguous = secondScore >= 0 && bestScore - secondScore < opts.margin;
+		if (bestId !== null && !ambiguous) {
+			for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
+				trackIdx,
+				identityId,
+				score
+			});
+		}
+	});
+	pairs.sort((a, b) => b.score - a.score);
+	const takenTracks = /* @__PURE__ */ new Set();
+	const takenIdentities = /* @__PURE__ */ new Set();
+	const result = /* @__PURE__ */ new Map();
+	for (const p of pairs) {
+		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
+		takenTracks.add(p.trackIdx);
+		takenIdentities.add(p.identityId);
+		result.set(candidates[p.trackIdx].trackId, {
+			identityId: p.identityId,
+			score: p.score
+		});
+	}
+	return result;
+}
+var EMPTY_AGGREGATE = Object.freeze({
+	assignedIdentityId: null,
+	confirmations: Object.freeze({})
+});
+/**
+* Fold one frame's match into a track's aggregate. A null match leaves state
+* untouched. An identity is assigned once its cumulative confirmation count
+* reaches `confirmFrames`; once assigned, a different identity must independently
+* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
+* a NEW identity, so callers fire the label update exactly once per transition.
+*
+* On each (re)assignment the confirmations record is reset to contain only the
+* newly-assigned identity's count, so any challenger must independently re-reach
+* `confirmFrames` from scratch after any assignment.
+*/
+function updateTrackAggregate(prev, match, opts) {
+	if (match === null) return {
+		state: prev,
+		changed: false
+	};
+	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
+	const confirmations = {
+		...prev.confirmations,
+		[match.identityId]: count
+	};
+	if (count < opts.confirmFrames) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	if (prev.assignedIdentityId === match.identityId) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	return {
+		state: {
+			assignedIdentityId: match.identityId,
+			confirmations: { [match.identityId]: count }
+		},
+		changed: true
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
 /** Attribution of a face identity NAMED BY THE OPERATOR in the gallery. */
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
@@ -25102,6 +25302,19 @@ var FaceGalleryProvider = class {
 		}
 		const currentFace = await this.faceStore.get(faceId);
 		if (!currentFace) throw new Error(`FaceGalleryProvider.assignFace: face disappeared after pre-cleanup: ${faceId}`);
+		const verdict = enrollmentPromiscuity(currentFace.embedding, MODEL_ID, identityId, await this.identityStore.loadGallery());
+		if (verdict !== null) {
+			this.logger.warn("assignFace refused: embedding too close to a FOREIGN identity sample", {
+				tags: { deviceId: currentFace.deviceId },
+				meta: {
+					faceId,
+					identityId,
+					foreignIdentityId: verdict.identityId,
+					cosine: verdict.cosine
+				}
+			});
+			throw new Error(`FaceGalleryProvider.assignFace: embedding is ambiguous — cosine ${verdict.cosine.toFixed(3)} with a sample of another identity (${verdict.identityId}); pick a clearer crop`);
+		}
 		let newKey;
 		if (currentFace.mediaKey) {
 			newKey = await this.mediaStore.reown({
@@ -33552,146 +33765,6 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/face-matcher.ts
-/**
-* Count enrolled samples per identity for probes of a matching model+dimension.
-* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
-*/
-function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probeModelId) continue;
-		if (s.embedding.length !== probeDim) continue;
-		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
-	}
-	const eligible = /* @__PURE__ */ new Set();
-	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
-	return eligible;
-}
-/**
-* Match a probe embedding against the gallery. Only samples with the same
-* `modelId` AND the same dimension are compared (model-version safety). Returns
-* the best identity when its score ≥ threshold and it beats the best OTHER
-* identity by ≥ margin; otherwise null.
