@trillboards/edge-sdk 0.2.113 → 0.2.119

package/deploy/detector/bench/run_candidate.py

@@ -91,6 +91,7 @@ from box_units import (  # noqa: E402  (sibling module, stdlib-only on purpose)
 )
 from trillboards_detector.errors import ModelContractError  # noqa: E402
 from trillboards_detector.labels import (  # noqa: E402
+    BOX_UNITS_NORMALIZED,
     BOX_UNITS_PIXELS,
     BUILTIN_VOCABULARIES,
     ModelVocabulary,
@@ -554,7 +555,11 @@ class Frame:
 
 
 def synthesise_vocabulary(
-    name: str, class_names: "dict[int, str]", output_layout: str
+    name: str,
+    class_names: "dict[int, str]",
+    output_layout: str,
+    box_units: str = BOX_UNITS_PIXELS,
+    box_scale_to_pixels: float = 1.0,
 ) -> ModelVocabulary:
     """A ModelVocabulary over a model's OWN names, canonicalised the service's way.
 
@@ -602,7 +607,7 @@ def synthesise_vocabulary(
         # 0..1 boxes as 0..1; what it would lose is per-class detections on
         # padded frames, which is the signal to read the units verdict before
         # trusting that candidate's score.
-        onnx_variant=VariantContract(output_layout, BOX_UNITS_PIXELS, 1.0),
+        onnx_variant=VariantContract(output_layout, box_units, box_scale_to_pixels),
     )
 
 
@@ -827,6 +832,75 @@ def main() -> int:
     if units["refusal"]:
         raise SystemExit(f"REFUSING: {units['refusal']}")
 
