@camstack/system 1.2.48 → 1.2.50

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-pages-aggregator/addon-pages-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, m as addonPagesCapability } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, m as addonPagesCapability } from "../../dist-BXqMB8EK.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 const require_settle_sources = require("../../settle-sources-Bhsy57y-.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/addon-widgets-aggregator/addon-widgets-aggregator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, g as addonWidgetsCapability } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, dt as errMsg, ft as BaseAddon, g as addonWidgetsCapability } from "../../dist-BXqMB8EK.mjs";
 import { t as settleSourcesWithTimeout } from "../../settle-sources-CDtNC8ub.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/alerts/alerts.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/alerts/alerts.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, _ as alertsCapability, dt as errMsg, ft as BaseAddon, n as AlertSchema } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, Tt as createEvent, _ as alertsCapability, dt as errMsg, ft as BaseAddon, n as AlertSchema } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/alerts/prune-policy.ts
 /**
 * Ids older than `cutoffMs`, oldest first.

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_fs = require("node:fs");
 let node_fs$1 = require_chunk.__toESM(node_fs, 1);
 node_fs = require_chunk.__toESM(node_fs);

package/dist/builtins/backup-orchestrator/backup-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, b as backupCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, b as backupCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import * as fs from "node:fs";
 import Kt from "node:fs";
 import * as path$1 from "node:path";

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_crypto = require("node:crypto");

package/dist/builtins/core-blocks/core-blocks.addon.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { S as coreBlocksCapability, ft as BaseAddon, o as CoreBlockSchema } from "../../dist-C7rPTQLR.mjs";
+import { S as coreBlocksCapability, ft as BaseAddon, o as CoreBlockSchema } from "../../dist-BXqMB8EK.mjs";
 import * as path$1 from "node:path";
 import { randomUUID } from "node:crypto";
 import * as fs from "node:fs/promises";

package/dist/builtins/device-manager/device-manager.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let _camstack_types_node = require("@camstack/types/node");
 let zod = require("zod");
 let node_crypto = require("node:crypto");

package/dist/builtins/device-manager/device-manager.addon.mjs

@@ -1,4 +1,4 @@
-import { At as isDeviceConfigCap, D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, J as normalizeUnit, Lt as sleep, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as EventCategory, X as parseStreamParamsFormPatch, _t as DeviceRole, a as CAP_NAMES_WITH_STATUS, ct as validateExpressionSource, dt as errMsg, et as setByPath, ft as BaseAddon, gt as DeviceFeature, j as enumerateItemArrayFields, ot as toExpressionValue, s as DeviceStatusSchema, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceType, x as buildStreamParamsConfigSchema, xt as WELL_KNOWN_TAB_MAP } from "../../dist-C7rPTQLR.mjs";
+import { At as isDeviceConfigCap, D as deviceStateCapability, E as deviceManagerCapability, I as getByPath, J as normalizeUnit, Lt as sleep, M as enumerateSchemaFields, N as evaluateLinkExpression, O as deviceStatusCapability, Rt as EventCategory, X as parseStreamParamsFormPatch, _t as DeviceRole, a as CAP_NAMES_WITH_STATUS, ct as validateExpressionSource, dt as errMsg, et as setByPath, ft as BaseAddon, gt as DeviceFeature, j as enumerateItemArrayFields, ot as toExpressionValue, s as DeviceStatusSchema, t as ALL_CAPABILITY_DEFINITIONS, u as STREAM_PROFILE_META, v as applyTransform, vt as DeviceType, x as buildStreamParamsConfigSchema, xt as WELL_KNOWN_TAB_MAP } from "../../dist-BXqMB8EK.mjs";
 import { canonicalDeviceFingerprint } from "@camstack/types/node";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";

package/dist/builtins/doorbell/virtual-doorbell.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/doorbell/virtual-doorbell.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon, k as doorbellCapability, vt as DeviceType } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon, k as doorbellCapability, vt as DeviceType } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/doorbell/trigger-engine.ts
 /**
 * Pure trigger logic for the virtual-doorbell builtin — edge detection over

package/dist/builtins/hub-forwarder/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/hub-forwarder/index.mjs

@@ -1,4 +1,4 @@
-import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/hub-forwarder/hub-forwarder-destination.ts
 var DEFAULT_OUTBOUND_BUFFER_SIZE = 500;

package/dist/builtins/liveness-monitor/liveness-monitor.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/liveness-monitor/liveness-monitor.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, Tt as createEvent, dt as errMsg, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/liveness-monitor/liveness-checks.ts
 var NO_DEVICES = "liveness:no-devices";
 var ALL_OFFLINE = "liveness:all-devices-offline";

