@camstack/system 1.2.117 → 1.2.119

package/dist/{dist-D4Vmj8iw.mjs → dist-DNbsZxNv.mjs}

@@ -4123,6 +4123,15 @@ var LabelDefinitionSchema = z.object({
 	description: z.string().optional(),
 	icon: z.string().optional()
 });
+var ClassMapDefinitionSchema = z.object({
+	mapping: z.record(z.string(), z.enum([
+		"person",
+		"vehicle",
+		"animal",
+		"package"
+	])),
+	preserveOriginal: z.boolean()
+});
 var MODEL_FORMATS = [
 	"onnx",
 	"coreml",
@@ -4206,6 +4215,12 @@ var ModelVariantGroupSchema = z.object({
 	*/
 	resolution: z.number().int().positive().optional()
 });
+var ModelProviderIdSchema = z.enum([
+	"camstack",
+	"frigate",
+	"scrypted",
+	"custom"
+]);
 var ModelCatalogEntrySchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -4301,7 +4316,19 @@ var ModelCatalogEntrySchema = z.object({
 	* `id` stays the source of truth for resolution/download/persistence; grouping
 	* is a presentation overlay resolved back to an `id`.
 	*/
-	group: ModelVariantGroupSchema.optional()
+	group: ModelVariantGroupSchema.optional(),
+	/**
+	* Catalog source for the pipeline stepper's provider-first picker. Absent on
+	* built-in CamStack entries (treated as `camstack`) and on registry rows
+	* persisted before this field existed (`inferModelProvider` fills those).
+	*/
+	provider: ModelProviderIdSchema.optional(),
+	/**
+	* Per-MODEL class map override. Absent ⇒ the step's `StepDefinition.classMap`
+	* applies (Frigate / COCO public catalog). Set on a custom model whose raw
+	* labels already ARE the CamStack macros (Scrypted identity map).
+	*/
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertTargetSchema = z.discriminatedUnion("format", [z.object({
 	format: z.literal("openvino"),
@@ -4330,7 +4357,8 @@ var ModelConvertMetadataSchema = z.object({
 		"ocr",
 		"segmentation"
 	]),
-	faceAlignment: z.boolean().optional()
+	faceAlignment: z.boolean().optional(),
+	classMap: ClassMapDefinitionSchema.optional()
 });
 var ConvertArtifactSchema = z.object({
 	format: z.enum(MODEL_FORMATS),
@@ -12556,12 +12584,15 @@ var NcOccupancyConditionSchema = z.object({
 * there is no second switch that can disagree with the first and every rule
 * authored before the decision migrates for free (`audioModeOf`):
 *
-*  - **LABEL mode — `labels` present.** The rule fires on the FIRST frame the
-*    classifier labels with one of them. No window, no percentage:
-*    `hitPercent` and `samplingSeconds` are ignored, and the rule's own
-*    `throttle` cooldown is the only brake. The per-label confidence floor is
-*    the analyzer's (`classificationMinScore`, per device) — a label only
-*    reaches this condition if the classifier was already confident enough.
+*  - **LABEL mode — `labels` present.** The rule fires when `confirmHits`
+*    labelled frames land inside `confirmWindowSec` (default 2 in 5 s).
+*    `hitPercent` and `samplingSeconds` are still ignored — a percentage of
+*    frames is the wrong question for a classifier that labels 1–3 frames
+*    per episode. The count window is the brake that drops a single-frame
+*    false positive; the rule's own `throttle` cooldown is the other. The
+*    per-label confidence floor is the analyzer's (`classificationMinScore`,
+*    per device) — a label only reaches this condition if the classifier was
+*    already confident enough. `confirmHits: 1` restores first-frame fire.
 *  - **LEVEL mode — `dbThreshold` present, no labels.** The sampling window IS
 *    the condition: at least `hitPercent`% of the samples over
 *    `samplingSeconds` must be at or above `dbThreshold` dBFS (see
@@ -12588,14 +12619,22 @@ var NcOccupancyConditionSchema = z.object({
 * an operator who typed `dog` mean the same thing.