+    # ── MEASURE THE UNITS, THEN DECODE WITH THEM ─────────────────────────────
+    #
+    # The pass above ran with the identity contract (`pixels`/1.0) ON PURPOSE:
+    # it is the only pair that scales nothing, so the graph's own box magnitudes
+    # reach `box_abs_max` untouched and the classifier sees what the model
+    # actually emitted. What was missing is the second half — USING the answer.
+    #
+    # For a NORMALISED artifact the identity decode reads 0..1 boxes as pixels,
+    # and un-letterboxing then subtracts the pad offset from a sub-pixel box and
+    # pushes it out of frame. On a SQUARE source there is no padding and nothing
+    # is lost; on any other aspect ratio EVERY detection is dropped, silently,
+    # and the run reports a model that fires on nothing.
+    #
+    # That is not hypothetical. `fall_1cls_11x` is the one normalised ONNX
+    # artifact in the registry, and `fall-2026-08-25` scored it on 14 positives
+    # that are 1024x1024 SQUARE against 80 negatives that are 640x480. The
+    # positives survived, the negatives were all dropped, and the card published
+    # `precision 1.0` with `fire_rate_on_labelled_empty: 0` — a measurement of
+    # the harness's blind spot wearing the model's name. Measured 2026-08-28:
+    # the same 80 frames score up to 0.9400 through the SERVICE's decode, which
+    # reads the declared contract, against a published operating threshold of
+    # 0.8616873025894165.
+    #
+    # So a normalised verdict re-runs the scored pass with the measured contract.
+    # It costs a second pass on the artifacts that need one and nothing on the
+    # ones that do not, and it cannot flatter a candidate: the second pass is the
+    # decode the SERVICE would use, and it can only ADD detections the first pass
+    # was unable to represent — including on negatives.
+    decoded_units = BOX_UNITS_PIXELS
+    redecoded = False
+    if units["units"] == BOX_UNITS_NORMALIZED and isinstance(runner, ShippedRunner) and declared_names:
+        redecoded = True
+        runner = ShippedRunner(
+            model_path,
+            synthesise_vocabulary(
+                args.candidate, declared_names, loadability["output_layout"],
+                BOX_UNITS_NORMALIZED, float(units["scale_to_pixels"]),
+            ),
+        )
+        detections = {}
+        infer_ms = []
+        wall_ms = []
+        for key in keys:
+            frame = Frame(frames_dir / os.path.basename(key))
+            started = time.perf_counter()
+            per_class, ms, _box_max = runner.run(frame, args.conf_floor)
+            wall_ms.append((time.perf_counter() - started) * 1000.0)
+            infer_ms.append(ms)
+            detections[key] = per_class
+            frame.release()
+        decoded_units = BOX_UNITS_NORMALIZED
+        sys.stderr.write(
+            f"  re-decoded {len(keys)} frame(s) with the MEASURED contract "
+            f"({BOX_UNITS_NORMALIZED} x{units['scale_to_pixels']:g}); the first pass used the identity "
+            "to measure the units and could not represent this artifact's boxes\n"
+        )
+    elif units["units"] == BOX_UNITS_NORMALIZED:
+        # No path to a correct decode from here: either the graph declares no
+        # names to synthesise a vocabulary from, or the runner is not the shipped
+        # one. REFUSE rather than emit a run whose detections were decoded with
+        # units the same run reports as wrong — that combination is what produced
+        # `fall_1cls_11x`'s card.
+        raise SystemExit(
+            f"REFUSING: {model_path.name} emits NORMALIZED boxes (ratio {units['ratio']:.4f}) and this "
+            "runner cannot be rebuilt with that contract, so every detection on a non-square frame was "
+            "silently dropped. Score it through the detector service instead: "
+            "node trillboard-api/scripts/sensing/score-venue-corpus.js --model <id> --sweep"
+        )
+
     same_source = bool(rss_before and rss_after_probe and rss_before[1] == rss_after_probe[1])
     rss = {
         "source": rss_before[1] if rss_before else None,
@@ -855,6 +929,17 @@ def main() -> int:
             "sha256": sha256_file(model_path),
             "bytes": model_path.stat().st_size,
         },
+        "decode": {
+            "units_measured": units["units"],
+            "units_decoded_with": decoded_units,
+            "rescored_after_measuring_units": redecoded,
+            "why": (
+                "The scored pass is decoded with the units the run MEASURED, not with the identity it "
+                "measured them with. A normalized artifact decoded as pixels loses every detection on a "
+                "letterbox-padded frame and keeps them on a square one, which is a property of the eval "
+                "set's aspect ratios and not of the model."
+            ),
+        },
         "eval_set_manifest": {
             "path": str(manifest_path),
             "sha256": sha256_file(manifest_path),