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,5 +1,5 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { d as ScopedTokenSchema, ft as BaseAddon, p as UserRecordSchema, r as ApiKeyRecordSchema, st as userManagementCapability, y as authProviderCapability } from "../../dist-C7rPTQLR.mjs";
+import { d as ScopedTokenSchema, ft as BaseAddon, p as UserRecordSchema, r as ApiKeyRecordSchema, st as userManagementCapability, y as authProviderCapability } from "../../dist-BXqMB8EK.mjs";
 import * as crypto$1 from "node:crypto";
 import { randomUUID } from "node:crypto";
 import nodeCrypto from "crypto";

package/dist/builtins/local-network/local-network.addon.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
 //#region src/builtins/local-network/local-network.addon.ts

package/dist/builtins/local-network/local-network.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, U as localNetworkCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, U as localNetworkCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import * as os from "node:os";
 //#region src/builtins/local-network/local-network.addon.ts
 /**

package/dist/builtins/loki-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/loki-logging/index.mjs

@@ -1,4 +1,4 @@
-import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/loki-logging/loki-payload.ts
 /**
 * Loki rejects a label name that is not a valid Prometheus label

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, Tt as createEvent, ft as BaseAddon, q as metricsProviderCapability } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, Tt as createEvent, ft as BaseAddon, q as metricsProviderCapability } from "../../dist-BXqMB8EK.mjs";
 import * as fs from "node:fs";
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/platform-probe/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_child_process = require("node:child_process");

package/dist/builtins/platform-probe/index.mjs

@@ -1,5 +1,5 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { $ as scoreRuntimes, A as enumerateInferenceDevices, Dt as emitReadiness, Rt as EventCategory, Z as platformProbeCapability, dt as errMsg, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { $ as scoreRuntimes, A as enumerateInferenceDevices, Dt as emitReadiness, Rt as EventCategory, Z as platformProbeCapability, dt as errMsg, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import * as fs from "node:fs";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Rt as EventCategory, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { Rt as EventCategory, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,4 +1,4 @@
-import { at as streamQualityLabel, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, i as BatteryStatusSchema, jt as nodePin, nt as snapshotCapability, vt as DeviceType } from "../../dist-C7rPTQLR.mjs";
+import { at as streamQualityLabel, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, i as BatteryStatusSchema, jt as nodePin, nt as snapshotCapability, vt as DeviceType } from "../../dist-BXqMB8EK.mjs";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage-provider.d.ts

@@ -1,5 +1,5 @@
-import { z } from 'zod';
 import { IStorageProviderImpl, StorageLocation, StorageProviderInfoSchema } from '@camstack/types';
+import { z } from 'zod';
 type StorageProviderInfo = z.infer<typeof StorageProviderInfoSchema>;
 export declare class FilesystemStorageProvider implements IStorageProviderImpl {
     static readonly providerId = "filesystem-storage";