 */
 var NcAudioConditionSchema = z.object({
-	/** LABEL MODE: audio macro labels. Present ⇒ fires on the first labelled frame. */
+	/** LABEL MODE: audio macro labels. Present ⇒ count-in-window confirm. */
 	labels: z.array(z.string().min(1)).min(1).optional(),
 	/** LEVEL MODE: floor in dBFS (negative-going, `0` = full scale). */
 	dbThreshold: z.number().min(-96).max(0).optional(),
 	/** LEVEL MODE ONLY: percentage of the window's samples that must be hits (1–100). */
 	hitPercent: z.number().int().min(1).max(100).default(60),
 	/** LEVEL MODE ONLY: length of the sampling window in seconds. */
-	samplingSeconds: z.number().int().min(1).max(300).default(10)
+	samplingSeconds: z.number().int().min(1).max(300).default(10),
+	/**
+	* LABEL MODE: how many labelled frames must land inside
+	* {@link NcAudioConditionSchema.shape.confirmWindowSec} before dispatch.
+	* Absent ⇒ 2 (the matcher default). `1` is first-frame fire.
+	*/
+	confirmHits: z.number().int().min(1).max(20).optional(),
+	/** LABEL MODE: the window those frames must share, in seconds. Absent ⇒ 5. */
+	confirmWindowSec: z.number().int().min(1).max(60).optional()
 });
 /**
 * Which zone-crossing DIRECTION a rule accepts (`ObjectEvent.zoneCrossing`).
@@ -15085,6 +15124,46 @@ var RecentTracksPageSchema = z.object({
 	/** Cursor for the next page, or null when this page is the last. */
 	nextCursor: z.string().nullable()
 });
+var LIST_GROUPS_DEFAULT_LIMIT = 40;
+var LIST_GROUPS_MAX_LIMIT = 100;
+var AnalyticsGroupRecordSchema = z.object({
+	id: z.string(),
+	deviceId: z.number().int(),
+	openedAt: z.number().int(),
+	closedAt: z.number().int(),
+	timestamp: z.number().int(),
+	memberCount: z.number().int(),
+	memberTrackIds: z.array(z.string()).readonly(),
+	className: z.string(),
+	classes: z.array(z.string()).readonly(),
+	/** Relative event-media path, or null when the group has no picture yet. */
+	mediaUrl: z.string().nullable(),
+	singleton: z.boolean()
+});
+var AnalyticsGroupMemberSchema = z.object({
+	trackId: z.string(),
+	deviceId: z.number().int(),
+	className: z.string(),
+	firstSeen: z.number().int(),
+	lastSeen: z.number().int(),
+	mediaUrl: z.string().nullable()
+});
+var AnalyticsGroupDetailSchema = AnalyticsGroupRecordSchema.extend({ members: z.array(AnalyticsGroupMemberSchema).readonly() });
+var ListGroupsQueryInput = z.object({
+	/** Devices to merge. An empty array yields `{ groups: [], nextCursor: null }`. */
+	deviceIds: z.array(z.number()),
+	/** Window lower bound on `closedAt` (inclusive). */
+	since: z.number().optional(),
+	/** Window upper bound on `openedAt` (inclusive). */
+	until: z.number().optional(),
+	limit: z.number().int().min(1).max(LIST_GROUPS_MAX_LIMIT).default(LIST_GROUPS_DEFAULT_LIMIT),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: z.string().optional()
+});
+var ListGroupsPageSchema = z.object({
+	groups: z.array(AnalyticsGroupRecordSchema).readonly(),
+	nextCursor: z.string().nullable()
+});
 var KeyEventQueryInput = z.object({
 	deviceId: z.number(),
 	/** Window lower bound (track firstSeen ≥ since). */
@@ -15160,7 +15239,9 @@ var TrackCascadeCountsSchema = z.object({
 	/** Unassigned plate reads removed (best-effort; plate leg deferred to plate-intelligence). */
 	plates: z.number().int(),
 	/** Per-track CLIP search vectors removed (best-effort). */
-	embeddings: z.number().int()
+	embeddings: z.number().int(),
+	/** Group membership + group rows removed with their last member (best-effort). */
+	groups: z.number().int()
 });
 /** Disk-wins reconcile: media rows whose blobs are gone, then empty tracks. */
 var DiskReconcileCountsSchema = z.object({
@@ -15332,6 +15413,16 @@ var pipelineAnalyticsCapability = {
 		* are not included (same contract as `listTracks`).