package/deploy/detector/tests/test_class_ownership.py

@@ -0,0 +1,126 @@
+"""Who answers a class when two models on one box can both emit it.
+
+`BUILTIN_VOCABULARIES` states the principle — "a class stays on the model it
+was SCORED on" — and used catalogue position as the mechanism. Position is a
+proxy and it had already failed in the shipped catalogue: `fall detected` is
+named by `ppe_vyra_14cls_v8m` (position 3) and by `fall_1cls_11x` (position 6),
+so order handed falls to vyra, whose score card fitted that class at the 0.05
+FLOOR on 1 hit of a HARDHAT corpus, while the model actually scored on
+`person_fall` — 18/94, fitted threshold 0.8783 — sat idle on the same box.
+
+Nothing about that is visible downstream. Both models emit real boxes with
+plausible confidences; the only difference is a threshold nobody fitted, on a
+class nobody scored, and every health surface stays green.
+
+So ownership is now DECLARED (`ModelVocabulary.owns`) and position decides only
+what no model declares. These tests pin the three things that can silently
+regress: the declared owner wins, an absent declarer does not black-hole its
+class, and two declarers is an error rather than a coin flip.
+"""
+
+from __future__ import annotations
+
+import unittest
+
+from trillboards_detector.labels import (
+    BUILTIN_VOCABULARIES,
+    ClassIndex,
+    ModelVocabulary,
+    VariantContract,
+    normalize_class_name,
+)
+
+_VARIANT = VariantContract(
+    output_layout="anchor_4_plus_nc", box_units="normalized", box_scale_to_pixels=640.0
+)
+
+
+def _vocab(name, classes, owns=frozenset()):
+    return ModelVocabulary(
+        model_name=name,
+        slot_names={i: c for i, c in enumerate(classes)},
+        logit_slots=len(classes),
+        approx_ram_bytes=1,
+        onnx_variant=_VARIANT,
+        owns=owns,
+    )
+
+
+class DeclaredOwnershipTest(unittest.TestCase):
+    def test_declared_owner_beats_catalogue_order(self):
+        general = _vocab("general", ["person", "fall detected"])
+        specialist = _vocab("specialist", ["fall detected"], owns=frozenset({"fall detected"}))
+        # `general` is FIRST, which is what used to decide it.
+        index = ClassIndex([general, specialist])
+        self.assertEqual(index.owner_of("fall detected"), "specialist")
+        self.assertEqual(index.owner_of("person"), "general")
+
+    def test_position_still_decides_what_nobody_declares(self):
+        a = _vocab("a", ["mask", "gloves"])
+        b = _vocab("b", ["mask"])
+        self.assertEqual(ClassIndex([a, b]).owner_of("mask"), "a")
+        self.assertEqual(ClassIndex([b, a]).owner_of("mask"), "b")
+
+    def test_a_declarer_that_is_not_resident_owns_nothing(self):
+        # `ClassIndex` is built over models whose artifact is ON THE BOX. If the
+        # specialist has not arrived, its class must fall through to the model
+        # that is actually there rather than becoming unanswerable.
+        general = _vocab("general", ["person", "fall detected"])
+        index = ClassIndex([general])
+        self.assertEqual(index.owner_of("fall detected"), "general")
+        self.assertIn("fall detected", index.class_names)
+
+    def test_two_declarers_is_an_error_not_a_coin_flip(self):
+        a = _vocab("a", ["fire"], owns=frozenset({"fire"}))
+        b = _vocab("b", ["fire"], owns=frozenset({"fire"}))
+        with self.assertRaisesRegex(ValueError, "one authority"):
+            ClassIndex([a, b])
+
+    def test_a_model_cannot_own_a_class_it_cannot_emit(self):
+        with self.assertRaisesRegex(ValueError, "not one of its own classes"):
+            _vocab("a", ["person"], owns=frozenset({"forklift"}))
+
+    def test_owned_names_must_be_canonical(self):
+        # `owner_of` keys on the canonical name, so `fall_detected` here would
+        # own nothing at all while looking correct in the source.
+        with self.assertRaisesRegex(ValueError, "not canonical"):
+            _vocab("a", ["fall detected"], owns=frozenset({"fall_detected"}))
+
+
+class ShippedCatalogueTest(unittest.TestCase):
+    """The catalogue as it ships, so a new model cannot quietly take a class."""
+
+    def test_every_owned_class_is_canonical_and_emittable(self):
+        for vocabulary in BUILTIN_VOCABULARIES:
+            for owned in vocabulary.owns:
+                self.assertEqual(owned, normalize_class_name(owned), vocabulary.model_name)
+                self.assertIn(owned, vocabulary.class_names, vocabulary.model_name)
+
+    def test_the_scored_model_owns_its_class(self):
+        index = ClassIndex(BUILTIN_VOCABULARIES)
+        # Each of these is a class whose fitted threshold lives on exactly one
+        # model's score card, and which at least one OTHER model also emits.
+        self.assertEqual(index.owner_of("fall detected"), "fall_1cls_11x")
+        self.assertEqual(index.owner_of("person"), "rfdetr_medium")
+        self.assertEqual(index.owner_of("hardhat"), "ppe_vyra_14cls_v8m")
+
+    def test_declaration_changes_exactly_one_ownership(self):
+        # The blast radius, asserted rather than assumed: `owns` is a correction
+        # to one class, not a re-shuffle of a 124-class union. If a future model
+        # moves a second class, that is a decision someone must make on purpose.
+        index = ClassIndex(BUILTIN_VOCABULARIES)
+        by_position: dict[str, str] = {}
+        for vocabulary in BUILTIN_VOCABULARIES:
+            for name in sorted(vocabulary.class_names):
+                by_position.setdefault(name, vocabulary.model_name)
+        moved = {n: (b, index.owner_of(n)) for n, b in by_position.items() if b != index.owner_of(n)}
+        self.assertEqual(moved, {"fall detected": ("ppe_vyra_14cls_v8m", "fall_1cls_11x")})
+
+    def test_no_class_is_left_without_an_owner(self):
+        index = ClassIndex(BUILTIN_VOCABULARIES)
+        for name in index.class_names:
+            self.assertIsNotNone(index.owner_of(name), name)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/deploy/detector/trillboards_detector/labels.py