-*/
-function matchEmbedding(probe, gallery, opts) {
-	const probeVec = new Float32Array(probe.embedding);
-	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
-	const bestByIdentity = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probe.modelId) continue;
-		if (s.embedding.length !== probe.embedding.length) continue;
-		if (!eligible.has(s.identityId)) continue;
-		const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
-		const prev = bestByIdentity.get(s.identityId);
-		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-	}
-	if (bestByIdentity.size === 0) return null;
-	let bestId = null;
-	let bestScore = -Infinity;
-	let secondScore = -Infinity;
-	for (const [id, score] of bestByIdentity) if (score > bestScore) {
-		secondScore = bestScore;
-		bestScore = score;
-		bestId = id;
-	} else if (score > secondScore) secondScore = score;
-	if (bestId === null || bestScore < opts.threshold) return null;
-	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
-	return {
-		identityId: bestId,
-		score: bestScore
-	};
-}
-/**
-* Assign at most one identity per track AND at most one track per identity for
-* a single frame. Greedy by score: compute every candidate's full ranked match
-* list, then repeatedly take the globally-highest (track, identity) pair whose
-* track and identity are both still free, until none qualify. A losing track
-* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
-*/
-function assignUniquePerFrame(candidates, gallery, opts) {
-	const pairs = [];
-	candidates.forEach((c, trackIdx) => {
-		const probeVec = new Float32Array(c.embedding);
-		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
-		const bestByIdentity = /* @__PURE__ */ new Map();
-		for (const s of gallery) {
-			if (s.modelId !== c.modelId) continue;
-			if (s.embedding.length !== c.embedding.length) continue;
-			if (!eligible.has(s.identityId)) continue;
-			const score = require_dist.cosineSimilarity(probeVec, new Float32Array(s.embedding));
-			const prev = bestByIdentity.get(s.identityId);
-			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-		}
-		for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
-			trackIdx,
-			identityId,
-			score
-		});
-	});
-	pairs.sort((a, b) => b.score - a.score);
-	const takenTracks = /* @__PURE__ */ new Set();
-	const takenIdentities = /* @__PURE__ */ new Set();
-	const result = /* @__PURE__ */ new Map();
-	for (const p of pairs) {
-		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
-		takenTracks.add(p.trackIdx);
-		takenIdentities.add(p.identityId);
-		result.set(candidates[p.trackIdx].trackId, {
-			identityId: p.identityId,
-			score: p.score
-		});
-	}
-	return result;
-}
-var EMPTY_AGGREGATE = Object.freeze({
-	assignedIdentityId: null,
-	confirmations: Object.freeze({})
-});
-/**
-* Fold one frame's match into a track's aggregate. A null match leaves state
-* untouched. An identity is assigned once its cumulative confirmation count
-* reaches `confirmFrames`; once assigned, a different identity must independently
-* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
-* a NEW identity, so callers fire the label update exactly once per transition.
-*
-* On each (re)assignment the confirmations record is reset to contain only the
-* newly-assigned identity's count, so any challenger must independently re-reach
-* `confirmFrames` from scratch after any assignment.
-*/
-function updateTrackAggregate(prev, match, opts) {
-	if (match === null) return {
-		state: prev,
-		changed: false
-	};
-	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
-	const confirmations = {
-		...prev.confirmations,
-		[match.identityId]: count
-	};
-	if (count < opts.confirmFrames) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	if (prev.assignedIdentityId === match.identityId) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	return {
-		state: {
-			assignedIdentityId: match.identityId,
-			confirmations: { [match.identityId]: count }
-		},
-		changed: true
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/face-recognizer.ts
 /** Attribution of an identity resolved by the in-process ArcFace matcher. */
 var FACE_RECOGNIZER_STEP_ID = "face-recognizer";
@@ -52396,6 +52469,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				},
 				renderEventMedia: (req) => this.renderEventMedia(req),
 				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
+				viewerUrlBase: async () => pickArtifactBaseUrl(await this.ncEndpoints()),
 				indexArtifact: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? {
 					url: null,
 					artifactId: null

package/dist/pipeline-analytics/index.mjs

@@ -6398,6 +6398,16 @@ var NcDeviceStateCache = class {
 	}
 };
 //#endregion
+//#region src/notification-center/default-tap-url.ts
+/** The viewer's hosted base path under the hub. */
+var VIEWER_BASE_PATH = "/viewer/camstack";
+function defaultTapUrl(input) {