 		*/
 		listRecentTracks: method(RecentTracksQueryInput, RecentTracksPageSchema),
+		/**
+		* Batched co-moving group listing — the Groups feed. Same merge/cursor
+		* contract as {@link listRecentTracks}. A group is a sealed partition of
+		* one session; `getGroup` is the detail with members.
+		*/
+		listGroups: method(ListGroupsQueryInput, ListGroupsPageSchema),
+		getGroup: method(z.object({
+			deviceId: z.number(),
+			groupId: z.string().min(1)
+		}), AnalyticsGroupDetailSchema.nullable()),
 		clearTracks: method(z.object({ deviceId: z.number() }), z.void(), {
 			kind: "mutation",
 			auth: "admin"
@@ -15925,6 +16016,33 @@ var NativeCropRefSchema = z.object({
 		h: z.number()
 	})
 });
+z.object({
+	crop: z.object({
+		left: z.number(),
+		top: z.number(),
+		width: z.number().positive(),
+		height: z.number().positive()
+	}).optional(),
+	content: z.object({
+		width: z.number().int().positive(),
+		height: z.number().int().positive()
+	}),
+	fit: z.enum(["stretch", "contain"]),
+	format: z.enum([
+		"rgb",
+		"gray",
+		"jpeg"
+	])
+});
+var FrameRefSchema = z.object({
+	registryId: z.string().min(1),
+	id: z.string().min(1),
+	width: z.number().int().positive(),
+	height: z.number().int().positive(),
+	format: z.enum(["rgb", "gray"]),
+	timestamp: z.number(),
+	capturedAt: z.number().optional()
+});
 var ModelFormatSchema$1 = z.enum([
 	"onnx",
 	"coreml",
@@ -15991,7 +16109,8 @@ var PipelineModelOptionSchema = z.object({
 		sizeMB: z.number()
 	})),
 	group: ModelVariantGroupSchema.optional(),
-	legacy: z.boolean().optional()
+	legacy: z.boolean().optional(),
+	provider: ModelProviderIdSchema.optional()
 });
 var ConfigFieldBridge = z.custom();
 var PipelineAddonSchemaSchema = z.object({
@@ -16246,7 +16365,7 @@ var pipelineExecutorCapability = {
 		* legacy call shape used by existing benchmark code; once all
 		* callers pass it explicitly we make it required.
 		*
-		* Exactly one of `frame`, `frameHandle`, `imageBase64`,
+		* Exactly one of `frame`, `frameRef`, `frameHandle`, `imageBase64`,
 		* `referenceImage` must be provided:
 		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
 		*    Carries the raw buffer, dimensions, and format; the executor
@@ -16268,6 +16387,12 @@ var pipelineExecutorCapability = {
 			steps: z.array(PipelineStepInputSchema).min(1),
 			frame: FrameInputSchema.optional(),
 			/**
+			* Process-local lazy frame. Valid only when caller and provider resolve
+			* in the same execution-group process; split/cross-node callers use
+			* `frame`/`image` inline compatibility instead.
+			*/
+			frameRef: FrameRefSchema.optional(),
+			/**
 			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
 			* the decoded pixels live in. One more member of the one-of
 			* frame/frameHandle/image/imageBase64/referenceImage group.
@@ -16617,7 +16742,10 @@ var NativeCropResultSchema = z.object({
 	* Which source served this crop, so a quality-sensitive consumer (the native
 	* `keyFrame`) can reject a degraded fallback:
 	* - `native` — cut from the decode worker's retained NATIVE surface (the
-	*   quality path).
+	*   quality path). A subject-tile serve is also native-resolution and stays
+	*   `native` here: the public enum cannot name `tile` without a breaking cap
+	*   change. Runner telemetry distinguishes lease vs tile via `source` on the
+	*   internal crop result (`nativeHits` vs `tileHits`).
 	* - `ram-fullframe` — the native surface MISSED but the request was full-frame,
 	*   so the ≤640 RAM `RetainedFrameStore` served it (honest lower-res; legit for
 	*   the blank-frame guard / 640-snapshot resolve, NOT for the clean keyFrame).
@@ -17108,12 +17236,41 @@ var RunnerLocalLoadSchema = z.object({
 * legacy `OrchestratorMetricsSchema` shape so existing dashboards keep
 * working unchanged when they switch to reading from the runner cap.