@@ -275,6 +275,26 @@ class ModelVocabulary:
     #: axis over. A model whose output layout is inferred is a model whose boxes
     #: are plausible and wrong.
     onnx_variant: "VariantContract"
+    #: The classes THIS model is the authority for, canonical spelling.
+    #:
+    #: The box-side copy of a relation the registry already holds: a model earns
+    #: a class by declaring `<class>_present` / `<class>_count` in its
+    #: `outputs_schema`, which is also the field its FITTED threshold hangs off
+    #: in `liveness_evidence.classes`. Same discipline as `slot_names` and
+    #: `onnx_variant` — the registry row is the authority, this is the copy the
+    #: service reads because there is no PostgreSQL on a shop PC, and check 10
+    #: of `check-sensing-model-publish-gate.js` fails the build when they drift.
+    #:
+    #: WHY THIS EXISTS RATHER THAN CATALOGUE ORDER. `BUILTIN_VOCABULARIES` states
+    #: the right principle — a class stays on the model it was SCORED on — and
+    #: position is a proxy for it that has already failed once. `fall detected`
+    #: is named by `ppe_vyra_14cls_v8m` (position 3) and by `fall_1cls_11x`
+    #: (position 6), so order hands falls to vyra, whose score card fitted that
+    #: class at the 0.05 FLOOR on 1 hit of a hardhat corpus, while the model
+    #: actually scored on `person_fall` — 18/94, fitted 0.8783 — sits idle. A
+    #: threshold nobody fitted, on plausible boxes, with every health surface
+    #: green. Declaration is the in-band signal position was standing in for.
+    owns: "frozenset[str]" = frozenset()
 
     def __post_init__(self) -> None:
         # The model name IS A DIRECTORY NAME — `resolve_model_path` puts the
@@ -310,6 +330,19 @@ class ModelVocabulary:
                     f"{self.model_name}: class name {name!r} is not canonical "
                     f"(expected {normalize_class_name(name)!r})"
                 )
+        for owned in sorted(self.owns):
+            # A model cannot be the authority for a class it cannot emit, and an
+            # un-canonical entry here would silently own nothing — `ClassIndex`
+            # keys on the canonical name.
+            if normalize_class_name(owned) != owned:
+                raise ValueError(
+                    f"{self.model_name}: owned class {owned!r} is not canonical "
+                    f"(expected {normalize_class_name(owned)!r})"
+                )
+            if owned not in set(self.slot_names.values()):
+                raise ValueError(
+                    f"{self.model_name}: claims to own {owned!r}, which is not one of its own classes"
+                )
         if len(set(self.slot_names.values())) != len(self.slot_names):
             raise ValueError(f"{self.model_name}: two slots share one class name, so a filter would be ambiguous")
 