+	if (input.systemEvent === true) return null;
+	if (input.baseUrl === null || input.baseUrl.length === 0) return null;
+	if (!Number.isInteger(input.deviceId) || input.deviceId <= 0) return null;
+	return `${input.baseUrl.replace(/\/+$/, "")}${VIEWER_BASE_PATH}/camera/${String(input.deviceId)}?at=${String(input.timestampMs)}`;
+}
+//#endregion
 //#region src/shared/frame/box-drawer.ts
 var DEFAULT_COLOR = DEFAULT_EVENT_COLOR;
 var DEFAULT_QUALITY = 80;
@@ -9255,12 +9265,19 @@ var NcDispatcher = class {
 		}) : rendered;
 		const attachments = [...await this.withArtifactUrls(entry, await this.resolveAttachments(entry)), ...frozenArtifactAttachments(entry)];
 		const params = pickParams(entry.payload.params);
+		const tapUrl = params.clickUrl === void 0 && this.deps.viewerUrlBase !== void 0 ? defaultTapUrl({
+			deviceId: systemEvent !== void 0 ? 0 : subject.deviceId,
+			timestampMs: subject.timestamp,
+			baseUrl: await this.deps.viewerUrlBase().catch(() => null),
+			systemEvent: systemEvent !== void 0
+		}) : null;
 		const actions = await this.mintActions(entry, target);
 		return {
 			body,
 			title,
 			priority: clampPriority(paramNumber(entry.payload.params, "priority") ?? entry.payload.priority),
 			...params,
+			...tapUrl !== null ? { clickUrl: tapUrl } : {},
 			tag: entry.payload.group?.key ?? entry.ruleId,
 			...systemEvent !== void 0 ? systemEvent.deviceId !== void 0 ? { deviceId: systemEvent.deviceId } : {} : { deviceId: subject.deviceId },
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
@@ -19126,7 +19143,8 @@ var NotificationCenter = class NotificationCenter {
 				confirmGate: (input) => confirmGate.judge(input),
 				confirmStats: () => confirmGate.stats()
 			} : {},
-			releaseCooldown: (input) => this.releaseCooldown(input)
+			releaseCooldown: (input) => this.releaseCooldown(input),
+			...deps.dispatcher.viewerUrlBase !== void 0 ? { viewerUrlBase: deps.dispatcher.viewerUrlBase } : {}
 		});
 		this.outbox = new NcOutbox({
 			store: deps.store,
@@ -24834,6 +24852,188 @@ function clusterByEmbedding(items, threshold = .5) {
 	})).toSorted((a, b) => b.size - a.size || b.cohesion - a.cohesion);
 }
 //#endregion
+//#region src/pipeline-analytics/pipeline/face-matcher.ts
+/**
+* Count enrolled samples per identity for probes of a matching model+dimension.
+* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
+*/
+function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probeModelId) continue;
+		if (s.embedding.length !== probeDim) continue;
+		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
+	}
+	const eligible = /* @__PURE__ */ new Set();
+	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
+	return eligible;
+}
+/**
+* Match a probe embedding against the gallery. Only samples with the same
+* `modelId` AND the same dimension are compared (model-version safety). Returns
+* the best identity when its score ≥ threshold and it beats the best OTHER
+* identity by ≥ margin; otherwise null.
+*/
+function matchEmbedding(probe, gallery, opts) {
+	const probeVec = new Float32Array(probe.embedding);
+	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
+	const bestByIdentity = /* @__PURE__ */ new Map();
+	for (const s of gallery) {
+		if (s.modelId !== probe.modelId) continue;
+		if (s.embedding.length !== probe.embedding.length) continue;
+		if (!eligible.has(s.identityId)) continue;
+		const score = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
+		const prev = bestByIdentity.get(s.identityId);
+		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+	}
+	if (bestByIdentity.size === 0) return null;
+	let bestId = null;
+	let bestScore = -Infinity;
+	let secondScore = -Infinity;
+	for (const [id, score] of bestByIdentity) if (score > bestScore) {
+		secondScore = bestScore;
+		bestScore = score;
+		bestId = id;
+	} else if (score > secondScore) secondScore = score;
+	if (bestId === null || bestScore < opts.threshold) return null;
+	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
+	return {
+		identityId: bestId,
+		score: bestScore
+	};
+}
+/**
+* Assign at most one identity per track AND at most one track per identity for
+* a single frame. Greedy by score: compute every candidate's full ranked match
+* list, then repeatedly take the globally-highest (track, identity) pair whose
+* track and identity are both still free, until none qualify. A losing track
+* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
+*/
+/**
+* Enrollment bound: the maximum cosine an embedding may score against a sample
+* of a DIFFERENT identity and still be enrolled. Genuine ArcFace cross-person
+* cosines sit under ~0.4; the low-information attractor (IR, blur, backs of
+* heads) sits at 0.95+. Measured 2026-08-18: 22 of 50 live samples were
+* enrolled from that attractor, with inter-identity cosines up to 0.988 — each
+* one a magnet that "recognises" every degraded probe as its owner.