 */
+var FrameLazyCountersSchema = z.object({
+	framesDecoded: z.number(),
+	framesAdmitted: z.number(),
+	framesDroppedPixelFree: z.number(),
+	viewsMaterialized: z.number(),
+	viewsSkipped: z.number(),
+	workerToRunnerBytes: z.number(),
+	runnerToPoolRawBytes: z.number(),
+	runnerToPoolJpegBytes: z.number(),
+	onDemandFullFrameRequests: z.number(),
+	onDemandCropRequests: z.number(),
+	nativeHits: z.number(),
+	nativeMisses: z.number(),
+	tileHits: z.number(),
+	tileMisses: z.number(),
+	fallbackHits: z.number(),
+	fallbackMisses: z.number(),
+	retainedWritesAvoided: z.number(),
+	residentRefs: z.number(),
+	residentBytes: z.number(),
+	releases: z.number(),
+	evictions: z.number(),
+	staleMisses: z.number()
+});
+var FrameLazyMetricsSchema = z.object({
+	node: FrameLazyCountersSchema,
+	cameras: z.array(FrameLazyCountersSchema.extend({ deviceId: z.number() }))
+});
 var RunnerLocalMetricsSchema = z.object({
 	nodeId: z.string(),
 	activeCameras: z.number(),
 	throttledCameras: z.number(),
 	avgInferenceTimeMs: z.number(),
-	queueDepth: z.number()
+	queueDepth: z.number(),
+	frameLazy: FrameLazyMetricsSchema.optional()
 });
 /**
 * Pipeline Runner capability — runtime detection workhorse.
@@ -23947,6 +24104,17 @@ var NotificationEndpointSchema = z.object({
 	/** What the ranking currently resolves to (null when nothing is reachable). */
 	resolved: z.string().nullable()
 });
+/**
+* The URLs the SDK / viewer should race for API access. `baseUrls` empty =
+* AUTO (every LAN IPv4 + the public tunnel). `resolved` is what that choice
+* currently expands to, so the UI can show the effective set either way.
+*/
+var ViewerEndpointsSchema = z.object({
+	/** The operator's explicit race set, or empty for AUTO. */
+	baseUrls: z.array(z.string()).readonly(),
+	/** What the ranking currently resolves to (may be empty if nothing is up). */
+	resolved: z.array(z.string()).readonly()
+});
 var AllowedAddressesSchema = z.object({ 
 /**
 * Allowlist of interface addresses operators have explicitly opted
@@ -23988,13 +24156,13 @@ var localNetworkCapability = {
 		*/
 		getPreferred: method(z.void(), PreferredSchema),
 		/**
-		* Ordered candidate base URLs the SDK should try on connect.
-		* Includes LAN IPs (one per non-internal interface), the public
-		* tunnel hostname (when active), and loopback as a last-resort
-		* fallback. Filterable by `includeLoopback` / `ipv4Only`.
-		* Honours `getAllowedAddresses()` when set — addresses outside
-		* the allowlist are dropped (the public tunnel + loopback are
-		* always included as escape hatches).
+		* Ordered candidate base URLs (the palette the Network tab shows).
+		* Includes LAN IPv4, stable LAN IPv6, the public tunnel, and mesh when
+		* joined. Loopback is off by default. The SDK races the subset from
+		* `getViewerEndpoints`, not this full list — IPv6 stays here because
+		* WebRTC ICE gathers dual-stack regardless of the HTTP race. Honours
+		* `getAllowedAddresses()` when set — addresses outside the allowlist
+		* are dropped (the public tunnel is still included as an escape hatch).
 		*
 		* **The port is the hub's, not the caller's** (D62 — a function's fact
 		* belongs to whoever already owns it). This method used to take a `port`
@@ -24025,10 +24193,11 @@ var localNetworkCapability = {
 			*/
 			port: z.number().int().min(1).max(65535).optional(),
 			/** Include `http(s)://127.0.0.1:<port>` as the lowest-priority
-			*  candidate. Default `true`. */
+			*  candidate. Default `false` — loopback is not a client route. */
 			includeLoopback: z.boolean().optional(),
-			/** Skip IPv6 entries. Some legacy clients can't parse them.
-			*  Default `false`. */
+			/** Skip IPv6 entries. Default `false` — the palette includes stable
+			*  LAN IPv6 (ICE/WebRTC uses dual-stack regardless). Pass `true` to
+			*  hide them. The viewer HTTP/WS race is `getViewerEndpoints`. */
 			ipv4Only: z.boolean().optional(),
 			/** Scheme to emit for LAN/loopback URLs. Default `'http'`.