@@ -330,6 +363,7 @@ RFDETR_MEDIUM = ModelVocabulary(
     logit_slots=EXPECTED_LOGIT_SLOTS,
     approx_ram_bytes=632 * 1024 * 1024,
     onnx_variant=RFDETR_MEDIUM_ONNX,
+    owns=frozenset({"person"}),
 )
 
 #: Every model this build knows how to label, IN PRIORITY ORDER.
@@ -367,6 +401,7 @@ GH_FORKLIFT_COMBINE = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"forklift"}),
 )
 
 #: PPE Detector (hard hat) — published 2026-08-25 by
@@ -401,6 +436,7 @@ PPE_VYRA_14CLS_V8M = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"hardhat"}),
 )
 
 #: Heavy Machinery Detector — published 2026-08-25 by
@@ -438,6 +474,7 @@ PPE_CONSTRUCTION_17CLS_V8N = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"excavators"}),
 )
 
 #: Fire-Safety Detector — published 2026-08-25 by
@@ -477,6 +514,7 @@ PPE_KILLUMINATI_19CLS_V8S = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"fire extinguisher"}),
 )
 
 #: FIVE SPECIALISTS WERE SCORED; FOUR ARE HERE. `gh_fall_tonlong` IS ABSENT ON
@@ -542,6 +580,7 @@ FALL_1CLS_11X = ModelVocabulary(
         box_units="normalized",
         box_scale_to_pixels=640.0,
     ),
+    owns=frozenset({"fall detected"}),
 )
 
 #: Heavy Machinery Detector (venue-adjudicated) — published 2026-08-27 by
@@ -572,6 +611,7 @@ GH_PPE_VINAYAK_L = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"machinery"}),
 )
 
 #: Fire and Smoke Detector — published 2026-08-27 by
@@ -594,6 +634,7 @@ FIRE_SMOKE_WESLLEYSKAH_11N = ModelVocabulary(
         box_units="pixels",
         box_scale_to_pixels=1.0,
     ),
+    owns=frozenset({"fire", "smoke"}),
 )
 
 BUILTIN_VOCABULARIES: "tuple[ModelVocabulary, ...]" = (RFDETR_MEDIUM, GH_FORKLIFT_COMBINE, PPE_VYRA_14CLS_V8M, PPE_CONSTRUCTION_17CLS_V8N, PPE_KILLUMINATI_19CLS_V8S, FALL_1CLS_11X, GH_PPE_VINAYAK_L, FIRE_SMOKE_WESLLEYSKAH_11N,)
@@ -611,11 +652,27 @@ class ClassIndex:
     def __init__(self, vocabularies: "Sequence[ModelVocabulary]"):
         self._vocabularies = tuple(vocabularies)
         owner: "dict[str, str]" = {}
+        # DECLARED ownership first, and it is exclusive. `owns` is the class a
+        # model was scored on, so this is the principle the catalogue order was
+        # standing in for, applied directly. Two models declaring one class is
+        # unresolvable rather than arbitrary, so it raises here instead of
+        # letting whichever sorted first answer at whatever threshold it carries.
+        for vocabulary in self._vocabularies:
+            for name in sorted(vocabulary.owns):
+                if name in owner:
+                    raise ValueError(
+                        f"{name!r} is declared owned by both {owner[name]} and "
+                        f"{vocabulary.model_name}; a class has one authority"
+                    )
+                owner[name] = vocabulary.model_name
         for vocabulary in self._vocabularies:
             for name in sorted(vocabulary.class_names):
-                # First-in-catalogue-order wins. `setdefault`, not assignment:
-                # a later specialist must not capture a class an earlier model
-                # already owns.
+                # Catalogue order for everything NOBODY declares — a class no
+                # model was scored on has no principled owner, and order at
+                # least keeps it stable. `setdefault`, not assignment: a later
+                # specialist must not capture a class an earlier model already
+                # owns. A declarer that is not RESIDENT owns nothing, so its
+                # class falls through to the best model actually on the box.
                 owner.setdefault(name, vocabulary.model_name)
         if len({v.model_name for v in self._vocabularies}) != len(self._vocabularies):
             raise ValueError("two vocabularies share one model name")