+*/
+var ENROLLMENT_MAX_FOREIGN_COSINE = .9;
+/**
+* Gate an embedding BEFORE it becomes a gallery sample: condemned when its
+* best cosine against any sample of ANOTHER identity (same model + dimension)
+* reaches {@link ENROLLMENT_MAX_FOREIGN_COSINE}. Null = safe to enroll.
+* Closeness to the TARGET identity's own samples is expected and never
+* condemns.
+*/
+function enrollmentPromiscuity(embedding, modelId, targetIdentityId, gallery, bound = ENROLLMENT_MAX_FOREIGN_COSINE) {
+	const probeVec = new Float32Array(embedding);
+	let worst = null;
+	for (const s of gallery) {
+		if (s.identityId === targetIdentityId) continue;
+		if (s.modelId !== modelId) continue;
+		if (s.embedding.length !== embedding.length) continue;
+		const cosine = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
+		if (cosine >= bound && (worst === null || cosine > worst.cosine)) worst = {
+			identityId: s.identityId,
+			cosine
+		};
+	}
+	return worst;
+}
+function assignUniquePerFrame(candidates, gallery, opts) {
+	const pairs = [];
+	candidates.forEach((c, trackIdx) => {
+		const probeVec = new Float32Array(c.embedding);
+		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
+		const bestByIdentity = /* @__PURE__ */ new Map();
+		for (const s of gallery) {
+			if (s.modelId !== c.modelId) continue;
+			if (s.embedding.length !== c.embedding.length) continue;
+			if (!eligible.has(s.identityId)) continue;
+			const score = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
+			const prev = bestByIdentity.get(s.identityId);
+			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
+		}
+		let bestId = null;
+		let bestScore = -1;
+		let secondScore = -1;
+		for (const [identityId, score] of bestByIdentity) if (score > bestScore) {
+			if (bestId !== null) secondScore = bestScore;
+			bestId = identityId;
+			bestScore = score;
+		} else if (score > secondScore) secondScore = score;
+		const ambiguous = secondScore >= 0 && bestScore - secondScore < opts.margin;
+		if (bestId !== null && !ambiguous) {
+			for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
+				trackIdx,
+				identityId,
+				score
+			});
+		}
+	});
+	pairs.sort((a, b) => b.score - a.score);
+	const takenTracks = /* @__PURE__ */ new Set();
+	const takenIdentities = /* @__PURE__ */ new Set();
+	const result = /* @__PURE__ */ new Map();
+	for (const p of pairs) {
+		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
+		takenTracks.add(p.trackIdx);
+		takenIdentities.add(p.identityId);
+		result.set(candidates[p.trackIdx].trackId, {
+			identityId: p.identityId,
+			score: p.score
+		});
+	}
+	return result;
+}
+var EMPTY_AGGREGATE = Object.freeze({
+	assignedIdentityId: null,
+	confirmations: Object.freeze({})
+});
+/**
+* Fold one frame's match into a track's aggregate. A null match leaves state
+* untouched. An identity is assigned once its cumulative confirmation count
+* reaches `confirmFrames`; once assigned, a different identity must independently
+* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
+* a NEW identity, so callers fire the label update exactly once per transition.
+*
+* On each (re)assignment the confirmations record is reset to contain only the
+* newly-assigned identity's count, so any challenger must independently re-reach
+* `confirmFrames` from scratch after any assignment.