 			*  Pass `'https'` when the caller is itself loaded over HTTPS
@@ -24057,6 +24226,19 @@ var localNetworkCapability = {
 		*/
 		setNotificationEndpoint: method(z.object({ baseUrl: z.string().nullable() }), NotificationEndpointSchema, { kind: "mutation" }),
 		/**
+		* The endpoints the SDK / viewer races for API access. Empty `baseUrls`
+		* means AUTO: every LAN IPv4 address plus the public tunnel, never IPv6,
+		* never mesh, never loopback. `resolved` is that set (or the operator's
+		* explicit subset) as it stands right now.
+		*/
+		getViewerEndpoints: method(z.void(), ViewerEndpointsSchema),
+		/**
+		* Replace the viewer race set. Empty `baseUrls` restores AUTO. Stored
+		* verbatim (not indices) so a temporarily-down tunnel is not silently
+		* dropped from the operator's choice.
+		*/
+		setViewerEndpoints: method(z.object({ baseUrls: z.array(z.string()).readonly() }), ViewerEndpointsSchema, { kind: "mutation" }),
+		/**
 		* Read the operator's allowlist. Empty = "auto" (no filter). Used
 		* by the admin UI's address selector to seed its checkbox state.
 		*/
@@ -25895,7 +26077,12 @@ var PlateInfoSchema = z.object({
 	plateBbox: BoundingBoxSchema.optional(),
 	/** keyFrame parity: MediaStore key of the track's native-resolution key frame. */
 	keyFrameMediaKey: z.string().optional(),
-	base64: z.string().optional()
+	base64: z.string().optional(),
+	/**
+	* Same crop as a data-plane URL. `getPlateByTrack` returns this and
+	* never inlines JPEG; `listPlates` still inlines for the admin-ui.
+	*/
+	cropUrl: z.string().optional()
 });
 var MediaFileLiteSchema = z.object({
 	key: z.string(),
@@ -32591,6 +32778,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"localNetwork.getViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"localNetwork.list": {
 		capName: "local-network",
 		capScope: "system",
@@ -32627,6 +32820,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"localNetwork.setViewerEndpoints": {
+		capName: "local-network",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"localNetwork.uploadCertificate": {
 		capName: "local-network",
 		capScope: "system",
@@ -33431,6 +33630,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.getGroup": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.getKeyEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -33515,6 +33720,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listGroups": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listOpsLog": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -36934,6 +37145,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.getGroup": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.getKeyEvents": [{
 		name: "deviceId",
 		form: "single",
@@ -36989,6 +37205,11 @@ Object.freeze({
 		form: "array",
 		optional: false
 	}],
+	"pipelineAnalytics.listGroups": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listOpsLog": [{
 		name: "deviceId",
 		form: "single",

package/dist/download/model-downloader.d.ts

@@ -23,13 +23,30 @@ export declare function siblingUrl(mainUrl: string, sibling: string): string;
  * agree on the on-disk layout without re-deriving it.
  */
 export declare function collectModelFiles(entry: ModelCatalogEntry, format: ModelFormat): string[];
+export type DownloadRedirectPolicy = (url: URL, hop: number) => void;
+export interface DownloadFileOptions {
+    readonly onProgress?: (downloaded: number, total: number) => void;
+    /**
+     * When set, redirects are followed manually and THIS policy is applied to
+     * the initial URL and every Location hop before the next fetch. Absent ⇒
+     * native `redirect: 'follow'` (backward compatible).
+     */
+    readonly redirectPolicy?: DownloadRedirectPolicy;
+    readonly maxRedirects?: number;
+    readonly timeoutMs?: number;
+    readonly maxBytes?: number;
+    readonly fetchImpl?: typeof fetch;
+}
 /**
  * Download a single file from a URL to a destination path.
- * Uses native fetch() (Node 22+) which handles redirects natively.
  * Streams to disk with optional progress callback.
  * Returns the destination path. Skips download if file already exists.
+ *
+ * The third argument remains a progress callback for existing callers. Pass
+ * an options object to supply a per-hop redirect policy, timeout, or byte cap.