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_path = require("node:path");
@@ -11,6 +11,69 @@ node_path = require_chunk.__toESM(node_path);
 let node_crypto = require("node:crypto");
 let node_os = require("node:os");
 let node_fs_promises = require("node:fs/promises");
+//#region src/builtins/sqlite-storage/path-guard.ts
+/**
+* Allowed-root containment guard for the filesystem-browse cap. Pure +
+* synchronous so it is trivially unit-testable; the provider applies it AFTER
+* resolving the real path (so symlink escapes are also caught upstream).
+*/
+/** True iff `candidate` is one of, or nested under, an allowed root. */
+function isWithinAllowedRoots(candidate, allowedRoots) {
+	const norm = (0, node_path.resolve)(candidate);
+	return allowedRoots.some((root) => {
+		const r = (0, node_path.resolve)(root);
+		return norm === r || norm.startsWith(r.endsWith(node_path.sep) ? r : r + node_path.sep);
+	});
+}
+/** Throws unless `candidate` is within an allowed root. */
+function assertWithinAllowedRoots(candidate, allowedRoots) {
+	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
+}
+//#endregion
+//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
+/**
+* Per-node filesystem-browse provider. Lists/creates directories under
+* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
+* `filesystem-browse` cap so the admin UI can pick a node + path for a
+* node-local storage location.
+*/
+var FilesystemBrowseProvider = class {
+	allowedRoots;
+	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
+	constructor(allowedRoots) {
+		this.allowedRoots = allowedRoots;
+	}
+	async listAllowedRoots() {
+		return [...this.allowedRoots()];
+	}
+	async browse({ path }) {
+		const real = await (0, node_fs_promises.realpath)(path).catch(() => path);
+		assertWithinAllowedRoots(real, await this.resolvedRoots());
+		const entries = (await (0, node_fs_promises.readdir)(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
+			name: d.name,
+			path: (0, node_path.join)(real, d.name)
+		}));
+		const fs = await (0, node_fs_promises.statfs)(real);
+		const totalBytes = fs.blocks * fs.bsize;
+		return {
+			path: real,
+			entries,
+			freeBytes: fs.bavail * fs.bsize,
+			totalBytes
+		};
+	}
+	async createDir({ path }) {
+		const parent = (0, node_path.dirname)(path);
+		assertWithinAllowedRoots((0, node_path.join)(await (0, node_fs_promises.realpath)(parent).catch(() => parent), (0, node_path.basename)(path)), await this.resolvedRoots());
+		await (0, node_fs_promises.mkdir)(path, { recursive: true });
+		return { path };
+	}
+	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
+	async resolvedRoots() {
+		return Promise.all(this.allowedRoots().map((r) => (0, node_fs_promises.realpath)(r).catch(() => r)));
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage-provider.ts
 /**
 * Filesystem `storage-provider` (Task 7).
@@ -272,69 +335,6 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 	}
 };
 //#endregion
-//#region src/builtins/sqlite-storage/path-guard.ts
-/**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
-*/
-/** True iff `candidate` is one of, or nested under, an allowed root. */
-function isWithinAllowedRoots(candidate, allowedRoots) {
-	const norm = (0, node_path.resolve)(candidate);
-	return allowedRoots.some((root) => {
-		const r = (0, node_path.resolve)(root);
-		return norm === r || norm.startsWith(r.endsWith(node_path.sep) ? r : r + node_path.sep);
-	});
-}
-/** Throws unless `candidate` is within an allowed root. */
-function assertWithinAllowedRoots(candidate, allowedRoots) {
-	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
-}
-//#endregion
-//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
-/**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
-*/
-var FilesystemBrowseProvider = class {
-	allowedRoots;
-	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
-	constructor(allowedRoots) {
-		this.allowedRoots = allowedRoots;
-	}
-	async listAllowedRoots() {
-		return [...this.allowedRoots()];
-	}
-	async browse({ path }) {
-		const real = await (0, node_fs_promises.realpath)(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
-		const entries = (await (0, node_fs_promises.readdir)(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
-			name: d.name,
-			path: (0, node_path.join)(real, d.name)
-		}));
-		const fs = await (0, node_fs_promises.statfs)(real);
-		const totalBytes = fs.blocks * fs.bsize;
-		return {
-			path: real,
-			entries,
-			freeBytes: fs.bavail * fs.bsize,
-			totalBytes
-		};
-	}
-	async createDir({ path }) {
-		const parent = (0, node_path.dirname)(path);
-		assertWithinAllowedRoots((0, node_path.join)(await (0, node_fs_promises.realpath)(parent).catch(() => parent), (0, node_path.basename)(path)), await this.resolvedRoots());
-		await (0, node_fs_promises.mkdir)(path, { recursive: true });
-		return { path };
-	}
-	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
-	async resolvedRoots() {
-		return Promise.all(this.allowedRoots().map((r) => (0, node_fs_promises.realpath)(r).catch(() => r)));
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage.addon.ts
 function defaultAllowedRoots() {
 	return [