+*/
+function updateTrackAggregate(prev, match, opts) {
+	if (match === null) return {
+		state: prev,
+		changed: false
+	};
+	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
+	const confirmations = {
+		...prev.confirmations,
+		[match.identityId]: count
+	};
+	if (count < opts.confirmFrames) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	if (prev.assignedIdentityId === match.identityId) return {
+		state: {
+			...prev,
+			confirmations
+		},
+		changed: false
+	};
+	return {
+		state: {
+			assignedIdentityId: match.identityId,
+			confirmations: { [match.identityId]: count }
+		},
+		changed: true
+	};
+}
+//#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
 /** Attribution of a face identity NAMED BY THE OPERATOR in the gallery. */
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
@@ -25080,6 +25280,19 @@ var FaceGalleryProvider = class {
 		}
 		const currentFace = await this.faceStore.get(faceId);
 		if (!currentFace) throw new Error(`FaceGalleryProvider.assignFace: face disappeared after pre-cleanup: ${faceId}`);
+		const verdict = enrollmentPromiscuity(currentFace.embedding, MODEL_ID, identityId, await this.identityStore.loadGallery());
+		if (verdict !== null) {
+			this.logger.warn("assignFace refused: embedding too close to a FOREIGN identity sample", {
+				tags: { deviceId: currentFace.deviceId },
+				meta: {
+					faceId,
+					identityId,
+					foreignIdentityId: verdict.identityId,
+					cosine: verdict.cosine
+				}
+			});
+			throw new Error(`FaceGalleryProvider.assignFace: embedding is ambiguous — cosine ${verdict.cosine.toFixed(3)} with a sample of another identity (${verdict.identityId}); pick a clearer crop`);
+		}
 		let newKey;
 		if (currentFace.mediaKey) {
 			newKey = await this.mediaStore.reown({
@@ -33492,146 +33705,6 @@ async function resolveDefaultEventMedia(deps) {
 	return pickTrackFallbackMedia(await deps.listTrackMedia(trackId)) ?? null;
 }
 //#endregion
-//#region src/pipeline-analytics/pipeline/face-matcher.ts
-/**
-* Count enrolled samples per identity for probes of a matching model+dimension.
-* Only identities meeting `minIdentitySamples` are eligible auto-match targets.
-*/
-function eligibleIdentities(gallery, probeModelId, probeDim, minIdentitySamples) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probeModelId) continue;
-		if (s.embedding.length !== probeDim) continue;
-		counts.set(s.identityId, (counts.get(s.identityId) ?? 0) + 1);
-	}
-	const eligible = /* @__PURE__ */ new Set();
-	for (const [id, count] of counts) if (count >= minIdentitySamples) eligible.add(id);
-	return eligible;
-}
-/**
-* Match a probe embedding against the gallery. Only samples with the same
-* `modelId` AND the same dimension are compared (model-version safety). Returns
-* the best identity when its score ≥ threshold and it beats the best OTHER
-* identity by ≥ margin; otherwise null.
-*/
-function matchEmbedding(probe, gallery, opts) {
-	const probeVec = new Float32Array(probe.embedding);
-	const eligible = eligibleIdentities(gallery, probe.modelId, probe.embedding.length, opts.minIdentitySamples ?? 1);
-	const bestByIdentity = /* @__PURE__ */ new Map();
-	for (const s of gallery) {
-		if (s.modelId !== probe.modelId) continue;
-		if (s.embedding.length !== probe.embedding.length) continue;
-		if (!eligible.has(s.identityId)) continue;
-		const score = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
-		const prev = bestByIdentity.get(s.identityId);
-		if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-	}
-	if (bestByIdentity.size === 0) return null;
-	let bestId = null;
-	let bestScore = -Infinity;
-	let secondScore = -Infinity;
-	for (const [id, score] of bestByIdentity) if (score > bestScore) {
-		secondScore = bestScore;
-		bestScore = score;
-		bestId = id;
-	} else if (score > secondScore) secondScore = score;
-	if (bestId === null || bestScore < opts.threshold) return null;
-	if (secondScore > -Infinity && bestScore - secondScore < opts.margin) return null;
-	return {
-		identityId: bestId,
-		score: bestScore
-	};
-}
-/**
-* Assign at most one identity per track AND at most one track per identity for
-* a single frame. Greedy by score: compute every candidate's full ranked match
-* list, then repeatedly take the globally-highest (track, identity) pair whose
-* track and identity are both still free, until none qualify. A losing track
-* falls back to its next-best free identity ≥ threshold. Ties resolve by input order.