  */
 export declare function downloadFile(url: string, destPath: string, onProgress?: (downloaded: number, total: number) => void): Promise<string>;
+export declare function downloadFile(url: string, destPath: string, options: DownloadFileOptions): Promise<string>;
 /**
  * Fetch JSON from a URL using native fetch().
  */

package/dist/{file-data-plane-CuE_hBli.mjs → file-data-plane-BhKdxJgf.mjs}

@@ -50,21 +50,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (fs.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	fs.mkdirSync(path$1.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -75,9 +110,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();

package/dist/{file-data-plane-DUHPHa-Y.js → file-data-plane-DO8KbxCe.js}

@@ -51,21 +51,56 @@ function buildHeaders(url) {
 	if (hfToken && url.includes("huggingface.co")) headers["Authorization"] = `Bearer ${hfToken}`;
 	return headers;
 }
-/**
-* Download a single file from a URL to a destination path.
-* Uses native fetch() (Node 22+) which handles redirects natively.
-* Streams to disk with optional progress callback.
-* Returns the destination path. Skips download if file already exists.
-*/
-async function downloadFile(url, destPath, onProgress) {
+var DEFAULT_MAX_REDIRECTS = 5;
+function normalizeDownloadOptions(third) {
+	if (typeof third === "function") return { onProgress: third };
+	return third ?? {};
+}
+function isRedirectStatus(status) {
+	return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
+function resolveRedirectUrl(current, location) {
+	return new URL(location, current);
+}
+async function downloadFile(url, destPath, onProgressOrOptions) {
 	if (node_fs.existsSync(destPath)) return destPath;
+	const opts = normalizeDownloadOptions(onProgressOrOptions);
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const maxRedirects = opts.maxRedirects ?? DEFAULT_MAX_REDIRECTS;
 	node_fs.mkdirSync(node_path.dirname(destPath), { recursive: true });
 	const tmpPath = destPath + ".downloading";
 	try {
-		const response = await fetch(url, {
-			redirect: "follow",
-			headers: buildHeaders(url)
-		});
+		let current = url;
+		const seen = /* @__PURE__ */ new Set();
+		let response;
+		const manual = opts.redirectPolicy !== void 0;
+		for (let hop = 0; hop <= maxRedirects; hop++) {
+			const parsed = new URL(current);
+			if (opts.redirectPolicy) opts.redirectPolicy(parsed, hop);
+			if (seen.has(parsed.href)) throw new Error(`Redirect loop detected at ${parsed.href}`);
+			seen.add(parsed.href);
+			const controller = opts.timeoutMs !== void 0 ? new AbortController() : void 0;
+			const timer = controller && opts.timeoutMs !== void 0 ? setTimeout(() => controller.abort(), opts.timeoutMs) : void 0;
+			try {
+				response = await fetchImpl(current, {
+					redirect: manual ? "manual" : "follow",
+					headers: buildHeaders(current),
+					...controller ? { signal: controller.signal } : {}
+				});
+			} finally {
+				if (timer) clearTimeout(timer);
+			}
+			if (manual && isRedirectStatus(response.status)) {
+				const location = response.headers.get("location");
+				if (!location) throw new Error(`Redirect ${response.status} missing Location header`);
+				if (hop >= maxRedirects) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
+				current = resolveRedirectUrl(current, location).href;
+				continue;
+			}
+			break;
+		}
+		if (!response) throw new Error(`No response downloading ${url}`);
+		if (manual && isRedirectStatus(response.status)) throw new Error(`Too many redirects (max ${maxRedirects}) downloading ${url}`);
 		if (!response.ok) throw new Error(`HTTP ${response.status} downloading ${url}`);
 		if (!response.body) throw new Error(`No response body from ${url}`);
 		const total = parseInt(response.headers.get("content-length") ?? "0", 10);
@@ -76,9 +111,10 @@ async function downloadFile(url, destPath, onProgress) {
 			for (;;) {
 				const { done, value } = await reader.read();
 				if (done || !value) break;
-				fileStream.write(value);
 				downloaded += value.length;
-				onProgress?.(downloaded, total);
+				if (opts.maxBytes !== void 0 && downloaded > opts.maxBytes) throw new Error(`Downloaded ${downloaded} bytes exceeds the ${opts.maxBytes}-byte limit`);
+				fileStream.write(value);
+				opts.onProgress?.(downloaded, total);
 			}
 		} finally {
 			fileStream.end();