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,10 +1,73 @@
-import { F as filesystemBrowseCapability, ft as BaseAddon, it as storageProviderCapability } from "../../dist-C7rPTQLR.mjs";
+import { F as filesystemBrowseCapability, ft as BaseAddon, it as storageProviderCapability } from "../../dist-BXqMB8EK.mjs";
 import * as fs from "node:fs";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
+//#region src/builtins/sqlite-storage/path-guard.ts
+/**
+* Allowed-root containment guard for the filesystem-browse cap. Pure +
+* synchronous so it is trivially unit-testable; the provider applies it AFTER
+* resolving the real path (so symlink escapes are also caught upstream).
+*/
+/** True iff `candidate` is one of, or nested under, an allowed root. */
+function isWithinAllowedRoots(candidate, allowedRoots) {
+	const norm = resolve(candidate);
+	return allowedRoots.some((root) => {
+		const r = resolve(root);
+		return norm === r || norm.startsWith(r.endsWith(sep) ? r : r + sep);
+	});
+}
+/** Throws unless `candidate` is within an allowed root. */
+function assertWithinAllowedRoots(candidate, allowedRoots) {
+	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
+}
+//#endregion
+//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
+/**
+* Per-node filesystem-browse provider. Lists/creates directories under
+* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
+* `filesystem-browse` cap so the admin UI can pick a node + path for a
+* node-local storage location.
+*/
+var FilesystemBrowseProvider = class {
+	allowedRoots;
+	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
+	constructor(allowedRoots) {
+		this.allowedRoots = allowedRoots;
+	}
+	async listAllowedRoots() {
+		return [...this.allowedRoots()];
+	}
+	async browse({ path }) {
+		const real = await realpath(path).catch(() => path);
+		assertWithinAllowedRoots(real, await this.resolvedRoots());
+		const entries = (await readdir(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
+			name: d.name,
+			path: join(real, d.name)
+		}));
+		const fs = await statfs(real);
+		const totalBytes = fs.blocks * fs.bsize;
+		return {
+			path: real,
+			entries,
+			freeBytes: fs.bavail * fs.bsize,
+			totalBytes
+		};
+	}
+	async createDir({ path }) {
+		const parent = dirname(path);
+		assertWithinAllowedRoots(join(await realpath(parent).catch(() => parent), basename(path)), await this.resolvedRoots());
+		await mkdir(path, { recursive: true });
+		return { path };
+	}
+	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
+	async resolvedRoots() {
+		return Promise.all(this.allowedRoots().map((r) => realpath(r).catch(() => r)));
+	}
+};
+//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage-provider.ts
 /**
 * Filesystem `storage-provider` (Task 7).
@@ -266,69 +329,6 @@ var FilesystemStorageProvider = class FilesystemStorageProvider {
 	}
 };
 //#endregion
-//#region src/builtins/sqlite-storage/path-guard.ts
-/**
-* Allowed-root containment guard for the filesystem-browse cap. Pure +
-* synchronous so it is trivially unit-testable; the provider applies it AFTER
-* resolving the real path (so symlink escapes are also caught upstream).
-*/
-/** True iff `candidate` is one of, or nested under, an allowed root. */
-function isWithinAllowedRoots(candidate, allowedRoots) {
-	const norm = resolve(candidate);
-	return allowedRoots.some((root) => {
-		const r = resolve(root);
-		return norm === r || norm.startsWith(r.endsWith(sep) ? r : r + sep);
-	});
-}
-/** Throws unless `candidate` is within an allowed root. */
-function assertWithinAllowedRoots(candidate, allowedRoots) {
-	if (!isWithinAllowedRoots(candidate, allowedRoots)) throw new Error(`path "${candidate}" is not within an allowed root`);
-}
-//#endregion
-//#region src/builtins/sqlite-storage/filesystem-browse-provider.ts
-/**
-* Per-node filesystem-browse provider. Lists/creates directories under
-* operator-configured allowed roots only (sandboxed by `path-guard`). Backs the
-* `filesystem-browse` cap so the admin UI can pick a node + path for a
-* node-local storage location.
-*/
-var FilesystemBrowseProvider = class {
-	allowedRoots;
-	/** allowedRoots is injected (read from addon config) so it stays per-node + testable. */
-	constructor(allowedRoots) {
-		this.allowedRoots = allowedRoots;
-	}
-	async listAllowedRoots() {
-		return [...this.allowedRoots()];
-	}
-	async browse({ path }) {
-		const real = await realpath(path).catch(() => path);
-		assertWithinAllowedRoots(real, await this.resolvedRoots());
-		const entries = (await readdir(real, { withFileTypes: true })).filter((d) => d.isDirectory()).map((d) => ({
-			name: d.name,
-			path: join(real, d.name)
-		}));
-		const fs = await statfs(real);
-		const totalBytes = fs.blocks * fs.bsize;
-		return {
-			path: real,
-			entries,
-			freeBytes: fs.bavail * fs.bsize,
-			totalBytes
-		};
-	}
-	async createDir({ path }) {
-		const parent = dirname(path);
-		assertWithinAllowedRoots(join(await realpath(parent).catch(() => parent), basename(path)), await this.resolvedRoots());
-		await mkdir(path, { recursive: true });
-		return { path };
-	}
-	/** Allowed roots with symlinks resolved (falls back to the raw root if it does not exist). */
-	async resolvedRoots() {
-		return Promise.all(this.allowedRoots().map((r) => realpath(r).catch(() => r)));
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/filesystem-storage.addon.ts
 function defaultAllowedRoots() {
 	return [

package/dist/builtins/sqlite-storage/index.d.ts

@@ -1,8 +1,7 @@
+export { ConfigStore } from './config-store.js';
+export type { DeviceRow } from './device-store.js';
+export { DeviceStore } from './device-store.js';
+export { FilesystemStorageAddon, FilesystemStorageAddon as default, } from './filesystem-storage.addon.js';
 export { FilesystemStorageProvider } from './filesystem-storage-provider.js';
-export { FilesystemStorageAddon } from './filesystem-storage.addon.js';
-export { SqliteSettingsBackend } from './sqlite-settings-backend.js';
 export { SqliteSettingsAddon } from './sqlite-settings.addon.js';
-export { DeviceStore } from './device-store.js';
-export type { DeviceRow } from './device-store.js';
-export { ConfigStore } from './config-store.js';
-export { FilesystemStorageAddon as default } from './filesystem-storage.addon.js';
+export { SqliteSettingsBackend } from './sqlite-settings-backend.js';