-*/
-function assignUniquePerFrame(candidates, gallery, opts) {
-	const pairs = [];
-	candidates.forEach((c, trackIdx) => {
-		const probeVec = new Float32Array(c.embedding);
-		const eligible = eligibleIdentities(gallery, c.modelId, c.embedding.length, opts.minIdentitySamples ?? 1);
-		const bestByIdentity = /* @__PURE__ */ new Map();
-		for (const s of gallery) {
-			if (s.modelId !== c.modelId) continue;
-			if (s.embedding.length !== c.embedding.length) continue;
-			if (!eligible.has(s.identityId)) continue;
-			const score = cosineSimilarity$1(probeVec, new Float32Array(s.embedding));
-			const prev = bestByIdentity.get(s.identityId);
-			if (prev === void 0 || score > prev) bestByIdentity.set(s.identityId, score);
-		}
-		for (const [identityId, score] of bestByIdentity) if (score >= opts.threshold) pairs.push({
-			trackIdx,
-			identityId,
-			score
-		});
-	});
-	pairs.sort((a, b) => b.score - a.score);
-	const takenTracks = /* @__PURE__ */ new Set();
-	const takenIdentities = /* @__PURE__ */ new Set();
-	const result = /* @__PURE__ */ new Map();
-	for (const p of pairs) {
-		if (takenTracks.has(p.trackIdx) || takenIdentities.has(p.identityId)) continue;
-		takenTracks.add(p.trackIdx);
-		takenIdentities.add(p.identityId);
-		result.set(candidates[p.trackIdx].trackId, {
-			identityId: p.identityId,
-			score: p.score
-		});
-	}
-	return result;
-}
-var EMPTY_AGGREGATE = Object.freeze({
-	assignedIdentityId: null,
-	confirmations: Object.freeze({})
-});
-/**
-* Fold one frame's match into a track's aggregate. A null match leaves state
-* untouched. An identity is assigned once its cumulative confirmation count
-* reaches `confirmFrames`; once assigned, a different identity must independently
-* reach `confirmFrames` to switch. `changed` is true only on a (re)assignment to
-* a NEW identity, so callers fire the label update exactly once per transition.
-*
-* On each (re)assignment the confirmations record is reset to contain only the
-* newly-assigned identity's count, so any challenger must independently re-reach
-* `confirmFrames` from scratch after any assignment.
-*/
-function updateTrackAggregate(prev, match, opts) {
-	if (match === null) return {
-		state: prev,
-		changed: false
-	};
-	const count = (prev.confirmations[match.identityId] ?? 0) + 1;
-	const confirmations = {
-		...prev.confirmations,
-		[match.identityId]: count
-	};
-	if (count < opts.confirmFrames) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	if (prev.assignedIdentityId === match.identityId) return {
-		state: {
-			...prev,
-			confirmations
-		},
-		changed: false
-	};
-	return {
-		state: {
-			assignedIdentityId: match.identityId,
-			confirmations: { [match.identityId]: count }
-		},
-		changed: true
-	};
-}
-//#endregion
 //#region src/pipeline-analytics/face-recognizer.ts
 /** Attribution of an identity resolved by the in-process ArcFace matcher. */
 var FACE_RECOGNIZER_STEP_ID = "face-recognizer";
@@ -52336,6 +52409,7 @@ var PipelineAnalyticsAddon = class extends BaseAddon {
 				},
 				renderEventMedia: (req) => this.renderEventMedia(req),
 				publishArtifact: async (bytes, mime) => await this.ncArtifactPlane?.publish(bytes, mime) ?? null,
+				viewerUrlBase: async () => pickArtifactBaseUrl(await this.ncEndpoints()),
 				indexArtifact: async (bytes, mime, meta) => await this.ncArtifactPlane?.publishIndexed(bytes, mime, meta) ?? {
 					url: null,
 					artifactId: null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-post-analysis",
-  "version": "1.2.94",
+  "version": "1.2.95",
   "description": "Post-Analysis bundle — enrichment, embedding-encoder, pipeline-analytics. Multi-entry npm package shipping addons that consume pipeline output.",
   "keywords": [
     "camstack",