package/dist/ChannelProber.d.ts

@@ -112,7 +112,12 @@ export declare function brandPathCandidates(brand: string | undefined, ch: numbe
 export declare function credentialFreePathTemplate(pathValue: string, brand: string | undefined): string;
 /** Restore a credential-free path recipe while writing the local-only config. */
 export declare function materializeCredentialPathTemplate(pathTemplate: string, username: string, password: string): string;
-/** Percent-encode credentials into an rtsp:// URL (the Hiten `pass@123` class). */
+/**
+ * Build an RTSP URL without duplicating a vendor's in-path authentication.
+ * Ordinary recorders keep RFC userinfo with percent-encoded credentials.
+ * XMEye/NETSurveillance paths already carry both values and older firmware
+ * rejects the same login when it is also repeated in the URL authority.
+ */
 export declare function buildRtspUrl(host: string, port: number, path: string, username: string, password: string): string;
 /** Inject creds into an ONVIF-returned rtsp URI (they usually come credless). */
 export declare function injectCreds(uri: string, username: string, password: string): string;

package/dist/ChannelProber.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChannelProber.d.ts","sourceRoot":"","sources":["../src/ChannelProber.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAMtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,UAAU,GACV,WAAW,GACX,cAAc,GACd,eAAe,CAAC;AAEpB,KAAK,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAMnC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAOT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsDxF;AAMD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,EAAE,EAAE,MAAM,EACV,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnD,MAAM,EAAE,CAuIV;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM/F;AAED,iFAAiF;AACjF,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CAIR;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKjH;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASnF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAyB5F;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc1D;AA0DD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,EACE,UAAU,EACV,SAAiB,EACjB,OAAe,EACf,SAAiB,GAClB,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAAO,GACrG,OAAO,CAAC,SAAS,CAAC,CAuEpB;AAWD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GACxE,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQpF;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA8BzG;AAqCD;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6gB3G"}
+{"version":3,"file":"ChannelProber.d.ts","sourceRoot":"","sources":["../src/ChannelProber.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAMtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,gBAAgB,GAChB,kBAAkB,GAClB,cAAc,GACd,UAAU,GACV,UAAU,GACV,WAAW,GACX,cAAc,GACd,eAAe,CAAC;AAEpB,KAAK,aAAa,GAAG,KAAK,GAAG,KAAK,CAAC;AAMnC,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE;IACnC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,MAAM,CAOT;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsDxF;AAMD,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,EAAE,EAAE,MAAM,EACV,WAAW,CAAC,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACnD,MAAM,EAAE,CA6IV;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM/F;AAeD,iFAAiF;AACjF,wBAAgB,iCAAiC,CAC/C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,MAAM,CASR;AAQD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQjH;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CASnF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAyB5F;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIjE;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc1D;AA0DD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAmB,SAAQ,SAAS;IACnD,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,EACE,UAAU,EACV,SAAiB,EACjB,OAAe,EACf,SAAiB,GAClB,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAAO,GACrG,OAAO,CAAC,SAAS,CAAC,CAuEpB;AAWD,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAA;CAAE,GACxE,OAAO,CAAC,kBAAkB,CAAC,CAmB7B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQpF;AAED,oEAAoE;AACpE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,YAAY,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA8BzG;AAqCD;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA6gB3G"}