package/dist/builtins/sqlite-storage/index.js

@@ -5,26 +5,6 @@ Object.defineProperties(exports, {
 require("../../chunk-Cek0wNdY.js");
 const require_builtins_sqlite_storage_filesystem_storage_addon = require("./filesystem-storage.addon.js");
 const require_builtins_sqlite_storage_sqlite_settings_addon = require("./sqlite-settings.addon.js");
-//#region src/builtins/sqlite-storage/device-store.ts
-var DeviceStore = class {
-	db;
-	constructor(db) {
-		this.db = db;
-	}
-	insert(addonId, device) {
-		this.db.prepare(`INSERT INTO devices (addon_id, stable_id, type, name, parent_stable_id) VALUES (?, ?, ?, ?, ?)`).run(addonId, device.stableId, device.type, device.name, device.parentStableId);
-	}
-	listByAddon(addonId) {
-		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ?`).all(addonId);
-	}
-	listChildren(addonId, parentStableId) {
-		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ? AND parent_stable_id = ?`).all(addonId, parentStableId);
-	}
-	remove(addonId, stableId) {
-		this.db.prepare(`DELETE FROM devices WHERE addon_id = ? AND stable_id = ?`).run(addonId, stableId);
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {
 	db;
@@ -51,6 +31,26 @@ var ConfigStore = class {
 	}
 };
 //#endregion
+//#region src/builtins/sqlite-storage/device-store.ts
+var DeviceStore = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	insert(addonId, device) {
+		this.db.prepare(`INSERT INTO devices (addon_id, stable_id, type, name, parent_stable_id) VALUES (?, ?, ?, ?, ?)`).run(addonId, device.stableId, device.type, device.name, device.parentStableId);
+	}
+	listByAddon(addonId) {
+		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ?`).all(addonId);
+	}
+	listChildren(addonId, parentStableId) {
+		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ? AND parent_stable_id = ?`).all(addonId, parentStableId);
+	}
+	remove(addonId, stableId) {
+		this.db.prepare(`DELETE FROM devices WHERE addon_id = ? AND stable_id = ?`).run(addonId, stableId);
+	}
+};
+//#endregion
 exports.ConfigStore = ConfigStore;
 exports.ConfigStore$1 = ConfigStore;
 exports.DeviceStore = DeviceStore;

package/dist/builtins/sqlite-storage/index.mjs

@@ -1,25 +1,5 @@
 import { FilesystemStorageAddon, t as FilesystemStorageProvider } from "./filesystem-storage.addon.mjs";
 import { SqliteSettingsAddon, t as SqliteSettingsBackend } from "./sqlite-settings.addon.mjs";
-//#region src/builtins/sqlite-storage/device-store.ts
-var DeviceStore = class {
-	db;
-	constructor(db) {
-		this.db = db;
-	}
-	insert(addonId, device) {
-		this.db.prepare(`INSERT INTO devices (addon_id, stable_id, type, name, parent_stable_id) VALUES (?, ?, ?, ?, ?)`).run(addonId, device.stableId, device.type, device.name, device.parentStableId);
-	}
-	listByAddon(addonId) {
-		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ?`).all(addonId);
-	}
-	listChildren(addonId, parentStableId) {
-		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ? AND parent_stable_id = ?`).all(addonId, parentStableId);
-	}
-	remove(addonId, stableId) {
-		this.db.prepare(`DELETE FROM devices WHERE addon_id = ? AND stable_id = ?`).run(addonId, stableId);
-	}
-};
-//#endregion
 //#region src/builtins/sqlite-storage/config-store.ts
 var ConfigStore = class {
 	db;
@@ -46,4 +26,24 @@ var ConfigStore = class {
 	}
 };
 //#endregion
+//#region src/builtins/sqlite-storage/device-store.ts
+var DeviceStore = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	insert(addonId, device) {
+		this.db.prepare(`INSERT INTO devices (addon_id, stable_id, type, name, parent_stable_id) VALUES (?, ?, ?, ?, ?)`).run(addonId, device.stableId, device.type, device.name, device.parentStableId);
+	}
+	listByAddon(addonId) {
+		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ?`).all(addonId);
+	}
+	listChildren(addonId, parentStableId) {
+		return this.db.prepare(`SELECT stable_id as stableId, type, name, parent_stable_id as parentStableId, enabled FROM devices WHERE addon_id = ? AND parent_stable_id = ?`).all(addonId, parentStableId);
+	}
+	remove(addonId, stableId) {
+		this.db.prepare(`DELETE FROM devices WHERE addon_id = ? AND stable_id = ?`).run(addonId, stableId);
+	}
+};
+//#endregion
 export { ConfigStore, DeviceStore, FilesystemStorageAddon, FilesystemStorageAddon as default, FilesystemStorageProvider, SqliteSettingsAddon, SqliteSettingsBackend };

package/dist/builtins/sqlite-storage/integration-registry.d.ts

@@ -1,4 +1,4 @@
-import { Integration, PersistedDevice, CreateIntegrationInput, CreateDeviceInput, IIntegrationRegistry, ISettingsStoreProvider } from '@camstack/types';
+import { CreateDeviceInput, CreateIntegrationInput, IIntegrationRegistry, Integration, ISettingsStoreProvider, PersistedDevice } from '@camstack/types';
 export declare class IntegrationRegistry implements IIntegrationRegistry {
     private readonly store;
     constructor(backend: ISettingsStoreProvider);

package/dist/builtins/sqlite-storage/sqlite-settings-backend.d.ts

@@ -1,5 +1,5 @@
+import { CollectionColumn, CollectionIndex, DataStoreEngineInfo, HistogramBucket, ISettingsBackend, SettingsCountInput, SettingsDeleteInput, SettingsGetInput, SettingsHistogramInput, SettingsInsertInput, SettingsIsEmptyInput, SettingsQueryInput, SettingsRecord, SettingsSetInput, SettingsUpdateInput } from '@camstack/types';
 import { default as Database } from 'better-sqlite3';
-import { DataStoreEngineInfo, ISettingsBackend, SettingsRecord, SettingsGetInput, SettingsSetInput, SettingsQueryInput, SettingsInsertInput, SettingsUpdateInput, SettingsDeleteInput, SettingsCountInput, SettingsIsEmptyInput, SettingsHistogramInput, HistogramBucket, CollectionColumn, CollectionIndex } from '@camstack/types';
 import { MutationFilterInput } from './filter-compiler.js';
 /** Input for {@link SqliteSettingsBackend.deleteWhere}. */
 interface SettingsDeleteWhereInput {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_crypto = require("node:crypto");
 let better_sqlite3 = require("better-sqlite3");
 better_sqlite3 = require_chunk.__toESM(better_sqlite3);
@@ -743,10 +743,7 @@ var SqliteVectorIndex = class {
 				const dim = row.data["dim"];
 				const metric = row.data["metric"];
 				if (typeof dim !== "number") continue;
-				this.specs.set(row.id, {
-					dim,
-					metric: isMetric(metric) ? metric : "cosine"
-				});
+				await this.declareIndex(row.id, dim, isMetric(metric) ? metric : "cosine");
 			}
 			this.logger.info("vector-store index registry loaded", { meta: { indexes: this.specs.size } });
 		} catch (err) {

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { C as cosineSimilarity, Nt as parseJsonUnknown, St as asJsonObject, T as decodeVectorBase64, dt as errMsg, ft as BaseAddon, l as RUNTIME_DEFAULTS, lt as vectorDimFromBase64, ut as vectorStoreCapability, w as dataStoreProviderCapability } from "../../dist-C7rPTQLR.mjs";
+import { C as cosineSimilarity, Nt as parseJsonUnknown, St as asJsonObject, T as decodeVectorBase64, dt as errMsg, ft as BaseAddon, l as RUNTIME_DEFAULTS, lt as vectorDimFromBase64, ut as vectorStoreCapability, w as dataStoreProviderCapability } from "../../dist-BXqMB8EK.mjs";
 import { randomUUID } from "node:crypto";
 import Database from "better-sqlite3";
 //#region src/builtins/sqlite-storage/filter-compiler.ts
@@ -737,10 +737,7 @@ var SqliteVectorIndex = class {
 				const dim = row.data["dim"];
 				const metric = row.data["metric"];
 				if (typeof dim !== "number") continue;
-				this.specs.set(row.id, {
-					dim,
-					metric: isMetric(metric) ? metric : "cosine"
-				});
+				await this.declareIndex(row.id, dim, isMetric(metric) ? metric : "cosine");
 			}
 			this.logger.info("vector-store index registry loaded", { meta: { indexes: this.specs.size } });
 		} catch (err) {

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_fs_promises = require("node:fs/promises");

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { Mt as parseJsonObject, f as StorageLocationTypeSchema, ft as BaseAddon, rt as storageCapability, tt as settingsStoreCapability } from "../../dist-C7rPTQLR.mjs";
+import { Mt as parseJsonObject, f as StorageLocationTypeSchema, ft as BaseAddon, rt as storageCapability, tt as settingsStoreCapability } from "../../dist-BXqMB8EK.mjs";
 import * as path$1 from "node:path";
 import * as fs from "node:fs/promises";
 import { buildStorageLocationRegistry } from "@camstack/system";

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { dt as errMsg, ft as BaseAddon, kt as hydrateSchema } from "../../dist-C7rPTQLR.mjs";
+import { dt as errMsg, ft as BaseAddon, kt as hydrateSchema } from "../../dist-BXqMB8EK.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-CH0DyAwh.js");
+const require_dist = require("../../dist-DXLXjrho.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-C7rPTQLR.mjs";
+import { W as logDestinationCapability, ft as BaseAddon } from "../../dist-BXqMB8EK.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-C7rPTQLR.mjs → dist-BXqMB8EK.mjs}