package/dist/ChannelProber.js

@@ -160,12 +160,10 @@ function brandPathCandidates(brand, ch, credentials) {
         `/ch${String(ch).padStart(2, '0')}/0`,
     ];
     const uniview = [`/unicast/c${ch}/s1/live`, `/unicast/c${ch}/s0/live`];
-    const xmeyeUser = encodeURIComponent(credentials?.username ?? 'admin');
-    const xmeyePassword = encodeURIComponent(credentials?.password ?? '');
     const hanwha = [`/LiveChannel/${Math.max(0, ch - 1)}/media.smp`];
     const xmeye = [
-        `/user=${xmeyeUser}&password=${xmeyePassword}&channel=${ch}&stream=1.sdp?real_stream`,
-        `/user=${xmeyeUser}&password=${xmeyePassword}&channel=${ch}&stream=0.sdp?real_stream`,
+        materializeCredentialPathTemplate(`/user={username}&password={password}&channel=${ch}&stream=1.sdp?real_stream`, credentials?.username ?? 'admin', credentials?.password ?? ''),
+        materializeCredentialPathTemplate(`/user={username}&password={password}&channel=${ch}&stream=0.sdp?real_stream`, credentials?.username ?? 'admin', credentials?.password ?? ''),
     ];
     const h264Preview = [
         `/h264Preview_${String(ch).padStart(2, '0')}_sub`,
@@ -286,17 +284,45 @@ function credentialFreePathTemplate(pathValue, brand) {
         return pathValue;
     return pathValue.replace(/^\/user=[^&]*&password=[^&]*(&channel=)/i, '/user={username}&password={password}$1');
 }
+function canUseLegacyXmeyePathCredential(value) {
+    // Old NETSurveillance/Xiongmai firmware parses these values itself instead
+    // of URL-decoding them. In the field, a password containing `@` worked only
+    // as a literal path value and was rejected as `%40`. Keep that compatibility
+    // fallback deliberately narrow: delimiters/control characters would change
+    // the request target and therefore remain percent-encoded.
+    return !/[&?#%/=\s\u0000-\u001f\u007f]/.test(value);
+}
+function isXmeyeCredentialPathTemplate(pathTemplate) {
+    return /^\/user=\{username\}&password=\{password\}&channel=/i.test(pathTemplate);
+}
 /** Restore a credential-free path recipe while writing the local-only config. */
 function materializeCredentialPathTemplate(pathTemplate, username, password) {
+    const legacyRaw = isXmeyeCredentialPathTemplate(pathTemplate) &&
+        canUseLegacyXmeyePathCredential(username) &&
+        canUseLegacyXmeyePathCredential(password);
+    const materialize = (value) => legacyRaw ? value : encodeURIComponent(value);
     return pathTemplate
-        .replace(/\{username\}/g, encodeURIComponent(username))
-        .replace(/\{password\}/g, encodeURIComponent(password));
+        .replace(/\{username\}/g, materialize(username))
+        .replace(/\{password\}/g, materialize(password));
 }
-/** Percent-encode credentials into an rtsp:// URL (the Hiten `pass@123` class). */
+function pathCarriesCredentials(pathValue) {
+    const hasUser = /(^|[?&/])(user|username|usr)=[^&#]*/i.test(pathValue);
+    const hasPassword = /(^|[?&/])(password|passwd|pwd|pass)=[^&#]*/i.test(pathValue);
+    return hasUser && hasPassword;
+}
+/**
+ * Build an RTSP URL without duplicating a vendor's in-path authentication.
+ * Ordinary recorders keep RFC userinfo with percent-encoded credentials.
+ * XMEye/NETSurveillance paths already carry both values and older firmware
+ * rejects the same login when it is also repeated in the URL authority.
+ */
 function buildRtspUrl(host, port, path, username, password) {
+    const norm = path.startsWith('/') ? path : `/${path}`;
+    if (pathCarriesCredentials(norm)) {
+        return `rtsp://${host}:${port}${norm}`;
+    }
     const u = encodeURIComponent(username);
     const p = encodeURIComponent(password);
-    const norm = path.startsWith('/') ? path : `/${path}`;
     return `rtsp://${u}:${p}@${host}:${port}${norm}`;
 }
 /** Inject creds into an ONVIF-returned rtsp URI (they usually come credless). */