@@ -12811,6 +12811,42 @@ var EventPruneCountsSchema = z.object({
 	object: z.number().int(),
 	audio: z.number().int()
 });
+/**
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
+*/
+var RebuildObjectEmbeddingsInput = z.object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: z.number().optional(),
+	since: z.number().optional(),
+	until: z.number().optional(),
+	/**
+	* Fraction added on EACH side of the detection box before cropping.
+	* ~0.2 (a 1.4x window) gives CLIP the surroundings it is trained on; 0 is
+	* the pixel-tight crop the first implementation used.
+	*/
+	cropMargin: z.number().min(0).max(4).optional(),
+	/** Square the window before extracting, so a tall subject is not squashed. */
+	square: z.boolean().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: z.number().int().positive().optional()
+});
+var RebuildObjectEmbeddingsResultSchema = z.object({
+	scanned: z.number(),
+	rebuilt: z.number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: z.number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: z.number(),
+	failed: z.number(),
+	/** False when the pass stopped at `maxTracks` with tracks left. */
+	complete: z.boolean()
+});
 var pipelineAnalyticsCapability = {
 	name: "pipeline-analytics",
 	scope: "device",
@@ -13083,7 +13119,12 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, z.array(ScoredObjectEventSchema).readonly())
+		searchObjectEvents: method(SearchObjectEventsInput, z.array(ScoredObjectEventSchema).readonly()),
+		rebuildObjectEmbeddings: method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
 	},
 	events: {
 		/**
@@ -27980,6 +28021,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.rebuildObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.relocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/{dist-CH0DyAwh.js → dist-DXLXjrho.js}

@@ -12811,6 +12811,42 @@ var EventPruneCountsSchema = zod.z.object({
 	object: zod.z.number().int(),
 	audio: zod.z.number().int()
 });
+/**
+* Re-embed stored tracks from their key frames.
+*
+* The reason this is an operator-callable method and not a migration script:
+* every knob that decides what a vector MEANS — encoder model, crop margin,
+* squaring — is only changeable if the existing vectors can be regenerated.
+* Mixing feature spaces in one index makes cosine scores incomparable, and the
+* symptom is a quality regression with no visible cause.
+*/
+var RebuildObjectEmbeddingsInput = zod.z.object({
+	/** Restrict to one camera. Omit for the whole fleet. */
+	deviceId: zod.z.number().optional(),
+	since: zod.z.number().optional(),
+	until: zod.z.number().optional(),
+	/**
+	* Fraction added on EACH side of the detection box before cropping.
+	* ~0.2 (a 1.4x window) gives CLIP the surroundings it is trained on; 0 is
+	* the pixel-tight crop the first implementation used.
+	*/
+	cropMargin: zod.z.number().min(0).max(4).optional(),
+	/** Square the window before extracting, so a tall subject is not squashed. */
+	square: zod.z.boolean().optional(),
+	/** Stop after this many tracks; the result reports whether more remain. */
+	maxTracks: zod.z.number().int().positive().optional()
+});
+var RebuildObjectEmbeddingsResultSchema = zod.z.object({
+	scanned: zod.z.number(),
+	rebuilt: zod.z.number(),
+	/** Tracks whose key frame is gone — nothing to re-embed from. */
+	missingKeyFrame: zod.z.number(),
+	/** Tracks with no usable detection box. */
+	missingBbox: zod.z.number(),
+	failed: zod.z.number(),
+	/** False when the pass stopped at `maxTracks` with tracks left. */
+	complete: zod.z.boolean()
+});
 var pipelineAnalyticsCapability = {
 	name: "pipeline-analytics",
 	scope: "device",
@@ -13083,7 +13119,12 @@ var pipelineAnalyticsCapability = {
 		* ObjectEvents by trackId. Returns up to `limit` events scored ≥
 		* `minScore`, sorted descending by score.
 		*/
-		searchObjectEvents: method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly())
+		searchObjectEvents: method(SearchObjectEventsInput, zod.z.array(ScoredObjectEventSchema).readonly()),
+		rebuildObjectEmbeddings: method(RebuildObjectEmbeddingsInput, RebuildObjectEmbeddingsResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			timeoutMs: 30 * 6e4
+		})
 	},
 	events: {
 		/**
@@ -27980,6 +28021,12 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.rebuildObjectEmbeddings": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.relocateMedia": {
 		capName: "pipeline-analytics",
 		capScope: "device",

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-Cek0wNdY.js");
-const require_dist = require("./dist-CH0DyAwh.js");
+const require_dist = require("./dist-DXLXjrho.js");
 const require_model_download_service = require("./model-download-service-hf0ookyy.js");
 const require_manifest_python_deps = require("./manifest-python-deps-BqE5j0-O.js");
 const require_resource_monitor = require("./resource-monitor-DNNomR-i.js");

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM$1, r as __exportAll, t as __commonJSMin$1 } from "./chunk-CNf5ZN-e.mjs";
-import { B as isVoidInput, Ct as asNumber, Et as emitDownForOwnedCaps, Ft as resolveCapMount, G as logLevelAtMost, H as lifecycleJobSchema, It as scopeKey, K as looseSchema, L as isArrayOutputSchema, Mt as parseJsonObject, Nt as parseJsonUnknown$1, Ot as expandCapMethods, P as extractNestedAddonId, Pt as readinessKey, Q as procedureAuthKey, R as isCollectionArrayMethod, Rt as EventCategory$1, St as asJsonObject$1, Tt as createEvent, V as kebabToCamel, Y as objectInputDeclaresAddonId, bt as ReadinessTimeoutError, c as METHOD_ACCESS_MAP, dt as errMsg$1, h as addonSettingsCapability, ht as DEVICE_STATUS_METHOD, l as RUNTIME_DEFAULTS, mt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pt as DATAPLANE_SECRET_HEADER$1, t as ALL_CAPABILITY_DEFINITIONS, wt as asString$1, yt as ReadinessRegistry, z as isObjectInput } from "./dist-C7rPTQLR.mjs";
+import { B as isVoidInput, Ct as asNumber, Et as emitDownForOwnedCaps, Ft as resolveCapMount, G as logLevelAtMost, H as lifecycleJobSchema, It as scopeKey, K as looseSchema, L as isArrayOutputSchema, Mt as parseJsonObject, Nt as parseJsonUnknown$1, Ot as expandCapMethods, P as extractNestedAddonId, Pt as readinessKey, Q as procedureAuthKey, R as isCollectionArrayMethod, Rt as EventCategory$1, St as asJsonObject$1, Tt as createEvent, V as kebabToCamel, Y as objectInputDeclaresAddonId, bt as ReadinessTimeoutError, c as METHOD_ACCESS_MAP, dt as errMsg$1, h as addonSettingsCapability, ht as DEVICE_STATUS_METHOD, l as RUNTIME_DEFAULTS, mt as DEVICE_SETTINGS_CONTRIBUTION_METHODS, pt as DATAPLANE_SECRET_HEADER$1, t as ALL_CAPABILITY_DEFINITIONS, wt as asString$1, yt as ReadinessRegistry, z as isObjectInput } from "./dist-BXqMB8EK.mjs";
 import { a as downloadModel, c as getModelFilePath, d as contentTypeFor, f as createAuthenticatedFileServer, h as resolveFilePath, i as downloadFile, l as isModelDownloaded, m as parseTokenizedUrl, n as collectModelFiles, o as ensureModel, p as parseRangeHeader, r as deleteModelFromDisk, s as fetchJson, t as ModelDownloadService, u as createFileDataPlaneHandler } from "./model-download-service-Cp9f4dk6.mjs";
 import { $ as buildNativeCapProxy, A as createHubCapForwardService, B as AGENT_CAP_FWD_ACTION, C as brokerTransportLink, Ct as resolveAddonClass, D as localProviderLink, E as ipcParentLink, F as createUdsLogger, G as callWithServiceDiscovery, H as CapRouteResolver, I as createUdsLoggerWithControl, J as UdsLocalTransportServer, K as createLocalTransport, L as LocalChildClient, M as createUdsEventBridge, N as createUdsEventBus, O as HUB_CAP_FWD_ACTION, P as udsChildLogToWorkerEntry, Q as encodeFrame, R as LocalChildRegistry, S as brokerCallForCap, St as runNpm, T as ipcChildLink, U as CapRouteError, V as AGENT_CAP_FWD_SERVICE, W as classifyCapRoute, X as localEndpointPath, Y as SocketChannel, Z as FrameDecoder, _ as createKernelHwAccel, _t as CapabilityHandle, a as getWorkerDeviceRegistry, b as __resetCapUsageRegistryForTests, bt as installManifestNativeDeps, c as setHubConnected, ct as NATIVE_PROVIDER_SERVICE_INFIX, d as getBrokerEventBus, dt as capBareAction, et as buildUdsNativeCapProxy, f as getMoleculerEventStats, ft as capServiceName, g as AddonDepsManager, gt as DeviceRegistry, h as subscribePassthrough, ht as serializeTypedArrays, i as createUdsAddonContext, it as mountNativeCapService, j as createParentUnownedCallHandler, k as HUB_CAP_FWD_SERVICE, l as EVENT_TOPIC_PREFIX, lt as capActionName, m as setNodeEventInterest, mt as deserializeTypedArrays, n as adaptBrokerToCluster, o as getOrInitReadinessRegistry, ot as createAddonService, p as registerEventBusService, pt as parseCapAction, q as UdsLocalTransportClient, r as createAddonContext, s as getOrInitReadinessRegistryForClient, st as validateProviderRegistrations, t as installManifestPythonDeps, tt as createBrokerDeviceManagerApi, u as clusterEventTopic, ut as capActionSuffix, v as resolveHwAccel, vt as CapabilityUnavailableError, w as buildLinkChain, wt as createAddonDataPlaneFacility, x as getCapUsageRegistry, xt as resolveNpmInvocation, y as CapUsageRegistry, yt as copyBundledNativeModules, z as UDS_NO_ROUTE_PREFIX } from "./manifest-python-deps-Ck4-9K9m.mjs";
 import { n as getSinglePidStats, t as getPidStats } from "./resource-monitor-BkP504Vq.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/system",
-  "version": "1.2.48",
+  "version": "1.2.50",
   "description": "Core addon for CamStack — builtins, pipeline, process management, auth, logging, events",
   "keywords": [
     "camstack",